1

There is a software which changes its behavior based on accessibility of the Active Directory domain controller (for domain joined machines). For example, if a machine inside a LAN and the domain controller is accessible, all features are available. If the machine goes outside of the LAN, some features of the software are disabled.

It works well on Windows using the standard Win32 API but I cannot find a way to implement it for macOS so far. I could not find any API. I tried some command line tools. For example,

dscl "/Active Directory/<DOMAIN NAME>" read / dsAttrTypeNative:DomainName

odutil show nodenames

Even if I disconnect the macOS machine from the AD LAN, they still show the information for about 30 minutes, like the domain controller is still accessible.

I cannot delete the whole Open Directory AD cache to make the tools to refresh the information because the cache is used by the system and the other applications. I do not want to change behavior of the whole system. I cannot kill (restart) services for that because I need to do it quite often (every 2-5 minutes).

I know I can use ldapsearch (or an LDAP C++ library) to check accessibility of an AD domain controller but my software does not have any idea about the domain controller configuration. It does not have any credentials to request the information. Also, in case of Windows API, Kerberos is used by default. In case of ldapsearch it has to be configured.

So, is there any macOS API (Objective C, C++) or any system command tool which I can use without additional configuration to check if the AD domain controller is accessible?

Eugen
  • 479
  • 5
  • 16
  • How about just trying to open a TCP connection to a DNS name? If you have a domain called `domain.whatever`, you should be able to open a connection to `domain.whatever` on port 389. Do you need any validation in case of successful connection that this actually is a domain controller and not just random LDAP? – raspy Nov 24 '20 at 22:59
  • raspy, thank you for your comment. Yes, validation is the issue. I cannot just ping a DNS name/IP address or connect to the LDAP port. I need to be sure it is the true domain controller. – Eugen Nov 26 '20 at 00:02
  • 1
    The very minimal validation, which should not require credentials, would be to open LDAPS connection to Active Directory and verify whether the connection was secured given a trusted certificate. I would set `LDAPTLS_CACERT` environment variable for trusted (expected) certificate and run `ldapsearch -ZZ -h controller.domain -s base -x`. This queries for rootDSE, which should be accessible without authentication in standard AD setup. – raspy Dec 09 '20 at 14:58

0 Answers0