PHP-LDAP EXOP support
| From: | Côme Chilliet | Date: | Mon, 26 Jun 2017 09:34:32 +0000 |
| Subject: | PHP-LDAP EXOP support | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-99641@lists.php.net to get a copy of this message | ||
Hello,
Some time ago, someone said on the tracker that there was an up to date patch for php-ldap exop and
controls: https://bugs.php.net/bug.php?id=69445
It appeared the code was in fact not up to date, at least not for PHP7.
But it was enough to make me try again to work from there to add EXOP support to PHP-LDAP, so I
extracted the part about EXOP from the patch and worked from there to have something working with
current master.
The result is there for now: https://github.com/MCMic/php-src/tree/ldap_exop
At least the methods for passwd and whoami EXOPs are working fine.
Which PHP release should a change like that target?
Do I need to open an RFC for these methods?
For now I just fixed code from the original patch mainly but I would like to rework the API as I’m
not convinced by the current state.
ldap_exop and ldap_parse_exop API seems reasonable, but ldap_exop expects ber encoded data as
request data and I’m not sure how to create that.
I think we should add a PHP method to ber encode, or change ldap_exop to accept an other format and
ber encode internally.
For the helper methods for whoami and passwd, I’m a bit puzzled..
They can work like this now:
ldap_exop_whoami($link, $authzid); // This return TRUE upon success or FALSE otherwise
$r = ldap_exop_whoami($link); // This return a result object you need to parse
ldap_parse_exop_whoami($link, $r, $authzid); // This will parse the result object and fill the third
param with the result
I would go for something a lot simpler like ldap_exop_whoami($link) directly returning the string
result, or FALSE if it fails.
For ldap_exop_passwd, I would go for ldap_exop_passwd($link, $user, $oldpw, $newpw) which would
return FALSE on failure, TRUE on success with a new password, or the generated password if $newpw is
empty.
So I would ditch ldap_parse_exop_whoami and ldap_parse_exop_passwd. People can use ldap_exop and
ldap_parse_exop if they want to work with result objects.
I guess we will also need constants for OID of all known EXOP operations out there.
Côme