我们有几台 AD 服务器，它们之间建立了森林信任，因此来自不同域的 Windows 用户能够访问受限资源。假设我们有 domainA.com 和 domainB.com，那么来自域 domainB.com 的任何用户都可以登录到 domainA.com 上的资源。出于安全原因，管理员禁用了对 LDAP 服务器的匿名访问。

现在我们需要在 OpenLDAP 客户端的帮助下在我们的 PHP 代码中列出来自所有 LDAP 服务器的所有用户。下面是从 domainB.com 获取所有用户信息的 PHP 代码

define('USER', 'user@domainA.com'); // User from domainA.com here
$ldap = ldap_connect('domainB.com') or die('Bad connection');
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
ldap_bind($ldap, USER, PASS) or die('Cannot bind');

我的脚本终止时出现消息“无法绑定(bind)”和 ldap 错误“49 无效凭据”。来自 AD 的附加信息:
80090308:LdapErr:DSID-0C0903A9，注释:AcceptSecurityContext 错误，数据 52e，v1db1

我认为问题出在简单的身份验证机制上，因为当我在 Ldap 管理员客户端中使用 GSS 协商身份验证时，使用与 user@domainA.com 相同的凭据，一切正常。

如何使用来自 user@domainA.com 的凭据在 domainB.com 上成功绑定(bind)？

UPD1 使用 SASL DIGEST-MD5 进行身份验证

ldap_sasl_bind ( $ldap, '', $pass, 'DIGEST-MD5', null, 'user@domainA.com');

来自 AD 的日志:

The computer attempted to validate the credentials for an account.

Authentication Package: WDigest
Logon Account:  user
Source Workstation: DOMAINA
Error Code: 0xc000006a

An account failed to log on.

Subject:
    Security ID:        NULL SID
    Account Name:       -
    Account Domain:     -
    Logon ID:       0x0

Logon Type:         3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:       user@domainA.com
    Account Domain:     domainA.com

Failure Information:
    Failure Reason:     An Error occured during Logon.
    Status:         0xc000006d
    Sub Status:     0xc000006d

Process Information:
    Caller Process ID:  0x0
    Caller Process Name:    -

Network Information:
    Workstation Name:   -
    Source Network Address: 
    Source Port:        

Detailed Authentication Information:
    Logon Process:      WDIGEST
    Authentication Package: WDigest
    Transited Services: -
    Package Name (NTLM only):   -
    Key Length:     0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.

最佳答案

我在配置 Moodle 时遇到过这个问题，它使用 PHP LDAP 库和 OpenLDAP 连接到 AD 服务器。解决方案非常简单，是两件事之一(实际上归结为一件事):

1. 使用未限定范围的用户名(即用户名后没有“@example.com”)
2. 使用域\用户名

基本上，它归结为获得正确的、预期的用户名语法。我认为这取决于特定的 AD 配置，因为我在各种 AD 服务器上看到了四种类型的用户名:完整 DN、范围用户名(即看起来像电子邮件地址)、DOMAIN\username 和普通用户名。

关于php - 如何使用来自受信任域的凭据绑定(bind)到 PHP 中的 AD 服务器？，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/6609692/