dissect.database.ese.ntds.schema

Module Contents

Classes

ClassEntry

AttributeEntry

Schema

An index for schema entries providing fast lookups by various keys.

Functions

parse_prefix_map

Parse a prefix map.

decode_oid

Decode a BER encoded OID.

Attributes

BOOTSTRAP_COLUMNS

BOOTSTRAP_ATTRIBUTES

BOOTSTRAP_OBJECT_CLASSES

BOOTSTRAP_OID_PREFIXES

dissect.database.ese.ntds.schema.BOOTSTRAP_COLUMNS = [('DNT', 'DNT_col', 524297), ('Pdnt', 'PDNT_col', 524297), ('Obj', 'OBJ_col', 524296),...
dissect.database.ese.ntds.schema.BOOTSTRAP_ATTRIBUTES = [('objectClass', 0, 524290, False), ('cn', 3, 524300, True), ('isDeleted', 131120, 524296,...
dissect.database.ese.ntds.schema.BOOTSTRAP_OBJECT_CLASSES
dissect.database.ese.ntds.schema.BOOTSTRAP_OID_PREFIXES
class dissect.database.ese.ntds.schema.ClassEntry

Bases: NamedTuple

dnt: int
id: int
name: str
class dissect.database.ese.ntds.schema.AttributeEntry

Bases: NamedTuple

dnt: int
id: int
name: str
column: str
syntax: int
om_syntax: int | None
om_object_class: bytes | None
is_single_valued: bool
search_flags: dissect.database.ese.ntds.util.SearchFlags | None
class dissect.database.ese.ntds.schema.Schema

An index for schema entries providing fast lookups by various keys.

Provides efficient lookups for schema entries by DNT, OID, ATTRTYP, LDAP display name, and column name.

load(db: dissect.database.ese.ntds.database.Database) → None

Load the classes and attributes from the database into the schema index.

Parameters:

db – The database instance to load the schema from.

lookup_attribute(*, id: int | None = None, name: str | None = None, link_id: int | None = None, column: str | None = None) → AttributeEntry | None

Lookup an attribute schema entry by an indexed field.

Parameters:

  • id – The attribute ID to look up.

  • name – The LDAP display name to look up.

  • link_id – The link ID to look up.

  • column – The column name to look up.

Returns:

The matching attribute schema entry or None if not found.

lookup_class(*, id: int | None = None, name: str | None = None) → ClassEntry | None

Lookup a class schema entry by an indexed field.

Parameters:

  • id – The class ID to look up.

  • name – The LDAP display name to look up.

Returns:

The matching class schema entry or None if not found.

lookup_oid(oid: str) → ClassEntry | AttributeEntry | None

Lookup a schema entry by OID.

Parameters:

oid – The OID to look up.

Returns:

The matching schema entry or None if not found.

attrtyp_to_oid(attrtyp: int) → str | None

Convert an ATTRTYP integer value to an OID string.

Parameters:

attrtyp – The ATTRTYP integer value to convert.

Returns:

The corresponding OID string or None if the ATTRTYP does not correspond to a valid OID.

lookup(*, dnt: int | None = None, oid: str | None = None, attrtyp: int | None = None, name: str | None = None) → ClassEntry | AttributeEntry | None

Lookup a schema entry by an indexed field.

Parameters:

  • dnt – The DNT (Distinguished Name Tag) of the schema entry to look up.

  • oid – The OID (Object Identifier) of the schema entry to look up.

  • attrtyp – The ATTRTYP (attribute type) of the schema entry to look up.

  • name – The LDAP display name of the schema entry to look up.

Returns:

The matching schema entry or None if not found.

dissect.database.ese.ntds.schema.parse_prefix_map(buf: bytes) → dict[int, str]

Parse a prefix map.

Parameters:

buf – The buffer containing the prefix map data.

dissect.database.ese.ntds.schema.decode_oid(buf: bytes) → str

Decode a BER encoded OID.

Parameters:

buf – The buffer containing the BER encoded OID.