LDAP Functions

Introducere

LDAP is the Lightweight Directory Access Protocol, and is a protocol used to access "Directory Servers". The Directory is a special kind of database that holds information in a tree structure.

The concept is similar to your hard disk directory structure, except that in this context, the root directory is "The world" and the first level subdirectories are "countries". Lower levels of the directory structure contain entries for companies, organisations or places, while yet lower still we find directory entries for people, and perhaps equipment or documents.

To refer to a file in a subdirectory on your hard disk, you might use something like:

     /usr/local/myapp/docs
    

The forwards slash marks each division in the reference, and the sequence is read from left to right.

The equivalent to the fully qualified file reference in LDAP is the "distinguished name", referred to simply as "dn". An example dn might be:

     cn=John Smith,ou=Accounts,o=My Company,c=US
    

The comma marks each division in the reference, and the sequence is read from right to left. You would read this dn as:

     country = US
     organization = My Company
     organizationalUnit = Accounts
     commonName = John Smith
    

In the same way as there are no hard rules about how you organise the directory structure of a hard disk, a directory server manager can set up any structure that is meaningful for the purpose. However, there are some conventions that are used. The message is that you can not write code to access a directory server unless you know something about its structure, any more than you can use a database without some knowledge of what is available.

Lots of information about LDAP can be found at

• » Mozilla

• » OpenLDAP Project

The Netscape SDK contains a helpful » Programmer's Guide in HTML format.

Necesităţi

You will need to get and compile LDAP client libraries from either » OpenLDAP or » Bind9.net in order to compile PHP with LDAP support.

Instalarea

LDAP support in PHP is not enabled by default. You will need to use the --with-ldap[=DIR] configuration option when compiling PHP to enable LDAP support. DIR is the LDAP base install directory. To enable SASL support, be sure --with-ldap-sasl[=DIR] is used, and that sasl.h exists on the system.

Notă: Note to Win32 Users Pentru ca această extensie să funcţioneze, anumite fişiere DLL trebuie să fie accesibile în calea de sistem a Windows din variabila PATH. Accesaţi FAQ întitulat "Cum să adaug directorul meu PHP la variabila PATH din Windows" pentru informaţii despre cum să realizaţi aceasta. Cu toate că copierea fişierelor DLL din directorul PHP în directorul de sistem al Windows de asemenea funcţionează (deoarece directorul de sistem este în mod implicit inclus în variabila PATH), acest lucru nu este recomandabil. Această extensie necesită ca următoarele fişiere să existe în calea PATH: libeay32.dll and ssleay32.dll
Versions before PHP 4.3.0 additionally require libsasl.dll.

In order to use Oracle LDAP libraries, proper Oracle environment has to be set.

Configuraţia la rulare

Comportamentul acestor funcţii este afectat de parametrii stabiliţi în php.ini.

LDAP configuration options

Name	Default	Changeable	Changelog
ldap.max_links	"-1"	PHP_INI_SYSTEM

Pentru mai multe detalii şi definiţii ale constantelor PHP_INI_* accesaţi php.ini directives.

Tipurile resurselor

Most LDAP functions operate on or return resources (e.g. ldap_connect() returns a positive LDAP link identifier required by most LDAP functions).

Constante predefinite

Constantele de mai jos sunt definite de această extensie şi vor fi disponibile doar dacă această extensie a fost compilată în interiorul PHP, sau a fost încărcată dinamic în timpul rulării.

LDAP_DEREF_NEVER (integer)

LDAP_DEREF_SEARCHING (integer)

LDAP_DEREF_FINDING (integer)

LDAP_DEREF_ALWAYS (integer)

LDAP_OPT_DEREF (integer)

LDAP_OPT_SIZELIMIT (integer)

LDAP_OPT_TIMELIMIT (integer)

LDAP_OPT_NETWORK_TIMEOUT (integer)

Option for ldap_set_option() to allow setting network timeout. (Available as of PHP 5.3.0)

LDAP_OPT_PROTOCOL_VERSION (integer)

LDAP_OPT_ERROR_NUMBER (integer)

LDAP_OPT_REFERRALS (integer)

LDAP_OPT_RESTART (integer)

LDAP_OPT_HOST_NAME (integer)

LDAP_OPT_ERROR_STRING (integer)

LDAP_OPT_MATCHED_DN (integer)

LDAP_OPT_SERVER_CONTROLS (integer)

LDAP_OPT_CLIENT_CONTROLS (integer)

LDAP_OPT_DEBUG_LEVEL (integer)

GSLC_SSL_NO_AUTH (integer)

GSLC_SSL_ONEWAY_AUTH (integer)

GSLC_SSL_TWOWAY_AUTH (integer)

Exemple

Retrieve information for all entries where the surname starts with "S" from a directory server, displaying an extract with name and email address.

Using the PHP LDAP calls

Before you can use the LDAP calls you will need to know ..

• The name or address of the directory server you will use

• The "base dn" of the server (the part of the world directory that is held on this server, which could be "o=My Company,c=US")

• Whether you need a password to access the server (many servers will provide read access for an "anonymous bind" but require a password for anything else)

The typical sequence of LDAP calls you will make in an application will follow this pattern:

  ldap_connect()    // establish connection to server
     |
  ldap_bind()       // anonymous or authenticated "login"
     |
  do something like search or update the directory
  and display the results
     |
  ldap_close()      // "logout"