Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't know if my question title even made sense - but let me explain.

When you do an LDAP query, you (apparently) are supposed to specify a DN in the Bind to "login" to the LDAP server. When I do this with slapd/OpenLDAP, the Bind DN is a normal DN like


or whatever. However, when I do this against [our corporate] Active Directory [server] - it wants a "Bind DN" to be like:


Which actually works. However, "CORP\brad" isn't really a DN in the ldap tree. In reality, "brad" exists as an object like "cn=brad,ou=users,dc=corp" - and this object has an "sAMAAccountName" attribute of "brad" (my actual username - changed here for simplification). I don't know if this is just "coincidence" - or if there could be others like this or what. How do you tell?

So - my quesion is - based on the DN/"Credentials" that were passed to the BIND, how can you determine what actual "Distingushed Name" the specified "Bind DN" equates to - when in AD - they don't appear to be one and of the same?

share|improve this question
up vote 2 down vote accepted

sAMAccountName is the username in Active Directory. If you search ldap for users with a samaccountname that matches your username, you can get the DN that way.

share|improve this answer
So - I just strip away the "domain" portion of the username? – Brad Jul 31 '13 at 13:48
I'll give you the credit. What I discovered was that I was actually using a "Global Catalog" server - which means more than one "tree" is in it - and thus more than one sAMAccountName can be in it. So I used the sAMAAccountName, with some more logic to make sure that from the domain name, I had the correct tree specified as the search base. – Brad Aug 9 '13 at 18:09

You can perhaps extract the DN from "ADsPath". You can obtain this as an attribute/field in your program after you bind to AD.

The DIT on AD and your other directory powered by OpenLDAP may not be the same, rendering different DNs.

share|improve this answer
I can't find that attribute/field anywhere in the directory. – Brad Jul 31 '13 at 13:47
It's actually not an attribute. It's the fully qualified LDAP URL that can reference an entry in the directory. For LDAP-based directories, the DN is usually the part after the host:port element of the URL. Please see… You can retrieve ADsPath as a property of your directory connection object. If you're using ADSI/ADO, it can also be returned as a column/field in the SQL result set.… – Bora Jul 31 '13 at 22:40
One more:… – Bora Jul 31 '13 at 22:41
My question is a bit more basic: I am given user credentials "domain\username" and "password". I need to authenticate this user against the AD server, and then figure out what their DN is, so I can look up their attributes. Question is - from the "domain\username" string - how do I figure out what DN to use? – Brad Aug 5 '13 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .