LDAP connection to Windows 2003

[ahmed24]

Hello everyone,

I have a LDAP script that connects to my domain and searches it and it works fine. I have recently obtained a script for authenticating a user in php via LDAP. However, I am not able to connect to the LDAP using it. The script that works with ldap, connects to LDAP in the following way:

$ldap_host = "192.168.0.1";
$base_dn = "DC=mydomain,DC=co,DC=uk";
$ldap_user = "[e-mail]";
$ldap_pass = "password";
//make the ldap connection
$connect = ldap_connect( $ldap_host, $ldap_port)
 or exit(">>Could not connect to LDAP server<<");
//for win2003
ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
//for win2003
ldap_set_option($connect, LDAP_OPT_REFERRALS, 0);
//this is where the username and password are used to make the ldap connection
$bind = ldap_bind($connect, $ldap_user, $ldap_pass)
 or exit(">>Could not bind to $ldap_host<<");

and the new script that I am trying to get to work looks like this and doesnt work:

$ldapconfig['host'] = '192.168.0.1';
$ldapconfig['port'] = NULL;
$ldapconfig['basedn'] = 'DC=mydomain,DC=co,DC=uk';
$ldapconfig['authrealm'] = 'Protected Area';

function ldap_authenticate() {
 global $ldapconfig;
 global $PHP_AUTH_USER;
 global $PHP_AUTH_PW;

 
 if ($PHP_AUTH_USER != "" && $PHP_AUTH_PW != "") {
 $ds=@ldap_connect($ldapconfig['host'],$ldapconfig['port']);
 $r = @ldap_search( $ds, $ldapconfig['basedn'], 'uid=' . $PHP_AUTH_USER);
 if ($r) {
 $result = @ldap_get_entries( $ds, $r);
 if ($result[0]) {
 if (@ldap_bind( $ds, $result[0]['dn'], $PHP_AUTH_PW) ) {
  return $result[0];
 }
 }
 }
 }
 header('WWW-Authenticate: Basic realm="'.$ldapconfig['authrealm'].'"');
 header('HTTP/1.0 401 Unauthorized');
 return NULL;
}

if (($result = ldap_authenticate()) == NULL) {
 echo('Authentication Failed');
 exit(0);
}
echo('Authorization success');
print_r($result);

Does anyone have any idea why it might not be working?

Thanks

[dreamcatcher]

Hi ahmed24,

You seem to have stumped everyone with this one. Did you find a solution yourself?

dc

[supermanjnk]

You need to bind to LDAP with a user account that has privileges to browse active directory before you do your initial LDAP search ($r = @ldap_search( $ds, $ldapconfig['basedn'], 'uid=' . $PHP_AUTH_USER)) or you won't have any results.

in the code that works you have

ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
//for win2003
ldap_set_option($connect, LDAP_OPT_REFERRALS, 0);
//this is where the username and password are used to make the ldap connection
$bind = ldap_bind($connect, $ldap_user, $ldap_pass)

You should add something like to this your config, then change the appropriate variables in the above code and add it to the non-working code under the connect statement.

$ldapconfig['username'] = "admin@domain";
$ldapconfig['password'] = "password";