Authenticating users of your web applications can be tedious, especially when your users are expected to remember multiple passwords (which can become a security vulnerability in it’s own right). That being said, integrating your login scripts with Active Directory/LDAP can be beneficial for a variety reasons: stronger passwords, fewer login credentials for your user to remember, and fewer headaches for you. Here is how we integrated LDAP with our online application authentication.
LDAP (short for Lightweight Directory Access Protocol), a directory service that runs over TCP/IP, stores information. The storage is similar to how a database stores information, but the structure is ideal for attribute-based, hierarchical structured data that does not undergo frequent changes (for example, the employees’s name, Active Directory group membership, address, and so forth). The LDAP directory can be thought of as a tree of nodes, where each node represents an entry in the LDAP database. These entries are comprised of a collection of attribute-value pairs, and they are identified uniquely by a ‘distinguished name’ or DN. The DN is important, because this is what we will be using to determine a user’s group membership.
Our login script will
- First bind to our LDAP server with a resource account (we are not using anonymous binding, so we will need to provide a resource account’s credentials)
- Check that the user’s ID and password are legit and exist in our Active Directory environment
- Check if the user is a member of a particular security group
If all of these conditions are met, the users will have successfully logged on and will be granted access to our application.
We will store our authentication function in a php file entitled resourceBind.php. The entire contents of resourceBind.php:
[php]<?php
function UMldap($Username, $SSO_Password){
//*************************************
///////////////////////////////// Using ldap bind
$ldaprdn = ‘bindaccountname’; // ldap rdn or dn
$ldappass = ‘bindaccountpassword’; // associated password
$ldapserver = ‘ldaps://your.ldap.server:3269′;
//This is the Active Directory group that users MUST be a member of in order to login successfully
$groupPath1 = "CN=YOURSECURITYGROUP-GS,OU=Accounting,OU=Lewis-Building,OU=Headquarters,DC=headquarters,DC=acme,DC=com";
/////////////////////////////Base DN
$ldap_base_dn = "CN=Users,DC=headquarters,DC=acme,DC=com";
$ldapconn = ldap_connect($ldapserver)or die("Could not connect to LDAP server.");
if ($ldapconn) { //connect to ldap server
// binding to ldap server
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
// verify binding
if ($ldapbind) {
// echo "LDAP bind successful…";
$errorCount = 0;
$ld_filter = "samaccountname=" . $Username;
$ldap_base_dn = "DC=com";
//Recursively search for the account name in the directory tree. Slow, but effective…
$result = ldap_search($ldapconn, $ldap_base_dn, $ld_filter);
//Create result set
$entries = ldap_get_entries($ldapconn, $result);
//If the account exists, attempt a bind with it. This will ensure that the provided password is legit
$bind = @ldap_bind($ldapconn, $entries[0][dn], $SSO_Password);
if( !$bind || !isset($bind))
{
//the bind failed, which means that the user could have typed in the wrong ID or password. We will display another login form
?>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST" id="login" name="login">
Username: <input type=text size=30 name="ssoname" maxlength=30 /><br />
Password: <input type=password size=30 name="ssopass" maxlength=30 /><br />
<button type="submit" value="submit" name="submit" >Logon</button>
</form>
<?php
//no point in running the rest of the function, so exit out.
exit;
}
$ii=0;
for ($i=0; $ii < $entries[$i]["count"]; $ii++)
{
$data = $entries[$i][$ii];
if ($data == "memberof") {
$total_memberof = count($entries[$i][$data]);
$jj=0;
for ($jj=0; $jj<$total_memberof; $jj++) {
//Check the groups that the user is a member of and see if our specific group is in the list
if ($entries[$i][$data][$jj] == $groupPath1)
{
// The user is a member of the group, so lets create a session and then return true
$_SESSION['USERGROUP'] = $entries[$i][$data][$jj];
return true;
break;
}
}//end for
}//end if
}//end for
} else { //could not bind, so display an error message and the login form
// We could not bind with our default resource account, so let’s exit and not waste any time with the users credentials
$displayForm=true;
}
}///close connect IF
//Unbind from our resource account
ldap_unbind($ldapconn);
//*************************************
}//end function
?>
[/php]
And, our login page, which we will call login.php, and which will be located in the same directory as resourceBind.php:
[php]<?php
//Disable error messages
error_reporting(0);
?>
<?php require_once(‘resourceBind.php’); ?>
<?php
if ($_POST) {
//Handy function to remove specific special characters from user provided input. ALWAYS validate user input. In this case, we are removing characters that are not allowed in usernames and passwords.
function cleanTxt($text)
{
$code_entities_match =
array(‘–’,'>’,'"’,'!’,'#’,'$’,'%’,'^’,'&’,'*’,'(‘,’)',’{‘,’}',’|',’:',’"’,'<’,’[',']‘,’\\’,';’,"’",’,',’/',’*',’~',’`');
$code_entities_replace = array(‘-’,'-’,”,”,”,”,”,”,”,”,”,”,”,”,”,”,”,”,”);
$text = str_replace($code_entities_match, $code_entities_replace, $text);
return $text;
}
//Set form variables
$Username=stripslashes(cleanTxt($_POST['ssoname']));
$SSO_Password=stripslashes($_POST['ssopass']);
//Get Ip Address and User Agent information. This is useful info to store in sessions, or a database table, especially if you need to track timestamps and access
$userIP = $_SERVER['REMOTE_ADDR'];
//Get Timestamp
$myDate = date("Y-m-d H:i:s");//Date in easy-to-read format
$displayForm=false;
if(UMldap($Username,$SSO_Password)){
//set complex string in case there is no ‘whencreated’ field for the username
//User has valid credentials. We are creating a new session variable with the user name. This is also a good place to effectively double up your authentication security by checking to see if the user name exists in another medium, such as a MySQL or Oracle table.
$_SESSION['USERCMS'] = $Username;
//The login is a smashing success, so redirect the user to the protected page.
$MM_redirectWithSuccess = "Successful_login.php";
header("Location: ". $MM_redirectWithSuccess );
} else {
/We can’t log the user in, so display the login form again
$displayForm=true;
}
//unbind
ldap_unbind($ldapconn);
//*************************************
}//end POST check
?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" >
<head>
<title>LDAP Login Form</title>
</head>
<body>
<h1>Login</h1>
<?php
//—————————————————————————-
//Form variables to display previously filled out fields
$displayForm=true;
$ssoname=”;
$ssopass=”;
//—————————————————————————-
//Display the login form
if ($displayForm){//Display the request form
?>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST" id="login" name="login">
UserID:
<input type=text size=30 name="ssoname" maxlength=30 />
Password:
<input type=password size=30 name="ssopass" maxlength=30 />
<br />
<button type="submit" value="submit" name="submit" >Logon</button>
</form>
<?php
}
?>
<!– Javascript to move the cursor to the Username form field. This is a small convenience to the user. –>
<script type="text/javascript" language="JavaScript">
document.forms['login'].elements['ssoname'].focus();
</script>
</body>
</html>
[/php]
To figure out how everything works, please read the comments within the code. If you are interested in learning more, please check out Hugh’s excellent book:
Thantos PHP