Reading from LDAP in Perl using Net::LDAP

LDAP stands for Lightweight Directory Access Protocol. It is usually used to fetch (and sometimes update) data in a directory of people. For example the employees and students of a University.

For example, Active Directory, which is used in Microsoft Windows based networks to hold the accounts of all he users, provides a way to access it via LDAP.

Using Net::LDAP can provide a way to interact with this database. For example you might build an in-house web application and instead of managing your own user database, you could let the users authenticate using their username/password in the Windows network.

There are several publicly accessible LDAP servers you can use to check your code. We are going to use the one published by The University of Michigan.

Fetching Data from an LDAP server

#!/usr/bin/env perl
use strict;
use warnings;

use Net::LDAP;
my $server = "ldap.itd.umich.edu";
my $ldap = Net::LDAP->new( $server ) or die $@;
$ldap->bind;

my $result = $ldap->search(
    base   => "",
    filter => "(&(cn=Jame*) (sn=Woodw*))",
);

die $result->error if $result->code;

printf "COUNT: %s\n", $result->count;

foreach my $entry ($result->entries) {
    $entry->dump;
}
print "===============================================\n";

foreach my $entry ($result->entries) {
    printf "%s <%s>\n",
        $entry->get_value("displayName"),
        ($entry->get_value("mail") || '');
}

$ldap->unbind;

Running the above code will print:

COUNT: 2
------------------------------------------------------------------------
dn:uid=jrwood,ou=People,dc=umich,dc=edu

      objectClass: umichPerson
                   top
                   person
                   inetOrgPerson
                   posixAccount
              uid: jrwood
               sn: Woodworth
               cn: James R Woodworth
                   James Woodworth
        uidNumber: 75786
        gidNumber: 10
    homeDirectory: /users/jrwood
RealtimeBlockList: TRUE
               ou: Alumni
      displayName: James R Woodworth
          krbName: jrwood@umich.edu
------------------------------------------------------------------------
dn:uid=jwoodnh,ou=People,dc=umich,dc=edu

          krbName: jwoodnh@umich.edu
        uidNumber: 99417910
       loginShell: /bin/csh
               sn: Woodward
               ou: Alumni
             mail: jwoodnh@umich.edu
    homeDirectory: /users/jwoodnh
RealtimeBlockList: TRUE
      displayName: James Alan Woodward
              uid: jwoodnh
        gidNumber: 10
               cn: James Alan Woodward
                   James A Woodward
                   James Woodward
      objectClass: umichPerson
                   inetOrgPerson
                   organizationalPerson
                   person
                   top
                   posixAccount
===============================================
James R Woodworth <>
James Alan Woodward <jwoodnh@umich.edu>

First thing is to create a Net::LDAP object providing the name of the LDAP server. Then we call bind. That is where we connect to the LDAP server. In this example we used an anonymous connection. This usually only allows read access.

The search method returns a Net::LDAP::Search object. (This is what gets assigned to the $result variable.

The code method of the Net::LDAP::Search object returns Net::LDAP::Constant which is 0 on success. (Like the exit code of a Unix shell command.) So the Perl code to check for failure is

if ($result->code) {
    die $result->error;
}

Or if you prefer:

die $result->error if $result->code;

The example in the documentation uses the shell-style:

$result->code && die $result->error;

that I personally don't find very readable.

If the search was successful the count method will return the number of hits.

The entries method returns all the hits. Each one is a Net::LDAP::Entry object.

In the first foreach loop we just dump the results for each entry. This is mostly useful for debugging purposes, or when we try to explore what kind of fields does the server provide.

In the second foreach loop we used the get_value method to fetch specific fields from the entry.

At the end of our interaction we unbind (disconnect) from the LDAP server.

Admin limit exceeded

If we widen our search, for example by searching for sn=W* instead of sn=Woodw*:

my $result = $ldap->search(
    base   => "",
    filter => "(&(cn=Jame*) (sn=W*))",
);

die $result->error if $result->code;

We will get an Admin limit exceeded error code.

Bad filter

If we don't provide a filter, or if it is formatted incorrectly, we get a Bad filter error code.