Is there a preferred way to get user / group information from an Active Directory domain in Python?

Question

For the Django application I'm working on, I would like the group membership to be determined by the Active Directory group. After a while, breaking through the pywin32 documentation, I came up with the following:

>>> import win32net >>> win32net.NetUserGetGroups('domain_name.com', 'username') [(u'Domain Users', 7), ...] 

I spent some time searching Google before I realized this, but the examples I found almost exclusively used LDAP for this kind of thing. Is there a reason why this is preferable to this method? Remember two things:

• I do not use Active Directory for actual authentication, only for permissions. Authentication is performed by another server.
• Although it would be nice to have some cross-platform capabilities, it will probably work almost exclusively on Windows.

Answer 1

The AD LDAP interface has quite a few "quirks" that make it more difficult to use than it might seem on the surface, and it lags far behind functions. When I worked with him, I was mainly involved in authentication, but this is probably the same thing no matter what you do. There is a lot of oddity in that you need to be attached as a specific user just for a simple search, which a regular LDAP server will allow you to do anonymously.

Also, at least a year ago when I was working on this, python-ldap was the only Python LDAP implementation to support anywhere near the full feature set, as it was built on top of OpenLDAP, however OpenLDAP is pretty hard to build on Windows ( and in general), so most builders will lack one or more functions. Although you do not authenticate, the lack of SASL / Kerberos support (which was not available at the time I used it) can make it difficult for you.

If you have something that works, and you just need to run it on Windows, I would really recommend sticking with it; using AD through LDAP can turn into a big project.

Answer 2

 import wmi oWMI = wmi.WMI(namespace="directory\ldap") ADUsers = oWMI.query("select ds_name from ds_user") for user in ADUsers: print user.ds_name 

Answer 3

Check out Tim Golden Python Stuff .

 import active_directory user = active_directory.find_user(user_name) groups = user.memberOf