Technical Bulletin 005 Revised 2010/12/10

Transcription

1 sitesecuresoftware.com Site-Secure Facility & Security Management Software Technical Bulletin 005 Revised 2010/12/10 Search Active Directory from SQL Server

2 Table of Contents Introduction... 3 Creating a linked server... 3 Using Enterprise Manager:... 3 Using script:... 4 Finding LDAP names... 5 Querying Active Directory (Less than 1000 users)... 9 Creating the Site-Secure vwemployeeview... 9 How to Populate Site-Secure from Active Directory(More than 1000 users) Security issues Hints Page 2

3 Introduction This document was created to show the user how to create a view within SQL-server that connects to Active Directory services. This view can then be used as the Remote PIM view for the Site-Secure employee lists. SQL Server 2000's linked server feature enables you to search Active Directory as easily as regular SQL Server tables. Microsoft's object linking and embedding for database (OLE DB) providers can create connections to non-sql Server data sources, as well as to other SQL servers. This is similar to the way ODBC data sources are used in Microsoft Access. Unlike the older ODBC standard, however (which could access relational data only), OLE DB can also connect to some non-relational data sources. The OLE DB providers make the non-relational data appear relational. This means that SQL Server can also query the contents of a domain's Active Directory, which is structured like a tree, not a table. In fact, the data retrieved from Active Directory can be made into a view or even joined with existing SQL Server data. Creating a linked server Using Enterprise Manager: You can use either the system stored procedure sp_addlinkedserver or Enterprise Manager to set up a linked server to Active Directory. The call to sp_addlinkedserver is: EXEC sp_addlinkedserver 'ADSI', 'Active Directory Services 2.5', 'ADSDSOObject', 'Full computer name' The first parameter, ADSI, is the name you'll use in querying the linked server. Active Directory Services 2.5 is the product name, ADSDSOObject is the provider, and adsdatasource is the built-in data source name (replaced with full computer name). Alternatively, when using Enterprise Manager, simply expand the Security container, right-click on Linked Servers, and select New Linked Server. The General tab will have the items listed above; leave the others blank (the provider appears in a drop-down list as OLE DB Provider for Microsoft Directory Services). On the Security tab, be sure the third option, To Be Made without a security context, is selected. Page 3

4 Using script: From the Query Analyser, execute the following script: ADSI-SQL_Linked_Server.sql which is located on the installation CD under the scripts\active Directory folder. Page 4

5 Please note that a valid Active Directory user name and password will be required. Finding LDAP names Lightweight Directory Access Protocol (LDAP) is a query language for directory services such as Active Directory. Each data element that you see in Active Directory has two names: the display name that appears on property pages, such as Active Directory Users and Computers, and an internal LDAP name. You need to use the latter name to query Active Directory. How do you find it? The easiest way to locate internal LDAP names is to use a Microsoft Management Console snap-in called Active Directory Schema. It's not installed by default on Windows 2000, although its DLL is present. To register this DLL (and thus make it visible in the Add Snap-in dialog box), open a console window on the database server to which you have local administrator rights and type: Regsvr32 schmmgmt.dll You should see the message: "DllRegisterServer in schmmgmt.dll succeeded." Page 5

6 Next, open a new, empty MMC console by typing the command mmc in the Run command's text box. From the Console menu, select Add Snap-in and the Add button. From the list, click on Active Directory Schema and click OK. You now have a hierarchical (tree) display in the navigator pane. Page 6

7 By opening the various levels, you can browse the structure, or schema, of Active Directory. Page 7

8 If you expand the Classes container and click on the Users class, the display panel on the right will fill up with all the elements that make up a User definition. The names listed are the LDAP names that you need to use in querying Active Directory from SQL. There's also a description for each element. For example, if you want to display a user s first and last names, you'll find them in the list under the LDAP names givenname and sn (short for surname), respectively. Page 8

9 Querying Active Directory (Less than 1000 users) You can't use the usual four-part naming convention used with linked servers to databases (for example, OTHERSERV.MyDatabase.dbo.Employees). Instead, you must write a pass-through query using the OPENQUERY function. In addition, only SELECT statements can be sent; INSERT, UPDATE, and DELETE statements are not allowed through ADSI. OPENQUERY is a rowset function: It returns a set of rows from a linked server as its function value. We can use it with our new linked server definition to query Active Directory. For example, to get the first and last names of users, write the following: select * from openquery (ADSI, 'Select GivenName, sn from ''LDAP://ts-server-internet.internet.ottawasecurity.com'' where objectcategory = ''person'' and objectclass = ''user''') Notice that this query just uses SELECT * to return all columns from the OPENQUERY function, using their original names. You can also alias the returning columns to provide more readable names. The LDAP query itself can be in the form above (called a serverless connection), or it can name the exact server to connect to: LDAP://LAXPDC01/ DC=yourcompany,DC=com Alternatively, it can use the domain to have any domain controller respond: LDAP://MYCORP/ DC=yourcompany,DC=com The part after the last slash is called the relative distinguished name or RDN of the Active Directory object you want to search. It reads from right to left, so additional qualifications are added on the left. For instance, if you want to list users in the Finance organizational unit (OU), you'd write: LDAP://MYCORP/ OU=Finance,DC=yourcompany,DC=com Creating the Site-Secure vwemployeeview Looking in the Active Directory Schema snap-in, you find that the LDAP names required. After identifying the User records in Active Directory, you can create a SELECT statement to query them, storing it as a view: /****** Site-Secure Views ******/ /****** Use this script for custom view to another SQL Server's Employee List ******/ /****** This view is also used for the List Users tab in the Key Management and Visitor registration (Contacts) ******/ if exists (select * from dbo.sysobjects where id = object_id(n'[dbo].[vwemployeeview]') and OBJECTPROPERTY(id, N'IsView') = 1) drop view [dbo].[vwemployeeview] GO Create View dbo.vwemployeeview As /****** This section is the remote table name and fields we wish to connect to (This can also be a view from the remote database ******/ select givenname as Empfirstname, sn as EmpLastname, telephonenumber as phone, mail as , Department as dept, PhysicalDeliveryOfficeName as Room, postalcode as emp_id from openquery (ADSI, 'Select GivenName, sn, TelephoneNumber, mail, Department, PhysicalDeliveryOfficeName, postalcode, as photo, as UpdateDate, as UpdateBy from ''LDAP://ts-server-internet.internet.ottawasecurity.com'' where objectcategory = ''person'' and objectclass = ''user'' ') where sn is not null and givenname is not null and postalcode is not null GO Page 9

10 How to Populate Site-Secure from Active Directory(More than 1000 users) This section will detail how to use the included scripts to populate the Site Secure database with employee information from Active Directory (AD). These instructions assume your Site Secure database resides on a SQL Server. 1. Execute the following script to create a table within the sitesecure database called ADSI_data that will act as a staging area for the employee data pulled from the ADSI linked server: a. ADSI_data.sql 2. Execute the following script to create a table within the SiteSecure database called ADSI_OU. This table holds the Domain Controller Servers from the different branches of AD which you would like to pull employee information: a. ADSI_OU.sql b. Sample records: Location LDAPServer LDAPdn CORP Europe CorpDCserver.company.net EuropeDCserver.eu.company.net dc=company,dc=net dc=eu,dc=company,dc=net You will need to enter your server name(s) 3. Execute the following script to create the stored procedure called usp_get_ldap_data that will populate the staging table ADSI_data: a. usp_get_ldap_data.sql 4. Execute the following script to create a new table called PIMTable in the sitesecure database. The PIMTable will be the functional table used to store employee records for use by the sitesecure application. It effectively will take the place of the BLDG_PAS table. Notice the table uses the IDENTITY property for the EmpID field: a. PIMTable.sql 5. Execute the following scripts to point the two views used by the Site Secure application to use the PIMTable: a. vwemployeeview.sql b. vwpimview.sql 6. Execute the following script to create the stored procedure called usp_reconcile_ldap_data_for_sitesecure. This procedure will populate the PIMTable will employee data contained in the ADSI_data staging table: a. usp_reconcile_ldap_data_for_sitesecure.sql 7. Execute the following script to create a 2-step SQL Server scheduled job called Pull_LDAP_Data. The first step will execute the stored procedure usp_get_ldap_data, and the second step will execute usp_reconcile_ldap_data_for_sitesecure. The job is scheduled to run every hour: a. Pull_LDAP_Data-SQL_Server_Scheduled_Job.sql Security issues When a linked server is created, it is automatically set up to use self-naming; that is, the users' own Windows login credentials are passed to Active Directory to see if they are authorized to use it. Each object in Active Directory carries with it a security descriptor that indicates which actions are allowed for each user. If the user trying to select from the directory doesn't have the right permissions, access is denied. Hints Page 10

11 ! "#$ %& ' ( ( ) *+,+-.*/.* ( 010 2'3'*45& ' *45&'67'593 '*45&667::;59 3*457'5<<&=& &6' > (? # & @0> A: 5@6&B(7' 5 CD0A0;* 5B 5&46;* 5 5 5$ Page 11