用户可以是（基于 Ldap 的）目录服务实例中多个子树的一部分吗？
我对使用 .net 框架进行基于 LDAP 的目录服务编程还很陌生； 因此有一个基本的愚蠢问题。
我想使用 System.DirectoryServices.Protocol 找出特定用户所属的所有子树。
首先，用户可以成为“一个”目录服务实例中多个子树的一部分吗？ 如果是，那么如何使用“System.DirectoryServices.Protocol”命名空间找到特定用户所属的所有子树？
如果一个用户“仅”属于某个特定的子树，那么我想我可以从用户的 DN 中找到该子树的所有 DN。 请问还有其他有效的方法吗？
更新：
具体来说我的问题，鉴于这是我的用户对象的 DN - “uid=DaffyD,OU=Ducks,OU=People,O=A “，它是否可以直接或间接存在于其他 OU 中？ 例如，“OU=Ducks”可以是除“People”之外的任何其他 OU 的一部分吗？
那么我的下一个问题，在不对用户的 DN 进行某种字符串操作的情况下，我能否以某种方式找到该用户有效使用 System.DirectoryService.Protocol 的父节点 DN 的名称？
I am pretty new to the ldap based directory service programming using .net framework; hence have a basic silly question.
I would like to find out the all sub trees a particular user belongs to using System.DirectoryServices.Protocol.
First of all, can a User be part of the multiple Sub Trees in “a” directory service instance? If yes, then how can I find all the sub trees that a particular user belongs to using “System.DirectoryServices.Protocol “ namespace?
If a user belongs to “only” a particular sub tree, then I guess I can find all the DN of the sub tree from the DN of the user. Please let me know if there is any other efficient way?
Update:
To be specific about my question , given this is DN of my user object - “uid=DaffyD,OU=Ducks,OU=People,O=A “ , whether can it exist in other OU directly or indirectly? E.g. can “OU=Ducks” be part of any other OU than “People”?
Then my next question, without doing some kind of string manipulation of user’s DN , can I somehow find the names of parent nodes’ DN that this user using System.DirectoryService.Protocol efficiently?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这完全基于我使用 Active Directory 的经验 - 但我假设其他 LDAP 目录也会以类似方式处理它：
不，用户仅存在一次，因此只能位于一个容器（通常是 OrganizationalUnit）中。 据我所知，用户没有“符号链接”的概念。
为什么你真的希望用户存在于多个地方？
如果您希望用户成为多个子树的一部分来处理权限，那么您就完全错误了 - 您不应该根据是否允许某个用户在 LDAP 中的“位置”进行给定操作的决定层次结构，而不是群体成员资格。
LDAP 组旨在处理权限，用户可以是任意数量的组的成员 - 那里有 1:n 关系 - 用户可以是组的成员，并且这些组负责处理权限。
马克
This is based solely on my experience with Active Directory - but I would assume other LDAP directories will handle it similarly:
No, a user exists only once and therefore can only be located in one single container (typically an OrganizationalUnit). There's no concept of "symbolic links" to users, as far as I know.
And why would you really want a user to exist in multiple places anyway??
If you want the user to be part of several subtrees in order to handle permissions, you're doing it all wrong - you shouldn't base your decisions whether or not to permit some user a given operation on his "location" in the LDAP hierarchy, but rather on group membership.
LDAP groups are what are intended to handle permissions, and a user can be member of any number of groups - there you have your 1:n relationship - user can be member of groups, and those groups are responsible for handling permissions.
Marc
我不确定用户“属于”子树是什么意思。 用户对象将存在于目录中的单个路径中，其 DN 将告诉您该路径是什么（实际上，反之亦然：您知道 DN，然后找到该对象）。 这就是 DN == 可分辨名称的全部要点：唯一地命名对象。
当然，一个用户可以属于多个组（作为 Active Directory 的一项功能）； 这些组分布在目录中。 不确定您在使用“属于”一词时是否也指群体。
编辑：由于任何类型的用户对象只能有一个父 OU，同样，每个 OU 只能有一个父容器（通常是 O 或 OU）。 整个目录形成一棵树，任何节点都不能有两个父节点。
该框架仅将 DN 作为字符串处理。 但是，有第三方 DN 解析器库可用。
I'm not sure what you mean by a user "belonging" to a subtree. A user object will exist in a single path in the directory, and its DN will tell you what that path is (in practice, it's vice versa: you know the DN and then find the object). This is the whole point of the DN == distinguished name: to uniquely name objects.
Of course, a user can belong to multiple groups (as a feature of Active Directory); those groups are spread over the directory. Not sure whether you also referred to groups when using the word "belong".
Edit: as any kind of user object can only have a single parent OU, likewise, each OU can have only a single parent container (typically O or OU). The entire directory forms a tree, no node can have two parents.
The framework only processes DNs as strings. However, there are third-party DN parser libraries available.