Bad search filter on LDAP when trying to get user data

Question

I am fresh out of the box here with LDAP, so let me know if I am doing this in the completely wrong fashion.

I am working with Symfony 1.4 using the bhLDAPAuthPlugin plugin

I am verifying user login with LDAP. However, there is more data in the LDAP table that I would like to query using the username. So I am writing this search function to filter results according to the username:

function user_values($username) {
if (!$username) {
    die ("Username is not there man!");
}

if (!$this->_conn) {
    die ("No Connection.");
}
if (!$this->_base_dn) {
    die ("No Base.");
}
$filter="samaccountname=".$username;

$attributes_ad = array("name");
$result = ldap_search($this->_conn, $this->_base_dn, $filter, $attributes_ad) 
or die ("Error in search query");
$entries = ldap_get_entries($this->_conn, $result);
    return($entries);
}

I am getting the error:

Warning: ldap_search(): Search: Bad search filter in /... Error in search query

when i run the query.

The first three "if's" are there just to assure I was getting the correct parameters for the search. The condition fails on the actual search.

Any suggestions?

UPDATE

The username variable is jtesting

I pulled the $username from the function, before it gets put in the search parameter. It is actually (jtesting). I am going to remove the parenthesis, and see if that remedies the problem.

What is the value of `$username`? Please show the actual value you are passing in... — DaveRandom, Jul 23 '12 at 22:33
Hmm... well that shouldn't cause a bad filter - try changing the line where you assign filter to `$filter = '(samaccountname='.trim($username).')';` — DaveRandom, Jul 23 '12 at 22:47
Check out my answer here: http://stackoverflow.com/questions/8560874/php-ldap-add-function-to-escape-ldap-special-characters-in-dn-syntax/8561604#8561604 — DaveRandom, Jul 24 '12 at 07:59

score 7 · Accepted Answer · edited Oct 07 '21 at 05:51

7

In order to use parentheses in the assertion value of a filter the parenthese must be escaped. A search filter where the assertion value is samAccountName=(jtesting) should be encoded as samAccountName=\28jtesting\29. The entire assertion value may be enclosed in parentheses which are not escaped, in which case the filter becomes (samAccountName=\28jtesting\29).

More Information

edited Oct 07 '21 at 05:51

Community

1
1

answered Jul 24 '12 at 00:30

Terry Gardner

10,957
2
28
38

1

+1 I thought this was the most likely answer. Useful link: http://stackoverflow.com/questions/8560874/php-ldap-add-function-to-escape-ldap-special-characters-in-dn-syntax/8561604#8561604 :-D – DaveRandom Jul 24 '12 at 08:02
It was the parenthesis. Once those were removed, the search completed successfully. – Carey Estes Jul 24 '12 at 14:06

Bad search filter on LDAP when trying to get user data

1 Answers1

More Information

Linked