ldaps connection problem

Spleshmen

Hello all...i need some help connection to a ldaps server...i am using the ldap_connect function with 2 parameters,the first one is a string with the host and the second one is a variable with a number ,the port number.here is the code,the data for connection is correct of course i get the message i display,but how can i know whats realy the problem?to get the exact error?

$host = "ldaps://******.com";
$port = 1793;
$c = ldap_connect($host,$port);
if (!$c) {
   echo 'Error';
}

bradgrafelman

I don't really understand what you're asking... are you trying to get a more detailed error message when an error occurs?

If so, what does the PHP error message say? Have you tried using [man]ldap_error/man ?

Spleshmen

yes,i want to find out whats the problem that displays my message (my echo).
i tryd to use ldap_error and ldap_errno but they dont work.
if i use the variable $c from my post as a parameter in both functions i get an error sayng i cant pass a boolean value as a parameter.if i dont use any parameter in ldap_error or ldap_errno i get another error...so therse no way to please them both 🙂
any ideas?thanks for the reply

bradgrafelman

Again, PHP will output an error if the ldap_connect() call fails (which it is doing) - either turn on display_errors or enable error logging to capture the PHP error message.

Spleshmen

okey,i will try to do that.thanks for the help,if i need any help i will post here again 🙂
thanks so much.

Spleshmen

display_errors is on
i tryied using ldap_error but i get this warning :

Warning: ldap_error(): supplied argument is not a valid ldap link resource

here is my current code

$host = "ldaps://******.com";
$port = 1793;
$c = ldap_connect($host,$port);
if (!$c) {
   echo 'Error : ';
   echo ldap_error($c);
}

johanafm

You can't use code like that. From ldap_connect

php documentation wrote:
Return values
Returns a positive LDAP link identifier on success, or FALSE on error.

And from ldap_error

php documentation wrote:
Parameters
link_identifier
    An LDAP link identifier, returned by ldap_connect().

Now, assuming ldap_connect failed, $c === false, and you are calling ldap_error(false). The only time you would be calling ldap_error with a proper argument would be if ldap_connect did NOT fail, and then there would be no reason to call ldap_error. And whenever $c === false, you allready do know that you failed to connect (although there might be different reasons). But since there is no ldap_connect_error() function returning a more precise explanation for the last failed connection attempt, I'd guess that ldap_connect allready tells you this (assuming error reporting is turned on).

Spleshmen

that makes sense 🙂 thanks, i understand now.
i am trying to connect to a ldaps server from another server.
i got all the information i need to connect to the ldaps server (host,port,password,bind_rdn - second parameter from ldap_bind,base_dn - second parameter from ldap_search) and 2 certificates the SSL CA and Root CA generated from the ldaps server.
i never used the data from the certificates on the server i am trying to make the connection with the ldaps server.could that be the reason why i cant establish a connection?

johanafm

It's often a good idea to go through the comments on the php documentation site if the documentation does not tell you what you need to know. It's possible that you have a problen with the certificate handling, and if so this post might tell you what you need to know.
If not, there should be an example on that page (or perhaps ldap_connect) about adding a domain to the username.

Spleshmen

i dont have a ldap.conf file and if i add the lines from below into my httpd.conf, apache wont start 🙂 where do i need to add those 2 certificates ? the SSL CA and Root CA.
i already have a httpd-ssl.conf with paths on other certificates. the certificates were added by default by the xampp installer.
by the way i am tryng to connect to the ldaps (ldap over ssl) server from my computer on wich i have the latest xampp distribution.thanks

TLS_CACERT /path/to/certificate
TLS_REQCERT never

johanafm

I don't know, but here's another comment which may be useful