- PHP on Linux authenticate users with a Windows Server Active Directory
- Step 1. Get the LDAP information (LDAP Connection URL) from your Windows Active Directory.
- Step 2. Verify PHP LDAP Library installed and enabled.
- Step 3. Test PHP Login against Windows AD
- Login
- Security Considerations:
- 11 thoughts on “ PHP on Linux authenticate users with a Windows Server Active Directory ”
- Установка поддержки LDAP в PHP на сервере LAMP Ubuntu
- Installing LDAP support in PHP on Ubuntu server
- Share this:
- Like this:
- Related
- One thought on “ Installing LDAP support in PHP on Ubuntu server ”
- Php ldap install apt get install
PHP on Linux authenticate users with a Windows Server Active Directory
A common request when building INTRANET web applications is to have users use only one common shared set of login credentials. Typically in most small and medium businesses this means that logging into a Windows Server of some kind to access the network. Windows Servers use Active Directory (AD) ,which is basically Microsoft’s glorified LDAP server with a slew of additional features needed for coroporate and enterprise users. We can leverage this by using PHP’s LDAP module to perform the login check for us..
IF you’re building your application in PHP a very easy way to do this is simply to use PHPs LDAP library and then simply call with the proper functions. Let’s detail the steps below. I’ll be doing this from a PHP 5 , Debian installation.
LDAP tends to be tied into the Windows AD Domain Name System to allow integrated quick lookups and fast resolution of queries. LDAP generally runs on port 389 and like other protocols tends to usually conform to a distinct set of rules (RFC’s).
Step 1. Get the LDAP information (LDAP Connection URL) from your Windows Active Directory.
First we need to verify which Windows Active directory we will be authenticating against. If your in a very large corporate environment, you may need the help of an SA (System administrator) to help guide you. Basically, the first thing you need is to know is the Domain which this users is associated with.
Essetially you need to figure out with the LDAP Connection URL is , and this requires a bit more information about how the Windows Network is configured, Typically its something like ,
CN=Users,DC=corp,DC=domain,DC=local
then you wold combine this with the URL of the Windows AD server
LDAP://dc1.corp.domain.com/ or LDAP://10.0.1.3/
To query for a particular user. If you have accesss to the Windows Server form the command line run.
C:\Users\Administrator> dsquery user -name To* "CN=Tony Jones,CN=Users,DC=Domain,DC=local" "CN=Tony Smith,CN=Users,DC=Domain,DC=local"
Alternatively from the Windows server desktop try
Active directory server -> Choose the Organization Unit OU -> Right Click -> Properties -> AttributeEditor -> DistinguishedName
The above information is necessary so you can fill in the details of the PHP script below.
Step 2. Verify PHP LDAP Library installed and enabled.
You can do this by running a simple viewing the PHP info to see which loaded modules are currently available on your server.
Create a simple PHP file on your web server , call it test.php or something like that. When you run it it will display all the information that PHP /Apache has configured.
Run that file from your browser http://localhost/test.php and search for an entry like LDAP (Typically midway down the page between JSON and LIBXML ), if you see something like the screen below.
PHP info showing LDAP module is enabled.
If you do not see this enabled, then you may want to have it added to your PHP/Apache server . The simplest way if you have a typical Debian Linux access to your server’s shell is to run the command. For other flavors of Linux like Redhat/Centos a similar yum command should be available.
sudo apt-get install php5-ldap
sudo apt-get install php-ldap
The command should install the necessary library and restart the server, once again re-test that it’s enabled by running the above test.php and confirming the LDAP module is correctly loaded.
Step 3. Test PHP Login against Windows AD
Finally Upload this test LDAP script to your server and save it as ldap.php (or similar name) which does the follow…
- Usig the supplied LDAP information , don’t forget to REPLACE the DOMAIN_FQDN and LDAP_SERVER define with your actual credentials
- Takes the user supplied username and password and
- Issues an LDAP bind to see if that’s a valid user
- You get back either a True or False from the AD and you can proceed from there.
elseif ($bind) < //determine the LDAP Path from Active Directory details $base_dn = array("CN=Users,DC=". join(',DC=', explode('.', DOMAIN_FQDN)), "OU=Users,OU=People,DC=". join(',DC=', explode('.', DOMAIN_FQDN))); $result = ldap_search(array($conn,$conn), $base_dn, "(cn=*)"); if (!count($result)) $err = 'Result: '. ldap_error($conn); else < echo "Success"; /* Do your post login code here */ >> > // session OK, redirect to home page if (isset($_SESSION['redir'])) < header('Location: /'); exit(); >elseif (!isset($err)) $err = 'Result: '. ldap_error($conn); ldap_close($conn); > ?> Login