从Active Directory组中提取所有用户

Question

I'm trying to read some user accounts from Active Directory. I can connect and authenticate just fine. But whatever search I throw at the thing, I get an »Operations error«. Any ideas what this could be?

I'm running the script on a Windows 2k8 server machine with PHP 5.3.8 CLI. (I'm no AD expert:) dsa.mcs tells me the AD host has DC Type = GC and DC Version W2K8.

// $ds = ldap_connect($host, $port);
// $db = ldab_bind($ds, $user, $password);
// $ds and $db are verified, connected and authenticated!

$dn = "CN=All users in Some City,OU=Some Group,OU=Some City,OU=Company Name,DC=bar,DC=foo,DC=com";
//$filter = 'sAMAccountName=' . $username;
//$filter = "(&(&(&(objectCategory=person)(objectClass=user))))";
$filter = "(objectClass=user)";
$attributes = array('sn', 'givenName', 'memberOf');
$res = ldap_search($ds, $dn, $filter, $attributes);

// results in 
//   ldap_errno(): 1
//   ldap_error(): Operations error

running the follwing in the "terminal" (that dos box thingie) returns the list of users just fine.

dsget group "CN=All users in Some City,OU=Some Group,OU=Some City,OU=Company Name,DC=bar,DC=foo,DC=com" -members

WTF am I missing here?

Answer 1

I can repeat your problem on an SBS 2003 box.

Try adding the following two lines between your calls to ldap_connect() and ldap_bind() :

// Use protocol version 3
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
// Don't follow referrals
ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);

This resolves the problem for me.