Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a PHP programmer and I've never work with active directory or ldap. I need to integrate my web app with an active directory and after ask the IT guy of the client company he said to me that isn't an LDAP integration but Active Directory.

Is that right? How can I connect without LDAP?

Also, which steps I have to follow to have just one login (the one on the machine startup), instead of two (on the web app against ldap/activedirectory)?

EDITED

I've found this about single signon: http://stackoverflow.com/questions/1003751/how-do-i-use-microsoft-ad-and-php-single-sign-on-web-app

In this case is LDAP used?

share|improve this question

5 Answers 5

Well, Active Directory is LDAP+Kerberos+a few other miscellaneous bits and pieces. Officially you could authenticate via Kerberos, but that's not going to provide any of the other authorization data you may need.

As long as your firewall doesn't prohibit it and you have a user account with the correct permissions, you should be able to query Active Directory using standard LDAP PHP libraries, LDAP browsers, etc.

share|improve this answer

LDAP isn't required. You can use claims based authentication (the new trend) with SAML. A PHP library is here.

Have your network admin install ADFSv2 to make AD open up a SAML and endpoint WS-Trust in your app. ADFS is a free, and Windows 2008 R2 is the right OS to run the latest version.

TIP: Just be sure to install it so it uses SQL (not SQL Express) if you want advanced features like token replay detection.

share|improve this answer
    
Downvoter: Why did this get a -1? –  makerofthings7 Feb 13 '12 at 18:02

im currently working on a hybrid application for my company that requires employee authentication via LDAP / ActiveDirectory

in PHP its not that hard to authorizes against LDAP.

Your PHP Configuration should have session and ldap enabled.

heres an example of a basic auth with PHP

class LDAP_Authentication
{
    private $connection;
    public function __construct($domain)
    {
        $this->connection = @ldap_connect($domain);
    }

    public connected()
    {
        return $this->connection !== false;
    }

    public function login($user,$password)
    {
        return @ldap_bind($this->connection,$user,$password);
    }
}

Example of usage:

session_start(); //Single Login

$LDAPAuth = new LDAP_Authentication('domain.internal');

if($LDAPAuth->connected())
{
    if($LDAPAuth->login('some_user',"some_pass"))
    {
        $_SESSION['logged_in'] = true;
        $_SESSION['credentials'] = array('some_user','some_pass');

        echo 'Welcome';
    }else
    {
        echo 'Try again';
    }
}

Update 1

A possible method is using JavaScript to accomplish this, you can detect the clients computer name, user name, domain by using the network object in WScript, you then detect the credentials and then send them to the server to check with AD, if there all good the server then will create a session for that user and reply with an JSON Object, with success set to true.

the javascript side will then see that its a success and then redirect the browser to another location causing them to be logged in.

POC:

var Data = {}
//Show loading layer
$("#loader").show();
try
{
    var Information = new ActiveXObject("WScript.Network");
    Data.Username = Information.UserName;
    Data.Computername = Information.ComputerName;
    Data.Domain = Information.UserDomain;

    $.post("/ldap/ajax/login",Data,fucntion(object){
        if(object.success)
        {
            document.location = "/"; //Will automatically start session.
        }else
        {
            document.location = "/ldap/faild/"; //general login page
        }
    });
}catch(e)
{
    document.location = "/ldap/faild/"; //general login page
}
share|improve this answer
    
Have you already use single signon? Like the link provided in the question? –  Telephone Nov 22 '10 at 22:39
    
Updated with a JavaScript solution. –  RobertPitt Nov 23 '10 at 9:49

Is that right? How can I connect without LDAP?

If your Linux system is running Winbind (http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/winbind.html), you could conceivably use standard PAM services for authentication. And, as has been pointed out, you can also authenticate using Kerberos (either treating it as a password database or by actuallly accepting Kerberos tokens via, e.g., Apache's mod_kerberos).

Using Kerberos gets you some security advantages if done correctly (because user passwords never traverse the network), but you would still need to interact with LDAP (or the local system running Winbind) to get group memberships, etc., for authorization.

share|improve this answer

You could try SAML as well. Try a search for "SAML active directory" as well as "SAML apache".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.