Re: domain name/LDAP redundancy

Andy Wolsten wrote:

I am trying to develop some redundancy in to one of our in house
applications which relies on contacting Active Directory for usernames and
other info via LDAP.

The app currently contacts one of the DC's for the LDAP search however,
this
obviously presents a single point of failure.

I am under the impression that i can use the actual domain name for
contacting a DC e.g. domain.inside Does this return a list of available
DC's,
or does it return the local one? I am trying to end with a situation where
the application does not fail if the local DC is down, and automatically
redirects to another local/remote DC.

There should be no need to specify a DC. I use the RootDSE object to
retrieve the DNS name of the domain and bind to that with a serverless
binding string. The nearest DC responds. For example, this VBScript program
uses ADO to retrieve the Distinguished Names of all users in the domain. It
can be modified to retrieve other information:
===============
Option Explicit

Dim adoCommand, adoConnection, strBase, strFilter, strAttributes

Dim objRootDSE, strDNSDomain, strQuery, adoRecordset, strDN



' Setup ADO objects.

Set adoCommand = CreateObject("ADODB.Command")
Set adoConnection = CreateObject("ADODB.Connection")
adoConnection.Provider = "ADsDSOObject"
adoConnection.Open "Active Directory Provider"
adoCommand.ActiveConnection = adoConnection



' Search entire Active Directory domain.

Set objRootDSE = GetObject("LDAP://RootDSE";)

strDNSDomain = objRootDSE.Get("defaultNamingContext")
strBase = "<LDAP://"; & strDNSDomain & ">"


' Filter on user objects.
strFilter = "(&(objectCategory=person)(objectClass=user))"



' Comma delimited list of attribute values to retrieve.
strAttributes = "distinguishedName"



' Construct the LDAP syntax query.
strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree"
adoCommand.CommandText = strQuery
adoCommand.Properties("Page Size") = 100
adoCommand.Properties("Timeout") = 30
adoCommand.Properties("Cache Results") = False



' Run the query.
Set adoRecordset = adoCommand.Execute


' Enumerate the resulting recordset.
Do Until adoRecordset.EOF

' Retrieve values and display.
strDN = adoRecordset.Fields("distinguishedName").Value

Wscript.Echo strDN

' Move to the next record in the recordset.
adoRecordset.MoveNext
Loop



' Clean up.

adoRecordset.Close

adoConnection.Close

=========

This code will run in any domain, so long as the user is authenticated to
the domain. The nearest DC responds to the query.


--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--


.

Relevant Pages

  • Employeenumber in AD
    ... I am in charge of an integration of the employee number from another ... application into Active directory. ... A third application will be using ldap to ... retrieve this information along with other info stored in AD. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Active directory users and associated groups
    ... >those users associated with that group using Active Directory using LDAP?? ... You mean retrieve all the users that are MEMBER of that group, ...
    (microsoft.public.dotnet.languages.csharp)
  • Active directory users and associated groups
    ... can anyone please tell me how I can retrieve just ... those users associated with that group using Active Directory using LDAP?? ... TIA ...
    (microsoft.public.dotnet.languages.csharp)
  • Active directory: Get users associated with groups
    ... can anyone please tell me how I can retrieve just ... those users associated with that group using Active Directory using LDAP?? ... TIA ...
    (microsoft.public.dotnet.general)
  • RE: LDAP + Active Directory
    ... Subject: LDAP + Active Directory ... LDAP uses an anonymous access for reading the tree, ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)