Is there any preferable way to get user/group information from an Active Directory domain in Python?
Question: For a Django application that I'm working on, I wanted to allow group
membership to be determined by Active Directory group. After a while of
digging through the pywin32 documentation, I came up with this:

    
    
    >>> import win32net
    >>> win32net.NetUserGetGroups('domain_name.com', 'username')
    [(u'Domain Users', 7), ...]
    

I spent a while googling before I figured this out though, and the examples I
found almost exclusively used LDAP for this kind of thing. Is there any reason
why that's to be preferred over this method? Bear a couple things in mind:

  1. I'm not using Active Directory to actually perform authentication, only permissions. Authentication is performed by another server.
  2. While it would be nice to have some cross-platform capabilities, this will probably run almost exclusively on Windows.


Answer: AD's LDAP interface has quite a few 'quirks' that make it more difficult to
use than it might appear on the surface, and it tends to lag significantly
behind on features. When I worked with it, I mostly dealt with authentication,
but it's probably the same no matter what you're doing. There's a lot of
weirdness in terms of having to be bound as a certain user just to do simple
searches that a normal LDAP server would let you do as anonymous.

Also, at least as of a year ago, when I worked on this, python-ldap was the
only Python LDAP implementation to support anywhere close to the full feature
set, since it's built on top of OpenLDAP, However, OpenLDAP is rather
difficult to build on Windows (and in general), so most builds will be missing
one or more features. Although you're not doing authentication, a lack of
SASL/Kerberos support (which was missing at the time I used it) might make
things complicated for you.

If you have something that works, and only need to run it on Windows, I would
really recommend sticking to it; using AD via LDAP can turn into a big
project.

