使用PHP LDAP获取组成员的AD属性

Question

I'm using PHP to query Active Directory. I need to get a few attributes (Office phone and email) of all the members of a specified group.

I can get the complete CNs of the users in the group, so, for example:

        $results = ldap_search($ds,$ldapbase, "cn=" . $group);
        $entries = ldap_get_entries($ds, $results);
        $members = $entries[0]['member'];

            for ($i=0; $i< count($members) -1; $i++) {

                $mem = $members[$i];

                if($mem != "") {

                    $groupMembers[] = $mem;
                }
            }

will give me an array of members of the group like this:

 CN=Testlastname1\, Testfirstname1,OU=Personnel,OU=All Staff,DC=domain,DC=domainsuffix              
 CN=Testlastname2\, Testfirstname2,OU=All Staff,DC=domain,DC=domainsuffix               
 etc...

My question, how can I take these results and query the attributes I need, namely the officephone and email address for each one? Or am I going at it completely wrong?

I have seen some things close to this and some (somewhat byzantine) examples that I cannot get to work. I have played with various filter syntax to no avail. There must be a way to take the individual results from the successful group query, retrieve the AD object described by the result, and extract the properties required, but I have yet to find it.

Any help is greatly appreciated.

BTW - PHP Version 5.5.7 using FastCGI on Windows 2008R2, IIS7.5

Answer 1

The following should work somehow:

foreach ($groupsmembers as $groupmember) {
    $result = ldap_search($ds,$groupmember, '*', 'officephone,mail');
    $entries = ldap_get_entries($ds, $results);
    $users[$groupmember]['officephone'] = $entries[0]['officephone'][0];
    $users[$groupmember]['mail'] = $entries[0]['mail'][0];
}

Main thing is, that you use the retrieved DN (which is the thingy with CN=Testlastname1\\, Testfirstname1,OU=Personnel,OU=All Staff,DC=domai.... ) as search-base and then retrieve the email and officephone-attributes from it.

On the (Linux)-Commandline that would look like this:

ldapsearch -h ldap-server -b "CN=Testlastname1, Testfirstname1,OU=Personnel,OU=All Staff,DC=domain,DC=domainsuffix" * mail,officephone

Hope that helps