Powershell list group membership of user (Novell eDirectory) NDS LDAP

Question

Trying to figure out, how to map a network share based on group membership of Novell eDir. I found a smart script in Technet for ActiveDirectory via ADSISEARCHER which is working pretty well in AD :)

# extract group names and removes unnecessary characters
$memberOf = ([ADSISEARCHER]"samaccountname=$($env:USERNAME)").Findone().$does.memberof -replace '^CN=([^,]+).+$','$1'

# check if user is member of group A
if($memberOf -contains "GroupA") {
  # map network-drive
  (New-Object -ComObject WScript.Network).MapNetworkDrive('X:','\\filer\sharename')

}

Is there any chance to use something similar for NDS? As far as I researched I have to use LDAP to connect to NDS and list all groups of a user object, but haven't much luck yet.

Thx

Answer 1

I found a useful script out there which I just have to edit a littlebit...

URL to Script: http://activedirectoryfaq.com/2014/01/searching-novell-nds-edirectory-with-powershell/

My final script in case somebody needs this crap:

<#
.SYNOPSIS
    Mapping a network share based on a specific group membership in NDS
.DESCRIPTION
    The script is mapping a network drive, based on a NDS group membership.
    The first match wins!
#>

# --------<SET CORRESPONDING VALUES HERE >--------

# Hostname of eDir Server (e.g.: NDSSRV01):
$LDAPServer = "hostname"

# Name of BaseDN (e.g.: o=MyCompany):
$dn = "o=basedn"

# ------------------------------------------------

# set username of current logged on user
$filter = "(uid=$env:USERNAME)"

# Creating necessary objects
[reflection.assembly]::LoadWithPartialName("system.directoryservices.protocols") | out-null
$ldapIdentifier = new-object directoryservices.protocols.ldapdirectoryidentifier($LDAPServer)
$ldapConnection = new-object directoryservices.protocols.ldapconnection($ldapIdentifier,$null,0)

# Attributes to search for:
# To search for multiple use comma separated list (eg: "groupmembership","cn","emailAddress")
[string[]]$attr = "groupmembership"

# Establishing LDAP connection
$scope = $ADS_SCOPE_SUBTREE
$searchRequest = new-object directoryservices.protocols.searchrequest($dn,$filter,$ADS_SCOPE_SUBTREE,$attr)

$searchRequest.typesonly = $false
$searchRequest.sizelimit = 10
$result = [directoryservices.protocols.searchresponse]$ldapConnection.sendrequest($searchRequest)
$entry = $result.entries

# extract group names and removes unnecessary characters
$membership = $entry[0].Attributes["groupmembership"].getValues([string]) -replace '^CN=([^,]+).+$','$1'

# check if user is member of group A
if($membership -contains "GroupA") {
  # map network-drive
  (New-Object -ComObject WScript.Network).MapNetworkDrive('X:','\\filer\sharegroupa')
}

# check if user is member of group B
elseif($membership -contains "GroupB") {
  # map network-drive
  (New-Object -ComObject WScript.Network).MapNetworkDrive('X:','\\filer\sharegroupb')
}

# elseif() ... and so on

# if nothing matches, then:
else {
  Write-Host 'current user is not a member of a specified group'
}