Hi all,
I’m trying to find a way of determining all of the groups a user is a member of. I did a search of the forum and found a reference to a solution using LDAP; however I would ideally like to do this using the C API.
Is there an obvious or easy way to do this that I’m not seeing? Any suggestions would be much appreciated!
Regards,
David
Subject: Using C API - find all groups a user is a member of
It’s not api but, just in case:
JYR
Subject: RE: Using C API - find all groups a user is a member of
Thanks, that has helped to point me in the right direction.
So I’m thinking of just doing repeated searches with NSFSearch(), starting by finding all groups which the user is a member of, and repeating the same search for each group encountered. This seems like it would work, but I wonder if there is a better way (using the C API)? Any suggestions?
Thanks!
David
Subject: RE: Using C API - find all groups a user is a member of
So I’m thinking of just doing repeated searches with NSFSearch(), starting by finding all groups which the user is a member of, and repeating the same search for each group encountered. This seems like it would work, but I wonder if there is a better way (using the C API)? Any suggestions?
If it is okay to skip mail-only groups, the answer you seek is a subset of the names returned in the NAMES_LIST object of NSFBuildNamesList.
All the security (for ACL) groups that a user belongs to appear at the tail end of a NAMES_LIST object. Following the coding example above, skip all the names up to and including those beginning with “". Immediately following the entries beginning with "” are the ListName[0] values for all security groups, both direct and nested, that the user belongs to.
Again, if it is okay to not include mail-only groups, this is the most efficient and solution. You NSFSearch approach is unlikely to be complete when dealing with multiple directories (i.e., Directory Assistance is used) whether the secondary directories are Domino or LDAP. Plus internally, Domino has caches that make NAMES_LIST generation perform well.
BTW, an upcoming release of the Domino LDAP server will return the security groups a user belongs to through a new operational attribute.
Subject: RE: Using C API - find all groups a user is a member of
Hi Ken,
That’s exactly what I was looking for - thank you very much!!
Regards,
David
Subject: RE: Using C API - find all groups a user is a member of
Hi Ken,
Having read over the docs for NSFBuildNamesList() a second time, it states that it uses the local Domino Directory to resolve group membership. This won’t work for me as the process doing the lookups is running on a remote server. Is there any other way of achieving this remotely?
Thanks,
David
Subject: RE: Using C API - find all groups a user is a member of
Having read over the docs for NSFBuildNamesList() a second time, it states that it uses the local Domino Directory to resolve group membership. This won’t work for me as the process doing the lookups is running on a remote server. Is there any other way of achieving this remotely?
Yes, NSFBuildNamesList works relative to the local machine’s directory services.
You have two ways of “properly” looking up Domino directory information per the Building Directory Friendly Applications presentation - using NAMELookup functions or LDAP protocol. Both have APIs in the Notes C API Toolkit.
NAMELookup - Use the $ServerAccess view to determine direct group membership. Unwind the nesting.
ldap_search_s - Use the “(&(objectclass=groupofNames)(member=%s))” search filter to determine direct group membership. Unwind the nesting.
Both methods will work with secondary directories and have server-side caches. To unwind the group membership using LDAP, refer to the detailed algorithms and Java code in Collaborative Cuisine’s 1 Hour JNDI Cookbook presentation. This presentation also touches on the importance of client-side caching for performance.
For ND8, the LDAP approach is vastly simplified by simply asking for the name’s dominoAccessGroups operational attribute.
Both directory programming presentations mentioned above are listed in the “Domino Directory FAQ” (google it).
Subject: RE: Using C API - find all groups a user is a member of
Great, thanks for your help Ken.
Regards,
David