LDAP Funciones

Tabla de contenidos

ldap_8859_to_t61 — Traducir caracteres 8859 a caracteres t61
ldap_add — Agregar entradas al directorio de LDAP
ldap_add_ext — Add entries to LDAP directory
ldap_bind — Realiza la autenticación con un servidor LDAP
ldap_bind_ext — Bind to LDAP directory
ldap_close — Alias de ldap_unbind
ldap_compare — Comparar el valor del atributo encontrado en la entrada que se especificó con un DN
ldap_connect — Abre una conexión a un servidor LDAP
ldap_connect_wallet — Connect to an LDAP server
ldap_control_paged_result — Enviar el control de paginación LDAP
ldap_control_paged_result_response — Recuperar la cookie de paginación LDAP
ldap_count_entries — Contar el número de entradas en una búsqueda
ldap_count_references — Counts the number of references in a search result
ldap_delete — Eliminar una entrada de un directorio
ldap_delete_ext — Delete an entry from a directory
ldap_dn2ufn — Convertir un DN a un formato de nombramiento amigable al usuario
ldap_err2str — Convertir un número de error de LDAP a una cadena con un mensaje de error
ldap_errno — Devuelve el número de error LDAP del último comando LDAP
ldap_error — Devuelve el mensaje de error de LDAP del último comando LDAP
ldap_escape — Escapa una cadena de texto para su uso en un filtro LDAP o DN
ldap_exop — Performs an extended operation
ldap_exop_passwd — PASSWD extended operation helper
ldap_exop_refresh — Refresh extended operation helper
ldap_exop_sync — Performs an extended operation
ldap_exop_whoami — WHOAMI extended operation helper
ldap_explode_dn — Divide un DN en sus partes componentes
ldap_first_attribute — Devolver el primer atributo
ldap_first_entry — Devolver el primer resultado de identificación
ldap_first_reference — Devolver la primera referencia
ldap_free_result — Liberar la memoria de resultado
ldap_get_attributes — Obtener atributos de una entrada de búsqueda de resultados
ldap_get_dn — Get the DN of a result entry
ldap_get_entries — Obtener todas las entradas de los resultados
ldap_get_option — Obtener el valor actual para la opción dada
ldap_get_values — Obtener todos los valores de una entrada de resultados
ldap_get_values_len — Obtener todos los valores binarios desde una entrada de resultados
ldap_list — Búsqueda de un solo nivel
ldap_mod_add — Agregar valores de atributo a los atributos actuales
ldap_mod_add_ext — Add attribute values to current attributes
ldap_mod_del — Borrar valores de atributo de los atributos actuales
ldap_mod_del_ext — Delete attribute values from current attributes
ldap_mod_replace — Reemplazar valores de atributos con valores nuevos
ldap_mod_replace_ext — Replace attribute values with new ones
ldap_modify — Modificar una entrada de LDAP
ldap_modify_batch — Batch and execute modifications on an LDAP entry
ldap_next_attribute — Obtener el siguiente atributo en un resultado
ldap_next_entry — Obtener el siguiente resultado de entrada
ldap_next_reference — Obtener la siguiente referencia
ldap_parse_exop — Parse result object from an LDAP extended operation
ldap_parse_reference — Extraer información de la entrada de referencia
ldap_parse_result — Extraer información del resultado
ldap_read — Leer una entrada
ldap_rename — Modificar el nombre de una entrada
ldap_rename_ext — Modify the name of an entry
ldap_sasl_bind — Unirse a un directorio LDAP utilizando SASL
ldap_search — Buscar el árbol LDAP
ldap_set_option — Establecer el valor de la opción proporcionada
ldap_set_rebind_proc — Establece una función de devolución de llamada para realizar revinculaciones en el rastreo referencial
ldap_sort — Clasificar entradas de resultados de LDAP en el lado del cliente
ldap_start_tls — Inciar TLS
ldap_t61_to_8859 — Traduce del conjunto de caracteres t61 al conjunto de caracteres 8859
ldap_unbind — Desenlazar de directorio LDAP

Found A Problem?

Learn How To Improve This Page • Submit a Pull Request • Report a Bug

＋add a note

User Contributed Notes 34 notes

down

idbobby at rambler dot ru ¶

14 years ago

First of all, sorry for my English.
Here are two functions to check group membership and some others which can be useful for work with LDAP (Active Directory in this example).

index.php
---------

<?php

$user = 'bob';
$password = 'zhlob';
$host = 'myldap';
$domain = 'mydomain.ex';
$basedn = 'dc=mydomain,dc=ex';
$group = 'SomeGroup';

$ad = ldap_connect("ldap://{$host}.{$domain}") or die('Could not connect to LDAP server.');
ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);
@ldap_bind($ad, "{$user}@{$domain}", $password) or die('Could not bind to AD.');
$userdn = getDN($ad, $user, $basedn);
if (checkGroupEx($ad, $userdn, getDN($ad, $group, $basedn))) {
//if (checkGroup($ad, $userdn, getDN($ad, $group, $basedn))) {
    echo "You're authorized as ".getCN($userdn);
} else {
    echo 'Authorization failed';
}
ldap_unbind($ad);

/*
* This function searchs in LDAP tree ($ad -LDAP link identifier)
* entry specified by samaccountname and returns its DN or epmty
* string on failure.
*/
function getDN($ad, $samaccountname, $basedn) {
    $attributes = array('dn');
    $result = ldap_search($ad, $basedn,
        "(samaccountname={$samaccountname})", $attributes);
    if ($result === FALSE) { return ''; }
    $entries = ldap_get_entries($ad, $result);
    if ($entries['count']>0) { return $entries[0]['dn']; }
    else { return ''; };
}

/*
* This function retrieves and returns CN from given DN
*/
function getCN($dn) {
    preg_match('/[^,]*/', $dn, $matchs, PREG_OFFSET_CAPTURE, 3);
    return $matchs[0][0];
}

/*
* This function checks group membership of the user, searching only
* in specified group (not recursively).
*/
function checkGroup($ad, $userdn, $groupdn) {
    $attributes = array('members');
    $result = ldap_read($ad, $userdn, "(memberof={$groupdn})", $attributes);
    if ($result === FALSE) { return FALSE; };
    $entries = ldap_get_entries($ad, $result);
    return ($entries['count'] > 0);
}

/*
* This function checks group membership of the user, searching
* in specified group and groups which is its members (recursively).
*/
function checkGroupEx($ad, $userdn, $groupdn) {
    $attributes = array('memberof');
    $result = ldap_read($ad, $userdn, '(objectclass=*)', $attributes);
    if ($result === FALSE) { return FALSE; };
    $entries = ldap_get_entries($ad, $result);
    if ($entries['count'] <= 0) { return FALSE; };
    if (empty($entries[0]['memberof'])) { return FALSE; } else {
        for ($i = 0; $i < $entries[0]['memberof']['count']; $i++) {
            if ($entries[0]['memberof'][$i] == $groupdn) { return TRUE; }
            elseif (checkGroupEx($ad, $entries[0]['memberof'][$i], $groupdn)) { return TRUE; };
        };
    };
    return FALSE;
}

?>

down

oscar dot php at linaresdigital dot com ¶

9 years ago

There is a lot of confusion about accountExpires, pwdLastSet, lastLogon and badPasswordTime active directory fields.

All of them are using "Interval" date/time format with a value that represents the number of 100-nanosecond intervals since January 1, 1601 (UTC, and a value of 0 or 0x7FFFFFFFFFFFFFFF, 9223372036854775807, indicates that the account never expires): https://msdn.microsoft.com/en-us/library/ms675098(v=vs.85).aspx

So if you need to translate it from/to UNIX timestamp you can easily calculate the difference with:

<?php
$datetime1 = new DateTime('1601-01-01');
$datetime2 = new DateTime('1970-01-01');
$interval = $datetime1->diff($datetime2);
echo ($interval->days * 24 * 60 * 60) . " seconds\n";
?>

The difference between both dates is 11644473600 seconds. Don't rely on floating point calculations nor other numbers that probably were calculated badly (including time zone or something similar).

Now you can convert from LDAP field:

<?php
$lastlogon = $info[$i]['lastlogon'][0];
// divide by 10.000.000 to get seconds from 100-nanosecond intervals
$winInterval = round($lastlogon / 10000000);
// substract seconds from 1601-01-01 -> 1970-01-01
$unixTimestamp = ($winInterval - 11644473600);
// show date/time in local time zone
echo date("Y-m-d H:i:s", $unixTimestamp) ."\n";
?>

Hope it helps.

down

maykelsb at yahoo dot com dot br ¶

17 years ago

Problems with ldap_search in W2k3, can be solved adding 

// -- $conn is a valid ldap connection.

ldap_set_option($conn, LDAP_OPT_PROTOCOL_VERSION,3);
ldap_set_option($conn, LDAP_OPT_REFERRALS,0);

before ldap_bind, as sad in http://bugs.php.net/bug.php?id=30670.

down

gcathell at thetdgroup dot com ¶

18 years ago

I recently had to access a Microsoft Active Directory server as an LDAP service over SSL using PHP.  It took me a long time to get all the information I needed to get it to work.

I attempted to post a note here with the details but it ended it being too long.  I've placed the details at the following URL in hopes that someone else will benefit and will be able to solve the problem much more quickly than I did.

http://greg.cathell.net/php_ldap_ssl.html

Good luck!

down

spam2004 at turniton dot dk ¶

20 years ago

Here are two small functions that enables you to convert a binary objectSID from Microsoft AD into a more usefull text version (formatted (S-1-5.....)).

// Converts a little-endian hex-number to one, that 'hexdec' can convert
function littleEndian($hex) {
    for ($x=strlen($hex)-2; $x >= 0; $x=$x-2) {
        $result .= substr($hex,$x,2);
    }
    return $result;
}

// Returns the textual SID
function binSIDtoText($binsid) {
    $hex_sid=bin2hex($binsid);
    $rev = hexdec(substr($hex_sid,0,2));          // Get revision-part of SID
    $subcount = hexdec(substr($hex_sid,2,2));    // Get count of sub-auth entries
    $auth = hexdec(substr($hex_sid,4,12));      // SECURITY_NT_AUTHORITY
    $result = "$rev-$auth";
    for ($x=0;$x < $subcount; $x++) {
        $subauth[$x] = hexdec(littleEndian(substr($hex_sid,16+($x*8),8)));  // get all SECURITY_NT_AUTHORITY
        $result .= "-".$subauth[$x];
    }
    return $result;
}

echo binSIDtoText($bin_sid);

down

hijinio at comcast dot net ¶

19 years ago

In case anybody has trouble configuring PHP with LDAP support on a Solaris 10 box, here is the configure line I used:

./configure --with-nsapi=/opt/SUNWwbsvr --enable-libgcc --disable-libxml --with-ldap=/usr/local --prefix=/opt/php/php-5.0.4

The important part to note is the location used for --with-ldap= ; which for most S10 people, will be "--with-ldap=/usr/local".

down

Richie Bartlett(at)ITsystems-Online com ¶

19 years ago

This is an update to <i>wtfo at technocraft dot com</i> (23-May-2002 03:40)... This function allows additional (optional) parameters. The prev function listed, failed to close the ldap connection after successful authenication.

<?php
function checkNTuser($username,$password,$DomainName="myDomain",
                      $ldap_server="ldap://PDC.example.net"){//v0.9
// returns true when user/pass enable bind to LDAP (Windows 2k).
    $auth_user=$username."@".$DomainName;
    #echo $auth_user."->";
    if($connect=@ldap_connect($ldap_server)){
        #echo "connection ($ldap_server): ";
        if($bind=@ldap_bind($connect, $auth_user, $password)){
            #echo "true <BR>";
            @ldap_close($connect);
            return(true);
        }//if bound to ldap
    }//if connected to ldap
    #echo "failed <BR>";
    @ldap_close($connect);
    return(false);
}//end function checkNTuser
?>

down

ant at solace dot mh dot se ¶

20 years ago

When working with LDAP, its worth remembering that the majority
of LDAP servers encode their strings as UTF-8. What this means
for non ascii strings is that you will need to use the utf8_encode and
utf8_decode functions when creating filters for the LDAP server.

Of course, if you can its simpler to just avoid using non-ascii characters
but for most sites the users like to see their strange native character
sets including umlauts etc..

If you just get ? characters where you are expecting non-ascii, then
you might just need to upgrade your PHP version.

down

christopherbyrne at hotmail dot com ¶

19 years ago

For anyone who's been having trouble working with the "accountexpires" attribute in Active Directory after having read the following article 

www.microsoft.com/technet/scriptcenter/
resources/qanda/sept05/hey0902.mspx 

or something similar, this may save you some frustration. In the article is is mentioned that this attribute is an integer representing the number of nanoseconds since 01-Jan-1601 00:00:00.

However the "accountexpires" attribute actually seems to be the number of 100 nanosecond increments since 31-Dec-1600 14:00:00. As a result if you divide the integer by 10,000,000 and subtract 11644560000 you will get a Unix timestamp that will match the dates in AD. 

To set the "accountexpires" date just reverse the procedure, that is, get the timestamp for the new date you want, add 11644560000 and multiply by 10,000,000. You will also need to format the resultant number to make sure it is not outputted in scientific notation for AD to be happy with it. 

Hope this helps!

down

llurovi at gmail dot com ¶

8 years ago

For those of you that are having trouble when user's password has special characters, make sure you decode the string to an appropiate codification. For instance, I had an issue where some users could not logging properly into our web app.

Example of a simple connection:

<?php

$ldap_ip = 'LDAP-SERVER-IP';
$ldap = ldap_connect($ldap_ip);

$user = 'Test';
$password = 'otoño'; //This password is correct but binding it with this format will give us an error

$password = utf8_decode($password); //$password = otoxF1o

$ldap_bind = ldap_bind($ldap, $user, $password); //Now the binding is successfull and $ldap_bind = true

?>

down

unroar at gmail dot com ¶

18 years ago

In Solaris 9 the libnet library is a prerequisite for building  PHP with LDAP, SASL and SSL (libnet is available on Sunfreeware).  

I didn't see this mentioned anywhere and I'm not sure if it is required by ldap or sasl or ssl.  I just spent an hour on Google with no luck before I figured it out, maybe this comment will help the next googler.

The error is,
ld: fatal: library -lnet: not found
ld: fatal: File processing errors. No output written to sapi/cli/php
collect2: ld returned 1 exit status
make: *** [sapi/cli/php] Error 1

down

alex at netflex dot nl ¶

17 years ago

If you want to use ldaps on windows but you don't want to validate the tls certificate try the following line before the ldap_connect call:

putenv('LDAPTLS_REQCERT=never') or die('Failed to setup the env');

down

jabba at zeelandnet dot nl ¶

20 years ago

When using PHP on windows, and you are trying to connect (bind) to a Netware (6) LDAP server that requires secure connections (LDAPS), PHP will return a message stating that the server cannot be found.
 
A network traffic capture of the traffic taking place on connection attempt reveals that the server supplies a certificate for use in the SSL connection, but this is rejected (***bad certificate SSLv3 packet) by the client.

The reason for this is probably that the PHP LDAP implementation tries to verify the received certificate with the CA that issued the certificate. There may be a way to make it possible that this verification succeeds, but it is also possible to disable this verification by the client (which is, in this case, PHP) by creating an openldap (surprise!!) configuration file. 

The location of this configuration file seems to be hardcoded in the LDAP support module for windows, and you may need to manually create the following directory structure:

C:\openldap\sysconf\

In the sysconf folder, create a text file named 'ldap.conf' (you can use notepad for this) and, to disable certificate verification, place the following line in the ldap.conf file:

TLS_REQCERT never

After this, all the normal ldap_bind calls will work, provided your supplied user id and password are correct.

down

Sami Oksanen ¶

20 years ago

I edited Jon Caplinger's code which is located below (date: 09-Nov-2002 05:44).

 - I corrected line
   "if (!($connect=@ldap_connect($ldap))) {" with
   "if (!($connect=@ldap_connect($ldap_server))) {"

 - Removed $name-attribute

 - "Name is:"-field was always an Array, so I changed printing line to:
   " echo "Name is: ". $info[$i]["name"][0]."<br>";"

I also added some alternative search filters to try out.

Here is the code:

<?php

$ldap_server = "ldap://foo.bar.net";
$auth_user = "user@bar.net";
$auth_pass = "mypassword";

// Set the base dn to search the entire directory.

$base_dn = "DC=bar, DC=net";

// Show only user persons
$filter = "(&(objectClass=user)(objectCategory=person)(cn=*))";

// Enable to show only users
// $filter = "(&(objectClass=user)(cn=$*))";

// Enable to show everything
// $filter = "(cn=*)";

// connect to server

if (!($connect=@ldap_connect($ldap_server))) {
     die("Could not connect to ldap server");
}

// bind to server

if (!($bind=@ldap_bind($connect, $auth_user, $auth_pass))) {
     die("Unable to bind to server");
}

//if (!($bind=@ldap_bind($connect))) {
//     die("Unable to bind to server");
//}

// search active directory

if (!($search=@ldap_search($connect, $base_dn, $filter))) {
     die("Unable to search ldap server");
}

$number_returned = ldap_count_entries($connect,$search);
$info = ldap_get_entries($connect, $search);

echo "The number of entries returned is ". $number_returned."<p>";

for ($i=0; $i<$info["count"]; $i++) {
   echo "Name is: ". $info[$i]["name"][0]."<br>";
   echo "Display name is: ". $info[$i]["displayname"][0]."<br>";
   echo "Email is: ". $info[$i]["mail"][0]."<br>";
   echo "Telephone number is: ". $info[$i]["telephonenumber"][0]."<p>";
}
?>

down

ben_demott at hotmail dot com ¶

16 years ago

For anyone that is a programmer and not extremely familiar with naming conventions in Microsoft Active Directory or how to find objects within the directory, or more importantly how to reference the objects.
Running "adsiedit.msc" from the command line will display all of your objects in the directory in an easy to read and copyable naming format.
Hope this is helpful!

Note:
You must Run this command from an AD Domain Controller
You Must have the Windows Resource Kit Tools installed
(wouldn't let me make a link that long so I had to make a link break - Sorry!)
a http://www.microsoft.com/downloads/details.aspx
?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en

Installing this tool should modify your system path so you can just type the command from the run dialogue, otherwise the absolute path is:
C:\Program Files\Windows Resource Kits\Tools\adsiedit.msc

down

nacenroe at remove dot this dot nystec dot com ¶

18 years ago

If you're looking to use PHP to integrate LDAP with AD (I'm working with Win2K3), you may want to tinker with the LDP.exe tool included (no resource kit needed!!) with Win2k and Win2K3.  You can run this app right from the command line.

The Win2K3 Help function was a good start point, and then pointed me to an article in the M$ KB: http://support.microsoft.com/default.aspx?scid=kb;en-us;255602 (XADM: Browsing and Querying Using the LDP Utility).

So ... if your connect/bindings are working but your queries are not, you may want to start here.  I'm finding it very useful when I run it on the local AD to see the attributes, etc.

down

christopherbyrne at hotmail dot com ¶

19 years ago

Just an ammendment to my previous post: my calculations were using east coast Australian time (GMT+10) whereas the Unix timestamp is in GMT. Therefore Active Directoy's "accountexpires" integer value does start from 1-Jan-1601 00:00:00 GMT and the number of seconds between this date and 1-Jan-1970 00:00:00 GMT is 11644524000. 

The increments are still definately in 100 nanoseconds though!

down

jpmens at gmail dot com ¶

19 years ago

Further to jabba at zeelandnet dot nl's note. If you are trying to connect to an LDAPS URI with OpenLDAP, you can either create the configuration file as described by jabba, or alternatively, use the environment settings to set LDAPTLS_REQCERT=never as described in ldap.conf(5).

down

knitterb at blandsite dot org ¶

22 years ago

When using PHP 4.2.1 with OpenLDAP 2.1.2 I was having problems with binding to the ldap server.  I found that php was using an older protocol and added the following to the slapd.conf:

allow bind_v2

See ``man slapd.conf'' for more info about the allow item in the slapd.conf file, this is all I know! :)

down

Jimmy Wimenta Oei ¶

20 years ago

If you want to disable/enable chase referral option, you need to first set the protocol version to version 3, otherwise the LDAP_OPT_REFERRALS option will not have any effect. This is especially true for querying MS Active Directory.

<?php
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
?>

And as always, these should be called after connect but before binding.

down

Andrew Sharpe ¶

12 years ago

To compile PHP 5.1.6 on RHEL 6.2 x86_64, add the following to your configure command:

--with-libdir=lib64
--with-ldap=/usr

down

pookey at pookey dot co dot uk ¶

21 years ago

This is an example of how to query an LDAP server, and print all entries out.

<?php

$ldapServer = '127.0.0.1';
$ldapBase = 'DC=anlx,DC=net';

/*
 * try to connect to the server
 */
$ldapConn = ldap_connect($ldapServer);
if (!$ldapConn)
{
  die('Cannot Connect to LDAP server');
}

/*
 * bind anonymously
 */
$ldapBind = ldap_bind($ldapConn);
if (!$ldapBind)
{
  die('Cannot Bind to LDAP server');
}

/*
 * set the ldap options
 */
ldap_set_option($ldapConn, LDAP_OPT_PROTOCOL_VERSION, 3);

/*
 * search the LDAP server
 */
$ldapSearch = ldap_search($ldapConn, $ldapBase, "(cn=*)");
$ldapResults = ldap_get_entries($ldapConn, $ldapSearch);

for ($item = 0; $item < $ldapResults['count']; $item++)
{
  for ($attribute = 0; $attribute < $ldapResults[$item]['count']; $attribute++)
  {
    $data = $ldapResults[$item][$attribute];
    echo $data.":&nbsp;&nbsp;".$ldapResults[$item][$data][0]."<br>";
  }
  echo '<hr />';
}

?>

down

greatsafari at hotmail dot com ¶

21 years ago

Having seen so many variations of methods for connecting and query the Active Directory server, it really makes me suspect that the whole thing is dependent of the Active Directory configurations. Looking at this post at:

http://www.phpbuilder.com/mail/php-general/2003022/1459.php

Some methods proven to be working in one instance failed at another instance.

down

nliu99 at nospam dot yahoo dot com ¶

21 years ago

libsasl.dll is NOT required for ldap functionalities. Go check out the posting at: http://bugs.php.net/bug.php?id=9485 

On win2k I followed these easy steps and got ldap to work:
1. copy php_ldap.dll from the extension folder to winnt/system32
2. edit winnt/php.ini so that ldap is enabled (uncomment the line). 
3. restart IIS. 
That's it and have fun with ldap. 

A note for Microsoft Active Directory
1. You can login with the user email, i.e. user@company.com
2. It's easiest to search for user info with ldap_search by filtering: (userprincipalname=[user])

down

egeczi at nospamplease dot dist113 dot org ¶

21 years ago

On Win2k Server running IIS, it is not enough to just restart IIS after enabling the php_ldap extension. You have to restart the server itself.

down

yorch at correo dot ath dot cx ¶

21 years ago

Some notes about running LDAP extension on a Win2k box:

After copying php_ldap.php and libsasl.dll in every single directory possible (c:\WinNT\System32, c:\php ...) I decided to read the installation.txt file.
The instructions to install php extensions say: "Some extra DLLs are required for some PHP extensions. Please copy the bundled dlls from the 'dlls/' directory in distribution package to your windows/system (Win9.x) or winnt/system32 (WinNT, Win2000, XP) directory. If you already have these DLLs installed on your system, overwrite them only if something is not working correctly."

So I did exactly that: copy ALL the dll files from "c:\php\dlls" to "c:\WinNT\System32".
Now they load beautifully ;-)

I hope this helps someone.

down

Tod ¶

17 years ago

Notes for people running PHP 4 with Apache 2.2 on Win2k3.
The Apache Service needs to be running under the local administrators account in order for the ldap_connect to return a result. As apposed to the Domain Administrators account as may happen on servers in an Active Directory Domain.

It will 'appear' to work ok but will return no results otherwise.

so use (server name)\administrator for the username in the service logon properties.

Tod

down

jector at inbox dot ru ¶

17 years ago

Spent some time on fixing "Unable to load dynamic library 'php_ldap.dll'. Copied libeay32.dll and ssleay32.dll  everywhere, but error still stands.

After digging all this dlls I found, that both libeay32.dll and ssleay32.dll need msvcr70.dll (or msvcr71.dll, it depends on the compiler version). Then just copy that dll to system32\ dir and it works perfectly.

down

nigelf at esp dot co dot uk ¶

18 years ago

Chasing referrals in Active Directory (ie: searching across domains), can be slow.  You can look up the object instead in the GC (Global Catalog) as follows:

Remove any reference to ldap:// when you use ldap_connect, ie: use "serv1.mydom.com" NOT "ldap://serv1.mydom.com"

Connect to port 3268 (not 389, the default)

Set the Base DN for the search to null ie: "" (empty quotes).  

AD will then run the search against the GC which holds a copy of all objects in the Forest.  You can also retrieve a subset of attributes (including group membership, except local groups).

You will still need to follow referals for a full set of attributes.

down

hkemale at hkem dot com ¶

21 years ago

For IIS+PHP+NTFS file system user
After copied <php_dir>/dlls/*.dll to <windows>/systems32/ remember to add read and exexcute premission to "everyone" and the extensions *.dll. this can prevent warning of Access is denied of php_ldap.dll

down

gerbille at free dot fr ¶

22 years ago

The MD5 of PHP returns a result encoded in base16. But the LDAP MD5 returns a string encoded in base64. 
$pwd="toto";
$pwd_md5=base64_encode(mhash(MHASH_MD5,$pwd));
Just add "{MD5}" front $pwd_md5 to obtain the same format as LDAP directory.

Bye
Aur?lia

down

mike at whisperedlies dot org ¶

22 years ago

In addition to the netBIOS suggestion above, when binding to a Windows2k AD server, you can use the UPN of the intended user. For instance, if your SAM account name is firstname.lastname and your domain is domainname.com, your UPN might be firstname.lastname@domainname.com

This can be used to bind to AD. I've not seen any difference in any of the methods.

down

rusko dot marton at gibzone dot hu ¶

22 years ago

You can authenticate to a Windows 2000 domain's ldap server easily by using the simplified netbios form of the username.

Somebody written:
When authenticating to a Win2k LDAP server, the name of the person must be
the FULL NAME in the dn 

NO. You can use this form:

$user = "DOMAINNAME\\username"
$password = "Password_of_user"; 

if (!$connect = ldap_connect("<server>", <port>)) { 
  //error
  exit;
} 
if (!$res = @ldap_bind($ldap, $user, $password)) { 
  //error
  exit;
} 

It works fine with Active Directory, we use it.

down

webmaster at autourdupc dot com ¶

22 years ago

When authenticating to a Win2k LDAP server, the name of the person must be the FULL NAME in the dn 



NB : nothing is case sensitive !



$dn="cn=DUPOND John, cn=Users, dc=autourdupc, dc=com"

$password = "Password_of_DUPOND"; 



Then when you bind to the LDAP database you use: 



if (!($ldap = ldap_connect("<server>", <port>))) { 

die ("Could not connect to LDAP server"); 

} 

if (!($res = @ldap_bind($ldap, $dn, $password))) { 

die ("Could not bind to $dn"); 

} 



Hope this will usefull for everyone !

＋add a note