Active Directory Profile
Relevant source files
The following files were used as context for generating this wiki page:
The Active Directory (AD) Profile is a specialized server implementation within the flext-ldif library designed to handle the unique requirements of Microsoft Active Directory LDIF data. It extends the base RFC 2849 functionality to support AD-specific attribute syntaxes, proprietary Access Control List (ACL) formats like nTSecurityDescriptor, and specialized object identification markers.
This profile is integrated into the project's Clean Architecture as an infrastructure adapter, allowing the core application service to process AD exports with high fidelity and proper normalization. It ensures that binary identifiers such as objectGUID and objectSid are correctly detected and that complex security descriptors are parsed into a structured format for migration or analysis.
Sources: src/flext_ldif/servers/ad.py:1-20, src/README.md:15-30
Architecture and Components
The Active Directory Profile is implemented in the FlextLdifServersAd class, which inherits from the RFC server base. It follows a modular structure where sub-classes manage specific domain concerns: Schema, ACL, and Entry detection.
The diagram above shows the inheritance from the RFC base and the internal component structure of the AD server profile.
Sources: src/flext_ldif/servers/ad.py:15-20
Technical Constants
The profile defines a comprehensive set of constants that drive the detection and processing logic.
| Constant | Value / Description |
|---|---|
SERVER_TYPE | "ad" |
GLOBAL_CATALOG_PORT | 3268 |
DETECTION_OID_PATTERN | 1\.2\.840\.113556\. (Microsoft Enterprise OID) |
ACL_ATTRIBUTE_NAME | nTSecurityDescriptor |
ENCODING_UTF16LE | Used for decoding SDDL values |
DETECTION_WEIGHT | 8 (High priority for auto-detection) |
Sources: src/flext_ldif/servers/ad.py:22-132
Detection Logic
The AD Profile employs a multi-faceted detection strategy to identify Active Directory entries within an LDIF stream. This is critical for applying the correct transformation rules during migration.
Detection Flow
This flow represents the priority sequence used by the Entry.can_handle method.
The detection specifically looks for:
- DN Markers: Presence of
cn=users,cn=computers, orcn=configuration. - Attributes: Existence of
samAccountName,objectGUID,objectSid, oruserPrincipalName. - ObjectClasses: Presence of
user,computer,group, orforeignSecurityPrincipal.
Sources: src/flext_ldif/servers/ad.py:65-100, src/flext_ldif/servers/ad.py:295-325
Access Control List (ACL) Processing
Active Directory uses the nTSecurityDescriptor attribute to store permissions. This attribute contains binary data representing a Security Descriptor, which can be expressed in Security Descriptor Definition Language (SDDL).
SDDL Parsing and Decoding
The Acl component of the profile is responsible for identifying and decoding these descriptors. If the value is base64 encoded, the profile attempts to decode it using utf-16-le (Active Directory's native encoding for unicode strings) or utf-8 as a fallback.
Sequence diagram showing the decoding path for AD security descriptors.
Sources: src/flext_ldif/servers/ad.py:192-280, src/flext_ldif/_models/domain_metadata.py:240-250
Schema and Attribute Handling
The AD Profile defines specific rules for schema normalization and attribute preservation during migration.
Operational Attributes
Active Directory contains several system-managed attributes that are typically excluded or treated specially during migration:
- Identifiers:
objectGUID,objectSid,distinguishedName. - Timestamps:
whenCreated,whenChanged,lastLogon. - Sequences:
uSNCreated,uSNChanged.
The profile explicitly marks whenCreated and whenChanged in the PRESERVE_ON_MIGRATION set to ensure audit metadata is kept if configured.
Schema Normalization
The Schema component includes hooks to fix common Active Directory schema issues, such as missing superior (sup) classes or "kind" mismatches (e.g., a class marked as structural when it should be auxiliary according to AD logic).
Sources: src/flext_ldif/servers/ad.py:135-172, tests/constants.py:300-350
Integration with Domain Metadata
When an entry is identified as belonging to an Active Directory profile, specific metadata is attached to the domain model to track its origin and compliance.
| Metadata Field | Description |
|---|---|
original_server_type | Set to "ad" for audit trails. |
boolean_conversions | Tracks AD-specific boolean mappings if needed. |
acls | Extracted SDDL strings from nTSecurityDescriptor. |
server_specific_data | Preserves proprietary binary identifiers for round-trip support. |
Sources: src/flext_ldif/_models/domain_metadata.py:150-200, src/flext_ldif/constants.py:80-100
Summary
The Active Directory Profile provides the necessary specialized logic to bridge the gap between standard LDIF and Microsoft's proprietary LDAP implementation. By centralizing AD detection markers, implementing SDDL decoding, and defining AD-specific operational attributes, the library enables seamless processing of enterprise-grade identity data.
Sources: src/flext_ldif/servers/ad.py:15-30, src/README.md:15-20