How do you determine if your domain isn't AD or ADAM?

Question

I'm trying to get some authentication stuff set up in ASP MVC, but keep getting thrown errors about how it doesn't support anything but Active Directory (AD) and Active Directory Application Mode (ADAM).

How can I figure out the actual running version of my LDAP provider? Is there some sort of command or query I can run against it? It's entirely possible it isn't AD or ADAM, but I have no idea how to figure that out.

Answer 1

Some directory servers publish information about the vendor in the root DSE in accordance with RFC3045. To retrieve information about the vendorName and vendorVersion, execute the following query:

ldapsearch -h hostname -p port -b "" -s base '(objectClass=*)' vendorName VendorVersion

For example, on my system:

ldapsearch -h localhost -p 1389 -b '' -s base '(objectClass=*)' vendorName VendorVersion
dn:
vendorName: UnboundID Corp.
VendorVersion: UnboundID Directory Server 3.1.0.2

Note that this information might be restricted. For more general information about the root DSE, see my blog entry.

Answer 2

When you start up your application, have it check for some well known feature of AD or ADAM.

Perhaps some specific schema attribute? (Probably a weak approach as you can usually add schema to look like AD into your other directory servers).

Perhaps something in the rootDSE ad Terry G suggests?

Perhaps some extended LDAP operation bind that only AD supports, and no other directories?

Find something unique to AD/ADAM and test for its presence, if not fail with a warning.