LDAP在PHP中对用户进行身份验证

Question

I'm building an authentication script from PHP to LDAP. My problem is that I don't really know how to check for the user if the user isn't my admin.

I don't really understand ldap_bind - here I can only login as my admin user, but then I can search for other users in my ou, but I don't know how to check their password.

What I have so far:

function login($up, $pw){
    $ldap = ldap_connect("dejan.local") or die("Could not connect to LDAP server.");

    if ($ldap){
        ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
        ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);

        //if I try $up and $pw here, I get an error
        if ($bind = ldap_bind($ldap, "Admin", "Somepassword")){
            $sr = ldap_search($ldap, "ou=testunit,DC=dejan,DC=local", "samaccountname=$up");
            $info = ldap_get_entries($ldap, $sr);

            //so here I've gotten information from the user $up
            //but I would like to check if his password matches and then get his information    
        }
    }
}

I've looked at some sort of auth scripts from others and they check the information through ldap_bind , but I can only connect with my admin user.

Answer 1

I believe the only change you need to make is:

if ($bind = ldap_bind($ldap, "$up@dejan.local", $pw)){

Which will make the request local to the specific domain. With Active Directory (which is somewhat different, blame Kerberos), you have to provide a context for login.