PHP 手冊
前一頁 |  | 下一頁

# LVIII. LDAP Functions

# 介紹

LDAP is the Lightweight Directory Access Protocol, and is a protocol used to access "Directory Servers". The Directory is a special kind of database that holds information in a tree structure.

The concept is similar to your hard disk directory structure, except that in this context, the root directory is "The world" and the first level subdirectories are "countries". Lower levels of the directory structure contain entries for companies, organisations or places, while yet lower still we find directory entries for people, and perhaps equipment or documents.

To refer to a file in a subdirectory on your hard disk, you might use something like:

/usr/local/myapp/docs

The forwards slash marks each division in the reference, and the sequence is read from left to right.

The equivalent to the fully qualified file reference in LDAP is the "distinguished name", referred to simply as "dn". An example dn might be:

cn=John Smith,ou=Accounts,o=My Company,c=US

The comma marks each division in the reference, and the sequence is read from right to left. You would read this dn as:

country = US
organization = My Company
organizationalUnit = Accounts
commonName = John Smith

In the same way as there are no hard rules about how you organise the directory structure of a hard disk, a directory server manager can set up any structure that is meaningful for the purpose. However, there are some conventions that are used. The message is that you can not write code to access a directory server unless you know something about its structure, any more than you can use a database without some knowledge of what is available.

Lots of information about LDAP can be found at

- Netscape

- OpenLDAP Project

- LDAP World

The Netscape SDK contains a helpful Programmer's Guide in HTML format.

# 需求

You will need to get and compile LDAP client libraries from either the University of Michigan ldap-3.3 package, Netscape Directory SDK 3.0 or OpenLDAP to compile PHP with LDAP support.

# 安裝

LDAP support in PHP is not enabled by default. You will need to use the --with-ldap[=DIR] configuration option when compiling PHP to enable LDAP support. DIR is the LDAP base install directory. To enable SASL support, be sure --with-ldap-sasl[=DIR] is used, and that `sasl.h` exists on the system.

> Note to Win32 Users: In order to enable this module on a Windows environment, you must copy several files from the DLL folder of the PHP/Win32 binary package to the SYSTEM folder of your windows machine. (Ex: `C:\WINNT\SYSTEM32`, or `C:\WINDOWS\SYSTEM`). For PHP <= 4.2.0 copy `libsasl.dll`, for PHP >= 4.3.0 copy `libeay32.dll` and `ssleay32.dll` to your SYSTEM folder.

# 執行時期組態

`php.ini`中的設定會影響這些函數的行為。

表格 1. LDAP configuration options

Name | Default | Changeable
--- | --- | ---
ldap.max_links | "-1" | PHP_INI_SYSTEM

For further details and definitions of the PHP_INI_* constants, see the 附錄 H.

# 資源類型

這個延伸沒有定義任何資源。

# 預先定義常數

以下的常數由此延伸定義，只在這個延伸被編譯成PHP或實行時期被動態載入時有效。

`LDAP_DEREF_NEVER` (integer)

`LDAP_DEREF_SEARCHING` (integer)

`LDAP_DEREF_FINDING` (integer)

`LDAP_DEREF_ALWAYS` (integer)

`LDAP_OPT_DEREF` (integer)

`LDAP_OPT_SIZELIMIT` (integer)

`LDAP_OPT_TIMELIMIT` (integer)

`LDAP_OPT_PROTOCOL_VERSION` (integer)

`LDAP_OPT_ERROR_NUMBER` (integer)

`LDAP_OPT_REFERRALS` (integer)

`LDAP_OPT_RESTART` (integer)

`LDAP_OPT_HOST_NAME` (integer)

`LDAP_OPT_ERROR_STRING` (integer)

`LDAP_OPT_MATCHED_DN` (integer)

`LDAP_OPT_SERVER_CONTROLS` (integer)

`LDAP_OPT_CLIENT_CONTROLS` (integer)

`LDAP_OPT_DEBUG_LEVEL` (integer)

`GSLC_SSL_NO_AUTH` (integer)

`GSLC_SSL_ONEWAY_AUTH` (integer)

`GSLC_SSL_TWOWAY_AUTH` (integer)

# 範例

Retrieve information for all entries where the surname starts with "S" from a directory server, displaying an extract with name and email address.

範例 1. LDAP search example

`<?php
// basic sequence with LDAP is connect, bind, search, interpret search
// result, close connection
echo "<h3>LDAP query test</h3>";
echo "Connecting ...";
$ds=ldap_connect("localhost"); // must be a valid LDAP server!
echo "connect result is " . $ds . "<br />";
if ($ds) {
echo "Binding ...";
$r=ldap_bind($ds); // this is an "anonymous" bind, typically
// read-only access
echo "Bind result is " . $r . "<br />";
echo "Searching for (sn=S*) ...";
// Search surname entry
$sr=ldap_search($ds, "o=My Company, c=US", "sn=S*");
echo "Search result is " . $sr . "<br />";
echo "Number of entires returned is " . ldap_count_entries($ds, $sr) . "<br />";
echo "Getting entries ...<p>";
$info = ldap_get_entries($ds, $sr);
echo "Data for " . $info["count"] . " items returned:<p>";
for ($i=0; $i<$info["count"]; $i++) {
echo "dn is: " . $info[$i]["dn"] . "<br />";
echo "first cn entry is: " . $info[$i]["cn"][0] . "<br />";
echo "first email entry is: " . $info[$i]["mail"][0] . "<br /><hr />";
}
echo "Closing connection";
ldap_close($ds);
} else {
echo "<h4>Unable to connect to LDAP server</h4>";
}
?>`

# Using the PHP LDAP calls

Before you can use the LDAP calls you will need to know ..

- The name or address of the directory server you will use

- The "base dn" of the server (the part of the world directory that is held on this server, which could be "o=My Company,c=US")

- Whether you need a password to access the server (many servers will provide read access for an "anonymous bind" but require a password for anything else)

The typical sequence of LDAP calls you will make in an application will follow this pattern:

ldap_connect() // establish connection to server
|
ldap_bind() // anonymous or authenticated "login"
|
do something like search or update the directory
and display the results
|
ldap_close() // "logout"

前一頁 | 內容 | 下一頁
java_last_exception_get | 上一層 | ldap_8859_to_t61