ldap_bind

(PHP 4, PHP 5)

ldap_bindBind to LDAP directory

Description

bool ldap_bind ( resource $link_identifier [, string $bind_rdn = NULL [, string $bind_password = NULL ]] )

Binds to the LDAP directory with specified RDN and password.

Parameters

link_identifier

An LDAP link identifier, returned by ldap_connect().

bind_rdn

bind_password

If bind_rdn and bind_password are not specified, an anonymous bind is attempted.

Return Values

Returns TRUE on success or FALSE on failure.

Examples

Example #1 Using LDAP Bind

<?php

// using ldap bind
$ldaprdn  'uname';     // ldap rdn or dn
$ldappass 'password';  // associated password

// connect to ldap server
$ldapconn ldap_connect("ldap.example.com")
    or die(
"Could not connect to LDAP server.");

if (
$ldapconn) {

    
// binding to ldap server
    
$ldapbind ldap_bind($ldapconn$ldaprdn$ldappass);

    
// verify binding
    
if ($ldapbind) {
        echo 
"LDAP bind successful...";
    } else {
        echo 
"LDAP bind failed...";
    }

}

?>

Example #2 Using LDAP Bind Anonymously

<?php

//using ldap bind anonymously

// connect to ldap server
$ldapconn ldap_connect("ldap.example.com")
    or die(
"Could not connect to LDAP server.");

if (
$ldapconn) {

    
// binding anonymously
    
$ldapbind ldap_bind($ldapconn);

    if (
$ldapbind) {
        echo 
"LDAP bind anonymous successful...";
    } else {
        echo 
"LDAP bind anonymous failed...";
    }

}

?>

See Also

Коментарии

I ran into a problem where I was getting a protocol error when I tried to bind.  I was able to connect fine and ldap commands worked fine from the command line. 

The problem turned out to be that openldap (v 2.1.5) was starting up in version 3 ldap mode, and php (4.2.3) expected it to be in version 2 mode.

To fix this use the ldap_set_option command to change the version that php expects.
2002-09-27 14:08:24
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
OpenLdap 2.1.x libraries support both LDAPv2 and LDAPv3. The problem lies with the slapd, the ldap server bundled with OpenLDAP.  It's default supported version is LDAPv3. One can set the "allow bind_v2" in the slapd.conf file, with this configured, the PHP ldap_set_option() is not required.
2002-11-21 03:01:30
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
You should NOT attempt to bind with a made up password.  However small the chance, the chance remains that your code produces a valid password.  The correct behaviour is to test for an empty password, and if your application will only service authenticated users, not perform any more LDAP operations on behalf of the user - this also happens to be more efficient.
2003-12-31 10:51:01
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
I want to point out that the line that reads 

"$ldaprdn  = 'uname';" 

is a bit confusing. You need to ensure that you use the entire rootdn. for instance. your code should look more like this...

<?php

// using ldap bind *** NOTE the uname *****
$ldaprdn  'cn=root,dc=testserver,dc=com';    // ldap rdn or dn
$ldappass 'secret'// associated password

// connect to ldap server
$ldapconn ldap_connect("ldap.testserver.com")
   or die(
"Could not connect to LDAP server.");

if (
ldap_set_option($dsLDAP_OPT_PROTOCOL_VERSION3)) {
   echo 
"Using LDAPv3";
} else {
   echo 
"Failed to set protocol version to 3";
}

if (
$ldapconn) {

   
// binding to ldap server
   
$ldapbind ldap_bind($ldapconn$ldaprdn$ldappass);

   
// verify binding
   
if ($ldapbind) {
       echo 
"LDAP bind successful...";
   } else {
       echo 
"LDAP bind failed...";
   }

}

?>
2004-06-14 02:32:42
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
As "john dot lewis at waldenweb dot com" correctly writes (and this is important to note and SHOULD be incorporated into the documentation as a warning - trying to bind with specific username and empty password will return TRUE.
2004-10-19 11:33:10
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
If you do not want to bind as unixadmin or *manager (i. e., for authentication on web applications), the following code could be useful:
<?php

$ldaphost 
"ldap.yourdomain.com";

/*for a SSL secured ldap_connect()

$ldaphost = "ldap.yourdomain.com"; */

$ldapport 389;

$ds ldap_connect($ldaphost$ldapport)
or die(
"Could not connect to $ldaphost");

if (
$ds) {

$username "some_user";
$upasswd "secret";
$binddn "uid=$username,ou=people,dc=yourdomain,dc=com";

$ldapbind ldap_bind($ds$binddn$upasswd);
                           
if (
$ldapbind) {

print 
"Congratulations! $some_user is authenticated.";}

else {

print 
"Nice try, kid. Better luck next time!";}}

?>
2004-11-25 01:40:14
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
As noted before with the password, I have found that if either  of the valuse for user or password are blank, or as in my case a typo resulted in a blank user as it was an undefined variable, the ldap_bind() will just perform an anonymous bind and return true!
Shouldn't this detect the presence of the additional values and return an error? At least if the user or password is passed. If they are both blank I'm not sure what it should do.
2005-02-16 13:27:07
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
I am assuming that ldap_bind does a simple bind and that for other
types of bind, ldap_sasl_bind should be used.

Also, while the allow bind v2 solution will work with slapd, you really should
use ldap v3 if at all possible because of the security improvements and
better protocol definition.  LDAP v2 is largely deprecated at this point.

Hopefully the PHP default LDAP version will move to v3 soon.
2005-02-24 06:04:38
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
complete ldap authentication script:

function checkldapuser($username,$password,$ldap_server){
  if($connect=@ldap_connect($ldap_server)){ // if connected to ldap server

    if (ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3)) {
      echo "version 3<br>\n";
    } else {
      echo "version 2<br>\n";
    }
    echo "verification on '$ldap_server': ";

    // bind to ldap connection
    if(($bind=@ldap_bind($connect)) == false){
      print "bind:__FAILED__<br>\n";
      return false;
    }

    // search for user
    if (($res_id = ldap_search( $connect,
                                "dc=auto,dc=tuwien,dc=ac,dc=at",
                                "uid=$username")) == false) {
      print "failure: search in LDAP-tree failed<br>";
      return false;
    }

    if (ldap_count_entries($connect, $res_id) != 1) {
      print "failure: username $username found more than once<br>\n";
      return false;
    }

    if (( $entry_id = ldap_first_entry($connect, $res_id))== false) {
      print "failur: entry of searchresult couln't be fetched<br>\n";
      return false;
    }

    if (( $user_dn = ldap_get_dn($connect, $entry_id)) == false) {
      print "failure: user-dn coulnd't be fetched<br>\n";
      return false;
    }

    /* Authentifizierung des User */
    if (($link_id = ldap_bind($connect, $user_dn, $password)) == false) {
      print "failure: username, password didn't match: $user_dn<br>\n";
      return false;
    }

    return true;
    @ldap_close($connect);
  } else {                                  // no conection to ldap server
    echo "no connection to '$ldap_server'<br>\n";
  }

  echo "failed: ".ldap_error($connect)."<BR>\n";

  @ldap_close($connect);
  return(false);

}//end function checkldapuser

Here a sample for using this function:

if (checkldapuser('myuser', 'secretpassword', 'ldap://link.to.ldap')) {
  echo "ACCESS GRANTED\n";
} else {
  echo "ACCESS DENIED\n";
}
2005-04-05 04:31:48
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Hey

I was trying this all day and final noticed that when you use bind and authenticate. The user name needs to be as follows for it to work. I am using PHP V 4.03 so this might be different now but here is what I used and the auth worked.

<?php
$ldaphost 
"ldap.what.at.greatnet.com";
$ldapport 389;

$ds ldap_connect($ldaphost$ldapport)
or die(
"Could not connect to $ldaphost");

if (
$ds
{
   
$username "johndoe@what.at.greatnet.com";
   
$upasswd "pass";

   
$ldapbind ldap_bind($ds$username$upasswd);
                               
    if (
$ldapbind
        {print 
"Congratulations! $username is authenticated.";}
    else 
        {print 
"Nice try, kid. Better luck next time!";}
}

?>
2005-08-23 14:33:07
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
This may be a security issue but after tinkering for hours with the below ldap auth function (edi01 at gmx dot at), I discovered that the ldap_bind function will return true if you enter a valid username AND a NULL value!

so if that function were to receive something like $username = 'someuser' and $password = '', it would return true. As long as it isn't a null value the function will work as expected. Might as well check if it is null or empty then.
2005-09-15 03:03:03
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Автор:
When using Active Directory 2003 (possibly also 2000) you can't search anonymously so you have to bind with a (known) user and password. Or else you will get an Search operations error. I also can confirm that an empty password bind succeeds! So test for an empty password first!

Some excellent information is found here:
http://www.scit.wlv.ac.uk/~jphb/sst/php/extra/ldap.html
http://www.scit.wlv.ac.uk/~jphb/sst/basics/ldap.html
2005-10-18 02:47:02
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
This code sample shows how to connect and bind to eDirectory in PHP using LDAP for Netware.

<?php

$server
='137.65.138.159';
$admin='cn=admin,o=novell';
$passwd='novell';

$ds=ldap_connect($server);  // assuming the LDAP server is on this host

if ($ds) {
   
// bind with appropriate dn to give update access
   
$r=ldap_bind($ds$admin$passwd);
    if(!
$r) die("ldap_bind failed<br>");

    echo 
"ldap_bind success";
   
ldap_close($ds);
} else {
    echo 
"Unable to connect to LDAP server"
}
?>
2005-11-05 03:18:21
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Автор:
It doesn't make much sense to let die() the script in case of an error, otherwise to ask if there were no errors before proceeding the script, as the official examples do.

better: 

<?php
ldap_bind
(...) or die(...);
do_something();
?>

or even better (die() is quick but dirty)

<?php
if (!ldap_bind(...)) {
 
error();
} else {
 
do_something();
}
?>
2006-05-03 03:36:40
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
I ran into an issue trying to bind as "cn=manager,dc=example,dc=com".  I took the example kenn posted where he set LDAP_OPT_PROTOCOL_VERSION to "3" for the connection.  Once I set this, I was able to bind with my manager id.
2006-07-12 17:43:24
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
had to do a bunch of research on this, but it does work, once config'd correctly.

using Apache/2.2.3 (Win32) mod_ssl/2.2.3 OpenSSL/0.9.8b 
PHP PHP Version 5.1.5-dev

ldap_bind was getting "81 Can't contact LDAP server" which was really annoying, since the connection worked fine without "ldaps"
using:

$ldapconnect = @ldap_connect( $connection_string );

well, actually the bind was really the one failing...

$bind = ldap_bind($ldapconnect, $client, $this->objSecurityLogin->Password);

many attempts to determine until i smartened up and turned on the trace level:

ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);

which must go before the connect!

found that on windows, you can't specifiy a quote in the ldap.conf:
i had:
TLS_REQCERT never
TLS_CACERT "C:\\Documents\\Tools\\Apache2\\conf\\ssl\\ad.pem"
which throws the error..
TLS: could not load verify locations (file:`"C:\Documents\Tools\Apache2\conf\ssl\ad.pem"',dir:`').
TLS: error:0200107B:system library:fopen:Unknown error .\crypto\bio\bss_file.c:122
TLS: error:2006D002:BIO routines:BIO_new_file:system lib .\crypto\bio\bss_file.c:127
TLS: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib .\crypto\x509\by_file.c:274
ldap_err2string

changed to:
TLS_REQCERT never
TLS_CACERT C:\\Documents\\Tools\\Apache2\\conf\\ssl\\ad.pem 
which cleans it up as:
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 1, err: 0, subject: /DC=xxx/DC=yyy/CN=zzzz, issuer: /DC=abab/DC=yyy/CN=zzzz
TLS certificate verification: depth: 0, err: 0, subject: ......

so the moral to the story is even though PHP wants quotes in some windows config parms, it won't work if its in ldap.conf!
2006-08-08 15:49:13
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Note that you have to specify the protocol version prior to making a call to ldap_bind, when the server is expecting LDAP protocol version 3.  If you do not, you will receive a warning and fail to bind, such as:

ldap_bind(): Unable to bind to server: Protocol error

In order to avoid this, make this call:

<?php
ldap_set_option
($dsLDAP_OPT_PROTOCOL_VERSION3);
?>

Where $ds is the result returned by ldap_connect(...);
2007-02-01 17:09:47
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
A number of examples and implementations of authentication schemes which use LDAP simple binds to authenticate users fail to properly sanitize user-submitted data. This can allow for an anonymous user to authenticate to a web-based application as an existing user. Provided below is a brief description and example of how this vulnerability can arise. For more detailed information please visit the links at the bottom of this posting.

The bind operation of LDAP, as described in RFC 4513, provides a method which allows for authentication of users. For the Simple Authentication Method a user may use the anonymous authentication mechanism, the unauthenticated authentication mechanism, or the name/password authentication mechanism. The unauthenticated authentication mechanism is used when a client who desires to establish an anonymous authorization state passes a non-zero length distinguished name and a zero length password. Most LDAP servers either can be configured to allow this mechanism or allow it by default. Web-based applications which perform the simple bind operation with the client's credentials are at risk when an anonymous authorization state is established. This can occur when the web-based application passes a distinguished name and a zero length password to the LDAP server.
This is commonly encountered when no password is provided from the client to the web-based application. This situation is described in some of the postings found below. For this situation, the recommendations found in other postings is sufficient to prevent authentication bypass.
However, no prior postings at php.net describe a situation in which a client may pass a distinguished username and a password of non-zero length to the web-based application which results in an anonymous authorization state. Below is an example of this situation.

$dn="testuser";
$pass="\x00\x41";
if (empty($dn) or empty($pass)) { exit(); } //check for empty strings
//if (preg_match('/[^a-zA-Z]/',$dn) or preg_match('/[^a-zA-Z0-9\x20!@#$%^&*()]/',$pass)) { exit(); } //check for expected values (whitelisting)
//if (preg_match('/\x00/',$dn) or preg_match('/\x00/',$pass)) { exit(); } //check for null byte (blacklisting)
$ldapconn=ldap_connect("192.0.2.2") or die("Could not connect to LDAP server.");
if ($ldapconn) {
        ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
        $ldapbind=ldap_bind($ldapconn, $dn, $pass);
        if ($ldapbind) {
                echo("success");
        } else {
                echo("fail");
                }
        }

References:
http://security.okstate.edu
2007-03-07 14:19:32
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Автор:
Example of connecting and searching AD

$con = ldap_connect('ad.domain.com');
ldap_set_option($con, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($con, LDAP_OPT_REFERRALS, 0);
ldap_bind($con, 'user@DOMAIN.COM', 'clear password');

ldap_search($con, 'DC=domain,DC=com', '(uniqueMember=user)');
2007-03-29 03:44:05
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Автор:
The OpenLDAP libraries will return error 53 (Server unwilling to perform) when trying to re-bind to a non-anonymous account if you accidentally leave the password field blank. If you want to authenticate against a different field than the dn, you have to bind to the server twice. Your code may look like the following:

<?
function ldapLogin($uname$pass$base_dn$fname$server$port){
   
$ldc=@ldap_connect($server$port);
    if (!
$ldc) return ERROR_CODE;
   
   
$bn='cn=anonymous-user,'.$base_dn;
   
$pw='anonymous-pass';
   
$lbind=@ldap_bind($ldc$bn$pw);
    if (!
$lbind) return ERROR_CODE;
   
   
   
$ureturn=@ldap_search($ldc$base_dn"($fname=$uname)", array('dn''givenName''sn''mail'));
   
   
   
$uent=@ldap_first_entry($ldc$ureturn);
    if (!
$uent) return ERROR_CODE;
   
   
$bn=@ldap_get_dn($ldc$uent);
   
   
//This line should use $pass rather than $password
   
$lbind=@ldap_bind($ldc$bn$password);
   
// Now you can find the error
   
echo ldap_error($ltc);

    if (
$lbind) return true; else return false;
?>

Hope this helps someone else running in to the same error.
2007-07-20 10:29:12
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Hi All, I just thought people should realize that the bug, or whatever change that was implemented with slapd and Openldap for the version V3 protocol has either not been repaired, or isn;t believed to be a bug or whatever...but still requires an implicit setting to V3 for use of the ldap_bind function. I am using Apache 2 and PHP 5.1 with LDAP 2. The default is set to deny V2 protocol, and even reconfiguring the slapd config file will not fix the problem. 

You must still use the ldap_set_option function. 

EX:

<?php 
    $ldapHost 
"ldap://server";
       
$ldapPort "port";
   
$ldapUser ="cn=name,dc=domain";
   
$ldapPswd ="password";

$ldapLink =ldap_connect($ldapHost$ldapPort)
    or die(
"Can't establish LDAP connection");

if (
ldap_set_option($ldapLink,LDAP_OPT_PROTOCOL_VERSION,3))
{
    echo 
"Using LDAP v3";
}else{
    echo 
"Failed to set version to protocol 3";
}

ldap_bind($ldapLink,$ldapUser,$ldapPswd)
    or die(
"Can't bind to server.");

?>

Thanks to Ken on below for showing the way. There was a slight code error in what he chose as his link_id, but thats all. This code above worked nice and shinny, and demonstrates we are still working with 2004 problems. I wish they would update this in the code above.
2008-06-23 13:12:50
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
I couldn't get ldap_bind to work on an ldaps connection until I followed some instructions about creating an ldap.conf file.  I don't see these instructions anywhere on the php site.  Maybe they're on the OpenLDAP site, but I thought it would be useful to have here as well.  Credit goes to a dude known as 'LRM', and I found my solution here: http://lists.horde.org/archives/sork/Week-of-Mon-20040503/001578.html

My setup is XAMPP on Win XP.
###### ApacheFriends XAMPP (basic package) version 1.6.3a ######

  + Apache 2.2.4
  + MySQL 5.0.45
  + PHP 5.2.3 + PHP 4.4.7 + PEAR
  + PHP-Switch win32 1.0 (please use the "php-switch.bat")
  + XAMPP Control Version 2.5 from www.nat32.com   
  + XAMPP Security 1.0   
  + SQLite 2.8.15
  + OpenSSL 0.9.8e
  + phpMyAdmin 2.10.3
  + ADOdb 4.95
  + Mercury Mail Transport System v4.01b
  + FileZilla FTP Server 0.9.23
  + Webalizer 2.01-10
  + Zend Optimizer 3.3.0
  + eAccelerator 0.9.5.1 for PHP 5.2.3  (comment out in the php.ini)

1. create C:\OpenLDAP\sysconf\ldap.conf (Yes, it MUST be this path because it's hard-coded in the dll)
2. put this line at the top:

TLS_REQCERT never

3. Save, stop/start apache.

The reason is, I think, because it doesn't understand the certificate, so this directive tells it to not bother checking it.  I guess that could be unsafe in some cases, but in my case I'm confident with the server I'm connecting to.

My connection code was as follows (nothing new here, I don't think):

<?php
$con 
= @ldap_connect('ldaps://the.ldap.server'636);
ldap_set_option($conLDAP_OPT_PROTOCOL_VERSION3);
ldap_set_option($conLDAP_OPT_REFERRALS0);
var_dump(@ldap_bind($con'user@sub.domain.com''password'));
?>

Good luck!  LDAPS can be a real bitch.
2008-10-27 08:55:21
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Active Directory doesn't accept anonymous requests anymore.

With Windows Server 2003, only authenticated users may initiate an LDAP request against Windows Server 2003-based domain controllers. You can override this new default behavior by changing the seventh character of the dsHeuristics attribute on the DN path as follows: 
CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,Root domain in forest

from: http://support.microsoft.com/kb/326690
2009-01-07 10:27:04
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Just a quick and easy function to authenticate against an AD domain controller:

<?php
function ad_auth$server$username$password ){
       
$ldap = @ldap_connect$server );

        if ( @
ldap_bind$ldap$username$password ) ){
               
ldap_unbind$ldap );
                return 
1;
                }
        else{
                return 
0;
                }
        }
?>
2009-02-09 16:36:03
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
When using LDAP with SSL and a LDAP server which uses a self-signed SSL certificate normally no connection will be established. Therefor you have to allow such connections explicitly.
With Linux (e.g. Debian, Ubuntu) you have to add "TLS_REQCERT never" to your /etc/ldap/ldap.conf. On other distributions this config file may be located somewhere else.
2009-09-04 10:18:33
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Автор:
I'm using OpenLDAP on linux and found out the right bind sequence the hard way... so I'm sharing it with you:

(wkaiser solution is ok if everything works fine, but for development I would suggest using ldap_error command like this)

<?php
$ldapconfig
['host'] = '10.10.10.10';
$ldapconfig['port'] = NULL;
$ldapconfig['basedn'] = 'dc=company,dc=com';

$ds=ldap_connect($ldapconfig['host'], $ldapconfig['port']);

$dn="uid=".$username.",ou=people,".$ldapconfig['basedn'];

if (
$bind=ldap_bind($ds$dn$password)) {
  echo(
"Login correct");
} else {

  echo(
"Unable to bind to server.</br>");

  echo(
"msg:'".ldap_error($ds)."'</br>");#check if the message isn't: Can't contact LDAP server :)
  #if it say something about a cn or user then you are trying with the wrong $dn pattern i found this by looking at OpenLDAP source code :)
  #we can figure out the right pattern by searching the user tree
  #remember to turn on the anonymous search on the ldap server
 
if ($bind=ldap_bind($ds)) {

   
$filter "(cn=*)";

    if (!(
$search=@ldap_search($ds$ldapconfig['basedn'], $filter))) {
      echo(
"Unable to search ldap server<br>");
      echo(
"msg:'".ldap_error($ds)."'</br>");#check the message again
   
} else {
     
$number_returned ldap_count_entries($ds,$search);
     
$info ldap_get_entries($ds$search);
      echo 
"The number of entries returned is "$number_returned."<p>";
      for (
$i=0$i<$info["count"]; $i++) {

       
var_dump($info[$i]);#look for your user account in this pile of junk and apply the whole pattern where you build $dn to match exactly the ldap tree entry
     
}
    }
  } else {
    echo(
"Unable to bind anonymously<br>");
    echo(
"msg:".ldap_error($ds)."<br>");
  }
}
?>

as you can see most of the examples use "cn=username" and OpenLDAP uses "uid=username" but who knows what will be used in the future builds, this code will help you check it out (I hope :)
2010-06-10 07:48:50
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Due to a bug in PHP 5.3 you may have to place the ldap.conf in the root of all your drives (I had to place it on D:).

See http://bugs.php.net/bug.php?id=48866
2010-10-26 15:27:55
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
If you are still having trouble after following all the instructions on the Web to get LDAPS to work, here's what worked for me:

I was trying to do LDAPS connection (our LDAP server was using port 40636) by running following command:

ldap_connect("www.example.com",40636)

This didn't work for days till I changed it to the following format:

ldap_connect("ldaps://www.example.com:40636")

Hope it'll help some out there.

-Cagdas
2010-12-16 16:00:51
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Interesting point,

if you can't bind to active directory with the error "49: Invalid Credentials", you can get the extended error output from the ldap_get_option function, using the option: LDAP_OPT_DIAGNOSTIC_MESSAGE. Unfortunately php hasn't defined this by default, but it's value is 0x0032.

This is useful if a user must change their password at first login (Data: 773), or if their account has expired on the network (Data: 532).

<?php

define
(LDAP_OPT_DIAGNOSTIC_MESSAGE0x0032)

$handle ldap_connect('ldap://active.directory.server/');
$bind ldap_bind($handle'user''expiredpass');

if (
$bind) {
    if (
ldap_get_option($handleLDAP_OPT_DIAGNOSTIC_MESSAGE$extended_error)) {
        echo 
"Error Binding to LDAP: $extended_error";
    } else {
        echo 
"Error Binding to LDAP: No additional information is available.";
    }
}
?>

Or something to that effect..

It took me a while to work this one out, so i figured i'd share my results..
2011-03-21 19:31:10
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
LDAP control support is missing from this implementation. Response controls might be part of the response(s) to the BIND request and must be handled in code.
2011-07-24 07:16:51
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
After a lot of trail and error i've found the way to authenticate to apple's Opendirectory (snow leopard server) and thought it maybe useful to share.

<?php
   
// using ldap bind
   
$ldaprdn  'uid=USERNAME,cn=users,dc=HOSTNAME,dc=DOMAIN,dc=com';     // ldap rdn or dn
   
$ldappass 'PASSWORD'// associated password

    // connect to ldap server
   
$ldapconn ldap_connect("HOSTNAME.DOMAIN.com")
            or die(
"Could not connect to LDAP server.");

   
// Set some ldap options for talking to 
   
ldap_set_option($ldapconnLDAP_OPT_PROTOCOL_VERSION3);
   
ldap_set_option($ldapconnLDAP_OPT_REFERRALS0);

    if (
$ldapconn) {

           
// binding to ldap server
           
$ldapbind = @ldap_bind($ldapconn$ldaprdn$ldappass);

           
// verify binding
           
if ($ldapbind) {
                echo 
"LDAP bind successful...\n";
            } else {
                echo 
"LDAP bind failed...\n";
            }

    }

?>
2011-09-01 07:46:17
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Автор:
If you're using SSL (e.g. ldaps) and ldap_bind is throwing 'Unable to bind to server:' errors, check that the hostname used in the ldap_connect matches the 'CN' in the SSL certificate on the LDAP server. For example:

<?
   ldap_connect
('ldaps://ldap01');
 
// 'ldap01' should match the CN in your LDAP server's SSL cert, otherwise the subsequent ldap_bind() will throw a bind error

?>

You can check your LDAP server's SSL cert using Openssl utility (Linux) - look for the 'Subject' line:

   $ openssl x509 -in /etc/pki/tls/certs/ldap01.crt -text -noout
   ...
        Subject: C=XY, ST=My State, L=My City, O=My Org, CN=ldap01/emailAddress=me@domain.com
   ...

I recently applied some updates to my system (now Centos 5.7 and PHP 5.3.6) and started having this issue with PHP scripts that had been fine previously where I was simply using the IP address of the server. Replacing the IP address with the hostname fixed my issue.
2012-01-03 02:38:10
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
I had a problem doing a ldap_bind over SSL against Active Directory. The server kept telling me: 'Unable to bind to server:'. To solve this (OS: CentOS 6) make sure that /etc/openldap/ldap.conf has this line:

TLS_REQCERT allow
2012-06-20 15:43:15
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
It's nessesary to add: 

<?php
ldap_set_option
($dsLDAP_OPT_PROTOCOL_VERSION3)
?>

for ldap_bind returned true, while you try to bind for openldap (at least version 2.4.21)
2012-07-11 15:07:19
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
In some structures its not possible to know the dn or rdn up front. However one can use $ldapuser= $samaccountname.'@'.domainname;
2014-06-20 08:53:21
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
GnuTLS and SChannel (Microsoft) implementations are not (yet) compatible for TLS 1.2 negotiation during LDAPS binding (when binding with Microsoft Windows 2012R2 server).

The trick is to disable TLS1.2 before using LDAP functions:

putenv(‘LDAPTLS_CIPHER_SUITE=NORMAL:!VERS-TLS1.2’);
2015-12-24 18:15:20
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Автор:
I use PHP 7.1.*. In this version ldap_bind will throw a RuntimeException if it fails to bind. I've tried with wrong host name, correct host and wrong password,  correct host and invalid DN syntax. All fail conditions seems to throw RuntimeException.

 So this function probably doesn't return false.
2017-03-26 01:57:57
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
I tried the solution above from user_o at hbt dot com about timeout and couldn't make it work. Initially I tried the following:

$this->conn = @ldap_connect($ip, $port);
ldap_set_option($this->conn, LDAP_OPT_NETWORK_TIMEOUT, 10);
ldap_set_option($this->conn, LDAP_OPT_TIMELIMIT, 10);
@ldap_bind($this->conn, $ldapUser, $ldapPwd);

but if the server didn't respond the request locked at this point. 
Then using code-completion I found there is a hidden LDAP option: LDAP_OPT_TIMEOUT

so changing the code to: 

$this->conn = @ldap_connect($ip, $port);
ldap_set_option($this->conn, LDAP_OPT_NETWORK_TIMEOUT, 10);
ldap_set_option($this->conn, LDAP_OPT_TIMELIMIT, 10);
ldap_set_option($this->conn, LDAP_OPT_TIMEOUT, 10);
@ldap_bind($this->conn, $ldapUser, $ldapPwd);

finally made ldap binding timeout correctly.
2018-07-09 20:12:04
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Автор:
(Correction)
ldap_bind does return TRUE if the password is expired or needs to be reset, use ldap_get_option if ldap_bind returns FALSE

<?php

define
("EXPIRED_PASSWORD"532);
define("PASSWORD_RESET"773);

$handle ldap_connect('ldap://active.directory.server/');
$bind ldap_bind($handle'user''expiredpass');

if (!
$bind) {
    if (
ldap_get_option($handleLDAP_OPT_DIAGNOSTIC_MESSAGE$extended_error)) {
           
$errno explode(','$extended_error)[2];
           
$errno explode(' '$errno)[2];
           
$errno intval($errno);

            if (
$errno === EXPIRED_PASSWORD) {
               
$err 'Unable to login: Password expired';
            } else if (
$errno === PASSWORD_RESET) {
               
$err 'Unable to login: Password needs to be reset';
            } else {
               
$err $extended_error;
            }
            if (
$errno === EXPIRED_PASSWORD || $errno === PASSWORD_RESET) {
               
#Change password
           
}
        }
}
?>
2019-09-11 13:42:59
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Example code from my ldap class.
this->query i send notes under ldap_search function documentation.

public function queryUserLogin($user_name='', $user_psw='', $tls_bool=true) // na localhostu pouzit tls=false
    {
    var_dump('queryUserLogin');
//$tls_bool = false;    // for localhost
    $fn     = 'queryUser';
    $config = $this->config;
    $conn   = $this->conn;
    if (!$conn)
        {return $this->errorConnection($fn);}
    // user - exist name?
    $user_name = $this->escapeValue($user_name);
    $user_psw  = $this->escapeValue($user_psw);
    $filter = "(&(objectclass=person)(cn=".$user_name."))";
//var_dump($filter);
    $att    = array('dn');
    $data   = $this->query($filter, $att, 2, true);
    if ($data===false)
        {
        $this->error("User error, nenalezen v ldap!");
        $this->disconnect();
        return false;
        }
    // user - exist user in LDAP (name, psw)
    $user = is_array($data) && isset($data[0]) && isset($data[0]['dn']) ? $data[0]['dn'] : '';    // "cn=mynickname,ou=users,o=su" 
    $psw  = $user_psw;
    if ($user=='' || $psw=='')
        {
        $this->error("User error, prazdne prihlasovaci udaje!");
        $this->disconnect();
        return false;
        }
    if ($tls_bool==true)
        {
        if (ldap_start_tls($conn))    //php7
            {
            $result = @ldap_bind($conn, $user, $psw);
            }
        else    {
            $this->error("Unable to start TLS!");  // SSL encrypt protocol, certificate, deprecated?
            }
        }
    else    {
        $result = @ldap_bind($conn, $user, $psw);
        }
    if ($result==false)
        {
        $this->error("Bind user error! bindDN = ".$user);    //".ldap_error($conn)."
        $this->disconnect();
        return false;
        }
    // user - get user info, bind to ldap user with more permitions and get data (login to intercon user)
    $user   = $config['userInterconDn'];
    $psw    = $config['userInterconPsw'];
    if ($tls_bool==true)
        {
        if (ldap_start_tls($conn))    //php7
            {
            $result = ldap_bind($conn, $user, $psw);
            }
        else    {
            $this->error("Unable to start TLS!");  // SSL encrypt protocol, certificate, deprecated?
            }
        }
    else    {
        $result = ldap_bind($conn, $user, $psw);
        }
    if ($result==false)
        {
        $this->error("Bind user intercon error!");    // . ldap_error($conn) !Nezobrazovat jmeno usera interconu
        $this->out = array(
            'uid'         => $user
            );
        return true;
        }
    // search user data
    $filter = "(&(objectclass=person)(cn=" . $user_name . "))";
//var_dump($filter);
    $att    = array(
        'uid', 
        'workforceID',
        'employeeID',
        'givenName',
        'sn',
        'mail'
        );
    $data   = $this->query($filter, $att, 2, true);
       // get data from ldap entires structure
    $this->out = array(
        'uid'         => $this->dataGetValue($data, 'uid'        , ''),
        'workforceID' => $this->dataGetValue($data, 'workforceid', ''),   
        'employeeID'  => $this->dataGetValue($data, 'employeeid' , ''),   
        'givenName'   => $this->dataGetValue($data, 'givenname'  , ''),
        'sn'          => $this->dataGetValue($data, 'sn'         , ''),    // prijmeni
        'mail'        => $this->dataGetValue($data, 'mail'       , '')    // mail
        );
    $this->conn = $conn;
    return true;
    }
2020-06-05 10:07:32
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
LDAPS over SSH port forwarding. 
It may be that, when developing/debugging, you don't have direct access to the LDAP server.  You can use SSH port-forwarding, but you need to disable the cert checks temporarily. Here's the easiest way to do it.

//Enable debugging, so you can see what's failing.
ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL,7);

//Disable the TLS certificate check (it will mismatch on the domain). Either
//edit /etc/ldap/ldap.conf and set "TLS_REQCERT never", or in your script:
putenv('LDAPTLS_REQCERT=never');

//Point your ldaps url at localhost. E.g.
$ldap_url = "ldaps://localhost:63600";

//Do the SSH port forward (in another terminal). E.g.
ssh -L 63600:your_real_ldap_server:636 your_proxy_server

//And continue as normal...
ldap_connect($ldap_url);
2022-07-27 20:33:38
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
Автор:
When using LDAP with SSL and a LDAP server which uses a self-signed SSL certificate the connection may fail with the error "Can't contact LDAP server". To make the connection work, use the options to point to the public cert file (see https://www.php.net/manual/en/ldap.constants.php).

Alternatively you can disable the certification check. But keep in mind that this is a security risk if the connection is routed over a public network!

This is achieved by:

<?php
$ds 
ldap_connect('ldaps://myhost:636');
ldap_bind($ds'{your_ldap_dn}''{your_ldap_password}')
ldap_set_option($dsLDAP_OPT_X_TLS_REQUIRE_CERTLDAP_OPT_X_TLS_ALLOW);
?>
2023-09-19 12:09:58
http://php5.kiev.ua/manual/ru/function.ldap-bind.html
This function can cause errors that might be expected to happen during ldap_connect.

As ldap_connect is - contrary to it's name - is not connecting to any server at all, usually the ldap_bind is the first command to actually hit a server and therefore can cause issues that one would not expect to happen here.
2024-02-25 18:55:48
http://php5.kiev.ua/manual/ru/function.ldap-bind.html

    Поддержать сайт на родительском проекте КГБ