XAMPP Needs Strong(er) Authentication When Using LDAP - php

Question

I am doing some initial tests on my website to allow domain users to login to it using a ldap_bind. I am running this simple test with a form to send the username and password.
$ldapconn = ldap_connect("ldap://DC01.DOMAIN.NET") or die ("Could Not Connecet to LDAP Server");
if ($ldapconn) {
$ldapbind = ldap_bind($ldapconn, $user, $password);
if ($ldapbind) {
echo "Bind Success";
}
else {
echo "Bind Failure";
}
When I pass a valid username and password I get the following error: **Warning**: ldap_bind(); Unable to bind to server: Strong(er) authentication required... Bind Failure
I am currently running 7.4.12. Server the XAMPP is running on has a valid certificate for the domain. What am I missing?

Answer 1

Ok so it sounds like you need to connect using TLS.
There are two ways to use TLS for LDAP connections: LDAPS and StartTLS. That you're getting a response on regular port 389 means StartTLS is likely to be supported.
So the first thing to do is to set the protocol version. Then you need to tell it to initiate a TLS handshake.
So your example above would become something like this:
$ldapconn = ldap_connect("ldap://DC01.DOMAIN.NET") or die ("Could Not Connecet to LDAP Server");
if ($ldapconn) {
if (! ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3)) {
die("Cannot set protocol v3");
}
if (! ldap_start_tls($ldapconn)) {
die("Cannot initiate TLS");
}
$ldapbind = ldap_bind($ldapconn, $user, $password);
if ($ldapbind) {
echo "Bind Success";
}
else {
echo "Bind Failure";
}
}
This assumes the server running PHP already trusts the CA that signed the LDAP server's certificate. If not, you'll also need to get the CA Cert, and either put it in the system trust store, or tell php to use it explicitly, before the call to ldap_start_tls:
ldap_set_option(LDAP_OPT_X_TLS_CACERTFILE, '/path/to/cacert.file');