Viewing file:  printMembers.pl (6.48 KB) -rw-r--r--
Select action/file-type:
 (+) |  (+) |  (+) | Code (+) | Session (+) |  (+) | SDB (+) |  (+) |  (+) |  (+) |  (+) |  (+) |
#!/usr/bin/perl
#printMembers.pl
#given the name of a group (assume object class is groupOfUniqueNames) will
#display the members of the group including members of any groups that may be a member
#of the original group
#*Now Handles Netscape Dynamic Groups*
#
#By default it will display the DN of the member entries, you can specify a particular
#attribute you wish to display instead (e.g. mail attribute)
#example: printMembers.pl -n "Accounting Managers"
#optionally you can also specify the host, port, binded search and search base.
#Mark Wilcox mark@mjwilcox.com
#
#first version: August 8, 1999
#second version: August 15, 1999
use strict;
use Carp;
use Net::LDAP;
use URI;
use vars qw($opt_h $opt_p $opt_D $opt_w $opt_b $opt_n $opt_a );
use Getopt::Std;
my $usage = "usage: $0 [-hpDwba] -n group_name";
die $usage unless @ARGV;
getopts('h:p:D:w:b:n:a:');
die $usage unless ($opt_n);
my $DEBUG = 0; #DEBUG 1 if you want debugging info
#get configuration setup
$opt_h = "airwolf" unless $opt_h;
$opt_p = 389 unless $opt_p;
$opt_b = "o=airius.com" unless $opt_b;
my $isGroup = 0; #checks for group or not
my $ldap = new Net::LDAP ($opt_h, port=> $opt_p);
#will bind as specific user if specified else will be binded anonymously
$ldap->bind($opt_D, password=> $opt_p) || die "failed to bind as $opt_D";
#get the group DN
my @attrs = ['dn'];
eval
{
my $mesg = $ldap->search(
base => $opt_b,
filter => "(&(cn=$opt_n)(objectclass=groupOfUniqueNames))",
attrs => @attrs
);
die $mesg->error if $mesg->code;
my $entry = $mesg->pop_entry();
my $groupDN = $entry->dn();
&printMembers($groupDN,$opt_a);
$isGroup = 1;
};
print "$opt_n is not a group" unless ($isGroup);
$ldap->unbind();
sub printMembers
{
my ($dn,$attr) = @_;
my @attrs = ["uniquemember","memberurl"];
my $mesg = $ldap->search(
base => $dn,
scope => 'base',
filter => "objectclass=*",
attrs => @attrs
);
die $mesg->error if $mesg->code;
#eval protects us if nothing is returned in the search
eval
{
#should only be 1 entry
my $entry = $mesg->pop_entry();
print "\nMembers of group: $dn\n";
#returns an array reference
my $values = $entry->get_value("uniquemember", asref => 1);
foreach my $val (@{$values})
{
my $isGroup = 0; #lets us know if the entry is also a group, default no
#change val variable to attribute
#now get entry of each member
#is a bit more efficient since we use the DN of the member
#as our search base, greatly reducing the number of entries we
#must search through for a match to 1 :)
my @entryAttrs = ["objectclass","memberurl",$attr];
$mesg = $ldap->search(
base => $val,
scope => 'base',
filter => "objectclass=*",
attrs => @entryAttrs
);
die $mesg->error if $mesg->code;
eval
{
my $entry = $mesg->pop_entry();
if ($attr)
{
my $values = $entry->get_value($attr, asref => 1);
foreach my $vals (@{$values})
{
print $vals,"\n";
}
}
else
{
print "$val\n";
}
my $values = $entry->get_value("objectclass", asref => 1);
# This value is also a group, print the members of it as well
&printMembers($entry->dn(),$attr) if (grep /groupOfUniqueNames/i, @{$values});
};
}
my $urls = $entry->get_value("memberurl", asref => 1);
&printDynamicMembers($entry->dn(),$urls,$attr) if ($urls);
};
return 0;
}
#prints out a search results
#for members of dynamic group (as supported by the Netscape Directory Server)
#*Note this may or may not return all of the resulting members and their attribute values
#depending on how the LDAP connection is binded. Normally users who are not binded as the Directory Manager
#are restricted to 2000 or less total search results.
#In theory a dynamic group could have a million or more entries
sub printDynamicMembers
{
my ($entryDN,$urls,$attr) = @_;
print "\nMembers of dynamic group: $entryDN\n";
foreach my $url (@{$urls})
{
print "url is $url\n" if $DEBUG;
my $uri;
eval
{
$uri = URI->new($url);
} ;
print "ref ",ref($uri),"\n" if $DEBUG;
my $base = $uri->dn();
print "base is $base\n" if $DEBUG;
my $scope = $uri->scope();
my $filter = $uri->filter();
my @attrs = [$attr];
my $mesg = $ldap->search(
base => $base,
scope => $scope,
filter => $filter,
attrs => @attrs
);
#print results
my $entry;
while ($entry = $mesg->pop_entry())
{
if ($attr)
{
my $values = $entry->get_value($attr, asref => 1);
foreach my $vals (@{$values})
{
print $vals,"\n";
}
}
else
{
print $entry->dn(),"\n";
}
}
}
return 0;
}
=head1 NAME
printMembers.pl
=head1 DESCRIPTION
Prints out the members of a given group, including members of groups that are also members of the given group.
Defaults to printing out members by DN, but you can specify other attributes for display
=head1 USAGE
perl printMembers.pl -n "Accounting Managers"
Members of group: cn=Accounting Managers,ou=groups,o=airius.com
uid=scarter, ou=People, o=airius.com
uid=tmorris, ou=People, o=airius.com
cn=HR Managers,ou=groups,o=airius.com
Members of group: cn=HR Managers,ou=groups,o=airius.com
uid=kvaughan, ou=People, o=airius.com
uid=cschmith, ou=People, o=airius.com
cn=PD Managers,ou=groups,o=airius.com
Members of group: cn=PD Managers,ou=groups,o=airius.com
uid=kwinters, ou=People, o=airius.com
uid=trigden, ou=People, o=airius.com
Here's an example of the same group but instead print the cn attribute
of each entry:
Members of group: cn=Accounting Managers,ou=groups,o=airius.com
Sam Carter
Ted Morris
HR Managers
Members of group: cn=HR Managers,ou=groups,o=airius.com
Kirsten Vaughan
Chris Schmith
PD Managers
Members of group: cn=PD Managers,ou=groups,o=airius.com
Kelly Winters
Torrey Rigden
And same group but with the mail attribute:
Members of group: cn=Accounting Managers,ou=groups,o=airius.com
scarter@airius.com
tmorris@airius.com
Members of group: cn=HR Managers,ou=groups,o=airius.com
kvaughan@airius.com
cschmith@airius.com
Members of group: cn=PD Managers,ou=groups,o=airius.com
kwinters@airius.com
trigden@airius.com
=cut
|