PowerShell で LDAP 接続を検証する。段階的に確認するスクリプトと、返ってくる値の読み方

# ▼ 変数（ここだけ書き換え）
$LdapHost = "ldap01.example.local"
$Port     = 389

# ▼ 実行（そのまま貼る）
Test-NetConnection $LdapHost -Port $Port

ComputerName     : ldap01.example.local
RemoteAddress    : 192.0.2.10
RemotePort       : 389
TcpTestSucceeded : True

Test-NetConnection ldap://ldap01.example.local -Port 389   # ✗ 失敗する
Test-NetConnection ldap01.example.local -Port 389          # ✓

WARNING: Name resolution of ldap://ldap01.example.local failed
TcpTestSucceeded : False

# ▼ 変数（ここだけ書き換え）
$LdapUrl = "ldap://ldap01.example.local:389/ou=people,dc=example,dc=com"

# ▼ 実行（そのまま貼る）
$u = [uri]$LdapUrl

$port = if ($u.Port -gt 0) { $u.Port } elseif ($u.Scheme -eq 'ldaps') { 636 } else { 389 }
Test-NetConnection $u.Host -Port $port

$u.Host    # ldap01.example.local
$port      # 389
[uri]::UnescapeDataString($u.AbsolutePath.TrimStart('/'))   # ou=people,dc=example,dc=com

ldap://ldap01.example.local        -> $u.Port = 389
ldaps://ldap01.example.local       -> $u.Port = -1
ldap://ldap01.example.local:1389   -> $u.Port = 1389

# ▼ 変数（ここだけ書き換え）
$LdapHost     = "ldap01.example.local"
$Port         = 389
$RootDseAttrs = "namingContexts", "defaultNamingContext", "vendorName", "vendorVersion", "supportedLDAPVersion"

# ▼ 実行（そのまま貼る）
Add-Type -AssemblyName System.DirectoryServices.Protocols

$id  = New-Object System.DirectoryServices.Protocols.LdapDirectoryIdentifier($LdapHost, $Port)
$con = New-Object System.DirectoryServices.Protocols.LdapConnection($id)
$con.SessionOptions.ProtocolVersion = 3
$con.AuthType = [System.DirectoryServices.Protocols.AuthType]::Anonymous
$con.Bind()

$req = New-Object System.DirectoryServices.Protocols.SearchRequest(
    "",
    "(objectClass=*)",
    [System.DirectoryServices.Protocols.SearchScope]::Base,
    [string[]]$RootDseAttrs)

$res = $con.SendRequest($req)
echo '----------------------------------------'
foreach ($a in $res.Entries[0].Attributes.AttributeNames) {
    "{0}: {1}" -f $a, (@($res.Entries[0].Attributes[$a].GetValues([string])) -join ', ')
    ""
}
echo '----------------------------------------'

----------------------------------------
namingcontexts: dc=example,dc=com

vendorname: Open Identity Platform Community

vendorversion: OpenDJ Server 5.1.2

supportedldapversion: 2, 3

----------------------------------------

# ▼ 変数（ここだけ書き換え）
$LdapHost = "ldap01.example.local"
$Port     = 389
$BindDn   = "uid=testuser,ou=people,dc=example,dc=com"
$Password = "<パスワード>"

# ▼ 実行（そのまま貼る）
Add-Type -AssemblyName System.DirectoryServices.Protocols

$id  = New-Object System.DirectoryServices.Protocols.LdapDirectoryIdentifier($LdapHost, $Port)
$con = New-Object System.DirectoryServices.Protocols.LdapConnection($id)
$con.SessionOptions.ProtocolVersion = 3
$con.AuthType = [System.DirectoryServices.Protocols.AuthType]::Basic
$con.Credential = New-Object System.Net.NetworkCredential($BindDn, $Password)

try {
    $con.Bind()
    "BIND OK"
} catch [System.DirectoryServices.Protocols.LdapException] {
    "ErrorCode : $($_.Exception.ErrorCode)"
    "Message   : $($_.Exception.Message)"
    "Server    : $($_.Exception.ServerErrorMessage)"
}

BIND OK

ダメ : testuser
OK   : uid=testuser,ou=people,dc=example,dc=com

# ▼ 変数（ここだけ書き換え）
$LdapHost   = "ldap01.example.local"
$Port       = 389
$BindDn     = "uid=testuser,ou=people,dc=example,dc=com"
$Password   = "<パスワード>"
$SearchBase = "ou=people,dc=example,dc=com"
$Filter     = "(objectClass=inetOrgPerson)"

# ▼ 実行（そのまま貼る）
Add-Type -AssemblyName System.DirectoryServices.Protocols

# --- 接続＋バインド（STEP 3 と同じ。STEP 3 の直後ならここは飛ばしてOK）---
$id  = New-Object System.DirectoryServices.Protocols.LdapDirectoryIdentifier($LdapHost, $Port)
$con = New-Object System.DirectoryServices.Protocols.LdapConnection($id)
$con.SessionOptions.ProtocolVersion = 3
$con.AuthType = [System.DirectoryServices.Protocols.AuthType]::Basic
$con.Credential = New-Object System.Net.NetworkCredential($BindDn, $Password)
$con.Bind()

# --- 検索 ---
$req = New-Object System.DirectoryServices.Protocols.SearchRequest(
    $SearchBase,
    $Filter,
    [System.DirectoryServices.Protocols.SearchScope]::Subtree)

$res = $con.SendRequest($req)
"ヒット件数: $($res.Entries.Count)"

echo '----------------------------------------'
foreach ($e in $res.Entries) {
    "dn: $($e.DistinguishedName)"
    foreach ($a in $e.Attributes.AttributeNames) {
        "    {0}: {1}" -f $a, (@($e.Attributes[$a].GetValues([string])) -join ' / ')
    }
    ""
}
echo '----------------------------------------'

ヒット件数: 1
----------------------------------------
dn: uid=testuser,ou=people,dc=example,dc=com
    uid: testuser
    givenname: testuser
    objectclass: top / inetOrgPerson / organizationalPerson / person
    cn: testuser
    sn: testuser

----------------------------------------

function Invoke-LdapSearchLimited {
    param($Connection, [string]$Base, [string]$Filter, [int]$Max)

    $req = New-Object System.DirectoryServices.Protocols.SearchRequest(
        $Base, $Filter, [System.DirectoryServices.Protocols.SearchScope]::Subtree)
    $req.SizeLimit = $Max        # 0 = 無制限

    try {
        $res = $Connection.SendRequest($req)
        [pscustomobject]@{ Entries = $res.Entries; Truncated = $false }
    } catch [System.DirectoryServices.Protocols.DirectoryOperationException] {
        # 上限に達した場合、例外の Response に「そこまでの結果」が入っている
        if ($_.Exception.Response.ResultCode -eq 'SizeLimitExceeded') {
            [pscustomobject]@{ Entries = $_.Exception.Response.Entries; Truncated = $true }
        } else {
            throw
        }
    }
}

# ▼ 変数（ここだけ書き換え）
$SearchBase = "ou=people,dc=example,dc=com"
$Filter     = "(objectClass=inetOrgPerson)"
$MaxResults = 20

# ▼ 実行（STEP 4 でバインド済みの $con を使う）
$r = Invoke-LdapSearchLimited -Connection $con -Base $SearchBase -Filter $Filter -Max $MaxResults

if ($r.Truncated) {
    Write-Host "[!] $MaxResults 件で打ち切りました。まだ続きがあります。" -ForegroundColor Yellow
    echo '----------------------------------------'
    foreach ($e in $r.Entries) { "  dn: $($e.DistinguishedName)" }
    echo '----------------------------------------'

    if ((Read-Host "全件を取得して続けますか？ (y/N)") -notmatch '^[yY]') { return }

    # y なら上限なしで取り直す
    $r = Invoke-LdapSearchLimited -Connection $con -Base $SearchBase -Filter $Filter -Max 0
}

[!] 2 件で打ち切りました。まだ続きがあります。
----------------------------------------
  dn: dc=example,dc=com
  dn: ou=people,dc=example,dc=com
----------------------------------------

[OK] ヒット件数: 3
----------------------------------------
  dn: dc=example,dc=com
  dn: ou=people,dc=example,dc=com
  dn: uid=testuser,ou=people,dc=example,dc=com
----------------------------------------

# 上限で打ち切って部分結果を返すヘルパー（前節のもの）
function Invoke-LdapSearchLimited {
    param($Connection, [string]$Base, [string]$Filter, [int]$Max)

    $req = New-Object System.DirectoryServices.Protocols.SearchRequest(
        $Base, $Filter, [System.DirectoryServices.Protocols.SearchScope]::Subtree)
    $req.SizeLimit = $Max        # 0 = 無制限

    try {
        $res = $Connection.SendRequest($req)
        [pscustomobject]@{ Entries = $res.Entries; Truncated = $false }
    } catch [System.DirectoryServices.Protocols.DirectoryOperationException] {
        if ($_.Exception.Response.ResultCode -eq 'SizeLimitExceeded') {
            [pscustomobject]@{ Entries = $_.Exception.Response.Entries; Truncated = $true }
        } else {
            throw
        }
    }
}

function Test-LdapConnection {
    param(
        [string]$LdapHost = "ldap01.example.local",
        [int]   $Port     = 389,
        [string]$BindDn   = "uid=testuser,ou=people,dc=example,dc=com",
        [string]$Password,
        [string]$SearchBase = "ou=people,dc=example,dc=com",
        [string]$Filter     = "(objectClass=inetOrgPerson)",
        [int]   $MaxResults = 20
    )

    Add-Type -AssemblyName System.DirectoryServices.Protocols

    # STEP 1
    if (-not (Test-NetConnection $LdapHost -Port $Port -WarningAction SilentlyContinue).TcpTestSucceeded) {
        Write-Host "[NG] ${LdapHost}:${Port} に到達できません" -ForegroundColor Red
        return
    }
    Write-Host "[OK] ポート疎通" -ForegroundColor Green

    $id = New-Object System.DirectoryServices.Protocols.LdapDirectoryIdentifier($LdapHost, $Port)

    # STEP 2
    $anon = New-Object System.DirectoryServices.Protocols.LdapConnection($id)
    $anon.SessionOptions.ProtocolVersion = 3
    $anon.AuthType = [System.DirectoryServices.Protocols.AuthType]::Anonymous
    try {
        $anon.Bind()
        $r = $anon.SendRequest((New-Object System.DirectoryServices.Protocols.SearchRequest(
            "", "(objectClass=*)",
            [System.DirectoryServices.Protocols.SearchScope]::Base, "namingContexts")))
        $nc = @($r.Entries[0].Attributes["namingContexts"].GetValues([string]))
        Write-Host "[OK] RootDSE  namingContexts: $($nc -join ', ')" -ForegroundColor Green
    } catch {
        Write-Host "[--] 匿名バインド不可（禁止設定なら正常）" -ForegroundColor DarkGray
    }

    # STEP 3
    $con = New-Object System.DirectoryServices.Protocols.LdapConnection($id)
    $con.SessionOptions.ProtocolVersion = 3
    $con.AuthType = [System.DirectoryServices.Protocols.AuthType]::Basic
    $con.Credential = New-Object System.Net.NetworkCredential($BindDn, $Password)
    try {
        $con.Bind()
        Write-Host "[OK] バインド成功: $BindDn" -ForegroundColor Green
    } catch [System.DirectoryServices.Protocols.LdapException] {
        Write-Host "[NG] バインド失敗 code=$($_.Exception.ErrorCode) $($_.Exception.Message)" -ForegroundColor Red
        Write-Host "     server: $($_.Exception.ServerErrorMessage)" -ForegroundColor Red
        return
    }

    # STEP 4
    try {
        $r = Invoke-LdapSearchLimited -Connection $con -Base $SearchBase -Filter $Filter -Max $MaxResults

        if ($r.Truncated) {
            Write-Host "[!] $MaxResults 件で打ち切りました。まだ続きがあります。" -ForegroundColor Yellow
            echo '----------------------------------------'
            foreach ($e in $r.Entries) { "  dn: $($e.DistinguishedName)" }
            echo '----------------------------------------'

            if ((Read-Host "全件を取得して続けますか？ (y/N)") -notmatch '^[yY]') {
                Write-Host "[--] ここで中断しました" -ForegroundColor DarkGray
                return
            }
            $r = Invoke-LdapSearchLimited -Connection $con -Base $SearchBase -Filter $Filter -Max 0
        }

        Write-Host "[OK] ヒット件数: $($r.Entries.Count)" -ForegroundColor Green
        echo '----------------------------------------'
        foreach ($e in $r.Entries) { "  dn: $($e.DistinguishedName)" }
        echo '----------------------------------------'

    } catch [System.DirectoryServices.Protocols.DirectoryOperationException] {
        $rc = $_.Exception.Response.ResultCode
        Write-Host "[NG] 検索失敗 code=$([int]$rc) ($rc)" -ForegroundColor Red
        Write-Host "     $($_.Exception.Response.ErrorMessage)" -ForegroundColor Red
    }
}

# ▼ 変数（ここだけ書き換え）
$LdapHost   = "ldap01.example.local"
$Port       = 389
$BindDn     = "uid=testuser,ou=people,dc=example,dc=com"
$Password   = "<パスワード>"
$SearchBase = "ou=people,dc=example,dc=com"
$Filter     = "(objectClass=inetOrgPerson)"
$MaxResults = 20

# ▼ 実行（そのまま貼る）※ 上の関数定義を先に流しておくこと
$params = @{
    LdapHost   = $LdapHost
    Port       = $Port
    BindDn     = $BindDn
    Password   = $Password
    SearchBase = $SearchBase
    Filter     = $Filter
    MaxResults = $MaxResults
}
Test-LdapConnection @params

[OK] ポート疎通
[OK] RootDSE  namingContexts: dc=example,dc=com
[OK] バインド成功: uid=testuser,ou=people,dc=example,dc=com
[OK] ヒット件数: 1
----------------------------------------
  dn: uid=testuser,ou=people,dc=example,dc=com
----------------------------------------

Add-Type -AssemblyName System.DirectoryServices.Protocols

$LdapHost   = "ldap01.example.local"; $Port = 389
$BindDn     = "uid=testuser,ou=people,dc=example,dc=com"
$Password   = "********"
$OutDir     = "$env:USERPROFILE\ldap-schema"

$id  = New-Object System.DirectoryServices.Protocols.LdapDirectoryIdentifier($LdapHost, $Port)
$con = New-Object System.DirectoryServices.Protocols.LdapConnection($id)
$con.SessionOptions.ProtocolVersion = 3
$con.AuthType   = [System.DirectoryServices.Protocols.AuthType]::Basic
$con.Credential = New-Object System.Net.NetworkCredential($BindDn, $Password)
$con.Bind()

function Get-LdapEntries($Base, $Filter, $Scope, [string[]]$Attrs) {
    $req = New-Object System.DirectoryServices.Protocols.SearchRequest($Base, $Filter, $Scope, $Attrs)
    $con.SendRequest($req).Entries
}
function Split-OidList($s) { if ($s) { $s -split '[\s$]+' | Where-Object { $_ } } }
function Get-DefList($def, $keyword) {
    if ($def -cmatch "\b$keyword\s+(?:\(([^)]*)\)|(\S+))") { Split-OidList ($Matches[1] + $Matches[2]) }
}

# 1. スキーマの場所を RootDSE に聞く
$root     = Get-LdapEntries "" "(objectClass=*)" Base @("subschemaSubentry")
$schemaDn = $root[0].Attributes["subschemaSubentry"][0]
"Schema DN: $schemaDn"

# 2. objectClasses の定義を解析する
$schema  = Get-LdapEntries $schemaDn "(objectClass=*)" Base @("objectClasses")
$classes = @{}
foreach ($def in $schema[0].Attributes["objectClasses"].GetValues([string])) {
    if ($def -cnotmatch "\bNAME\s+\(?\s*'([^']+)'") { continue }
    $name = $Matches[1]
    $kind = if ($def -cmatch "\b(STRUCTURAL|AUXILIARY|ABSTRACT)\b") { $Matches[1] } else { "STRUCTURAL" }
    $classes[$name] = [pscustomobject]@{
        Name = $name; Kind = $kind
        Sup  = @(Get-DefList $def "SUP")
        Aux  = @(Get-DefList $def "AUX")
        Must = @(Get-DefList $def "MUST")
        May  = @(Get-DefList $def "MAY")
    }
}

# 3. 親クラス（と補助クラス）をたどって、クラス×属性の一覧にする
function Get-ClassAttrs($cls, $seen = @{}) {
    if (-not $classes.ContainsKey($cls) -or $seen[$cls]) { return }
    $seen[$cls] = $true
    $c = $classes[$cls]
    foreach ($a in $c.Must) { [pscustomobject]@{ Attribute = $a; Required = "MUST"; DefinedIn = $cls } }
    foreach ($a in $c.May)  { [pscustomobject]@{ Attribute = $a; Required = "MAY";  DefinedIn = $cls } }
    foreach ($s in ($c.Sup + $c.Aux)) { Get-ClassAttrs $s $seen }
}

New-Item -ItemType Directory -Force $OutDir | Out-Null

$classes.Values | Sort-Object Name |
    Select-Object Name, Kind, @{n = "Sup"; e = { $_.Sup -join "," }} |
    Export-Csv "$OutDir\classes.csv" -NoTypeInformation -Encoding UTF8

$classes.Keys | Sort-Object | ForEach-Object {
    $cls = $_
    Get-ClassAttrs $cls | Sort-Object Attribute -Unique |
        Select-Object @{n = "Class"; e = { $cls }}, Attribute, Required, DefinedIn
} | Export-Csv "$OutDir\class-attributes.csv" -NoTypeInformation -Encoding UTF8

# 例：inetOrgPerson（AD なら user）だけ画面に出す
Get-ClassAttrs "inetOrgPerson" | Sort-Object Required, Attribute | Format-Table -AutoSize

$SearchBase = "dc=example,dc=com"

$req  = New-Object System.DirectoryServices.Protocols.SearchRequest(
          $SearchBase, "(objectClass=*)",
          [System.DirectoryServices.Protocols.SearchScope]::Subtree, [string[]]@("objectClass"))
$page = New-Object System.DirectoryServices.Protocols.PageResultRequestControl(500)
[void]$req.Controls.Add($page)

$counts = @{}
do {
    $res = $con.SendRequest($req)
    foreach ($e in $res.Entries) {
        $key = ($e.Attributes["objectclass"].GetValues([string]) |
                Where-Object { $_ -ne "top" } | Sort-Object) -join ","
        $counts[$key]++
    }
    $prc = $res.Controls | Where-Object { $_ -is [System.DirectoryServices.Protocols.PageResultResponseControl] }
    $page.Cookie = $prc.Cookie
} while ($prc -and $prc.Cookie.Length -gt 0)

$counts.GetEnumerator() | Sort-Object Value -Descending |
    Select-Object @{n = "ObjectClasses"; e = { $_.Key }}, @{n = "Count"; e = { $_.Value }} |
    Format-Table -AutoSize

$u = Get-LdapEntries "CN=taro,CN=Users,DC=example,DC=local" "(objectClass=*)" Base @("allowedAttributes")
$u[0].Attributes["allowedattributes"].GetValues([string]) | Sort-Object

rem ▼ 変数（ここだけ書き換え）
set "OPENDJ_HOME=<OpenDJのインストール先>"
set "LDAP_HOST=localhost"
set "LDAP_PORT=389"
set "BIND_DN=uid=testuser,ou=people,dc=example,dc=com"
set "BIND_PW=<パスワード>"
set "SEARCH_BASE=ou=people,dc=example,dc=com"
set "FILTER=(objectClass=inetOrgPerson)"

rem ▼ 実行（そのまま貼る）
"%OPENDJ_HOME%\bat\ldapsearch.bat"^
 -h %LDAP_HOST% -p %LDAP_PORT%^
 -D "%BIND_DN%"^
 -w "%BIND_PW%"^
 -b "%SEARCH_BASE%"^
 -s sub "%FILTER%" "*"

dn: uid=testuser,ou=people,dc=example,dc=com
cn: testuser
givenName: testuser
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: testuser
uid: testuser

80090308: LdapErr: DSID-0C09044E, comment: AcceptSecurityContext error, data 52e, v4563

if ($_.Exception.ServerErrorMessage -match 'data ([0-9a-f]+)') {
    "AD data   : $($Matches[1])"
}

"0" 個の引数を指定して "Bind" を呼び出し中に例外が発生しました: "この操作には強力な認証が必要です。"
    + FullyQualifiedErrorId : DirectoryOperationException

} catch [System.DirectoryServices.Protocols.DirectoryOperationException] {
    "ResultCode: $($_.Exception.Response.ResultCode)"   # StrongAuthRequired
    "Message   : $($_.Exception.Message)"
}

$Port = 636
$id  = New-Object System.DirectoryServices.Protocols.LdapDirectoryIdentifier($LdapHost, $Port)
$con = New-Object System.DirectoryServices.Protocols.LdapConnection($id)
$con.SessionOptions.ProtocolVersion = 3
$con.SessionOptions.SecureSocketLayer = $true

$con.SessionOptions.StartTransportLayerSecurity($null)

$con.AuthType = [System.DirectoryServices.Protocols.AuthType]::Negotiate
$con.SessionOptions.Signing = $true
$con.SessionOptions.Sealing = $true
$con.Credential = New-Object System.Net.NetworkCredential("testuser", $Password, "EXAMPLE")

reg query HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters /v LDAPServerIntegrity

"0" 個の引数を指定して "FindAll" を呼び出し中に例外が発生しました: "エラーを特定できません"
    + FullyQualifiedErrorId : COMException

try {
    $ds.FindAll()
} catch {
    $e = $_.Exception
    while ($e.InnerException) { $e = $e.InnerException }   # 最後まで辿る
    "Type    : " + $e.GetType().FullName
    "Message : " + $e.Message
    "HRESULT : 0x" + ('{0:X8}' -f $e.HResult)
}

$_.Exception.Response.ResultCode     # 32 とか 49 とか
$_.Exception.Response.ErrorMessage   # サーバーが返した説明文

検索ベースに指定されたエントリ ou=people,dc=nosuch,dc=com が
ディレクトリサーバー内に存在しません

$ds.SearchRoot = $directoryEntry   # 接続先と認証情報をセット
$ds.SearchRoot = $SearchBase       # ← これで全部消える

上書き前: Path='LDAP://ldap01.example.local:389'  Username='uid=testuser,ou=people,dc=example,dc=com'
上書き後: Path=''                                 Username=''   AuthType=(空)

$de = New-Object System.DirectoryServices.DirectoryEntry(
        "LDAP://ldap01.example.local:389/ou=people,dc=example,dc=com",
        "uid=testuser,ou=people,dc=example,dc=com",
        "<パスワード>",
        [System.DirectoryServices.AuthenticationTypes]::None)   # simple bind

& cmd.exe /c "ldapsearch.bat -b ""ou=people,dc=example,dc=com"" ..."