Fetch all users from Active Directory group

Question

I'm trying to read some user accounts from Active Directory. I can connect and authenticate just fine. But whatever search I throw at the thing, I get an »Operations error«. Any ideas what this could be?

I'm running the script on a Windows 2k8 server machine with PHP 5.3.8 CLI. (I'm no AD expert:) dsa.mcs tells me the AD host has DC Type = GC and DC Version W2K8.

// $ds = ldap_connect($host, $port);
// $db = ldab_bind($ds, $user, $password);
// $ds and $db are verified, connected and authenticated!

$dn = "CN=All users in Some City,OU=Some Group,OU=Some City,OU=Company Name,DC=bar,DC=foo,DC=com";
//$filter = 'sAMAccountName=' . $username;
//$filter = "(&(&(&(objectCategory=person)(objectClass=user))))";
$filter = "(objectClass=user)";
$attributes = array('sn', 'givenName', 'memberOf');
$res = ldap_search($ds, $dn, $filter, $attributes);

// results in 
//   ldap_errno(): 1
//   ldap_error(): Operations error

running the follwing in the "terminal" (that dos box thingie) returns the list of users just fine.

dsget group "CN=All users in Some City,OU=Some Group,OU=Some City,OU=Company Name,DC=bar,DC=foo,DC=com" -members

WTF am I missing here?

DaveRandom · Accepted Answer · 2011-12-08 14:15:42Z

1

I can repeat your problem on an SBS 2003 box.

Try adding the following two lines between your calls to ldap_connect() and ldap_bind():

// Use protocol version 3
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
// Don't follow referrals
ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);

This resolves the problem for me.

answered Dec 8, 2011 at 14:15

DaveRandom

88.8k11 gold badges159 silver badges174 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Fetch all users from Active Directory group

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest