PHP ldap_connect + ldap_bind unable to bind - php

I have this PHP code:
$ldap = ldap_connect("aaa.bbbbb.cc")
or die("Could not connect to LDAP server.");
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
$ldapbind = ldap_bind($ldap);
if ($ldapbind) {
echo "LDAP bind successful...";
} else {
echo "LDAP bind failed..."; //end up here
}
And I'm unable to make it bind successfully, I have tried all sorts of combinations.
Passing credentials, using an URI with "ldap://".
The following C# code works fine when binding to the same LDAP server:
var connection = new LdapConnection("aaa.bbbbb.cc");
connection.Bind();
The LDAP API for PHP seemssomewhat hard to debug, since if bind fails, you don't get any result, so I have no idea how to see what fails, if it cant access the server, bad credentials, or something else..
So, any ideas what could cause the PHP code to fail? is there something special I need to do?
(LDAP extension is enabled for PHP)

I've had problems with PHP LDAP before.
Luckily I found this in the doc comments:
ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
Which will give you verbose output when trying to open a connection and bind.
I usually do this:
ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
$ldap = ldap_connect("ldap://" . $domainController, $port);
$bind = #ldap_bind($ldap, $username . $accountSuffix, $password);
if (!$bind) {
// throw or something
echo ldap_error($ldap); // http://php.net/manual/en/function.ldap-error.php
}
Wikipedia has a nice write up of the various parts to the LDAP protocol.

Related

Can't connect LDAP over SSL with PHP script but I can with ldp.exe

I've been stuck at this step for days.
I'm successfully connecting to my LDAP server from a client-server using LDP.exe over port 636, so I'm
connecting securely. I've configured a self-signed certificate from CA on the LDAP server and also have it placed on the client-server, which allows me to do the step above.
However, when I run my PHP script, it's unable to bind, even though ldp.exe can do it without problems. The error logs on the LDAP server shows this when I run my script:
Internal event: An LDAP over Secure Sockets Layer (SSL) connection
could not be established with a client. Client network address:
################## Protocol: TCP Additional Data Error value: 2148074277 The certificate chain was issued by an authority that is
not trusted.
Here is my code:
<?php
echo "Hello <br>";
var_dump(openssl_get_cert_locations());
// using ldap bind
$ldaprdn = "****"; // ldap rdn or dn
$ldappass = "****"; // associated password
$ldaphost = "ldaps://****************";
// connect to ldap server
$ldapconn = ldap_connect($ldaphost)
or die("Could not connect to LDAP server.");
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);
echo "$ldapconn </br>";
echo ldap_error($ldapconn);
echo "</br>";
if ($ldapconn) {
//$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
var_dump(#ldap_bind($ldapconn, $ldaprdn, $ldappass));
// verify binding
if ($ldapbind) {
echo "LDAP bind successful...";
} else {
echo "LDAP bind failed...";
}
echo ldap_error($ldapbind);
}
?>

Couldn't bind LDAP using PHP

I try to bind LDAP using PHP and I getting this error
Warning: ldap_bind() [function.ldap-bind]: Unable to bind to server: Can't contact LDAP server on line 21
and the script on line 21 is this..
$bind_status = ldap_bind($conn_status, $app_user, $app_pass);
Here's the script to connect in LDAP:
$conn_status = ldap_connect('ldaps://ldap.domain.com/', 389);
if ($conn_status === FALSE) {
die("Couldn't connect to LDAP service");
} else {
echo "Successful! <br/>";
}
Here's the script of Bind to LDAP:
$app_user = 'cn=user, dc=domain, dc=com';
$app_pass = 'password';
$username = 'user'; //same as cn
$password = 'password'; //same as $app_pass
$bind_status = ldap_bind($conn_status, $app_user, $app_pass);
if ($bind_status === FALSE) {
die("Couldn't bind to LDAP as application user");
} else {
echo "Bind to LDAP successfully <br/>";
}
My updated LDAP bind script
$bind_status = ldap_bind($conn_status, $username, $password);
if ($bind_status === FALSE) {
//die("Couldn't bind to LDAP <br/>");
echo "LDAP-Errno: " . ldap_errno($ds) . "<br />";
} else {
echo "Bind to LDAP successfully <br/>";
}
And now I got this error:
Warning: ldap_bind() [function.ldap-bind]: Unable to bind to server: Operations error on line 21
Line 21 is this:
$bind_status = ldap_bind($conn_status, $username, $password);
When I use
var_dump (#ldap_bind($conn_status, "cn=Username, ou=domain, ou=com"));
The result is
bool(false)
Pls help me to fix this. Thank you
Typically ldaps listens on port 636/tcp and ldap with starttls listens on port 389/tcp.
$ldap_URI = "ldap://ldap.example.com/" ;
$ldap_bind_dn = "cn=myapplication,ou=service accounts,dc=example,dc=com" ;
$ldap_bind_dn_password = "hopefully something long and complicated" ;
$ldap_connection = ldap_connect($ldap_URI) ;
if(ldap_start_tls($ldap_connection)){
if(!ldap_bind($ldap_connection,$ldap_bind_dn,$ldap_bind_dn_password)) ;
//TODO: return/throw some error/exception here to be handled by caller, regarding invalid credentials
}else{
ldap_close($ldap_connection);
//TODO: return/throw some error/exception here to be handled by caller, regarding starttls failure
}
Check the TLS settings of your global ldap config, usually
/etc/openldap/ldap.conf or /etc/ldap/ldap.conf.
If you use SELinux, check httpd_can_connect_ldap, i.e. $ getsebool httpd_can_connect_ldap
Also:
When OpenLDAP 2.x.x is used, ldap_connect() will always return a resource as it does not actually connect but just initializes the connecting parameters. The actual connect happens with the next calls to ldap_* funcs, usually with ldap_bind(). --php manual
In your ldap_connect method, you specified a secure ldap connection ldaps and yet used the standard port for 389. If you are trying to make a secure connection, then remove the port number and ldap_connect will figure out the right port or use port 636. Otherwise use ldap with port number 389 for the unsecure connection.
Either
$conn_status = ldap_connect('ldap://ldap.domain.com/');
$conn_status = ldap_connect('ldap://ldap.domain.com/', 389);
OR
$conn_status = ldap_connect('ldaps://ldap.domain.com/');
$conn_status = ldap_connect('ldaps://ldap.domain.com/', 636);

LDAP bind using POST variable for UID?

I am working on a login form that uses LDAP to authenticate users. However I do not know how to pass the username as a POST variable along with the DN credentials. This is working allowing me to send a password from a login form:
<?php
// using ldap bind
$ldaprdn = 'uid=my.name,cn=XXX,dc=XXX,dc=XXX,dc=XXX'; // ldap rdn or dn
$ldappass = $_POST['userPassword']; // user password
// connect to ldap server
$ldapconn = ldap_connect("server.domain.com")
or die("Could not connect to LDAP server.");
// Set some ldap options for talking to
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);
if ($ldapconn) {
// binding to ldap server
$ldapbind = #ldap_bind($ldapconn, $ldaprdn, $ldappass);
// verify binding
if ($ldapbind) {
echo "LDAP bind successful...\n";
} else {
echo "LDAP bind failed...\n";
}
}
?>
However this does not when trying to append the value contained within the POST variable to the CN and DN values.
<?php
// using ldap bind
$ldaprdn = "uid = . $_POST['userLogin'] . 'cn=XXX,dc=XXX,dc=XXX,dc=XXX'"; // ldap rdn or dn
$ldappass = $_POST['userPassword']; // user password
// connect to ldap server
$ldapconn = ldap_connect("server.domain.com")
or die("Could not connect to LDAP server.");
// Set some ldap options for talking to
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);
if ($ldapconn) {
// binding to ldap server
$ldapbind = #ldap_bind($ldapconn, $ldaprdn, $ldappass);
// verify binding
if ($ldapbind) {
echo "LDAP bind successful...\n";
} else {
echo "LDAP bind failed...\n";
}
}
?>
Can this be achieved this way? I believe I can only pass three variables using the LDAP_bind function,
Many Thanks
You are incorrectly using quotes here and have missed a comma:
$ldaprdn = "uid = . $_POST['userLogin'] . 'cn=XXX,dc=XXX,dc=XXX,dc=XXX'";
should be
$ldaprdn = 'uid =' . $_POST['userLogin'] . ',cn=XXX,dc=XXX,dc=XXX,dc=XXX';
or
$ldaprdn = "uid =$_POST['userLogin'],cn=XXX,dc=XXX,dc=XXX,dc=XXX";
Remember that using single quotes around variables will not resolve the variable to its value (and thus concatenation is required), but using double quotes will.
And on top of that: never work with user-inputted-data directly in your scripts - validate the input or at the very least use htmlentities() or strip_tags()...

ldap_bind(): Unable to bind to server: No such object

I successfully made a ldap_connect() but when I try ldap_bind() I'm getting the following message: Warning: ldap_bind(): Unable to bind to server: No such object in /var/www/... on line 25. What does this mean? I am doing something wrong or does the server has some configurations that prevent me to authenticate?
I am sure that the parameters for ldap_bind() are correct.
I solved the problem meanwhile.
The code was something like this:
$ldaphost = "ldaps://XXX";
$ldapport = YY;
$ldaprdn="uid=username,ou=OU1,ou=OU2,ou=OU3,dc=dc1,dc=dc2,dc=dc3,dc=dc4";
$ldappass="password";
// Connecting to LDAP
$ldapconn = ldap_connect($ldaphost, $ldapport)
or die("Could not connect to {$ldaphost}");
if ($ldapconn) {
// binding to ldap server
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
// verify binding
if ($ldapbind) {
echo "LDAP bind successful...";
} else {
echo "LDAP bind failed...";
}
}
I was not setting the proper organisational units(ous). The usernamewas in other ou. After setting the correct one everything was fine.

LDAP Authenticated Bind Issue - PHP, Apache, Windows

I'm having issues performing an authenticated bind against the server. The issues doesn't appear to be in code however maybe a server issue.
Just so you know;
LDAP is enabled in Apache/PHP
I'm connecting as user#domain.com
The domain controller has LDAP running and an entry in the firewall (Windows Server 2008 R2)
I can perform an anonymous bind
I can bind anonymously using this script;
$ldapconn = ldap_connect("machinename.domain.com")
or die("Could not connect to LDAP server.");
if ($ldapconn) {
// binding anonymously
$ldapbind = ldap_bind($ldapconn);
if ($ldapbind) {
echo "LDAP bind anonymous successful...";
} else {
echo "LDAP bind anonymous failed...";
}
}
However when I try to do an authenticated bind using this script, it fails.
// Authenticated Bind
$ldaprdn = 'username#domain.com'; // ldap rdn or dn
$ldappass = 'password'; // associated password
// connect to ldap server
$ldapconn = ldap_connect("machinename.domain.com")
or die("Could not connect to LDAP server.");
if ($ldapconn) {
// binding to ldap server
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
// verify binding
if ($ldapbind) {
echo "LDAP bind successful...";
} else {
echo "LDAP bind failed...";
}
}
Where am I going wrong?
May your LDAP requires a DN as login. For retrive the DN make a search of the user uid first.
$search = ldap_search($ldapconn, $baseDn, $filter, $attributes);
if ($search) {
$entries = ldap_get_entries($ldapconn, 'uid=' . $ldaprdn);// Here $ldaprdn is the email
if (is_array($entries)) {
$ldaprdn = $entries[0]['dn']; // Get the DN of the user
}
}
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
// ....
NOTE: You should escape $ldaprdn for avoid LDAP injection attacks.
Okay, after much investigation I have turned on error info using ldap_errno() and ldap_error() and found it bringing back the error 'Strong(er) authentication required' have discovered two possible solutions;
Adjust Group Policy Settings
Negotiate Signing (Network security: LDAP client signing requirements)
No signing requirements (Domain Controller: LDAP server signing requirements)
Result: Managed to bind successfully and when I enter the username or password incorrectly and it throws an 'Invalid credentials' as expected.
Enable LDAP over SSL (LDAPS)
http://www.christowles.com/2010/11/enable-ldap-over-ssl-ldaps-on-windows.html
http://support.microsoft.com/kb/321051

Categories