PHP LDAP无法搜索用户

问题描述：

我能够成功连接并绑定到LDAP，我可以从一个域级别查询用户，但是不能从下一级级别查询用户。PHP LDAP无法搜索用户

基本DN我可以查询：

$ldap_base_dn = 'DC=a_level,DC=company,DC=org';

基本DN我想查询：

$ldap_base_dn = 'DC=b_level,DC=a_level,DC=company,DC=org';

我使用管理员帐户绑定到LDAP。

<?php 

/** 
* Get a list of users from Active Directory. 
*/ 
$ldap_password = 'PASSWORD'; 
$ldap_username = 'ADMIN'; 
$ldap_connection = ldap_connect('ldap://ldap.company.org/'); 
if (false === $ldap_connection) { 
    // Uh-oh, something is wrong... 
    print "CONNECT ERROR<br />"; 
} 

// We have to set this option for the version of Active Directory we are using. 
ldap_set_option($ldap_connection, LDAP_OPT_PROTOCOL_VERSION, 3) or die('Unable to set LDAP protocol version'); 
ldap_set_option($ldap_connection, LDAP_OPT_REFERRALS, 0); // We need this for doing an LDAP search. 

if (true === ldap_bind($ldap_connection, $ldap_username, $ldap_password)) { 
    print "ldap bind<br />"; 
    $ldap_base_dn = 'DC=b_level,DC=a_level,DC=company,DC=org'; 
    $search_filter = '(&(objectCategory=person)(samaccountname=*))'; 
    $attributes = array(); 
    $attributes[] = 'givenname'; 
    $attributes[] = 'mail'; 
    $attributes[] = 'samaccountname'; 
    $attributes[] = 'sn'; 
    $result = ldap_search($ldap_connection, $ldap_base_dn, $search_filter, $attributes); 
    if (false !== $result) { 
     print "ldap search<br />"; 
     $entries = ldap_get_entries($ldap_connection, $result); 
     for ($x=0; $x<$entries['count']; $x++) { 
      if (!empty($entries[$x]['givenname'][0]) && 
       !empty($entries[$x]['mail'][0]) && 
       !empty($entries[$x]['samaccountname'][0]) && 
       !empty($entries[$x]['sn'][0]) && 
       'Shop' !== $entries[$x]['sn'][0] && 
       'Account' !== $entries[$x]['sn'][0]) { 
       $ad_users[strtoupper(trim($entries[$x]['samaccountname'][0]))] = array('email' => strtolower(trim($entries[$x]['mail'][0])),'first_name' => trim($entries[$x]['givenname'][0]),'last_name' => trim($entries[$x]['sn'][0])); 
      } 
     } 
    } 
    ldap_unbind($ldap_connection); // Clean up after ourselves. 
} 

$message .= "Retrieved ". count($ad_users) ." Active Directory users\n"; 

print $message; 

echo '<pre>'; 
print_r($entries); 
echo '</pre>';

使用程序Apache目录工作室，我能够运行在b_level用户和dn，所以我不明白为什么PHP版本不起作用的搜索库的搜索。

编辑：

作出更改显示错误输出。

<?php 

/** 
* Get a list of users from Active Directory. 
*/ 
$ldap_password = 'PASSWORD'; 
$ldap_username = 'ADMIN'; 
$ldap_connection = ldap_connect('ldap://ldap.company.org/'); 
if (false === $ldap_connection) { 
    // Uh-oh, something is wrong... 
    print "CONNECT ERROR<br />"; 
} 

print "Connect Success...<br />"; 

// We have to set this option for the version of Active Directory we are using. 
ldap_set_option($ldap_connection, LDAP_OPT_PROTOCOL_VERSION, 3) or die('Unable to set LDAP protocol version'); 
ldap_set_option($ldap_connection, LDAP_OPT_REFERRALS, 0); // We need this for doing an LDAP search. 

if (true === ldap_bind($ldap_connection, $ldap_username, $ldap_password)) { 
    print "Bind Success...<br />"; 
    $ldap_base_dn = 'DC=b_level,DC=a_level,DC=company,DC=org'; 
    $search_filter = '(&(objectCategory=person)(samaccountname=*))'; 
    $attributes = array(); 
    $attributes[] = 'givenname'; 
    $attributes[] = 'mail'; 
    $attributes[] = 'samaccountname'; 
    $attributes[] = 'sn'; 
    $result = ldap_search($ldap_connection, $ldap_base_dn, $search_filter, $attributes); 
    print "ldap_search error: ".ldap_error($ldap_connection) . '<br />'; 
    if (false !== $result) { 
     print "LDAP Search...<br />"; 
     $entries = ldap_get_entries($ldap_connection, $result); 
     for ($x=0; $x<$entries['count']; $x++) { 
      if (!empty($entries[$x]['givenname'][0]) && 
       !empty($entries[$x]['mail'][0]) && 
       !empty($entries[$x]['samaccountname'][0]) && 
       !empty($entries[$x]['sn'][0]) && 
       'Shop' !== $entries[$x]['sn'][0] && 
       'Account' !== $entries[$x]['sn'][0]) { 
       $ad_users[strtoupper(trim($entries[$x]['samaccountname'][0]))] = array('email' => strtolower(trim($entries[$x]['mail'][0])),'first_name' => trim($entries[$x]['givenname'][0]),'last_name' => trim($entries[$x]['sn'][0])); 
      } 
     } 
    } 
    ldap_unbind($ldap_connection); // Clean up after ourselves. 
} 

$message .= "Retrieved ". count($ad_users) ." Active Directory users\n"; 

print $message; 

echo '<pre>'; 
print_r($entries); 
echo '</pre>';

输出为：

Connect Success... 
Bind Success... 
ldap_search error: Referral 
LDAP Search... 
Retrieved 0 Active Directory users 
Array 
(
    [count] => 0 
)

什么ldap_error （）输出？（f.e.）由于search * does *工作于一个Base-DN的几率很高，这是一个配置问题，它似乎不适用于不同的Base-DN。但这与您的具体设置密切相关。所以不知道这很难说为什么“它不起作用” – heiglandreas

一个原因f.e.可能是你不允许以下推介，但你所要求的基地DN可能在一个... – heiglandreas

我在ldap_search下添加了以下内容：$ result = ldap_search（$ ldap_connection，$ ldap_base_dn，$ search_filter，$ attributes）; print ldap_error（$ ldap_connection）。 '
';'返回Referral。 – blu

答

在我看来，该base_dn（level_b）不存储在您所请求的目录，但在配置为转诊另一个目录。

您需要：

改线ldap_set_option($ldap_connection, LDAP_OPT_REFERRALS, 0);到ldap_set_option($ldap_connection, LDAP_OPT_REFERRALS, true);
配置重新绑定回调函数来追推荐：看http://php.net/manual/en/function.ldap-set-rebind-proc.php更多信息

PHP LDAP无法搜索用户

相关推荐