LDAP problem, ldap_bind invalid dn syntax

Question

I know that my mistake will be something very simple, but I tried to find the problem, and I do not see it, maybe you can help me ....

I am trying to create a function with php, so I can connect to LDAP and find the information I need.

My php code is as follows:

$ldapconfig['host'] = "127.0.0.1"; $ldapconfig['port'] = NULL; $ldapconfig['basedn'] = "dc=example,dc=com"; $ldapconfig['binddn'] = "user"; $ldapconfig['bindpw'] = "password"; function ldap_authenticate($user, $pass) { global $ldapconfig; ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7); if ($user != "" && $pass != "") { $ds=ldap_connect($ldapconfig['host'],$ldapconfig['port']); if(!ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3)) { return NULL; } ldap_set_option($ds, LDAP_OPT_REFERRALS, 0); ldap_bind( $ds, $ldapconfig['binddn'], $ldapconfig['bindpw']); $r = ldap_search( $ds, $ldapconfig['basedn'], 'sAMAccountName=' . $user); if ($r) { $result = ldap_get_entries( $ds, $r); if ($result[0]) { if (ldap_bind( $ds, $result[0]['dn'], $pass) ) { return $result[0]['mail'][0]; } } } } return NULL; 

When I try to run the code, it gives me the following error: ldap_bind the invalid DN syntax in line xxxx and this line is as follows:

 ldap_bind( $ds, $ldapconfig['binddn'], $ldapconfig['bindpw']); 

Answer 1

As indicated in the error, your bind DN is the wrong format. DN represents the full path to the object - so in your case there should be something like this (looks like you're on AD?)

"cn = username, ou = domain users, dc = example, dc = com"

Depending on your taste of LDAP (Active Directory, OpenLDAP, etc.), you can use uid (so simple "username") to bind, but it is best to assume that you always need the full DN.

You can use an LDAP tool, such as Apache Directory Studio , to help collect queries and find out what the object DN is. Or there ldp.exe too (provided that it is AD), but the studio directory is easier to use.

Answer 2

In DC, Execution: User dsquery -samid jim

will show the DN of the user matching sAMAccountName: "CN = Jim Willeke, CN = Users, DC = mad, DC = willeke, DC = com"

http://ldapwiki.willeke.com/wiki/LDAP%20and%20Active%20Directory