ID: 25827 Comment by: whampton at new-albany dot k12 dot oh dot us Reported By: pennington at rhodes dot edu Status: Bogus Bug Type: LDAP related Operating System: Windows 2000 PHP Version: 4.3.3 New Comment:
hey pennington, thanks for the quick response! anyway, i have been searching around some more information, but due to my relative inexperience in this area (admittedly) some of this stuff is way over my head. it seems that at least this first article from our buddies at microsoft indicated this is a known issue/feature... http://support.microsoft.com/default.aspx?scid=kb;en-us;275523 this second article kinda addresses it too, but it is pretty confusing to me. it mentions the possibility of doing something with the primarygroupid instead. http://support.microsoft.com/default.aspx?scid=kb;en-us;321360 anyway it seems that this problem exists in microsoft's active directory, although i have no idea if it is exclusive to AD or not, but AD is the current "solution" we are using for LDAP here. the solutions and workarounds seem to be far beyond my skill level and patience, and since i am just trying to learn, and not necessarily NEEDING this solution, i really probably should move on i guess, but i leave this area darn frusterated. maybe this is a combo AD/PHP bug, or maybe PHP is just handing the AD bug...errrr feature, as best it can. i know i'm not much help here, but sometimes that affirmation in knowing you are not the only one on earth having the problem helps bring some closure... good luck! let me know if you need me to help test anything. wes Previous Comments: ------------------------------------------------------------------------ [2004-04-29 16:26:41] pennington at rhodes dot edu Wes, thanks for confirming this bug for me. Yes, it is frustrating. PHP (especially the [EMAIL PROTECTED] person) basically refuse to belive this is a bug, and they say that even if it is, they use the OpenLDAP libraries so they can do nothing about it. I pursued this with the OpenLDAP folks (after verifying that this bug also happens on a variety of platforms running OpenLDAP, including Windows and Linux), and they just ignored me. I'm not sure who else to notify about it or how to get it fixed. We sorta worked around the bug here in the application we were building by looking for a particular attribute in a user's Active Directory record via LDAP, such as Department or Position. We test for a particular value there instead of querying by AD group, which is much better way of doing it. Your note about primary groups being the ones left out of the list is interesting. I'll have to check that out. Thanks. ------------------------------------------------------------------------ [2004-04-29 15:50:08] whampton at new-albany dot k12 dot oh dot us hey pennington! i am having this exact same problem as well, although i have only started playing with php/ldap support for active directory yesterday. i realize that you have had this open for a very long time and wondered if you have found any other useful information. i am using win2k server and php 4.3.5rc1. i did, however, want to confirm that i am having this problem as well, in reponse to your frusteration "I find it strange that no one has seen this before, because Microsoft's Active Directory is probably the most widely-used commercial LDAP server in the world." apparently not many "microsoft shops" are thinking outside of the box or looking to develop opensource solutions, well...at least not based on active directory. anyway, the problem is plain to see. here's the breakdown for everyone: you count the number of memberships that a user is part of in the "Member Of" tab in the admin program for active directory on your domain controller, and it is one more that php returns with its builtin supprt. one is missing, and it depends per user. it's simple as that. here is one interesting thing though, and that is for every test that i have run, the "memberof value" that is not returned by php is ALWAYS the primary group that the user is set to in active directoy. its the little button you hit at the bottom of the "Member Of" tab. whatever is set there will not be returned in the memberof values of php's ldap support. any thoughts anyone has would be greatly appreciated, or please provide a link to the solution if i have thick-headedly missed it in my extensive searches... thanks, wes ------------------------------------------------------------------------ [2004-04-20 17:50:50] pennington at rhodes dot edu [EMAIL PROTECTED]: I appreciate you posting your note about the unique way in which the "Domain Users" group is handled (I didn't know that at all - very interesting), I think my problem reported with this bug is actually a different issue. Even if I assumed that the number of groups returned by LDAP query is 1 less than the actual total (such as if the Domain Users group wasn't counted), I still can't get a listing of all AD groups. One of the groups, which seems to be selected at random (i.e. it is not always Domain Users) is simply left out. If I change the array loop to purposefully give me more members of the LDAP group array than the person actually has groups, I still don't get all of that person's groups. In other words, the problem isn't limited to the Domain User's group - LDAP through PHP simply does not let me see every one of the person's groups. For some reason (and it is related to the OpenLDAP libraries PHP uses), one of the groups, randomly selected, is always dropped. ------------------------------------------------------------------------ [2004-04-20 07:55:33] info at dbnet dot com dot au Hi, I'm seeing your post 6 months too late, but let me alert you to something that I found after similar grief with AD. It turns out that ONE of the AD group memberships, (in our case 'Domain Users', in your case perhaps one of the others), is handled "differently" in AD. It will be the one listed as the "default" group when you look up a user in any AD admin tool, and incredibly it just doesn't get fed back to you by AD when you ask for the memberOf attribute using any standard LDAP technique. I vaguely remember an MSDN KB article describing an astonishingly complex workaround for victims of this behaviour using ADSI.. sorry I have no link to it now. Our solution was to accept that the so-called "default" group for each user is just not treated properly by AD in its LDAP interface. It's a special case. ------------------------------------------------------------------------ [2003-10-14 19:56:48] [EMAIL PROTECTED] We only wrap around the OpenLDAP libraries. So it's definately not PHP bug -> bogus. You should report this to the openldap folks, they propably already know about it or are very willing to fix it if it's not already fixed. Please let us know what the response is so we can possibly update the used openldap libraries in the win32 binaries build. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/25827 -- Edit this bug report at http://bugs.php.net/?id=25827&edit=1
