Use PHP and LDAP to list members of an Active Directory group (Improved)

PHP function that gets the members of an Active Directory group, and returns the Users’ attributes as an array.

This is an improved version of the snippet posted on 2/10/2011

The Function

<?php
function get_members($group=FALSE,$inclusive=FALSE) {
    // Active Directory server
    $ldap_host = "ad.domain";
 
    // Active Directory DN
    $ldap_dn = "CN=Users,DC=ad,DC=domain";
 
    // Domain, for purposes of constructing $user
    $ldap_usr_dom = "@".$ldap_host;
 
    // Active Directory user
    $user = "jdoe";
    $password = "password1234!";
 
    // User attributes we want to keep
    // List of User Object properties:
    // http://www.dotnetactivedirectory.com/Understanding_LDAP_Active_Directory_User_Object_Properties.html
    $keep = array(
        "samaccountname",
        "distinguishedname"
    );
 
    // Connect to AD
    $ldap = ldap_connect($ldap_host) or die("Could not connect to LDAP");
    ldap_bind($ldap,$user.$ldap_usr_dom,$password) or die("Could not bind to LDAP");
 
     // Begin building query
     if($group) $query = "(&"; else $query = "";

     $query .= "(&(objectClass=user)(objectCategory=person))";

    // Filter by memberOf, if group is set
    if(is_array($group)) {
        // Looking for a members amongst multiple groups
            if($inclusive) {
                // Inclusive - get users that are in any of the groups
                // Add OR operator
                $query .= "(|";
            } else {
                // Exclusive - only get users that are in all of the groups
                // Add AND operator
                $query .= "(&";
            }

            // Append each group
            foreach($group as $g) $query .= "(memberOf=CN=$g,$ldap_dn)";

            $query .= ")";
    } elseif($group) {
        // Just looking for membership of one group
        $query .= "(memberOf=CN=$group,$ldap_dn)";
    }

    // Close query
    if($group) $query .= ")"; else $query .= "";

    // Uncomment to output queries onto page for debugging
    // print_r($query);

    // Search AD
    $results = ldap_search($ldap,$ldap_dn,$query);
    $entries = ldap_get_entries($ldap, $results);
 
    // Remove first entry (it's always blank)
    array_shift($entries);
 
    $output = array(); // Declare the output array
 
    $i = 0; // Counter
    // Build output array
    foreach($entries as $u) {
        foreach($keep as $x) {
            // Check for attribute
            if(isset($u[$x][0])) $attrval = $u[$x][0]; else $attrval = NULL;

            // Append attribute to output array
            $output[$i][$x] = $attrval;
        }
        $i++;
    }
 
    return $output;
}

// Example Output

print_r(get_members()); // Gets all users in OU 'Users'

print_r(get_members("Test Group")); // Gets all members of 'Test Group'

print_r(get_members(
            array("Test Group","Test Group 2")
        )); // EXCLUSIVE: Gets only members that belong to BOTH 'Test Group' AND 'Test Group 2'

print_r(get_members(
            array("Test Group","Test Group 2"),TRUE
        )); // INCLUSIVE: Gets members that belong to EITHER 'Test Group' OR 'Test Group 2'
?>

<?php

function get_members($group=FALSE,$inclusive=FALSE) {

// Active Directory server

$ldap_host = "ad.domain";

// Active Directory DN

$ldap_dn = "CN=Users,DC=ad,DC=domain";

// Domain, for purposes of constructing $user

$ldap_usr_dom = "@".$ldap_host;

// Active Directory user

$user = "jdoe";

$password = "password1234!";

// User attributes we want to keep

// List of User Object properties:

// http://www.dotnetactivedirectory.com/Understanding_LDAP_Active_Directory_User_Object_Properties.html

$keep = array(

"samaccountname",

"distinguishedname"

);

// Connect to AD

$ldap = ldap_connect($ldap_host) or die("Could not connect to LDAP");

ldap_bind($ldap,$user.$ldap_usr_dom,$password) or die("Could not bind to LDAP");

// Begin building query

if($group) $query = "(&"; else $query = "";

$query .= "(&(objectClass=user)(objectCategory=person))";

// Filter by memberOf, if group is set

if(is_array($group)) {

// Looking for a members amongst multiple groups

if($inclusive) {

// Inclusive - get users that are in any of the groups

// Add OR operator

$query .= "(|";

} else {

// Exclusive - only get users that are in all of the groups

// Add AND operator

$query .= "(&";

}

// Append each group

foreach($group as $g) $query .= "(memberOf=CN=$g,$ldap_dn)";

$query .= ")";

} elseif($group) {

// Just looking for membership of one group

$query .= "(memberOf=CN=$group,$ldap_dn)";

}

// Close query

if($group) $query .= ")"; else $query .= "";

// Uncomment to output queries onto page for debugging

// print_r($query);

// Search AD

$results = ldap_search($ldap,$ldap_dn,$query);

$entries = ldap_get_entries($ldap, $results);

// Remove first entry (it's always blank)

array_shift($entries);

$output = array(); // Declare the output array

$i = 0; // Counter

// Build output array

foreach($entries as $u) {

foreach($keep as $x) {

// Check for attribute

if(isset($u[$x][0])) $attrval = $u[$x][0]; else $attrval = NULL;

// Append attribute to output array

$output[$i][$x] = $attrval;

}

$i++;

}

return $output;

}

// Example Output

print_r(get_members()); // Gets all users in OU 'Users'

print_r(get_members("Test Group")); // Gets all members of 'Test Group'

print_r(get_members(

array("Test Group","Test Group 2")

)); // EXCLUSIVE: Gets only members that belong to BOTH 'Test Group' AND 'Test Group 2'

print_r(get_members(

array("Test Group","Test Group 2"),TRUE

)); // INCLUSIVE: Gets members that belong to EITHER 'Test Group' OR 'Test Group 2'

Example Output

Array
(
    [0] => Array
        (
            [samaccountname] => sam
            [distinguishedname] => CN=sam,CN=Users,DC=ad,DC=domain
        )

    [1] => Array
        (
            [samaccountname] => jdoe
            [distinguishedname] => CN=John Doe,CN=Users,DC=ad,DC=domain
        )

)

Array

(

[0] => Array

(

[samaccountname] => sam

[distinguishedname] => CN=sam,CN=Users,DC=ad,DC=domain

)

[1] => Array

(

[samaccountname] => jdoe

[distinguishedname] => CN=John Doe,CN=Users,DC=ad,DC=domain

)

David,

What you need to do is add primaryGroupID=x to the LDAP query string

To make it work, you could do this–

Replace the foreach under ‘Append each group’ with:

// Append each group
foreach($group as $g) {
    if(is_numeric($g)) $query .= "(primaryGroupID=$g)"; else $query .= "(memberOf=CN=$g,$ldap_dn)";
}

And replace the line under ‘Just looking for membership of one group’ with:

// Just looking for membership of one group
if(is_numeric($group)) $query .= "(primaryGroupID=$group)"; else $query .= "(memberOf=CN=$group,$ldap_dn)";

The code we added will detect if you are using a number instead of a string, and will then check for users that have that number as their primaryGroupID.

The caveat being you have to use the ID of the group and not the CN, but you can mix it with CN’s since our code checks for numerics:

print_r(get_members(513)); // Gets all users that have primaryGroupID = 513
print_r(get_members(array("Test Group",513))); // EXCLUSIVE: Gets only members that belong to 'Test Group' AND that have primaryGroupID = 513
print_r(get_members(array("Test Group",513),TRUE)); // INCLUSIVE: Gets members that belong to 'Test Group' OR that have primaryGroupID = 513

513 is the ‘Domain Users’ group

It’s a bit of a hack, but it should get you in the right direction

The proper way to do it would probably be to have 2 LDAP queries run: one that looks up the group ID for each/single passed group, and the other would search against both the memberOf with the CN and the primaryGroupID with the ID

Reply ↓

14 thoughts on “Use PHP and LDAP to list members of an Active Directory group (Improved)”

Joao on October 20, 2011 at 5:24 am said:

Congrats, works like a charm!

Thanks.

Reply ↓
Lachlan on April 9, 2012 at 9:30 pm said:

this works great, and has saved me a lot of time, thanks!
I don’t suppose there is a way to search for multiple groups at a time?

Reply ↓
- sam on April 10, 2012 at 12:08 am said:
  
  Lachlan,
  
  I have updated the original post with a newer version of the function that allows you to specify multiple groups
  
  That should work for you
  
  Reply ↓
  - Lachlan on April 10, 2012 at 1:18 am said:
    
    Thanks for that Sam… unfortunately, it does not work.
    when using it without specifying any groups, it works fine, but if I specify a group (exactly as provided in the example), I get the following errors:
    array_shift() expects parameter 1 to be array, null given in C:\inetpub\wwwroot\test.php on line 68
    Invalid argument supplied for foreach() in C:\inetpub\wwwroot\test.php on line 74
    the only change I made to your code when testing was I changed username/password/domain details (obviously) and changed the attributes it searches for. I even tried setting them back to as above, but to no avail.
    
    Reply ↓
    - sam on April 10, 2012 at 10:23 am said:
      
      I have not been able to reproduce the error
      
      Can you paste your code?
      http://paste.samjlevy.com/p
      And paste the generated URL here
      
      Remember to blank out your AD information if it is sensitive
      
      Reply ↓
      - Lachlan on April 10, 2012 at 7:51 pm said:
        
        Here is the URL: http://paste.samjlevy.com/v/4f84d55ad5438
        
        thanks!
    - sam on April 12, 2012 at 12:33 pm said:
      
      The error was occurring when a ‘keep’ attribute was not found for a user (for example: a user had no telephone number value)
      
      I have fixed the original post, the tweaked code is:
      
      $i = 0; // Counter // Build output array foreach($entries as $u) { foreach($keep as $x) { // Check for attribute if(isset($u[$x][0])) $attrval = $u[$x][0]; else $attrval = NULL; // Append attribute to output array $output[$i][$x] = $attrval; } $i++; }
      
      Reply ↓
Rasmus Lund on April 18, 2012 at 12:51 pm said:

Hey Sam

Excellent code work. I build an application for a business in Denmark, where they must have 2 different logins. Admin and User login. I do not quite know how to solve this problem other than to make 2 different OU’s. but if I change:
$ ldap_dn = “CN = Users, DC = domain, DC = com”;
to another “CN” than “Users” it comes with errors.
hope you can help :)

Reply ↓
- sam on April 18, 2012 at 1:00 pm said:
  
  Can you paste the errors?
  
  Reply ↓
  - Rasmus Lund on April 18, 2012 at 1:14 pm said:
    
    Warning: ldap_search() [function.ldap-search]: Search: No such object in C:\wamp\www\authenticate.php on line 62
    
    Warning: ldap_get_entries() expects parameter 2 to be resource, boolean given in C:\wamp\www\authenticate.php on line 63
    
    Warning: array_shift() expects parameter 1 to be array, null given in C:\wamp\www\authenticate.php on line 66
    
    Warning: Invalid argument supplied for foreach() in C:\wamp\www\authenticate.php on line 72
    
    If I use “CN=Users” I receive the correct arrays, from the OU=Users in AD.
    
    Reply ↓
    - sam on April 18, 2012 at 6:06 pm said:
      
      Your $ldap_dn must be incorrectly using CN instead of OU
      
      Right click on the object in AD Users & Computers, then go to the Object tab
      
      If it says ‘Object class: Container’, then use CN=XXX
      If it says ‘Object class: Organizational Unit’, then use OU=XXX
      
      The Users object is actually a Container and not an OU, this might be the cause of your confusion
      
      Reply ↓
Rasmus Lund on April 19, 2012 at 2:47 am said:

Thanks a lot. It work by changing the CN to OU.

Reply ↓
David Stetler on May 1, 2012 at 9:35 am said:

The code worked well, however I did find two issues, 1 I resolved and the other I still have not fully.

1. The AD setup I was searching through was setup with groups in 1 OU and the users in a separate OU, both at the same level. I added a 2nd $ldap_dn variable with the OU of the Users and then passed that variable into the $results =(ldap_search($ldap,$ldap_dn2, $query);

2. The other issue I am having is caused by users being setup with the searched group as their primary group. When you set them up this way, AD does not add the user to the member attribute of the group. I am still looking for the best solution to this issue, other than the obvious, just add them all back to the default users as their primary group. Any Ideas?

Thanks for the great function.

Reply ↓
- sam on May 2, 2012 at 12:10 am said:
  David,
  
  What you need to do is add primaryGroupID=x to the LDAP query string
  
  To make it work, you could do this–
  
  Replace the foreach under ‘Append each group’ with:
```
// Append each group
foreach($group as $g) {
    if(is_numeric($g)) $query .= "(primaryGroupID=$g)"; else $query .= "(memberOf=CN=$g,$ldap_dn)";
}
```
  And replace the line under ‘Just looking for membership of one group’ with:
```
// Just looking for membership of one group
if(is_numeric($group)) $query .= "(primaryGroupID=$group)"; else $query .= "(memberOf=CN=$group,$ldap_dn)";
```
  The code we added will detect if you are using a number instead of a string, and will then check for users that have that number as their primaryGroupID.
  
  The caveat being you have to use the ID of the group and not the CN, but you can mix it with CN’s since our code checks for numerics:
```
print_r(get_members(513)); // Gets all users that have primaryGroupID = 513
print_r(get_members(array("Test Group",513))); // EXCLUSIVE: Gets only members that belong to 'Test Group' AND that have primaryGroupID = 513
print_r(get_members(array("Test Group",513),TRUE)); // INCLUSIVE: Gets members that belong to 'Test Group' OR that have primaryGroupID = 513
```
  513 is the ‘Domain Users’ group
  
  It’s a bit of a hack, but it should get you in the right direction
  
  The proper way to do it would probably be to have 2 LDAP queries run: one that looks up the group ID for each/single passed group, and the other would search against both the memberOf with the CN and the primaryGroupID with the ID
  Reply ↓

sam j levy

Use PHP and LDAP to list members of an Active Directory group (Improved)

The Function

Example Output

14 thoughts on “Use PHP and LDAP to list members of an Active Directory group (Improved)”

Leave a Reply Cancel reply