LDAP bind with Win Server 2008 R2 Standard AD fails - ldap

Question

The environment is a single server running Win Server 2008 R2 Standard with SP1 with Apache 2.2 and PHP 5.3.19.
I have a PHP script that attempts to do an LDAP bind to the Win Server 2008 R2 Active Directory and fails no matter what variations I try. I put in a lot of echos to see the results at each step, and I've discovered that ldap_connect ALWAYS connects. I can put total garbage in the URL and it never fails. The latest iteration of my PHP script does an anonymous bind, then does an ldap_search, which fails.
Here's the script (actual domain, user & pswd changed):
<?php
define(LDAP_OPT_DIAGNOSTIC_MESSAGE, 0x0032);
ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
echo "<br>LDAP set debug level: " . ldap_errno($ad) . ' ' . ldap_error($ad);
$LDAPhost = 'ldap://myDomain.com';
$LDAPport = '3268';
$ad = ldap_connect($LDAPhost, $LDAPport);
echo "<br>LDAP connect to $LDAPhost: " . ldap_errno($ad) . ' ' . ldap_error($ad);
if ($ad) {
ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);
echo "<br>LDAP set protocol to version 3: " . ldap_errno($ad) . ' ' . ldap_error($ad);
ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);
echo "<br>LDAP set referrals to 0: " . ldap_errno($ad) . ' ' . ldap_error($ad);
$bind = ldap_bind($ad);
echo "<br>LDAP bind: " . ldap_errno($ad) . ' ' . ldap_error($ad);
$baseDN = 'CN=Users,DC=myDomain,DC=com';
$filter = '(objectClass=*)';
$search = ldap_search($ad, $baseDN, $filter);
echo "<br>LDAP search $baseDN $filter: " . ldap_errno($ad) . ' ' . ldap_error($ad);
if ($rec = ldap_get_entries($ad, $search)) {
echo "<br>LDAP get entries: " . ldap_errno($ad) . ' ' . ldap_error($ad);
for ($i = 0; $i < $rec["count"]; $i++) {
echo "<br>$rec[0]['uid'][0]";
echo "<br>$rec[0]['givenname'][0]";
}
} else {
echo '<br>Record not found.';
}
ldap_close($ad);
} else {
echo '<br><br>Could not connect.';
}
?>
The displayed results are:
LDAP set debug level:
LDAP connect to ldap://myDomain.com: 0 Success
LDAP set protocol to version 3: 0 Success
LDAP set referrals to 0: 0 Success
LDAP bind: 0 Success
LDAP search CN=Users,DC=myDomain,DC=com (objectClass=*): 1 Operations error
Record not found.
Using the Windows LDP.exe utility, I am able to bind with the same user/pswd credentials used in the test.
I would love to know exactly what to put as the base DN, i.e. what is ldap_bind comparing these values to? Something in Active Directory? Something in the registry? Something else?
Searching for this stuff turns up lots of examples, but none that work for me. Any ideas?

Answer 1

The Base DN you need is a valid DN in your AD. How do you find a base DN? Well you need to look at the rootDSE, to see what the namingContexts attribute says.
If you have a Unix box with ldapsearch, you can do an
ldapsearch -x -h mydomain.com -p3268 | less to see what namingContexts values are.
AD usually has 4 namingContexts values as I recall by default. (Don't have an AD box to do a quick test against). Many GUI LDAP tools can let you connect and look at the rootDSE or else have a GUI way to see it.

Answer 2

One thing to note is if the base DN doesn't seem to work and you are sure of everything, try using the 2003 format for the username: user#domain instead of the DN. There seems to be an issue where a domain that was migrated from a 2003 controller to a 2008 controller might have issues binding using PHP LDAP functions. I don't have the full details as I'm still exploring it but the 2003 format works on a 2008 R2 domain controller. Below is a sample basic function used in testing.
# $ldapconn = a valid connection
# $username = a username in the format 'username#domain'
# #password = the password for the above user
function ad_auth($ldapconn,$username,$password){
ldap_set_option ($ldapconn, LDAP_OPT_REFERRALS, 0);
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
try {
$ldap_bind = ldap_bind($ldapconn, $username, $password);
} catch (Exception $e){
# Your error code
}
return $ldap_bind;
}
Usage: $rs = ad_auth($ldapconn,$username,$password);
If I figure out the cause I'll post it.