Recipe 16.14. Viewing a User's Group MembershipProblemYou want to view a user's group membership. SolutionUsing a graphical user interface
Using a command-line interfaceThe following command displays the groups <UserDN> is a member of. Use the -expand switch to list nested group membership as well: > dsget user <UserDN> -memberof [-expand] Using VBScript' This code displays the group membership of a user. ' It avoids infinite loops due to circular group nesting by ' keeping track of the groups that have already been seen. ' ------ SCRIPT CONFIGURATION ------ strUserDN = "<UserDN>" ' e.g., cn=jsmith,cn=Users,dc=rallencorp,dc=com ' ------ END CONFIGURATION --------- set objUser = GetObject("LDAP://" & strUserDN) Wscript.Echo "Group membership for " & objUser.Get("cn") & ":" strSpaces = "" set dicSeenGroup = CreateObject("Scripting.Dictionary") DisplayGroups "LDAP://" & strUserDN, strSpaces, dicSeenGroup Function DisplayGroups ( strObjectADsPath, strSpaces, dicSeenGroup) set objObject = GetObject(strObjectADsPath) WScript.Echo strSpaces & objObject.Name on error resume next ' Doing this to avoid an error when memberOf is empty if IsArray( objObject.Get("memberOf") ) then colGroups = objObject.Get("memberOf") else colGroups = Array( objObject.Get("memberOf") ) end if for each strGroupDN In colGroups if Not dicSeenGroup.Exists(strGroupDN) then dicSeenGroup.Add strGroupDN, 1 DisplayGroups "LDAP://" & strGroupDN, strSpaces & " ", dicSeenGroup end if next End Function DiscussionThe memberOf attribute on user objects is multivalued and lists the distinguished names for the groups of which the user is a member. memberOf is actually linked with the member attribute on group objects, which holds the distinguished names of its members. For this reason, you cannot directly modify the memberOf attribute; you must modify the member attribute on the group instead. The primary group of a user, which the user is technically a member of, will not be shown in either the CLI or VBScript solutions. This is because the primary group is not stored in the memberOf attribute like the rest of the groups. See AlsoRecipe 16.13 |