title: Validate credentials against Active Directory with Zend\Authentication\Adapter\Ldap (ZF2)
body: <p>I want to check username/password against our active directory within my ZF2-Application. I use Zend\Authentication\Adapter\Ldap for this and it works partly.</p>
  
  <p>This is my code:</p>
  
  <pre><code>use Zend\Authentication\AuthenticationService;
  use Zend\Authentication\Adapter\Ldap as AuthAdapter;    
  
  $username = 'johndoe';
  $password = 'xxx';
  
  $auth = new AuthenticationService();
  $adapter = new AuthAdapter(
      array('server1'=&gt;array(
          'host' =&gt; '192.168.0.3',
          'useStartTls' =&gt; false,
          'useSsl' =&gt; false,
          'accountDomainName' =&gt; 'domain.local',
          'accountDomainNameShort' =&gt; 'DOMAIN',
          'accountCanonicalForm' =&gt; 3,
          'accountFilterFormat' =&gt; '(&amp;(objectClass=user)(sAMAccountName=%s))',
          'baseDn' =&gt; 'CN=Users,DC=domain,DC=local',
          'bindRequiresDn' =&gt; false,
          'optReferrals' =&gt; false
      )), 
      $username, 
      $password
  );
  
  $result = $auth-&gt;authenticate($adapter);
  
  var_dump($result);
  </code></pre>
  
  <p>if I set an incorrect password i get the following result:</p>
  
  <pre><code>object(Zend\Authentication\Result)#279 (3) {
    ["code":protected]=&gt;
    int(-3)
    ["identity":protected]=&gt;
    string(3) "johndoe"
    ["messages":protected]=&gt;
    array(4) {
      [0]=&gt;
      string(19) "Invalid credentials"
      [1]=&gt;
      string(124) "0x31 (Invalid credentials; 80090308: LdapErr: DSID-0C0903AA, comment:     AcceptSecurityContext error, data 52e, v1772): DOMAIN\johndoe"
      [2]=&gt;
      string(238) "host=192.168.0.3,useStartTls=,useSsl=,accountDomainName=domain.local,accountDomainNameShort=DOMAIN,accountCanonicalForm=3,accountFilterFormat=(&amp;(objectClass=user)(sAMAccountName=%s)),baseDn=CN=Users,DC=domain,DC=local,bindRequiresDn=,optReferrals="
      [3]=&gt;
      string(151) "johndoe authentication failed: 0x31 (Invalid credentials; 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 52e, v1772): DOMAIN\johndoe"
    }
  }
  </code></pre>
  
  <p>with the correct password the result changes:</p>
  
  <pre><code>object(Zend\Authentication\Result)#279 (3) {
    ["code":protected]=&gt;
    int(-1)
    ["identity":protected]=&gt;
    string(3) "johndoe"
    ["messages":protected]=&gt;
    array(4) {
      [0]=&gt;
      string(22) "Account not found: johndoe"
      [1]=&gt;
      string(68) "0x20: No object found for: (&amp;(objectClass=user)(sAMAccountName=johndoe))"
      [2]=&gt;
      string(238) "host=192.168.0.3,useStartTls=,useSsl=,accountDomainName=domain.local,accountDomainNameShort=DOMAIN,accountCanonicalForm=3,accountFilterFormat=(&amp;(objectClass=user)(sAMAccountName=%s)),baseDn=CN=Users,DC=domain,DC=local,bindRequiresDn=,optReferrals="
      [3]=&gt;
      string(95) "johndoe authentication failed: 0x20: No object found for: (&amp;(objectClass=user)(sAMAccountName=johndoe))"
    }
  }
  </code></pre>
  
  <p>why is no account found? Is there a problem with my accountFilterFormat?</p>
  
  <p>sAMAccountName and objectClass seem to be valid. I checked this with the Sysinternals Active Directory Browser:
  <img src="https://i.stack.imgur.com/W1U7L.png" alt="Active Directory Browser">
  <img src="https://i.stack.imgur.com/W3ytf.png" alt="Active Directory Browser Properties"></p>
  
  <p>A similar search with this tool works fine:
  <img src="https://i.stack.imgur.com/XkRkk.png" alt="Active Directory Browser Search"></p>