Added by Stefan Gehrig, last edited by Ralph Schindler on Nov 01, 2008  (view change)

Labels

 

Zend Framework: Zend_Ldap_Ext Component Proposal

Proposed Component Name Zend_Ldap_Ext
Developer Notes http://framework.zend.com/wiki/display/ZFDEV/Zend_Ldap_Ext
Proposers Stefan Gehrig
Liasion: Ralph Schindler
Revision 0.1 - 29 March 2008: Opened proposal.
0.1.1 - 3 April 2008: Changed layout to use decks.
0.2 - 13 April 2008: Added Zend_Ldap_Ext::count() method
0.3 - 17 April 2008: Completely reworked the class skeletons to match the current version, I'm working on.
0.4 - 5 July 2008: Changed respository location
0.5 - 10 August 2008: Reworked the proposal as it was fairly outdated (wiki revision: 25)

Table of Contents

1. Overview

The existing Zend_Ldap component currently just responds to authentication use cases in all their varieties. There is no posibility to query a LDAP directory service in a unified and consistent way. The current component also lacks core CRUD (Create, Retrieve, Update and Delete) functionality - operations that are crucial to for example database abstraction layers.
This proposals tries to resolve these deficiencies in that it provides a simple two-ply object oriented model to connect to, query and perfom CRUD operations on an LDAP server. The first layer is a wrapper around the ext/ldap functions, spiced up with extended functionality such as copying and moving (renaming in a LDAP context) nodes and subtrees.
The second layer (Zend_Ldap_Node) provides an active-record-like interface to LDAP entries and stresses the tree-structure of LDAP data in providing (recursive) tree traversal methods.
To simplify the usage of the unfamiliar LDAP filter syntax this components proposes an object oriented approach to LDAP filter string generation, which can loosely be compared to Zend_Db_Select.

2. References

3. Component Requirements, Constraints, and Acceptance Criteria

  • This component will extend Zend_Ldap.
  • This component will provide generic search functions.
  • This component will provide generic CRUD functions (add(), update() and delete()).
  • This component will contain a query result class to abstract the cumbersome use of ext/ldap to retrieve attributes in a common format.
  • This component will assist the user in populating and reading LDAP entry arrays.
  • This component will detect LDAP boolean values ('TRUE' and 'FALSE') and convert them to PHP booleans.
  • This component will provide a method to populate an LDAP entry array regardless of the PHP variable type.
  • This component will handle file resources transparently so that it's possible to add the contents of a file to an LDAP attribute.
  • This component will provide a method to set a LDAP userPassword attribute with SHA1 or MD5 hashed passwords.

4. Dependencies on Other Framework Components

  • Zend_Ldap
  • PHP ext/ldap

5. Theory of Operation

The Zend_Ldap_Ext component extends Zend_Ldap with methods to query an LDAP directory service and to perform creation, updating, retrieval and deletion operations on the LDAP server. It therefore wraps ext/ldap function calls in an object-oriented interface and unifies result handling. On this layer LDAP data is represented in an array format to allow for round-trips of the data. Helper functions will allow developers to handle LDAP data in a common way; this includes conversion of LDAP date/time attributes, LDAP boolean attributes and the creation of LDAP password attributes. These methods will also help the developer to build consistent LDAP data arrays for use with the different data modification methods of Zend_Ldap_Ext and will allow the creation of LDAP DN strings (a lof of these functions are inspired by PEAR::Package::Net_LDAP2).
Query results are encapsulated in Zend_Ldap_QueryResult which acts as an interface to the LDAP resultset. Zend_Ldap_QueryResult implemets the common PHP SPL interfaces Iterator and Countable and includes a LDAP entry cache to speed up multiple iterations.
On top of these core functionality Zend_Ldap_Node provides an active-record-like interface to single LDAP entries. Through the use of the SPL RecursiveIterator interface developers can traverse complete LDAP trees recursively with a single foreach()-loop. Zend_Ldap_Node can be extended by deleopers and form a basis for a LDAP data model.
Building LDAP filter strings is unfamiliar to SQL-accustomed developers and not always very intuitive with all its parentheses. Zend_Ldap_Filter proposes an object oriented approach to filter creation which is also inspired by PEAR::Package::Net_LDAP2. With automatic value escaping LDAP filter string creation could be a no-brainer this way.

6. Milestones / Tasks

  • Milestone 1: [DONE] Write initial proposal
  • Milestone 2: [CURRENT] Review by community
  • Milestone 3: [DONE] Checked in at http://svn2.assembla.com/svn/zf-proposals/trunk
  • Milestone 4: Review by Zend
  • Milestone 5: Component incubated
  • Milestone 6: [DONE] Write unit tests
  • Milestone 7: Write documentation
  • Milestone 8: Component cored

7. Class Index

  • Zend_Ldap_Ext
  • Zend_Ldap_Filter
  • Zend_Ldap_Filter_Abstract
  • Zend_Ldap_Filter_And
  • Zend_Ldap_Filter_Exception
  • Zend_Ldap_Filter_Logical
  • Zend_Ldap_Filter_Mask
  • Zend_Ldap_Filter_Not
  • Zend_Ldap_Filter_Or
  • Zend_Ldap_Filter_String
  • Zend_Ldap_Helper
  • Zend_Ldap_Node
  • Zend_Ldap_Node_AttributeIterator
  • Zend_Ldap_Node_Children
  • Zend_Ldap_QueryResult

8. Use Cases

Core classes

Filter subpackage
Node subpackage

9. Class Skeletons

Core classes

Filter subpackage
Node subpackage

I wonder if really nobody is interested in an extended LDAP support for the Zend Framework. The current implementation does not allow for anything more than authentication and ext/ldap usage is realy time-consuming, e.g. dealing with three different resource types (connection, search result, entry).I personally think, Zend Framework should provide a LDAP component for working with a LDAP directory entirely.
There is a lot of room for improvement and a procreative discussion among the community could help a lot.

I'm building a small internal tool for the company I work for to manage some internal projects and I'll use this component to browse/search our ldap server. I'll blog about once I'm done over at http://cogo.wordpress.com/. If I find some shortcomings or bugs I'll be sure to let you know.

I've heard requests for this functionality many times. Have you announced that it is ready for review on the general mailing list yet?

,Wil

Hi Wil,

yes I did make an announcement on the fw-general mailing yes. I only got a response from Michael B Allen more or less rejecting the idea of a Zend Framework LDAP component extension in the given form.
I didn't have any time to respond to his doubts yet but I think that even if this component does not use polymorphism (one of the main arguments of Michael B Allen) the object oriented interface creatly simplifies the usage of LDAP directory services in PHP code.
I currently use this component on an internal project and I'm looking forward to get back some impressions and review from Christer.

Best regards

Stefan

I am quite keen on the general concept of Zend and I have been using the framework for some time. The existing Zend_Ldap class and this proposed extension, however, are a poor substitute for PEAR's Net_LDAP2 (successor to Net_LDAP). The Net_LDAP package was modelled on CPAN's (perl) Net::LDAP package interface, which is pretty much the benchmark in terms of fully functional object oriented access to LDAP repositories.

I hate to be negative here but I really think that you need to go away and have a good long hard look at both Net_LDAP2 and Net::LDAP. Both are under free software licenses and so it isn't hard or legally complex to examine what these packages do (especially in terms of schema browsing, object editing and updating, and connection to multiple LDAP servers for resiliency) and bring those ideas back into Zend, or even copy the entire interface design and concept back here.

I think you're doing yourself and the Zend community a disservice by not looking in detail at at least the interfaces to these excellent packages. I have authored several systems built on top of Net::LDAP and I'm in the process of migrating one of those to PHP using Net_LDAP2, and these systems really are the swiss army knife of LDAP manipulation.

Happily enough I have managed to develop an authentication adapter (Zend_Auth_Adapter_Ldap2 implements Zend_Auth_Adapter_Interface) built on top of Net_LDAP2 so I've been able to avoid the use of Zend's Zend_Ldap interface entirely, but I wish I didn't have to pull in quite so many PEAR components to get LDAP working the way I want it to work within my Zend application.

Stefan, I think you're doing an excellent job in general, and I'd much prefer to see an extended LDAP interface within Zend, and I'm not sure what Michael Allen's issues are, but if the Zend leaders can't be pushed to support an extended LDAP interface within Zend then programmers are going to have to look outside of Zend for LDAP support.

Hi Del,

thanks a lot for your constructive and suggestive comments. I think most points of criticism are actually founded on the fact that this proposal's page is somehow not really up-to-date with the current features implemented in code. Shame on me for this one - but I currently don't have enough time to update the proposal's page.
Did you have a look at the actual code from