如何使用LDAP和PHP檢索Active Directory安全組中的用戶信息

Question

正如您在下面看到的，當我對安全組執行LDAP搜索時，沒有收到任何用戶信息。我想使用$_SERVER[remote_user]來檢查用戶是否是該組的成員。我也想檢索這個用戶的信息並用它更新sql數據庫。這可能嗎？

$dn = "CN=Intra,OU=Common Security Groups,DC=mydomain,DC=local"; 
$filter = "(member=*)"; 

$ad = ldap_connect("IP") or die("Couldn't connect to AD!"); 
ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3); 
$bd = ldap_bind($ad, "username@mydomain.local", "password") or die("Can't bind to server."); 
$sr = ldap_search($ad,$dn,$filter); 
$entries = ldap_get_entries($ad, $sr); 

print_r($entries);

返回此：當我用正常的DN

Array 
(
    [count] => 1 
    [0] => Array 
     (
      [objectclass] => Array 
       (
        [count] => 2 
        [0] => top 
        [1] => group 
       ) 

      [0] => objectclass 
      [cn] => Array 
       (
        [count] => 1 
        [0] => Intra 
       ) 

      [1] => cn 
      [description] => Array 
       (
        [count] => 1 
        [0] => Group for (LDAP) INTRANET server access 
       ) 

      [2] => description 
      [member] => Array 
       (
        [count] => 4 
        [0] => CN=Fname1 Lname1,OU=Mail enabled users,OU=Aberdeen,DC=mydomain,DC=local 
        [1] => CN=Fname2 Lname2,OU=Mail enabled users,OU=Forres,DC=mydomain,DC=local 
        [2] => CN=Fname3 Lname3,OU=Houston,DC=mydomain,DC=local 
        [3] => CN=Fname4 Lname4,OU=Mail enabled users,OU=Bergen,DC=mydomain,DC=local 
       ) 

      [3] => member 
      [distinguishedname] => Array 
       (
        [count] => 1 
        [0] => CN=Intra,OU=Common Security Groups,DC=mydomain,DC=local 
       ) 

      [4] => distinguishedname 
      [instancetype] => Array 
       (
        [count] => 1 
        [0] => 4 
       ) 

      [5] => instancetype 
      [whencreated] => Array 
       (
        [count] => 1 
        [0] => 20100711172407.0Z 
       ) 

      [6] => whencreated 
      [whenchanged] => Array 
       (
        [count] => 1 
        [0] => 20100712063949.0Z 
       ) 

      [7] => whenchanged 
      [usncreated] => Array 
       (
        [count] => 1 
        [0] => 17491499 
       ) 

      [8] => usncreated 
      [usnchanged] => Array 
       (
        [count] => 1 
        [0] => 17498823 
       ) 

      [9] => usnchanged 
      [name] => Array 
       (
        [count] => 1 
        [0] => Intra 
       ) 

      [10] => name 
      [objectguid] => Array 
       (
        [count] => 1 
        [0] => 
       ) 

      [11] => objectguid 
      [objectsid] => Array 
       (
        [count] => 1 
        [0] => 
       ) 

      [12] => objectsid 
      [samaccountname] => Array 
       (
        [count] => 1 
        [0] => Intra 
       ) 

      [13] => samaccountname 
      [samaccounttype] => Array 
       (
        [count] => 1 
        [0] => 268435456 
       ) 

      [14] => samaccounttype 
      [grouptype] => Array 
       (
        [count] => 1 
        [0] => -2147483646 
       ) 

      [15] => grouptype 
      [objectcategory] => Array 
       (
        [count] => 1 
        [0] => CN=Group,CN=Schema,CN=Configuration,DC=mydomain,DC=local 
       ) 

      [16] => objectcategory 
      [count] => 17 
      [dn] => CN=Intra,OU=Common Security Groups,DC=mydomain,DC=local 
     ) 

) 

一切正常：

$dn = "OU=Mail enabled users,OU=Bergen,DC=mydomain,DC=local"; 

但AD專家告訴我，這是一個很大的NO -NO，我應該使用安全組代替：\

Answer 1

查詢這樣的AD：

$dn  = "DC=mydomain,DC=local"; 
$group_DN = "CN=Intra,OU=Common Security Groups,DC=mydomain,DC=local"; 
$filter = "(&(objectCategory=user)(memberOf=$group_DN))"; 
// ... 
$sr  = ldap_search($ad, $dn, $filter); 

看一看在MSDN article about the LDAP search filter syntax用於更復雜的過濾器信息。

一定要注意特殊字符部分在該頁面上。正確的解決方案必須通過$group_DN通過轉義機制才能在過濾器字符串中使用它！

請務必儘可能具體地嘗試構建過濾器。讓LDAP服務器整理不需要的記錄會更有效率，而不是通過網絡傳輸更多的記錄而不是您需要的，並將一半的記錄丟棄在客戶端上。

Answer 2

託默勒格

我認爲這個問題是不是在安全組的所有用戶來自同一個OU。

如果我改變

$dn  = "DC=mydomain,DC=local"; 

到

$dn  = "OU=Bergen,DC=mydomain,DC=local"; 

過濾作品。但我還有兩個用戶的OU。