ldap_search results limited

[mburtch]

I am running into a problem with my queries returning a limited number of result entries. The LDAP server is Kerio Mail Server, and I am verified that the SIZELIMIT in the server's configuration is 0 (no limit). For some reason, my server seems to be limited to 200 results if no limit is specified in ldap_search(), or 201 (?!) if I specify a limit larger than 200.

// setting the protocol version
ldap_set_option($conn, LDAP_OPT_PROTOCOL_VERSION, 3); // returns TRUE

// getting & settings SIZELIMIT options
ldap_get_option($conn, LDAP_OPT_SIZELIMIT, $optVal); // returns 0
ldap_set_option($conn, LDAP_OPT_SIZELIMIT, 1000); // returns TRUE

// some example queries
$res = ldap_search($conn, "", "cn=*", $attrs, false, 0); // 200 results
$res = ldap_search($conn, "", "cn=*", $attrs, false, 1000); // 201 results
$res = ldap_search($conn, "", "cn=*", $attrs, false, 199); // 199 results

I am using MAMP with PHP 5.2.5. Any ideas?

- MB

[quickshiftin]

On Wed, May 7, 2008 at 12:50 PM, mburtch <mburtch@...> wrote:

>
> I am running into a problem with my queries returning a limited number of
> result entries. The LDAP server is Kerio Mail Server, and I am verified
> that
> the SIZELIMIT in the server's configuration is 0 (no limit). For some
> reason, my server seems to be limited to 200 results if no limit is
> specified in ldap_search(), or 201 (?!) if I specify a limit larger than
> 200.
>
> // setting the protocol version
> ldap_set_option($conn, LDAP_OPT_PROTOCOL_VERSION, 3); // returns TRUE
>
> // getting & settings SIZELIMIT options
> ldap_get_option($conn, LDAP_OPT_SIZELIMIT, $optVal); // returns 0
> ldap_set_option($conn, LDAP_OPT_SIZELIMIT, 1000); // returns TRUE
>
> // some example queries
> $res = ldap_search($conn, "", "cn=*", $attrs, false, 0); // 200 results
> $res = ldap_search($conn, "", "cn=*", $attrs, false, 1000); // 201 results
> $res = ldap_search($conn, "", "cn=*", $attrs, false, 199); // 199 results
>
> I am using MAMP with PHP 5.2.5. Any ideas?

hard to say if its a php issue..  have you tried using phpLdapAdmin ?  i
usually set that up on my ldap installs; kindofa nice failsafe.

-nathan

[Jay Blanchard-3]

[snip]
> I am running into a problem with my queries returning a limited number
of
> result entries.
[/snip]

Most LDAP servers set a limit, it is usually not a PHP problem. One way
to solve is to query by first letter of last name and throw into an
array (iterating through the alphabet).

function ldapUserList($username, $password, $ip="127.0.0.1"){

        $arrLetters = array("A", "B", "C", "D", "E", "F", "G", "H", "I",
"J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W",
"X", "Y", "Z");

        /* connect to AD server */
        if(!$ds=ldap_connect($ip)){
                echo "did not connect...please contact system
administrator or go back to try again";
        }

        /* set LDAP option */
        $un = "domain\\".$username;
        $upw = $password;
        ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
        ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
        ldap_set_option($ds, LDAP_OPT_SIZELIMIT, 0);

        /* bind to AD server */
        if(!$r=ldap_bind($ds, $un, $upw)){
            echo 'You are not authorized and or, your login information
was incorrect<br />';
            echo $un.": ".$upw."<br />\n";
        } else {
                $userArray = array();
                foreach($arrLetters as $letter){

                        /*
                         * search AD for users with surnames (sn), valid
e-mail addresses (mail)
                         * and make sure that they are valid
(msExchHideFromAddessLists)
                         */

                        $sr= @ldap_search($ds, "dc=domain, dc=local",
"(&(&(sn=".$letter."*)(mail=*@...))(!(msExchHideFromAddressLists=
TRUE)))");
                        $info = ldap_get_entries($ds, $sr);
                        if(0 != count($info)){
                                /* place all valid entries into a usable
array */
                                for ($i=0; $i<count($info); $i++) {
                                        /* make sure the item being
pushed into the array is not empty */
                                        if('' !=
$info[$i]["mailnickname"][0]){
                                                //array_push($userArray,
$info[$i]["mailnickname"][0] . "+".$info[$i]["cn"][0] .
"+".$info[$i]["mail"][0]);
                                                $fullname =
$info[$i]["cn"][0];
                                                $arrFN = explode("
",$fullname);
                                                $fullname = $arrFN[1].",
".$arrFN[0];
                                                $readname = $arrFN[0]."
".$arrFN[1];
                                                $tusername =
strtolower($info[$i]["samaccountname"][0]);
                                                $tempArray =
array("username"=>$tusername, "fullname"=>$fullname,
"readname"=>$readname);
                                                array_push($userArray,
$tempArray);
                                        }
                                }
                        }
                }
        }
        /* sort the user array alphabetically and re-align numeric key
*/

        array_multisort($userArray[1], SORT_ASC, SORT_STRING);
        return $userArray;
}



$userArray = ldapUserList($_SESSION['user'], $_SESSION['password'],
"127.0.0.1");

Sorry about the funky line breaks

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

[mburtch]

Thanks for the tips. phpLDAPAdmin was hanging while trying to authenticate,
but I'll give it a try again later.

Nathan: splitting up the search; I hadn't considered this! It is working
nicely for the time being, thanks.

- MB

On Wed, May 7, 2008 at 3:23 PM, Jay Blanchard <jblanchard@...> wrote:

> [snip]
> > I am running into a problem with my queries returning a limited number
> of
> > result entries.
> [/snip]
>
> Most LDAP servers set a limit, it is usually not a PHP problem. One way
> to solve is to query by first letter of last name and throw into an
> array (iterating through the alphabet).
>
> function ldapUserList($username, $password, $ip="127.0.0.1"){
>
>        $arrLetters = array("A", "B", "C", "D", "E", "F", "G", "H", "I",
> "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W",
> "X", "Y", "Z");
>
>        /* connect to AD server */
>        if(!$ds=ldap_connect($ip)){
>                echo "did not connect...please contact system
> administrator or go back to try again";
>        }
>
>        /* set LDAP option */
>        $un = "domain\\".$username;
>        $upw = $password;
>        ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
>        ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
>        ldap_set_option($ds, LDAP_OPT_SIZELIMIT, 0);
>
>        /* bind to AD server */
>        if(!$r=ldap_bind($ds, $un, $upw)){
>            echo 'You are not authorized and or, your login information
> was incorrect<br />';
>            echo $un.": ".$upw."<br />\n";
>        } else {
>                $userArray = array();
>                foreach($arrLetters as $letter){
>
>                        /*
>                         * search AD for users with surnames (sn), valid
> e-mail addresses (mail)
>                         * and make sure that they are valid
> (msExchHideFromAddessLists)
>                         */
>
>                        $sr= @ldap_search($ds, "dc=domain, dc=local",
> "(&(&(sn=".$letter."*)(mail=*@...))(!(msExchHideFromAddressLists=
> TRUE)))");
>                        $info = ldap_get_entries($ds, $sr);
>                        if(0 != count($info)){
>                                /* place all valid entries into a usable
> array */
>                                for ($i=0; $i<count($info); $i++) {
>                                        /* make sure the item being
> pushed into the array is not empty */
>                                        if('' !=
> $info[$i]["mailnickname"][0]){
>                                                //array_push($userArray,
> $info[$i]["mailnickname"][0] . "+".$info[$i]["cn"][0] .
> "+".$info[$i]["mail"][0]);
>                                                $fullname =
> $info[$i]["cn"][0];
>                                                $arrFN = explode("
> ",$fullname);
>                                                $fullname = $arrFN[1].",
> ".$arrFN[0];
>                                                $readname = $arrFN[0]."
> ".$arrFN[1];
>                                                $tusername =
> strtolower($info[$i]["samaccountname"][0]);
>                                                $tempArray =
> array("username"=>$tusername, "fullname"=>$fullname,
> "readname"=>$readname);
>                                                array_push($userArray,
> $tempArray);
>                                        }
>                                }
>                        }
>                }
>        }
>        /* sort the user array alphabetically and re-align numeric key
> */
>
>        array_multisort($userArray[1], SORT_ASC, SORT_STRING);
>        return $userArray;
> }
>
>
>
> $userArray = ldapUserList($_SESSION['user'], $_SESSION['password'],
> "127.0.0.1");
>
> Sorry about the funky line breaks
>

[quickshiftin]

On Wed, May 7, 2008 at 2:26 PM, Matt Burtch <mburtch@...> wrote:

> Thanks for the tips. phpLDAPAdmin was hanging while trying to
> authenticate, but I'll give it a try again later.
>
> Nathan: splitting up the search; I hadn't considered this! It is working
> nicely for the time being, thanks.


umm, that was jay who gave the tip, but ... youre welcome! :)

-nathan