gwdg.Ldap.dll 3.5.0

Overview

Simple LDAP class to easily search and modify objects within a LDAP server. This package wraps some Classes around the Microsoft library System.DirectoryServices.Protocols.

Usage

On non windows systems the environment variable LDAPTLS_REQCERT should be set to "never" in order to connect via LDAPs. Otherwise it aborts with the unspecified message "LDAP server is not available".

Search objects

Create a searcher and start searching

LdapSearcher seacher = new("hostname", 636, "cn=admin,ou=admins,dc=example,dc=org", "mysecretpassword", useSsl: true);
# Search objects fased on a filter and define which attributes you want to read
List<LdapEntry> foundObjects = searcher.Search("ou=users,dc=example,dc=org", "(uid=mustermann)", "uid", "cn", "description")

foreach(LdapEntry entry in foundObjects)
{
    string uid = entry.Attributes["uid"].Values.First();

    // Do something
}

Search objects asynchronously

LdapSearcher seacher = new("hostname", 636, "cn=admin,ou=admins,dc=example,dc=org", "mysecretpassword", useSsl: true);
# Search objects fased on a filter and define which attributes you want to read
List<LdapEntry> foundObjects;
seacher.PartialResult += foundEntries =>
    {
        entries.AddRange(foundEntries);
        Console.Write($"\Search objects: {entries.Count()}");
    };

await searcher.SearchAsync("ou=users,dc=example,dc=org", "(uid=mustermann)", "uid", "cn", "description");

// if you cannot await you can use SearchCompleted property as well
while(!searcher.SearchCompleted)
    Thread.Sleep(50);

foreach(LdapEntry entry in foundObjects)
{
    string uid = entry.Attributes["uid"].Values.First();

    // Do something
}

Modify objects

entry.Attributes["someAttribute"].Clear();
entry.Attributes["description"].Replace("This in my new description");
entry.Attributes["someOtherAttribute"].Add("A new value");

LdapModifier modifier = new("hostname", 636, "cn=admin,ou=admins,dc=example,dc=org", "mysecretpassword", useSsl: true);
modifier.Modify(entry);
// or async
await modifier.ModifyAysnc(entry);

Change passwords (OpenLDAP)

LdapModifier.ChangePassword uses the LDAP Password Modify extended operation (RFC 3062, OID 1.3.6.1.4.1.4203.1.11.1), not a direct modification of userPassword. The server must support this extension and permit the operation under its access controls and password policy.

Use LDAPS or StartTLS with server certificate validation enabled. Passwords are sent as UTF-8 bytes, not hashed by the client.

string userDn = "uid=mustermann,ou=users,dc=example,dc=org";
string oldPassword = "current-password";
string newPassword = "new-password";

LdapModifier modifier = new("hostname", 636, "cn=admin,ou=admins,dc=example,dc=org", "mysecretpassword", useSsl: true);
modifier.ChangePassword(newPassword, distinguishedName: userDn, oldPassword: oldPassword);

Parameters:

• newPassword: Required; must not be null or empty.
• distinguishedName: Optional; omit it or pass null to change the bound user's password.
• oldPassword: Optional; omit it or pass null only if the server authorizes the change without it.

For the bound user, the last call can also be written as:

modifier.ChangePassword(newPassword, oldPassword: oldPassword);

For an administrative reset, use a modifier connected as an account with the required reset permissions and omit the old password:

adminModifier.ChangePassword(newPassword, distinguishedName: userDn);

Server rejections, such as insufficient permissions or password policy violations, are reported as System.DirectoryServices.Protocols.DirectoryOperationException.