get domain name of mobile account.

Question

Created Nov ’20

Replies 2

Boosts 0

Participants 2

Hi,

my computer is bound to windows LDAP server. the connection is configured to use mobile account so I'd be able to login while the LDAP is unreachable.

I'd like to extract domain name for my user. which is represented by the field dsAttrTypeNative:DomainName as can be shown in the following code :

Code Block     ODNode * node = [ODNode nodeWithSession:[ODSession defaultSession] type:kODNodeTypeAuthentication error:&err];
    NSArray * subnodeNames = [node subnodeNamesAndReturnError:&err];
    for (NSString * subnodeName in subnodeNames) {
        ODNode * subnodeObject = [ODNode nodeWithSession:[ODSession defaultSession] name:subnodeName error:&err];
        id subnodeDetails = [subnodeObject nodeDetailsForKeys:nil error:&err];
        NSArray * domainName = subnodeDetails[@"dsAttrTypeNative:DomainName"];

when LDAP connectivity is online, I can see that this field appears in subnodeDetails and it's equal to the concatenation of 2 string separated by dot (i.e MY-CORP.mycompanyname-dev.com). but when it's offline, this field doesn't appear even though I see that the LDAP user appears by running the following command id username.

is there any way to extract domain name when LDAP is unconnected ?

I could do something really patchy like running odrecord and append the DC fields from dsAttrTypeStandard:AppleMetaRecordName which include the following data :
'dsAttrTypeStandard:AppleMetaRecordName': 'CN=John Smith,CN=Users,DC=my-corp,DC=mycorpname-dev,DC=com'
and this will result : my-corp.mycorpname-dev.com

but perhaps there's an easier builtin alternative ?

Answered by DTS Engineer in 648322022

There’s probably a better way to do this but it’s hard to say without more info. Can you use dscl to dump your account record while in the offline state and post the result here?

Code Block  % dscl localhost -read /Search/Users/quinn

Make sure to elide anything stupidly large (like JPEGPhoto) and redact anything private. When you do the redaction, it’d help if you substituted placeholders, like the my-corp.mycorpname-dev.com in your original post.

Also, format the dump as a code block (using triple backticks) so that it’s easier to read.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Nov ’20

Accepted Answer

There’s probably a better way to do this but it’s hard to say without more info. Can you use dscl to dump your account record while in the offline state and post the result here?

Code Block  % dscl localhost -read /Search/Users/quinn

Make sure to elide anything stupidly large (like JPEGPhoto) and redact anything private. When you do the redaction, it’d help if you substituted placeholders, like the my-corp.mycorpname-dev.com in your original post.

Also, format the dump as a code block (using triple backticks) so that it’s easier to read.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

1

Answer 2

chapo81 OP

Nov ’20

Hi, I've followed you very useful command and found a field that represent the user full name (base name + domain) even when active directory is unreachable. the field is kODAttributeTypeAltSecurityIdentities and I can definitely recommend using it to extract domain name.

Code Block 
    NSError *err;
    
    ODNode * searchNode = [ODNode nodeWithSession:[ODSession defaultSession] name:@"/Search" error:&err];
    if (err) {
        writeLog(LOG_ERROR, "error getting Search node : %s", [[err description] UTF8String]);
        return L"";
    }
    
    ODRecord *record = [searchNode recordWithRecordType:kODRecordTypeUsers
                                                   name:username
                                             attributes:nil error:&err];
    if (!record) {
        writeLog(LOG_ERROR, "error: couldn't find user %S in Search node : %s", username.c_str(), [[err description] UTF8String]);
        return L"";
    }
    ODQuery *query = [[ODQuery alloc] initWithNode:searchNode
                                    forRecordTypes:kODRecordTypeUsers
                                         attribute:kODAttributeTypeRecordName
                                         matchType:kODMatchEqualTo
                                       queryValues:username
                                  returnAttributes:@[kODAttributeTypeAltSecurityIdentities]
                                    maximumResults:10
                                             error:&err];
    
    NSArray* results = [query resultsAllowingPartial:NO error:&err];
 
    for(ODRecord *record in results) {
        NSString * domainName = (NSString *)[record valuesForAttribute:kODAttributeTypeAltSecurityIdentities error:nil][0];
        if (domainName != nil) {
            return [[domainName componentsSeparatedByString: @":"] lastObject];
        }
    }

0