title: Using LDAP functions to get Active Directory tokenGroups attribute in PHP
body: <p>Greetings,</p>
  
  <p>I already have a working connection to the AD and can search and retrieve information from it.  I've even developed a recursive method by which one can retrieve all groups for a given user.  However, I'd like to avoid the recursion if possible.  One way to do this is to get the tokenGroups attribute from the AD for the user, which should be a list of the SIDs for the groups that the specified user has membership, whether that membership be direct or indirect.</p>
  
  <p>When I run a search for a user's AD information, though, the tokenGroups attribute isn't even in it.  I tried specifically requesting that information (i.e., specifying it using the fourth parameter to <a href="http://us.php.net/manual/en/function.ldap-search.php" rel="nofollow noreferrer">ldap_search</a>) but that didn't work, either.</p>
  
  <p>Thanks,
  David Kees</p>
  
  <hr>