ldap_modify: no way to unset single valued attribute any more

[ralfbecker]

Description

The following code:

<?php
$ds = ldap_bind(...);
$dn = '....';
$entry = ['personalTitle' => []]))
try {
   if (ldap_modify($ds, $dn, $entry)) {
       echo "success";
   }
}
catch (\ValueError $e) {
   echo $e->getMessage();
}

Resulted in this output:

ldap_modify(): Argument #3 ($entry) attribute "url" must be a non-empty list of attribute values

But I expected this output instead:

success

Using an empty array is the documented way to unset both single- and multi-valued attributes.
Trying NULL for single-valued attributes also gives a php-side validation error, so this is also not working.

It was nice to have a way to unset attributes without knowing if they are single- or multi-values, but I could also live with two separate ways, thought there should be at least one (documented) way to unset single-valued attributes with ldap_modify too.

PHP Version

PHP 8.5.3 (cli) (built: Feb 13 2026 15:52:21) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.5.3, Copyright (c) Zend Technologies
    with Xdebug v3.5.0, Copyright (c) 2002-2025, by Derick Rethans
    with Zend OPcache v8.5.3, Copyright (c), by Zend Technologies

Operating System

Ubuntu 24.04 in a Docker container

[ralfbecker]

Wired thing the above mentioned error is also given when I set multi-valued attributes like ActiveDirectory's "description" to an empty array().
I also tried setting an empty string "" instead, that triggers no php-side validation errors, but an LDAP server-side error :(
I'll try downgrading PHP now, so see when that was broken.
Ralf

[ralfbecker]

Ok, unsetting single- or multi-values attributes via setting them to an empty array still work with the latest PHP 8.4:

PHP 8.4.18 (cli) (built: Feb 13 2026 15:52:15) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.18, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.18, Copyright (c), by Zend Technologies
    with Xdebug v3.5.0, Copyright (c) 2002-2025, by Derick Rethans

Ralf

[sircubbi]

I too justed stumbled over this problem after updating our systems from PHP 8.3 to 8.5 yesterday. There is no mention of this change in the release notes, so I didn't catch the problem beforehand.

Reviewing the code this change was introduced in 9e91810 some 16 months ago. That commit mentions no reason for the change, nor was the documentation updated.

[sircubbi]

null-values are not allowed (by PHP-validation), empty-strings don't work (by LDAP-validation) and an array with any empty-string also not (by LDAP-validation).

However, while trying with null I got this error: TypeError: LDAP value must be of type string|int|bool, null given. So it seems a boolean is possible. And from my first testing setting the value to false actually seems to work.