?
Solved

PHP and LDAP: php_ldap.dll giving "Access is Denied" error

Posted on 2003-03-04
11
Medium Priority
?
1,622 Views
Last Modified: 2013-12-13
Hi everyone. I've been stuck on this problem for a while, and it's driving me nuts, so I'd greatly appreciate the help!

I have PHP set up on a Microsoft IIS 5.x server. For authentication purposes, I am trying to query a Microsoft Exchange of user information via LDAP. Now, I have never used LDAP before, but I followed the instructions very closely. Here is what I've done so far:

- Placed php_ldap.dll and libsasl.dll in the c:/php/extensions folder
- Uncommented the extension for php_ldap.dll in the php.ini file and set the extension_dir to c:/php/extensions
- Gave the IUSR_machine_name full privileges to the php_ldap.dll and libsasl.dll files, as well as the folders they reside in.
- I have tried placing the .dll's in the c:/winnt/system32 directory, and still the same problem. I have also downloaded all the .dll's in the windows binary version of the PHP download and placed them all in the system32 directory.

The problem I'm having is that whenever I try to access the website I get a pop-up message on the server that states:
"Unknown(): Unable to load dynamic library 'c:/php/extensions/php_ldap.dll' - Access is denied". This occurs whenever I try to access any of the PHP pages, not just the one that tries to connect to the Exchange Server via LDAP. One more possible clue is that my phpInfo() page doesn't mention anything about LDAP being used in the system.

My hunch is that this is a permissions thing, but I've tried everything I know to do as far as that goes! Anybody out there ever had this problem or have any ideas? I'd be very grateful.

Thanks,
Brian Hibma
0
Comment
Question by:hibster
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
  • +1
11 Comments
 
LVL 1

Assisted Solution

by:pcaylor
pcaylor earned 120 total points
ID: 8122917
This is almost certainly a NTFS permissions issue.  To test it (assuming you are on a fairly secure server) give IUSR_machine_name read and execute rights for

c:\php (and all subdirectories) and
c:\winnt\system32

While this is extremely bad practice to do permanently, it does prove/disprove the NTFS permissions issue.  Just don't forget to back out the changes once you've done the test.

Also, double check that the php_ldap.dll and libsasl.dll files do not have file level permissions on them.  They should inherit the permissions of the folder they are in.

I had the exact same error with the imap extensions and it was a NTFS permission problem, where iusr_machine_name did not have the correct permissions for the directory the extensions were in, so I think you are on the right track.

-Peter
0
 

Author Comment

by:hibster
ID: 8142570
Peter, thanks for your comment.  Actually, I have already tried your approach to give the IUSR_ account full privileges on the entire drive, and still it didn't work.  So it really doesn't seem to be an NTFS issue.  I'm getting more suspicious of IIS (I have absolutely no experience with it, I'm an Apache man myself...stuck in a company brainwashed with Microsoft!).  Anybody know if IIS has its own set of file permissions or in any way overrides the NTFS permissions?

Thanks again Peter, but don't think that's it (wish it was!)

Brian
0
 
LVL 1

Expert Comment

by:pcaylor
ID: 8142969
This is a long shot, but try checking the Application Protection setting for the site.  (Right click on the site, select properties, then the Home Directory tab)  I've had best luck with PHP under the medium setting.

Also, are you running PHP in CGI or ISAPI mode?

-Peter
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:hibster
ID: 8155001
I'm running PHP in CGI mode; it seemed the easiest at the point of install.

Yeah, I checked into the Application Protection properties and I already had it set at medium.  I've tinkered with all those setting so many times trying to find this solution that I find it hard to imagine I missed one.

Again, thanks for the thoughts,

Brian
0
 
LVL 1

Expert Comment

by:pcaylor
ID: 8155552
It's a pain in the neck to switch, but try running PHP in ISAPI mode.  I think this is what's causing the problem:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q311481

Unfortunately the MS article doesn't help much with the resolution, so that's why I'd suggest switching to ISAPI mode.

-Peter
0
 

Expert Comment

by:hotaru
ID: 8530940
Hello Brian,

as Peter correctly stated in his first comment, this is an NTFS permissions issue.

Inspired by Peter's comment, I tried giving IUSR_machinename "read" and "execute" rights for the whole system32 directory. I also tried to set the permissions for the entire drive like you did. Both methods have two things in common: They are a potential security risk, and they don't work.

You must explicitly give IUSR_yourmachinename the necessary "read" and "execute" rights for each one of the DLLs that you copied into the c:\winnt\system32\ directory. After you've done that, everything will work fine.

Hope this helps.

- Hotaru
0
 

Author Comment

by:hibster
ID: 8532489
Hi Hotaru,

Your comment makes so much sense!  Problem is, though that is the intuitive answer, it doesn't work.  I have tried just about every combination of permissions settings, even going so far as to make the entire machine vulnerable (obviously I didn't leave it that way) and still, the same error.  I have tried giving each .dll the correct permissions for the IUSR_machinename account, and no luck.  I have tried giving the IUSR_machinename the proper permissions on the entire parent folder with files in the folder inheriting the permissions, and no luck.

An update on this story is that instead of wasting my time with this issue, I convinced my manager to switch over to a Linux box.  Everything went smoothly from there, so perhaps the accepted answer should be the first one who comments "Move to Linux!" :) ...
0
 

Accepted Solution

by:
hotaru earned 240 total points
ID: 8532797
Ehm....

"Move to Linux!" ;-)

Well, okay, that was an easy one. Feel free not to give any points. At least for all servers that I installed yet, my solution worked great. I don't know why it didn't work for you.

- Hotaru
0
 

Expert Comment

by:eparks
ID: 8534864
You probably just require another dll to load the ones that it is having problems loading.

It is not a matter of finding them, or loading them, or permissions.  It just doesn't see the other dependant dll's.

If you copy the dll's from the "dlls" (and maybe "sapi") directory folder from the php install, to the directory where you are trying to load the extensions from, it will probably find the necessary dll's and load.  I just did this myself.  It doesn't really tell you which dll you needed though. - Eric

 

0
 

Expert Comment

by:eparks
ID: 8534895
Sorry, I should have read that a little closer, it looks like you do have an access denied issue, not a module not found issue like most people have, when it can't load the proper dll.
0
 

Author Comment

by:hibster
ID: 9089685
Well, in the time since I have posted this I have left the company that I was having this problem at without ever resolving the issue.  So while I don't have to deal with it anymore, it still irks me.  I still don't believe that it was a permissions issue, but was more of a .dll location issue, but that's my own intuition.  Anyhow, I am unable to try any more of your suggestions (thank you for them).

One other suggestion I received was from an individual who emailed me having the same problem.  I will post it here in hopes it helps someone else out who hit this same problem:

Quote:
I worked at this problem for a couple of days non-stop and then took a
break.  When I came back to I simply copied ssleay32.dll & libeay32.dll into
my PHP directory (in my case c:\php) and also moved my php_ldap.dll into
that same directory.  I then changed my php.ini file to look at c:\php for
my extensions.

Wa-la!  I couldn't believe my eyes.  It was actually working.  Now the only
problem is that I'm not sure if it was something that I did earlier in
conjunction with this or not.  At least it's working. (Whew!)
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article discusses four methods for overlaying images in a container on a web page
There are times when I have encountered the need to decompress a response from a PHP request. This is how it's done, but you must have control of the request and you can set the Accept-Encoding header.
Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…
The viewer will learn how to count occurrences of each item in an array.
Suggested Courses

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question