Retrieving Server Information from the Root DSE with the LDAP Component

The root DSE (DSA-Specific Entry) is a special entry at the top of an LDAP server's directory tree, which contains information about the server's configuration and capabilities. It is commonly used to find the base DN of the directory (e.g., DC=example,DC=com), which is needed to build the DNs of other entries. It can also be used to check which LDAP versions, controls, and authentication mechanisms the server supports.

Querying the Root DSE

The root DSE has an empty DN, and is retrieved with a base-level search. To query it, set the DN property to an empty string, set SearchScope to ssBaseObject, and call the Search method with the filter objectClass=*. When the search completes, the returned attributes are available in the Attributes collection.

LDAP ldap = new LDAP();
ldap.ServerName = "ldap.example.com";
ldap.Timeout = 30;
// Many servers allow the root DSE to be read anonymously, so the component connects without binding.
ldap.Connect();
ldap.DN = "";
ldap.SearchScope = LDAPSearchScopes.ssBaseObject;
ldap.Search("objectClass=*");
foreach (LDAPAttribute attr in ldap.Attributes) {
  Console.WriteLine(attr.AttributeType + " = " + attr.Value);
}

Attributes that have several values (such as namingContexts and supportedControl) appear in the collection once for each value. The first item holds the attribute's name in its AttributeType field, and the items for the remaining values have an empty AttributeType.

Reading a Specific Attribute

To read a single attribute, use the Attr method, which returns the value of the specified attribute from the Attributes collection. For example, the following code retrieves the base DN of the directory:

string baseDN = ldap.Attr("defaultNamingContext");
Console.WriteLine("Base DN: " + baseDN);

To request only certain attributes, add their names to the Attributes collection before calling Search. This is also useful for operational attributes, which many servers return only when they are requested by name. Since the collection is also used by other operations, clear it before a search that should return all attributes.

ldap.Attributes.Clear();
ldap.Attributes.Add(new LDAPAttribute("namingContexts"));
ldap.Attributes.Add(new LDAPAttribute("supportedLDAPVersion"));
ldap.Search("objectClass=*");

Common Root DSE Attributes

Notes

• Some servers only return the root DSE to clients that have bound to the server. In this case, set DN and Password to the credentials of a user and call Bind instead of Connect (and then set DN to an empty string).
• When Timeout is set to 0, the component operates asynchronously, and the results are available once the SearchComplete event fires.
• In Active Directory, the LDAP component uses the defaultNamingContext attribute automatically to locate the Users and Computers containers for methods such as ChangePassword and ListGroups. For more information, please see our Changing User Passwords with the LDAP Component entry.

Note that in older versions of IPWorks, the returned attributes were read using the AttrCount, AttrType, and AttrValue array properties, which have been replaced by the Attributes collection.