ldap filter for distinguishedName

Question

I am successfully querying our Active Directory for a user with the following code:

$filter = (&(objectCategory=person)(samaccountname=someusername));
$fields = array("samaccountname","mail","manager","department","displayname","objectGUID");

$user = ldap_search($ldapconnection, $baseDn, $filter, $fields);

The resulting array gives this value for the manager attribute:

CN=McBossy\, Boss,OU=Users,OU=CentralOffice,DC=ds,DC=example,DC=com

This looks like a distinguishedName to me. But when I try to query for the manager's record,

$filter = (&(objectCategory=person)(dn='CN=McBossy\, Boss,OU=Users,OU=CentralOffice,DC=ds,DC=example,DC=com'));

$manager = ldap_search($ldapconnection, $baseDn, $filter, $fields);

the query fails with PHP Warning: ldap_search(): Search: Bad search filter

I've tried a number of possibilities including different quotation, more parentheses, using distinguishedName rather than dn, etc.

What am I doing wrong and what is the right way to get the manager's record?

score 15 · Accepted Answer · edited Mar 16 '21 at 04:11

15

dn is not an attribute. Only attribute types, OIDs, and names can be used in filters.

When you get the manager attribute, to get the attributes for the DN that is the manager, use the value of the manager attribute as the base object in a search request. Set the scope of the search to BASE, the filter to either (&) or (objectClass=*) and request the attributes required. Then transmit the search request to the server and interpret the response.

edited Mar 16 '21 at 04:11

Pang

9,564
146
81
122

answered Jun 25 '13 at 18:14

Terry Gardner

10,957
2
28
38

ok. Then, given that the only link to a user's manager (so far as I know) is the `manager` attribute, how do I use that information to get the manager's user record? – dnagirl Jun 25 '13 at 18:39
Wouldn't that find all the people who had my current user as a manager? I want to get the manager of my current user. Sorry if I'm being thick. – dnagirl Jun 25 '13 at 18:54
Yes, it would. I re-read your question and updated my answer. – Terry Gardner Jun 25 '13 at 19:51
Hi, I'm in the same boat -- I can query a user by email, get their manager in the result, then I want to get their manager's manager, but all I have to work with from the first AD result is "CN=McBossy\, Boss,OU=Users,OU=CentralOffice,DC=ds,DC=example,DC=com". I don't know enough about AD to make use of this answer. I understand when you say that you can't search by DN, but how do I "set the scope of the search to BASE"? I'm using almost the same code as @dnagirl to start. – Brian Ashe Dec 26 '19 at 16:20
@BrianAshe, php's ldap_search is a wrapper for ldapsearch. To understand the options, have a look here: https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.2/html/Administration_Guide/Finding_Directory_Entries-Using_ldapsearch.html You're probably most interested in the `-b` option – dnagirl Dec 27 '19 at 18:20
The full DN in the search filter did not work for me until I escaped special characters (in my case parenthesis) - see https://stackoverflow.com/questions/4827263/active-directory-search-filter-by-manager – Peter Thoeny Jul 24 '20 at 19:29

score 1 · Answer 2 · answered Sep 18 '20 at 18:45

Old question, but I don't think it was answered clearly. You can search AD by DN for a user, computer, or group, but it must be escaped properly, so use the built in function.

$ldap_to_find = ldap_escape($manager_dn, null, LDAP_ESCAPE_FILTER);
$ldap_filter  = "(distinguishedName={$ldap_to_find})";

From my testing, adding class or category makes no speed difference, probably because the DN is a unique location and not a real attribute.

score 1 · Answer 3 · edited Dec 10 '22 at 15:01

If there is an entry in LDAP

dn: uid=John Smith,ou=people,dc=example,dc=org
objectClass: inetOrgPerson
cn: John Smith
sn: smith
uid: jsmith
uid: John Smith
mail: j.smith@example.com
ou: accounting

and if you want to search entries whose dn contain uid=John Smith, the command will look like:

ldapsearch  -b dc=example,dc=org -D "cn=admin,dc=example,dc=org"  -LLL '(uid:dn:=John Smith)'

See https://confluence.atlassian.com/kb/how-to-write-ldap-search-filters-792496933.html for a reference.

ldap filter for distinguishedName

3 Answers3

Linked