Re: Reducing ADAM Accesses

The ADAM rootDSE tokenGroups attribute is a single search you can perform
that will give you the SIDs of all of the groups that the currently bound
user is a member of, including both Windows and ADAM groups if the currently
bound user is a Windows user.

I'd suggest trying it out to learn more about how it works and how it might
help you.

Once you have the SIDs, you can either resolve those into friendly names if
you need to or just use them directly, in which case you are basically done
and don't need to make any additional calls. I'd also suggest caching this
info so you don't need to perform this operation frequently.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Phran" <Phran@xxxxxxxxxxxxxxx> wrote in message
news:6669ADE3-E0CE-4BA4-B062-852D58EE9964@xxxxxxxxxxxxxxxx
Hi Joe, thanks for this suggestion. I have looked at some documentation on
MSDN but I can't find anything obvious that seems to cover reducing
traffic.
Was there anything in particular that you had in mind?

"Joe Kaplan" wrote:

Have you looked at the ADAM tokenGroups attribute on RootDSE?

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Phran" <Phran@xxxxxxxxxxxxxxx> wrote in message
news:E517F220-2215-4955-8B49-FE6E89F8ED99@xxxxxxxxxxxxxxxx
Hello, I have a question about reducing the number of trips to query
group
membership held in and ADAM.

Below is some code that I have butchered from a sample to keep things
simple. The code is intended to bind to a user object and then to
iterate
over the group memberships of that user - in order to find out whether
the
user is a member of a group. If I was to call this code repeatedly for
the
same user it seems to me that there would be repeated binds to the ADAM
followed by repeated iterations of over the group membership.

What suggestions do people have about reducing the number of trips to
the
ADAM?


ADsOpenObject(..., (void **)&pIADsUser);

IADsMembers *pIADsMembers;
pIADsUser->Groups(&pIADsMembers)));

pIADsMembers->get__NewEnum(&pUnk);
hr = pUnk->QueryInterface(IID_IEnumVARIANT,(void**)&pEnum);

while (SUCCEEDED(hr) && hr != S_FALSE)
{
hr = pEnum->Next(1, &Variant, &ulElementsFetched)));

// hr = false if there is no next
if (hr != S_FALSE)
{
IDispatch *pDispatch = NULL;
IADsGroup *pIADsGroup = NULL;
hr = pDispatch->QueryInterface(IID_IADsGroup,(VOID **) &pIADsGroup))) ;

pIADsGroup->get_ADsPath(&groupNameBstr);

}

}





.

Relevant Pages

  • Re: AD Schema Extension Question
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... The ADAM instances could be ...
    (microsoft.public.windows.server.active_directory)
  • Re: Getting all security groups without a token?
    ... I think this will work on a Win2K domain although I don't know if these APIs ... member machine as it will auth to AD as the computer account for the member ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.platformsdk.security)
  • Re: Changing ADAM user password
    ... setting in ADAM, but it was removed to make ADAM "secure by default". ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... DirectoryEntry changeEntry = new DirectoryEntry(ldapPath, userID, ...
    (microsoft.public.windows.server.active_directory)
  • Re: LDAP Bind to ADAM user - bad-pwd-count not being set.
    ... There are definitely a ton of useful things you can do with ADAM ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... The basic functionality is working fine, correct passwords and user DNs ...
    (microsoft.public.dotnet.security)
  • Re: Setting Empty Property Values in ADAM
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... The ADAM schema was a copy of AD, ...
    (microsoft.public.windows.server.active_directory)