C#LDAP查询以获取某些组中用户的管理器

Question

我目前写了一个c#脚本来检索属于三个独立用户组的用户——看起来像这样...

string DomainPath = "LDAP://DC=<dc>,DC=<dc>,DC=org";
DirectoryEntry searchRoot = new DirectoryEntry(DomainPath); 
DirectorySearcher search = new DirectorySearcher(searchRoot);
search.Filter = "(&(objectClass=user)(objectCategory=person)(|(memberof=CN=group1,OU=Groups,OU=<ou>,DC=dc,DC=<dc>,DC=org)(memberof=CN=group2,OU=Groups,OU=<ou>,DC=<dc>,DC=<dc>,DC=org)(memberof=CN=group3,OU=Groups,OU=<ou>,DC=<dc>,DC=<dc>,DC=org)))";
search.PropertiesToLoad.Add("samaccountname");
search.PropertiesToLoad.Add("mail");
search.PropertiesToLoad.Add("usergroup");
search.PropertiesToLoad.Add("displayname");
search.PropertiesToLoad.Add("manager");
SearchResult result;
SearchResultCollection resultCol = search.FindAll();

使用这段代码，我能够检索为此用户公开的任何属性，包括“manager”记录。manager记录在此级别作为DN公开：

Manager = "CN=MTK93,OU=Users,OU=<ou>,DC=<dc>,DC=<dc>,DC=org"

真正需要的是能够递归地获取现有查询返回的每个管理人员的所有用户属性，然后将它们组合到一个数据集中...

例如，考虑下面的层次结构…

Lisa (manager's manager)
   | 
   | -- Tim (Manager)
   |    mail = [e-mail], usergroup = groupA, manager = Lisa
   |     | 
   |     |-- Mike
   |     |    mail = [e-mail], usergroup = group1, manager = Tim
   |     |-- Lori
   |     |    mail = [e-mail], usergroup = group2, manager = Tim
   | -- Katie (another manager)
         |    mail = [e-mail], usergroup = groupB, manager = Lisa
         |
         |-- John
         |    mail = [e-mail], usergroup = group3, manager = Katie
         |-- Larry
              mail = [e-mail], usergroup = group4, manager = Katie

我的查询返回mike、lori、katie和john，因为他们存在于我要查询的组（组1、组2、组3）中，但我也需要Tim和katie的用户记录（因为他们是属于这些组的人的经理）

理想的输出应该是这样的...

Name       Mail        Group        Manager
------------------------------------------------
Mike     [e-mail]   group1        Tim's DN
Lori     [e-mail]   group2        Tim's DN
John     [e-mail]   group3        Katie's DN
Katie    [e-mail]  groupB        Lisa's DN
Tim      [e-mail]   groupA        Lisa's DN

注意：我不希望Lisa（在她下面的级别中没有人属于第一组、第二组或第三组）或Larry（不属于第一组、第二组或第三组）

事实证明，这个LDAP查询的递归性质很难弄清楚。

Answer 1

我通过以下方法获得了所需的结果：

>

// class variable
List<ActiveDirectoryUser> recordsToInsert;

// build the query appender
string queryAppender = "";
foreach (string activeDirectoryGroup in activeDirectoryGroups)
{
    queryAppender += "(memberof=CN=" + activeDirectoryGroup + ",OU=Groups,OU=<<ou>>,DC=<<dc>>,DC=<<dc>>,DC=<org>>)";
}

// create the ldap query string
var ldapQueryForUsersInDtGroups = "(&(objectClass=user)(objectCategory=person)(|" + queryAppender + "))";

// first get the users that belong to the active directory groups...
recordsToInsert = getEmployeeRecordsFromLdapQuery(ldapQueryForUsersInDtGroups);

// then, query again to make sure we are including the managers for the people returned from the first query
var distinctManagers = (from record in recordsToInsert select record.manager).Distinct();

// build an ldap query to get only the records for the managers we need
// example query string with 2 managers: 
// (&(objectClass=user)(objectCategory=person)

queryAppender = "";
foreach (var manager in distinctManagers)
{
    queryAppender += "(distinguishedName=" + manager + ")";
}

// ldap query filter for the managers
var ldapQueryForManagers = "(&(objectClass=user)(objectCategory=person)(|" + queryAppender + "))";

// combine the result set with the managers result set
recordsToInsert.AddRange(getEmployeeRecordsFromLdapQuery(ldapQueryForManagers));

// filter off any duplicates.
uniqueRecordsToInsert = recordsToInsert.GroupBy(x => x.employeeId).Select(x => x.First()).ToList<ActiveDirectoryUser>();