Question

我有一个AD ldap.patontheback.org ，我正在尝试使用默认的管理员帐户ldap_bind。我可以成功使用远程桌面来管理用户的帐户。

$ldapconn = ldap_connect("ldap://172.31.22.45");
ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
ldap_bind($ldapconn, "cn=Administrator,dc=ldap,dc=patontheback,dc=org", "<my password>");

哪些可以连接，但不进行身份验证：

ldap_sasl_bind_s
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 172.31.22.45:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 172.31.22.45:389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 0x2bb31e0 msgid 1
wait4msg ld 0x2bb31e0 msgid 1 (infinite timeout)
wait4msg continue ld 0x2bb31e0 msgid 1 all 1
** ld 0x2bb31e0 Connections:
* host: 172.31.22.45  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon May  9 13:45:10 2016


** ld 0x2bb31e0 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x2bb31e0 request count 1 (abandoned 0)
** ld 0x2bb31e0 Response Queue:
   Empty
  ld 0x2bb31e0 response count 0
ldap_chkResponseList ld 0x2bb31e0 msgid 1 all 1
ldap_chkResponseList returns ld 0x2bb31e0 NULL
ldap_int_select
read1msg: ld 0x2bb31e0 msgid 1 all 1
read1msg: ld 0x2bb31e0 msgid 1 message type bind
read1msg: ld 0x2bb31e0 0 new referrals
read1msg:  mark request completed, ld 0x2bb31e0 msgid 1
request done: ld 0x2bb31e0 msgid 1
res_errno: 49, res_error: <Simple Bind Failed: NT_STATUS_LOGON_FAILURE>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ldap_msgfree
ldap_err2string
PHP Warning:  ldap_bind(): Unable to bind to server: Invalid credentials in php shell code on line 1

我已经检查过密码是否正确。从Windows服务器获取的IP到LDAP：

C:\Users\Administrator>nslookup ldap.patontheback.org
Server:  AWS-4A06F0BDB6.ldap.patontheback.org
Address:  172.31.22.45

Name:    ldap.patontheback.org
Addresses:  172.31.22.45
          172.31.2.194

我到底错过了什么？

Answer 1

所以我可以使用UPN作为标识来使用它：

ldap_bind($ldapconn, "Administrator@ldap.patontheback.org", "<password>");

它有效，但它无法解释为什么其他方式不起作用。

Answer 2

对于那些后来遇到这个问题的人，正确的方法是

ldap_bind($ldapconn, "cn=Administrator,cn=Users,dc=ldap,dc=patontheback,dc=org", "<my password>");

cn=Users是必须包含的路径。

为什么ldap_bind无法对SimpleAD进行身份验证？

2 个答案: