add subtree in LDAP - ldapauth

I just tested and seems working, for some reason it didn't in the version 4.x.x.; I really appreciate you working in this module.

Thanks
Alex.

Sorry for the last info, I tested with one account that was in the cache, with new account it doesn't work.

The problem that I have is, we have a tree like dc=example, dc=com
- ou=USA
- ou=Canada
- ou=Mexico
- ou=Brazil
- and 30 countries

If I do in the DN in ldapauth like "dc=example,dc=com" it can't find anything, but when I do "ou=USA,dc=example,dc=com" and "ou=Canada,dc=example,dc=com" it works, the problem I have to do for each one of the 30 countries. And that's the reason I have a bug open asking to change the field type from varchar(255) to a long text.

Let me know if you need help to test, because I have a very complex LDAP/Active Directory schema.

Thanks, and sorry for the confusion

Alex.

Hi kreaper

I enable the msg function in ldapauth.conf.php, check the http error log and drupal log, but I couldn't find any error related to LDAP. I checked my AD and seems fine. I will write a small code in PHP to test and let you know what happen.

Do you know if I can add more msg functions around the ldapauth.module to show me the errors? Is there a specific place that you recommend?

Thanks
Dinnouti

Hi Kreaper

it is getting strange by the second, I create a piece of code (bellow) based on the module with the same user,password, etc. information just to test my Linux box and the AD. The custom code works but not the "ldapauth.module".

I have a feeling that is the caps of samaccountname, the reason is when I change in the my code from:

print_r ($entries[$i]["samaccountname"]);

to

print_r ($entries[$i]["sAMAccountName"]);

it stop working. Does it make any sense to you? We are using here AD with Windows 2003, what version are you using?

My code:

   $ad = ldap_connect(<ldap server>);

   ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);
   ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);

   $bd = ldap_bind($ad,<username>,<passwd>) or die("Couldn't bind to AD!");

   //Search the directory
   $result = ldap_search($ad, <dn>, "(sAMAccountName=<username>)");

   //Create result set
   $entries = ldap_get_entries($ad, $result);

   //Sort and print
   echo "Total count: " . $entries["count"] . "<br />";

   for ($i=0; $i < $entries["count"]; $i++)
   {
        print_r ($entries[$i]["samaccountname"]);
        echo "<p />";
        print_r ($entries[$i]);
        echo "<hr>";
   }

   ldap_unbind($ad);

I added a watchdog in to the "ldapauth.module" and is sending the same DN and filter information from the custom code

$filter = "$name_attr=$name";
$result = $ldap->search($base_dn, $filter);
watchdog('ldap',"Filter: $filter <br /> Base: $base_dn",WATCHDOG_NOTICE);

Thoughts?

Thanks
Dinnouti

Kreaper good news!

I found the problem it's a compatibility issue with Windows 2003 ( see: http://bugs.php.net/bug.php?id=30670 ) in LDAPInterface.php you have to add:

ldap_set_option($con, LDAP_OPT_REFERRALS, 0);

Like:

  function initConnection() {
    if (!$con = ldap_connect($this->server, $this->port)) {
      watchdog('user', 'LDAP Connect failure to ' . $this->server . ':' . $this->port);
      return NULL;
    }

    $this->connection = $con;
    ldap_set_option($con, LDAP_OPT_PROTOCOL_VERSION, 3);
    ldap_set_option($con, LDAP_OPT_REFERRALS, 0);

Please can you put this change in the HEAD files?

Thanks a lot for your time.
Dinnouti