How to get all members of AD group via LDAP in Java

Question

I have written an application that retrieves Active Directory groups and flattens them, i.e. includes recursively members of subgroup to the top parent group. It works fine for small groups, but with larger groups I am facing a problem.

If number of members does not exceed 1500, they are listed in the member attribute. If there are more - then this attribute is empty and attribute with name member;range:0-1499 appears, containing first 1500 members.

My problem that I don't know how to get the rest of member set over 1500. We have groups with 8-12 thousand members. Do I need to run another query? On the Microsoft site I have seen C# code snippet on the similar matter, but couldn't make much sense of it, as they were showing how to specify a range, but not how to plug it into query. If someone knows how to do it in Java, I'd appreciate a tip.

This might be useful https://stackoverflow.com/questions/22355213/retrieve-all-members-of-large-ad-groups — J. Knight, Jun 22 '17 at 23:32
Possible duplicate of [Retrieve All Members of Large AD Groups](https://stackoverflow.com/questions/22355213/retrieve-all-members-of-large-ad-groups) — Esteban, Jun 23 '17 at 07:05
I am trying to create similar working code, can you please pass on me the working example, what is "ldapBaseDn" used here? — Karthik P, Dec 20 '21 at 12:57

score 2 · Accepted Answer · edited Jul 28 '17 at 11:42

2

This will obviously give you the next ones:

String[] returnedAtts = { "member;range=1500-2999" };

You need to fetch the users chunk by chunk (1500 chunks) Just make a counter and update you search and retrieve the next ones until you have all of them.

edited Jul 28 '17 at 11:42

Juan Serrats

1,358
5
24
30

answered Jul 28 '17 at 08:27

Thierry Salmon

36
3

Thanks, I have come up to the same thing couple weeks ago. – Gary Greenberg Jul 28 '17 at 21:54
And a small function to generate the range would look like this: public String[] genRange(int i) { String range = "member;range=" + i * 1500 + "-" + ((i + 1) * 1500 - 1); String[] returnedAtts = { range }; return returnedAtts; } – Thierry Salmon Aug 11 '17 at 11:07

score 2 · Answer 2 · answered Aug 29 '18 at 07:41

With your help I have a full working code

    // Initialize
    LdapContext ldapContext = null;
    NamingEnumeration<SearchResult> results = null;
    NamingEnumeration<?> members = null;

    try {
        // Initialize properties
        Properties properties = new Properties();
        properties.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        properties.put(Context.PROVIDER_URL, "ldap://" + ldapUrl);
        properties.put(Context.SECURITY_PRINCIPAL, adminLoginADOnPremise);
        properties.put(Context.SECURITY_CREDENTIALS, adminPasswordADOnPremise);

        // Initialize ldap context
        ldapContext = new InitialLdapContext(properties, null);

        int range = 0;
        boolean finish = false;
        while (finish != true) {
            // Set search controls
            SearchControls searchCtls = new SearchControls();
            searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
            searchCtls.setReturningAttributes(generateRangeArray(range));

            // Get results
            results = ldapContext.search(ldapBaseDn, String.format("(samAccountName=%s)", groupName), searchCtls);
            if (results.hasMoreElements() == true) {
                SearchResult result = results.next();
                try {
                    members = result.getAttributes().get(generateRangeString(range)).getAll();
                    while (members.hasMore()) {
                        String distinguishedName = (String) members.next();
                        logger.debug(distinguishedName);
                    }
                    range++;
                } catch (Exception e) {
                    // Fails means there is no more result
                    finish = true;
                }
            }
        }
    } catch (NamingException e) {
        logger.error(e.getMessage());
        throw new Exception(e.getMessage());
    } finally {
        if (ldapContext != null) {
            ldapContext.close();
        }
        if (results != null) {
            results.close();
        }
    }

You didn't include code for generateRangeString(range) – Steve Zavocki Oct 15 '18 at 21:21 — Steve Zavocki, Oct 15 '18 at 21:21
Hi Nicolas, can you let me know what is "ldapBaseDn" – Karthik P Dec 20 '21 at 12:59 — Karthik P, Dec 20 '21 at 12:59

score 1 · Answer 3 · answered Sep 24 '19 at 14:27

Two functions missing from the working code example by @Nicolas, I guess they would be something like:

public static String[] generateRangeArray(int i) {
    String range = "member;range=" + i * 1500 + "-" + ((i + 1) * 1500 - 1);
    String[] returnedAtts = { range };

    return returnedAtts;
}

public static String generateRangeString(int i) {
    String range = "member;range=" + i * 1500 + "-" + ((i + 1) * 1500 - 1);

    return range;
}

The code does not handle the case if the AD group is not so large that the member attribute actually needs to be "chunked", that is if the "member" attribute exists instead.

How to get all members of AD group via LDAP in Java

3 Answers3