Edit report at https://bugs.php.net/bug.php?id=66724&edit=1
ID: 66724
Comment by: post at rolandgruber dot de
Reported by: post at rolandgruber dot de
Summary: ldap_get_entries does not escape DN values on Active
Directory
Status: Assigned
Type: Bug
Package: LDAP related
Operating System: Debian Linux
PHP Version: 5.4.25
Assigned To: heiglandreas
Block user comment: N
Private report: N
New Comment:
This is still an issue. In addition, using the "cn=foo\, bar,dc=test" that comes back in
Active Directory case does not work for ldap_read(). Active Directory expects the comma to be
escaped as "\2C".
Previous Comments:
------------------------------------------------------------------------
[2017-01-27 17:44:13] post at rolandgruber dot de
True, on PHP 7 it is "ou=foo\2C bar,ou=test,o=test,c=de" for OpenLDAP.
------------------------------------------------------------------------
[2017-01-22 15:22:01] heiglandreas@php.net
The DN should contain EITHER '\,' OR '\2C' but NOT '\5C\2C'. IMO that
means that the value in the CN-Attribute already contains '\,' and not a simple
','. Can you please check that?
Additionally I checked that against a third LDAP-Server:
$ldap = ldap_connect('ldap://pksldap.tttc.de');
ldap_bind($ldap);
$result = ldap_search($ldap, 'c=DE', 'sn=Jahneke');
$res = ldap_get_entries($ldap, $result);
var_Dump($res[0]['dn']);
//string(101) "cn=Jahneke\2C Ralf- ChristophSER:799945522,ou=T-TeleSec SigG Test CA
15:PN,o=Deutsche Telekom AG,c=de"
var_Dump($res[0]['cn'][0]);
string(37) "Jahneke, Ralf- ChristophSER:799945522"
Could you run that agains your OpenLDAP and ActiveDirectory (with appropriately adapted
search-filter)? Thanks!
------------------------------------------------------------------------
[2017-01-22 15:21:58] heiglandreas@php.net
The DN should contain EITHER '\,' OR '\2C' but NOT '\5C\2C'. IMO that
means that the value in the CN-Attribute already contains '\,' and not a simple
','. Can you please check that?
Additionally I checked that against a third LDAP-Server:
$ldap = ldap_connect('ldap://pksldap.tttc.de');
ldap_bind($ldap);
$result = ldap_search($ldap, 'c=DE', 'sn=Jahneke');
$res = ldap_get_entries($ldap, $result);
var_Dump($res[0]['dn']);
//string(101) "cn=Jahneke\2C Ralf- ChristophSER:799945522,ou=T-TeleSec SigG Test CA
15:PN,o=Deutsche Telekom AG,c=de"
var_Dump($res[0]['cn'][0]);
string(37) "Jahneke, Ralf- ChristophSER:799945522"
Could you run that agains your OpenLDAP and ActiveDirectory (with appropriately adapted
search-filter)? Thanks!
------------------------------------------------------------------------
[2017-01-22 08:53:35] post at rolandgruber dot de
I verified with PHP 7.0.12 against Windows 2012 and OpenLDAP 2.4.40
------------------------------------------------------------------------
[2017-01-22 04:22:45] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=66724
--
Edit this bug report at https://bugs.php.net/bug.php?id=66724&edit=1