LDAP.Search
-----------

Performs a search.

| Component | Version | macOS | Windows | Linux | Server | iOS SDK |
|---|---|---|---|---|---|---|
| [LDAP](component_LDAP.md) | [6.0](newinversion60.md) | ✅ Yes | ✅ Yes | ✅ Yes | ✅ Yes | ❌ No |

MBS( "LDAP.Search"; LDAPRef; Base; Scope; Filter; Attributes { ; AttributesOnly; TimeOut; Size Limit } ) 

**MBS**( **"LDAP.Search";** /\* Performs a search. \*/  
**$LDAPRef**; /\* The reference number for the LDAP connection.e.g. $ldap \*/   
**$Base**; /\* the distinguished name of the entry at which to start the search. \*/   
**$Scope**; /\* Value to indicate the search scope. Can be:  
  
Base: Search the base entry only.  
OneLevel: Search all entries in the first level below the base entry, excluding the base entry.  
Subtree: Search the base entry and all entries in the tree below the base.  
  
On Mac can also be Children.e.g. "Subtree" \*/   
**$Filter**; /\* A text that specifies the search filter. \*/   
**$Attributes**; /\* List indicating which attributes to return for each matching entry.e.g. "cn¶sn" \*/   
**$AttributesOnly**; /\* Optional; Boolean value that should be 0 if both attribute types and values are to be returned, 1 if only types are required.e.g. 0 \*/   
**$TimeOut**; /\* Optional; Timeout in seconds.  
Specifies both the local search time-out value, in seconds, and the operation time limit that is sent to the server within the search request.e.g. 10 \*/   
**$Size Limit**) /\* Optional; Limit on the number of entries to return from the search.   
A value of zero indicates no limit. \*/ 

### Parameters

| Parameter | Description | Example | Flags |
|---|---|---|---|
| LDAPRef | The reference number for the LDAP connection. | $ldap |  |
| Base | the distinguished name of the entry at which to start the search. |  |  |
| Scope | Value to indicate the search scope. Can be:      Base: Search the base entry only.   OneLevel: Search all entries in the first level below the base entry, excluding the base entry.   Subtree: Search the base entry and all entries in the tree below the base.      On Mac can also be Children. | "Subtree" |  |
| Filter | A text that specifies the search filter. |  |  |
| Attributes | List indicating which attributes to return for each matching entry. | "cn¶sn" |  |
| AttributesOnly | Boolean value that should be 0 if both attribute types and values are to be returned, 1 if only types are required. | 0 | Optional |
| TimeOut | Timeout in seconds.   Specifies both the local search time-out value, in seconds, and the operation time limit that is sent to the server within the search request. | 10 | Optional |
| Size Limit | Limit on the number of entries to return from the search.    A value of zero indicates no limit. |  | Optional |

### Result

Returns OK or error.

### Description

Performs a search.  
Searches the LDAP directory and returns a requested set of attributes for each matched entry.  
  
On success, you can use [LDAP.SearchResult.Count](LDAPSearchResultCount.md) to find out the number of entries found.  
### Examples

Search for name:

 MBS ( "LDAP.Search"; $ldap ; "dc=example,dc=com"; "Subtree"; "(sn=Jensen)")  
Find entries with a givenName:

 MBS ("LDAP.Search"; $ldap ; ""; "Subtree"; "(givenName=\*)"; ""; 0; 20; 999)  
Example script to create new group:

 # ========================================   
\# Purpose:   
\# Creates a new AD Group   
\# Returns:   
\# $error = Error code if unsuccessful   
\# $error = 0 for success   
\# $resultText = Text summary of the success or error   
\# Parameters:   
\# $serverName   
\# $serverDomain   
\# $baseOU   
\# $groupName (base name only, excluding domain name)   
\# $groupDomain   
\# Called from:   
\# (script) "Set AD Group (worker)"   
\# Author:   
\# John Munro (HJM) from Deutsche Schule Tokyo Yokohama   
\# Notes:   
\# none   
\# History:   
\# 2021-05-26 HJM - created from DySIS-StudentAdmin version   
\# ========================================   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptParameter ) ) \]   
\#   
\# The branch in LDAP containing all active entries   
Set Variable \[ $searchBase ; Value: "dc=dsty,dc=ac,dc=jp" \]   
\#   
Set Error Capture \[ On \]  
\#   
\# If debugging these parameters will be empty so fill with test data   
If \[ $serverName = "" \]   
 Set Variable \[ $serverName ; Value: "sn-sys-dc1" \]   
End If  
If \[ $serverDomain = "" \]   
 Set Variable \[ $serverDomain ; Value: "schulnetz.dsty.ac.jp" \]   
End If  
If \[ $baseOU = "" \]   
 Set Variable \[ $baseOU ; Value: $searchBase \]   
End If  
If \[ $groupName = "" \]   
 Set Variable \[ $groupName ; Value: "Test-Group" \]   
End If  
If \[ $groupDomain = "" \]   
 Set Variable \[ $groupDomain ; Value: "dsty.ac.jp" \]   
End If  
\#   
\#   
\# Bind to LDAP   
Perform Script \[ Specified: From list ; “LDAPServerBind” ; Parameter: # ( "serverName" ; $serverName ) &amp; # ( "serverDomain" ; $serverDomain ) \]  
\# Returns $result , $ldap   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptResult ) ) \]   
If \[ $error &lt;&gt; 0 \]   
 Show Custom Dialog \[ "LDAP error" ; $resultText \]   
 Exit Script \[ Text Result: # ( "error" ; $result ) &amp; # ( "resultText" ; "LDAP error: " &amp; $resultText ) \]   
End If  
\#   
\#   
\# Sanity check: Ensure that group is not already present in AD   
Set Variable \[ $LDAPFilter ; Value: "(sAMAccountName=" &amp; $groupName &amp; ")" \]   
Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $searchBase ; "subtree" ; $LDAPFilter ; "" ; 0 ; 20 ; 9999 ) \]   
\#   
Set Variable \[ $entryCount ; Value: MBS ("[LDAP.SearchResult.Count](LDAPSearchResultCount.md)"; $ldap ) \]   
If \[ $entryCount &gt; 0 \]   
 # The group is already present in AD so exit with error  
 Set Variable \[ $resultText ; Value: "The sAMAccountName is already present in AD: \\" &amp; $groupName " \]   
 Show Custom Dialog \[ "LDAP Error" ; $resultText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: # ( "error" ; 1 ) &amp; # ( "resultText" ; "LDAP error: " &amp; $resultText ) \]   
End If  
\#   
\#   
\# Sanity check: Ensure the DN is not already present in AD   
Set Variable \[ $groupDN ; Value: "CN=" &amp; $groupName &amp; "," &amp; $baseOU \]   
Set Variable \[ $LDAPFilter ; Value: "" \]   
Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $groupDN ; "base" ; $LDAPFilter ; "" ; 0 ; 4 ; 1 ) \]   
\#   
Set Variable \[ $entryCount ; Value: MBS ("[LDAP.SearchResult.Count](LDAPSearchResultCount.md)"; $ldap ) \]   
If \[ $entryCount &gt; 0 \]   
 # The groupname is already present in AD so exit with error  
 Set Variable \[ $resultText ; Value: "The DN is already present in AD: " &amp; $groupDN \]   
 Show Custom Dialog \[ "LDAP Error" ; $resultText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: # ( "error" ; 1 ) &amp; # ( "resultText" ; "LDAP error: " &amp; $resultText ) \]   
End If  
\#   
\#   
\# ===============================================================================================   
\# Group is confirmed not present in AD so proceed to create it   
\# Build the JSON for the Add   
\#   
\# AD attributes   
Set Variable \[ $objectClass ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"objectClass\\", \\"values\\": \[ \\"top\\", \\"group\\" \] }" \]   
Set Variable \[ $sAMAccountName ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"sAMAccountName\\", \\"value\\": \\"" &amp; $groupName &amp; "\\" }" \]   
Set Variable \[ $cn ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"cn\\", \\"value\\": \\"" &amp; $groupName &amp; "\\" }" \]   
Set Variable \[ $mail ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"mail\\", \\"value\\": \\"" &amp; Lower ( $groupName &amp; "@" &amp; $groupDomain ) &amp; "\\" }" \]   
\#   
\# Add the JSON components together   
Set Variable \[ $json ; Value: "\[" &amp; $objectClass &amp; "," &amp; $sAMAccountName &amp; "," &amp; $cn &amp; "," &amp; $mail &amp; "\]" \]   
\#   
\# Attempt to add the groupDN record to the $baseOU   
Set Variable \[ $result ; Value: MBS ( "[LDAP.AddJSON](LDAPAddJSON.md)" ; $ldap ; $groupDN ; $json ) \]   
If \[ MBS ( "IsError" ) \]   
 Set Variable \[ $resultText ; Value: "Failed to add group." &amp; ¶ &amp; $result &amp; ¶ &amp; $json \]   
 Show Custom Dialog \[ "LDAP Error" ; $resultText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: # ( "error" ; $result ) &amp; # ( "resultText" ; "LDAP error: " &amp; $resultText ) \]   
End If  
\#   
\#   
\# Cleanup   
Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
Go to Layout \[ original layout ; Animation: None \]  
\#   
\#   
\# Return error free result   
Exit Script \[ Text Result: # ( "error" ; 0 ) &amp; # ( "resultText" ; "Group create success" ) \]  
Example script get records:

 # ========================================   
\# Purpose:   
\# Queries Active Directory from a server-side script   
\# This guarrantees the MBS plugin availability and that the MBS plugin has LDAP access to the Domain Controller   
\# Returns:   
\# $error = Error code if unsuccessful   
\# $error = 0 for success   
\# $resultText = Text summary of the success or error   
\# Parameters:   
\# $serverName   
\# $serverDomain   
\# $personIDs   
\# Called from:   
\# (script) "Get AD Records"   
\# Author:   
\# John Munro (HJM) from Deutsche Schule Tokyo Yokohama   
\# Notes:   
\# none   
\# History:   
\# 2020-06-15 HJM - created   
\# 2021-05-20 HJM - Replaced bind code with call to LDAPServerBind (including added parameter $serverDomain to all calls)   
\# 2021-05-21 HJM - modified result returned to be in #Assign variable method   
\# ========================================   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptParameter ) ) \]   
\#   
\# The branch in LDAP containing all active entries   
Set Variable \[ $searchBase ; Value: "dc=dsty,dc=ac,dc=jp" \]   
\#   
Set Error Capture \[ On \]  
\#   
\# If debugging these parameters will be empty so fill with test data   
If \[ $serverName = "" \]   
 Set Variable \[ $serverName ; Value: "sys-dc1" \]   
End If  
If \[ $serverName = "" \]   
 Set Variable \[ $serverDomain ; Value: "dsty.ac.jp" \]   
End If  
If \[ $personIDs = "" \]   
 Set Variable \[ $personIDs ; Value: "12345" \]   
End If  
\#   
\# Jump to a working list populated with the records of the passed IDs   
Set Field \[ #Selector::SelectedPersonID ; $personIDs \]   
Go to Layout \[ “@People” (@People) ; Animation: None \]  
Go to Related Record \[ Show only related records ; From table: “#SelectedPerson” ; Using layout: “@People” (@People) \]   
\#   
\#   
\# Bind to LDAP   
Perform Script \[ Specified: From list ; “LDAPServerBind” ; Parameter: # ( "serverName" ; $serverName ) &amp; # ( "serverDomain" ; $serverDomain ) \]  
\# Returns $error ,$resultText , $ldap   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptResult ) ) \]   
If \[ $error &lt;&gt; 0 \]   
 Go to Layout \[ original layout ; Animation: None \]  
 Show Custom Dialog \[ "LDAP error" ; $resultText \]   
 Exit Script \[ Text Result: # ( "error" ; $error ) &amp; # ( "resultText" ; "LDAP error: " &amp; $resultText ) \]   
End If  
\#   
\#   
\# Define search filter   
Set Variable \[ $usernameList ; Value: Substitute ( @People::Ac | DSTY | Username FoundSet\_List ; "¶¶" ; "¶" ) //Remove any CR from the source field \]   
Set Variable \[ $LDAPFilter ; Value: "(|" &amp; "(sAMAccountName=" &amp; Substitute ( $usernameList ; "¶" ; ")(sAMAccountName=" ) &amp; ")" &amp; ")" \]   
\#   
\# Perform the search on LDAP   
Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $searchBase ; "subtree" ; $LDAPFilter ; "" ; 0 ; 30 ; 9999 ) \]   
\#   
\# Record the search timestamp for all records (including those not present in AD)   
Set Variable \[ $LookupTimestamp ; Value: Get ( CurrentTimestamp ) \]   
\#   
// # Check results  
// Show Custom Dialog \[ "JSON" ; MBS ("[LDAP.JSON](LDAPJSON.md)"; $ldap ) \]   
\#   
Set Variable \[ $foundInAD ; Value: MBS ("[LDAP.SearchResult.Count](LDAPSearchResultCount.md)"; $ldap ) \]   
If \[ $foundInAD &gt; 0 \]   
 #   
 # extract the results  
 Set Variable \[ $jsonIndex ; Value: 0 \]   
 Loop  
 Set Variable \[ $username ; Value: MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; $jsonIndex ; "sAMAccountName" ) \]   
 #   
 # find the record with DSTYUsername = $username   
 Perform Find \[ Restore \]   
 #   
 If \[ Get ( FoundCount ) = 1 \]   
 # There should only be one record found as DSTYUsername has unique values  
 #   
 # Populate the LDAP cache fields  
 Set Field \[ @People::Ac | LDAP | AD Network ; $serverDomain \]   
 Set Field \[ @People::Ac | LDAP | DataTimestamp ; $LookupTimestamp \]   
 Set Field \[ @People::Ac | LDAP | userDN ; MBS ("[LDAP.SearchResult.DistinguishedName](LDAPSearchResultDistinguishedName.md)"; $ldap ; $jsonIndex ) \]   
 Set Field \[ @People::Ac | LDAP | DisplayName ; MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; $jsonIndex ; "displayName" ) \]   
 Set Field \[ @People::Ac | LDAP | EmailAddr ; MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; $jsonIndex ; "mail" ) \]   
 Set Field \[ @People::Ac | LDAP | Groups | Raw ; MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; $jsonIndex ; "memberOf" ) \]   
 Set Field \[ @People::Ac | LDAP | PrivEmail ; MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; $jsonIndex ; "otherMailbox" ) \]   
 Set Field \[ @People::Ac | LDAP | PwdLastSet ; MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; $jsonIndex ; "pwdLastSet" ) \]   
 Set Field \[ @People::Ac | LDAP | userAccountControl ; MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; $jsonIndex ; "userAccountControl" ) \]   
 Set Field \[ @People::Ac | LDAP | Username ; $username \]   
 #   
 # Convert raw time from AD to a local Filemaker timestamp  
 Set Variable \[ $accountExpires ; Value: MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; $jsonIndex ; "accountExpires" ) \]   
 If \[ $accountExpires &gt; 0 \]   
 Set Variable \[ $accountExpires ; Value: Timestamp ( Date ( 1 ; 1 ; 1601 ) ; Time ( 0 ; 0 ; 0 ) + 9 \* 3600 ) + Round ( $accountExpires / 10000000 / 60 ; 0 ) \* 60 \]   
 Else  
 Set Variable \[ $accountExpires ; Value: "" \]   
 End If  
 Set Field \[ @People::Ac | LDAP | accountExpires ; $accountExpires \]   
 #   
 # Convert raw time from AD to a local Filemaker timestamp  
 Set Variable \[ $lastLogon ; Value: MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; $jsonIndex ; "lastLogon" ) \]   
 If \[ $lastLogon &gt; 0 \]   
 Set Variable \[ $lastLogon ; Value: Timestamp ( Date ( 1 ; 1 ; 1601 ) ; Time ( 0 ; 0 ; 0 ) + 9 \* 3600 ) + Round ( $lastLogon / 10000000 / 60 ; 0 ) \* 60 \]   
 Else  
 Set Variable \[ $lastLogon ; Value: "" \]   
 End If  
 #   
 # Update the lastLogon field with only if it is a more recent date  
 Set Field \[ @People::Ac | LDAP | LastLogon ; Max ( @People::Ac | LDAP | LastLogon ; $lastLogon ) \]   
 #   
 End If  
 #   
 Set Variable \[ $jsonIndex ; Value: $jsonIndex + 1 \]   
 Exit Loop If \[ $jsonIndex &gt;= $foundInAD \]   
 #   
 End Loop  
 #   
End If  
\#   
\# Check for records not updated (i.e. not present in AD)   
\#   
\# Refind the original people set   
Set Field \[ #Selector::SelectedPersonID ; $personIDs \]   
Go to Related Record \[ Show only related records ; From table: “#SelectedPerson” ; Using layout: “@People” (@People) \]   
\#   
\# Omit those that have just been updated   
Constrain Found Set \[ Restore \]   
Set Variable \[ $missingFromAD ; Value: Get ( FoundCount ) \]   
\#   
\# if there are any remaining, these were not found in the LDAP query, so clear the fields in case the entry was removed from AD   
If \[ $missingFromAD &gt; 0 \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | DataTimestamp ; $LookupTimestamp \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | AD Network ; "" \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | DisplayName ; "" \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | userDN ; "" \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | EmailAddr ; "" \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | Groups | Raw ; "" \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | LastLogon ; "" \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | PrivEmail ; "" \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | PwdLastSet ; "" \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | userAccountControl ; "" \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | Username ; "" \]   
 Replace Field Contents \[ With dialog: Off ; @People::Ac | LDAP | accountExpires ; "" \]   
End If  
\#   
\# Cleanup   
Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
Go to Layout \[ original layout ; Animation: None \]  
\#   
\#   
\# Return error free result   
Exit Script \[ Text Result: # ( "error" ; 0 ) &amp; # ( "resultText" ; "Staff found and updated from AD: " &amp; $foundInAD &amp; ¶ &amp; "New staff needing to be added to AD: " &amp; $missingFromAD ) \]  
Example script to create an user:

 # ========================================   
\# Purpose:   
\# If the user is not present in AD, create a new user in Pre-handover OU and add the groups defined in DySIS   
\# Returns:   
\# 0 for success   
\# Errot text if unsuccessful   
\# Parameters:   
\# $serverName   
\# $userName   
\# $userDomain   
\# $userEmail   
\# $fullName   
\# $surname   
\# $givenName   
\# $userOU   
\# $groups (base names only, excluding domain names)   
\# $userPassword   
\# Called from:   
\# (script) Create AD User account   
\# Author:   
\# John Munro (HJM) from Deutsche Schule Tokyo Yokohama   
\# Notes:   
\# none   
\# History:   
\# 2020-06-30 HJM - created   
\# 2020-09-10 HJM - modified to add parameter $userOU   
\# 2020-12-18 HJM - modified PasswordSet to use external subroutine rather than local code   
\# 2021-05-20 HJM - Replaced bind code with call to LDAPServerBind (including added parameter $serverDomain to all calls)   
\# ========================================   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptParameter ) ) \]   
\#   
\# ===============================================================================================   
\# If debugging these parameters will be empty so fill with test data   
If \[ $serverName = "" \]   
 Set Variable \[ $serverName ; Value: "sys-dc1" \]   
End If  
If \[ $serverName = "" \]   
 Set Variable \[ $serverDomain ; Value: "dsty.ac.jp" \]   
End If  
If \[ $userName = "" \]   
 Set Variable \[ $userName ; Value: "DySIStestUser" \]   
End If  
If \[ $userDomain = "" \]   
 Set Variable \[ $userDomain ; Value: "dsty.ac.jp" \]   
End If  
If \[ $userEmail = "" \]   
 Set Variable \[ $userEmail ; Value: "dysistestUser@dsty.test" \]   
End If  
If \[ $userPassword = "" \]   
 Set Variable \[ $userPassword ; Value: "Welcome2" \]   
End If  
If \[ $fullName = "" \]   
 Set Variable \[ $fullName ; Value: "DySIS testUser" \]   
End If  
If \[ $surname = "" \]   
 Set Variable \[ $surname ; Value: "testUser" \]   
End If  
If \[ $givenName = "" \]   
 Set Variable \[ $givenName ; Value: "DySIStest" \]   
End If  
If \[ $userOU = "" \]   
 Set Variable \[ $userOU ; Value: "OU=Pre-handover,OU=DSTY Groups,DC=dsty,DC=ac,DC=jp" \]   
End If  
\# Note $groups as an empty set is a valid condition so this should NOT be filled if empty   
\#   
\#   
\# Bind to LDAP   
Perform Script \[ Specified: From list ; “LDAPServerBind” ; Parameter: # ( "serverName" ; $serverName ) &amp; # ( "serverDomain" ; $serverDomain ) \]  
\# Returns $error ,$resultText , $ldap   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptResult ) ) \]   
If \[ $error &lt;&gt; 0 \]   
 Go to Layout \[ original layout ; Animation: None \]  
 Show Custom Dialog \[ "LDAP error" ; $resultText \]   
 Exit Script \[ Text Result: # ( "error" ; $error ) &amp; # ( "resultText" ; "LDAP error: " &amp; $resultText ) \]   
End If  
\#   
\#   
\# Sanity check: Ensure that user is not already present in AD   
\#   
Set Variable \[ $LDAPFilter ; Value: "(sAMAccountName=" &amp; $userName &amp; ")" \]   
Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $searchBase ; "subtree" ; $LDAPFilter ; "" ; 0 ; 20 ; 9999 ) \]   
\#   
Set Variable \[ $entryCount ; Value: MBS ("[LDAP.SearchResult.Count](LDAPSearchResultCount.md)"; $ldap ) \]   
If \[ $entryCount &gt; 0 \]   
 # The username is already present in AD so exit with error  
 Set Variable \[ $errorText ; Value: "The sAMAccountName is already present in AD: \\" &amp; $userName " \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
\# Sanity check: Ensure the DN is not already present in AD   
\#   
Set Variable \[ $personDN ; Value: "CN=" &amp; $fullName &amp; "," &amp; $userOU \]   
Set Variable \[ $LDAPFilter ; Value: "" \]   
Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $personDN ; "base" ; $LDAPFilter ; "" ; 0 ; 4 ; 1 ) \]   
\#   
Set Variable \[ $entryCount ; Value: MBS ("[LDAP.SearchResult.Count](LDAPSearchResultCount.md)"; $ldap ) \]   
If \[ $entryCount &gt; 0 \]   
 # The username is already present in AD so exit with error  
 Set Variable \[ $errorText ; Value: "The DN is already present in AD: " &amp; $personDN \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
\#   
\# ===============================================================================================   
\# User is confirmed not present in AD so proceed to create it   
\# Build the JSON for the Add   
\#   
\# AD attributes   
Set Variable \[ $objectClass ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"objectClass\\", \\"values\\": \[ \\"top\\", \\"person\\", \\"organizationalPerson\\", \\"user\\" \] }" \]   
Set Variable \[ $sAMAccountName ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"sAMAccountName\\", \\"value\\": \\"" &amp; $userName &amp; "\\" }" \]   
Set Variable \[ $userPrincipalName ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"userPrincipalName\\", \\"value\\": \\"" &amp; $userName &amp; "@" &amp; $userDomain &amp; "\\" }" \]   
Set Variable \[ $userAccountControl ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"userAccountControl\\", \\"value\\": \\"" &amp; 544 &amp; "\\" }" //NB: 544 is \[ NoPasswordRequired, NormalAccount \] \]   
Set Variable \[ $cn ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"cn\\", \\"value\\": \\"" &amp; $fullName &amp; "\\" }" \]   
Set Variable \[ $displayName ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"displayName\\", \\"value\\": \\"" &amp; $fullName &amp; "\\" }" \]   
Set Variable \[ $sn ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"sn\\", \\"value\\": \\"" &amp; $surname &amp; "\\" }" \]   
Set Variable \[ $givenName ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"givenName\\", \\"value\\": \\"" &amp; $givenName &amp; "\\" }" \]   
Set Variable \[ $mail ; Value: "{ \\"operation\\": \\"Add\\", \\"name\\": \\"mail\\", \\"value\\": \\"" &amp; $userEmail &amp; "\\" }" \]   
\#   
\# Add the JSON components together   
Set Variable \[ $json ; Value: "\[" &amp; $objectClass &amp; "," &amp; $sAMAccountName &amp; "," &amp; $userPrincipalName &amp; "," &amp; $userAccountControl &amp; "," &amp; $cn &amp; "," &amp; $displayName &amp; "," &amp; $sn &amp; "," &amp; $givenName &amp; "," &amp; $mail &amp; "\]" \]   
\#   
\# Attempt to add the personDN record to the default OU   
Set Variable \[ $result ; Value: MBS ( "[LDAP.AddJSON](LDAPAddJSON.md)" ; $ldap ; $personDN ; $json ) \]   
If \[ MBS ( "IsError" ) \]   
 Set Variable \[ $errorText ; Value: "Failed to add user." &amp; ¶ &amp; $result &amp; ¶ &amp; $json \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
\# ===============================================================================================   
\# Set the password   
\#   
Perform Script \[ Specified: From list ; “Set AD Password (worker)” ; Parameter: # ( "serverName" ; $serverName ) &amp; # ( "serverDomain" ; $serverDomain ) &amp; # ( "personDN" ; $personDN ) &amp; # ( "userPassword" ; $userPassword ) \]  
\#   
Set Variable \[ $result ; Value: Get ( ScriptResult ) \]   
If \[ $result &lt;&gt; 0 \]   
 Show Custom Dialog \[ "Error setting the password" ; $result \]   
 # Exit with failure  
 Exit Script \[ Text Result: "Error setting the password:¶" &amp; $result \]   
End If  
\#   
\#   
\# ===============================================================================================   
\# Set the userAccountControl to NormalAccount (512)   
\# Prior to setting the password, the account has a password not required attribute   
\#   
\# Build the JSON for the modify   
Set Variable \[ $json ; Value: "\[{ \\"operation\\": \\"Replace\\", \\"name\\": \\"userAccountControl\\", \\"value\\": \\"512\\" }\]" \]   
\#   
\# Attempt to modify the groupDN record   
Set Variable \[ $result ; Value: MBS ( "[LDAP.ModifyJSON](LDAPModifyJSON.md)" ; $ldap ; $personDN ; $json ) \]   
If \[ MBS ( "IsError" ) \]   
 Set Variable \[ $errorText ; Value: "Failed to set account to 'Normal account (type 512)'." &amp; ¶ &amp; $result &amp; ¶ &amp; $json \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
\#   
\# Cleanup   
Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
\#   
\#   
\# ===============================================================================================   
\# Add the person to all the groups passed in $groups   
\#   
Set Variable \[ $groupDomain ; Value: $userDomain \]   
\#   
Set Variable \[ $groupIndex ; Value: 1 \]   
Set Variable \[ $groupCount ; Value: ValueCount ( $groups ) \]   
If \[ $groupCount &gt; 0 \]   
 #   
 Loop  
 Set Variable \[ $groupName ; Value: GetValue ( $groups ; $groupIndex ) \]   
 #   
 If \[ $groupName &lt;&gt; "" \]   
 #   
 # This worker script is already running on the server so do not nest it to a sub server script as this does not make sense nor work.  
 Perform Script \[ Specified: From list ; “Set AD Group (worker)” ; Parameter: # ( "serverName" ; $serverName ) &amp; # ( "serverDomain" ; $serverDomain ) &amp; # ( "operation" ; "Add" ) &amp; # ( "personDN" ; $personDN ) &amp; # ( "groupName" ; $groupName ) &amp; # ( "groupDomain" ; $groupDomain ) \]  
 #   
 Set Variable \[ $result ; Value: Get ( ScriptResult ) \]   
 If \[ $result &lt;&gt; 0 \]   
 Show Custom Dialog \[ "Add group error" ; $result \]   
 Exit Script \[ Text Result: $result \]   
 End If  
 End If  
 #   
 Set Variable \[ $groupIndex ; Value: $groupIndex + 1 \]   
 Exit Loop If \[ $groupIndex &gt; $groupCount \]   
 #   
 End Loop  
End If  
\#   
\# Exit with a success result   
Exit Script \[ Text Result: 0 \]  
Example script to assign an organization unit for an user:

 # ========================================   
\# Purpose:   
\# Assigns the OU of a single AD user   
\# Returns:   
\# 0 for success   
\# Error text if unsuccessful   
\# Parameters:   
\# $serverName   
\# $serverDomain   
\# $personDN   
\# $targetOU (the full DN of the target OU)   
\# Called from:   
\# (script) "Set AD OU"   
\# Author:   
\# John Munro (HJM) from Deutsche Schule Tokyo Yokohama   
\# Notes:   
\# none   
\# History:   
\# 2020-07-10 HJM - created   
\# 2021-05-20 HJM - Replaced bind code with call to LDAPServerBind (including added parameter $serverDomain to all calls)   
\# ========================================   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptParameter ) ) \]   
\#   
// # The branch in LDAP containing all active entries  
// Set Variable \[ $searchBase ; Value: "ou=DSTY Groups,dc=dsty,dc=ac,dc=jp" \]   
\#   
Set Error Capture \[ On \]  
\#   
\# If debugging these parameters will be empty so fill with test data   
If \[ $serverName = "" \]   
 Set Variable \[ $serverName ; Value: "sys-dc1" \]   
End If  
If \[ $serverName = "" \]   
 Set Variable \[ $serverDomain ; Value: "dsty.ac.jp" \]   
End If  
If \[ $personDN = "" \]   
 Set Variable \[ $personDN ; Value: "CN=DySIS testUser,OU=VerwaltungOU,OU=DSTY Groups,DC=dsty,DC=ac,DC=jp" \]   
End If  
If \[ $targetOU = "" \]   
 Set Variable \[ $targetOU ; Value: "OU=Pre-handover,OU=DSTY Groups,DC=dsty,DC=ac,DC=jp" \]   
End If  
\#   
\#   
\# Bind to LDAP   
Perform Script \[ Specified: From list ; “LDAPServerBind” ; Parameter: # ( "serverName" ; $serverName ) &amp; # ( "serverDomain" ; $serverDomain ) \]  
\# Returns $error ,$resultText , $ldap   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptResult ) ) \]   
If \[ $error &lt;&gt; 0 \]   
 Go to Layout \[ original layout ; Animation: None \]  
 Show Custom Dialog \[ "LDAP error" ; $resultText \]   
 Exit Script \[ Text Result: # ( "error" ; $error ) &amp; # ( "resultText" ; "LDAP error: " &amp; $resultText ) \]   
End If  
\#   
\#   
\# Check the targetOU is valid (exit with error if not)   
Set Variable \[ $LDAPFilter ; Value: "" \]   
Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $targetOU ; "base" ; $LDAPFilter ; "" ; 0 ; 4 ; 1 ) \]   
If \[ MBS ("[LDAP.SearchResult.DistinguishedName](LDAPSearchResultDistinguishedName.md)"; $ldap ; 0 ) = $targetOU \]   
 #   
 # Check the target is an actual Organisational Unit  
 Set Variable \[ $objectClasses ; Value: MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; 0 ; "objectClass" ) \]   
 #   
 If \[ FilterValues ( $objectClasses ; "organizationalUnit" ) = "" \]   
 # The target is not an actual Organisational Unit so exit with error  
 Set Variable \[ $errorText ; Value: "Target is not an Organizational Unit." &amp; ¶ &amp; $targetOU &amp; ¶ &amp; $result \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
 End If  
 #   
End If  
\#   
\#   
\# Check the personDN is valid and update the dn to contain the targetOU   
Set Variable \[ $LDAPFilter ; Value: "" \]   
Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $personDN ; "base" ; $LDAPFilter ; "" ; 0 ; 4 ; 1 ) \]   
If \[ MBS ( "IsError" ) \]   
 Set Variable \[ $errorText ; Value: "Failed to locate the personDN." &amp; ¶ &amp; $personDN &amp; ¶ &amp; $result \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
Set Variable \[ $foundDN ; Value: MBS ("[LDAP.SearchResult.DistinguishedName](LDAPSearchResultDistinguishedName.md)"; $ldap ; 0 ) \]   
If \[ $foundDN &lt;&gt; $personDN \]   
 Set Variable \[ $errorText ; Value: "The found record DN did not match personDN." &amp; ¶ &amp; "Found: " &amp; $foundDN &amp; ¶ &amp; "PersonDN: " &amp; $personDN &amp; ¶ &amp; $result \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
// # Build the JSON for the modify  
// Set Variable \[ $json ; Value: "\[{ \\"operation\\": \\"Replace\\", \\"type\\": \\"distinguishedName\\", \\"value\\": \\"" &amp; $newPersonDN &amp; "\\" }\]" \]   
\#   
\# Attempt to move the user record to the new DN   
Set Variable \[ $cn ; Value: MBS ("[LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)" ; $ldap ; 0 ; "cn" ) \]   
Set Variable \[ $rdn ; Value: "CN=" &amp; $cn \]   
Set Variable \[ $deleteOldRdn ; Value: 1 \]   
Set Variable \[ $result ; Value: MBS ( "[LDAP.Rename](LDAPRename.md)" ; $ldap ; $personDN ; $rdn ; $targetOU ; $deleteOldRdn ) \]   
If \[ MBS ( "IsError" ) \]   
 Set Variable \[ $errorText ; Value: "Failed to modify the personDN." &amp; ¶ &amp; "From: " &amp; $personDN &amp; ¶ &amp; "To: " &amp; $rdn &amp; ¶ &amp; "Under: " &amp; $targetOU &amp; ¶ &amp; $result \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
\#   
\# Cleanup   
Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
Go to Layout \[ original layout ; Animation: None \]  
\#   
\#   
\# Return error free result   
Exit Script \[ Text Result: 0 \]  
Example script to change password for an user:

 # ========================================   
\# Purpose:   
\# Assigns the Password of a single AD user   
\# Returns:   
\# 0 for success   
\# Error text if unsuccessful   
\# Parameters:   
\# $serverName   
\# $serverDomain   
\# $personDN   
\# $userPassword (the password to assign to the personDN)   
\# Called from:   
\# (script) "Set AD Password"   
\# Author:   
\# John Munro (HJM) from Deutsche Schule Tokyo Yokohama   
\# Notes:   
\# none   
\# History:   
\# 2020-07-10 HJM - created   
\# 2021-05-20 HJM - Replaced bind code with call to LDAPServerBind (including added parameter $serverDomain to all calls)   
\# ========================================   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptParameter ) ) \]   
\#   
\# The branch in LDAP containing all active entries   
Set Variable \[ $searchBase ; Value: "ou=DSTY Groups,dc=dsty,dc=ac,dc=jp" \]   
\#   
Set Error Capture \[ On \]  
\#   
\# If debugging these parameters will be empty so fill with test data   
If \[ $serverName = "" \]   
 Set Variable \[ $serverName ; Value: "sys-dc1" \]   
End If  
If \[ $serverName = "" \]   
 Set Variable \[ $serverDomain ; Value: "dsty.ac.jp" \]   
End If  
If \[ $personDN = "" \]   
 Set Variable \[ $personDN ; Value: "CN=DySIS testUser,OU=VerwaltungOU,OU=DSTY Groups,DC=dsty,DC=ac,DC=jp" \]   
End If  
If \[ $userPassword = "" \]   
 Set Variable \[ $userPassword ; Value: "Welcome" \]   
End If  
\#   
\# Bind to LDAP   
Perform Script \[ Specified: From list ; “LDAPServerBind” ; Parameter: # ( "serverName" ; $serverName ) &amp; # ( "serverDomain" ; $serverDomain ) \]  
\# Returns $error ,$resultText , $ldap   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptResult ) ) \]   
If \[ $error &lt;&gt; 0 \]   
 Go to Layout \[ original layout ; Animation: None \]  
 Show Custom Dialog \[ "LDAP error" ; $resultText \]   
 Exit Script \[ Text Result: # ( "error" ; $error ) &amp; # ( "resultText" ; "LDAP error: " &amp; $resultText ) \]   
End If  
\#   
\#   
\# Check the personDN is valid and update the dn to contain the targetOU   
Set Variable \[ $LDAPFilter ; Value: "" \]   
Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $personDN ; "base" ; $LDAPFilter ; "" ; 0 ; 4 ; 1 ) \]   
If \[ MBS ( "IsError" ) \]   
 Set Variable \[ $errorText ; Value: "Failed to locate the personDN." &amp; ¶ &amp; $personDN &amp; ¶ &amp; $result \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
Set Variable \[ $foundDN ; Value: MBS ("[LDAP.SearchResult.DistinguishedName](LDAPSearchResultDistinguishedName.md)"; $ldap ; 0 ) \]   
If \[ $foundDN &lt;&gt; $personDN \]   
 Set Variable \[ $errorText ; Value: "The found record DN did not match personDN." &amp; ¶ &amp; "Found: " &amp; $foundDN &amp; ¶ &amp; "PersonDN: " &amp; $personDN &amp; ¶ &amp; $result \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
\# ===============================================================================================   
\# Set the password   
\#   
\# Add double quotes to the password passed as a parameter   
Set Variable \[ $encodedPW ; Value: "\\"" &amp; $userPassword &amp; "\\"" \]   
\# Change to 8 bit hex   
Set Variable \[ $encodedPW ; Value: HexEncode ( $encodedPW ) \]   
\# Change 8 bit hex to 16 bit hex   
Set Variable \[ $encodedPW ; Value: Hex8to16LE ( $encodedPW ) \]   
\#   
\# Build the JSON for the modify   
Set Variable \[ $json ; Value: "\[{ \\"operation\\": \\"Replace\\", \\"name\\": \\"unicodePwd\\", \\"hex\\": true, \\"value\\": \\"" &amp; $encodedPW &amp; "\\" }\]" \]   
\#   
\# Attempt to modify the password via the unicode attribute   
Set Variable \[ $result ; Value: MBS ( "[LDAP.ModifyJSON](LDAPModifyJSON.md)" ; $ldap ; $personDN ; $json ) \]   
If \[ MBS ( "IsError" ) \]   
 Set Variable \[ $errorText ; Value: "Failed to set the password." &amp; ¶ &amp; $result &amp; ¶ &amp; $json \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
\#   
\# ===============================================================================================   
\# Require the password to be changed on the next login   
\#   
Set Variable \[ $pwdLastSet ; Value: "{ \\"operation\\": \\"Replace\\", \\"name\\": \\"pwdLastSet\\", \\"value\\": \\"0\\" }" \]   
\#   
\# Build the JSON for the modify   
Set Variable \[ $json ; Value: "\[" &amp; $pwdLastSet &amp; "\]" \]   
\#   
\# Attempt to modify the password via the unicode attribute   
Set Variable \[ $result ; Value: MBS ( "[LDAP.ModifyJSON](LDAPModifyJSON.md)" ; $ldap ; $personDN ; $json ) \]   
If \[ MBS ( "IsError" ) \]   
 Set Variable \[ $errorText ; Value: "Failed to set 'User must change password at next logon'." &amp; ¶ &amp; $result &amp; ¶ &amp; $json \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: "LDAP error. " &amp; $errorText \]   
End If  
\#   
\#   
\# Cleanup   
Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
Go to Layout \[ original layout ; Animation: None \]  
\#   
\# Return error free result   
Exit Script \[ Text Result: 0 \]  
Example script to set group for user:

 # ========================================   
\# Purpose:   
\# Adds or removes membership in a AD Group of a single AD user   
\# Returns:   
\# $error = Error code if unsuccessful   
\# $error = 0 for success   
\# $resultText = Text summary of the success or error   
\# Parameters:   
\# $serverName   
\# $serverDomain   
\# $operation (ADD, DELETE)   
\# $personDN   
\# $groupName (base name only, excluding domain name)   
\# $groupDomain   
\# Called from:   
\# (script) "Toggle AD Group"   
\# Author:   
\# John Munro (HJM) from Deutsche Schule Tokyo Yokohama   
\# Notes:   
\# none   
\# History:   
\# 2020-06-19 HJM - created   
\# 2021-05-20 HJM - Replaced bind code with call to LDAPServerBind (including added parameter $serverDomain to all calls)   
\# 2021-05-21 HJM - modified result returned to be in #Assign variable method   
\# ========================================   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptParameter ) ) \]   
\#   
\# The branch in LDAP containing all active entries   
Set Variable \[ $searchBase ; Value: "dc=dsty,dc=ac,dc=jp" \]   
\#   
Set Error Capture \[ On \]  
\#   
\# If debugging these parameters will be empty so fill with test data   
If \[ $serverName = "" \]   
 Set Variable \[ $serverName ; Value: "sys-dc1" \]   
End If  
If \[ $serverName = "" \]   
 Set Variable \[ $serverDomain ; Value: "dsty.ac.jp" \]   
End If  
If \[ $operation = "" \]   
 Set Variable \[ $operation ; Value: "Add" \]   
End If  
If \[ $personDN = "" \]   
 Set Variable \[ $personDN ; Value: "CN=John Munro,OU=SysAdmins,OU=VerwaltungOU,OU=DSTY Groups,DC=dsty,DC=ac,DC=jp" \]   
End If  
If \[ $groupName = "" \]   
 Set Variable \[ $groupName ; Value: "IT-Admin-Staff" \]   
End If  
If \[ $groupDomain = "" \]   
 Set Variable \[ $groupDomain ; Value: "dsty.ac.jp" \]   
End If  
\#   
\#   
\# Bind to LDAP   
Perform Script \[ Specified: From list ; “LDAPServerBind” ; Parameter: # ( "serverName" ; $serverName ) &amp; # ( "serverDomain" ; $serverDomain ) \]  
\# Returns $error ,$resultText , $ldap   
\#   
Set Variable \[ $! ; Value: #Assign ( Get ( ScriptResult ) ) \]   
If \[ $error &lt;&gt; 0 \]   
 Go to Layout \[ original layout ; Animation: None \]  
 Show Custom Dialog \[ "LDAP error" ; $resultText \]   
 Exit Script \[ Text Result: # ( "error" ; $error ) &amp; # ( "resultText" ; $resultText ) \]   
End If  
\#   
\# Retreive the groupDN from the $groupName   
Set Variable \[ $LDAPFilter ; Value: "(&amp;(objectClass=group)(sAMAccountName=" &amp; $groupName &amp; "))" \]   
Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $searchBase ; "subtree" ; $LDAPFilter ; "" ; 0 ; 4 ; 99 ) \]   
Set Variable \[ $entryCount ; Value: MBS ("[LDAP.SearchResult.Count](LDAPSearchResultCount.md)"; $ldap ) \]   
If \[ $entryCount &gt; 1 \]   
 #   
 # More than one group with the given name exists, there should only be one.  
 Set Variable \[ $error ; Value: 1 \]   
 Set Variable \[ $errorText ; Value: "More than 1 group found containing the name:" &amp; ¶ &amp; $groupName \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: # ( "error" ; $error ) &amp; # ( "resultText" ; $errorText ) \]   
 #   
Else If \[ $entryCount = 0 \]   
 #   
 # No such group found so create it  
 #   
 Set Variable \[ $resultText ; Value: "No AD group found containing the name:" &amp; ¶ &amp; $groupName &amp; ¶ &amp; "OK to created it?" \]   
 Show Custom Dialog \[ "LDAP Warning" ; $resultText \]   
 #   
 If \[ Get ( LastMessageChoice ) = 1 or PatternCount ( Get ( ApplicationVersion ) ; "Server" ) //script is running on server so create the group by default \]   
 #   
 # Create the new group  
 Perform Script \[ Specified: From list ; “Create AD Group (worker)” ; Parameter: # ( "serverName" ; $serverName ) &amp; # ( "serverDomain" ; $serverDomain ) &amp; # ( "baseOU" ; $searchBase ) &amp; # ( "groupName" ; $groupName ) &amp; # ( "groupDomain" ; $groupDomain ) \]  
 #   
 Set Variable \[ $! ; Value: #Assign ( Get ( ScriptResult ) ) \]   
 If \[ $error &lt;&gt; 0 \]   
 Show Custom Dialog \[ "LDAP error" ; $resultText \]   
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Go to Layout \[ original layout ; Animation: None \]  
 Exit Script \[ Text Result: # ( "error" ; $error ) &amp; # ( "resultText" ; "LDAP error: " &amp; $resultText ) \]   
 End If  
 #   
 Set Variable \[ $warning ; Value: "New AD group: " &amp; $groupName &amp; " created at: " &amp; $groupDN \]   
 Set Variable \[ $LDAPFilter ; Value: "(&amp;(objectClass=group)(sAMAccountName=" &amp; $groupName &amp; "))" \]   
 Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $searchBase ; "subtree" ; $LDAPFilter ; "" ; 0 ; 4 ; 99 ) \]   
 #   
 Else  
 # Group creation not approved, so cannot proceed to add user to the group  
 Set Variable \[ $error ; Value: 2 \]   
 Set Variable \[ $errorText ; Value: "No AD group found containing the name:" &amp; ¶ &amp; $groupName &amp; " and creation not approved by user" \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Go to Layout \[ original layout ; Animation: None \]  
 Exit Script \[ Text Result: # ( "error" ; $error ) &amp; # ( "resultText" ; $errorText ) \]   
 End If  
End If  
\#   
Set Variable \[ $groupDN ; Value: MBS ("[LDAP.SearchResult.DistinguishedName](LDAPSearchResultDistinguishedName.md)"; $ldap ; 0 ) \]   
\#   
\# Check the personDN is valid and add the personDN to the Group if so   
Set Variable \[ $LDAPFilter ; Value: "" \]   
Set Variable \[ $result ; Value: MBS ( "LDAP.Search" ; $ldap ; $personDN ; "base" ; $LDAPFilter ; "" ; 0 ; 4 ; 1 ) \]   
If \[ MBS ("[LDAP.SearchResult.DistinguishedName](LDAPSearchResultDistinguishedName.md)"; $ldap ; 0 ) = $personDN \]   
 #   
 # Build the JSON for the modify  
 Set Variable \[ $json ; Value: "\[{ \\"operation\\": \\"" &amp; $operation &amp; "\\", \\"type\\": \\"member\\", \\"value\\": \\"" &amp; $personDN &amp; "\\" }\]" \]   
 #   
 # Attempt to modify the groupDN record  
 Set Variable \[ $result ; Value: MBS ( "[LDAP.ModifyJSON](LDAPModifyJSON.md)" ; $ldap ; $groupDN ; $json ) \]   
 #   
 If \[ MBS ( "IsError" ) \]   
 Set Variable \[ $error ; Value: 3 \]   
 Set Variable \[ $errorText ; Value: "Failed to modify the 'member' attribute of the Group record." &amp; ¶ &amp; $result \]   
 Show Custom Dialog \[ "LDAP Error" ; $errorText \]   
 # Cleanup  
 Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
 Exit Script \[ Text Result: # ( "error" ; $error ) &amp; # ( "resultText" ; $errorText ) \]   
 End If  
End If  
\#   
\# Cleanup   
Set Variable \[ $releaseResult ; Value: MBS ("[LDAP.Release](LDAPRelease.md)"; $ldap ) \]   
Go to Layout \[ original layout ; Animation: None \]  
\#   
\#   
\# Return error free result together with any non-fatal warnings if they exist   
Exit Script \[ Text Result: # ( "error" ; 0 ) &amp; # ( "resultText" ; "Group set success. " &amp; $warning ) \]  
### See also

- [LDAP.JSON](LDAPJSON.md)
- [LDAP.Modify](LDAPModify.md)
- [LDAP.Release](LDAPRelease.md)
- [LDAP.Rename](LDAPRename.md)
- [LDAP.SearchResult.AttributeName](LDAPSearchResultAttributeName.md)
- [LDAP.SearchResult.AttributeValue](LDAPSearchResultAttributeValue.md)
- [LDAP.SearchResult.AttributeValueCount](LDAPSearchResultAttributeValueCount.md)
- [LDAP.SearchResult.AttributeValues](LDAPSearchResultAttributeValues.md)
- [LDAP.SearchResult.AttributeValuesByName](LDAPSearchResultAttributeValuesByName.md)
- [LDAP.SearchResult.DistinguishedName](LDAPSearchResultDistinguishedName.md)

### Release notes

- **Version 15.5**
    - Fixed [LDAP.Search](https://www.mbsplugins.eu/LDAPSearch.shtml) to allow call with only 5 parameters.
- **Version 13.0**
    - Fixed a bug in [LDAP.Search](https://www.mbsplugins.eu/LDAPSearch.shtml) passing attribute names on macOS.
- **Version 11.3**
    - Changed [LDAP.Search](https://www.mbsplugins.eu/LDAPSearch.shtml) to hex encode UUID/GUID entries with 16 raw bytes.
- **Version 8.5**
    - Changed how timeout is passed to [LDAP.Search](http://www.mbsplugins.eu/LDAPSearch.shtml) function.
- **Version 7.4**
    - Added [LDAP.SearchResult.AttributeValuesByName](http://www.mbsplugins.eu/LDAPSearchResultAttributeValuesByName.shtml) function.
- **Version 7.0**
    - Fixed issue on Windows with [LDAP.Search](http://www.mbsplugins.eu/LDAPSearch.shtml) and using attribute list.

### Example Databases

- [Network/LDAP Query](https://www.mbsplugins.eu/MBS-FileMaker-Plugin-Examples/Network/LDAP%20Query.shtml#1ScriptAnchor_)

### Blog Entries

- [MBS FileMaker Plugin, version 15.5pr1](https://www.mbsplugins.de/archive/2025-10-01/MBS_FileMaker_Plugin_version_1/monkeybreadsoftware_blog_filemaker)
- [MBS FileMaker Plugin, version 12.6pr1](https://www.mbsplugins.de/archive/2022-12-01/MBS_FileMaker_Plugin_version_1/monkeybreadsoftware_blog_filemaker)
- [MBS FileMaker Plugin, version 11.3pr4](https://www.mbsplugins.de/archive/2021-06-22/MBS_FileMaker_Plugin_version_1/monkeybreadsoftware_blog_filemaker)
- [MBS FileMaker Plugin, version 8.5pr7](https://www.mbsplugins.de/archive/2018-11-14/MBS_FileMaker_Plugin_version_8/monkeybreadsoftware_blog_filemaker)
- [LDAP with JSON](https://www.mbsplugins.de/archive/2017-12-11/LDAP_with_JSON/monkeybreadsoftware_blog_filemaker)
- [MBS FileMaker Plugin, version 7.0pr4](https://www.mbsplugins.de/archive/2017-01-19/MBS_FileMaker_Plugin_version_7/monkeybreadsoftware_blog_filemaker)
- [LDAP in FileMaker](https://www.mbsplugins.de/archive/2015-12-16/LDAP_in_FileMaker/monkeybreadsoftware_blog_filemaker)

This function checks for a license.

Created 15th December 2015 , last changed 25th February 2026

  
[LDAP.Rename](LDAPRename.md) - [LDAP.SearchResult.AttributeCount](LDAPSearchResultAttributeCount.md)

[HTML Version](LDAPSearch.shtml)