PHP AD LDAP脚本仅在传递变量时失败

Question

Sample AD LDAP Live Lookup PHP from Helpspot

Okay so I am using the above sample php LDAP script to lookup user info in our ticketing system. I am running into some issues however (these are probably due to my very rudimentary understanding of PHP). I know the script is sort of working because if I hit the URL for the script in my browser it will spit back a list of all users in the domain until it hit the return limit and just stops. I am sure I could get it to spit back more, but that is not really the issue right now. Because I am getting data from my domain I am assuming that my creds and binds are good in the script. We use the credentials, server, etc on all our MFP's for their global address list without issue so I am positive I am good there. The problem arises when you pass anything to it to do a lookup. I receive an error that states:

ldap search failed: Operations error 

When I tweak the script to give me a little more info it points me back to this line:

$search = ldap_search($ad, $dn, $filter, $attrs)
          or die ("ldap search failed: ".ldap_error($ad));

Which I had suspected given the error I was getting is present in this line. So I am assuming one of those defined variables is the culprit causing me problems. This is where i start to get lost. I am not understanding why asking it to narrow the results returned would break this? Any suggestions? Or is there anything more I need to share?

Answer 1

Thank you @heiglandreas that post helped me immensely. Using the script being run in that section I was able to grab some pieces that allowed my script to function properly. I am not sure exactly why my environment didn't care for my first script, I suspect the change in location in the script of certain steps and the changed formatting of the bind helped. My script now looks like:

    <?php
header('Content-type: text/xml');

$hostname="ldap://SERVER IP ADDRESS";
$ds=ldap_connect($hostname, 389);
$user = "domain\username";
$pswd = "PASSWORD";
ldap_set_option ($ds, LDAP_OPT_REFERRALS, 0) or die('Unable to set LDAP opt referrals');
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3) or die('Unable to set LDAP protocol version');

if ($ds)
{
$dn = "DC=DOMAIN,DC=local";

if (!($ldapc=ldap_bind($ds, $user, $pswd))) { 
    echo "<p>Error:" . ldap_error($ds) . "</p>"; 
    echo "<p>Error number:" . ldap_errno($ds) . "</p>"; 
    echo "<p>Error:" . ldap_err2str(ldap_errno($ds)) . "</p>"; 
    die;
} 

$attributes = array('employeeID','givenname','sn','mail','telephoneNumber');

if(!empty($_GET['customer_id'])){   //If an ID is passed in use that to make a direct lookup

    $filter = 'employeeID='.$_GET['customer_id'].'*';   

}elseif(!empty($_GET['email'])){            //If no ID then try email

    $filter = 'mail='.$_GET['email'].'*';

}elseif(!empty($_GET['last_name'])){    //If no ID or email then search on last name

    $filter = 'sn='.$_GET['last_name'].'*';



}elseif(!empty($_GET['first_name'])){   //Try first name if no ID,email,last name

    $filter = 'givenname='.$_GET['first_name'].'*'; 

}else{
    $filter = 'sn='.'*';    //Return everyone
}


$search = ldap_search($ds, $dn, $filter, $attributes)
          or die ("ldap search failed: ".ldap_error($ds));

$entries = ldap_get_entries($ds, $search);

echo '<?xml version="1.0" encoding="utf-8"?>';
}
?>
<livelookup version="1.0" columns="first_name,last_name, email">
        <?php for ($i=0; $i < $entries["count"]; $i++) : ?>
        <customer>
                <customer_id><?php if(isset($entries[$i]['employeeID'][0])){ echo htmlspecialchars($entries[$i]['employeeID'][0]); } ?></customer_id>
                <first_name><?php if(isset($entries[$i]['givenname'][0])){ echo htmlspecialchars($entries[$i]['givenname'][0]); } ?></first_name>
                <last_name><?php if(isset($entries[$i]['sn'][0])){ echo htmlspecialchars($entries[$i]['sn'][0]); } ?></last_name>
                <email><?php if(isset($entries[$i]['mail'][0])){ echo htmlspecialchars($entries[$i]['mail'][0]); } ?></email>
                <phone><?php if(isset($entries[$i]['telephonenumber'][0])){ echo htmlspecialchars($entries[$i]['telephonenumber'][0]); } ?></phone>
                <!-- Add custom elements here. Simply add them to $attrs above and then output the tag like the others here -->
        </customer>
        <?php endfor; ?>
</livelookup>

<?php ldap_unbind($ds); ?>