ldap_bind() error with valid! credentials

[jenn99]

I need to authenticate a user using PHP and LDAP. I can successfully, connect to the LDAP server. ldap_bind() annonymously. And ldap_search(). But if I want to authenticate the username(userdn)/password pair by doing ldap_bind() with that pair - I get an "invalid credentials" error (however, the userdn and password are DEFINITELY valid!)

I know that the passwords stored on the LDAP server are encrypted - do I have to do some sort of encryption in the PHP script before I do ldap_bind()?

What else would cause that invalid credentials error?

 

[DRJ478]

Can you show some code please? It's hard to answer without any "corpus delicti".

 

[jenn99]

Sure.

The latest bit of code I have running is this:

$ldap_host = "12.3.45.6";
// 12.3.45.6 - fake IP, obviously I use the real one in my script...

$ldap_user = "uid=myuserid,ou=users,dc=mycompany,dc=com";
// our user data isn't in "people" like others I've read
// about online - it's actually in users...
// and myuserid is replaced with my own user id
// which I know is valid...


$ldap_pass = "mypassword";
// mypassword is replaced with my own password
// which I know is valid...

$connect = ldap_connect($ldap_host)
or exit(">>Could not connect to LDAP server<<");
ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);

$bind = ldap_bind($connect, $ldap_user, $ldap_pass)
or exit(">>Could not bind to $ldap_host<<");


And that gives me this error:

Warning: ldap_bind(): Unable to bind to server: Invalid credentials in ...(my document path and name here...)
>>Could not bind to (ip addres of ladp server here)<

 

[jenn99]

Actually - changing the ou=users to cn=users may be the trick...

 

[jenn99]

To answer my own question...

If you have valid credentials, and you're still getting a "invalid credentials" error - check to make sure that with all your testing, etc. that you haven't caused your account to be locked. Heh. Not that I would know anything about that... ;-)

So, that's what had happened. I had actually hit it right somewhere in all my testings/trying out different things - but apparently the way our setup is, if you attempt to login too many times incorrectly - your account gets locked... at which point, even if you try again with VALID credentials - a locked account will give that "invalid credentials" error.