<?php
$ldap_columns = NULL;
$ldap_connection = NULL;
$host = "172.88.88.88";  
$port = '389';
$ldap_password = "";  
$ldap_username = "[email protected]";
$ldap_base_dn = 'OU=Users,OU=RSC,OU=CHINA,DC=cn,DC=China,DC=com';
$search_filter = '(&(objectCategory=person))';
 
//------------------------------------------------------------------------------
// Connect to the LDAP server.
//------------------------------------------------------------------------------
$ldap_connection = ldap_connect( $host, $port );
if ( FALSE === $ldap_connection ) {
    die( '<p>Failed to connect to the LDAP server: '. $host.':'. $port .'</p>' );
}
 
ldap_set_option( $ldap_connection, LDAP_OPT_PROTOCOL_VERSION, 3 ) or die( 'Unable to set LDAP protocol version' );
ldap_set_option( $ldap_connection, LDAP_OPT_REFERRALS, 0 );
var_dump(ldap_bind( $ldap_connection, $ldap_username, $ldap_password ));
// We need this for doing an LDAP search.
if ( TRUE !== ldap_bind( $ldap_connection, $ldap_username, $ldap_password ) ) {
    die( '<p>Failed to bind to LDAP server.</p>' );
}
 
//------------------------------------------------------------------------------
// Get a list of all Active Directory users.
//------------------------------------------------------------------------------
$result = ldap_search( $ldap_connection, $ldap_base_dn, $search_filter );
$ldap = array();
if ( FALSE !== $result ) {
    $entries = ldap_get_entries( $ldap_connection, $result );
    if ( $entries['count'] > 0 ) {
        for ( $i = 0; $i < $entries['count']; $i++ ) {
            $data['adname'] = $entries[$i]['samaccountname'][0];	//域账号  3个英文4个数字
            //$data['email'] = $entries[$i]['userprincipalname'][0];
			if($entries[$i]['mail'][0]){						//获取真实Email
				$data['email'] = $entries[$i]['mail'][0];
			}else if($entries[$i]['extensionattribute3'][0]){
				$data['email'] = $entries[$i]['extensionattribute3'][0];
			}else{
                $data['email'] = $entries[$i]['userprincipalname'][0];
            }
            if($data['email']){ //这里说一下为什么先分割Email，因为用户名有重名的情况，所以先分割Email，email唯一。
                $data['username'] = explode("@",$data['email'])[0];	//获取用户名
            }else if($entries[$i]['mailnickname'][0]){
                $data['username'] = $entries[$i]['mailnickname'][0];
            }else{
                $data['username'] = $entries[$i]['samaccountname'][0];
            }
			$data['description'] = $entries[$i]['description'][0];	//获取简介
			$data['phonenumber'] = $entries[$i]['telephonenumber'][0];		//获取电话
            $data['create_at'] = time();		
            array_push($ldap,$data);
            print_r($entries[$i]);
			exit;
        }
    }
}
ldap_unbind( $ldap_connection );

#!/usr/bin/env python3
#!/usr/bin/env python3
# -*- coding: UTF-8 -*-
 
from ldap3 import Server, Connection, SUBTREE, ALL
 
ldap_host = '192.168.1.1'
ldap_port = 389
ldap_admin_user = 'serv-admin'  ###域账号，通过这个账号和密码就可以测试这个脚本
ldap_admin_password = 'Y888883'  ###勿外传。。。
#ldap_base_search = 'OU=Consultants,OU=PartTime Users,OU=RSC,OU=CHINA,DC=cn,DC=China,DC=com'
ldap_base_search = 'OU=Users,OU=ShanghaiNHD,OU=CHINA,DC=cn,DC=China,DC=com'
 
 
def ldap_auth(username, password):
    s = Server(host=ldap_host, port=ldap_port, use_ssl=False, get_info='ALL')
    # 这个首先看看你的admin能不能正常connect
    ldapz_admin_connection = Connection(s, user=username, password=password, auto_bind='NONE',
                                        version=3,
                                        authentication='SIMPLE', client_strategy='SYNC', auto_referrals=True,
                                        check_names=True,
                                        read_only=False, lazy=False,
                                        raise_exceptions=False)
    # 连上以后必须bind才能有值
    ldapz_admin_connection.bind()
 
    # 这个是为了查询你输入的用户名的入口搜索地址
    res = ldapz_admin_connection.search(search_base=ldap_base_search,
                                        ##search_filter='(sAMAccountName={})'.format('dong'),  ##获取登陆用户的信息 例如我个人的是域账号：ycx8888，可以把username改成我的ycx8888做测试
                                        search_filter='(&(objectCategory=person))',   ##这个是获取所有用户，可以通过for循环ldapz_admin_connection.response获取所有用户信息
                                        search_scope=SUBTREE,
                                        attributes=['samaccountname',  ##域账号
                                                    'mailnickname',  ##用户名，不过最好别用，用下面的邮箱，然后使用split @分割获取用户名
                                                    'mail',  ##邮箱
                                                    'description',  ##简介
                                                    'telephonenumber'])  ## 电话
 
    ## ldapz_admin_connection.response  包含了所有的AD域用户的信息。for循环即可获取。
    if res:
        try:
            for i in ldapz_admin_connection.response:
                print(i)
            print("登陆成功")
            ###读取数据库，判断是否有username用户，如果有，就update更新登陆时间、IP等信息，如果没有就创建新用户，不用加密码
        except Exception as e:
            print("操作失败")
            print(e)
    else:
        print("登陆失败")
    ldapz_admin_connection.unbind()
 
################
###LDAP登陆，所有的ldap账号都是3个字母加4个数字，示例：ycx8888
 
ldap_auth(ldap_admin_user, ldap_admin_password)