如何在 Windows 中使用 PHP 中的 GSS-API 机制执行 LDAP SASL 绑定到 Active Directory？

Question

I have an Active Directory server and a Windows WAMP server hosting PHP web applications that need to be able to authenticate to Active Directory using Kerberos.

I was able to easily connect and bind to the Active Directory host using some sample PHP code, but I'm not sure how to do so with Kerberos. I have see many forums and blogs detailing how to do this on *NIX machines, but that doesn't help me with my situation.

I did use Wireshark and Fiddler to confirm that there is no Kerberos or NTLM negotiating happening.

Sample code I used to connect and bind to LDAP:

<?php   
   $ldaphost = "example.domain.com";
   $ldapport = 389;
   $ldapuser = "user";
   $ldappass = "password";

    $ldapconn = ldap_connect( $ldaphost, $ldapport )
    or die( "Unable to connect to the LDAP server {$ldaphost}" );

    if ($ldapconn)
    {
        $ldapbind = ldap_bind($ldapconn, $ldapuser, $ldappass);

        if ($ldapbind)
        {
            echo "LDAP connection successful";
        }
        else
        {
            echo "LDAP connction failed";
        }
    }
?>

Any help will be greatly appreciated, thanks!

Update: I've been wrestling with this all day and I think I need to use ldap_sasl_bind(), possibly using GSSAPI as the mechanism... No matter what parameters I put in to ldap_sasl_bind(), I get the following error: 'Unable to bind to server: Unknown authentication method'

I'm not sure how to implement GSSAPI, but some examples I've seen show using ldap_start_tls(), but I keep getting a 'Unable to start TLS: Server is unavailable' error.

I don't know if anyone knows anything about ldap_sasl_bind() (which is undocumented by PHP) or ldap_start_tls, but if this is the way I should be going, please point me in the right direction.

Answer 1

I cannot help with the Kerberos issue yet, as I am still struggling with it myself. However, I can point you in the right direction for TLS. TLS will at least prevent your credentials from being transmitted over the network in clear text. TLS requires proper configuration of OpenLDAP. At the very least, you can configure your client to not request or check any server certificates. You do this by adding the following line to the top of your ldap.conf configuration file.

TLS_REQCERT never

Your ldap.conf file should be located in C:\\ or C:\\openldap\\sysconf , depending on your version of PHP and OpenLDAP. The file most likely does not yet exist in your setup. You may also be able to set the configuration via an environment variable as well putenv(TLS_REQCERT=never); , but I have not tried that myself, and there appear to be mixed results reported by others.

Answer 2

What you need to do: Make sure that the LDAP interface in PHP is compiled against SASL, supports GSS-API mech and either uses keytabs or the Windows-own SSPI interface. Good luck.

Answer 3

I solved this problem on windows by creating executable based on c++ ldap_bind_s. I use this executable as a command line with the parameters: host, username,password. This is the only way I got it work for GSSAPI.

WINLDAPAPI ULONG LDAPAPI ldap_bind_s(
  LDAP        *ld,
  const PSTR  dn,
  const PCHAR cred,
  ULONG       method
);

I used LDAP_AUTH_NEGOTIATE.