Warm tip: This article is reproduced from serverfault.com, please click

Getting user readable name via LDAP with PHP by having only the login credentials

发布于 2016-12-29 10:10:54

I am integrating my login form with Microsoft active directory. I authenticate users via LDAP php library.

When user try to log in, they enter username & password. Connecting to server go successfully, authentication via "LDAP_bind" also give me true or false according to the values correctness. Now i am not able to retrieve the user Real name to display it on the screen.

ALL Information I have are the ldap uri with the port number, and username & password entered via the webform.

here is my current code,

$ldap = ldap_connect("ldap://abc.xyz:123");
if ($bind = ldap_bind($ldap, $_REQUEST['username'].'@abc.xyz',$_REQUEST['password'])) 
{ echo "Welcome". $_REQUEST['username'];}

the $_REQUEST['username'] is not human readable, so i need to read this user attributes or at least display name only.

ldap_search and ldap_read functions did not help, I tried this code:

$ldap_base_dn = 'DC=abc,DC=xyz';
$search_filter = "(objectclass=*)";
$result = ldap_search($ldap_connection, $ldap_base_dn, $search_filter);

with no luck, is there any other information i must have in order to make the ldap_search or ldap_read work successfully. in other words can this be done by having the username and password and the ldap uri only?

Questioner
user-stacker
Viewed
11
ChadSikorra 2016-12-29 23:27:56

You should be able to do the search like this:

$upn = $_REQUEST['username'].'@abc.xyz';
$attributes = ['displayname'];
$filter = "(&(objectClass=user)(objectCategory=person)(userPrincipalName=".ldap_escape($upn, null, LDAP_ESCAPE_FILTER)."))";
$baseDn = "DC=abc,DC=xyz";
$results = ldap_search($ldap, $baseDn, $filter, $attributes);
$info = ldap_get_entries($ldap, $results);

// This is what you're looking for...
var_dump($info[0]['displayname'][0]);

Also, make sure to do the bind with these options:

$ldap = ldap_connect("ldap://abc.xyz:123");
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
if ($bind = ldap_bind($ldap, $_REQUEST['username'].'@abc.xyz',$_REQUEST['password']))