cmem-plugin-ldap

Query LDAP directory services such as OpenLDAP or Active Directory.

This is a plugin for eccenca Corporate Memory. You can install it with the cmemc command line client like this:

cmemc admin workspace python install cmem-plugin-ldap

Search LDAP directory

Searches a directory server over LDAP and returns each matching entry as an entity, so that the people, groups and devices a directory holds can be mapped into a Knowledge Graph. It works with any LDAPv3 directory, among them OpenLDAP, Active Directory and Apple Open Directory.

Configuring a search

A search needs the URL of the directory, where to start, what to match and what to return:

Leaving the bind name and password empty binds anonymously. The attributes have to be named one by one: the entities are described to the workflow while it is being drawn, and * would only be resolved by the directory once the search runs.

What comes out

One entity per entry, identified by the LDAP URL of that entry as defined by RFC 4516:

ldaps://directory.example.org/uid%3Djdoe%2Cou%3Dpeople%2Cdc%3Dexample%2Cdc%3Dorg

Each entity carries the distinguished name of the entry, followed by the values of the requested attributes in the order they were requested. An attribute an entry does not carry produces no value, which keeps it distinguishable from an attribute that is present and empty, and an attribute holding several values keeps all of them.

Values arrive in the lexical form a Knowledge Graph expects - timestamps as ISO 8601, booleans as true and false - and a value which is not text, such as jpegPhoto or objectSid, is Base64 encoded. The schema of the directory is read while connecting to make that possible, since a directory sends every value as text and only its schema says which of them is a timestamp.

Large directories

Searching is always paged, so a result set is not cut short by the maximum result size of the directory, which is 1000 entries on a default Active Directory installation. A search which reaches the configured maximum number of entries stops there and reports a warning saying so.

References to other directory servers are not followed unless this is asked for, since following one opens an anonymous connection to a server named by the directory rather than by the task.

Connecting securely

ldaps:// is encrypted from the start, and an ldap:// connection can be upgraded with StartTLS before authenticating. Certificates are validated in both cases. Where the directory uses an internal certificate authority, configure that authority rather than switching validation off.