使用 python-ldap 添加 AD 组

Question

I am trying to create group within AD with no success, below is my code:

import ldap
import ldap.modlist as modlist

LDAPserver = 'hidden'
LDAPlogin = 'hidden'
LDAPpassword = 'hidden'

l = ldap.initialize('ldap://' + LDAPserver)

l.simple_bind_s(LDAPlogin, LDAPpassword)

dn = 'OU=someunit,OU=someunit,OU=someunit,OU=someunit,DC=my-company,DC=local'

attrs = {}
attrs['objectclass'] = ['top','Group']
attrs['cn'] = 'group name to be created'
attrs['description'] = 'Test Group'

ldif = modlist.addModlist(attrs)

l.add_s(dn,ldif)

l.unbind_s()

Following snippet gives me an error:

ldap.INSUFFICIENT_ACCESS: {'info': '00000005: SecErr: DSID-031521D0, problem 4003 
(INSUFF_ACCESS_RIGHTS), data 0\n', 'desc': 'Insufficient access'}

However, using same credentials I can create group with some UI tools like LDAP Admin

so I suppose that I have proper permissions to create groups, but still no success with python-ldap.

I can also query existing groups and fetch its members via script.

I believe that the problem is in my attributes, maybe Active Directory need some different values to be inserted into attrs variable. AD is running under Win Server 2012 R2.

Any help would be appreciated :)

Answer 1

dn实际上应该是CN=<groupname> + base_dn ，所以在你的情况下是这样的

dn = 'CN=groupname,OU=someunit,OU=someunit,OU=someunit,OU=someunit,DC=my-company,DC=local'

Answer 2

请尝试将LDAPlogin替换为完整的绑定dn值，例如

"cn=hidden,dc=example,dc=com"