Richard
Fri Apr 30 21:47:13 CDT 2004
tykes wrote:
> I am trying to check to see if a user is in a given Group. I assume I
should be looking up the Memberof field and have the line
> If (instr(varProp, "CN=TestGroup") > 0 )Then
>
> This works fine where the user is the member of one other group besides
their Primary group but when they are are a member of two or more groups I
get a type mismatch. What is going on ?
>
>
Hi,
The memberOf attribute is multi-valued. In fact, you have to account for
this attribute having no value, one value, or more than one. If you are only
interested in direct membership (ignoring group nesting), you can use code
similar to:
Set objUser = GetObject("LDAP://cn=TestUser,ou=Sales,dc=MyDomain,dc=com")
On Error Resume Next
arrstrGroups = objUser.GetEx("memberOf")
If Err.Number <> 0 Then
On Error GoTo 0
strGroups = ""
Else
On Error GoTo 0
strGroups = LCase(Join(arrstrGroups))
End If
If InStr(strGroups, "cn=testgroup") > 0 Then
Wscript.Echo "User is a direct member of the group"
End If
The GetEx method can be used to retrieve multi-valued attributes in an
array. However, this raises an error if the attribute has no values, so the
snippet above traps this error with "On Error Resume Next". The Join
function is used to convert the array into one string of group Distinguished
Names (separated by spaces). This works even if memberOf has only one value.
Finally, the InStr function checks if the group name is found in the string.
More advanced functions for checking group membership are linked on this
page:
http://www.rlmueller.net/freecode1.htm
Some of the functions handle nested groups, the "primary" group (which is
not included in the "memberOf" attribute), and other situations.
--
Richard
Microsoft MVP Scripting and ADSI
HilltopLab web site -
http://www.rlmueller.net
--