blocks|key|364484|text|PHP有库：http://ca.php.net/ldap|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|364485|PEAR还有许多包：http://pear.php.net/search.php?q=ldap&in=packages&x=0&y=0|364486|我也没有使用过，但我一度打算使用，它们看起来应该可以工作。|364487|entityMap|0|LINK|mutability|MUTABLE|url|http://ca.php.net/ldap|1|http://pear.php.net/search.php?q=ldap&in=packages&x=0&y=0^0|6|M|0|0|A|1L|1|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]]|C|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@$A|W|B|X|1|Y]]|C|$]]|$1|F|3|G|5|6|7|Z|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|10|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]|P|$5|K|L|M|C|$N|Q]]]]

PHP has libraries: <a href="http://ca.php.net/ldap" rel="noreferrer">http://ca.php.net/ldap</a>

PEAR also has a number of packages: <a href="http://pear.php.net/search.php?q=ldap&amp;in=packages&amp;x=0&amp;y=0" rel="noreferrer">http://pear.php.net/search.php?q=ldap&amp;in=packages&amp;x=0&amp;y=0</a>

I haven't used either, but I was going to at one point and they seemed like they should work.

blocks|key|3364291|text|我喜欢Zend类，你只能在你的项目中使用这个类，而不需要Zend_Ldap框架。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3364292|entityMap|0|LINK|mutability|MUTABLE|url|https://framework.zend.com/manual/2.3/en/modules/zend.ldap.introduction.html^0|S|9|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

I like the <a href="https://framework.zend.com/manual/2.3/en/modules/zend.ldap.introduction.html" rel="nofollow noreferrer">Zend_Ldap</a> Class, you can use only this class in your project, without the Zend Framework.

blocks|key|3364294|text|我只需将用户凭据传递给ldap_bind()即可。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3364295|http://php.net/manual/en/function.ldap-bind.php|offset|length|3364296|如果该帐户可以绑定到LDAP，则它是有效的；如果它不能绑定，则它不是有效的。如果您所做的只是身份验证(而不是帐户管理)，那么我看不出有必要使用库。|3364297|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|1B|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@$D|Q|E|R|1|S]]|A|$]]|$1|F|3|G|5|6|7|T|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|U|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|C]]]]

I do this simply by passing the user credentials to ldap_bind().

<a href="http://php.net/manual/en/function.ldap-bind.php" rel="noreferrer">http://php.net/manual/en/function.ldap-bind.php</a>

If the account can bind to LDAP, it's valid; if it can't, it's not. If all you're doing is authentication (not account management), I don't see the need for a library.

blocks|key|361983|text|当你只需要两行代码时，导入整个库似乎效率很低……|type|unstyled|depth|inlineStyleRanges|entityRanges|data|361984|$ldap+=+ldap_connect("ldap.example.com");
if+($bind+=+ldap_bind($ldap,+$_POST['username'],+$_POST['password']))+{
++//+log+them+in!
}+else+{
++//+error+message
}|code-block|syntax|javascript|361985|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Importing a whole library seems inefficient when all you need is essentially two lines of code...

<pre><code>$ldap = ldap_connect("ldap.example.com");
if ($bind = ldap_bind($ldap, $_POST['username'], $_POST['password'])) {
 // log them in!
} else {
 // error message
}
</code></pre>

blocks|key|361990|text|对于那些正在寻找完整示例的人，请查看http://www.exchangecore.com/blog/how-use-ldap-active-directory-authentication-php/。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|361991|我测试了从Windows+Server2003Web+Server+(IIS6)和从运行R2+8的Windows+Server+2012企业连接到Windows+Server2003和windows+Server2008IIS域控制器的方法。|361992|entityMap|0|LINK|mutability|MUTABLE|url|http://www.exchangecore.com/blog/how-use-ldap-active-directory-authentication-php/^0|I|2A|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

For those looking for a complete example check out <a href="http://www.exchangecore.com/blog/how-use-ldap-active-directory-authentication-php/" rel="noreferrer">http://www.exchangecore.com/blog/how-use-ldap-active-directory-authentication-php/</a>.

I have tested this connecting to both Windows Server 2003 and Windows Server 2008 R2 domain controllers from a Windows Server 2003 Web Server (IIS6) and from a windows server 2012 enterprise running IIS 8.

blocks|key|361264|text|您可能认为，在Active+Directory中使用LDAP对用户进行身份验证将是一个非常简单的过程，而不需要库。但是有很多事情会让事情变得非常复杂：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|361265|361266|您必须验证输入。否则将传递空的用户名/密码。|unordered-list-item|361267|您应该确保在绑定时对用户名/密码进行了正确编码。|361268|您应该使用TLS对连接进行加密。|361269|使用单独的LDAP服务器提供冗余，以防其中一个服务器关闭。如果身份验证失败，|361270|会收到一条信息性错误消息。|361271|361272|实际上，在大多数情况下，使用支持上述功能的LDAP库会更容易。最终，我使用了自己的库来处理上述所有问题：LdapTools+(好吧，不仅仅是用于身份验证，它还可以做更多的事情)。它的使用方法如下：|offset|length|361273|use+LdapTools\Configuration;
use+LdapTools\DomainConfiguration;
use+LdapTools\LdapManager;

$domain+=+(new+DomainConfiguration('example.com'))
++++->setUsername('username')+#+A+separate+AD+service+account+used+by+your+app
++++->setPassword('password')
++++->setServers(['dc1',+'dc2',+'dc3'])
++++->setUseTls(true);
$config+=+new+Configuration($domain);
$ldap+=+new+LdapManager($config);

if+(!$ldap->authenticate($username,+$password,+$message))+{
++++echo+"Error:+$message";
}+else+{
++++//+Do+something...
}|code-block|syntax|javascript|361274|上面的身份验证调用将：|361275|361276|验证用户名或密码是否正确编码(默认情况下为UTF-8)。|361277|尝试备用empty.|361278|Ensure服务器，以防其中一台服务器使用TLS+down.|361279|Encrypt身份验证请求。|361280|361281|在失败时提供其他信息(即，锁定/禁用帐户等)|361282|361283|还有其他库也可以做到这一点(比如Adldap2)。然而，我觉得有必要提供一些额外的信息，因为投票最多的答案实际上是一个安全风险，没有进行输入验证，也没有使用TLS。|361284|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/ldaptools/ldaptools^0|0|0|0|0|0|0|0|0|1G|9|0|0|0|0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1M|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|1N|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|1O|8|@]|9|@]|A|$]]|$1|F|3|G|5|E|7|1P|8|@]|9|@]|A|$]]|$1|H|3|I|5|E|7|1Q|8|@]|9|@]|A|$]]|$1|J|3|K|5|E|7|1R|8|@]|9|@]|A|$]]|$1|L|3|M|5|E|7|1S|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|1T|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1U|8|@]|9|@$Q|1V|R|1W|1|1X]]|A|$]]|$1|S|3|T|5|U|7|1Y|8|@]|9|@]|A|$V|W]]|$1|X|3|Y|5|6|7|1Z|8|@]|9|@]|A|$]]|$1|Z|3|-4|5|6|7|20|8|@]|9|@]|A|$]]|$1|10|3|11|5|E|7|21|8|@]|9|@]|A|$]]|$1|12|3|13|5|E|7|22|8|@]|9|@]|A|$]]|$1|14|3|15|5|E|7|23|8|@]|9|@]|A|$]]|$1|16|3|17|5|E|7|24|8|@]|9|@]|A|$]]|$1|18|3|-4|5|E|7|25|8|@]|9|@]|A|$]]|$1|19|3|1A|5|E|7|26|8|@]|9|@]|A|$]]|$1|1B|3|-4|5|6|7|27|8|@]|9|@]|A|$]]|$1|1C|3|1D|5|6|7|28|8|@]|9|@]|A|$]]|$1|1E|3|-4|5|6|7|29|8|@]|9|@]|A|$]]]|1F|$1G|$5|1H|1I|1J|A|$1K|1L]]]]

You would think that simply authenticating a user in Active Directory would be a pretty simple process using LDAP in PHP without the need for a library. But there are a lot of things that can complicate it pretty fast:

<ul>
<li>You must validate input. An empty username/password would pass otherwise.</li>
<li>You should ensure the username/password is properly encoded when binding.</li>
<li>You should be encrypting the connection using TLS.</li>
<li>Using separate LDAP servers for redundancy in case one is down.</li>
<li>Getting an informative error message if authentication fails.</li>
</ul>

It's actually easier in most cases to use a LDAP library supporting the above. I ultimately ended up rolling my own library which handles all the above points: <a href="https://github.com/ldaptools/ldaptools" rel="noreferrer">LdapTools</a> (Well, not just for authentication, it can do much more). It can be used like the following:

<pre><code>use LdapTools\Configuration;
use LdapTools\DomainConfiguration;
use LdapTools\LdapManager;

$domain = (new DomainConfiguration('example.com'))
 -&gt;setUsername('username') # A separate AD service account used by your app
 -&gt;setPassword('password')
 -&gt;setServers(['dc1', 'dc2', 'dc3'])
 -&gt;setUseTls(true);
$config = new Configuration($domain);
$ldap = new LdapManager($config);

if (!$ldap-&gt;authenticate($username, $password, $message)) {
 echo "Error: $message";
} else {
 // Do something...
}
</code></pre>

The authenticate call above will:

<ul>
<li>Validate that neither the username or password is empty.</li>
<li>Ensure the username/password is properly encoded (UTF-8 by default)</li>
<li>Try an alternate LDAP server in case one is down.</li>
<li>Encrypt the authentication request using TLS.</li>
<li>Provide additional information if it failed (ie. locked/disabled account, etc)</li>
</ul>

There are other libraries to do this too (Such as Adldap2). However, I felt compelled enough to provide some additional information as the most up-voted answer is actually a security risk to rely on with no input validation done and not using TLS.

I'm looking for a way to authenticate users through LDAP with PHP (with Active Directory being the provider). Ideally, it should be able to run on IIS 7 (<a href="http://adldap.sourceforge.net/" rel="noreferrer">adLDAP</a> does it on Apache). Anyone had done anything similar, with success?

<ul>
<li>Edit: I'd prefer a library/class with code that's ready to go... It'd be silly to invent the wheel when someone has already done so.</li>
</ul>

Authenticating in PHP using LDAP through Active Directory

Windows Server

身份验证

服务器

Windows

我正在寻找一种方法来验证用户通过LDAP与PHP (与Active Directory提供程序)。理想情况下，它应该能够在IIS7上运行(可以在Apache上运行)。有没有人成功地做过类似的事情？编辑:我更喜欢有现成代码的库/类……在别人已经发明轮子的时候发明轮子是愚蠢的。--

问在PHP中通过Active Directory使用LDAP进行身份验证
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在PHP中通过Active Directory使用LDAP进行身份验证EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在PHP中通过Active Directory使用LDAP进行身份验证
EN