2013-05-29 15:21
浏览 120

如何使用PHP中的GSS-API机制从Windows执行LDAP SASL绑定到Active Directory?

I have an Active Directory server and a Windows WAMP server hosting PHP web applications that need to be able to authenticate to Active Directory using Kerberos.

I was able to easily connect and bind to the Active Directory host using some sample PHP code, but I'm not sure how to do so with Kerberos. I have see many forums and blogs detailing how to do this on *NIX machines, but that doesn't help me with my situation.

I did use Wireshark and Fiddler to confirm that there is no Kerberos or NTLM negotiating happening.

Sample code I used to connect and bind to LDAP:

   $ldaphost = "";
   $ldapport = 389;
   $ldapuser = "user";
   $ldappass = "password";

    $ldapconn = ldap_connect( $ldaphost, $ldapport )
    or die( "Unable to connect to the LDAP server {$ldaphost}" );

    if ($ldapconn)
        $ldapbind = ldap_bind($ldapconn, $ldapuser, $ldappass);

        if ($ldapbind)
            echo "LDAP connection successful";
            echo "LDAP connction failed";

Any help will be greatly appreciated, thanks!

Update: I've been wrestling with this all day and I think I need to use ldap_sasl_bind(), possibly using GSSAPI as the mechanism... No matter what parameters I put in to ldap_sasl_bind(), I get the following error: 'Unable to bind to server: Unknown authentication method'

I'm not sure how to implement GSSAPI, but some examples I've seen show using ldap_start_tls(), but I keep getting a 'Unable to start TLS: Server is unavailable' error.

I don't know if anyone knows anything about ldap_sasl_bind() (which is undocumented by PHP) or ldap_start_tls, but if this is the way I should be going, please point me in the right direction.

  • 写回答
  • 好问题 提建议
  • 关注问题
  • 收藏
  • 邀请回答

2条回答 默认 最新

  • doushui3061 2013-06-02 11:49

    What you need to do: Make sure that the LDAP interface in PHP is compiled against SASL, supports GSS-API mech and either uses keytabs or the Windows-own SSPI interface. Good luck.

    解决 无用
    打赏 举报
  • duanbi2003 2013-06-06 17:32

    I cannot help with the Kerberos issue yet, as I am still struggling with it myself. However, I can point you in the right direction for TLS. TLS will at least prevent your credentials from being transmitted over the network in clear text. TLS requires proper configuration of OpenLDAP. At the very least, you can configure your client to not request or check any server certificates. You do this by adding the following line to the top of your ldap.conf configuration file.

    TLS_REQCERT never

    Your ldap.conf file should be located in C:\ or C:\openldap\sysconf, depending on your version of PHP and OpenLDAP. The file most likely does not yet exist in your setup. You may also be able to set the configuration via an environment variable as well putenv(TLS_REQCERT=never);, but I have not tried that myself, and there appear to be mixed results reported by others.

    解决 无用
    打赏 举报

相关推荐 更多相似问题