Active Directory Groups Modify

alongwor has asked for the wisdom of the Perl Monks concerning the following question:

Hi all, I am trying to use the Net::LDAP module to modify the members of a group and running into some troubles. I was wondering if someone can point me in the right direction with this one... I have the following code

use Net::LDAP;

$userDn = "CN=Ext User 1,OU=External,OU=People,DC=test,DC=com";
$groupDn = "CN=Mailing_All,OU=Mailing Lists,OU=Groups,DC=test,DC=com";

my $ldapConnection = Net::LDAP->new('172.16.171.11',
        port=>'389')
    or die "$@";

# Now that we are connected to the directory, bind as the specified us
+er.
$mesg = $ldapConnection->bind('administrator@test.com',
        password => 'password');

# Perform an LDAP search
$queryResult = $ldapConnection->search(base=> 'DC=test,DC=com',
        filter => '(&(objectClass=group))');

$queryResult->code && die $queryResult->error;
foreach $entry ($queryResult->entries) {
    $entry->dump;
}

print "time to add: " . $userDn . " to group: " . $groupDn . "\n";

my $result = $ldapConnection->modify ($userDn,
        add => {
            'member' => $groupDn
        });
        
print "Error code: " . $result->code . "\n";
print "Error name: " . $result->error_name . "\n";
print "Error text: " . $result->error_text . "\n";

$ldapConnection->disconnect;
[download]

When I run it the resulting error is a schema violation.

Error code: 65
Error name: LDAP_OBJECT_CLASS_VIOLATION
Error text: The request specifies a change to an existing entry or the
+ addition of a new
entry that does not comply with the servers schema
[download]

Does anyone have any tips for me on where I am going wrong? Cheers

Comment on Active Directory Groups Modify Select or Download Code

Replies are listed 'Best First'.
Re: Active Directory Groups Modify by cdarke (Prior) on Oct 21, 2008 at 13:42 UTC
Check that the group exists.	[reply]
Re: Active Directory Groups Modify by bingos (Vicar) on Oct 21, 2008 at 20:55 UTC
I think that you may be approaching this from the wrong direction. I know that when I've done this kind of thing with Win32::OLE and the ADSI interface I modify the group to add the user, you appear to be trying to modify the user to add the group. Just a thought. Updated: I managed to check this out this morning. Yes, one modifies group membership in the group itself. How this maps to use from Net::LDAP, I'm not sure. Maybe: `my $result = $ldapConnection->modify ($groupDn, add => $userDn, );` [download]	[reply] [d/l]