dsGetUsersGrps Error 1001

 Keywords: dsGetUsersGrps Error 1001 Bad ADSI path name dsGetUserGrps dsGetUsersGrp

Question:

I am getting the error 1001: Bad ADSI path name when executing dsGetUsersGrps. I have confirmed I am passing a valid user path. In fact the user path is generated by the dsFindPath function. WHat could be causing this problem?

Answer:

The error doesn't mean that the user's path is invalid, it means that a group path returned to the extender by AD is invalid. Do any of your group paths contain invalid characters? (i.e. slashes, commas etc.)

User Reply:

I found the problem. Some of the groups (not direct, but nested) had the forward slash "/" character in their name (CN attribute) Apparently "displayName" and other attributes like Canonical name and Distinguished Name can have this "/" and it doesn't cause problems.
I have changed my group names for now but the standard Microsoft tool for creating groups (Microsoft Exchange Management Console) allows you to create a group name with the "/". The ADUC (Microsoft's AD users and computers) tool warns you not to use "/" or other characters.

I prefer if you could ignore or accommodate these invalid names or at least give an error that is more useful like� "invalid ADSI path in this object or one of the groups that it is a member of"

Answer:

For obvious reasons forward slashes need to be escaped. AD sometimes returns the paths with that character escaped and sometimes it doesn't. I consider it an AD bug. When you are submitting a path to the extender it always needs to be escaped but that is not the issue here since the dsGetUsersGrps function is having the problem with paths returned by AD.

I will add the error message change request to the enhancement list. For now it looks like you will need to capture for the 1001 error then use some alternative means to get a list of group names. Check out the following tech article:

; Probably will not work as is across domains.
#DefineFunction GetAllGroups(strServer, strObjPath, plAllGroups)
   ; Look for a nested group.
   lMembership = dsGetProperty(strObjPath, "memberOf")
   nMemberOfs = ItemCount( lMembership, @TAB)
   For i = 1 To nMemberOfs

      ; Get the next group.
      strPath = ItemExtract(i, lMembership, @TAB)
      strPath = strServer:"/":strPath

      ; Check for tombstones.
      If dsIsObject(strPath)

         ; Prevent duplicates and infinity
         If ItemLocate(strPath, *plAllGroups, @TAB) Then Continue

         ; Add to group list
         *plAllGroups = ItemInsert(strPath, -1, *plAllGroups, @TAB)

         ; Add groups memeber to list
         GetAllGroups(strServer, strPath, plAllGroups)
      EndIf
   Next

   Return 1
#EndFunction

AddExtender("WWADS44I.DLL")

; Construct the full domain ADSI path.
ServerDn = dsGetProperty("LDAP://rootDSE", "serverName")
ServerName = ItemExtract(1, ServerDn, ",")
ServerName = ItemExtract(2, ServerName, "=")

; Set values by method of choice.
strServer  =  "LDAP://":ServerName ; Our test server
strUserSam = "homer simpson"          ; !!!! A test user with convoluted group membership.!!!!
lAllGroups = ""

; Get the full path.
strUser = dsFindPath(strServer, "(&(objectCategory=person)(sAMAccountName=%strUserSam%))")
If strUser == ""
   Message("Blah Blah Blah", "Bad user SAM name")
   Exit
EndIf

; Get regular groups
GetAllGroups(strServer, strUser, &lAllGroups)

; Get Primary group when necessary.
strPrimGroup = dsGetPrimGrp(strUser)
If !ItemLocate( strPrimGroup, lAllGroups, @TAB )
   lAllGroups   = ItemInsert(strPrimGroup, -1, lAllGroups, @TAB)
   GetAllGroups(strServer, strPrimGroup, &lAllGroups)
EndIf

AskItemlist("All Groups", lAllGroups,@TAB,@UNSORTED,@SINGLE)
Exit

An interesting regular expression for escaping illegal LDAP path characters can be found here http://blogs.imeta.co.uk/TPeplow/archive/2008/07/03/300.aspx

Article ID:   W17527

Filename:   dsGetUsersGrps Error 1001.txt

File Created: 2011:08:18:08:08:18

Last Updated: 2011:08:18:08:08:18

Database Search

TechHome