Finding all groups that a user manages
active-directory, c#, ldap
Solution
This is, I'm afraid, not possible to accomplish with only one LDAP query. You will have to split it into subqueries and run the each separately, which in turn will choke the domain controller if there's a lot to iterate over.
I tried to do it the way I described, and the performance was horrible, at least doing it using the available modules for .NET.
Problem
We got a special multivalue attribute. Let's call it `ourOwnManagedBy` which can contain users or groups (their DN) that manages the current group. How can I retrieve a list of all groups that a specific user manages (with the help of `managedBy` and `ourOwnManagedBy`)? For instance. Let's say that the user is member of the group GlobalAdministrators and that the group ApplicationAdministrators has GlobalAdministrations as a member. And finally the group MyApplication which has ApplicationAdministrators in the `ourOwnManagedBy` attribute. - `User` is member of `GlobalAdministrators` - `GlobalAdministrators` is member of `ApplicationAdministrators` - `MyApplication` got `ApplicationAdministrators` in `ourOwnManagedBy` How do I use that information to find all groups that a specific user manages? Is it possible to do some kind of recursive check in custom attributes (that contains DNs of users and groups)? Update I've tried to use a directory search filter like this: ``` string.Format("(ourOwnManagedBy:1.2.840.113556.1.4.1941:={0})", dn); ``` but I might have missunderstood what `1.2.840.113556.1.4.1941` does? (MSDN page)