使用LDAP和PHP检查Active Directory中的组成员身份

Question

I am pretty new to LDAP and Active Directory, and I think this should be a simple question. I am connecting to AD using the following code:

$ad = ldap_connect("domain.com") or die("Could not connect to AD");
//bind to the server
$uname = $uid . "@domain.com";
if (!ldap_bind($ad, "$uname", "$pwd") and $uid != "guest") {
    code...
}

and I need to check to see if the user is a member of one of three groups: ECSDocket_Admin, ECSDocket_User, or ECSDocket_Viewer. I have been searching around and most of the answers I have found use CN= and DN= and DC= in their queries, but I don't know what those mean. If someone could explain how it works, and what I need to do to figure out the group membership, that would be awesome!

Answer 1

If anyone cares, I was able to do a search like this:

$dn = "CN=$uid,CN=Users,DC=domain,DC=com";
$filter = "(memberOf=CN=ECSDocket_Admin,OU=Groups,DC=domain,DC=com)";
$justthese = array("memberOf");

$sr = ldap_search($ad, $dn, $filter, $justthese);
$info = ldap_get_entries($ad, $sr);
echo $info["count"]." entries returned.
";

And by checking the count, I was able to determine if the inputted username was a part of the group -- if there was one, then it was a part of the group since I had already used ldap_connect under that username to check if it was valid within AD. For the filter, since memberOf is an array you need to specify the entire path. For example if you just needed to query the sn (surname) you could just have something like:

$filter = "(sn=smith)";

A site that helped me know exactly the right attributes was this one: http://www.selfadsi.org/user-attributes-w2k8.htm