Using PHP With LDAP (part 2) - Of Needles And Haystacks (
Page 2 of 8 )
In the first part of this article, I had written
a simple PHP script to search the LDAP directory for a particular user. But real
life is never that simple...
Let's suppose I want to search for my
friend Joe from high school. Now, there are a million Joes in the world, and I
would like to drill down to my Joe without having to navigate through a large
set of results. The solution? A more complex search, which uses additional
parameters to restrict the result set.
Take a look at the new search
form,
<html>
<head>
<title>Search</title>
</head>
<body>
<form action="search.php" method="POST">
First name
<br>
<input type="text" name="cn" length="30"><br>
Last name
<br>
<input type="text" name="sn" length="30"><br>
Email address
<br>
<input type="text" name="email" length="30"><br>
<input type="submit" name="submit" value="Search">
</form>
</body>
</html>
which looks like this:
Once the form above is submitted, the data entered by
the user is sent to the search script "search.php", which actually performs the
query - take a look:
<html>
<head>
</head>
<body>
<?php
// specify the LDAP server to connect to
$conn = ldap_connect("localhost") or die("Could not connect to server");
// bind to the LDAP server specified above
$r = ldap_bind($conn) or die("Could not bind to server");
// create the search string
$query = "(&(cn=" . $_POST['cn'] . ")(sn=" . $_POST['sn'] . ")(mail=" .
$_POST['email'] . "))";
// start searching
// specify both the start location and the search criteria
// in this case, start at the top and return all entries $result =
ldap_search($conn,"dc=my-domain,dc=com", $query) or die("Error in search
query");
// get entry data as array
$info = ldap_get_entries($conn, $result);
// iterate over array and print data for each entry
echo "<ul>";
for ($i=0; $i<$info["count"]; $i++)
{
echo "<li>".$info[$i]["sn"][0]." - ".$info[$i]["mail"][0]." -
".$info[$i]["dn"]."</li>"; } echo "</ul>";
// print number of entries found
echo "Number of entries found: " . ldap_count_entries($conn, $result) .
"<p>";
// all done? clean up
ldap_close($conn);
?>
</body>
</html>
The structure of the code is identical to that of the
examples in previous pages - with one important difference:
<?php
// create the search string
$query = "(&(cn=" . $_POST['cn'] . ")(sn=" . $_POST['sn'] . ")(mail=" .
$_POST['email'] . "))";
?>
This search string, obviously with the variables replaced
with actual values, is passed to the ldap_search() function; it returns only
those entries from the LDAP directory free which match *all* the parameters
specified. Why? Because of my usage of the special AND operator, signified by
the addition of the ampersand (&) to the beginning of the search string
above.
Here's what the output looks like:
If your LDAP entries contain other attributes, it's
just as easy to create more complex search queries - simply add more input
fields to the search form, and update the search string above to use those
attributes when searching the directory tree.
In case you were wondering,
yes, you can also use logical OR (the | operator) or logical NOT (the !
operator) in your search queries - I'll leave that to you to play
with.
/ 8 
