How to escape LDAP dn for lookup? - active-directory

Question

I have a small script (spring/groovy/ldap) that finds, in Active Directory, the 'management tree' under a person,
i.e. from a 'root person' the script finds the root person's direct reports then uses recursion: for each direct report find their direct reports, etc.
the directReports users attribute specifies a list of DN's in the form:
CN=Simpson\, Homer,OU=OU_0731DevOps,OU=OU_0100Monitor Services,OU=OU_0001U*Nuclear Energy Corporation,OU=OU_UNuclearUsers,DC=corp,DC=unucleargrp,DC=com
The script does an "ldap lookup" for each direct report by DN, e.g.:
obj = ldapTemplate.lookup(pDn, new UserAttributesMapper())
Problem
The ldap lookup throws an InvalidNameException
[LDAP: error code 34 - 0000208F: LdapErr: DSID-0C090787
I've tried various combinations of escaping but still get the error.
What am I missing???
More Info
This url https://social.technet.microsoft.com/wiki/contents/articles /5312.active-directory-characters-to-escape.aspx shows which characters to escape:
Active Directory requires that the following ten characters be escaped
with the backslash "\" escape character if they appear in any of the
individual components of a distinguished name:
Comma ,
Backslash character \
Pound sign (hash sign) #
Plus sign +
Less than symbol <
Greater than symbol >
Semicolon ;
Double quote (quotation mark) "
Equal sign =
Leading or trailing spaces
Tools
Groovy
Spring Boot
JVM
thanks!

Answer 1

I found the answer by poking around with LDAPNameBuilder.
TLDR:
ldapTemplate.lookup requires stripping off the "DC.." portion of the DN.*
If you know a cleaner/more-official solution, please post!
LDAP Lookup fails with a DN like this:
This DN has "DC=.." components and fails using spring ldap lookup.
CN=Simpson\, Homer,OU=OU_0731DevOps,OU=OU_0100Monitor Services,OU=OU_0001U*Nuclear Energy Corporation,OU=OU_UNuclearUsers,DC=corp,DC=unucleargrp,DC=com
LDAP succeeds with this (no "DC" components):
This DN has no "DC=" components. Spring LDAP template provides the basedn.
CN=Simpson\, Homer,OU=OU_0731DevOps,OU=OU_0100Monitor Services,OU=OU_0001U*Nuclear Energy Corporation
Context Reminder
This application traverses 'management tree.' It gets a persons managees by the 'directReports' attribute (which lists the full-DN's of each direct report). This application wanted to lookup that user by his/her DN.
Tweak/Example
This tweak got the ldap lookup to work:
User lookupUserByDn(String pDn) {
// needed this to get it to work
String dn=pDn.replace(",${ldapConfig.base}","")
ldapTemplate.lookup(dn, new UserAttributesMapper())
}
for the record, my application.yml ldap portion looked like this:
spring:
ldap:
urls: ldap://dc.corp.unucleargrp.com:389
base: DC=corp,DC=unucleargrp,DC=com
username: username_val
password : password_val

Answer 2

According to this https://docs.spring.io/spring-ldap/docs/2.3.1.RELEASE/reference/#contextsource-configuration
Removing the base attribute, All operations going back and forth will use full DNs.