PHP Manual
PrevNext

XXVI. LDAP functions

Introduction to LDAP

LDAP is the Lightweight Directory Access Protocol, and is a protocol used to access "Directory Servers". The Directory is a special kind of database that holds information in a tree structure.

The concept is similar to your hard disk directory structure, except that in this context, the root directory is "The world" and the first level subdirectories are "countries". Lower levels of the directory structure contain entries for companies, organisations or places, while yet lower still we find directory entries for people, and perhaps equipment or documents.

To refer to a file in a subdirectory on your hard disk, you might use something like


    /usr/local/myapp/docs

The forwards slash marks each division in the reference, and the sequence is read from left to right.

The equivalent to the fully qualified file reference in LDAP is the "distinguished name", referred to simply as "dn". An example dn might be.


    cn=John Smith,ou=Accounts,o=My Company,c=US

The comma marks each division in the reference, and the sequence is read from right to left. You would read this dn as ..


    country = US
    organization = My Company
    organizationalUnit = Accounts
    commonName = John Smith

In the same way as there are no hard rules about how you organise the directory structure of a hard disk, a directory server manager can set up any structure that is meaningful for the purpose. However, there are some conventions that are used. The message is that you can not write code to access a directory server unless you know something about its structure, any more than you can use a database without some knowledge of what is available.

Complete code example

Retrieve information for all entries where the surname starts with "S" from a directory server, displaying an extract with name and email address.

Example 1. LDAP search example

  1 
  2 <?php
  3 // basic sequence with LDAP is connect, bind, search, interpret search
  4 // result, close connection
  5 
  6 echo "<h3>LDAP query test</h3>";
  7 echo "Connecting ...";
  8 $ds=ldap_connect("localhost");  // must be a valid LDAP server!
  9 echo "connect result is ".$ds."<p>";
 10 
 11 if ($ds) { 
 12     echo "Binding ..."; 
 13     $r=ldap_bind($ds);     // this is an "anonymous" bind, typically
 14                            // read-only access echo "Bind result is
 15     echo "Bind result is ".$r."<p>";
 16 
 17     echo "Searching for (sn=S*) ...";
 18     // Search surname entry
 19     $sr=ldap_search($ds,"o=My Company, c=US", "sn=S*");  
 20     echo "Search result is ".$sr."<p>";
 21 
 22     echo "Number of entires returned is ".ldap_count_entries($ds,$sr)."<p>";
 23 
 24     echo "Getting entries ...<p>";
 25     $info = ldap_get_entries($ds, $sr);
 26     echo "Data for ".$info["count"]." items returned:<p>";
 27 
 28     for ($i=0; $i<$info["count"]; $i++) {
 29         echo "dn is: ". $info[$i]["dn"] ."<br>";
 30         echo "first cn entry is: ". $info[$i]["cn"][0] ."<br>";
 31         echo "first email entry is: ". $info[$i]["mail"][0] ."<p>";
 32     }
 33 
 34     echo "Closing connection";
 35     ldap_close($ds);
 36 
 37 } else {
 38     echo "<h4>Unable to connect to LDAP server</h4>";
 39 }
 40 ?>
 41 

Using the PHP LDAP calls

You will need to get and compile LDAP client libraries from either the University of Michigan ldap-3.3 package or the Netscape Directory SDK. You will also need to recompile PHP with LDAP support enabled before PHP's LDAP calls will work.

Before you can use the LDAP calls you will need to know ..

  • The name or address of the directory server you will use

  • The "base dn" of the server (the part of the world directory that is held on this server, which could be "o=My Company,c=US")

  • Whether you need a password to access the server (many servers will provide read access for an "anonymous bind" but require a password for anything else)

The typical sequence of LDAP calls you will make in an application will follow this pattern:


  ldap_connect()    // establish connection to server
     |
  ldap_bind()       // anonymous or authenticated "login"
     |
  do something like search or update the directory
  and display the results
     |
  ldap_close()      // "logout"

More Information

Lots of information about LDAP can be found at

The Netscape SDK contains a helpful Programmer's Guide in .html format.

Table of Contents
ldap_add — Add entries to LDAP directory
ldap_mod_add — Add attribute values to current attributes
ldap_mod_del — Delete attribute values from current attributes
ldap_mod_replace — Replace attribute values with new ones
ldap_bind — Bind to LDAP directory
ldap_close — Close link to LDAP server
ldap_connect — Connect to an LDAP server
ldap_count_entries — Count the number of entries in a search
ldap_delete — Delete an entry from a directory
ldap_dn2ufn — Convert DN to User Friendly Naming format
ldap_explode_dn — Splits DN into its component parts
ldap_first_attribute — Return first attribute
ldap_first_entry — Return first result id
ldap_free_result — Free result memory
ldap_get_attributes — Get attributes from a search result entry
ldap_get_dn — Get the DN of a result entry
ldap_get_entries — Get all result entries
ldap_get_values — Get all values from a result entry
ldap_get_values_len — Get all binary values from a result entry
ldap_list — Single-level search
ldap_modify — Modify an LDAP entry
ldap_next_attribute — Get the next attribute in result
ldap_next_entry — Get next result entry
ldap_read — Read an entry
ldap_search — Search LDAP tree
ldap_unbind — Unbind from LDAP directory
ldap_err2str — Convert LDAP error number into string error message
ldap_errno — Return the LDAP error number of the last LDAP command
ldap_error — Return the LDAP error message of the last LDAP command
PrevHomeNext
ibase_num_fieldsUpldap_add