BeerSercYou are viewing revision #1 of this wiki article.
This version may not be up to date with the latest version.
You may want to view the differences to the latest version.
It took me a while to get ldap auth working with yii, so I write it down here, maybe it can be of some use.
Yii does not have a ldap class by itself, but you can extend it for example with Zend classes. To authenticate users at you page via ldap, change protected/components/UserIdentity.php in the following way:
On top of the file add:
Yii::import('application.vendors.*');
require_once('Zend/Ldap.php');
Delete or comment out everything in the authenticate() function. Then add
$options = array(
'host' => 'your.ldap.host.com',
'username' => 'your_admin_users_username',
'password' => 'your_admin_users_password',
'baseDn' => 'your_base_dn',
'useStartTls' => true, # if you need startTls
);
$ldap = new Zend_Ldap($options);
try{
$ldap->bind("cn=".$this->username.",your_base_dn", $this->password);
$auth=true;
}
catch (Exception $e){
$auth=false;
}
if($auth===true)
{
$this->errorCode=self::ERROR_NONE;
}
return !$this->errorCode;
For this to work you need Exception.php, Ldap.php and the Ldap folder from the library folder of a Zend installation in the folder protected/vendors/Zend
User Contributed Notes 15
okay
yes it's works.
fyi, ldap server configuration may vary, i use uid instead of cn.
$ldap->bind("uid=".$this->username.",ou=People,dc=blahblah,dc=com", $this->password);thanks!
adLDAP
You guys should take a look at this:
http://adldap.sourceforge.net/
I've done the same thing with 6 lines of code. Couldn't be simpler! :)
Why not use php ldap internal functions instead of zend's?
If it is just for validation you can aswell use the native LDAP functions of php without having to download/extract classes from another framework (and without exposing the admin passwd of the ldap server).
I have something along the line of the following (wrapped conveniently on a try/catch block in case the ldap connection cannot be established) working for about 1 year with no problem:
$ds=ldap_connect($serverURL); ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3); ldap_set_option($ds, LDAP_OPT_REFERRALS, 0); if ($ds) { $r=ldap_bind($ds,"uid=$this->username,ou=Users,dc=example,dc=com",$this->password); if (!$r) { $this->errorCode=self::ERROR_PASSWORD_INVALID; } else { $this->errorCode=self::ERROR_NONE; } } return !$this->errorCode;Thank you very much
I was just looking for this and this worked like a charm!
Thank you.
ldap_connect error ()
I generated the following error: Fatal error: Call to undefined function ldap_connect()
that extention library or should I include?
urgent help please! = D
fact identical to the example code
@Navarr
thanks for your reply, as I php_ldap.dll or php_ldap.so? where I can get in that directory and go?
@Navarr
Should uncomment the following line: Before Code ;extension = php_ldap.dll
Rate Code: extension = php_ldap.dll
only, or should I see other extensions that I have to move?
@Navarr
help...
I generated the following error:
ldap_bind() [function.ldap-bind]: Unable to bind to server: Invalid credentials
Active Directory
If you use active directory then:
In UserIdentity.php
public function authenticate() { $options = Yii::app()->params['ldap']; $connection = ldap_connect($options['host'], $options['port']); ldap_set_option($connection, LDAP_OPT_PROTOCOL_VERSION, 3); ldap_set_option($connection, LDAP_OPT_REFERRALS, 0); if($connection) { try { @$bind = ldap_bind($connection, $options['domain']."\\".$this->username, $this->password); } catch (Exception $e){ echo $e->getMessage(); } if(!$bind) $this->errorCode = self::ERROR_PASSWORD_INVALID; else $this->errorCode = self::ERROR_NONE; } return !$this->errorCode; }main.php
'params'=>array( 'ldap' => array( 'host' => 'serverAd.example.com', 'port' => 389, 'domain' => 'MYDOMAIN', ),adLDAP
i am trying to use adLDAP but i am having errors, can you provide more information about how to use it
Active Directory
@Ace D.
This worked to me!!
$bind = @ldap_bind($connection, $this->username."@".$options['domain'], $this->password);
Error validation
It's work for me if I login right username and password, but if login wrong password i got an error :
ldap_bind() [<a href='function.ldap-bind'>function.ldap-bind</a>]: Unable to bind to server: Invalid credentialshow to return/redirect login form to validate username and password?
@Finzaiko
You need to silence the ldap_bind error by prefixing it with a @. I've amended the article to reflect that.
Note: in general this is a bad thing to do, but in this case it may be necessary. Ldap should really be re-worked into some sort of an object resource that throws exceptions instead of errors.
Two-step login
Note, that there are systems and LDAP configurations, which requires two-step login approach, in which you don't construct your own DN!
First, you bind anonymously, by specifying only
$bind = @ldap_bind($connection);, then you search for a given username (usingldap_search). This search will return you a valid user's DN (orNULL, if particular user does not exist).Second, using returned LDAP you issue another
ldap_bind, this time attempting to actually login user.Question about authorization manager after successfully authenticating (with LDAP)
Hi, firstly thank you for this tutorial. My question is about authorization. If I want to have a few different levels based on the group membership of the users (who successfully login - authentication with LDAP as per your tutorial), what steps should I follow? I'm using gii and giix to generate my CRUD forms and then making changes to fit my requirements. Thank you
Leave a comment
If you have any questions, please ask in the forum instead.
Join the conversation to share a note.