Title: LDAPS Support Request Last modified: February 21, 2017 --- # LDAPS Support Request * Resolved [timkite](https://wordpress.org/support/users/timkite/) * (@timkite) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/) * I’m evaluating Authorizer as an all-in-one replacement to the grab-bag of authentication- related plugins we’re currently using in a large, shared WordPress environment on campus. For us it would replace: – wpDirAuth, locally forked to allow LDAPS on a non-standard port – theme-my-login (potentially, need to evaluate your theme support) – limit-login-attempts-reloaded (though offers fewer options) It would also add CAS support, something we’ve missed since the old cas-authentication plugin went deprecated, and could make sites completely non-public, which might be nice for classes that use it. * CAS support works beautifully with our CAS installation (though oddly only in 2.x compatibility mode, even though we’re running CAS 3.5.3). LDAP, however, does not. It appears your plugin attempts to use StartTLS, and there’s no option to use LDAPS, which is all our LDAP server supports. Is that a feature that might be added in a future version? * I currently get this error: PHP Warning: ldap_start_tls(): Unable to start TLS: Can’t contact LDAP server in /plugins/authorizer/authorizer.php on line 1259, referer: * Disabling TLS and trying to inject “ldaps://” into the LDAP hostname just times things out, and just disabling TLS doesn’t work because the server isn’t listening for unencrypted logins. * If it helps or makes a difference, I’m running this on Red Hat Enterprise Linux 6 (so, HTTPD 2.2.15-56.el6_8.3, PHP 5.3.3-48.el6_8, all required PHP libraries installed and active) Viewing 11 replies - 1 through 11 (of 11 total) * Plugin Author [Paul Ryan](https://wordpress.org/support/users/figureone/) * (@figureone) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8832851) * Sure, I’ll try to help you get up and running. * The LDAP routine in the plugin is pretty straightforward: [https://github.com/uhm-coe/authorizer/blob/master/authorizer.php#L1252-L1294](https://github.com/uhm-coe/authorizer/blob/master/authorizer.php#L1252-L1294) * The plugin should work out-of-the-box over LDAPS or LDAP/TLS using OpenLDAP, so my guess is your LDAP server is Active Directory. * ldap_start_tls() only fires if you check “Use TLS” in Authorizer settings, so leaving that unchecked is probably the way to go for your setup. * Getting LDAPS working for AD requires some work, and it looks like there’s some feedback on the PHP documentation for ldap_connect(): [http://php.net/manual/en/function.ldap-connect.php#36156](http://php.net/manual/en/function.ldap-connect.php#36156) * Basically, the PHP docs say that using an LDAP host of the form ldaps://hostname: port will work as of OpenLDAP 2.x.x or later, so if you get the dependencies set up you should be able to set your LDAP Host (in Authorizer settings) to the full URL including “ldaps://”. * Thread Starter [timkite](https://wordpress.org/support/users/timkite/) * (@timkite) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8835240) * It’s actually not AD, though I could try AD if needed. I just already have a service account for LDAP. * Our current LDAP is based on ApacheDS. It’s slated to be upgraded to a fully standard OpenLDAP server at some point in the future, but I don’t have an ETA on that. * With the full URL including ldaps:// in the LDAP Host field, the custom port in the LDAP Port field, and Use TLS disabled, attempted LDAP user logins will just sit and sit until timing out, at which point the login prompt does its little“ no” shake and I get an “invalid username”, with no errors output by PHP into the log (it does display an error if I try to put the port in the LDAP Host URL). I’m using otherwise the same configuration parameters for the LDAP service that wpDirAuth uses and also that HTTPD uses for native directory security on non- WordPress sites. * [Paul Gilzow](https://wordpress.org/support/users/gilzow/) * (@gilzow) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8835650) * I was pinged because of the wpDirAuth mention, but let me see if I can help. * Here’s a more streamlined ldap test script you can use * [https://github.com/gilzow/simple-ldap-test/blob/master/ldap.php](https://github.com/gilzow/simple-ldap-test/blob/master/ldap.php) * This one will allow you to use ldaps AND specify a different port. Change the items on lines 10 – 30 for your specific instance. Since you aren’t using TLS, you’ll need to change some of the defaults. so on line 56, you’ll want to change that to something like * ``` $aryOptions = array( 'useldap3' => false, 'starttls' => false, ); ``` * Between the errors the script outputs and your error logs, you should be able to pinpoint where the exact failure is coming from. * Plugin Author [Paul Ryan](https://wordpress.org/support/users/figureone/) * (@figureone) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8836530) * Great, thanks for the info. Let’s see if we can modify the plugin source a bit to make it log some debug data. * First, remove the ampersand from the `ldap_bind()` line: [https://github.com/uhm-coe/authorizer/blob/master/authorizer.php#L1270](https://github.com/uhm-coe/authorizer/blob/master/authorizer.php#L1270) * The ampersand makes it fail silently, so I’m hoping that that’s where it’s timing out. Check for PHP errors in the log after a timeout/failed login attempt and see if it says anything. * If that doesn’t shed any light on things, you can insert `error_log()` lines throughout the code that will cause a PHP error to be output to the logs. * If you’re really enterprising, you can configure xdebug and set a breakpoint with `xdebug_break()`, and then trace the code that way. But hopefully that won’t be necessary. * Thread Starter [timkite](https://wordpress.org/support/users/timkite/) * (@timkite) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8845847) * Ah ha! Got it working via a very similar hack to the one I had to use for wpDirAuth to make it work. * If you look at [the manual for ldap_connect()](http://php.net/manual/en/function.ldap-connect.php), you’ll see that the port option is ignored if you supply an ldap:// or ldaps:// URI, meaning that without string manipulation, you can’t use a non-default port. However, if you send an empty variable in position 2, ldap_connect() complains that it needs to be a long, even though it’ll ignore it. * To hack it into working, I changed this line (1256): `$ldap = ldap_connect( $auth_settings['ldap_host'], $auth_settings['ldap_port'] );` * …to this: `$ldap = ldap_connect( $auth_settings['ldap_host'] . ":" . $auth_settings[' ldap_port'] );` * And it works! For my situation specifically, anyway. What you need to do is actually look at the ldap_host parameter and decide if it’s a URI. If it is, concatenate ldap_port onto the end of it with a colon and trigger ldap_connect() with a single parameter. If it’s not a URI, do it the way you’re doing it now. For example, replace line 1256 with (there is probably a better way to do this!): * ``` if ( substr( $auth_settings['ldap_host'], 0, 7 ) === "ldap://" || substr( $auth_settings['ldap_host'], 0, 8 ) === "ldaps://" ) { $ldap = ldap_connect( $auth_settings['ldap_host'] . ":" . $auth_settings['ldap_port'] ); } else { $ldap = ldap_connect( $auth_settings['ldap_host'], $auth_settings['ldap_port'] ); } ``` - This reply was modified 9 years, 3 months ago by [timkite](https://wordpress.org/support/users/timkite/). * Thread Starter [timkite](https://wordpress.org/support/users/timkite/) * (@timkite) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8845854) * Ah ha! Got it working via a very similar hack to the one I had to use for wpDirAuth to make it work. * (if this is a duplicate post, I apologize, but it looks like the editor ate my initial reply attempt) * If you look at [the manual for ldap_connect()](http://php.net/manual/en/function.ldap-connect.php), you’ll see that the port option is ignored if you supply an ldap:// or ldaps:// URI, meaning that without string manipulation, you can’t use a non-default port. However, if you send an empty variable in position 2, ldap_connect() complains that it needs to be a long, even though it’ll ignore it. * To hack it into working, I changed this line (1256): `$ldap = ldap_connect( $auth_settings['ldap_host'], $auth_settings['ldap_port'] );` * …to this: `$ldap = ldap_connect( $auth_settings['ldap_host'] . ":" . $auth_settings[' ldap_port'] );` * And it works! For my situation specifically, anyway. What you need to do is actually look at the ldap_host parameter and decide if it’s a URI. If it is, concatenate ldap_port onto the end of it with a colon and trigger ldap_connect() with a single parameter. If it’s not a URI, do it the way you’re doing it now. For example, replace line 1256 with (there is probably a better way to do this!): * ``` if ( substr( $auth_settings['ldap_host'], 0, 7 ) === "ldap://" || substr( $auth_settings['ldap_host'], 0, 8 ) === "ldaps://" ) { $ldap = ldap_connect( $auth_settings['ldap_host'] . ":" . $auth_settings['ldap_port'] ); } else { $ldap = ldap_connect( $auth_settings['ldap_host'], $auth_settings['ldap_port'] ); } ``` * Thread Starter [timkite](https://wordpress.org/support/users/timkite/) * (@timkite) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8845891) * Actually I definitely missed something. In the event it’s a URI, you need to test if ldap_port is set before trying to append it, or ldap_connect() will complain that “ldaps://foo.bar:” is an invalid URI. Also I’m not super happy about that substring test and would rather do a regex, but since I don’t normally work in PHP I’d need to go look that up. Yeah, I know, but it’s Friday. * Thread Starter [timkite](https://wordpress.org/support/users/timkite/) * (@timkite) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8845907) * Here, with comments even: * ``` // Establish LDAP connection. if ( substr( $auth_settings['ldap_host'], 0, 7 ) === "ldap://" || substr( $auth_settings['ldap_host'], 0, 8 ) === "ldaps://" ) { if ( ! empty($auth_settings['ldap_host']) ) { // URI with port provided, append port to URI $ldap = ldap_connect( $auth_settings['ldap_host'] . ":" . $auth_settings['ldap_port'] ); } else { // Only URI provided, send it alone $ldap = ldap_connect( $auth_settings['ldap_host'] ); } } else { // URI not provided, pass host and port as separate parameters $ldap = ldap_connect( $auth_settings['ldap_host'], $auth_settings['ldap_port'] ); } ``` * Thread Starter [timkite](https://wordpress.org/support/users/timkite/) * (@timkite) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8845927) * Last one, I promise. Yeah it’s Friday but it didn’t take long to find preg_match(): * ``` if ( preg_match( "/^ldaps?:\/\//", $auth_settings['ldap_host'] ) ) { if ( ! empty($auth_settings['ldap_host']) ) { // URI with port provided, append port to URI $ldap = ldap_connect( $auth_settings['ldap_host'] . ":" . $auth_settings['ldap_port'] ); } else { // Only URI provided, send it alone $ldap = ldap_connect( $auth_settings['ldap_host'] ); } } else { // URI not provided, pass host and port as separate parameters $ldap = ldap_connect( $auth_settings['ldap_host'], $auth_settings['ldap_port'] ); } ``` * Plugin Author [Paul Ryan](https://wordpress.org/support/users/figureone/) * (@figureone) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8846339) * Yay Friday! Thanks for doing that research on ldap_connect(). Your contribution is awesome and I’ll get it included in the next version. * Plugin Author [Paul Ryan](https://wordpress.org/support/users/figureone/) * (@figureone) * [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8858673) * I’ve updated the code to check whether a hostname or an LDAP URI are specified in the LDAP Host field. If it’s a URI, then make sure we append the port from the LDAP Port field if it’s not already specified in the URI. This should work for all existing setups. [https://github.com/uhm-coe/authorizer/commit/cdc816c4c2fd1bb05b9f01ddff89925db9e6ce5c](https://github.com/uhm-coe/authorizer/commit/cdc816c4c2fd1bb05b9f01ddff89925db9e6ce5c) * Note that I used `parse_url()` instead of `preg_match()` just to simplify the checking. I wanted to make sure to support random LDAP URIs that may have a path appended to the domain, or username, etc. * Thanks so much for your contribution! Version 2.6.7 is out now with the fix. [https://wordpress.org/plugins/authorizer/changelog/](https://wordpress.org/plugins/authorizer/changelog/) Viewing 11 replies - 1 through 11 (of 11 total) The topic ‘LDAPS Support Request’ is closed to new replies. * ![](https://ps.w.org/authorizer/assets/icon-256x256.jpg?rev=1967453) * [Authorizer](https://wordpress.org/plugins/authorizer/) * [Frequently Asked Questions](https://wordpress.org/plugins/authorizer/#faq) * [Support Threads](https://wordpress.org/support/plugin/authorizer/) * [Active Topics](https://wordpress.org/support/plugin/authorizer/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/authorizer/unresolved/) * [Reviews](https://wordpress.org/support/plugin/authorizer/reviews/) * 12 replies * 3 participants * Last reply from: [Paul Ryan](https://wordpress.org/support/users/figureone/) * Last activity: [9 years, 3 months ago](https://wordpress.org/support/topic/ldaps-support-request/#post-8858673) * Status: resolved