PHP ldap_search 超出大小限制

发布于 2024-12-23 01:28:45 字数 1022 浏览 1 评论 0原文

我对查询 Microsoft 的 Active Directory 还很陌生,并且遇到了一些困难:

AD 的大小限制为每个请求 1000 个元素。我无法更改大小限制。 PHP 似乎不支持分页(我使用的是 5.2 版本,并且无法更新生产服务器。)

到目前为止,我遇到了两种可能的解决方案:

  1. 按 objectSid 对条目进行排序并使用过滤器来获取所有对象。 示例代码
    我不喜欢这样,有几个原因:
    • 弄乱 objectSid 似乎是不可预测的,因为你必须将它拆开,将其转换为十进制,然后再转换回来......
    • 我不明白如何比较这些 ID。
      (我尝试过:'&((objectClass=user)(objectSid>=0))')

  2. 在对象名称的第一个字母之后进行过滤(按照建议 此处):
    这不是最佳解决方案,因为我们系统中的许多用户/组都以相同的几个字母为前缀。

所以我的问题:

这里最好使用什么方法?
如果是第一个,我如何确保正确处理objectSid?

还有其他可能性吗? 我错过了一些明显的东西吗?

更新:
- 相关问题提供了有关简单分页结果扩展为何这样做的信息不工作。
- Web 服务器在 Linux 服务器上运行,因此 COM 对象/adoDB 不是一个选项。

I'm quite new to querying Microsoft's Active Directory and encountering some difficulties:

The AD has a size limit of 1000 elements per request. I cannot change the size limit. PHP does not seem to support paging (I'm using version 5.2 and there's no way of updating the production server.)

I've so far encountered two possible solutions:

  1. Sort the entries by objectSid and use filters to get all the objects. Sample Code
    I don't like that for several reasons:

    • It seems unpredictable to mess with the objectSid, as you have to take it apart, convert it to decimal, convert it back ...
    • I don't see how you can compare these id's.
      (I've tried: '&((objectClass=user)(objectSid>=0))')

  2. Filter after the first letters of the object names (as suggested here):
    That's not an optimal solution as many of the users/groups in our system are prefixed with the same few letters.

So my question:

What approach is best used here?
If it's the first one, how can I be sure to handle the objectSid correctly?

Any other possibilities?
Am I missing something obvious?

Update:
- This related question provides information about why the Simple Paged Results extension does not work.
- The web server is running on a Linux server, so COM objects/adoDB are not an option.

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(4

不必了 2024-12-30 01:28:45

我能够使用 ldap_control_paged_result 绕过大小限制

ldap_control_paged_result 用于通过发送分页控件来启用 LDAP 分页。下面的函数在我的例子中运行得很好。这适用于(PHP 5 >= 5.4.0,PHP 7)

function retrieves_users($conn)
    {
        $dn        = 'ou=,dc=,dc=';
        $filter    = "(&(objectClass=user)(objectCategory=person)(sn=*))";
        $justthese = array();

        // enable pagination with a page size of 100.
        $pageSize = 100;

        $cookie = '';

        do {
            ldap_control_paged_result($conn, $pageSize, true, $cookie);

            $result  = ldap_search($conn, $dn, $filter, $justthese);
            $entries = ldap_get_entries($conn, $result);

            if(!empty($entries)){
                for ($i = 0; $i < $entries["count"]; $i++) {
                    $data['usersLdap'][] = array(
                            'name' => $entries[$i]["cn"][0],
                            'username' => $entries[$i]["userprincipalname"][0]
                    );
                }
            }
            ldap_control_paged_result_response($conn, $result, $cookie);

        } while($cookie !== null && $cookie != '');

        return $data;
    }

如果您现在已经成功更新服务器,那么上面的函数可以获取所有条目。我正在使用此功能来获取我们 AD 中的所有用户。

I was able to get around the size limitation using ldap_control_paged_result

ldap_control_paged_result is used to Enable LDAP pagination by sending the pagination control. The below function worked perfectly in my case. This would work for (PHP 5 >= 5.4.0, PHP 7)

function retrieves_users($conn)
    {
        $dn        = 'ou=,dc=,dc=';
        $filter    = "(&(objectClass=user)(objectCategory=person)(sn=*))";
        $justthese = array();

        // enable pagination with a page size of 100.
        $pageSize = 100;

        $cookie = '';

        do {
            ldap_control_paged_result($conn, $pageSize, true, $cookie);

            $result  = ldap_search($conn, $dn, $filter, $justthese);
            $entries = ldap_get_entries($conn, $result);

            if(!empty($entries)){
                for ($i = 0; $i < $entries["count"]; $i++) {
                    $data['usersLdap'][] = array(
                            'name' => $entries[$i]["cn"][0],
                            'username' => $entries[$i]["userprincipalname"][0]
                    );
                }
            }
            ldap_control_paged_result_response($conn, $result, $cookie);

        } while($cookie !== null && $cookie != '');

        return $data;
    }

If you have successfully updated your server by now, then the function above can get all the entries. I am using this function to get all users in our AD.

泪痕残 2024-12-30 01:28:45

由于我没有找到任何干净的解决方案,因此我决定采用第一种方法:按 Object-Sids 过滤。

此解决方法有其局限性:

  1. 它仅适用于具有objectsid 的对象,即用户和组。
  2. 它假设所有用户/组都是由相同的权限创建的。
  3. 它假定缺失的相对 SID 数量不超过大小限制。

这个想法是首先读取所有可能的对象并挑选出相对 SID 最低的对象。相对 SID 是 SID 中的最后一个块:

S-1-5-21-3188256696-111411151-3922474875-1158

假设这是仅返回“部分搜索”的搜索中的最低相对 SID结果'。
我们进一步假设大小限制为 1000。

然后程序执行以下操作:
它搜索 SID 介于

S-1-5-21-3188256696-111411151-3922474875-1158
之间的所有对象

S -1-5-21-3188256696-111411151-3922474875-0159

然后全部在

S-1-5-21-3188256696-111411151-3922474875-1158

S-1-5-21-3188256696-111411151-3922474875-2157

依此类推,直到其中一个搜索返回零个对象。

这种方法有几个问题,但足以满足我的目的。
代码:

$filter = '(objectClass=Group)';
$attributes = array('objectsid','cn'); //objectsid needs to be set

$result = array();

$maxPageSize = 1000;
$searchStep = $maxPageSize-1;

$adResult = @$adConn->search($filter,$attributes); //Supress warning for first query (because it exceeds the size limit)

//Read smallest RID from the resultset
$minGroupRID = '';

for($i=0;$i<$adResult['count'];$i++){
    $groupRID = unpack('V',substr($adResult[$i]['objectsid'][0],24));
    if($minGroupRID == '' || $minGroupRID>$groupRID[1]){
        $minGroupRID = $groupRID[1];
    }    
}

$sidPrefix =  substr($adResult[$i-1]['objectsid'][0],0,24);   //Read last objectsid and cut off the prefix

$nextStepGroupRID = $minGroupRID;

do{ //Search for all objects with a lower objectsid than minGroupRID
    $adResult = $adConn->search('(&'.$filter.'(objectsid<='.preg_replace('/../','\\\\$0',bin2hex($sidPrefix.pack('V',$nextStepGroupRID))).')(objectsid>='.preg_replace('/../','\\\\$0',bin2hex($sidPrefix.pack('V',$nextStepGroupRID-$searchStep))).'))', $attributes);

    for($i=0;$i<$adResult['count'];$i++){
        $RID = unpack('V',substr($adResult[$i]['objectsid'][0],24));    //Extract the relative SID from the SID
        $RIDs[] = $RID[1];

        $resultSet = array();
        foreach($attributes as $attribute){
            $resultSet[$attribute] = $adResult[$i][$attribute][0];
        }
        $result[$RID[1]] = $resultSet;
    }

    $nextStepGroupRID = $nextStepGroupRID-$searchStep;

}while($adResult['count']>1);

$nextStepGroupRID = $minGroupRID;

do{ //Search for all object with a higher objectsid than minGroupRID  
    $adResult = $adConn->search('(&'.$filter.'(objectsid>='.preg_replace('/../','\\\\$0',bin2hex($sidPrefix.pack('V',$nextStepGroupRID))).')(objectsid<='.preg_replace('/../','\\\\$0',bin2hex($sidPrefix.pack('V',$nextStepGroupRID+$searchStep))).'))', $attributes);

    for($i=0;$i<$adResult['count'];$i++){
        $RID = unpack('V',substr($adResult[$i]['objectsid'][0],24));    //Extract the relative SID from the SID
        $RIDs[] = $RID[1];

        $resultSet = array();
        foreach($attributes as $attribute){
            $resultSet[$attribute] = $adResult[$i][$attribute][0];
        }
        $result[$RID[1]] = $resultSet;
    }

    $nextStepGroupRID = $nextStepGroupRID+$searchStep;

}while($adResult['count']>1);

var_dump($result);

$adConn->search 方法如下所示:

function search($filter, $attributes = false, $base_dn = null) {
        if(!isset($base_dn)){
            $base_dn = $this->baseDN;
        }

        $entries = false;
        if (is_string($filter) && $this->bind) {
                if (is_array($attributes)) {
                        $search  = ldap_search($this->resource, $base_dn, $filter, $attributes);
                } else {
                        $search  = ldap_search($this->resource, $base_dn, $filter);
                }
                if ($search !== false) {
                        $entries = ldap_get_entries($this->resource, $search);
                }
        }
        return $entries;
}

As I've not found any clean solutions I decided to go with the first approach: Filtering By Object-Sids.

This workaround has it's limitations:

  1. It only works for objects with an objectsid, i.e Users and Groups.
  2. It assumes that all Users/Groups are created by the same authority.
  3. It assumes that there are not more missing relative SIDs than the size limit.

The idea is it to first read all possible objects and pick out the one with the lowest relative SID. The relative SID is the last chunk in the SID:

S-1-5-21-3188256696-111411151-3922474875-1158

Let's assume this is the lowest relative SID in a search that only returned 'Partial Search Results'.
Let's further assume the size limit is 1000.

The program then does the following:
It searches all Objects with the SIDs between

S-1-5-21-3188256696-111411151-3922474875-1158
and
S-1-5-21-3188256696-111411151-3922474875-0159

then all between

S-1-5-21-3188256696-111411151-3922474875-1158
and
S-1-5-21-3188256696-111411151-3922474875-2157

and so on until one of the searches returns zero objects.

There are several problems with this approach, but it's sufficient for my purposes.
The Code:

$filter = '(objectClass=Group)';
$attributes = array('objectsid','cn'); //objectsid needs to be set

$result = array();

$maxPageSize = 1000;
$searchStep = $maxPageSize-1;

$adResult = @$adConn->search($filter,$attributes); //Supress warning for first query (because it exceeds the size limit)

//Read smallest RID from the resultset
$minGroupRID = '';

for($i=0;$i<$adResult['count'];$i++){
    $groupRID = unpack('V',substr($adResult[$i]['objectsid'][0],24));
    if($minGroupRID == '' || $minGroupRID>$groupRID[1]){
        $minGroupRID = $groupRID[1];
    }    
}

$sidPrefix =  substr($adResult[$i-1]['objectsid'][0],0,24);   //Read last objectsid and cut off the prefix

$nextStepGroupRID = $minGroupRID;

do{ //Search for all objects with a lower objectsid than minGroupRID
    $adResult = $adConn->search('(&'.$filter.'(objectsid<='.preg_replace('/../','\\\\$0',bin2hex($sidPrefix.pack('V',$nextStepGroupRID))).')(objectsid>='.preg_replace('/../','\\\\$0',bin2hex($sidPrefix.pack('V',$nextStepGroupRID-$searchStep))).'))', $attributes);

    for($i=0;$i<$adResult['count'];$i++){
        $RID = unpack('V',substr($adResult[$i]['objectsid'][0],24));    //Extract the relative SID from the SID
        $RIDs[] = $RID[1];

        $resultSet = array();
        foreach($attributes as $attribute){
            $resultSet[$attribute] = $adResult[$i][$attribute][0];
        }
        $result[$RID[1]] = $resultSet;
    }

    $nextStepGroupRID = $nextStepGroupRID-$searchStep;

}while($adResult['count']>1);

$nextStepGroupRID = $minGroupRID;

do{ //Search for all object with a higher objectsid than minGroupRID  
    $adResult = $adConn->search('(&'.$filter.'(objectsid>='.preg_replace('/../','\\\\$0',bin2hex($sidPrefix.pack('V',$nextStepGroupRID))).')(objectsid<='.preg_replace('/../','\\\\$0',bin2hex($sidPrefix.pack('V',$nextStepGroupRID+$searchStep))).'))', $attributes);

    for($i=0;$i<$adResult['count'];$i++){
        $RID = unpack('V',substr($adResult[$i]['objectsid'][0],24));    //Extract the relative SID from the SID
        $RIDs[] = $RID[1];

        $resultSet = array();
        foreach($attributes as $attribute){
            $resultSet[$attribute] = $adResult[$i][$attribute][0];
        }
        $result[$RID[1]] = $resultSet;
    }

    $nextStepGroupRID = $nextStepGroupRID+$searchStep;

}while($adResult['count']>1);

var_dump($result);

The $adConn->search method looks like this:

function search($filter, $attributes = false, $base_dn = null) {
        if(!isset($base_dn)){
            $base_dn = $this->baseDN;
        }

        $entries = false;
        if (is_string($filter) && $this->bind) {
                if (is_array($attributes)) {
                        $search  = ldap_search($this->resource, $base_dn, $filter, $attributes);
                } else {
                        $search  = ldap_search($this->resource, $base_dn, $filter);
                }
                if ($search !== false) {
                        $entries = ldap_get_entries($this->resource, $search);
                }
        }
        return $entries;
}
酒解孤独 2024-12-30 01:28:45

永远不要对服务器或服务器配置做出假设,这会导致脆弱的代码和意外的、有时甚至是严重的失败。今天是 AD 并不意味着明天也是 AD,或者微软不会改变服务器中的默认限制。我最近处理过一种情况,客户端代码是用大小限制为 2000 的部落知识编写的,当管理员出于自己的原因更改大小限制时,客户端代码会严重失败。

您确定PHP不支持请求控件(简单分页结果扩展就是请求控件)?我写了一篇关于"LDAP:简单分页结果的文章“,虽然文章样本代码是Java,重要的是概念,而不是语言。另请参阅“LDAP:编程实践”

Never make assumptions about servers or server configuration, this leads to brittle code and unexpected, sometimes spectacular failures. Just because it is AD today does not mean it will be tomorrow, or that Microsoft will not change the default limit in the server. I recently dealt with a situation where client code was written with the tribal knowledge that the size limit was 2000, and when administrators, for reasons of their own, changed the size limit, the client code failed horribly.

Are you sure that PHP does not support request controls (the simple paged result extension is a request control)? I wrote an article about "LDAP: Simple Paged Results", and though the article sample code is Java, the concepts are important, not the language. See also "LDAP: Programming Practices".

空宴 2024-12-30 01:28:45

当最近的 SID 之间的距离大于 999 时,可能会出现前面的脚本错误。
示例:

S-1-5-21-3188256696-111411151-3922474875-1158

S-1-5-21-3188256696-111411151-3922474875-3359

3359-1158 > ; 999

为了避免这种情况,您需要使用刚性结构

示例:

$tt = '1';
do {
    ...
    $nextStepGroupRID = $nextStepGroupRID - $searchStep;
    $tt++;
} while ($tt < '30');

在此示例中,我们被迫检查 999 * 30 * 2 = 59940 值。

The previous script error may occur when the distance between the nearest SIDs 999 more.
Example:

S-1-5-21-3188256696-111411151-3922474875-1158

S-1-5-21-3188256696-111411151-3922474875-3359

3359-1158 > 999

in order to avoid this you need to use rigid structures

Example:

$tt = '1';
do {
    ...
    $nextStepGroupRID = $nextStepGroupRID - $searchStep;
    $tt++;
} while ($tt < '30');

In this example, we are forced to check 999 * 30 * 2 = 59940 values.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文