note 99347 added to ref.ldap
| From: | idbobbyatramblerdotru at osu1 dot php dot net | Date: | Thu, 12 Aug 2010 09:26:28 +0000 |
| Subject: | note 99347 added to ref.ldap | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-171594@lists.php.net to get a copy of this message | ||
First of all, sorry for my English.
Here are two functions to check group membership and some others which can be useful for work with
LDAP (Active Directory in this example).
index.php
---------
<?php
$user = 'bob';
$password = 'zhlob';
$host = 'myldap';
$domain = 'mydomain.ex';
$basedn = 'dc=mydomain,dc=ex';
$group = 'SomeGroup';
$ad = ldap_connect("ldap://{$host}.{$domain}") or die('Could not connect to LDAP
server.');
ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);
@ldap_bind($ad, "{$user}@{$domain}", $password) or die('Could not bind to AD.');
$userdn = getDN($ad, $user, $basedn);
if (checkGroupEx($ad, $userdn, getDN($ad, $group, $basedn))) {
//if (checkGroup($ad, $userdn, getDN($ad, $group, $basedn))) {
echo "You're authorized as ".getCN($userdn);
} else {
echo 'Authorization failed';
}
ldap_unbind($ad);
/*
* This function searchs in LDAP tree ($ad -LDAP link identifier)
* entry specified by samaccountname and returns its DN or epmty
* string on failure.
*/
function getDN($ad, $samaccountname, $basedn) {
$attributes = array('dn');
$result = ldap_search($ad, $basedn,
"(samaccountname={$samaccountname})", $attributes);
if ($result === FALSE) { return ''; }
$entries = ldap_get_entries($ad, $result);
if ($entries['count']>0) { return $entries[0]['dn']; }
else { return ''; };
}
/*
* This function retrieves and returns CN from given DN
*/
function getCN($dn) {
preg_match('/[^,]*/', $dn, $matchs, PREG_OFFSET_CAPTURE, 3);
return $matchs[0][0];
}
/*
* This function checks group membership of the user, searching only
* in specified group (not recursively).
*/
function checkGroup($ad, $userdn, $groupdn) {
$attributes = array('members');
$result = ldap_read($ad, $userdn, "(memberof={$groupdn})", $attributes);
if ($result === FALSE) { return FALSE; };
$entries = ldap_get_entries($ad, $result);
return ($entries['count'] > 0);
}
/*
* This function checks group membership of the user, searching
* in specified group and groups which is its members (recursively).
*/
function checkGroupEx($ad, $userdn, $groupdn) {
$attributes = array('memberof');
$result = ldap_read($ad, $userdn, '(objectclass=*)', $attributes);
if ($result === FALSE) { return FALSE; };
$entries = ldap_get_entries($ad, $result);
if ($entries['count'] <= 0) { return FALSE; };
if (empty($entries[0]['memberof'])) { return FALSE; } else {
for ($i = 0; $i < $entries[0]['memberof']['count']; $i++) {
if ($entries[0]['memberof'][$i] == $groupdn) { return TRUE; }
elseif (checkGroupEx($ad, $entries[0]['memberof'][$i], $groupdn)) { return
TRUE; };
};
};
return FALSE;
}
?>
----
Server IP: 78.41.111.10
Probable Submitter: 195.239.244.242
----
Manual Page -- http://www.php.net/manual/en/ref.ldap.php
Edit -- https://master.php.net/note/edit/99347
Del: integrated -- https://master.php.net/note/delete/99347/integrated
Del: useless -- https://master.php.net/note/delete/99347/useless
Del: bad code -- https://master.php.net/note/delete/99347/bad+code
Del: spam -- https://master.php.net/note/delete/99347/spam
Del: non-english -- https://master.php.net/note/delete/99347/non-english
Del: in docs -- https://master.php.net/note/delete/99347/in+docs
Del: other reasons-- https://master.php.net/note/delete/99347
Reject -- https://master.php.net/note/reject/99347
Search -- https://master.php.net/manage/user-notes.php