Question

I’m trying to accomplish something very similar to what this user was doing Here.

I followed the answer, but I could not get it working. Inside the Active directory, my memberOf field looks like this:

CN=$VPN Users,CN=Users,DC=iai,DC=pri,CN=$ITAR,CN=Users,DC=iai,DC=pri,CN=allsubscribers,CN=Users,DC=iai,DC=pri

My Filter that works is:

(&(objectCategory=person)(sAMAccountName=$p_username))

I’m trying to get the following to work:

(&(objectCategory=person)(sAMAccountName=$p_username)(memberOf=CN=$ITAR))

I have tried adding the full DN which is
CN=Users,DC=iai,DC=pri
to my filter as well, but I get:

array(1) { ["count"]=> int(0) } 

as my response.

I’m using ldap 3

This is the partial Working authentication code written in php:

  $login = ldap_bind( $url, "username@somedomain", $password ); 

  $attributes = array("displayname", "mailnickname");
  $filter = "(&(objectCategory=person)(sAMAccountName=$username))";

  $result = ldap_search($url, "CN=Users,DC=iai,DC=pri", $filter, $attributes);

  $entries = ldap_get_entries($url, $result);

What am I doing wrong?

Code Result

From @DaveRandom

First Var dump:

string(49) "(&(objectCategory=person)(sAMAccountName=rmoser))"
array(2) {
  ["count"] => int(1)
  [0] => array(8) {
    ["displayname"] => array(2) {
      ["count"] => int(1)
      [0] => string(10) "Ryan Moser"
    }
    [0] => string(11) "displayname"
    ["memberof"] => array(4) {
      ["count"] => int(3)
      [0] => string(36) "CN=$VPN Users,CN=Users,DC=iai,DC=pri"
      [1] => string(31) "CN=$ITAR,CN=Users,DC=iai,DC=pri"
      [2] => string(40) "CN=allsubscribers,CN=Users,DC=iai,DC=pri"
    }
    [1]=> string(8) "memberof"
    ["mailnickname"] => array(2) {
      ["count"] => int(1)
      [0] => string(6) "rmoser"
    }
    [2] => string(12) "mailnickname"
    ["count"] => int(3)
    ["dn"] => string(36) "CN=Ryan Moser,CN=Users,DC=iai,DC=pri"
  }
}
bool(false)

Second var_dump:

string(70) "(&(objectCategory=person)(sAMAccountName=rmoser)(memberof=*CN=$ITAR*))" 
array(1) {
  ["count"] => int(0)
} 

Answer 1

LDAP filters look for an exact match.

In order to match CN=$ITAR anywhere in a value, you will need to surround it with the filter wildcard character *.

Try this filter:

(&(objectCategory=person)(sAMAccountName=$p_username)(memberOf=*CN=$ITAR*))

Also don’t forget that $ITAR is a valid variable name in PHP, so if you place that filter string in double quotes (which you would need to in order for $p_username to be interpolated) PHP will attempt to interpolate $ITAR as a variable as well, find that it (probably) doesn’t exist and the end result will be that it gets stripped from the string.

$filter = "(&(objectCategory=person)(sAMAccountName=$p_username)(memberOf=*CN=\$ITAR*))";

A useful link for any question concerning a dynamic filter built with PHP is this.