cfldap

Description

Provides an interface to a Lightweight Directory Access Protocol (LDAP) directory server, such as the Netscape Directory Server.

Category

Internet Protocol tags

Syntax

<cfldap 
   server = "server_name"
   port = "port_number"
   username = "name"
   password = "password"
   action = "action"
   name = "name"
   timeout = "milliseconds"
   maxRows = "number"
   start = "distinguished_name"
   scope = "scope"
   attributes = "attribute, attribute"
returnAsBinary = "column_name, column_name"
   filter = "filter"
   sort = "attribute[, attribute]..."
   sortControl = "nocase" and/or "desc" or "asc"
   dn = "distinguished_name"
   startRow = "row_number"
   modifyType = "replace" or "add" or "delete"
   rebind = "yes" or "no"
   referral = "number_of_allowed_hops"
   secure = "multi_field_security_string"
   separator = "separator_character"
   delimiter = "delimiter_character">

See also

cfftp, cfhttp, cfmail, cfmailparam, cfpop, Managing LDAP Directories in ColdFusion MX Developer's Guide

History

ColdFusion MX 7: Added the returnAsBinary attribute. Added SSL V3 client based authentication; this means that ColdFusion supports the CFSSL_CLIENT_AUTH option.If CFSSL_CLIENT_AUTH is selected, ColdFusion assumes that the first certificate in the cacerts (or the certificate database) contains the Client Certificate.

ColdFusion MX:

• Changed the name attribute behavior: this tag validates the query name in the name attribute.
• Changed sorting behavior: this tag does not support client-side sorting of query results. (It supports server-side sorting; use the sort and sortcontrol attributes.)
• Changed how results are sorted: server-side sorting results might be sorted slightly differently than in ColdFusion 5. If you attempt a sort against a server that does not support it, ColdFusion MX throws an error.
• Deprecated the filterfile attribute. It might not work, and might cause an error, in later releases.

Attributes

Usage

If you use the query action, cfldap creates a query object, allowing access to information in the query variables, as follows:

If you use the security="CFSSL_BASIC" option, ColdFusion determines whether to trust the server by comparing the server's certificate with the information in the jre/lib/security/cacerts keystore of the JRE used by ColdFusion MX. The ColdFusion MX default cacerts file contains information about many certificate granting authorities. If you must update the file with additional information, you can use the keytool utility in the ColdFusion jre/bin directory to import certificates that are in X.509 format. For example, enter the following:

keytool -import -keystore cacerts -alias ldap -file ldap.crt -keypass bl19mq

Then restart ColdFusion MX. The keytool utility initial keypass password is "change it". For more information on using the keytool utility, see the Sun JDK documentation.

Characters that are illegal in ColdFusion can be used in LDAP attribute names. As a result, the cfldap tag could create columns in the query result set whose names contain illegal characters and are, therefore, inaccessible in CFML. In ColdFusion, illegal characters are automatically mapped to the underscore character; therefore, column names in the query result set might not exactly match the names of the LDAP attributes.

For usage examples, see ColdFusion MX Developer's Guide.

Example

<h3>cfldap Example</h3>
<p>Provides an interface to LDAP directory servers. The example uses the 
University of Connecticut public LDAP server. For more public LDAP servers,
see <a href="http://www.emailman.com">http://www.emailman.com</a>.</p>
<p>Enter a name and search the public LDAP resource. 
An asterisk before or after the name acts as a wildcard.</p>
<!--- If form.name exists, the form was submitted; run the query. --->
<cfif IsDefined("form.name")>
   <!--- Check to see that there is a name listed. --->
   <cfif form.name is not "">
      <!--- Make the LDAP query. --->
      <cfldap 
          server = "ldap.uconn.edu"
          action = "query"
          name = "results"
          start = "dc=uconn,dc=edu"
          filter = "cn=#name#"
          attributes = "cn,o,title,mail,telephonenumber"
          sort = "cn ASC">
      <!--- Display results. --->
      <center>
      <table border = 0 cellspacing = 2 cellpadding = 2>
         <tr>
            <th colspan = 5>
               <cfoutput>#results.recordCount# matches found
               </cfoutput></TH>
         </tr>
         <tr>
            <th><font size = "-2">Name</font></TH>
            <th><font size = "-2">Organization</font></TH>
            <th><font size = "-2">Title</font></TH>
            <th><font size = "-2">E-Mail</font></TH>
            <th><font size = "-2">Phone</font></TH>
         </tr>
         <cfoutput query = "results">
            <tr>
               <td><font size = "-2">#cn#</font></td>
               <td><font size = "-2">#o#</font></td>
               <td><font size = "-2">#title#</font></td>
               <td><font size = "-2">
                  <A href = "mailto:#mail#">#mail#</A></font></td>
               <td><font size = "-2">#telephonenumber#</font></td>
            </tr>
         </cfoutput>
         </table>
         </center>
      </cfif>
</cfif>

<form action="#cgi.script_name#" method="POST">
<p>Enter a name to search in the database.
<p>
<input type="Text" name="name">
<input type="Submit" value="Search" name="">
</form>

ColdFusion MX 7 | ColdFusion MX 6.1 | ColdFusion MX | Forums | Developer Center | KnowledgeBase | Bug Reporting

Version 7

Comments

Add Comment

eblackey101 said on Apr 12, 2005 at 3:07 PM :

You still need to update the docs to state that the timeout is in milliseconds instead of seconds. This has caused me lots of problems. Please update the docs so no one else runs into the same thing.

jrunrandy said on Apr 19, 2005 at 11:09 AM :

Good catch. I have added bug 60090 to help us track this bug.

Michael said on Jul 24, 2006 at 7:24 AM :

The documentation for CFLDAP incorrectly states the delimiter for RETURNASBINARY as a comma. The correct delimiter should be a space. This was confirmed by Chandan Kumar.

Syntax: RETURNASBINARY="objectGUID objectSID"

ksmith said on Jan 11, 2007 at 7:08 AM :

SSL v3 is not supported by CFLDAP.

postwick said on May 16, 2007 at 5:46 PM :

This tag does not support full and proper multi-clause filters. The following is a perfectly valid LDAP query filter, and it does not work in CFLDAP:

(&(objectClass=person)(!samAccountName=*$)(!samAccountName=Srvc_*)(!samAccountName=Kher*)(!samAccountName=C2K*)(!samAccountName=Khec*)(!samAccountName=Test_*)(!samAccountName=Svc-*)(!samAccountName=SVC*)(!samAccountName=_*))

In fact, simply putting in:

(!samAccountName=*$)

or:

!samAccountName=*$

...neither work, even though this is valid LDAP syntax.

Hoska said on Sep 7, 2007 at 8:56 AM :

Documentation for the scope attribute states that the default is 'onelevel' while it appears to actually be 'subtree'.

halL said on Sep 21, 2007 at 1:50 PM :

Hoska is correct, the default scope attribute is subtree.

rvoosten said on Feb 12, 2008 at 5:55 AM :

Omitting the "action" argument will thow a "java.lang.NullPointerException", whereas when omitting another argument such as "attributes" will thow a nicer human-readable error:

"When the value of the ACTION attribute is "QUERY", the tag requires the attribute(s): ATTRIBUTES."

For a minute I thought MX7 had the same CFLDAP bug as MX6 with the newer java runtime, until I realised I simply forgot the action.

RSS feed | Send me an e-mail when comments are added to this page | Comment Report

Current page: http://livedocs.adobe.com/coldfusion/7/htmldocs/00000283.htm

Add Comment