无法在php中使用ldap_search为用户找到Windows AD组

Question

I can successfully connect and bind to ldap in windows AD using php. However, I'm not getting the results I expect from ldap_search. I know my test user is in Intranet_Group123 but either ldap_search isn't finding the group, or I don't know how to correctly parse the result array. I know the distinguished name of the group: CN=Intranet_Group123,OU=PD,OU=Intranet,OU=Apps,OU=Groups,DC=mydomain,DC=com

Here's the code I'm using (based on blog here: blog here ).

    $user = 'testuser';
    $password = 'test';
    $ldap_host = "myServer";

// Active Directory DN (I have also tried having CN=Intranet_Group123 at the beginning of the string)
$ldap_dn = "OU=PD,OU=Intranet,OU=Apps,OU=Groups,DC=mydomain,DC=com";


// Domain, for purposes of constructing $user
$ldap_usr_dom = "@mydomain.com";

// connect to active directory
$ldap = ldap_connect($ldap_host);

// verify user and password
if($bind = @ldap_bind($ldap, $user . $ldap_usr_dom, $password)) {
    var_dump($bind);  // bool•true
    // valid
    // check presence in groups
    $filter = "(sAMAccountName=" . $user . ")";
    $attr = array("memberof");
    $result = ldap_search($ldap, $ldap_dn, $filter, $attr) or exit("Unable to search LDAP server");
    var_dump($result);  //resource(8) of type (ldap result)
    $entries = ldap_get_entries($ldap, $result);
    var_dump($entries);  // array(1) {'count' → int 0}

Answer 1

You are searching groups container with a filter (sAMAccountName=username) . This is not going to produce you any meaningful results because there is no user entry in groups container, as your var_dump($entries) shows -- // array(1) {'count' -> int 0} just gives you a hint that no entries were found.

Instead, turn your query to a root search (dc=mydomain,dc=com) and search with more complex filter. You need to find a user that has particular sAMAccountName and memberof attribute pointing to the proper group DN. Note that memberof attribute accepts DN, not a group name.

The query filter then would look like this:

"(&(objectclass=user)(sAMAccountName=".$user.")(memberof=".$ldap_dn."))"

and do search over $root_prefix where $root_prefix = "dc=mydomain,dc=com" with a subtree scope.