1

Running PHP 5.4.16. Here's the (simplified) code:

<?php
    $username = "username";
    $password = "password";
    $ldap = ldap_connect("ldaps://ldap.domain.xyz", 636);
    ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
    ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
    $bind = ldap_bind($ldap, $username, $password);
    ldap_unbind($ldap);
?>

And here's the LDAP section of phpinfo:

ldap

LDAP Support => enabled
RCS Version => $Id$
Total Links => 0/unlimited
API Version => 3001
Vendor Name => OpenLDAP
Vendor Version => 20440
SASL Support => Enabled

Directive => Local Value => Master Value
ldap.max_links => Unlimited => Unlimited

No matter what I try, I get the same "ldap_bind(): Unable to bind to server: Can't contact LDAP server" error. SELinux already has httpd_can_connect_ldap --> on set, and I've also tried disabling SELinux entirely which didn't help. Everything else I can turn up suggests firewall/credentials issues or configuration problems on the server side, but:

  1. I am one hundred percent positive that I'm using the right credentials.
  2. I can telnet to the LDAP server on port 636 so I'm reasonably sure it's not a firewall issue.
  3. This same code works fine on a different machine (which is running PHP 5.3.3) with the same credentials.

I'm kind of at my wit's end. Anyone have any ideas what it could be?

pastelillos
  • 11
  • 1
  • 4
  • Many different things can cause this, a more detailed list is here: https://stackoverflow.com/q/5309372/367456 – hakre Jun 29 '17 at 21:31
  • 1
    Check if your 5.3.3 machine has `TLS_REQCERT` set to `never` in `/etc/openldap/ldap.conf` (the location might be different) and then check if your machine that won't budge has it to something else. It could be related to certificate check, and LDAP might be using non-CA certificate, which causes the connection error. Now.. I might be shooting in the dark, but it's worth a try. – N.B. Jun 29 '17 at 22:10
  • What is the underlying error? Is it 'connection refused', 'connect timeout', an SSL handshake problem, ...? – user207421 Jul 03 '17 at 00:21
  • 1
    @EJP is there a way to check this? The only output I'm getting is the "can't contact LDAP server" message that I pasted above. – pastelillos Jul 05 '17 at 13:48

0 Answers0