Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Our script continues to fail whenever attempting to bind to LDAP (active directory) using SSL, I am stumped. We can successfully connect using the unsecured method, but we are attempting to perform password changes which requires SSL. Our script snippets are as follows:

config.php

// SSL

 $LDAPDOMAIN="dc=campus,dc=local";
 $LDAPLOCALDOMAIN="campus.local";
 $LDAPHOST='ldaps://localhost';
 $LDAPPORT=636;
 $ldap = ldap_connect($LDAPHOST, $LDAPPORT) or die ('<p class="message">Error connecting');

 ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
 ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);

reset.php (uses config.php)

if ($ldap)  {

  $bind = @ldap_bind($ldap,$username."@".$LDAPLOCALDOMAIN,$password);
  if (!($bind)) {
    @ldap_close($ldap);
    die ('<p class="message">Your password is incorrect, please try again 
      <a href=javascript:history.back()>click here</a><br>');
  }

Whatever we do, the script "dies" in reset.php. When we were using regular LDAP, we at least could communicate. Our config.php code was as follows:

$ldap = ldap_connect($LDAPHOST) or die ('<p class="message">Error connecting to LDAP');

I appreciate any assistance and thank you ahead of time.

Update*

I tried running the following simple program to test my LDAP. SSL still does not work, however regular LDAP does. Is this a configuration issue? My certificates should be okay, I created a new one and enrolled my server. I've used an LDAP utility which binds and connects just fine. Just not PHP though.

<?php
    $ldap = ldap_connect("ldaps://localhost/");
    $username="USER@campus.uhsa.local";
    $password="password";

    if($bind = ldap_bind($ldap, $username,$password ))
    echo "logged in";
    else
        echo "fail";
        echo "<br/>done";
        ?>

My result is Fail.

share|improve this question
2  
What error code are you receiving? Are you using an SSL cert you created? –  jscott Aug 1 '11 at 17:45
    
Yes we just created/enrolled a new certificate. For some reason when attempting to output the php error with "die (ldap_error($ldap));" instead of what I have above ("password is incorrect"), I receive: Warning: ldap_error(): 2 is not a valid ldap link resource in C:\inetpub\hosts\ADPasswordReset\passreset.php on line 50. –  Sean Aug 1 '11 at 18:12
1  
have you tried to connect (ldapsearch or whatever) from the command-line to determine if php is really the base problem? –  h0tw1r3 Aug 1 '11 at 20:13
    
I've used an ldap utility to test binding and connection to SSL. I decided to try and simply connect using a small program. Again regular LDAP worked but SSL does not. My certificates should be okay. I updated my initial question with the code I just tried running. –  Sean Aug 1 '11 at 21:07
    
are you running the ldap server locally? If so turn up debugging on the ldap server and check for errors. This sounds like a ldap server configuration problem. –  n8whnp Aug 1 '11 at 22:57

2 Answers 2

Can you try running ldapsearch and giving us the error output? It would look something like this:

ldapsearch -x -d 1 -LLL -H ldaps://localhost -b 'dc=campus,dc=local' -D 'username' -W '(sAMAccountName=username)'

where the parameters are:

  • -x: forces the connection to use simple authentication instead of SASL (emulating the PHP ldap_bind() function)
  • -d 1: show debugging output, increase the number for more verbosity
  • -LLL: changes the output format to remove some LDIF information you don't need for debugging
  • -H: the host URI specifier; you can change this to "ldap://" to test non-SSL binding
  • -b: the bind DN
  • -D: the bind credential username, CN, or other identifying string
  • -W: forces ldapsearch to ask for a password

If you were using SASL to connect to an Active Directory server over LDAPS, it'd be necessary to set the "maxssf" parameter to zero. I'm not exactly sure how PHP's LDAP functions work, so it might be worth trying to set that parameter if you can figure out how.

share|improve this answer
up vote 1 down vote accepted

Thank you all for the help everyone. I was able to finally figure out what was going on, after additional research. I know that I will not be the only person experiencing this problem now or in the future. So please follow instructions listed on these websites, and you will be golden.

Downloaded the configuration file from the first link, then followed the instructions on the second link.

http://jaredjennings.org/index.php5/Enabling_LDAP_SSL_in_PHP
http://www.apple-scripts.com/Downloads/Enable%20LDAPS%20on%20Windows%20IIS.pdf

Windows server environment can be so clumsy sometimes.

share|improve this answer
1  
You should mark your answer as "accepted". This will indicate that this question has been correctly answered. –  jscott Feb 16 '12 at 0:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.