Binding to ADDS with SSL using PHP

[neonetman]

I'm trying to connect to ADDS to manipulate user accounts using PHP, and whilst I can connect succesfully without SSL (e.g. on port 389), as soon as I try to connect using port 636 for SSL, I'm coming unstuck:

 

The following code works perfectly fine (Obviously I've removed the section that sets the login account variables for security):-

 

// User directory. Such as all users are placed in
// the Users directory by default.
$user_dir = "OU=Test-PHPCreate,{redacted}";
// Either an IP or a domain.$ldap_server = "dc02.ad.domain.org.uk";
// Get a connection$ldap_conn = ldap_connect($ldap_server) or die("Not Parseable");

// Set LDAP_OPT_PROTOCOL_VERSION to 3
ldap_set_option($ldap_conn, LDAP_OPT_PROTOCOL_VERSION, 3) or die ("Could not set LDAP Protocol version");

// Authenticate the user and link the resource_id with
// the authentication.
if($ldapbind = ldap_bind($ldap_conn,$username,$password) == true){

 

However if I switch to this it either comes back with a 504 error, or with the error that I'll post below:-

 

// User directory. Such as all users are placed in
// the Users directory by default.
$user_dir = "OU=Test-PHPCreate,{redacted}";
// Either an IP or a domain.
$ldap_server = "ldaps://dc02.ad.domain.org.uk/";

// Get a connection
$ldap_conn = ldap_connect($ldap_server, 636) or die("Not Parseable");

// Set LDAP_OPT_PROTOCOL_VERSION to 3
ldap_set_option($ldap_conn, LDAP_OPT_PROTOCOL_VERSION, 3) or die ("Could not set LDAP Protocol version");


// Authenticate the user and link the resource_id with
// the authentication.
if($ldapbind = ldap_bind($ldap_conn,$username,$password) == true){

 

Warning: ldap_bind(): Unable to bind to server: Can't contact LDAP server in C:\inetpub\dev{redacted} on line 33

Could not bind to the server. Check the username/password.

Server Response:

Error Number: -1

Description: Can't contact LDAP server

 

Line 33 is the ldap_bind command

 

Hopeing one of you gurus can point me in the right direection (btw I have run ldp.exe from the web server, and another DC and connected correctly on port 636)

 

Edited September 27, 2021 by neonetman

[neonetman]

Anyone? This could be a deal-breaker for a system we're investigating if we can't provision/update accounts into AD on premises

[Norphy]

Is there a certificate on the domain controller to allow LDAPS? Does the machine connecting to the DC trust the certificate?

[howartp]

https://www.php.net/manual/en/function.ldap-connect.php

 

 

Have a look at the comment by nateshull at the bottom of the article.

[neonetman]

Excuse what is potentialy a noob question - but which certificate do I need to find on the DC, and how do I make the webserver trust it (or vice versa).

 

I can only think that it is a certificate issue but not sure how to debug further