(PHP 4 >= 4.0.4, PHP 5, PHP 7, PHP 8)
ldap_set_option — Modifica el valor de una opción LDAP
Modifica el valor de la opción option reemplazando el valor
actual por value.
ldap
Puede ser una instancia LDAP\Connection, devuelta por ldap_connect(),
para definir la opción para esta conexión, o null para definir la opción globalmente.
option
El parámetro option puede tomar uno de los siguientes valores:
| Opción | Tipo | Disponible a partir de |
|---|---|---|
LDAP_OPT_DEREF |
int | |
LDAP_OPT_SIZELIMIT |
int | |
LDAP_OPT_TIMELIMIT |
int | |
LDAP_OPT_NETWORK_TIMEOUT |
int | |
LDAP_OPT_PROTOCOL_VERSION |
int | |
LDAP_OPT_ERROR_NUMBER |
int | |
LDAP_OPT_REFERRALS |
bool | |
LDAP_OPT_RESTART |
bool | |
LDAP_OPT_HOST_NAME |
string | |
LDAP_OPT_ERROR_STRING |
string | |
LDAP_OPT_DIAGNOSTIC_MESSAGE |
string | |
LDAP_OPT_MATCHED_DN |
string | |
LDAP_OPT_SERVER_CONTROLS |
array | |
LDAP_OPT_CLIENT_CONTROLS |
array | |
LDAP_OPT_X_KEEPALIVE_IDLE |
int | PHP 7.1.0 |
LDAP_OPT_X_KEEPALIVE_PROBES |
int | PHP 7.1.0 |
LDAP_OPT_X_KEEPALIVE_INTERVAL |
int | PHP 7.1.0 |
LDAP_OPT_X_TLS_CACERTDIR |
string | PHP 7.1.0 |
LDAP_OPT_X_TLS_CACERTFILE |
string | PHP 7.1.0 |
LDAP_OPT_X_TLS_CERTFILE |
string | PHP 7.1.0 |
LDAP_OPT_X_TLS_CIPHER_SUITE |
string | PHP 7.1.0 |
LDAP_OPT_X_TLS_CRLCHECK |
int | PHP 7.1.0 |
LDAP_OPT_X_TLS_CRLFILE |
string | PHP 7.1.0 |
LDAP_OPT_X_TLS_DHFILE |
string | PHP 7.1.0 |
LDAP_OPT_X_TLS_KEYILE |
string | PHP 7.1.0 |
LDAP_OPT_X_TLS_PROTOCOL_MIN |
int | PHP 7.1.0 |
LDAP_OPT_X_TLS_RANDOM_FILE |
string | PHP 7.1.0 |
LDAP_OPT_X_TLS_REQUIRE_CERT |
int | PHP 7.0.5 |
Las opciones LDAP_OPT_SERVER_CONTROLS y
LDAP_OPT_CLIENT_CONTROLS requieren una
lista de controles, lo que significa que el valor debe ser un array de controles.
Un control está compuesto por un oid
como identificador, un valor opcional value,
y un flag opcional de "criticalidad" (criticality). En PHP,
un control se define como un array, por lo que las claves son
oid con una cadena como valor, y dos claves
opcionales. Estas claves son value con una
cadena como valor, y iscritical con un valor
booleano. Por omisión, iscritical vale false. Ver
el archivo » draft-ietf-ldapext-ldap-c-api-xx.txt
para más detalles. Consulte el segundo ejemplo para una ilustración.
Nota:
Todas las opciones TLS deben ser definidas globalmente antes de ldap_connect() para una conexión ldaps, o para la conexión antes de ldap_start_tls().
value
El nuevo valor para la opción option especificada.
| Versión | Descripción |
|---|---|
| 8.1.0 |
The ldap parameter expects an LDAP\Connection
instance now; previously, a valid ldap link recurso was expected.
|
Ejemplo #1 Modificación de la versión del protocolo
<?php
// $ds debe ser una instancia de conexión LDAP\Connection válida
if (ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3)) {
echo "Versión LDAPv3";
} else {
echo "No es posible modificar la versión del protocolo a 3";
}
?>Ejemplo #2 Modificación de los controles del servidor
<?php
// $ds debe ser una instancia de conexión LDAP\Connection válida
$ctrl1 = array("oid" => "1.2.752.58.10.1", "iscritical" => true);
// iscritical vale por omisión FALSE
$ctrl2 = array("oid" => "1.2.752.58.1.10", "value" => "magic");
// intenta usar los dos controles
if (!ldap_set_option($ds, LDAP_OPT_SERVER_CONTROLS, array($ctrl1, $ctrl2))) {
echo "No es posible modificar los controles del servidor";
}
?>Nota:
Esta función solo está disponible cuando se utiliza OpenLDAP 2.x.x o Netscape Directory SDK x.x.
As john.hallam@compaq.com above mentioned ,one has to set option LDAP_OPT_PROTOCOL_VERSION=3
ldap_set_option($ds,LDAP_OPT_PROTOCOL_VERSION,3);
to use the ldap_rename function.
However, the ldap_set_option() line has to be written immediately after ldap_connect() and before ldap_bind() statements.
Christos SouliosLuckily you can turn on debugging before you open a connection:
ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
This way you at least can see in the logs if the connection fails...If you want to disable the TLS cert check (e.g. because you are doing an SSH port-forward, and ldaps is pointing to localhost), then you must invoke:
ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,0)
*before* calling ldap_connect()
If you try:
$ds = ldap_connect(...)
ldap_set_option($ds, LDAP_OPT_X_TLS_REQUIRE_CERT,0)
then the option won't actually take effect, and the certificate will be checked anyway, and a TLS failure will happen..The following flags are valid integer values for the LDAP_OPT_DEREF (as taken from the documentation for ldap_read()):
LDAP_DEREF_NEVER (int 0) - (default) aliases are never dereferenced.
LDAP_DEREF_SEARCHING (int 1) - aliases should be dereferenced during the search but not when locating the base object of the search.
LDAP_DEREF_FINDING (int 2) - aliases should be dereferenced when locating the base object but not during the search.
LDAP_DEREF_ALWAYS (int 3) - aliases should be dereferenced always.
Example:
<?php
ldap_set_option($ds, LDAP_OPT_DEREF, LDAP_DEREF_ALWAYS);
?>
These are defined in the draft C API (presumably from the original LDAP API). See draft-ietf-ldapext-ldap-c-api-xx.txt included in the OpenLDAP source code distribution.PHP 7.1 added support for configuring the LDAP CA/Cert environment directly, rather than relying on the environment variables. I noticed that a lot of people are having trouble getting this to work.
The correct way is:
$ds=ldap_connect("ldap.google.com");
ldap_set_option(NULL, LDAP_OPT_X_TLS_CERTFILE, "/path/file.crt");
ldap_set_option(NULL, LDAP_OPT_X_TLS_KEYFILE, "/path/file.key");
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
ldap_start_tls($ds);
...
ldap_close($ds);I have the following code, but you do not rename the cn, that may be?
$TheDN = "cn=Nombre,ou=Addressbook,dc=axia-ldap,dc=net";
$newRDN = "cn=bill";
$newParent = "ou=Addressbook,dc=axia-ldap,dc=net";
ldap_set_option($ds,LDAP_OPT_PROTOCOL_VERSION,3);
$result = ldap_rename($ds, $TheDN, $newRDN, $newParent, TRUE);To get this to work I had to set the LDAP version to 3 using ldap_set_option. Here is an example that might help:
$TheDN = "cn=john smith,ou=users,dc=acme,dc=com";
$newRDN = "cn=bill brown";
$newParent = "ou=users,dc=acme,dc=com";
ldap_set_option($ds,LDAP_OPT_PROTOCOL_VERSION,3);
@$result = ldap_rename($ds, $TheDN, $newRDN, $newParent, TRUE);it seems that ldap_set_option returns 1 for bogus ldap_connect -ions also.
ldap_connect always returns a resource (documented in the
comments of ldap_connect) so it is not possible to check if the
ldap server is there or alive or what. and because ldap_set_option
must be between ldap_connect and ldap_bind, there seems to
be no sense in checking the return value.
it is a bit strange that ldap_bind is the first function which can
really check if a ldap resource is usable because it is the third
function in line to use when working with openldap.
<?php
$connect = ldap_connect("whatever");
$set = ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
echo $set;
?>