ekmixon

Lab: Active Directory as LDAP for Linux

• Goal: Create a minimal working setup where a Linux machine retrieves users from Active Directory via LDAP.
• Requirements: Vagrant, VirtualBox.

Setup

Put all of the attached files somewhere and switch to that directory.

ekmixon

<#############################
## 2015-07-10, 14:45 - 
## Check if Session running with evevated / administrator privledges
#############################>
  ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")

  #Ref: http://www.jonathanmedd.net/2014/01/testing-for-admin-privileges-in-powershell.html
  
<#############################
## 2015-07-10, 11:10 - 

ekmixon

# ms_ad_connect.py
#
# Code to query microsoft active directory
#
#
#
#

import sys
import ldap3

ekmixon

#!/usr/local/bin/python
from subprocess import call
from subprocess import Popen
from subprocess import PIPE
import re
import winrm
import sys
import time

settings = {

ekmixon

#! /usr/bin/python

from OpenDirectory import ODNode, ODSession, kODRecordTypeUsers, \
	kODRecordTypeGroups, kODRecordTypeComputers
from SystemConfiguration import SCDynamicStoreCreate, SCDynamicStoreCopyValue
	
class ActiveDirectory(object):
	def __init__(self, creds):
		self.creds = creds
		self.info = self.get_bind_info()

ekmixon

#!/usr/bin/env python
# coding: utf8
from gluon import *
import re
import smtplib
import tempfile
import ssam_utils
import ttsd.ldaputils
import ttsd.ldaputils.ad
from ttsd.ldaputils import StudentConfiguration

ekmixon

import ldap
class ADconnection(object):
	
	
	def __enter__(self):
		
				
		#LDAP Connection
		try:
			# Fix MS Issues

ekmixon

$GroupObject = Get-ADGroup 'MyGroupName'
$NTPrincipal = Get-ADUser 'myUserName'

if ($GroupObject -and $NTPrincipal) {

    $acl = Get-Acl "AD:$($GroupObject.distinguishedName)"

    $identity = [System.Security.Principal.IdentityReference] $NTPrincipal.SID

    $adRights = [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty -bor [System.DirectoryServices.ActiveDirectoryRights]::WriteDacl

ekmixon

<#
.Synopsis
    Takes Group DNs and User DNs and sets the user(s) as managers of the group(s).
.DESCRIPTION
    Only changes needed for the group's configuration to match the request are
    made, that is if the group already has the same managers in the specified
    positions (managedBy vs msExchCoManagedByLink) then nothing is modified.
    If no property changes are needed but the rights aren't set correctly,
    the necessary ACL rules are applied and extraneous rules are removed.

ekmixon

#based on code from this blog: https://mcpmag.com/articles/2015/06/18/reporting-on-local-groups.aspx

function Get-AdsiComputer {
    [CmdletBinding()]
    param (
        [Parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
        [string]$ComputerName = $env:COMPUTERNAME
    )
    process {
        [ADSI]("WinNT://$ComputerName,computer")