How to use PHP and LDAP to implement user group management and authorization

With the continuous expansion of enterprise scale and business needs, user group management and authorization have become an essential part. LDAP (Lightweight Directory Access Protocol), as a directory service protocol widely used in enterprise networks, provides an efficient way to implement user group management and authorization. This article will introduce how to use PHP and LDAP to implement user group management and authorization.

1. What is LDAP

LDAP is a lightweight directory access protocol that is widely used as a directory service protocol in enterprise networks. LDAP is based on the client/server model, which provides read and write access to information in a directory through standard protocols.

The data structure of LDAP is organized in a tree structure. The root node of the tree is the top-level DNS domain name (such as com, net, etc.), the next level is the organizational unit (OU), and the next level is the user object. (leaf node).

2. PHP and LDAP

PHP provides support for LDAP, and you can easily use PHP to operate LDAP directory services. PHP provides some basic functions, such as ldap_connect(), ldap_bind(), ldap_search(), ldap_add(), ldap_delete(), etc., which are used to connect to the LDAP server, perform authentication, search and modify LDAP directory information and other operations.

3. User group management and authorization implementation

1. Connect to the LDAP server

Use php code to connect to the LDAP server:

$ldapserver = "ldap: //127.0.0.1"; //LDAP server IP address
$ldapport = 389; //LDAP server port number
$ldapbinddn = "cn=admin,dc=my-domain,dc=com"; / /LDAP administrator account
$ldappass = "123456"; //LDAP administrator password
$ldapconn = ldap_connect($ldapserver, $ldapport);

if($ldapconn){

$ldapbind = ldap_bind($ldapconn, $ldapbinddn, $ldappass);
if(!$ldapbind){
    echo "LDAP连接失败！";
}

}

2. Create a user group

Use php code to create a user group:

$newgroup = array();
$newgroup[' cn'] = "developers"; //Group name
$newgroup['gidNumber'] = "1000"; //Group ID
$newgroup'objectclass' = "top";
$newgroup' objectclass' = "posixGroup"; //The group type is posixGroup
ldap_add($ldapconn, "cn=developers,ou=groups,dc=my-domain,dc=com", $newgroup);

3. Add users to user groups

Use php code to add users to user groups:

$userdn = "uid=john,ou=people,dc=my-domain,dc=com "; //User DN
$groupdn = "cn=developers,ou=groups,dc=my-domain,dc=com"; //Group DN
$modify['member'] = $userdn;
ldap_modify($ldapconn, $groupdn, $modify);

4. Delete users from user groups

Use php code to delete users from user groups:

$ userdn = "uid=john,ou=people,dc=my-domain,dc=com"; //User DN
$groupdn = "cn=developers,ou=groups,dc=my-domain,dc=com "; //Group DN
$modify['member'] = $userdn;
ldap_modify($ldapconn, $groupdn, $modify);

5. Query user group members

Use php code to query user group members:

$groupdn = "cn=developers,ou=groups,dc=my-domain,dc=com"; //Group DN
$filter = "(objectclass=person)";
$result = ldap_search($ldapconn, $groupdn, $filter);
$entries = ldap_get_entries($ldapconn, $result);
for($i = 0 ; $i < $entries['count']; $i ){

echo $entries[$i]['dn'];

}

6. User group authorization

Use php code to authorize the user group ：

$groupdn = "cn=developers,ou=groups,dc=my-domain,dc=com"; //Group DN
$attrs['uniquemember'] = array(); / /Authorized user DN array
$attrs['uniquemember'][] = "uid=john,ou=people,dc=my-domain,dc=com";
$attrs['uniquemember'][] = "uid=smith,ou=people,dc=my-domain,dc=com";
ldap_mod_add($ldapconn, $groupdn, $attrs);

7. Revoke user group authorization

Use PHP code to revoke authorization from user groups:

$groupdn = "cn=developers,ou=groups,dc=my-domain,dc=com"; //Group DN
$attrs['uniquemember'] = array(); //Revoke authorized user DN array
$attrs['uniquemember'][] = "uid=john,ou=people,dc=my-domain,dc=com ";
ldap_mod_del($ldapconn, $groupdn, $attrs);

4. Summary

This article introduces how to use PHP and LDAP to implement user group management and authorization, including connecting to LDAP Server, create user groups, add users to user groups, delete users from user groups, query user group members, user group authorization and revoke user group authorization and other operations. LDAP, as a directory service protocol widely used in enterprise networks, provides an efficient way to implement user group management and authorization.

The above is the detailed content of How to use PHP and LDAP to implement user group management and authorization. For more information, please follow other related articles on the PHP Chinese website!