How do I retrieve a list of only those users and groups that have been added since a certain date from an LDAP directory?

Question

My application does an LDAP query once a day and fetches all the users and groups in a given container. Once it is fetched, my app goes iterates through the list of users of groups, adding only the new ones to my application's database (it adds only username).

If there are 50,000 users, my application server is busy for 45 minutes every day performing this operation.

Is there any way to specify that I need a "delta" in my LDAP query so that I retrieve only those users who got added/modified/deleted since my last LDAP query?

Answer 1

I think there should be a modifyTimestamp on each entry. Take a peek with something like softerra ldap browser (http://download.softerra.com/files/ldapbrowser26.msi). If it exists you should be able to add a condition to your ldap query to look for entries that have been changed since you last ran the sync job.

Answer 2

It depends on your directory. There should be an attribute such as a timestamp or sequence number that you can use to filter your LDAP query with. In Active Directory for instance, the value is 'uSNChanged'.

Answer 3

There are two main choices for tracking changes: polling and DirSync. These articles should give you some background and help you to choose what's best for you.

http://support.microsoft.com/kb/891995

http://msdn.microsoft.com/en-us/library/ms677974%28VS.85%29.aspx

and here's some .NET stuff:

http://msdn.microsoft.com/en-us/library/system.directoryservices.directorysynchronization.aspx