How I can get group name to which the user belongs?

Use this forum to post questions relating to WinGate, feature requests, technical or configuration problems

Moderator: Qbik Staff

How I can get group name to which the user belongs?

Postby SadTroll » Jul 31 20 7:39 pm

Hello!

I study the UserDatabase API from WinGateSDK. I use UDBSearchOpen to browse UDB with UDB_SEARCH_USERS | UDB_SEARCH_GROUPS flags.
But I can not understand how to define the group name to which the user belongs in the case when UDBhandle param in UDBSearchCallbackFunc corresponds user object.
The current UDB provider is Windows UDB.
Is it possible to do this using the User Database API and if so what is the best way to do it

Thanks
SadTroll
 
Posts: 14
Joined: Jul 30 20 10:16 pm

Re: How I can get group name to which the user belongs?

Postby adrien » Aug 04 20 3:31 pm

Hi

the first thing you need to know is that a user can be a member of many groups, including groups that one or more of the groups can be a member of.

When you search for groups a user is member of, you choose how to specify the user you are searching for membership. For example in our code to display Membership of for an object, we use this code for the search.

Code: Select all
   // OK, we need to kick off a search which returns all the groups this object is a member of
   UDB_SEARCH_INFO Search;
   Search.dwFlags = UDB_SEARCH_USESTRINGVALUE | UDB_SEARCH_ALLOBJECTS | UDB_SEARCH_MEMBEROF;
   Search.strValue = m_strObjectGUID.c_str();
   Search.dwField = UDB_SEARCH_FIELD_GUID;
   Search.dwItems = 0;
   Search.pContext = this;
   Search.pCallbackFunc = GetMemberofCallbackFunc;

   UDBHandle hSearch;
   SPI::UDBSearchOpen(&Search, &hSearch);
   SPI::UDBCloseHandle(hSearch);


So we take the GUID of the object (since not just user can be a member of a group, but also group, computer, security principal etc). then we specify that the search value is the GUID of the object in dwField.

Could use SID, but they are not always guaranteed unique or invariant. SID can be doubled up in some cases (e.g. well known security principals) and can change for a user if the user is moved to a different domain.

Note: can get the GUID of a user object with

Code: Select all
HRESULT UDBObjectGetInfo(WinGateSDK::UDBHandle hObject, WinGateSDK::UDB_OBJECT_INFO** ppInfo);
HRESULT UDBObjectFreeInfo(WinGateSDK::UDB_OBJECT_INFO* pInfo);


Also note we free the handle after calling the search function, it's reference counted and cleaned up after last search result is delivered to the callback function. It's easier to do this than to check for end of search results and clean up search handle then (saves having to remember the handle). If you want to cancel the search however you would need to remember the search handle.


Regards

Adrien
adrien
Qbik Staff
 
Posts: 5441
Joined: Sep 03 03 2:54 pm
Location: Auckland

Re: How I can get group name to which the user belongs?

Postby SadTroll » Aug 05 20 3:42 am

thanks for the help
SadTroll
 
Posts: 14
Joined: Jul 30 20 10:16 pm

Re: How I can get group name to which the user belongs?

Postby SadTroll » Aug 05 20 5:28 am

And how to check for the end of search results?
SadTroll
 
Posts: 14
Joined: Jul 30 20 10:16 pm

Re: How I can get group name to which the user belongs?

Postby adrien » Aug 05 20 12:08 pm

SadTroll wrote:And how to check for the end of search results?


end of search is denoted by delivery of a NULL handle.
adrien
Qbik Staff
 
Posts: 5441
Joined: Sep 03 03 2:54 pm
Location: Auckland

Re: How I can get group name to which the user belongs?

Postby SadTroll » Aug 08 20 3:12 am

Hi!

Thanks for the help!

One more question.
Is it correct that with each call to UDBSearchOpen, a separate thread will be started?
And is it correct that in this thread the transferred callback will be called?
SadTroll
 
Posts: 14
Joined: Jul 30 20 10:16 pm

Re: How I can get group name to which the user belongs?

Postby adrien » Aug 11 20 3:20 pm

Hi

In the GUI, the call does not spawn a new thread, but uses the existing communication thread to post the request to the engine. Callbacks come in the context of the user interface thread of the gatekeeper.exe process

In the engine, the call spawns a new thread and callbacks come in that thread. So you are correct in your assumption. You should not throw any exceptions from your callback.

Regards

Adrien
adrien
Qbik Staff
 
Posts: 5441
Joined: Sep 03 03 2:54 pm
Location: Auckland

Re: How I can get group name to which the user belongs?

Postby SadTroll » Aug 11 20 10:32 pm

Thanks for the help!
SadTroll
 
Posts: 14
Joined: Jul 30 20 10:16 pm

Re: How I can get group name to which the user belongs?

Postby SadTroll » Aug 13 20 1:41 am

Hi!

Thanks for the help!

And one more question.

I use this code to search all users into group with given object GUID:

Code: Select all
info.dwFlags = UDB_SEARCH_USESTRINGVALUE | UDB_SEARCH_USERS | UDB_SEARCH_MEMBERS;
info.strValue = obj->strGUID;
info.dwField = UDB_SEARCH_FIELD_GUID;
info.dwItems = 0;


It is work perfect

but when I try to search all users into group using the given object name, like this:

Code: Select all
info.dwFlags = UDB_SEARCH_USESTRINGVALUE | UDB_SEARCH_USERS | UDB_SEARCH_MEMBERS;
info.strValue = obj->strName;
info.dwField = UDB_SEARCH_FIELD_NAME;
info.dwItems = 0;


I can not find anything

How can I find all users into the group using the object name?

Thanks!
SadTroll
 
Posts: 14
Joined: Jul 30 20 10:16 pm

Re: How I can get group name to which the user belongs?

Postby adrien » Aug 13 20 1:50 pm

Hi

only the following are supported:

UDB_SEARCH_FIELD_DNAME
UDB_SEARCH_FIELD_SID
UDB_SEARCH_FIELD_GUID
UDB_SEARCH_FIELD_ACCOUNTNAME

you will get a warning log message about "search string empty, invalid search field for members of group"

I think only DName, SID, GUID and accountname can be relied on to obtain a group object. I don't think group name is indexed in the AD, and can also change.

So I suggest if you are storing configuration about groups and you want membership, to do a search for the group yourself first, and get its UUID (never changes) or SID (changes if group changes domain and in some cases isn't unique) or DNAME

Or even better store the UUIDs.

Adrien
adrien
Qbik Staff
 
Posts: 5441
Joined: Sep 03 03 2:54 pm
Location: Auckland

Re: How I can get group name to which the user belongs?

Postby SadTroll » Aug 13 20 8:53 pm

Thanks for the help!
SadTroll
 
Posts: 14
Joined: Jul 30 20 10:16 pm

Re: How I can get group name to which the user belongs?

Postby adrien » Aug 20 20 2:12 pm

you're welcome!
adrien
Qbik Staff
 
Posts: 5441
Joined: Sep 03 03 2:54 pm
Location: Auckland


Return to WinGate

Who is online

Users browsing this forum: Google [Bot] and 39 guests

cron