Adding AD User to Group fails

[water]

I had a look at your q&d modification of the AD UDF. Looks promising

The concept I'm thinking about:

• If only _AD_Open is used then all scripts should work without chances
• If _AD_Open2 is used in addition then all queries should go to domain2 whereas all write operations still target domain1
• The user can switch between single domain/multi domain mode by setting a global variable
• Only a few functions will use this multi domain feature as the the functions need to be changed one by one
• A bit off topic: A global variable could switch off all _AD_ObjectExists calls. Would make scripts in multi domain mode a bit faster and easier to code. You still get an error but just a bit more cryptic.

Which function should we modify as a proof of concept?

[Surf243]

Hey water, sorry for my delayed response.

Anyway, I wasn't expecting the UDF to be fully multi-domain aware but rather something to assist with process of adding a user from another domain. I'm currently working on project that needed to have that ability. That's why I modified those 3 functions awhile back:

Thanks! I appreciate that you looked my modifications.

As for your concept, I agree with with you're trying to do and I'm onboard. So, are you saying to switch off _AD_ObjectExists while only in multi domain mode? Does that mean it would still function normally if you were just using 1 domain? I think that would work out well for the time being, but it's good function to have if/when it reaches production.

As for a PoC, I think _AD_AddUserToGroup is a good place to start. I've noticed a lot posts relating to adding a user from another domain. It would also make its sister function _AD_RemoveUserFromGroup easier to code since it would use a lot of the same code. Also, the topic for this post is Adding AD User to Group fails 

Off Topic Notes:

• The AD wiki mentions parameter 6 can be either 1, 2 or 3. However, the UDF only mentions 0, 1, and 2 (screenshot below). Not sure if that was intentional or not.
• Speaking of parameter 6, The example you provided in the Wiki does not work (Screenshot below). Reason being... the UDF only adds the BindFlags if useridparam <> ""  (Line: 303 to 316 in UDF version: 1.4.6.0)

 

Edited November 16, 2016 by Surf243
Added 2nd Note

[water]

19 hours ago, Surf243 said:

The AD wiki mentions parameter 6 can be either 1, 2 or 3. However, the UDF only mentions 0, 1, and 2 (screenshot below). Not sure if that was intentional or not.

3 is a combination of 1 and 2. Hence it is not listed in the UDF but mentioned as "Can be a combination of the following:"

[water]

19 hours ago, Surf243 said:

Speaking of parameter 6, The example you provided in the Wiki does not work (Screenshot below). Reason being... the UDF only adds the BindFlags if useridparam <> ""  (Line: 303 to 316 in UDF version: 1.4.6.0)

That's a bug. I think I started with security flag = 1 (Encrypt Password) and this only makes sense when userid/password have been specified.
Seems I need to fix this one