NT Authentication / Exchange LDAP

apaxson

I am currently building a Help Desk project for my organization consisting of several trusted domains. I will be building this with RedHat7.3, PHP4, MySQL, and Apache, utilizing LDAP on Exchange Server. However, I'm needing more information on NT Authentication and LDAP for Exchange Server.

I think I can probably get the authentication down using Samba and WinBind. Theoretically, using Samba and Winbind, the linux box acts as an NT Domain member, throwing all authentication requests to the Primary Domain Controller. <Comments?> However, I'm still looking for the PHP functions which handle the requests and errors if any. I'm an ASP/JSP programmer, and am upset of all the lost time I spent learning ASP/JSP rather than PHP. I'm just amazed at it!

However, LDAP is new to me. I have LDAP enabled on my Exchange server, but I think I'm doing things wrong. Can anyone give me some good resources which describe more about LDAP and how people utilize the Exchange information in PHP? I'm only getting bits and pieces in the forums. And how I can access a user's information in Exchange based on the authentication process?

I'm not really looking for someone to hold my hand and walk me through it <although I won't complain!!> rather, somewhere where I can research realistic projects.

Thanks in advance!!

Aaron

apaxson

One way to do the NT Authentication is to use the same kind of NT authentication that Squid uses. In other words, smbclient checks to see if it can read a file. If you create a file with the contents "allow", and give read-only access to "user1", then:

smbclient //ntpdc/netlogon -I 192.168.1.1 -d 0 -U user1%password -W domain -c "get filename -"

Will return "allow". If it doesn't, then no access is granted. I didn't even think about this kind of authentication, until I found it on Zend's website. I use Squid to authenticate allowed users to the internet this way. I didn't even think that it would work for PHP as well.

Now that they are authenticated, I can use $username to access my LDAP server. Now if I can just get the resources for LDAP .... <grin>

Aaron