Diese Seite bei php.net
The PHP manual text and comments are covered by the Creative Commons Attribution 3.0 License © the PHP Documentation Group - Impressum - mail("TO:Reinhard Neidl",...)
(PHP 4, PHP 5)
ldap_get_values_len — Liefert alle binären Werte eines Ergebnis-Eintrags
Rückgabewert: im Erfolgsfall ein Array der Werte des Merkmals, FALSE im Fehlerfall.
Die ldap_get_values_len() Funktion wird benutzt um alle Werte des Merkmals eines Eintrags im Ergebnis zu lesen. Der Eintrag wird durch Ergebnis-Eintrag-Kennung bestimmt. Die Anzahl der Werte kann über die Indexierung von "count" des resultierenden Arrays bestimmt werden. Der Zugriff auf einzelne Werte erfolgt durch einen ganzzahligen Index im Array. Der erste Indexwert ist 0.
Diese Funktion wird exakt gleich benutzt wie die Funktion ldap_get_values() mit der Aussnahme, dass hier binäre Daten statt Textdaten behandelt werden.
Hinweis:
Diese Funktion wurde in 4.0 hinzugefügt.
Tried a couple of different ways to do this but this seems to work best:
<?php
$info = ldap_first_entry($ds,$sr);
// get it binary-safe.
$bin_guid = ldap_get_values_len($ds,$info,"objectguid");
// convert to hex, bin2hex failed here for me. Unpack() seems to work though.
$hex_guid = unpack("H*hex", $bin_guid[0]);
?>
no more need to use ldap_get_values_len (). ldap_get_attributes() works well now.
<?php
$attrs = ldap_get_attributes($this->cid, $this->re);
$hex_Sid= bin2hex($attrs['objectSid'][0]); //returns 010500000000000515000000c94d7d363d787b17e77b80109d060000
$hex_GUID= bin2hex($attrs['objectGUID'][0]); //returns 710234bbc2abc148ade8c1f9b4567b24
?>
In order to set directory/file permissions with smbcacls, you'll need to get the objectSid and objectGuid, convert them with the functions described in the other post of this manual and concat them like this :
$user='S-' . $strObjectSid . '-' . $strObjectGuid
One more function to add that complements the bin_to_str_guid function I posted below:
// This function will convert a string GUID value into a HEX value to search AD.
function str_to_hex_guid($str_guid) {
$str_guid = str_replace('-', '', $str_guid);
$octet_str = substr($str_guid, 6, 2);
$octet_str .= substr($str_guid, 4, 2);
$octet_str .= substr($str_guid, 2, 2);
$octet_str .= substr($str_guid, 0, 2);
$octet_str .= substr($str_guid, 10, 2);
$octet_str .= substr($str_guid, 8, 2);
$octet_str .= substr($str_guid, 14, 2);
$octet_str .= substr($str_guid, 12, 2);
$octet_str .= substr($str_guid, 16, strlen($str_guid));
return $octet_str;
}
If you want to convert the string GUID back to the HEX format (required if you want to search AD based on the GUID string, make sure you escape the HEX string with double backslashes when searching -- ie. \\AE\\0F\\88...).
To elaborate on rcrow's post, if you want to convert the objectSID value to a usable string (from Active Directory) the following function will do the trick (this was borrowed from another section of the manual, just thought I'd add it here):
// Returns the textual SID
function bin_to_str_sid($binsid) {
$hex_sid = bin2hex($binsid);
$rev = hexdec(substr($hex_sid, 0, 2));
$subcount = hexdec(substr($hex_sid, 2, 2));
$auth = hexdec(substr($hex_sid, 4, 12));
$result = "$rev-$auth";
for ($x=0;$x < $subcount; $x++) {
$subauth[$x] =
hexdec($this->little_endian(substr($hex_sid, 16 + ($x * 8), 8)));
$result .= "-" . $subauth[$x];
}
// Cheat by tacking on the S-
return 'S-' . $result;
}
// Converts a little-endian hex-number to one, that 'hexdec' can convert
function little_endian($hex) {
for ($x = strlen($hex) - 2; $x >= 0; $x = $x - 2) {
$result .= substr($hex, $x, 2);
}
return $result;
}
This function is not related to the ldap_get_values_len function but is still helpful if you want to convert the objectGUID binary value to a string format (converted from some vbscript provided by Richard Mueller):
// This function will convert a binary value guid into a valid string.
function bin_to_str_guid($object_guid) {
$hex_guid = bin2hex($object_guid);
$hex_guid_to_guid_str = '';
for($k = 1; $k <= 4; ++$k) {
$hex_guid_to_guid_str .= substr($hex_guid, 8 - 2 * $k, 2);
}
$hex_guid_to_guid_str .= '-';
for($k = 1; $k <= 2; ++$k) {
$hex_guid_to_guid_str .= substr($hex_guid, 12 - 2 * $k, 2);
}
$hex_guid_to_guid_str .= '-';
for($k = 1; $k <= 2; ++$k) {
$hex_guid_to_guid_str .= substr($hex_guid, 16 - 2 * $k, 2);
}
$hex_guid_to_guid_str .= '-' . substr($hex_guid, 16, 4);
$hex_guid_to_guid_str .= '-' . substr($hex_guid, 20);
return strtoupper($hex_guid_to_guid_str);
}
Here's an example on how to use both:
$filter="samaccountname=".$username;
$fields=array("objectguid","objectsid");
//establish the connection and specify the base_dn first. there are a lot of examples in the manual for this
$sr=ldap_search($this->_conn,$this->_base_dn,$filter,$fields);
$entries = ldap_get_entries($this->_conn, $sr);
if (in_array("objectguid", $fields)) {
$entries[0]["objectguid"][0]=
$this->bin_to_str_guid($entries[0]["objectguid"][0]);
}
if (in_array("objectsid", $fields)) {
$entry = ldap_first_entry($this->_conn, $sr);
$objectsid_binary = ldap_get_values_len($this->_conn, $entry, "objectsid");
$entries[0]["objectsid"][0] = $this->bin_to_str_sid($objectsid_binary[0]);
}
Hope this helps someone!
If you are trying to access BINARY DATA, such as ObjectSID within LDAP, you must first get an individual entry, as stated under ldap_get_values() function -- "This call needs a result_entry_identifier, so needs to be preceded by one of the ldap search calls and one of the calls to get an individual entry."
The following code snippet will get the LDAP objectSID for a specific user.
<?php
/* Get the binary objectsid entry */
/* Be sure that you have included the binary field in your ldap_search. */
$criteria = "samaccountname=$ldapUser";
$justthese = array("memberOf", "objectsid");
$ldapSearchResult = ldap_search($ldapConnectionResult, $ldapBase, $criteria, $justthese);
if (ldap_count_entries($ldapConnectionResult, $ldapSearchResult)){
$ldapResults = ldap_get_entries($ldapConnectionResult, $ldapSearchResult);
$entry = ldap_first_entry($ldapConnectionResult, $ldapSearchResult);
$ldapBinary = ldap_get_values_len ($ldapConnectionResult, $entry, "objectsid");
/* your code here */
}
?>
You then can use something like bin2hex to put the data in a more usable form.
Diese Seite bei php.net