PHP/AD/LDAP：嵌套组成员

Question

I'm working on a PHP/Active Directory auth class, but would like to know how to resolve nested group memberships. It's a mess to make each user member of all needed groups, so I'd like to make use of groups in groups. How should I tackle this with LDAP?

Code: http://pastie.org/private/ypuwba1cwnqklre4yhgr7g

Answer 1

adLDAP is an open source solution for LDAP/AD in php.

you can check it's code if you wish to create an auth class yourself, or just use it in your auth class to handle all interactions with the LDAP/AD

you can get it here

Answer 2

This is an old question, but it is still very hard to finde the proper solution for recursively testing if a user (distinguished name) is member of an AD group (indirect membership), using LDAP.

The solution is TokenGroups , and here is some sample code.

function memberOf($userDN, $groupDN)
{
    
    if (!$this->connection) {
        throw new SSOException('LDAP connectin required');
    }
    
    // Get the group's SID
    $result = @ldap_read($this->connection, $groupDN, "CN=*", ["objectsid"]);
    if (!$result) {
        throw new SSOException('No such group: '.$groupDN);
    }
    $data = ldap_get_entries($this->connection, $result);
    if (($data['count'] > 0) && ($data[0]['objectsid']['count'] > 0)) {
        $groupSID = $data[0]['objectsid'][0];
    } else {
        throw new SSOException('Found no SID for group ['.$groupDN.']');
    }
    
    // TokenGroup will also include indirect memberships
    $result = @ldap_read($this->connection, $userDN, "CN=*", ["tokengroups"]);
    if (!$result) {
        throw new SSOException('No such user ['.$userDN.']');
    }
    $data = ldap_get_entries($this->connection, $result);
    if ($data['count'] > 0) {
        $groups = $data[0]['tokengroups'];
        unset($groups['count']);
        return in_array($groupSID, $groups);
    } else {
        throw new SSOException('No TokenGroups for user ['.$userDN.']');
        return false;
    }
}

Note, that SSOException is a custom class. Hope, this snippet saves someone a few hours of Google, Trial, and Error.