java ldap - get info is something changes in to AD

Question

I'm making a project with java spring where i do specific searches to the content of some attributes from a user or ad group. Also i write some text input to specific attributes.

Now i want to go a little but futher ..

The idea is that i do an open search on a specific AD group of users. When in this group an attributes or something else from a user changes, then the AD must send a message to my java program or something to tell me "attention user x has changed".

If i know that, i can do a new search to look if the attributes has changed of that user.

I know that i can solve this to do every time a search on the timestamp of the users in this AD group .. But it is not the perfect solution. Because then i must do everytime searches to every timestamp. And if there are for example 5000 users in this group. And i start with user 1 and user 4000 has changed yeah .. then it wil take a minut or something until i know that user 4000 has changed.

So i want a real time search thing.

Can you help me with this ? Can you put me into a direction that i can search futher on the web to find a solution or something. Or is this just not possible ?

Thanks a lot

Answer 1

Active Directory does not have a push notification feature, so this is not possible to do. You will need to search periodically to find the accounts you want.

You can, however, change your criteria to only find the accounts you want. The whenChanged attributes has the date the account was last changed. You can make a query to ask for members of that group, which have recently changed.

For example:

(&(objectClass=User)(whenChanged>=20190108000000.0Z)(memberOf=CN=mygroup,OU=Groups,DC=domain,DC=com))

A description of the date format used with whenChanged is here .

The memberOf condition should match the distinguishedName of the group. If the group has other groups inside it and you want to find members of those too, then you can do a recursive search:

(&(objectClass=User)(whenChanged>=20190108000000.0Z)(memberOf:1.2.840.113556.1.4.1941:=CN=mygroup,OU=Groups,DC=domain,DC=com))

That crazy number is called LDAP_MATCHING_RULE_IN_CHAIN and described here .