title: PHP LDAP Connection to Authenticate against Active Directory from External Server
body: <p>I have an external web server trying to authenticate against Active Directory on an internal server via LDAP. I am able to connect and authenticate locally, though using the same code (switching out host and port) am not able to authenticate externally. We have other services that are able to connect and authenticate such as Attask (http://www.attask.com/).</p>
  
  <p>The external server is currently a Linux (gs) on Media Temple running PHP 5.3.15 with LDAP support enabled.</p>
  
  <p>The internal server is currently a Windows Server 2008 box with LDAP and Active Directory.</p>
  
  <p>The code below is the current PHP I am using that was able to connect locally, but having problems on the external server. It basically uses the PHP LDAP connection string and tries to bind. If it fails, it tries to bind anonymously. Both of which aren't working externally and returns the error: Can't contact LDAP server.</p>
  
  <pre><code>&lt;?php
  $username = 'username';
  $password = 'password';
  
  $ldapconfig['host'] = '00.000.000.000';
  $ldapconfig['port'] = '636';
  $ldapconfig['basedn'] = 'dc=client,dc=eqc,dc=local';
  
  $ds=ldap_connect($ldapconfig['host'], $ldapconfig['port']);
  
  ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
  ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
  ldap_set_option($ds, LDAP_OPT_NETWORK_TIMEOUT, 10);
  
  $dn="".$username."";
  
  if ($bind=ldap_bind($ds, $dn, $password)) {
    echo("Login correct");
  } else {
  
    echo("Unable to bind to server.&lt;/br&gt;");
  
    echo("msg:'".ldap_error($ds)."'&lt;/br&gt;".ldap_errno($ds)."");
  
    if ($bind=ldap_bind($ds)) {
  
      $filter = "(cn=*)";
  
      if (!($search=@ldap_search($ds, $ldapconfig['basedn'], $filter))) {
        echo("Unable to search ldap server&lt;br&gt;");
        echo("msg:'".ldap_error($ds)."'&lt;/br&gt;");
      } else {
        $number_returned = ldap_count_entries($ds,$search);
        $info = ldap_get_entries($ds, $search);
        echo "The number of entries returned is ". $number_returned."&lt;p&gt;";
        for ($i=0; $i&lt;$info["count"]; $i++) {
          var_dump($info[$i]);
        }
      }
    } else {
      echo("Unable to bind anonymously&lt;br&gt;");
      echo("msg:".ldap_error($ds)."&lt;br&gt;");
    }
  }
  ?&gt;
  </code></pre>
  
  <p>A few notes:</p>
  
  <ul>
  <li><p>The external LDAP server is using LDAPS so the suggested host is ldaps://00.000.000.000 on port 636</p></li>
  <li><p>I've tried binding with 'username' as well as 'username@00.000.000.000' already</p></li>
  <li><p>There is a firewall, however, the external server can successfully ping the internal LDAP server so there is connection taking place on that level.</p></li>
  </ul>
  
  <p>Any help would be greatly appreciated. If there are server settings or things of that nature, would love to know. Also, I've checked out ADFS though could not find a simple script to setup to test without spending a lot time to no end if it didn't work.</p>