LDAP in PHP get current user details - php

I can authenticate using AD and PHP my problem is I got no idea how to get the current user displayname or cn details. This Sample code from php.com worked well for autheticating but now I need the details Anyone help?
// using ldap bind
$ldaprdn = 'uname'; // ldap rdn or dn
$ldappass = 'password'; // associated password
// connect to ldap server
$ldapconn = ldap_connect("ldap.example.com")
or die("Could not connect to LDAP server.");
if ($ldapconn) {
// binding to ldap server
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
// verify binding
if ($ldapbind) {
echo "LDAP bind successful...";
} else {
echo "LDAP bind failed...";
}
}

Transmit a search request to the server and interpret the response. A search request (encapsulated in PHP by ldap_search) consists of the following at a minimum:
a base object (or base DN in some documentation): no objects superior to the base DN ail be considered of the search result
a search scope: one, subtree, or base: the depth of the search
a filter: used to filter (narrow) the result pool
requested attribues: this is where the LDAP client should put cn, displayName, and any other attributes needed for processing:
see also
LDAP: Mastering Search Filters
LDAP: Search best practices
LDAP: Programming practices

Before authenticating, store the values to be authenticate into session variables. If authentication success use the session values to display.
If authentication fails, clear the session values and try to submit the login form again.
Following is the sample code to assign the values into session variable in ZF2:
$session = new Container('base');
$this->session->offsetSet('username', $username);
and to get the session value:
$sesUserName = $this->session->offsetGet('username');
I hope this helps.

Related

Authenticating against LDAP with ApacheDS and PHP

I'm wondering how to authenticate against ApacheDS in PHP. I keep getting a "Invalid Credentials" when I try to log on as a user in a group. I can log in as "uid=admin,ou=system" just fine, but if I try "uid=,ou=consumers,ou=system", it returns "Invalid Credentials".
It is important to note that this is not the full DN of the entry. It's more like "uid=...+gn=...+...,ou=consumers,ou=system". I can search and find this value just fine when bound to the administrator and the API account.
How do I bind to a user just to authenticate and retrieve information on them (like the rest of their attributes and the children of their entry? Here's what I'm doing and failing.
$dn = ldap_connect($serveraddress,10389);
$bn = ldap_bind("uid=".$user.",ou=consumers,ou=system");
var_dump($bn);
var_dump(ldap_error($dn);
Thank you for any help you can provide.
Edit: So I've gotten farther. Why is this a protocol error?
$ds=ldap_connect("192.168.1.126",10389); // must be a valid LDAP server!
if ($ds) ldap_bind($ds,"uid=apiaccess,ou=system",...);
else die("!Can't connect to server");
$userid = md5($user);
$results = ldap_get_entries($ds,ldap_search($ds,"ou=consumers,ou=system","(uid=".$userid.")"));
$result = $results[0]["dn"];
echo $result;
if ($ds) ldap_bind($ds,$result,$pass);
else die("!Can't connect to server");
var_dump(ldap_error($ds));
You need to tell PHP to use LDAPv3.
Before you call ldap_bind, add the following call:
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);

LDAP Authentication in PHP - Authenticated without giving a password

I'm getting a strange behavior on my LDAP Authentication, I need this to authenticate users with their AD credentials, this is what I have:
session_start();
$adServer = "MY IP";
$ldapconn = ldap_connect($adServer) or $this->msg = "Could not connect to LDAP server.";
$ldaprdn = "DOMAIN\\" . $_POST["username"];
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $_POST["password"]);
if ($ldapbind) {
//$msg = "Successfully Authenticated";
$_SESSION['loggedin'] = 1;
$_SESSION['username'] = $username;
header("Location: ../main.php");
} else {
header("Location: ../index.php?login_failed=1");
}
This is the different behaviors I get:
No username / No Password = authenticated (BAD)
Username / No Password = authenticated (BAD)
Incorrect Username/Password (both fields were given) = not authenticated
Correct Username/Password (both fields were given) = authenticated
I find this hard to muster, all users are being validated if the password field is not being used. But if I do use the password field it only authenticates users with the correct credentials..
Am I doing something wrong here or should I start nagging the IT people?
After doing some research, I reached a conclusion that the LDAP server we are using allows anonymous binds.
More info here:
https://issues.jfrog.org/jira/browse/RTFACT-3378
WARNING: An attempt to bind with a blank password always succeeds
because the LDAP protocol considers this to be an "anonymous" bind,
even though a username is specified. Always check for a blank password
before binding.
In order to go around this, I now check the password input field in PHP:
if (strlen(trim($user_pass)) == 0) {
//login failed
} else {
$ldaprdn = "DOMAIN\\" . $_POST["username"];
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $_POST["password"]);
}
An empty password input (or whitespaces) will always return a login fail.
Using the 'simple' BIND authentication method, there are four possibilities:
null DN, null password (anonymous): no authentication takes place, therefore this session and authorization state are not safe
DN, null password (unauthenticated): no authentication takes place, therefore this session and authorization state are not safe
DN and password: authentication takes place and either succeeds or fails
null DN, password: no authentication takes place, therefore this session and authorization state are not safe
The 3d is the only one in which authentication takes place. Properly configured LDAP directory servers will reject the other 3 possibilities because, contrary to what the question states, authentication does not take place. A method of an API not throwing an exception or returning true does not indicate whether authentication took place. The BIND result contains an integer result code which indicates that authentication was successful or not.
see also
LDAP: authentication best practices
LDAP: programming practices
Before you nag the IT people, check if the value passed in the line
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $_POST["password"]);
Is correct, you have probably checked this already, but do a
var_dump($ldaprdn);
var_dump($_POST["password"]);
and see if the data is accurate.
Manually put the data like
$ldapbind = ldap_bind($ldapconn, "username", "password");
Also check if you have to give the entire DN, such as CN=Username,DC=xxx,DC=com for the username.
Also sometimes you have to give the name such as "User Name", rather than "user.name" because this is how it might be stored.
If all this fails, you can go eat the head of the IT people :-P

PHP ldap_bind() authentication - error Unable to bind to server: Invalid credentials?

I'm trying to authenticate a user with LDAP using PHP. I have the DN for the user which I have checked to be correct. I also have a password. This is the correct password for the user when they authenticate with SamAccountName.
I am hoping this is the password to use when authenticating with the DN. There isn't a Distinguished Name specific password for LDAP is there? The following is my code to authenticate using PHP's ldap_bind() function. Am I doing this correct?
$ldaphost="ldap://somehost.com:3268";
$dn = "cn=LastName\, FirstName Dept/Country/ext,OU=Accounts,OU=Location,ou=Division,";
$basedn="dc=abc,dc=enterprise";
if (!($connect = ldap_connect($ldaphost))) {
die ("Could not connect to LDAP server");
}
$ldapbind = ldap_bind($connect, "$dn" . "$basedn", $password);
if ($ldapbind) {
echo "LDAP bind successful...";
} else {
echo "LDAP bind failed...";
}
The result I get from the above code is :
Warning: ldap_bind() [function.ldap-bind]: Unable to bind to server:
Invalid credentials LDAP bind failed...
From the line where ldap_bind() call is made:
$ldapbind = ldap_bind($connect, "$dn" . "$basedn", $password);
Invalid credentials makes me believe there is something wrong potentially with the DN or password. I have triple checked the DN and there is not an error there as far as I can see.
Any ideas?
I guess you are connecting to a Microsoft Domain, you can try the domain syntax for the credentials then. For User015 in DOMAIN - DOMAIN\user015
When ever dealing with ldap I always find jxplorer useful

Connecting flex/php to Active Directory

Is there a way to connect my flex web application to Active Directory, and get the logged username?
Right now we have a PHP script connected to the flex application, that gets user/pass input from the user and checks if there's such user in the AD, and that the password is correct.
I don't want to ask for user/pass, but to make the application get the domain username that connected to it, so I could use it (check if the user has access to my application and such).
Is there a way to do so?
<?php
// using ldap bind
$ldaprdn = 'uname'; // ldap rdn or dn
$ldappass = 'password'; // associated password
// connect to ldap server
$ldapconn = ldap_connect("ldap.example.com")
or die("Could not connect to LDAP server.");
if ($ldapconn) {
// binding to ldap server
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
// verify binding
if ($ldapbind) {
echo "LDAP bind successful...";
} else {
echo "LDAP bind failed...";
}
}
?>
When your application is launched, you need to access the LDAP with the windows login credentials.
`AUTH_USER` request variable is the one which you have to check.
This will hold your Windows login username and AUTH_USER will be
MYDOMAINNAME\user.name
The username/password I need for this,
is that admin credentials, or any user
on the system?
You can get the username alone, not the password... when the user logs into his window's machine, we can check his credentials using Environment.username in C# and in PHP we can use AUTH_USER to verify the user logged in is valid.
Plus, do you know where can I find a
list of variables (like auth_user) of
which information can I get?
http://in3.php.net/manual/en/ref.ldap.php
You can get a lot of information from the above link.

Authenticating user using LDAP from PHP

My project is to make a module enrollment system for our university. So I contacted the IT people in my university for details to authenticate the students into the system. We are developing the system using the existing university login. They gave me some LDAP information, I don't know the usage of that.
I'm using PHP,Mysql on an Apacha server.
How can I authenticate a user logging into my system, given his userid and password with the LDAP information.
Given below is the LDAP information(i have changed the domain name etc.)
LDAP information for blueroom.ac.uk domain
LDAP Host : ad.blueroom.ac.uk
LDAP port no: 389
BASE DN : ou=bluebird, dc=bluebird, dc=ac, dc=my
LDAP account to bind : cn = kikdap, ou=servacc, dc=bluebird,dc=ac,dc=uk
LDAP account password : ********
Attribute : sAMAccountName
The general procedure would be (relevant ext/ldap php commands in brackets):
connect to LDAP server using the "LDAP Host" and "LDAP port no" (ldap_connect()) and set the correct connection options (ldap_set_option()), especially LDAP_OPT_PROTOCOL_VERSION and LDAP_OPT_REFERRALS
bind to LDAP server using the "LDAP account to bind" and "LDAP account password" (ldap_bind()) - if you're authenticating against an Active Directory server you can directly use the username and password from the login page and skip all the following steps.
search the tree for a matching user entry/object by specifing the "BASE DN" and the appropriate LDAP filter - most likely something like (&(objectClass=user)(sAMAccountName=%s)) where %s should be replaced by the username to be authenticated (ldap_search())
check if the number of returned entries is 1 (if <> 1 then something has gone wrong, e.g. no user found or multiple users found)
retrive the distinguished name (DN) of this single entry (ldap_get_dn())
use the DN found in the last step to try to bind to the LDAP server with the password given at the authentication page (ldap_bind())
if the bind succeeds then everything is OK, if not, most likely the password is wrong
It's really not as hard as it sounds at first. Generally I'd propose to use some sort of standard library for authenticating against a LDAP server such as the Net_LDAP2 PEAR package or Zend_Ldap out of the Zend Framework. I have no experience with actually using Net_LDAP2 (although I know the code quite well) but Zend_Ldap works very well against Active Directory servers or ADAMS servers (which is obviously what you're working with).
This will do the trick using Zend_Ldap:
$options = array(
'host' => 'ad.blueroom.ac.uk',
'useStartTls' => true,
'accountDomainName' => 'blueroom.ac.uk',
'accountCanonicalForm' => 4,
'baseDn' => 'ou=bluebird,dc=bluebird,dc=ac,dc=my',
);
$ldap = new Zend_Ldap($options);
try {
$ldap->bind('user', 'password');
} catch (Zend_Ldap_Exception $e) {
// something failed - inspect $e
}
// bind successful
$acctname = $ldap->getCanonicalAccountName('user', Zend_Ldap::ACCTNAME_FORM_DN);
You might try http://code.activestate.com/recipes/101525/ while referring to http://us3.php.net/ldap and other results from a Google search for [php ldap authentication].
#Stephen provided good points. Here is my plain PHP code to authenticate using AD:
first you need to know this parameters: server host, user domain (you need also base dn if you want query AD).
use the following code:
$ldap = ldap_connect($host); // e.g. 165.5.54.6 or an URL
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); // Recommended for AD
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
$bind = ldap_bind($ldap, $username.'#'.$userDomain, $passwrod);
if($bind){
// successful authentication.
}
you could use http://pear.php.net/package/Net_LDAP2/docs
it's nice and works.
Example of connection taken by the doc:
// Inclusion of the Net_LDAP2 package:
require_once 'Net/LDAP.php';
// The configuration array:
$config = array (
'binddn' => 'cn=admin,ou=users,dc=example,dc=org',
'bindpw' => 'password',
'basedn' => 'dc=example,dc=org',
'host' => 'ldap.example.org'
);
// Connecting using the configuration:
$ldap = Net_LDAP2::connect($config);
// Testing for connection error
if (PEAR::isError($ldap)) {
die('Could not connect to LDAP-server: '.$ldap->getMessage());
}

Categories