ldap_bind

add a note User Contributed Notes

david dot marsh at hartfordlife dot com
09-Aug-2006 03:49


had to do a bunch of research on this, but it does work, once config'd correctly.



using Apache/2.2.3 (Win32) mod_ssl/2.2.3 OpenSSL/0.9.8b 

PHP PHP Version 5.1.5-dev



ldap_bind was getting "81 Can't contact LDAP server" which was really annoying, since the connection worked fine without "ldaps"

using:



$ldapconnect = @ldap_connect( $connection_string );



well, actually the bind was really the one failing...



$bind = ldap_bind($ldapconnect, $client, $this->objSecurityLogin->Password);



many attempts to determine until i smartened up and turned on the trace level:



ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);



which must go before the connect!



found that on windows, you can't specifiy a quote in the ldap.conf:

i had:

TLS_REQCERT never

TLS_CACERT "C:\\Documents\\Tools\\Apache2\\conf\\ssl\\ad.pem"

which throws the error..

TLS: could not load verify locations (file:`"C:\Documents\Tools\Apache2\conf\ssl\ad.pem"',dir:`').

TLS: error:0200107B:system library:fopen:Unknown error .\crypto\bio\bss_file.c:122

TLS: error:2006D002:BIO routines:BIO_new_file:system lib .\crypto\bio\bss_file.c:127

TLS: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib .\crypto\x509\by_file.c:274

ldap_err2string



changed to:

TLS_REQCERT never

TLS_CACERT C:\\Documents\\Tools\\Apache2\\conf\\ssl\\ad.pem 

which cleans it up as:

TLS trace: SSL_connect:before/connect initialization

TLS trace: SSL_connect:SSLv2/v3 write client hello A

TLS trace: SSL_connect:SSLv3 read server hello A

TLS certificate verification: depth: 1, err: 0, subject: /DC=xxx/DC=yyy/CN=zzzz, issuer: /DC=abab/DC=yyy/CN=zzzz

TLS certificate verification: depth: 0, err: 0, subject: ......



so the moral to the story is even though PHP wants quotes in some windows config parms, it won't work if its in ldap.conf!

romerom at cox dot net
13-Jul-2006 05:43


I ran into an issue trying to bind as "cn=manager,dc=example,dc=com".  I took the example kenn posted where he set LDAP_OPT_PROTOCOL_VERSION to "3" for the connection.  Once I set this, I was able to bind with my manager id.

dedlfix
03-May-2006 03:36


It doesn't make much sense to let die() the script in case of an error, otherwise to ask if there were no errors before proceeding the script, as the official examples do.



better: 



<?php

ldap_bind(...) or die(...);

do_something();

?>



or even better (die() is quick but dirty)



<?php

if (!ldap_bind(...)) {

  error();

} else {

  do_something();

}

?>

baroque at citromail dot hu
05-Nov-2005 05:18


This code sample shows how to connect and bind to eDirectory in PHP using LDAP for Netware.



<?php



$server='137.65.138.159';

$admin='cn=admin,o=novell';

$passwd='novell';



$ds=ldap_connect($server);  // assuming the LDAP server is on this host



if ($ds) {

    // bind with appropriate dn to give update access

    $r=ldap_bind($ds, $admin, $passwd);

    if(!$r) die("ldap_bind failed<br>");



    echo "ldap_bind success";

    ldap_close($ds);

} else {

    echo "Unable to connect to LDAP server"; 

}

?>

18-Oct-2005 02:47


When using Active Directory 2003 (possibly also 2000) you can't search anonymously so you have to bind with a (known) user and password. Or else you will get an Search operations error. I also can confirm that an empty password bind succeeds! So test for an empty password first!



Some excellent information is found here:

http://www.scit.wlv.ac.uk/~jphb/sst/php/extra/ldap.html

http://www.scit.wlv.ac.uk/~jphb/sst/basics/ldap.html

darkstar_ae at hotmail dot com
15-Sep-2005 03:03


This may be a security issue but after tinkering for hours with the below ldap auth function (edi01 at gmx dot at), I discovered that the ldap_bind function will return true if you enter a valid username AND a NULL value!



so if that function were to receive something like $username = 'someuser' and $password = '', it would return true. As long as it isn't a null value the function will work as expected. Might as well check if it is null or empty then.

get_your_gun at hotmail dot com
24-Aug-2005 02:33


Hey



I was trying this all day and final noticed that when you use bind and authenticate. The user name needs to be as follows for it to work. I am using PHP V 4.03 so this might be different now but here is what I used and the auth worked.



<?php

$ldaphost = "ldap.what.at.greatnet.com";

$ldapport = 389;



$ds = ldap_connect($ldaphost, $ldapport)

or die("Could not connect to $ldaphost");



if ($ds) 

{

    $username = "johndoe@what.at.greatnet.com";

    $upasswd = "pass";



    $ldapbind = ldap_bind($ds, $username, $upasswd);

                               

    if ($ldapbind) 

        {print "Congratulations! $username is authenticated.";}

    else 

        {print "Nice try, kid. Better luck next time!";}

}



?>

edi01 at gmx dot at
05-Apr-2005 04:31


complete ldap authentication script:



function checkldapuser($username,$password,$ldap_server){

  if($connect=@ldap_connect($ldap_server)){ // if connected to ldap server



    if (ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3)) {

      echo "version 3<br>\n";

    } else {

      echo "version 2<br>\n";

    }

    echo "verification on '$ldap_server': ";



    // bind to ldap connection

    if(($bind=@ldap_bind($connect)) == false){

      print "bind:__FAILED__<br>\n";

      return false;

    }



    // search for user

    if (($res_id = ldap_search( $connect,

                                "dc=auto,dc=tuwien,dc=ac,dc=at",

                                "uid=$username")) == false) {

      print "failure: search in LDAP-tree failed<br>";

      return false;

    }



    if (ldap_count_entries($connect, $res_id) != 1) {

      print "failure: username $username found more than once<br>\n";

      return false;

    }



    if (( $entry_id = ldap_first_entry($connect, $res_id))== false) {

      print "failur: entry of searchresult couln't be fetched<br>\n";

      return false;

    }



    if (( $user_dn = ldap_get_dn($connect, $entry_id)) == false) {

      print "failure: user-dn coulnd't be fetched<br>\n";

      return false;

    }



    /* Authentifizierung des User */

    if (($link_id = ldap_bind($connect, $user_dn, $password)) == false) {

      print "failure: username, password didn't match: $user_dn<br>\n";

      return false;

    }



    return true;

    @ldap_close($connect);

  } else {                                  // no conection to ldap server

    echo "no connection to '$ldap_server'<br>\n";

  }



  echo "failed: ".ldap_error($connect)."<BR>\n";



  @ldap_close($connect);

  return(false);



}//end function checkldapuser



Here a sample for using this function:



if (checkldapuser('myuser', 'secretpassword', 'ldap://link.to.ldap')) {

  echo "ACCESS GRANTED\n";

} else {

  echo "ACCESS DENIED\n";

}

owen at delong dot com
24-Feb-2005 08:04


I am assuming that ldap_bind does a simple bind and that for other

types of bind, ldap_sasl_bind should be used.



Also, while the allow bind v2 solution will work with slapd, you really should

use ldap v3 if at all possible because of the security improvements and

better protocol definition.  LDAP v2 is largely deprecated at this point.



Hopefully the PHP default LDAP version will move to v3 soon.

phredbroughton at yahoo dot com
17-Feb-2005 03:27


As noted before with the password, I have found that if either  of the valuse for user or password are blank, or as in my case a typo resulted in a blank user as it was an undefined variable, the ldap_bind() will just perform an anonymous bind and return true!

Shouldn't this detect the presence of the additional values and return an error? At least if the user or password is passed. If they are both blank I'm not sure what it should do.

wkaiser at mpimf-heidelberg dot mpg dot de
25-Nov-2004 03:40


If you do not want to bind as unixadmin or *manager (i. e., for authentication on web applications), the following code could be useful:

<?php



$ldaphost = "ldap.yourdomain.com";



/*for a SSL secured ldap_connect()



$ldaphost = "ldap.yourdomain.com"; */



$ldapport = 389;



$ds = ldap_connect($ldaphost, $ldapport)

or die("Could not connect to $ldaphost");



if ($ds) {



$username = "some_user";

$upasswd = "secret";

$binddn = "uid=$username,ou=people,dc=yourdomain,dc=com";



$ldapbind = ldap_bind($ds, $binddn, $upasswd);

                            

if ($ldapbind) {



print "Congratulations! $some_user is authenticated.";}



else {



print "Nice try, kid. Better luck next time!";}}



?>

jakob at grimstveit dot no
19-Oct-2004 11:33


As "john dot lewis at waldenweb dot com" correctly writes (and this is important to note and SHOULD be incorporated into the documentation as a warning - trying to bind with specific username and empty password will return TRUE.

kenn at pcintelligent dot com
14-Jun-2004 02:32


I want to point out that the line that reads 



"$ldaprdn  = 'uname';"  



is a bit confusing. You need to ensure that you use the entire rootdn. for instance. your code should look more like this...



<?php



// using ldap bind *** NOTE the uname *****

$ldaprdn  = 'cn=root,dc=testserver,dc=com';    // ldap rdn or dn

$ldappass = 'secret';  // associated password



// connect to ldap server

$ldapconn = ldap_connect("ldap.testserver.com")

   or die("Could not connect to LDAP server.");



if (ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3)) {

   echo "Using LDAPv3";

} else {

   echo "Failed to set protocol version to 3";

}



if ($ldapconn) {



   // binding to ldap server

   $ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);



   // verify binding

   if ($ldapbind) {

       echo "LDAP bind successful...";

   } else {

       echo "LDAP bind failed...";

   }



}



?>

pete dot rowley at example dot com
01-Jan-2004 12:51


You should NOT attempt to bind with a made up password.  However small the chance, the chance remains that your code produces a valid password.  The correct behaviour is to test for an empty password, and if your application will only service authenticated users, not perform any more LDAP operations on behalf of the user - this also happens to be more efficient.

kokheng at jhs dot com dot sg
21-Nov-2002 05:01


OpenLdap 2.1.x libraries support both LDAPv2 and LDAPv3. The problem lies with the slapd, the ldap server bundled with OpenLDAP.  It's default supported version is LDAPv3. One can set the "allow bind_v2" in the slapd.conf file, with this configured, the PHP ldap_set_option() is not required.

elvisciousatrmci.net
28-Sep-2002 02:08


I ran into a problem where I was getting a protocol error when I tried to bind.  I was able to connect fine and ldap commands worked fine from the command line.  



The problem turned out to be that openldap (v 2.1.5) was starting up in version 3 ldap mode, and php (4.2.3) expected it to be in version 2 mode.



To fix this use the ldap_set_option command to change the version that php expects.

naujocke at nospam dot abacusii dot com
07-May-2002 12:27


One useful item when trying to bind to Novell's NDS LDAP servers.



If you are using NDS 8 and attempt to bind it will work with a partail context.



As an example if you full context is cn=user.ou=sales.ou=division.o=company 

and you use as your authentication context cn=user.o=company it will work.



But you will be required to supply the full context to authenticate to an eDirectory based LDAP setup. Such as Netware 6 or eDirectory 8.5 or greater.



Also when using the wildcard * symbol in your object class. If you are not careful it is possible to dump the entire contents of your NDS tree into an array.

tpiper at pinnacle dot couk
26-Feb-2002 11:19


An example to help you authenticate against M$ Exchange, rather than use anonymous mode...



you will need to create an NT domain member (I've called it ldapquery) and give it search permission in the LDAP protocol settings in Exchange.



then:

$ds=ldap_connect ("<exchange server>");  

$r=@ldap_bind($ds,"cn=ldapquery, o=<your organisation>, c=<your country>, ","<the password for ldapquery account>");



we've tested this on Exchange 5.5SP3.

ral at royal dot net
22-Jul-2001 01:49


I'm using the following code to generate


'userPassword' for OpenLDAP 1.2.x using {ssha} method


(to encrypt {smd5} just change MHASH_SHA1 to MHASH_MD5)





  mt_srand((double) microtime()*1000000);


  $salt=mhash_keygen_s2k(MHASH_SHA1,$password,substr(pack("h*",md5(mt_rand())),0,8),4);


  $passsword="{ssha}".base64_encode(mhash(MHASH_SHA1, $password.$salt).$salt);

ian-php at eiloart dot com
07-Jun-2001 08:16


You might also get the message "Inappropriate authentication" when your username/password pair is invalid.

gparamelle at ina dot fr
10-Nov-2000 10:00


if you use ldap_bind() to test an aurhentification, it will return something like "Warning: LDAP: Unable to bind to server: Invalid credentials in


test.php on line 50"


to avoid this use error_reporting (E_ALL & ~E_NOTICE & ~E_WARNING)


or better solution :


@ldap_bind($ds, $dn, $password) ;

pelle at alma dot nu
04-Aug-2000 02:27


Regarding "invalid credentials",


according to the rfc


"Invalid credentials" is the LDAP


response code returned when password/username pair isnt correct.

john dot lewis at waldenweb dot com
15-Dec-1999 09:01


To get around the null password returns true on servers where anonymous access is allowed, try...





// get a connection


        $ldap=ldap_connect($ldapServer);


// check to see if we got one, if we did, proceed


        if($ldap)


        {


                if(!$passWord)


                {


       // generate a bogus password to pass if the user doesn't give us one


      // this gets around systems that are anonymous search enabled


                   $passWord = crypt(microtime());


                }





then do your ldap_bind to test authentication....

add a note

ldap_bind

Description