php ldap_search in Active Directory root DN - empty results - php

Question

I am trying to query Active directory for a given user group membership.
When I search a specific user's OU, the search works ok.
When I try to search the entire directory, the result is empty.
Since I have many user OU's, and specific user OU may vary.
The system is CentOS 6.4 with PHP+Apache.
Here is the code:
$ldap_dn = "dc=ccc,dc=bbb,dc=aaa,dc=com";
// Active Directory user for querying
$query_user = "ldap_bind#ccc.bbb.aaa.com";
$password = "xxxx";
// Connect to AD
$ldap = ldap_connect($ldap_host, 389) or die("Could not connect to LDAP");
ldap_bind($ldap,$query_user,$password) or die("Could not bind to LDAP");
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
// Search AD
$results = ldap_search($ldap,$ldap_dn,"(sAMAccountName=$user)",array("memberof","primarygroupid"));
$entries = ldap_get_entries($ldap, $results);
if($entries['count'] == 0) {
echo "No results\n";
return false;
}
Have anyone ever seen similar results? am I missing something or any configuration to support such search?

Answer 1

The correct code iss...
$ldap_dn = "dc=ccc,dc=bbb,dc=aaa,dc=com";
// Active Directory user for querying
$query_user = "ldap_bind#ccc.bbb.aaa.com";
$password = "xxxx";
// Connect to AD
$ldap = ldap_connect($ldap_host, 389) or die("Could not connect to LDAP");
->>> bfore ldap_bind<<<- ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
->>> bfore ldap_bind<<<- ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
ldap_bind($ldap,$query_user,$password) or die("Could not bind to LDAP");
// Search AD
$results = ldap_search($ldap,$ldap_dn,"(sAMAccountName=$user)",array("memberof","primarygroupid"));
$entries = ldap_get_entries($ldap, $results);
if($entries['count'] == 0) {
echo "No results\n";
return false;
}