ZF-8274

added option to provide one or multiple LDAP URI(s) (ldap://, ldaps:// or ldapi://) in the $host parameter

git-svn-id: http://framework.zend.com/svn/framework/standard/trunk@18924 44c647ce-9c0f-0410-b52a-842ac1e357ba

library/Zend/Ldap.php

@@ -117,9 +117,18 @@ class Zend_Ldap
      *
      * @param  array|Zend_Config $options Options used in connecting, binding, etc.
      * @return void
+     * @throws Zend_Ldap_Exception if ext/ldap is not installed
      */
     public function __construct($options = array())
     {
+        if (!extension_loaded('ldap')) {
+            /**
+             * @see Zend_Ldap_Exception
+             */
+            require_once 'Zend/Ldap/Exception.php';
+            throw new Zend_Ldap_Exception(null, 'LDAP extension not loaded',
+                Zend_Ldap_Exception::LDAP_X_EXTENSION_NOT_LOADED);
+        }
         $this->setOptions($options);
     }
 
@@ -689,14 +698,6 @@ class Zend_Ldap
     public function disconnect()
     {
         if (is_resource($this->_resource)) {
-            if (!extension_loaded('ldap')) {
-                /**
-                 * @see Zend_Ldap_Exception
-                 */
-                require_once 'Zend/Ldap/Exception.php';
-                throw new Zend_Ldap_Exception(null, 'LDAP extension not loaded',
-                    Zend_Ldap_Exception::LDAP_X_EXTENSION_NOT_LOADED);
-            }
             @ldap_unbind($this->_resource);
         }
         $this->_resource = null;
@@ -705,6 +706,12 @@ class Zend_Ldap
     }
 
     /**
+     * To connect using SSL it seems the client tries to verify the server
+     * certificate by default. One way to disable this behavior is to set
+     * 'TLS_REQCERT never' in OpenLDAP's ldap.conf and restarting Apache. Or,
+     * if you really care about the server's cert you can put a cert on the
+     * web server.
+     *
      * @param  string  $host        The hostname of the LDAP server to connect to
      * @param  int     $port        The port number of the LDAP server to connect to
      * @param  boolean $useSsl      Use SSL
@@ -741,38 +748,34 @@ class Zend_Ldap
             throw new Zend_Ldap_Exception(null, 'A host parameter is required');
         }
 
-        /* To connect using SSL it seems the client tries to verify the server
-         * certificate by default. One way to disable this behavior is to set
-         * 'TLS_REQCERT never' in OpenLDAP's ldap.conf and restarting Apache. Or,
-         * if you really care about the server's cert you can put a cert on the
-         * web server.
-         */
-        $url = ($useSsl) ? "ldaps://$host" : "ldap://$host";
-        if ($port) {
-            $url .= ":$port";
-        }
-
+        $useUri = false;
         /* Because ldap_connect doesn't really try to connect, any connect error
          * will actually occur during the ldap_bind call. Therefore, we save the
          * connect string here for reporting it in error handling in bind().
          */
-        $this->_connectString = $url;
+        $hosts = array();
+        if (preg_match_all('~ldap(?:i|s)?://~', $host, $hosts, PREG_SET_ORDER) > 0) {
+            $this->_connectString = $host;
+            $useUri = true;
+            $useSsl = false;
+        } else {
+            if ($useSsl) {
+                $this->_connectString = 'ldaps://' . $host;
+                $useUri = true;
+            } else {
+                $this->_connectString = 'ldap://' . $host;
+            }
+            if ($port) {
+                $this->_connectString .= ':' . $port;
+            }
+        }
 
         $this->disconnect();
 
-        if (!extension_loaded('ldap')) {
-            /**
-             * @see Zend_Ldap_Exception
-             */
-            require_once 'Zend/Ldap/Exception.php';
-            throw new Zend_Ldap_Exception(null, 'LDAP extension not loaded',
-                Zend_Ldap_Exception::LDAP_X_EXTENSION_NOT_LOADED);
-        }
-
         /* Only OpenLDAP 2.2 + supports URLs so if SSL is not requested, just
          * use the old form.
          */
-        $resource = ($useSsl) ? @ldap_connect($url) : @ldap_connect($host, $port);
+        $resource = ($useUri) ? @ldap_connect($this->_connectString) : @ldap_connect($host, $port);
 
         if (is_resource($resource) === true) {
             $this->_resource = $resource;

tests/Zend/Ldap/ConnectTest.php

@@ -194,4 +194,33 @@ class Zend_Ldap_ConnectTest extends PHPUnit_Framework_TestCase
             $this->assertEquals(0x0, Zend_Ldap_Exception::getLdapCode(null));
         }
     }
+
+    /**
+     * @group ZF-8274
+     */
+    public function testConnectWithUri()
+    {
+        $host = TESTS_ZEND_LDAP_HOST;
+        $port = 0;
+        if (defined('TESTS_ZEND_LDAP_PORT') && TESTS_ZEND_LDAP_PORT != 389) $port = TESTS_ZEND_LDAP_PORT;
+        $useSsl = false;
+        if (defined('TESTS_ZEND_LDAP_USE_SSL')) $useSsl = TESTS_ZEND_LDAP_USE_SSL;
+        if ($useSsl) {
+            $host = 'ldaps://' . $host;
+        } else {
+            $host = 'ldap://' . $host;
+        }
+        if ($port) {
+            $host = $host . ':' . $port;
+        }
+
+        $ldap = new Zend_Ldap();
+        try {
+            $ldap->connect($host)
+                 ->bind('CN=ignored,DC=example,DC=com', 'ignored');
+            $this->fail('Expected exception for invalid username');
+        } catch (Zend_Ldap_Exception $zle) {
+            $this->assertContains('Invalid credentials', $zle->getMessage());
+        }
+    }
 }