Question

我正在使用python-ldap模块编写Python脚本，目的是在Active Directory Windows 2012R2 Server中创建用户。

我面临的问题是，当我创建的新DN出现这样的语法时：

DN：cn =名称Second_name，等等。

似乎只接受诸如以下格式：

DN：cn = NameSecond_name，等等。要么 DN：cn =名称，等等。

此问题也发生在 cn 属性上。

到目前为止，我的代码如下：

import ldap
import ldap.modlist as modlist
import base64, sys

DN, secret = sys.argv[1:3]

ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
l = ldap.initialize('ldaps://ldap_server')

l.simple_bind_s(DN,secret)


name = "name"
second_name = "secondname"
fullname = name + " " + second_name
mail = "name_secondname@company.com"
company_id = "id1234"
password = "passsword"

base_dn = "OU=Accounts,DC=internal"
user_dn = 'CN=' + name + ' '  + second_name + ',' + base_dn

user_attrs = {}
user_attrs['objectclass'] = ['top', 'person', 'organizationalPerson', 'user']
user_attrs['cn'] = full_name
user_attrs['givenName'] = str(name)
user_attrs['sn'] = str(second_name)
user_attrs['displayName'] = "%s" % full_name
user_attrs['userAccountControl'] = '514'
user_attrs['mail'] = mail
user_attrs['uid'] = company_id
user_attrs['countryCode'] = '0'
user_attrs['primaryGroupID'] = '513',
user_attrs['userPrincipalName'] = '%s@company.internal' % str(company_id)
user_attrs['sAMAccountname'] = "%s" % srt(company_id)
user_ldif = modlist.addModlist(user_attrs)

unicode_pass = unicode('\"' + password + '\"', 'iso-8859-1')
password_value = unicode_pass.encode('utf-16-le')

add_pass = [(ldap.MOD_REPLACE, 'unicodePwd', [password_value])]
# 512 will set user account to enabled
mod_acct = [(ldap.MOD_REPLACE, 'userAccountControl', '512')]


l.add_s(user_dn, user_ldif)
l.modify_s(user_dn, add_pass)
l.modify_s(user_dn, mod_acct)

我当前遇到的错误如下：

    l.add_s(user_dn, user_ldif)
  File "/home/edevi98/.local/lib/python2.7/site-packages/ldap/ldapobject.py", line 430, in add_s
    return self.add_ext_s(dn,modlist,None,None)
  File "/home/edevi98/.local/lib/python2.7/site-packages/ldap/ldapobject.py", line 416, in add_ext_s
    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
  File "/home/edevi98/.local/lib/python2.7/site-packages/ldap/ldapobject.py", line 751, in result3
    resp_ctrl_classes=resp_ctrl_classes
  File "/home/edevi98/.local/lib/python2.7/site-packages/ldap/ldapobject.py", line 758, in result4
    ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
  File "/home/edevi98/.local/lib/python2.7/site-packages/ldap/ldapobject.py", line 331, in _ldap_call
    reraise(exc_type, exc_value, exc_traceback)
  File "/home/edevi98/.local/lib/python2.7/site-packages/ldap/ldapobject.py", line 315, in _ldap_call
    result = func(*args,**kwargs)

ldap.INVALID_DN_SYNTAX: {'info': u"00002081: NameErr: DSID-03050CF6, problem 2003 (BAD_ATT_SYNTAX), data 0, best match of:\n\t'CN=name secondname,OU=Accounts,DC=internal'\n", 'desc': u'Invalid DN syntax'}

有什么办法解决这个问题吗？

非常感谢

Answer 1

基本dn不完整，域组件（DC）必须引用您域中的每个组件。

例如，域 internal.com 将被写为DC=internal,DC=com，而基本dn（因为此目录树中的所有dn）必须与这些DC匹配：

base_dn = "OU=Accounts,DC=internal,DC=com"

Answer 2

问题归结于python格式中的语法错误

应该是：

user_dn = 'CN=' + name + ' ' + second_name + ',' + base_dn

和

fullname = name + ' ' + second_name

否则它现在可以正常工作。

python-ldap-在Active Directory中创建用户-问题2003（BAD_ATT_SYNTAX）cn和DN

2 个答案: