read users permissions on files in the local network

[hamarsheh]

please i need you'r help .. we are designing a web site and we need a critical code in php for security , we have to read users permissions on files in the local network ,to give them the real access and permissions also in their homes(on website) not just in thier work place (by local network security)so we have to read ldap file system ,but we can't find the code required ........

[hamarsheh]

this error msg appears befor i added debugging msg .

Can't contact LDAP server

although the connect function returns true .
i installed openldap server and determined cn , ou , and all required information and i executed my code while that server was running , the same result , i dont know what i have to do , is ldap supported automatically and i only connect to it or there must be some program installed inaddtion to the configurations i did ,?

[hamarsheh]

i found something about ldap support in php but i don't understand what i have to do , what i have to do with the dark lines below ...

LDAP support in PHP is not enabled by default. You will need to use the --with-ldap[=DIR] configuration option when compiling PHP to enable LDAP support. DIR is the LDAP base install directory. To enable SASL support, be sure --with-ldap-sasl[=DIR] is used, and that sasl.h exists on the system.

[Motoma]

the following was displayed:

Warning: mysql_query(): supplied resource is not a valid MySQL-Link resource in C:\AppServ\www\ test.php on line 23

--------------------------------------------------------------------------------
MySQL Error:


and my php code[apiece of it] :

if(!($ldap=ldap_connect("[e-mail]"))){
 die("ldap server can not be reached");
 }
 else{
$oudc="ou=birzeit,dc=bzu";
$dn2="cn=aham,".$oudc;
$password="all";
 
 
if(!($res=@ldap_bind($ldap,$dn2,$password))){
mysql_query($res, $ldap) or die('<hr />MySQL Error: ' .mysql_error(). '<hr />');
print(ldap_error($ldap)."<br>");
die("could not bind to $dn2");
 
}
 

the function mysql_query requires aquery identifier ididn't do anything till now, all i did just bind so i gave the function $res which is the bind return value, i really don't know if this is the problem .
the problem i'am facing is that its the first time i deal with ldap !!!...

Also, if i put any thing in the ldap_connect function it returns true..

The error is occuring with your MySQL statement. What exactly are you trying to do on that line?

[Motoma]

i found something about ldap support in php but i don't understand what i have to do , what i have to do with the dark lines below ...

LDAP support in PHP is not enabled by default. You will need to use the --with-ldap[=DIR] configuration option when compiling PHP to enable LDAP support. DIR is the LDAP base install directory. To enable SASL support, be sure --with-ldap-sasl[=DIR] is used, and that sasl.h exists on the system.

Run a phpinfo page, and see if LDAP is enabled on your server. If it was not, ldap_connect() would give you an error along the lines of "Function does not exist."

[hamarsheh]

thanks alot motoma ...

i got all users from ldap there was an error on our organizational unit .
Now what i want to do is to read users permissions i now need to get the file group id , i can do it using the function int filegroup ( string $filename )

which returns the group ID of the file, . The group ID is returned in numerical format,so you have to use posix_getgrgid( ) to resolve it to a group name.
but unfortunately the last one(posix_getid ( )) is only defined on unix platform , i'am searching for afunction defined on windows to do this task ..
OR if i can work on windows and use unix help at same time , idon't know if there is away to do that.

[Motoma]

Why do you need to resolve the group id to a group name? It has been a long time since I have dealt with LDAP, but isn't this something you could do with the LDAP functions PHP provides?

[hamarsheh]

because the function dosen't produce meaningful results on windows system, there is afunction which resolves this , but unfortunately its only defined on unix platforms . this is the problem i'am facing , i looked for functions that can do the same thing and defined on windows but i didn't find any one all sites give you the same function which works only on unix.......

[Motoma]

because the function dosen't produce meaningful results on windows system, there is afunction which resolves this , but unfortunately its only defined on unix platforms . this is the problem i'am facing , i looked for functions that can do the same thing and defined on windows but i didn't find any one all sites give you the same function which works only on unix.......

Have you played around with LDAP Browser at all? The reason I ask is because it is a very useful tool to use side by side with LDAP programming. It will show you all of the information you will be able to query from your LDAP server.

I guess, to rephrase my question: what do you need a group name for what a group id will not suffice?

[hamarsheh]

may be i didn't give the complete picture about what we are infact doing ..
we are designing aweb site , we have a local network in our company , on the local network users have permissions on folders they can't open every thing , what we need is to reflect this on our website there are links on the website which uses these folders
the steps are : we need to get all groups from the ldap , then to get users of each group , so when auser login we can determine in which group he is , then we need to read file permission or( which group uses) each file , now user permissions are determined..
you may say why this effort users can reach folders in local network server , thats right but we are looking for making it also available in their homes ...
i hope that the idea is clear now ..
i read all users from ldap but i'am looking for getting groups from ldap , and reading files permissions ..
i will seek for ldap browser
thank you

[Motoma]

The point I was trying to get at is that a file's group ownership is represented by a number, and a user's group membership is represented by a number, why does one need to resolve this number to a name in order to do the comparison?