使用samaccountname修改AD LDAP对象

Question

I have a php script which works but I need to change it to use an AD account (samaccountname) instead of CN in this sample;

<?php

$base_dn="CN=Peter Parker,OU=Subcontainer,OU=Subcontainer,OU=Container,
DC=domain,DC=com";
$ldapconn = ldap_connect("host.domain.com") or die("Could not connect to LDAP server.");

if ($ldapconn)
{
    $ldapbind = ldap_bind($ldapconn, $ldapusername, $ldappassword);

    if ($ldapbind)
    {
        echo "LDAP bind successful ...";
    }
    else
    {
        echo "LDAP bind failed ...";
    }
}

$newinfo['ipphone']="555";
ldap_modify($ldapconn,$base_dn,$newinfo);
?>

The intention is to modify the ipphone object for users in AD, but I can't use CN because this input is not unique enough for the task. If the CN in the account's base DN is the descriptive name of the user, am I out of luck?

Answer 1

You have to give ldap_modify the distinguished name (DN) of the account you want to change. There is no way around that.

If you start out only knowing the sAMAccountName, then you can search the domain for the account first, then grab the distinguishedName attribute from the results.

To search, use ldap_search using the filter "(sAMAccountName=username)"