issues using memberOf clause in ldap query - php

Question

I'm trying to accomplish something very similar to what this user was doing Here.
I followed the answer, but I could not get it working. Inside the Active directory, my memberOf field looks like this:
CN=$VPN Users,CN=Users,DC=iai,DC=pri,CN=$ITAR,CN=Users,DC=iai,DC=pri,CN=allsubscribers,CN=Users,DC=iai,DC=pri
My Filter that works is:
(&(objectCategory=person)(sAMAccountName=$p_username))
I'm trying to get the following to work:
(&(objectCategory=person)(sAMAccountName=$p_username)(memberOf=CN=$ITAR))
I have tried adding the full DN which is
CN=Users,DC=iai,DC=pri
to my filter as well, but I get:
array(1) { ["count"]=> int(0) }
as my response.
I'm using ldap 3
This is the partial Working authentication code written in php:
$login = ldap_bind( $url, "username#somedomain", $password );
$attributes = array("displayname", "mailnickname");
$filter = "(&(objectCategory=person)(sAMAccountName=$username))";
$result = ldap_search($url, "CN=Users,DC=iai,DC=pri", $filter, $attributes);
$entries = ldap_get_entries($url, $result);
What am I doing wrong?
Code Result From #DaveRandom
First Var dump:
string(49) "(&(objectCategory=person)(sAMAccountName=rmoser))"
array(2) {
["count"] => int(1)
[0] => array(8) {
["displayname"] => array(2) {
["count"] => int(1)
[0] => string(10) "Ryan Moser"
}
[0] => string(11) "displayname"
["memberof"] => array(4) {
["count"] => int(3)
[0] => string(36) "CN=$VPN Users,CN=Users,DC=iai,DC=pri"
[1] => string(31) "CN=$ITAR,CN=Users,DC=iai,DC=pri"
[2] => string(40) "CN=allsubscribers,CN=Users,DC=iai,DC=pri"
}
[1]=> string(8) "memberof"
["mailnickname"] => array(2) {
["count"] => int(1)
[0] => string(6) "rmoser"
}
[2] => string(12) "mailnickname"
["count"] => int(3)
["dn"] => string(36) "CN=Ryan Moser,CN=Users,DC=iai,DC=pri"
}
}
bool(false)
Second var_dump:
string(70) "(&(objectCategory=person)(sAMAccountName=rmoser)(memberof=*CN=$ITAR*))"
array(1) {
["count"] => int(0)
}

Answer 1

LDAP filters look for an exact match.
In order to match CN=$ITAR anywhere in a value, you will need to surround it with the filter wildcard character *.
Try this filter:
(&(objectCategory=person)(sAMAccountName=$p_username)(memberOf=*CN=$ITAR*))
Also don't forget that $ITAR is a valid variable name in PHP, so if you place that filter string in double quotes (which you would need to in order for $p_username to be interpolated) PHP will attempt to interpolate $ITAR as a variable as well, find that it (probably) doesn't exist and the end result will be that it gets stripped from the string.
$filter = "(&(objectCategory=person)(sAMAccountName=$p_username)(memberOf=*CN=\$ITAR*))";
A useful link for any question concerning a dynamic filter built with PHP is this.