非微软Active Directory环境下将LDAP用户添加至安全组的PowerShell脚本需求

核心说明 #

在Samba3 LDAP环境中，不能通过直接设置用户的memberOf属性来添加用户到组——这个属性是LDAP自动维护的反向引用。正确的做法是修改目标组的member属性，将用户的完整DN（区分名）添加进去。

脚本实现（添加现有用户到组） #

# LDAP服务器配置
$ldapServer = "LDAP://w.x.y.z/DC=acne,DC=local"
$ldapUsername = "username@snap.local"
$ldapPassword = "user_password"

# 目标用户与组信息
$targetUserSamAccountName = "user"  # 要添加的用户sAMAccountName
$targetGroupName = "Production"     # 目标安全组名称

# 1. 连接LDAP服务器
$rootEntry = New-Object System.DirectoryServices.DirectoryEntry($ldapServer, $ldapUsername, $ldapPassword)
$rootEntry.AuthenticationType = [System.DirectoryServices.AuthenticationTypes]::Secure

# 2. 查找目标用户对象
$userSearcher = New-Object System.DirectoryServices.DirectorySearcher($rootEntry)
$userSearcher.Filter = "(&(objectClass=user)(sAMAccountName=$targetUserSamAccountName))"
$userResult = $userSearcher.FindOne()
if (-not $userResult) {
    Write-Error "未找到用户: $targetUserSamAccountName"
    exit 1
}
$userEntry = $userResult.GetDirectoryEntry()
$userDN = $userEntry.Properties["distinguishedName"].Value

# 3. 查找目标组对象
$groupSearcher = New-Object System.DirectoryServices.DirectorySearcher($rootEntry)
$groupSearcher.Filter = "(&(objectClass=group)(cn=$targetGroupName))"
$groupResult = $groupSearcher.FindOne()
if (-not $groupResult) {
    Write-Error "未找到组: $targetGroupName"
    exit 1
}
$groupEntry = $groupResult.GetDirectoryEntry()

# 4. 将用户添加到组的member属性
$groupEntry.Properties["member"].Add($userDN)
$groupEntry.CommitChanges()

# 清理资源
$userEntry.Close()
$groupEntry.Close()
$rootEntry.Close()

Write-Host "用户 $targetUserSamAccountName 已成功添加至组 $targetGroupName"

可选：创建新用户并直接添加到组 #

如果需要在创建用户的同时就将其加入组，可以整合你的原有脚本（修正原脚本中$Props应为$properties的变量错误）后添加组操作：

# Server credential
$ldapServer = "LDAP://w.x.y.z/DC=acne,DC=local"
$ldapUsername = "username@snap.local"
$ldapPassword = "user_password"
$targetGroupName = "Production"

# Connect to the LDAP server
$rootEntry = New-Object System.DirectoryServices.DirectoryEntry($ldapServer, $ldapUsername, $ldapPassword)
$rootEntry.AuthenticationType = [System.DirectoryServices.AuthenticationTypes]::Secure

# 用户属性配置
$properties = @{
    "sAMAccountName" = "user"
    "userPrincipalName" = "user@acne.local"
    "userAccountControl" = 66048
    "givenName" = "User"
    "sn" = "One"
    "displayName" = "User One"
}

# 1. 添加新用户
$userCN = "CN=" + $properties["displayName"] + ",CN=Users"
$newUser = $rootEntry.Children.Add($userCN, "user")

foreach ($p in $properties.GetEnumerator()) {
    $newUser.Properties[$p.Key].Value = $p.Value
}

$newUser.CommitChanges()
$userDN = $newUser.Properties["distinguishedName"].Value

# 2. 查找目标组并添加用户
$groupSearcher = New-Object System.DirectoryServices.DirectorySearcher($rootEntry)
$groupSearcher.Filter = "(&(objectClass=group)(cn=$targetGroupName))"
$groupResult = $groupSearcher.FindOne()
if ($groupResult) {
    $groupEntry = $groupResult.GetDirectoryEntry()
    $groupEntry.Properties["member"].Add($userDN)
    $groupEntry.CommitChanges()
    $groupEntry.Close()
    Write-Host "新用户已创建并添加至组 $targetGroupName"
} else {
    Write-Warning "未找到组 $targetGroupName，用户创建完成但未加入组"
}

# 清理资源
$newUser.Close()
$rootEntry.Close()

注意事项 #

• 确保使用的LDAP账号拥有修改组属性的权限
• 确认用户和组的DN路径正确：Zentyal的用户/组默认存储在CN=Users,DC=acne,DC=local下
• 若组不存在，可提前通过Zentyal管理界面或LDAP命令创建安全组

内容的提问来源于stack exchange，提问作者James