How to get server controls

[pafernandez-oesia]

Hi!

Is there any way to check if the server has returned a control? I have to check for LDAPPasswordExpiringControl presence and I can't find any reference in the API docs. What I'm trying to do is the same as described in PHP manual on LDAP controls examples.

The code I use is similar to this:

<?php

$user   = 'cn=admin,dc=example,dc=com';
$passwd = 'adminpassword';

$ds = ldap_connect('ldap://localhost');

if ($ds) {
    $r = ldap_bind_ext($ds, $user, $passwd, []);

    if (ldap_parse_result($ds, $r, $errcode, $matcheddn, $errmsg, $referrals, $ctrls)) {
        if ($errcode != 0) {
            die("Error: $errmsg ($errcode)");
        }
        if (isset($ctrls["2.16.840.1.113730.3.4.5"])) {
            $value = $ctrls["2.16.840.1.113730.3.4.5"]['value'];
            echo "Expires in: ".$value['expire']." seconds\n";
        }
    }
} else {
    die("Unable to connect to LDAP server");
}
?>

It works with vanilla PHP when the server returns the LDAPPasswordExpiringControl (OID = "2.16.840.1.113730.3.4.5"), but I can't figure how to do it the LdapRecord way. I'm currently making a double bind, one with LdapRecord and another one with a code similiar to the shown above in order to get the result.

Any help would be appreciated. Thank you.

Kind regards,

[stevebauman]

Hi @pafernandez-oesia, unfortunately this isn't possible in the LdapRecord API right now due to LdapRecord using ldap_bind() (returns bool) instead of ldap_bind_ext() (returns LdapResult|false).

You'd have to implement your own implementation of the LdapRecord\Ldap class and add that method manually.

I'll create an issue for this and patch this in so you can parse the bind result 👍

[stevebauman]

#379

[pafernandez-oesia]

Thank you very much @stevebauman. Happy New Year 😉

[stevebauman]

Happy new year to you as well @pafernandez-oesia!

I have some somewhat disappointing news however. This patch will have to reside in a new major version (v3) since it requires a new method being added to the LdapInterface or changing the return type of the bind method inside Ldap.php. Changing either of these in a minor or patch could break tests and applications.

I'll start work on v3 👍

[pafernandez-oesia]

Ups, I didn't think this would require working in a major version. Anyway, version 3 having this feature are good news 😉Thank you.