LDAP and IIS 6

LDAP and IIS 6

am 12.03.2007 19:19:20 von dsartori

Hello,

I am trying to get my certs and LDAP to work for SASL external
authentication. So far, no luck. My error message and code follow. Some
of the documentation for PHP suggests that there is only limited LDAP
functionality included in the default extension (not SASL) and you must
recompile to get everything. Is this my problem? Which is a problem since
I don't have Visual Studio C++. But knowing for sure that I haven't done a
silly typo of some kind would be a good start. A friend is running similar
code with success using the same certificates. So, I don't think it is
them.

This is my first foray into authenticated links so your help is greatly
appreciated.

Diana



[12-Mar-2007 10:08:23] PHP Warning: ldap_start_tls() [ href='function.ldap-start-tls'>function.ldap-start-tls]: Unable to start
TLS: Connect error in

.......

# SASL EXTERNAL authentication config
$tls_cacert="ca.crt";
$tls_cert=website.crt";
$tls_key="website.key";

putenv("LDAPTLS_CACERT=$tls_cacert");
putenv("LDAPTLS_CERT=$tls_cert");
putenv("LDAPTLS_KEY=$tls_key");

# LDAPv3 is required
$r = ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, 3);

$d = ldap_connect($host);

if (!$d)
exit(0);

$r = ldap_start_tls($d);

--
------------------------------------------------------------ -
Diana Sartorius dsartori@u.washington.edu 206.543.7263
227 Hall Health Center Box 354400 U of WA
Seattle, WA 98195-4400

--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

RE: LDAP and IIS 6

am 12.03.2007 20:09:54 von zbowden

Can you turn off SASL binding on your ldap server or try contacting
another ldap server w/ tls just to make sure that's not your issue? I've
had trouble in the past when I didn't specify the full path to the
certificate or ldaprc file.

It looks like you're failing at the ldap_start_tls() and not the
ldap_sasl_bind(...,"EXTERNAL") but that could just be a bad error
message.

Just an idea .. I've not actually done a SASL bind from PHP/IIS :)

-zeb

=20

-----Original Message-----
From: dsartori [mailto:dsartori@u.washington.edu]=20
Sent: Monday, March 12, 2007 2:19 PM
To: php-windows@lists.php.net
Subject: [PHP-WIN] LDAP and IIS 6

Hello,

I am trying to get my certs and LDAP to work for SASL external=20
authentication. So far, no luck. My error message and code follow.
Some=20
of the documentation for PHP suggests that there is only limited LDAP=20
functionality included in the default extension (not SASL) and you must=20
recompile to get everything. Is this my problem? Which is a problem
since=20
I don't have Visual Studio C++. But knowing for sure that I haven't
done a=20
silly typo of some kind would be a good start. A friend is running
similar=20
code with success using the same certificates. So, I don't think it is=20
them.

This is my first foray into authenticated links so your help is greatly=20
appreciated.

Diana



[12-Mar-2007 10:08:23] PHP Warning: ldap_start_tls() [ href=3D'function.ldap-start-tls'>function.ldap-start-tls]: Unable to
start=20
TLS: Connect error in

.......

# SASL EXTERNAL authentication config
$tls_cacert=3D"ca.crt";
$tls_cert=3Dwebsite.crt";
$tls_key=3D"website.key";

putenv("LDAPTLS_CACERT=3D$tls_cacert");
putenv("LDAPTLS_CERT=3D$tls_cert");
putenv("LDAPTLS_KEY=3D$tls_key");

# LDAPv3 is required
$r =3D ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, 3);

$d =3D ldap_connect($host);

if (!$d)
exit(0);

$r =3D ldap_start_tls($d);

--=20
------------------------------------------------------------ -
Diana Sartorius dsartori@u.washington.edu 206.543.7263
227 Hall Health Center Box 354400 U of WA
Seattle, WA 98195-4400

--=20
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: LDAP and IIS 6

am 12.03.2007 21:59:23 von dsartori

Zeb,

I should have been more complete. LDAP is working. I am trying to upgrade
for security reasons from a working setup. I recently also upgraded PHP to
5.2.1, though everything else seems to be working fine.

I agree, the error message does list ldap_start_tls which is a command I
haven't used in the past. That is what made me wonder if it is not included
by default in the Windows version of LDAP or require me to recompile with
the SASL option. Before, I was simply binding without the certificate
requirements. Simple binding to a different ldap host still works. I
shortened the code and do give the full paths to the crts.

I don't know if there is another LDAP box I can try tls on, but I will use
your suggestion next.

Thank you,
Diana
------------------------------------------------------------ -
Diana Sartorius dsartori@u.washington.edu 206.543.7263
227 Hall Health Center Box 354400 U of WA
Seattle, WA 98195-4400

""Bowden, Zeb"" wrote in message
news:B4F529047A581D48A7D52F9C451CE4A901D0D18A@rivendell.cc.v t.edu...
Can you turn off SASL binding on your ldap server or try contacting
another ldap server w/ tls just to make sure that's not your issue? I've
had trouble in the past when I didn't specify the full path to the
certificate or ldaprc file.

It looks like you're failing at the ldap_start_tls() and not the
ldap_sasl_bind(...,"EXTERNAL") but that could just be a bad error
message.

Just an idea .. I've not actually done a SASL bind from PHP/IIS :)

-zeb



-----Original Message-----
From: dsartori [mailto:dsartori@u.washington.edu]
Sent: Monday, March 12, 2007 2:19 PM
To: php-windows@lists.php.net
Subject: [PHP-WIN] LDAP and IIS 6

Hello,

I am trying to get my certs and LDAP to work for SASL external
authentication. So far, no luck. My error message and code follow.
Some
of the documentation for PHP suggests that there is only limited LDAP
functionality included in the default extension (not SASL) and you must
recompile to get everything. Is this my problem? Which is a problem
since
I don't have Visual Studio C++. But knowing for sure that I haven't
done a
silly typo of some kind would be a good start. A friend is running
similar
code with success using the same certificates. So, I don't think it is
them.

This is my first foray into authenticated links so your help is greatly
appreciated.

Diana



[12-Mar-2007 10:08:23] PHP Warning: ldap_start_tls() [ href='function.ldap-start-tls'>function.ldap-start-tls]: Unable to
start
TLS: Connect error in

.......

# SASL EXTERNAL authentication config
$tls_cacert="ca.crt";
$tls_cert="website.crt";
$tls_key="website.key";

putenv("LDAPTLS_CACERT=$tls_cacert");
putenv("LDAPTLS_CERT=$tls_cert");
putenv("LDAPTLS_KEY=$tls_key");

# LDAPv3 is required
$r = ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, 3);

$d = ldap_connect($host);

if (!$d)
exit(0);

$r = ldap_start_tls($d);

--
------------------------------------------------------------ -
Diana Sartorius dsartori@u.washington.edu 206.543.7263
227 Hall Health Center Box 354400 U of WA
Seattle, WA 98195-4400

--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP Windows Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php