In order to authenticate a user with an LDAP directory you first need to obtain their DN as well as their password. With a login form, people typically enter a simple identifier such as their username or email address. You don't expect them to memorise the DN of their directory entry.
Once the user has filled in a username and a password, the URL containing the PHP script will be called again with the predefined variables PHP_AUTH_USER , PHP_AUTH_PW , and AUTH_TYPE set to the user name, password and authentication type respectively. These predefined variables are found in the $_SERVER array.
LDAP is the Lightweight Directory Access Protocol, and is a protocol used to access "Directory Servers". The Directory is a special kind of database that holds information in a tree structure.
LDAP v3 supports three types of authentication: anonymous, simple and SASL authentication.
The general procedure would be (relevant ext/ldap php commands in brackets):
connect to LDAP server using the "LDAP Host" and "LDAP port no" (ldap_connect()) and set the correct connection options (ldap_set_option()), especially LDAP_OPT_PROTOCOL_VERSION
and LDAP_OPT_REFERRALS
bind to LDAP server using the "LDAP account to bind" and "LDAP account password" (ldap_bind()) - if you're authenticating against an Active Directory server you can directly use the username and password from the login page and skip all the following steps.
search the tree for a matching user entry/object by specifing the "BASE DN" and the appropriate LDAP filter - most likely something like (&(objectClass=user)(sAMAccountName=%s))
where %s
should be replaced by the username to be authenticated (ldap_search())
check if the number of returned entries is 1 (if <> 1 then something has gone wrong, e.g. no user found or multiple users found)
retrive the distinguished name (DN) of this single entry (ldap_get_dn())
use the DN found in the last step to try to bind to the LDAP server with the password given at the authentication page (ldap_bind())
if the bind succeeds then everything is OK, if not, most likely the password is wrong
It's really not as hard as it sounds at first. Generally I'd propose to use some sort of standard library for authenticating against a LDAP server such as the Net_LDAP2
PEAR package or Zend_Ldap
out of the Zend Framework. I have no experience with actually using Net_LDAP2
(although I know the code quite well) but Zend_Ldap
works very well against Active Directory servers or ADAMS servers (which is obviously what you're working with).
This will do the trick using Zend_Ldap
:
$options = array(
'host' => 'ad.blueroom.ac.uk',
'useStartTls' => true,
'accountDomainName' => 'blueroom.ac.uk',
'accountCanonicalForm' => 4,
'baseDn' => 'ou=bluebird,dc=bluebird,dc=ac,dc=my',
);
$ldap = new Zend_Ldap($options);
try {
$ldap->bind('user', 'password');
} catch (Zend_Ldap_Exception $e) {
// something failed - inspect $e
}
// bind successful
$acctname = $ldap->getCanonicalAccountName('user', Zend_Ldap::ACCTNAME_FORM_DN);
You might try http://code.activestate.com/recipes/101525/ while referring to http://us3.php.net/ldap and other results from a Google search for [php ldap authentication].
@Stephen provided good points. Here is my plain PHP code to authenticate using AD:
use the following code:
$ldap = ldap_connect($host); // e.g. 165.5.54.6 or an URL
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3); // Recommended for AD
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
$bind = ldap_bind($ldap, $username.'@'.$userDomain, $passwrod);
if($bind){
// successful authentication.
}
you could use http://pear.php.net/package/Net_LDAP2/docs it's nice and works.
Example of connection taken by the doc:
// Inclusion of the Net_LDAP2 package:
require_once 'Net/LDAP.php';
// The configuration array:
$config = array (
'binddn' => 'cn=admin,ou=users,dc=example,dc=org',
'bindpw' => 'password',
'basedn' => 'dc=example,dc=org',
'host' => 'ldap.example.org'
);
// Connecting using the configuration:
$ldap = Net_LDAP2::connect($config);
// Testing for connection error
if (PEAR::isError($ldap)) {
die('Could not connect to LDAP-server: '.$ldap->getMessage());
}
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With