java - Get groups and users from LDAP -

hi trying fetch posixgroup ldap , users in group. code below have done far, returns me groups not sure how users these groups. please guide me approach good? or should go first getting users , based on gid group name?

public static void main(string[] args) {         hashtable env = new hashtable();         env.put(context.initial_context_factory,"com.sun.jndi.ldap.ldapctxfactory");         env.put(context.provider_url,"ldap://192.168.*.*:389");         env.put(context.url_pkg_prefixes, "com.sun.jndi.url");          env.put(context.referral, "ignore");          env.put(context.security_authentication, "simple");          env.put(context.security_principal, "cn=manager,dc=*,dc=*");          env.put(context.security_credentials, "****");          dircontext ctx;         try {             ctx = new initialdircontext(env);         } catch (namingexception e) {             throw new runtimeexception(e);         }          namingenumeration results = null;         try {              searchcontrols controls = new searchcontrols();             controls.setsearchscope(searchcontrols.subtree_scope);              results = ctx.search("ou=path,dc=*,dc=*", "(objectclass=posixgroup)",controls);             // go through each item in list             while (results.hasmore()) {                 searchresult nc = (searchresult)results.next();                 attributes att=     nc.getattributes();                                            system.out.println("group name "+ att.get("cn").get(0));                 system.out.println("gid "+ att.get("gidnumber").get(0));             }         } catch (namenotfoundexception e) {             system.out.println("error : "+e);         } catch (namingexception e) {             throw new runtimeexception(e);         } {             if (results != null) {                 try {                     results.close();                 } catch (exception e) {                     system.out.println("error : "+e);                 }             }             if (ctx != null) {                 try {                     ctx.close();                 } catch (exception e) {                     system.out.println("error : "+e);                 }             }         }            } 

querying users in group

it depends attribute used groups in directory denote membership. posixgroup uses memberuid username value (defined in rfc 2307). there other possible attributes (member, uniquemember) , values (dn) check directory uses.

so in order load users group, have to:

1. query group, example filter (&(objectclass=posixgroup)(cn=<group name>))
2. iterate through values of memberuid in group, each:
   1. query user object (&(objectclass=posixaccount)(uid=<memberuid>))
   2. then can access user attributes uidnumber.

this not efficient way of doing because generate lots of small queries, far know, ldap has no means join group entry user entries references in single result (unlike sql).

you optimise bit limiting results attributes need: gidnumber group query , uidnumber user query. using either searchcontrols.setreturningattributes() or version of dircontext.search() takes attributestoreturn argument. doesn't reduce number of queries though, volume of data returned.

some more general notes ldap usage

• if queries have large number of results (for example "all users"), might hit directory's result size limit (typically 5000) , partial results.
• when modifying group membership information, have update both posixaccount , posixgroup objects (unless directory server it, doubt will), otherwise becomes inconsistent.