<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Sent: Friday, April 05, 2013 3:51 PM From: Mosior, Benjamin<o:p></o:p></p>
<p class="MsoPlainText">> Our AD magicians might have some wisdom to share. I'll see what they say and report back if there's anything worth noting.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Hopefully this can supplement our collective knowledge. According to the O'Reilly "Active Directory" textbook (ISBN 978-0-596-52059-5), the Global Catalog is a read-only interface for "forest-wide searches". Accessible attributes are
defined in the "partial attribute set" (PAS), which is configurable. Normal LDAP connections limit explicitly to the search base and, at least in this scenario, it seems the search is not recursive.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">It's starting to make sense. I remember testing the following scenarios, where hypothetical users "testfaculty" and "teststaff" were located under "CN=FACULTY,DC=EXAMPLE,DC=EDU" and "CN=STAFF,DC=TEST,DC=EDU", respectively.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># Search above containers<o:p></o:p></p>
<p class="MsoPlainText">User: testfaculty<o:p></o:p></p>
<p class="MsoPlainText">Connection: LDAP(389)<o:p></o:p></p>
<p class="MsoPlainText">Search Base: DC=EXAMPLE,DC=EDU<o:p></o:p></p>
<p class="MsoPlainText">Result: FAIL<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># testfaculty account in Faculty container<o:p></o:p></p>
<p class="MsoPlainText">User: testfaculty<o:p></o:p></p>
<p class="MsoPlainText">Connection: LDAP(389)<o:p></o:p></p>
<p class="MsoPlainText">Search Base: CN=FACULTY,DC=EXAMPLE,DC=EDU<o:p></o:p></p>
<p class="MsoPlainText">Result: SUCCEED<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"># teststaff account in Faculty container<o:p></o:p></p>
<p class="MsoPlainText"><span style="color:black">User: teststaff<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Connection: LDAP(389)<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Search Base: CN=FACULTY,DC=EXAMPLE,DC=EDU<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Result: FAIL<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="color:black"># testfaculty in Global Catalog<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">User: testfaculty<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Connection: Global Catalog (3268)<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Search Base: DC=EXAMPLE,DC=EDU<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Result: SUCCEED<o:p></o:p></span></p>
<p class="MsoPlainText" style="text-indent:.5in"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="color:black"># teststaff in Global Catalog<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">User: teststaff<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Connection: Global Catalog (3268)<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Search Base: DC=EXAMPLE,DC=EDU<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black">Result: SUCCEED<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="color:black">I'd like to do some more testing before declaring the above to be true. Any Active Directory admins on the list who could confirm?<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText">Benjamin Mosior<o:p></o:p></p>
</div>
</body>
</html>