PHP cannot connect to LDAP Oracle Directory Server Enterprise Edition

Question

Played with this for several days and couldn't get php to contact ldap on Oracle DSEE.

function test(){ // LDAP variables $ldaphost = "xxx.xxxxx.com"; $ldapport = 636; $ldaprdn = 'cn=xyxyxyxy,ou=Accounts,dc=xxx,dc=xxxxx,dc=com'; $ldappass = 'vcvcvcvcvc'; ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7); // isn't helping // Connecting to LDAP $ldapconn = ldap_connect($ldaphost, $ldapport) or die("Could not connect to $ldaphost"); if ($ldapconn) { // binding to ldap server $ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass); // verify binding if ($ldapbind) { echo "LDAP bind successful..."; } else { echo "LDAP bind failed..."; } } } 

I get an error message:

Message: ldap_bind () [function.ldap-bind]: Cannot bind to server: cannot connect to LDAP server

Tearing my hair on it. I just can't tie a thing.

I tried direct telnet for the host on port 636 and is not blocked by any firewall. In particular, I do not receive additional debugging information from "LDAP_OPT_DEBUG_LEVEL" on the screen or in my logs.

Answer 1

start_tls() and ldaps are mutually exclusive, that is, you cannot release start_tls() on an ssl port (standard 636) or initiate ldaps on an unencrypted port (standard 389). The start_tls() command initiates a secure connection on an unencrypted port after the connection is initiated, so you must issue this before the connection occurs to make it encrypted. Another set of common ports is 3268 (unencrypted) and 3269 (ssl), which can be enabled on your server.

ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);

logged in the error log of your web servers depending on the level of your log or on completeness (from the PHP CLI). For more information here, check the web server log level settings or just run the php script from the command line.

To successfully use the ssl port, you need to specify the ldaps:// prefix, while on an unencrypted port this is optional (with the ldap:// prefix).

Looking at your code, this may be a problem with the protocol version, since PHP uses version 2 by default. To solve this problem, you can specify:

 ldap_set_option($conn, LDAP_OPT_PROTOCOL_VERSION,3); ldap_set_option($conn, LDAP_OPT_REFERRALS,0); 

before trying to bind.

You can also view the code in Problems with secure binding to Active Directory using PHP , which I successfully use in CentOS 5, but you have problems with Ubuntu, If your server has an open unencrypted port, it is recommended to use unencrypted test binding with it to exclude any connection problems.

To check if a port is open, you can check if telnet, EG is connected to it:

 telnet my.server.com 3268 

If the port is open, you can use it.

* Change . If the ssl certificate is considered invalid, the connection will fail, if so, setting the debug level to 7 will announce it. To get around this particular problem, you should ignore its reliability:

You can ignore reality in windows by releasing

 putenv('LDAPTLS_REQCERT=never'); 

in your php code. In the * nix file, you need to edit the /etc/ldap.conf file containing

 TLS_REQCERT never 

Answer 2

Port 636 is an SSL compliant port and requires an SSL connection. You should try connecting to port 389 or changing your code to enable a secure layer (much more complex).

Yours faithfully,

Lodovico

Answer 3

To connect using SSL, you should try

 $ldapconn = ldap_connect('ldaps://'.$ldaphost); 

This will automatically connect to port 636, which is the standard ldaps -port. Depending on the installation and configuration of your server, it may be possible that connections are allowed only on port 389 (without encryption or using TLS) or only on port 636 using SSL encryption. Although it is possible that your server provides other ports. Thus, in general, you need to know which port you are connecting to and which encryption method the server requires (no encryption, SSL or TLS).

Answer 4

Is the LDAP server certificate signed by a valid CA? Perhaps your client simply rejects the certificate!