LDAP和PHP连接失败

Question

我试图通过PHP连接到安全的LDAP服务器(使用LDAP),但我遇到了问题.我收到以下错误

警告:ldap_bind()[function.ldap-bind]:无法绑定到服务器:无法联系第16行的/var/www/test.php中的LDAP服务器

我在没有LDAP的情况下尝试连接时工作,但是我需要使用LDAP,因为我将处理敏感信息.

我使用以下代码

<?php
// basic sequence with LDAP is connect, bind, search, interpret search
// result, close connection

echo "<h3>LDAP query test</h3>";
echo "Connecting ...";
$ds=ldap_connect("ldaps://server");  // must be a valid LDAP server!




print $ds;

if ($ds) { 
    echo "<br><br>Binding ..."; 
    $r=ldap_bind($ds);     // this is an "anonymous" bind, typically
                           // read-only access
    echo "Bind result is " . $r . "<br />";

    echo "Searching for (sn=S*) ...";
    // Search surname entry
    $sr=ldap_search($ds, "ou=people,o=server.ca,o=server", "uid=username*");  
    echo "Search result is " . $sr . "<br />";

    echo "Number of entires returned is " . ldap_count_entries($ds, $sr) . "<br />";

    echo "Getting entries ...<p>";
    $info = ldap_get_entries($ds, $sr);
    echo "Data for " . $info["count"] . " items returned:<p>";

print_r($info);
//    for ($i=0; $i<$info["count"]; $i++) {
//        echo "dn is: " . $info[$i]["dn"] . "<br />";
//        echo "first cn entry is: " . $info[$i]["cn"][0] . "<br />";
//        echo "first email entry is: " . $info[$i]["mail"][0] . "<br /><hr />";
//    }

    echo "Closing connection";
    ldap_close($ds);

} else {
    echo "<h4>Unable to connect to LDAP server</h4>";
}
?>

Answer 1

该问题与实际绑定过程(无效凭据)无关,因为如果LDAP服务器无法验证您的凭据,则警告将是不同的.但正如保罗迪克森所说,ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3)应该要求使用 - 即使我不认为这是你的问题的原因.

• 您要连接哪种LDAP服务器类型？OpenLDAP,Active Directory还是其他什么？
• 运行PHP程序的计算机的操作系统是什么？
• 您是否在LDAP服务器上使用自签名SSL证书,并且是运行PHP程序的计算机信任的给定证书的证书颁发机构？
• LDAP服务器在哪个端口上运行？636将成为LDAPS的"官方"端口.也许您可以将端口显式添加到服务器地址:ldaps://<<server>>:636.

ext/ldapSSL/TLS安全连接存在一些问题.你可以尝试添加

TLS_REQCERT never

到ldap.conf(/etc/ldap.conf或/etc/ldap/ldap.conf基于*nix的系统)或Windows机器创建一个ldap.conf具有上述内容C:\OpenLDAP\sysconf\ldap.conf(路径必须完全匹配,因为它硬编码到扩展中).

Answer 2

我认为你只需要将 ldap 协议版本设置为 3

echo "<h3>LDAP query test</h3>";
echo "Connecting ...";

$ldap_server = 'ldaps://server';
$ldap_port = '636';

$ds = ldap_connect($ldap_server, $ldap_port);

if ($ds) 
{
    //add this
    if (!ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3)) 
    {
        fatal_error("Failed to set LDAP Protocol version to 3, TLS not supported.");
    }
    echo "<br><br>Binding ..."; 
    $r=ldap_bind($ds);     // this is an "anonymous" bind, typically
                       // read-only access
    echo "Bind result is " . $r . "<br />";

    echo "Searching for (sn=S*) ...";
    // Search surname entry
    $sr=ldap_search($ds, "ou=people,o=server.ca,o=server", "uid=username*");  
    echo "Search result is " . $sr . "<br />";

    echo "Number of entires returned is " . ldap_count_entries($ds, $sr) . "<br />";

    echo "Getting entries ...<p>";
    $info = ldap_get_entries($ds, $sr);
    echo "Data for " . $info["count"] . " items returned:<p>";

    print_r($info);
    //    for ($i=0; $i<$info["count"]; $i++) {
    //        echo "dn is: " . $info[$i]["dn"] . "<br />";
    //        echo "first cn entry is: " . $info[$i]["cn"][0] . "<br />";
    //        echo "first email entry is: " . $info[$i]["mail"][0] . "<br /><hr />";
    //    }

    echo "Closing connection";
    ldap_close($ds);

} 
else 
{
    echo "<h4>Unable to connect to LDAP server</h4>";
}