[RESOLVED] Searching an Entire Domain with LDAP

NFClimber

I've developed an application that searches Microsoft Active Directory for user information to display in a phonebook-type view. My problem is that although PH states that is searches the directory with the scope of SUBTREE, it doesn't appear that it's working. I can search individual OUs and sub OUs just fine, such as

$user="user";
$pass="password";
$ou="ou=thisdivision,dc=mycompany,dc=com";
$filter="(|(sn=$person*)(givenname=$person*)(department=*$person*))";
$res=@ldap_bind($ldap,$user,$pass);
$sr=ldap_search($ldap,$ou,$filter);

but if I want to search my entire domain, i.e.

$user="user";
$pass="password";
$ou="dc=mycompany,dc=com";
$filter="(|(sn=$person*)(givenname=$person*)(department=*$person*))";
$res=@ldap_bind($ldap,$user,$pass);
$sr=ldap_search($ldap,$ou,$filter);

it doesn't search at all, and generates a PHP Operations error.

PHP.net states that PHP will search an LDAP directory in parallel, but I haven't found any definitive samples of this working. I tried creating an array of ou's to search, but again, PHP will generate an operations error and of course, not find anything.

Sumary is, if anyone has any suggestions or samples on how to search and LDAP directory in parallel (i.e. multiple ou's for one search) or how to search an entire domain, this would help me alot.

Thanks!

NFClimber

Nevermind, I've found the solution.

For PHP to search entire Windows 2003 domains, two optinos have to be set after the connect command, but before the bind command:

ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION,3);
ldap_set_option($ldap, LDAP_OPT_REFERRALS,0);