Solved

Using LDAP in PHP to get Active Directory info always returns Invalid credentials

Posted on 2008-10-06
5
1,462 Views
Last Modified: 2013-12-19
Let me preface this question with, I am not a sys admin by any means.  I am a LAMP developer attempting to use PHP's LDAP extension to authenticate users of a PHP application against my client's Active Directory accounts.

Setup:
    Box 1:
        Windows 2003 running Apache 2.2 and PHP 5.2
    Box 2:
        Windows box running Active Directory

The sys admin send me a screenshot of the Active Directory tree.  My account was located on:
domain: area1.area2.local
ad host machine: box2

My account is in the Our Users -> Our Department -> Our Team folder.

$connection = ldap_connect('box2');    <------- works
ldap_bind($connection,'cn=billybob,ou=Our Users,ou=Our Department,ou=Our Team,dc=area1,dc=area2,dc=local','mypassword');    <------- throws 'Unable to bind to server: Invalid credentials'

Any ideas?  

0
Comment
Question by:mhmservices
  • 3
  • 2
5 Comments
 
LVL 40

Expert Comment

by:RQuadling
Comment Utility
Can you take a look through the user notes on http://docs.php.net/ldap_bind

The code ...

if (ldap_set_option($ldapLink,LDAP_OPT_PROTOCOL_VERSION,3))
{
    echo "Using LDAP v3";
}else{
    echo "Failed to set version to protocol 3";
}

May be required for you as well as other settings.
0
 

Author Comment

by:mhmservices
Comment Utility
Thanks for the idea, but unfortunately that piece is already in our code.
0
 
LVL 40

Expert Comment

by:RQuadling
Comment Utility
Are you sure the password is correct? Case sensitivity and all that.
0
 

Author Comment

by:mhmservices
Comment Utility
I am sure the info is correct because I am using it to login to the VPN.  Thanks for the shot though.
0
 
LVL 40

Accepted Solution

by:
RQuadling earned 125 total points
Comment Utility
I've only done a little playing with LDAP.

Here is the code I used as my first test.

I'm using this from the command line.


Usage :

ldap_search <username> <password> <searchElement> <seachValue>

e.g.

ldap_search RQuadling blahblahblah sn Q*

will use my credentials to look for all entities that have a SN (surname) element that starts with Q.




If you change LDAP_Server to the server name and DOMAIN to the domain.





<?php

$ds=ldap_connect('LDAP_Server.DOMAIN');  // must be a valid LDAP server!

$dn="DC=DOMAIN";
 

if ($ds)

	{ 

	$r=ldap_bind($ds, 'DOMAIN\\' . $argv[1], $argv[2]);

	$sr = ldap_search($ds, $dn, $argv[3] . '=' . $argv[4]);
 

	if (0 == $sr)

		{

		echo ldap_errno($ds), ':', ldap_error($ds), ':';

		}

	else

		{

		$info = ldap_get_entries($ds, $sr);

		print_r($info);

		}
 

	ldap_close($ds);

	var_dump($ds);

	}

Open in new window

0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Synchronize a new Active Directory domain with an existing Office 365 tenant
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now