Authenticating users from a certain group ldap active directory

Question

I want only a (faculty) group of users to be able to access a certain web page on my website.

This page is only meant to be seen by faculty.

Within active directory, we have a group called "faculty"

Here is a snippet of code I have to authenticate users via ldap/active directory, but I want to only authenicate users that are within the faculty group.

$ldap = ldap_connect("ldap.domain.com")
if($bind = ldap_bind($ldap, $_POST['username'], $_POST['password'])) {
  // log them in!
} else {
  // error message
}

Answer 1

AD stores the Member list on Groups, not the Group Membership on users, so you would have to retrieve the cn=faculty,ou=whatever,dc=acme,dc=com objects Member list, and see if this user is listed. If they are, then let them try and bind, which if it succeeds continue.

I would test for the group membership before testing the bind, since a bind is usually more expensive than a query.