Using PHP LDAP Functions for Connecting, Binding, and Authenticating Users

LDAP (Lightweight Directory Access Protocol) is a protocol for accessing and maintaining distributed directory information, often used for user authentication and authorization in web applications. PHP offers a set of functions to work with LDAP, and this guide demonstrates how to connect, bind, and authenticate users using these functions.

1. Connect to LDAP Server

Use the ldap_connect function to establish a connection to the LDAP server. The following example shows how to specify the server address and port, and handle connection failures with or die.

<?php
$ldapserver = 'ldap.example.com';
$ldapport = 389; // default port
$ldapconn = ldap_connect($ldapserver, $ldapport)
    or die("Unable to connect to LDAP server: $ldapserver");
?>

2. Bind to LDAP Server

After connecting, bind a user to the server with ldap_bind. The example sets the LDAP protocol version to 3 using ldap_set_option, then binds the administrator account.

<?php
$ldaprdn = 'cn=admin,dc=example,dc=com';
$ldappass = 'adminpassword';
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
if ($ldapbind) {
    echo "LDAP bind successful!";
} else {
    echo "LDAP bind failed!";
}
?>

3. User Authentication

To authenticate a user, search for the user's DN with ldap_search and retrieve the entry with ldap_get_entries. If a single entry is found, bind with the supplied password to verify credentials.

<?php
$username = 'user1';
$password = 'password1';
$searchFilter = "(uid=$username)";
$searchResult = ldap_search($ldapconn, 'ou=users,dc=example,dc=com', $searchFilter);
$entry = ldap_get_entries($ldapconn, $searchResult);
if ($entry['count'] == 1) {
    $ldaprdn = $entry[0]['dn'];
    $ldapbind = ldap_bind($ldapconn, $ldaprdn, $password);
    if ($ldapbind) {
        echo "User authentication successful!";
    } else {
        echo "Invalid username or password!";
    }
} else {
    echo "User does not exist!";
}
?>

This basic workflow and the accompanying sample code illustrate how PHP can connect to an LDAP server, bind an account, and perform user authentication, enabling secure access control in web applications.