How to get authorized user in ldap using php? - php

I want to use my system login password to php login page. So that i used the LDAP concept in my project. I have mentioned below my coding, that is everything fine. But When i run this code, the result shows "Invalid user". I don't know why this was showing wrongly.
$ldaphost = 'abc.co.in';
$ldapport = '389';
$username = '4444';
$password = '4444pass';
$ldap = ldap_connect($ldaphost, $ldapport)
or die("Could not connect to $ldaphost");
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
$user = "uid=$username,dc=abc,dc=co,dc=in";
$bind = #ldap_bind($ldap, $user, $password);
if ($bind) {
echo "<br />Valid user";
} else {
$msg = "<br />Invalid user";
echo $msg;
}
Below the result:
What is fault in my code or i need to anything add?
Please find and solve this request. That will more helpful to me.
Thank you advance...

This is how my ldap thing works. change your ldap host to be either "ldap://abd.asd.co:389' or "ldaps://asd.basd.co:636".
function verify_user() {
$user = $_REQUEST['user'];
$passwd = $_REQUEST['pass'];
// Bind to LDAP to check is user is valid
$server = "ldaps://ldap.server.com:636";
$dn = "uid=$user, ou=People, ou=something, dc=other, dc=whatever";
// Create a fake password if needed to keep people from anonymously
// binding to LDAP
if($passwd == '') { $passwd = "p"; }
$ldap = ldap_connect($server) or die("Can't connect to LDAP server!");
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_start_tls($ldap);
if($ldap) {
$bnd = #ldap_bind($ldap, $dn, stripslashes($passwd));
if(!$bnd) {
sleep(5);
echo "<br>Error: Bad Username or Password!<br>";
exit;
}
}
header("Location: {$_REQUEST['url']}"); /* Redirect browser */
exit;
}

Related

Issue connecting to LDAP through PHP

My company recently changed domains due to an ownership change and I am having an issue getting my LDAP bind to complete on the new domain.
My connect command creates the resource correctly but when I go to bind I get the error.
"Warning: ldap_bind(): Unable to bind to server: Strong(er) authentication required"
I am not using ldaps. I have confirmed I have the correct domain url for LDAP.
$ad is the resource, $dmun is the username with domain added and the $pw is the password.
$bd = ldap_bind($ad,$dmun,$pw);
It's an intranet site.
Try This code. This code worked for me
$username = 'username';
$password = 'password';
$ldap_host = "domain.com";
$ldap_port = 389;
$base_dn = "DC=domain,DC=com";
$filter = '(sAMAccountName=' . $username . ')';
$connect = ldap_connect($ldap_host, $ldap_port) or exit("Error : Could not connect to LDAP server.");
if ($connect) {
ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($connect, LDAP_OPT_REFERRALS, 0);
if (#$bind = ldap_bind($connect, "$username#domain.com", $password)) {
echo "Bind Successfull";
} else {
echo "Invalid Username / Password";
}
}

Retrieve full name from ldap AD

This is my LDAP code to authenticate a user. I have to show users full name once the user had logged in. How do I get the full name of the user from AD?
<?php
FUNCTION ldapCheckLogin ($username, $upasswd) {
$ldaphost = '10.20.30.40';
$ldapport = 389;
$ds = ldap_connect($ldaphost, $ldapport)
or die("Could not connect to our login server!");
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
if ($ds)
{
//$username = 'na\'; //OK - Congratulations! na\spups is authenticated.
$upname = 'iap\\' . $username;
$ldapbind = #ldap_bind($ds, $upname, $upasswd);
if ($ldapbind) {
//print "Congratulations! $username is authenticated.<BR><BR>";
ldap_unbind( $ds );
return true;
} else { //print "$username - Access Denied!<BR><BR>";
return false;
}
} else {
return false;
}
}
?>
You need to retrieve the user's entry using ldap_search with the user's samAccountName e.g. (samaccountname=$username) or userPrincipalName e.g. (userprincipalname=$username . "#" . $domain.com ) as the filter attribute.
samaccountname is only unique in the domain whereas userPrincipalName is unique across the entire forest.
When you perform the ldap_search you need to include the cn or displayName in the attributes to return.
If the search is successful then you need to process the resulting entry and extract the cn and/or the displayName.

LDAP authentication in PHP

I'm trying to implement some code from these pages but unsuccessfully.
I need to do ldap authentication from php and have this code:
<?php
$ldap['user'] = "tester";
$ldap['pass'] = "test";
$ldap['host'] = '147.32.99.8';
$ldap['port'] = 636;
$ldap['conn'] = ldap_connect( $ldap['host'], $ldap['port'] )
or die("Could not conenct to {$ldap['host']}" );
$ldap['bind'] = ldap_bind($ldap['conn'], $ldap['user'], $ldap['pass']);
if( !$ldap['bind'] )
{
echo ldap_error( $ldap['conn'] );
exit;
}
echo "<p>";
echo ($ldap['bind'])? "Valid Login" : "Login Failed";
echo "</p><br />";
ldap_close( $ldap['conn'] );
?>
But it doesn't work. I'm almost sure that in user name is missing domain. But where can I find domain? I have only IP address.
From Softera ldap browser I have following informations:
URL: ldaps://147.32.99.8:636/cn=tester,ou=staff,ou=uceeb,o=cvut
Maybe there is another mistake not only missing domain but I'm really LDAP beginner.
Thank you for any reply that will help me.
This code sometimes works:
function authUserAD($username, $password, $ldap_server="147.32.99.8") {
$auth_user = $username;
if($connect = ldap_connect($ldap_server)){
ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($connect, LDAP_OPT_REFERRALS, 0);
if(ldap_bind($connect, $auth_user, $password)) {
ldap_close($connect);
return(true);
}
}
ldap_close($connect);
return(false);
}
if(authUserAD("cn=tester,ou=staff,ou=uceeb,o=cvut", "test")) echo "<p>Login/password OK.</p>";
else echo "<p>Connection error.</p>";
But in LDAP administration I have to change the value of Require TLS for simple links with password to NO and after that again back to YES. After this two operations it works. But how to do it without this strange operation.

PHP & IIS: LDAPS Connection for Password Change

My aim is to change passwords in Active Directory through a web interface using PHP & IIS.
I have been following the instructions on http://www.ashleyknowles.net/2011/07/iis-php-and-ldaps-with-active-directory/
Prior to following these instructions I could not get a bind to the AD for an LDAPS connection, however after following these instructions it seems to successfully connect, yet gives an error of "Server is unwilling to perform" when I attempt to change the "unicodePwd" value.
Please note that the code below will successfully change any other value of a user in the AD.
<?php
$ldaprdn = 'CN=Admin User,OU=*******,OU=Staff,OU=********,DC=********,DC=*******,DC=******,DC=*****';
$ldappass = "*******"; // associated password
$ldapconn = ldap_connect("ldaps://***.***.***.***:636" ) or die("Could not connect to LDAP server.");
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);
if ($ldapconn) {
// binding to ldap server
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
// verify binding
if ($ldapbind) {
echo "LDAP bind successful...";
$username = '******';
$dn = "CN=Bob Smith,OU=******,OU=******,OU=******,DC=******,DC=******,DC=******,DC=******";
$newPassword = 'blah';
$newEntry = array('unicodePwd' => encodePwd($newPassword));
print_r($newEntry);
if(ldap_mod_replace($ldapconn, $dn, $newEntry)) {
print "<p>succeded</p>";
} else {
print "<p>failed</p>";
}
print_r(ldap_error($ldapconn));
} else {
echo "LDAP bind failed...";
print_r(ldap_error($ldapconn));
}
}
// Credit: http://www.cs.bham.ac.uk/~smp/resources/ad-passwds/
function encodePwd($pw) {
$newpw = '';
$pw = "\"" . $pw . "\"";
$len = strlen($pw);
for ($i = 0; $i < $len; $i++)
$newpw .= "{$pw{$i}}\000";
$newpw = base64_encode($newpw);
return $newpw;
}
?>
SOLVED!!
It turns out that by following the Ashley Knowles tutorial, I was successfully establishing a SSL connection over LDAP, however the error was occurring because of the password encoding.
The credit for the successful password encoding goes to hd42 on this forum post, which enabled me to modify my code accordingly.
Therefore, once you have correctly installed the certificates etc in the harddrive on the IIS server, this code will successfully modify a user password in Active Directory using PHP through an IIS web server (assuming that the $ldaprdn user has sufficient admin rights):
<?php
$ldaprdn = 'CN=Admin User,OU=*******,OU=Staff,OU=********,DC=********,DC=*******,DC=******,DC=*****';
$ldappass = "*******"; // associated password
$ldapconn = ldap_connect("ldaps://***.***.***.***:636" ) or die("Could not connect to LDAP server.");
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);
if ($ldapconn) {
// binding to ldap server
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
// verify binding
if ($ldapbind) {
echo "LDAP bind successful...";
$dn = "CN=Bob Smith,OU=******,OU=******,OU=******,DC=******,DC=******,DC=******,DC=******";
$newPassword = 'blah';
$newPassword = "\"" . $newPassword . "\"";
$newPass = mb_convert_encoding($newPassword, "UTF-16LE");
$newEntry = array('unicodePwd' => $newPass);
print_r($newEntry);
if(ldap_mod_replace($ldapconn, $dn, $newEntry)) {
print "<p>succeded</p>";
} else {
print "<p>failed</p>";
}
print_r(ldap_error($ldapconn));
} else {
echo "LDAP bind failed...";
print_r(ldap_error($ldapconn));
}
}

PHP LDAP authentication NOT WORKING

I am trying to implement LDAP authentication into our company web portal. I can successfully connect to the host, but I cannot seem to get a successful bind with my Active Directory credentials. Looking for some help on what could possibly be going wrong. Any help, tips, or advice would be greatly appreciated.
$username = $_POST['username'];
$password = $_POST['password'];
$host = "xxx.xxx.xxx.xxx";
$port = "389";
$connection = ldap_connect($host, $port) or die("Could not connect to LDAP server.");
ldap_set_option($connection, LDAP_OPT_PROTOCOL_VERSION, 3);
if ($connection) {
$bind = ldap_bind($connection, $username, $password);
if ($bind) {
echo "LDAP bind successful";
}
else {
echo "LDAP bind failed";
}
}
I had the same problem recently enough and the solution was to add the domain to the username.
$isAuth = ldap_bind($ldap_conn,$_POST['username'].$ldap_settings['adDomain'], $_POST['password']);
Where $ldap_settings['adDomain'] was "#your_domain"

Categories