php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #19520 ldap bind true
Submitted: 2002-09-20 04:21 UTC Modified: 2002-09-20 18:20 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: fmj at natas dot ch Assigned:
Status: Not a bug Package: LDAP related
PHP Version: 4.2.2 OS: Windows NT
Private report: No CVE-ID: None
 [2002-09-20 04:21 UTC] fmj at natas dot ch
$user_ldappassword = "";


  # connect to ldap
  echo "<br>trying to connect to ldap...";
  $ldap = ldap_connect($ldap_host);
  if(!$ldap)
    echo "<br>Can't etablish connection to ".$ldap_host;
  else
    echo "<br>Connection etablished to ".$ldap_host;

  # get dn (if you don't know)
  $bind_dn = ldap_bind($ldap); // anonymous
  $search_dn = ldap_search($ldap,"o=awp","uid=".$user_ldapid);
  $result_dn = ldap_get_entries($ldap,$search_dn);
  
  for($i=0; $i < $result_dn['count']; $i++)
    $user_dn = $result_dn[$i]['dn'];
  echo "<br>dn: ".$user_dn;

  # get authed
  $auth_bind = ldap_bind($ldap,$user_dn,$user_ldappassword);
  if($auth_bind)
    echo "<br>You are in!";
  else
    echo "<br>You are out!";

  # close connection to ldap
  ldap_close($ldap);
_______________________________________________________

try to get non-anonymous bind with userpassword = "" (empty string), the bind returns 1 and no error! (like this: LDAP: Unable to bind to server: Inappropriate authentication in ...)

that's odd, isn't it?

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-09-20 14:04 UTC] venaas@php.net
Yes, especially if $user_dn is non-empty. PHP returns true
only if the LDAP API's ldap_bind_s() function returns
LDAP_SUCCESS. I'm pretty sure that the API function
behaves the same, so this might be a problem with the
LDAP API implementation. Are you sure that $user_dn is
non-empty? I'm marking this as bogus since I'm pretty sure
it's not a problem in PHP.

 [2002-09-20 18:20 UTC] fmj at natas dot ch
i think you are right. i'm not a ldap freak but developer should be careful, it could be a security hole if you only check the return value (true or false).
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 18 21:01:29 2024 UTC