PHP LDAP Question

Question

I am desperately trying to get a LDAPs client in PHP working. My code is in place, and it works using the standard LDAP protocol.

However, when I change ldap://server to ldaps://server, it doesnt work. Setting the debug mode to 7 yeilds this error. I should add that this a linux server using openSSL.

TLS: can't connect: The Diffie Hellman prime sent by the server is not acceptable (not long enough)..

Is there any way to get past this? Changing anything on the LDAP server is not an option as I only have client privlidges on it.

EDIT: Only setting in my LDAP.conf is

TLS_REQCERT never

EDIT2: Here is my code

if(isset($_POST['pass'])){
    $username = $_POST['user'];
    $password = $_POST['pass'];

    ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);



    $ds=ldap_connect("ldaps://ldap.ryerson.ca");  
    //$ds=ldap_connect("141.117.101.14");  
    ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
    ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3) ;
    //Check LDAP server for user
        if(!@ldap_bind($ds, "uid={$username},ou=people,o=ryerson.ca,o=ryerson", "{$password}") || strlen($password)==0){
    //      LDAP login was not successful
            printf("Sorry, wrong username/password\n\n\n");
            return;
        }

    $ldapSearch=@ldap_search($ds, "ou=people,o=ryerson.ca,o=ryerson", "uid={$_POST['user']}");
    $result = @ldap_get_entries($ds, $ldapSearch);


}

Answer 1

First of all, this is for Ryerson? Come on! (I used to work at York U! Gotta tease the guys downtown a little. Could be worse, you could be at U of T!). But seriously, depending on your LDAP server at the backend, there are two usual approaches.

ldaps://ldap.ryerson.ca:636 might work better, in that it will try and do an SSL bind, expecting you have trusted the public key of the CA that signed the certificate in use for SSL.

TLS is really SSL V3.1 and one of the very nice features it adds is that it works fine on port 389 as well, but can issue a StartTLS command which takes a clear text connection you started on 389 and enables encryption.

My suspicion is that from the error code it is trying to make an LDAP over SSL on the clear text port which will fail.

Answer 2

This could be due to a bug in your version of libgnutls

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=440344