|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2005-12-09 10:30 UTC] bfg at frost dot ath dot cx
Description:
------------
ldap_sasl_bind() sends bind DN as sasl authz id.
This is wrong ;)
Reproduce code:
---------------
<?php
$host = "ldap://ldap.example.org";
$dn = "uid=bfg,ou=users,ou=unix,ou=production,dc=noviforum,dc=si";
$pw = "test";
$realm = "PROD.EXAMPLE.ORG";
$mech = "PLAIN";
$authz_id = "bfg";
$props = null;
$r = ldap_connect($host);
if (! $r) {
echo "Unable to connect: \n";
exit(1);
}
ldap_set_option($r, LDAP_OPT_PROTOCOL_VERSION, 3);
echo "Connected, trying to bind...\n";
$b = ldap_sasl_bind($r, $dn, $pw, $mech, $realm, $authz_id, $props);
echo "LDAP bind: " . (($b) ? "OK" : "FAILED") . "\n";
?>
Expected result:
----------------
OK
... i've written php patch which i've sent to jani.
Actual result:
--------------
Dec 8 11:31:34 orion slapd[5404]: conn=113 fd=15 ACCEPT from
IP=192.168.2.232:55217 (IP=0.0.0.0:389)
LDAP: Dec 8 11:31:12 orion slapd[5404]: conn=112 op=0 BIND
dn="uid=bfg,ou=users,ou=unix,ou=production,dc=example,dc=si" method=163
PHP: Dec 8 11:31:34 orion slapd[5404]: conn=113 op=0 BIND
dn="uid=bfg,ou=users,ou=unix,ou=production,dc=example,dc=si" method=163
LDAP: Dec 8 11:31:12 orion saslauthd[17532]: rel_accept_lock : released
accept lock
PHP: Dec 8 11:31:34 orion saslauthd[17533]: rel_accept_lock : released
accept lock
LDAP: Dec 8 11:31:12 orion saslauthd[17533]: get_accept_lock : acquired
accept lock
PHP: Dec 8 11:31:34 orion saslauthd[17531]: get_accept_lock : acquired
accept lock
FAILED
Kerberos logs (ldap server authenticates against kerberos)
LDAP marked lines are produced when connecting to ldap server with ldapsearch(1), PHP marked lines are produced with php interpreter running script above.
LDAP: Dec 8 11:31:12 orion krb5kdc[5468]: AS_REQ (1 etypes {18})
195.250.198.144: NEEDED_PREAUTH: bfg@PROD.EXAMPLE.ORG for
krbtgt/PROD.EXAMPLE.ORG@PROD.EXAMPLE.ORG, Additional pre-authentication
required
PHP: Dec 8 11:31:34 orion krb5kdc[5468]: AS_REQ (1 etypes {18})
195.250.198.144: CLIENT_NOT_FOUND:
uid=bfg,ou=users,ou=unix,ou=production,dc=examle,dc=si@PROD.EXAMPLE.ORG
for krbtgt/PROD.EXAMPLE.ORG@PROD.EXAMPLE.ORG, Client not found in Kerberos
database
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Oct 30 16:00:01 2025 UTC |
Also, FYI: -X authzid SASL authorization identity ("dn:<dn>" or "u:<user>") (that's from ldapsearch -h output)