Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't know if my question title even made sense - but let me explain.

When you do an LDAP query, you (apparently) are supposed to specify a DN in the Bind to "login" to the LDAP server. When I do this with slapd/OpenLDAP, the Bind DN is a normal DN like


or whatever. However, when I do this against [our corporate] Active Directory [server] - it wants a "Bind DN" to be like:


Which actually works. However, "CORP\brad" isn't really a DN in the ldap tree. In reality, "brad" exists as an object like "cn=brad,ou=users,dc=corp" - and this object has an "sAMAAccountName" attribute of "brad" (my actual username - changed here for simplification). I don't know if this is just "coincidence" - or if there could be others like this or what. How do you tell?

So - my quesion is - based on the DN/"Credentials" that were passed to the BIND, how can you determine what actual "Distingushed Name" the specified "Bind DN" equates to - when in AD - they don't appear to be one and of the same?

share|improve this question
up vote 2 down vote accepted

sAMAccountName is the username in Active Directory. If you search ldap for users with a samaccountname that matches your username, you can get the DN that way.

share|improve this answer
So - I just strip away the "domain" portion of the username? – Brad Jul 31 '13 at 13:48
I'll give you the credit. What I discovered was that I was actually using a "Global Catalog" server - which means more than one "tree" is in it - and thus more than one sAMAccountName can be in it. So I used the sAMAAccountName, with some more logic to make sure that from the domain name, I had the correct tree specified as the search base. – Brad Aug 9 '13 at 18:09

You can perhaps extract the DN from "ADsPath". You can obtain this as an attribute/field in your program after you bind to AD.

The DIT on AD and your other directory powered by OpenLDAP may not be the same, rendering different DNs.

share|improve this answer
I can't find that attribute/field anywhere in the directory. – Brad Jul 31 '13 at 13:47
It's actually not an attribute. It's the fully qualified LDAP URL that can reference an entry in the directory. For LDAP-based directories, the DN is usually the part after the host:port element of the URL. Please see… You can retrieve ADsPath as a property of your directory connection object. If you're using ADSI/ADO, it can also be returned as a column/field in the SQL result set.… – Bora Jul 31 '13 at 22:40
One more:… – Bora Jul 31 '13 at 22:41
My question is a bit more basic: I am given user credentials "domain\username" and "password". I need to authenticate this user against the AD server, and then figure out what their DN is, so I can look up their attributes. Question is - from the "domain\username" string - how do I figure out what DN to use? – Brad Aug 5 '13 at 12:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.