How can I figure out my LDAP connection string?

The ASP.NET Active Directory Membership Provider does an authenticated bind to the Active Directory using a specified username, password, and “connection string”. The connection string is made up of the LDAP server’s name, and the fully-qualified path of the container object where the user specified is located.

The connection string begins with the URI LDAP://.

For the server name, you can use the name of a domain controller in that domain– let’s say “dc1.corp.domain.com”. That gives us LDAP://dc1.corp.domain.com/ thusfar.

The next bit is the fully qualified path of the container object where the binding user is located. Let’s say you’re using the “Administrator” account and your domain’s name is “corp.domain.com”. The “Administrator” account is in a container named “Users” located one level below the root of the domain. Thus, the fully qualified DN of the “Users” container would be: CN=Users,DC=corp,DC=domain,DC=com. If the user you’re binding with is in an OU, instead of a container, the path would include “OU=ou-name”.

So, using an account in an OU named Service Accounts that’s a sub-OU of an OU named Corp Objects that’s a sub-OU of a domain named corp.domain.com would have a fully-qualified path of OU=Service Accounts,OU=Corp Objects,DC=corp,DC=domain,DC=com.

Combine the LDAP://dc1.corp.domain.com/ with the fully qualified path to the container where the binding user is located (like, say, LDAP://dc1.corp.domain.com/OU=Service Accounts,OU=Corp Objects,DC=corp,DC=domain,DC=com) and you’ve got your “connection string”.

(You can use the domain’s name in the connection string as opposed to the name of a domain controller. The difference is that the domain’s name will resolve to the IP address of any domain controller in the domain. That can be both good and bad. You’re not reliant on any single domain controller to be up and running for the membership provider to work, but the name happens to resolve to, say, a DC in a remote location with spotty network connectivity then you may have problems with the membership provider working.)

Related Posts:

  1. What are the differences between LDAP and Active Directory?
  2. Query to list all users of a certain group
  3. What are CN, OU, DC in an LDAP search?
  4. Powershell: A positional parameter cannot be found that accepts argument “xxx”
  5. Cannot get Kerberos service ticket: KrbException: Server not found in Kerberos database (7)
  6. Authenticating in PHP using LDAP through Active Directory
  7. How can I find out what AD groups I’m a member of?
  8. Find name of Active Directory domain controller
  9. Is there a way to view the members of an Active Directory group if you aren’t a domain admin and can’t log into to a domain controller?
  10. What is ADFS (Active Directory Federation Services)?
  11. ldap_sasl_bind(SIMPLE): Can’t contact LDAP server(-1)
  12. LDAP query in PowerShell
  13. Command line to list users in a Windows Active Directory group?
  14. What is Active Directory Domain Services and how does it work?
  15. Windows Active Directory naming best practices?

Leave a Comment

tech