Question

When using ldap_search to get users from Ad server, I get for each entry several objectClasses.

I’m interested only in the most specific objectClass in the classes hierarchy.
How do I get it?

for example: for the entry

name: user1
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user

I want to get only the “user” objectClass.

I noticed that in the programmatic ldap_search, the most specific class is returned in the last cell of the values array, that is returned from ldap_get_values(ld, entry, "objectClass") function call. Is that by chance or is that a defined behavior?
(in other words, can I rely on this to always be true?)

Thanks for any help!

Answer 1

For sure you can’t count on heritance order. The solution for you is to specify the objectClass attribute in your ldap search filter, and to cross with objectCategory to eliminate computers for example.

(&(objectClass=user)(objectCategory=person))

you’ll receive here all the objects of class user and inetOrgPerson (they are also user).

(&(objectClass=inetOrgPerson)(objectCategory=person))

you’ll receive here all the objects of class inetOrgPerson (but not those which are uniquely user).