#! /bin/sh
# \
exec tclsh "$0" ${1+"$@"}

namespace eval ldapsearch {

    set settings(domain) your.domain
    set settings(user) authorized_user
    set settings(pass) p4sSwh1rRed
    # for pw_expires, use "never" or keywords compatible with clock arithmetic
    # see https://www.tcl-lang.org/man/tcl/TclCmd/clock.html#M22
    set settings(pw_expires) {90 days}
    set settings(server_timezone) GMT
    set settings(client_timezone) US/Eastern

    # timeout in seconds for LDAP queries... For some reason, when searching for cn
    # or displayName, results return instantly; whereas searching any other field
    # (employeeID for instance) returns results in *exactly* the number of seconds
    # in this timeout setting, regardless of the actual time needed to complete the
    # search.  Perhaps the Windows domain controller does not send its EOF-ish search
    # complete signal when searching non-indexed columns the same as it does for
    # sAMAccountName / cn / displayName / etc.  But I digress.  Set this low for
    # faster queries, but not low enough that valid searches return 0 results.
    set settings(timeout) 8

    # Wildcard searches seem to error with ldap::secure_connect
    set settings(use-ssl) false

     #########################
     # End of user variables #
     #########################

    variable settings

    package require ldap
    if {$settings(use-ssl)} { package require tls }

    proc isid {what} {
        # What does an employee ID look like in your organization?
        # For this example we'll say it's in the format of E01234567
        return [regexp -nocase {^E\d{8}$} $what]
    }

    proc search {what} {
        variable settings
        global env

        if {$settings(use-ssl)} {
            if {[catch {ldap::secure_connect $settings(domain)} idx]} { set idx [ldap::connect $settings(domain)] }
        } {        set idx [ldap::connect $settings(domain)] }

        if {$settings(use-ssl) && [::ldap::info tls $idx]} {
            puts "SSL connected to [::ldap::info ip $idx]"
        } { puts "Connected to [::ldap::info ip $idx]" }

        ldap::bind $idx $settings(user)@$settings(domain) $settings(pass)

        set attributes {
            sAMAccountName
            name
            displayName
            employeeID
            pwdLastSet
            userAccountControl
            memberOf
            msExchHomeServerName
            msExchHideFromAddressLists
        }
        if {[isid $what]} {
            set filter "(employeeID=$what)"
            set options [list -scope sub -timelimit $settings(timeout) -sizelimit 1]
        } else {
            set filter "|(cn=$what*)(displayName=$what*)"
            set options [list -scope sub -timelimit $settings(timeout) -sizelimit 20]
        }
        if {[catch {
            set dc "dc=[string map {. ,dc=} $settings(domain)]"
            ldap::searchInit $idx $dc $filter $attributes $options
        } fail]} { puts "Init failure: $fail"; ldap::unbind $idx; ldap::disconnect $idx; return }

        while {![catch {ldap::searchNext $idx} flat]} {

            set dn [lindex $flat 0]
            set flat [lindex $flat 1]

            if {![llength $flat]} { continue }
            foreach attr $attributes { set res($attr) {} }
            foreach {name val} $flat { set res($name) $val }

            # Interpret dates from the server's time zone, displaying them in the client's
            if {[info exists env(TZ)]} { set keepTZ $env(TZ) } { set keepTZ $settings(client_timezone) }
            set env(TZ) $settings(server_timezone)
            # $res(pwdLastSet) is measured in 100 nanosecond intervals since 1/1/1601
            # convert to seconds
            set res(pwdLastSet) [expr {wide($res(pwdLastSet) * pow(10,-7))}]
            # convert to 1970 epoch
            incr res(pwdLastSet) [clock scan {1601-1-1} -format {%Y-%m-%d}]
            # expires when?
            if {![regexp {\d} $settings(pw_expires)]} {
                set res(pwdExpires "never"
            } else {
                set dur [lindex $settings(pw_expires) 0]
                set unit [lindex $settings(pw_expires) 1]
                set res(pwdExpires) [clock format [clock add $res(pwdLastSet) $dur $unit]\
                -format {%+} -timezone $settings(client_timezone)]
            }
            # Set how long ago?
            set res(pwdAge) "[expr {([clock seconds] - $res(pwdLastSet)) / 60 / 60 / 24}] days"
            # Math finished.  Make pwdLastSet human readable now.
            set res(pwdLastSet) [clock format $res(pwdLastSet) -format {%+} -timezone $settings(client_timezone)]
            # restore temporarily changed env(TZ)
            set env(TZ) $keepTZ

            # see http://support.microsoft.com/kb/305144 for $res(userAccountControl)
            set UAC {
                134217728        UF_USE_AES_KEYS
                67108864        UF_PARTIAL_SECRETS_ACCOUNT
                16777216        TRUSTED_TO_AUTH_FOR_DELEGATION
                8388608        PASSWORD_EXPIRED
                4194304        DONT_REQ_PREAUTH
                2097152        USE_DES_KEY_ONLY
                1048576        NOT_DELEGATED
                524288        TRUSTED_FOR_DELEGATION
                262144        SMARTCARD_REQUIRED
                131072        MNS_LOGON_ACCOUNT
                65536        DONT_EXPIRE_PASSWORD
                8192        SERVER_TRUST_ACCOUNT
                4096        WORKSTATION_TRUST_ACCOUNT
                2048        INTERDOMAIN_TRUST_ACCOUNT
                512        NORMAL_ACCOUNT
                256        TEMP_DUPLICATE_ACCOUNT
                128        ENCRYPTED_TEXT_PWD_ALLOWED
                64        PASSWD_CANT_CHANGE
                32        PASSWD_NOTREQD
                16        LOCKOUT
                8        HOMEDIR_REQUIRED
                2        ACCOUNTDISABLE
                1        SCRIPT
            }

            set flags [list]
            foreach {dec flag} $UAC {
                if {!$res(userAccountControl)} { break }
                if {$res(userAccountControl) >= $dec} { lappend flags $flag; incr res(userAccountControl) -$dec }
            }
            set res(userAccountControl) $flags

            set groups [list]
            foreach group $res(memberOf) {
                lappend groups [string map {CN= ""} [lindex [split $group ,] 0]]
            }
            set res(memberOf) $groups

            set res(msExchHomeServerName) [lindex [split [lindex $res(msExchHomeServerName) end] =] end]

            foreach {name val} [array get res] { puts "$name: $val" }
            puts "\n"
        }
        # puts "Last value of \$flat: $flat"
        ldap::searchEnd $idx
        ldap::unbind $idx
        ldap::disconnect $idx

        return
    }
}; # end namespace

if {[llength $argv]} { puts $argv; ldapsearch::search [lindex $argv 0] }

$ tclsh
% source thisfile.tcl
% ldapsearch::search employeeID
- outputs exact match where employeeID=searchterm
% ldapsearch::search username
- outputs records for (up to 20) accounts matching cn=searchterm* or displayName=searchterm*