AD – A Javascript implementation of common Active Directory tasks (opens in new tab)

(github.com)

79 pointsrobinj68y ago19 comments

19 comments

16 comments · 5 top-level

0xbear8y ago· 4 in thread

I'm pretty sure Microsoft had this 15 years ago. AD is accessible through COM. Anything that's accessible through COM is scriptable in JS and VBScript (if it still exists, it's been a while).

Const-me8y ago

Right, the thing is called ADSI: https://msdn.microsoft.com/en-us/library/aa772170%28v=vs.85%...

Yes, both JScript (not the same as JavaScript, BTW) and VBScript are still supported and both are included in modern Windows versions.

The project is still somewhat useful because it runs on any OS, not just Windows. It doesn’t use ADSI, it relies on this instead: http://ldapjs.org/

pjc508y ago

.. and Powershell. It's very, very hard to discover what this API is though.

youdontknowtho8y ago

Ops project or PowerShell?

1 more reply

flukus8y ago

Is this the API that the .net libraries are based on? If so it's the worst API I've ever used in my life. It's near impossible to test with and anything non-trivial can leave the system in god knows what state when something goes wrong.

ToFab1238y ago· 4 in thread

Let me get this straight. Passwords, including the password of a domain admin, are hardcoded as plain text in client side JavaScript files. Surely, I must be reading this wrong?

robinj6OP8y ago

Reading it wrong. Any application needs to use secrets, it's up to the developer to pass them in properly. For example, you can use environmental variables, command line args when running the process, or a config file. This isn't a client-side library.

_ar78y ago

Yeah you're reading it wrong. This is for node so it'd never be client side, and I'm sure the pw examples are in plaintext just for simplicity in the README.

IncRnd8y ago

The authors are even aware of this! The admin password in their first example is "howinsecure".

tracker18y ago

A recent shared secret, I defaulted to "not very secure" for local dev/testing, but uses an environment variable in practice.

1 more reply

holydude8y ago· 3 in thread

I am not very proficient in javascript so excuse my idiotic questions but how does this work ? Does this need to talk to some low level api or nodejs supports this or ?

robinj6OP8y ago

You would download and run this on a Node server. It then uses LDAP to talk to Active Directory, and exposes a Javascript library to make that talk simple.

delinka8y ago

I don't think the server part is necessary. Regardless of where you run it, it relies on ldapjs to talk LDAP to Active Directory.

1 more reply

tracker18y ago

It's an npm package for use with node.js. I don't think it will work in a browser as-is. It's funny, but my initial assumption these days is that it will be exposed via npm and work in node and/or browser via bundling.

dsl8y ago

I really appreciate the effort put in to a library like this, fantastic work.

However I would strongly warn anyone considering using it to do massive amounts of testing in their real production network. Implementing against the current version is easy, but lets remember: this is a protocol old enough to buy cigarettes. It not only changes in behavior between versions, it also has edge cases where things behave differently when the version you are running is an upgrade. Or an upgrade in progress. Or part of a forest that also has... etc.

AndrewCHM8y ago

https://gist.github.com/Summertime/95cc7bec49d3948ce2f76ded0... An attempt to transcribe the examples to powershell cmdlets, in case anyone was wondering how much it differs to the tools pre-existing for the task

- - -

I have to say, other than setup and lack of permission handling the js lib has, I would find myself preferring it

j / k navigate · click thread line to collapse

19 comments

16 comments · 5 top-level

0xbear8y ago· 4 in thread

I'm pretty sure Microsoft had this 15 years ago. AD is accessible through COM. Anything that's accessible through COM is scriptable in JS and VBScript (if it still exists, it's been a while).

Const-me8y ago

Right, the thing is called ADSI: https://msdn.microsoft.com/en-us/library/aa772170%28v=vs.85%...

Yes, both JScript (not the same as JavaScript, BTW) and VBScript are still supported and both are included in modern Windows versions.

The project is still somewhat useful because it runs on any OS, not just Windows. It doesn’t use ADSI, it relies on this instead: http://ldapjs.org/

pjc508y ago

.. and Powershell. It's very, very hard to discover what this API is though.

youdontknowtho8y ago

Ops project or PowerShell?

1 more reply

flukus8y ago

ToFab1238y ago· 4 in thread

Let me get this straight. Passwords, including the password of a domain admin, are hardcoded as plain text in client side JavaScript files. Surely, I must be reading this wrong?

robinj6OP8y ago

_ar78y ago

Yeah you're reading it wrong. This is for node so it'd never be client side, and I'm sure the pw examples are in plaintext just for simplicity in the README.

IncRnd8y ago

The authors are even aware of this! The admin password in their first example is "howinsecure".

tracker18y ago

A recent shared secret, I defaulted to "not very secure" for local dev/testing, but uses an environment variable in practice.

1 more reply

holydude8y ago· 3 in thread

I am not very proficient in javascript so excuse my idiotic questions but how does this work ? Does this need to talk to some low level api or nodejs supports this or ?

robinj6OP8y ago

You would download and run this on a Node server. It then uses LDAP to talk to Active Directory, and exposes a Javascript library to make that talk simple.

delinka8y ago

I don't think the server part is necessary. Regardless of where you run it, it relies on ldapjs to talk LDAP to Active Directory.

1 more reply

tracker18y ago

dsl8y ago

I really appreciate the effort put in to a library like this, fantastic work.

AndrewCHM8y ago

- - -

I have to say, other than setup and lack of permission handling the js lib has, I would find myself preferring it

j / k navigate · click thread line to collapse