INFO: I am trying to authenticate and adLDAP
PROBLEM: adLDAP telling me "User authentication unsuccessful"
QUESTION: How do I find out what I need to do when there are no errors telling me what handle this.
SEARCHED/TRIED:
http://adldap.sourceforge.net/faq.php
stackoverflow.com/questions/2465260/using-adldap-php-class-but-getting-error-when-looking-for-group-user-belongs-to
adldap.sourceforge.net/wiki/doku.php?id=documentation_examples#authenticating_a_user
http://phreek.org/blog/2011/12/enable-php-ldap-module-in-xampp
CODE:
require_once(dirname(__FILE__) . '/adLDAP.php');
$adldap = new adLDAP();
$username = "user";
// $username = "domain\user"; // I have also tried
$password = "pass";
$authUser = $adldap->authenticate($username, $password);
if ($authUser == true) {
echo "User authenticated successfully";
}
else {
echo "User authentication unsuccessful";
}
echo('<hr />');
$result=$adldap->user_info("jboyle");
print_r($result);
HTML OUTPUT:
User authentication unsuccessful
Fatal error: Call to undefined method adLDAP::user_info() in C:\xampp\htdocs\adLDAP\compare.php on line 18
Replace:
echo "User authentication unsuccessful";
with
echo "Username '{$username}' login failed: ".$adldap->getLastError();
Result:
Username 'user' login failed: Can't contact LDAP server
Info/sources:
https://sourceforge.net/projects/adldap/forums/forum/358759/topic/1719128?message=4368835
http://adldap.sourceforge.net/wiki/doku.php?id=ldap_over_ssl#tell_apache_how_to_use_ldaps
Do a phpinfo() and check where the HOME variable points to in the Apache environment. Create a symbolic link or copy ldap.conf to this location.
If you get a connect error may be because your local OpenSSL installation doesn't recognise the certificate (or its authority) provided by the server. This can be circumvented by adding the following line to ldap.conf on your server or similar:
Change TLS_REQCERT allow to TLS_REQCERT never
Apache must be able to read ldap.conf, you cannot skip this step.
Related
I am trying to establish connection using sftp class
my code:
$host = 'some ip address';
$username = 'username';
$pass = 'password';
$sftp = new SFTPConnection($host, 22);
$sftp->login($username, $pass);
When i run this script i get message Could not authenticate with username and password
When i use same user and pass in fileZilla with sftp, then is ok, I can establish connection, but with script i cant
Anyone know what is the problem?
Ok, here what was the problem...
My IP address wasnt been allowed on FTP server?! Now when they put my IP on whitelist, everything working just fine.
Thank you guys for your effort.
Try to add this code in your sftp.php in login(){} function. Then tell what error does it give:
if (!extension_loaded('ssh2'))
{
throw new Exception("Extension ssh2 has to be loaded to use this class. Please enable in php.ini.");
}
if (! #ssh2_auth_password($this->connection, $username, $password))
throw new Exception("Could not authenticate with username $username " . "and password $password.");
$this->sftp = #ssh2_sftp($this->connection);
if (! $this->sftp)
throw new Exception("Could not initialize SFTP subsystem.");
Edit your code to do the following[ as some people say that we should authenticate both via username_password and as well as hostKeyAuthentication ]
-------------------------------
The above description shows that:
The issue lies in the php extension assuming that you’re going to authenticate either with a password or with a public key. Because of that assumption, authenticating with a password will give you a failure and could throw you off into the wrong direction (brief description is in the link: Must Read).
$connection = ssh2_connect($host, $port);
ssh2_auth_password($connection, $username, $password);
if (ssh2_auth_pubkey_file($connection, $username, $pubkey, $privatekey)) {
echo "Public Key Authentication Successful";
}
else {
echo 'Public Key Authentication Failed' ;
return false;
}
I have serious trouble figuring out which credentials to use to connect to the ad in php.
I can connect successfully using ldp.exe with generic function type and the right domain, user, and password. With any other option set in ldp.exe I can only connect anonymous.
In php I have no chance. I'm not very familiar with ldap, so I am kinda lost here.
Here some php code:
$ldap_host = "ldap://<dc>:389";
$ldap_user = "<username>";
$ldap_pw = "<pw>";
$ldap_domain = "<full domain>";
$connection = ldap_connect($ldap_host) or die("Could not connect to LDAP server.");
//$user = $ldap_user;
$user = $ldap_user."#".$ldap_domain;
//$user = $ldap_user;
//$user = "uid=".$ldap_user;
//$user = $ldap_domain."\\".$ldap_user;
//$user = "User=$ldap_user";
//$user = "cn=".$ldap_user;
//$user = "CN=".$ldap_user.",OU=<someOU>,OU=<someOU>,DC=<DC1>,DC=<DC2>";
ldap_bind($connection, $user, $ldap_pw);
You can see there some combinations I tried. In ldp.exe it is just the $ldap_user in the username field and $ldap_domain in the domain field. Imho atleast the user#domain and domain\user version should work. It is a kerberos domain, if thats important.
Well I don't think there are code errors. But how do I translate the generic function type of ldp.exe into php?
Here the error message to make it easier to find:
Warning: ldap_bind(): Unable to bind to server: Invalid credentials in ...
I would really appreciate some help.
EDIT: In ldp.exe I seem to use the SSPI method. I thought generic picks the method it self so far. Does it have something to do with ldap_sasl_bind() ? The server specifies on connection he is capable of the following:
supportedSASLMechanisms: GSSAPI; GSS-SPNEGO; EXTERNAL; DIGEST-MD5;
While only GSSAPI (SSPI ????) seems to work.
EDIT2: Here some other output of ldp.exe after an successful authentication:
res = ldap_bind_s(ld, NULL, &NtAuthIdentity, 1158); // v.3
{NtAuthIdentity: User='<username>'; Pwd= <unavailable>; domain = '<full domain'.}
Authenticated as dn:'<username>'.
Try specifying the port as well into a variable
$ldapPort = 389;
I would ignore the host part and just try connecting to your server (you have it as domain) Check to see if your ldap bind is working
// Handle login requests
$ds = ldap_connect($ldapServer, $ldapPort);
if (ldap_bind($ds, $user, $password)) {
// Successful auth
$_SESSION['lastactivity'] = time();
$_SESSION['username'] = $user;
$_SESSION['password'] = $password;
return $ds;
} else {
// Auth failed
header("Location: failpage.php?fail=1"); //bad credentials
exit;
}
Also for calling all the attributes, try http://blog.uta.edu/jthardy/2007/08/08/obtaining-user-information-from-ldap-using-php/
I have some code that uses PHP and LDAP to connect to AD:
$host = 'ldap://stack.overflow.com';
$port = 389;
$username = 'stackOverflow';
$password = 'IaMP4ssWord';
$dn = 'CN=Users, DC=STACK, DC=OVERFLOW, DC=COM';
$cond = '(&(objectcategory=user)(displayname=*))';//All users that have a displayname
if($ldap = ldap_connect($host, $port))
{
if(ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3))
{
if(ldap_bind($ldap, $username, $password))
{
$attrs = array('displayname', 'mail');
if($rs = ldap_search($ldap, $dn, $cond, $attrs))
{
$results = ldap_get_entries($ldap, $rs);
echo "<pre>";print_r($result);echo "</pre>";//Print the results
}
}
else
{ echo 'Binding failed';}
}
else
{ echo 'Setting options failed';}
}
else
{ echo 'Connection failed'; }
Now this code works just fine. It print out every user that has a displayname in AD.
Problem is for the username/password binding i am using my own user credential to bind to the server.
I would like to know if there is a way to bind using the servers credentials.
I am setup using PHP 5.3 + IIS on windows server 2008 R2 for both the server with IIS and the one that has AD.(two different VM).
I also know that IIS has a AD account named IISStackOverflow but I don't know the password or even if it has a password...
Thanks!
Oh! I tried changing $username to IISStackOverflow and $password to ''
But it gave invalid credential error.
--EDIT--
Do I have to do the binding part at all? (If I am only reading data)
As you run it from server itself, and you just want to read I would try to use :
...
if(ldap_bind($ldap))
...
According to PHP documentation if bind_rdn and bind_password are not specified, an anonymous bind is attempted.
Then if your anonymous logon is refused (this should not be, because running under IIS on the server your code is at least executed as a domain user) you will find there how to enable anonymous LDAP binds to Windows Server. This used to work forme on W2K8, Inever test it on W2K12.
I've been looking at a couple of guides (and the PHP manual) trying to validate AD users on an intranet site I'm about to make. This is the first time I've used ldap_connect, and I haven't had the best of luck.
Could anyone look at my code and see what I'm missing?
Thanks.
<?php
$user = "08jf1";
$password = "pass";
// Active Directory server
$ldap_host = "10.43.48.5";
// Active Directory DN
$ldap_dn = "OU=CSE-W7,OU=Students-W7,DC=server,DC=local";
// Domain, for purposes of constructing $user
$ldap_usr_domain = "#server.local";
// Connect to AD host
$ldapconn = ldap_connect("10.43.48.5");
if ($ldapconn) {
$bind = ldap_bind($ldap_host, $ldap_dn, $user . $ldap_usr_domain, $password);
if ($bind) {
echo "Verified user";
//$_SESSION['username'] = $session_username;
//$_SESSION['password'] = $session_password;
} else {
echo "User does not exist";
}
}
?>
Edit: I can confirm ldap is enabled though phpinfo!
Is that syntax of ldap_bind correct?. Isn't it ldap_bind($ldapconn,$rdn,$password) ?
Binding may need a elevated privilege or authbind wrapper. Refer to authbind for ldap. LDAP AuthBind
Take a look at this very simple example: How to use LDAP Active Directory Authentication with PHP
I have a PHP script on an apache server, and every time I try to run it, it tells me:
unable to bind to the AD
It connects fine though. I took it off the apache server, and ran it locally from my machine, and it was able to bind just fine. I'm assuming that there is something wrong with my configuration of apache.
I'm using the adLDAP API, and this is the following script I'm trying to run. It's basically a test to see whether I'm able to bind successfully or not and check to see if the credentials entered are in the Active Directory.
$username = $_POST["username"];
$password = $_POST["password"];
$formage = $_POST["formage"];
if ($_POST["oldform"]) { //prevent null bind
if ($username != NULL && $password != NULL){
//include the class and create a connection
include (dirname(__FILE__) . "/../src/adLDAP.php");
try {
$adldap = new adLDAP();
}
catch (adLDAPException $e) {
echo $e;
exit();
}
//authenticate the user
if ($adldap->authenticate($username, $password)){
//establish your session and redirect
session_start();
$_SESSION["username"] = $username;
$_SESSION["userinfo"] = $adldap->user()->info($username);
$redir = "Location: https://" . $_SERVER['HTTP_HOST'] .
dirname($_SERVER['PHP_SELF']) . "/menu.php";
header($redir);
exit;
}
}
$failed = 1;
}
Why am I getting this error: unable to bind to the AD?
I figured out the issue.
Apparently SELinux was blocking the port I needed to connect to, so I just essentially told SELinux that it's ok to connect to that port. Now everything works like a charm. Here is how I allowed Apache access to the port:
grep httpd /var/log/audit/audit.log | audit2allow -M mypol
semodule -i mypol.pp