如果我需要在LDAP和PHP中搜索两个子文件夹，我可以为$ base_dn添加什么

Question

I only have a very basic understanding of doing LDAP searches. I'm using PHP with Laravel.

I'm trying to do a search for all users within my my OU=USERS directory. I have two subfolders within that: OU=STAFF and OU="STUDENTS. I want to be able to search for a specific DN by username within both of those directories. The problem is that I can only make my search work if I specify either the STAFF or STUDENTS directories. I currently have:

...
$base_dn = 'OU=USERS,DC=mysite,DC=mydomain,DC=edu';
$filter = "(&(objectClass=person)(sAMAccountName=$username))";

$result = ldap_search($connection, $base_dn, $filter);
$entries = ldap_get_entries($connection, $result);


foreach ($entries as $entry) {
    $ldapUsername = $entry["sAMAccountName"][0];
    echo $ldapUsername;
    return;
}

It will work if I specify either

$base_dn = 'OU=STAFF,OU=MMM_USERS,DC=mmc,DC=mmm,DC=edu';

or

$base_dn = 'OU=STUDENTS,OU=MMM_USERS,DC=mmc,DC=mmm,DC=edu';

but not without them.

Overall, I'm just trying to validate a user based off of their username, which is also their cn, and their LDAP password. As far as I've been able to tell, however, I need to first get their DN, to try to bind to the connection with the DN and password, taken from a PHP form input.

Any advice on the specifics or the overall method of going about this would be greatly appreciated.

Answer 1

Depending on your LDAP Server Implementation you could use an extensible matching filter.

However, I suspect you are using Microsoft Active Directory and it does NOT support extensible matching as you wish to perform.

-jim