This is a very brief function that authenticates a user against Active Directory. Because you can authenticate using a fully qualified DN, sAMAccountName, or userPrincipalName … there’s no need to use a system credential or search for the user provided you’ve got a single domain in your forest (i.e. you know what to prepend to the sAMAccountName or postpend to userPrincipalName).
If you need to perform authorization as well as authentication, you’ll need the user’s FQDN so use the generic LDAP authentication and authorization function.
<?php
error_reporting(0);
#=== FUNCTION ==================================================================
# NAME: activeDirectoryLDAPAuthentication
# PARAMETERS:
# $strLDAPHost String LDAP Server URI
# $strLogonUserID String Input user ID
# $strLogonUserPassword String Input user password
# DESCRIPTION: Verify authentication againt Active Directory server.
#
# RETURNS: int BindReturnCode: -2 indicates LDAP connection failure, -3 indicates user auth not attempted, >=0 is IANA-registered resultCode values (https://www.iana.org/assignments/ldap-parameters/ldap-parameters.xml#ldap-parameters-6)
# NOTE: 0 is successful authentication in IANA-registered resultCode
#
# USAGE: $iBindResult = activeDirectoryLDAPAuthentication("ldaps://ad.example.com", $strInputUserName, $strInputUserPassword)
#===============================================================================
function activeDirectoryLDAPAuthentication($strLDAPHost, $strLogonUserID, $strLogonUserPassword){
$iBindReturnCode = null;
// Validate password is not null, otherwise directory servers implementing unauthenticated bind (https://tools.ietf.org/html/rfc4513#section-5.1.2) will return 0 on auth attempts with null password
if( strlen($strLogonUserPassword) < 1){
$iBindReturnCode = -1;
}
else{
$userDS = ldap_connect($strLDAPHost);
if($userDS){
ldap_set_option($userDS, LDAP_OPT_PROTOCOL_VERSION, 3);
$userBind = ldap_bind($userDS, $strLogonUserID . '@example.com', $strLogonUserPassword);
$iBindReturnCode = ldap_errno($userDS);
ldap_close($userDS);
}
// ldap connection failed
else{
$iBindReturnCode = -2;
}
}
return $iBindReturnCode;
}
$iBadUser = activeDirectoryLDAPAuthentication("ldaps://ad.example.com", "xe0012345", 'N0tTh3P@s5w0rd');
print "\nInvalid user: $iBadUser\n";
$iUserAuthenticated = activeDirectoryLDAPAuthentication("ldaps://ad.example.com", "e012345", 'Go0dP@s5w0rdH3r3');
print "\nGood password: $iUserAuthenticated\n";
$iBadPassword = activeDirectoryLDAPAuthentication("ldaps://ad.example.com", "e0012345", 'N0tTh3P@s5w0rd');
print "\nBad password: $iBadPassword\n";
$iBadHost = activeDirectoryLDAPAuthentication("ldaps://abc.example.com", "e0012345", 'N0tTh3P@s5w0rd');
print "\nBad host: $iBadHost\n";
?>