How to lookup the logged in user on website

[jamesfed]

Any ideas on what PHP code to use when looking up the users first and surname?

Here our users login with their initial followed by their surname so displaying the logged in username kinda looses its effect.

 

(Wordpress hosted on PHP using IIS with Windows Auth enabled here)

[localzuk]

Any ideas on what PHP code to use when looking up the users first and surname?

Here our users login with their initial followed by their surname so displaying the logged in username kinda looses its effect.

 

(Wordpress hosted on PHP using IIS with Windows Auth enabled here)

 

Your best bet would be to use some form of ldap code to search for those details. You'd need to connect to the AD via LDAP, do a search using the username, and then retrieve the sn and givenname properties for that record.

[jamesfed]

Your best bet would be to use some form of ldap code to search for those details. You'd need to connect to the AD via LDAP, do a search using the username, and then retrieve the sn and givenname properties for that record.

 

Little out of my area of expertise then Time to do some googling I think.

[localzuk]

Little out of my area of expertise then Time to do some googling I think.

 

After having a play myself, the following works:

 

$initial = $_SERVER["AUTH_USER"]; 
   $_SESSION['un'] = preg_replace("/.*\\\\/", "", $initial); 

$host = 'server';
$basedn = 'dc=domain,dc=local';
$group = 'Group Name';
$bind_user = "cn=Administrator,cn=Users," . $basedn;
       $password = 'password';
$ad = ldap_connect("ldap://" . $server ,389) or die('Could not connect to LDAP server.');
ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);
@ldap_bind($ad, $bind_user, $password) or die('Could not bind to AD.');

$filter = "(sAMAccountName=" . $_SESSION['un'] . ")";
$attr = array("memberof");
$result = ldap_search($ad, $basedn, $filter, $attr) or exit("Unable to search LDAP server");
$entries = ldap_get_entries($ad,$result);
ldap_unbind($ad);
foreach($entries[0]['memberof'] as $grps){
	if(strpos($grps,$group)){ $access = 1; break;}
}
if($access == 1){
	echo ("user is an admin");
}

 

So, that simply connects to the AD server $server, using the user $bind_user, with password $password. Then does a search for that user, and retrieves the attribute 'memberof' (which is the list of groups), and then does a compare between each group in the list and $group.

 

You can expand this to check multiple groups by adding extra if(strpos($grps,$othergroup)){$access = 2;} lines etc (and remove the 'break;'.

 

Note - you should probably turn the above into a function for ease of reuse.

[MK-2]

After having a play myself, the following works:

 

i'm getting the error:

PHP Notice: Undefined offset: 0 in test.php on line 28 PHP Warning: Invalid argument supplied for foreach() in test.php on line 28 PHP Notice: Undefined variable: access in test.php on line 30

[localzuk]

Try inserting '$access = 0;' on the line before the foreach.

[localzuk]

Right, function versions of it

 

    //Returns a bound LDAP connection
   function getldapconnection($host,$user,$password){     
       $ad = ldap_connect("ldap://" . $host,389) or die('Could not connect to LDAP server.');
       ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);
       ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);
       @ldap_bind($ad, $user, $password) or die('Could not bind to AD.');
       return $ad;
   }

   //Checks group membership for a user
   function checkldapgroupmembership($ldap,$basedn,$group,$username){
       $filter = "(sAMAccountName=" . $username . ")";
       $attr = array("memberof");
       $result = ldap_search($ldap, $basedn, $filter, $attr) or exit("Unable to search LDAP server");
       $entries = ldap_get_entries($ldap,$result);
       $access = 0;
       foreach($entries[0]['memberof'] as $grps){
           if(strpos($grps,$group)){ $access = 1; break;}
       }
       return $access;
   }

 

Then you'd just call it like so:

 

$ld = getldapconnection("server","cn=Administrator,cn=Users,dc=domain,dc=local","password");

 

$result = checkldapgroupmembership($ld,"dc=domain,dc=local","Group Name","user.name");

 

With result either being 0 or 1.

Edited March 23, 2011 by vikpaw
typo in function call.

[MK-2]

Try inserting '$access = 0;' on the line before the foreach.

 

still getting errors, this is what i have

$initial = $_SERVER["AUTH_USER"]; 
$_SESSION['un'] = preg_replace("/.*\\\\/", "", $initial); 

$ldaphost = "server"; 
$ldapport = 389;                
$basedn = 'dc=domain,dc=internal';
$group = 'Domain Admins';
$bind_user = "cn=Administrator,cn=Users," . $basedn;
$password = 'xxxxx';

$ad = ldap_connect($ldaphost, $ldapport)
or die("Could not connect to $ldaphost");

// BIND TO LDAP
ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);
@ldap_bind($ad, $bind_user, $password) or die('Could not bind to AD.');

$filter = "(sAMAccountName=" . $_SESSION['un'] . ")";
$attr = array("memberof");
$result = ldap_search($ad, $basedn, $filter, $attr) or exit("Unable to search LDAP server");
$entries = ldap_get_entries($ad,$result);
ldap_unbind($ad);
$access = 0;
foreach($entries[0]['memberof'] as $grps){if(strpos($grps,$group)){ $access = 1; break;}
}
if($access == 1){
	echo ("user is an admin");
}


?>

[localzuk]

Do you have authentication enabled on that host? ie. Is $_SERVER["AUTH_USER"]; returning anything? Try outputting that to the page to see.

[MK-2]

Do you have authentication enabled on that host? ie. Is $_SERVER["AUTH_USER"]; returning anything? Try outputting that to the page to see.

 

permission to call myself a dick......i was testing it on a site which had no authentication. just moved it to a test site with authentication and got my username returned.

 

have tried the original script and i just get a blank page now, nothing echoing back about being an admin

 

**edit** have tried it in firefox and get "user is an admin"....IE wont play though

[localzuk]

permission to call myself a dick......i was testing it on a site which had no authentication. just moved it to a test site with authentication and got my username returned.

 

have tried the original script and i just get a blank page now, nothing echoing back about being an admin

 

Do you have error reporting enabled on that site?

[MK-2]

Do you have error reporting enabled on that site?

 

i edited after you posted. firefox it works fine on, its just IE it wont show

[localzuk]

i edited after you posted. firefox it works fine on, its just IE it wont show

 

It'll be down to permissions regarding authentication in IE. Is the site included in the trusted site group in IE?

[MK-2]

It'll be down to permissions regarding authentication in IE. Is the site included in the trusted site group in IE?

no, its just a test website that i just created in iis, so hasn't been published anywhere.

does that mean for the script to work using IE in school the intranet pages would need to be added to trusted sites via GPO?

 

if it is, thats ok, i can plan for summer when we overhaul all servers and add it then, i just want to know in advance so i dont end up making the same mistakes twice

Edited March 22, 2011 by MK-2

[localzuk]

no, its just a test website that i just created in iis, so hasn't been published anywhere.

does that mean for the script to work using IE in school the intranet pages would need to be added to trusted sites via GPO?

 

if it is, thats ok, i can plan for summer when we overhaul all servers and add it then, i just want to know in advance so i dont end up making the same mistakes twice

 

I think these instructions cover it nicely. Enabling NTLM Authentication in Firefox and Internet Explorer

[MK-2]

Thanks for all the help dude

[vikpaw]

Right, function versions of it

 

 //Returns a bound LDAP connection
function getldapconnection($host,$user,$password){ 
$ad = ldap_connect("ldap://" . $host,389) or die('Could not connect to LDAP server.');
ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);
@ldap_bind($ad, $user, $password) or die('Could not bind to AD.');
return $ad;
}

//Checks group membership for a user
function checkldapgroupmembership($ldap,$basedn,$group,$username){
$filter = "(sAMAccountName=" . $username . ")";
$attr = array("memberof");
$result = ldap_search($ldap, $basedn, $filter, $attr) or exit("Unable to search LDAP server");
$entries = ldap_get_entries($ldap,$result);
$access = 0;
foreach($entries[0]['memberof'] as $grps){
if(strpos($grps,$group)){ $access = 1; break;}
}
return $access;
}

 

Then you'd just call it like so:

 

$ld = getldapconnection("server","cn=Administrator,cn=Users,dc=domain,dc=local","password");

 

$result = checlldapgroupmemberships($ld,"dc=domain,dc=local","Group Name","user.name");

 

With result either being 0 or 1.

 

tony, can i just edit typo in the 2nd function call and then suggest splitting this part of thread over to coding or web or something....?

Edited March 23, 2011 by vikpaw
highlight

[localzuk]

tony, can i just edit typo in the 2nd function call and then suggest splitting this part of thread over to coding or web or something....?

 

Sure. I'd suggest splitting back to where MK-2 asked about how to do group checking.

[vikpaw]

Sure. I'd suggest splitting back to where MK-2 asked about how to do group checking.

 

Moved so hopefully it's all there and makes sense. Let me know if i've missed something or thread title is not apt.