The Ldap Component

The Ldap component provides a means to connect to an LDAP server (OpenLDAP or Active Directory).

Installation

$ composer require symfony/ldap

Note

If you install this component outside of a Symfony application, you mustrequire the vendor/autoload.php file in your code to enable the classautoloading mechanism provided by Composer. Readthis article for more details.

Usage

The Ldap class provides methods to authenticateand query against an LDAP server.

The Ldap class uses an AdapterInterfaceto communicate with an LDAP server. The adapterfor PHP's built-in LDAP extension, for example, can be configured using thefollowing options:

• host
• IP or hostname of the LDAP server
• port
• Port used to access the LDAP server
• version
• The version of the LDAP protocol to use
• encryption
• The encryption protocol: ssl, tls or none (default)
• connection_string
• You may use this option instead of host and port to connect to theLDAP server
• optReferrals
• Specifies whether to automatically follow referrals returned by the LDAP server
• options
• LDAP server's options as defined inConnectionOptionsFor example, to connect to a start-TLS secured LDAP server:

use Symfony\Component\Ldap\Ldap;
 
$ldap = Ldap::create('ext_ldap', [
    'host' => 'my-server',
    'encryption' => 'ssl',
]);

Or you could directly specify a connection string:

use Symfony\Component\Ldap\Ldap;
 
$ldap = Ldap::create('ext_ldap', ['connection_string' => 'ldaps://my-server:636']);

The bind() methodauthenticates a previously configured connection using both thedistinguished name (DN) and the password of a user:

use Symfony\Component\Ldap\Ldap;
// ...
 
$ldap->bind($dn, $password);

Once bound (or if you enabled anonymous authentication on yourLDAP server), you may query the LDAP server using thequery() method:

use Symfony\Component\Ldap\Ldap;
// ...
 
$query = $ldap->query('dc=symfony,dc=com', '(&(objectclass=person)(ou=Maintainers))');
$results = $query->execute();
 
foreach ($results as $entry) {
    // Do something with the results
}

By default, LDAP entries are lazy-loaded. If you wish to fetchall entries in a single call and do something with the results'array, you may use thetoArray() method:

use Symfony\Component\Ldap\Ldap;
// ...
 
$query = $ldap->query('dc=symfony,dc=com', '(&(objectclass=person)(ou=Maintainers))');
$results = $query->execute()->toArray();
 
// Do something with the results array

By default, LDAP queries use the Symfony\Component\Ldap\Adapter::SCOPE_SUBscope, which corresponds to the LDAP_SCOPE_SUBTREE scope of theldap_search function. You can also use SCOPE_BASE (relatedto the LDAP_SCOPE_BASE scope of ldap_read) and SCOPE_ONE(related to the LDAP_SCOPE_ONELEVEL scope of ldap_list):

use Symfony\Component\Ldap\Adapter;
 
$query = $ldap->query('dc=symfony,dc=com', '...', ['scope' => Adapter::SCOPE_ONE]);

Creating or Updating Entries

The Ldap component provides means to create new LDAP entries, update or evendelete existing ones:

use Symfony\Component\Ldap\Entry;
use Symfony\Component\Ldap\Ldap;
// ...
 
$entry = new Entry('cn=Fabien Potencier,dc=symfony,dc=com', [
    'sn' => ['fabpot'],
    'objectClass' => ['inetOrgPerson'],
]);
 
$entryManager = $ldap->getEntryManager();
 
// Creating a new entry
$entryManager->add($entry);
 
// Finding and updating an existing entry
$query = $ldap->query('dc=symfony,dc=com', '(&(objectclass=person)(ou=Maintainers))');
$result = $query->execute();
$entry = $result[0];
$entry->setAttribute('email', ['[email protected]']);
$entryManager->update($entry);
 
// Adding or removing values to a multi-valued attribute is more efficient than using update()
$entryManager->addAttributeValues($entry, 'telephoneNumber', ['+1.111.222.3333', '+1.222.333.4444']);
$entryManager->removeAttributeValues($entry, 'telephoneNumber', ['+1.111.222.3333', '+1.222.333.4444']);
 
// Removing an existing entry
$entryManager->remove(new Entry('cn=Test User,dc=symfony,dc=com'));

Batch Updating

Use the entry manager's applyOperations()method to update multiple attributes at once:

use Symfony\Component\Ldap\Entry;
use Symfony\Component\Ldap\Ldap;
// ...
 
$entry = new Entry('cn=Fabien Potencier,dc=symfony,dc=com', [
    'sn' => ['fabpot'],
    'objectClass' => ['inetOrgPerson'],
]);
 
$entryManager = $ldap->getEntryManager();
 
// Adding multiple email addresses at once
$entryManager->applyOperations($entry->getDn(), [
    new UpdateOperation(LDAP_MODIFY_BATCH_ADD, 'mail', '[email protected]'),
    new UpdateOperation(LDAP_MODIFY_BATCH_ADD, 'mail', '[email protected]'),
]);

Possible operation types are LDAP_MODIFY_BATCH_ADD, LDAP_MODIFY_BATCH_REMOVE,LDAP_MODIFY_BATCH_REMOVE_ALL, LDAP_MODIFY_BATCH_REPLACE. Parameter$values must be NULL when using LDAP_MODIFY_BATCH_REMOVE_ALLoperation type.