如何使用CodeIgniter和adLDAP v2.1库排除LDAP域下的特定文件夹

Question

我正在使用adLDAP和CodeIgniter在LDAP服务器上执行搜索.我想要搜索的内容基本上是已从LDAP服务器停用的帐户.在我的PHP代码中,我有以下内容来调用adLDAP库:

        $searchCriteria = array(
            "givenname"       => $values['givenName'],
            "sn"              => $values['sn'],
            "title"           => $values['title'],
            "mail"            => $values['mail'],
            "telephonenumber" => $values['telephonenumber'],
         );

//         echo "<pre>"; print_r($searchCriteria); echo "</pre>";

         // create the search filter
         $noOfFieldsSet = 0;
         $searchFilterA = '(objectClass=user)(samaccounttype='. ADLDAP_NORMAL_ACCOUNT .')(objectCategory=person)';
         $searchFilterB = '';
         foreach ($searchCriteria AS $key => $value)
         {
            if ($value)
            {
               $searchFilterB .= "(".$key."=".$wildcard.$value."*)";
               ++$noOfFieldsSet;
            }
         }
         // We perform a logical AND  or OR (depending on $logic) on all
         // specified search criteria to create the final search filter: 
         if ($logic == "&")
         {
            $searchFilter = "(".$logic." ".$searchFilterA.$searchFilterB.")";
         }
         else // logic = OR
         {
            $searchFilter = "(& ".$searchFilterA."(".$logic." ".$searchFilterB."))";
         }

//         echo $searchFilter."<br>";

         // define what attributes we want to get
         $attribs = array("displayname", "samaccountname", "mail", "telephonenumber", "title", "physicaldeliveryofficename");
         $resultEntries = $this->ad_ldap->search_directory($searchFilter, $attribs);

然后在最后一行中,调用adLDAP库中的函数ad_ldap-> search目录,此函数:

   function search_directory($filter, $fields, $sorted = true)
   {
      if ( ! $this->_bind)
         return (false);

      $sr = ldap_search($this->_conn, $this->_base_dn, $filter, $fields);
      $entries = ldap_get_entries($this->_conn, $sr);

//      echo "<pre>"; print_r($entries); echo "</pre>";

      return $entries;
   }

这就是我的LDAP树结构的样子:

我想知道如何排除那些目录(由黑色箭头指向)和另一个"users"文件夹内的其他Inactive文件夹.

我不确定的是如何排除目录或指定我想要排除的目录.

任何帮助,将不胜感激.

Answer 1

您应该添加排除过滤器$searchFilterB：

$searchFilterA = '(objectClass=user)(samaccounttype='. ADLDAP_NORMAL_ACCOUNT .')(objectCategory=person)';
$searchFilterB = '(!(UserAccountControl:1.2.840.113556.1.4.803:=2))';

这是 AD 特定的查询语言：查找所有没有该标志UF_ACCOUNTDISABLED的帐户（您可以通过翻转禁用开关在 AD 用户控件中进行编辑）。