PHP LDAP Connection Can't Contact LDAP Server

Question

I have an external web server that I am migrating. I'm trying to authenticate against Active Directory on an internal server via LDAP. I am able to connect and authenticate from the old server (Ubuntu 8) using the same code but am not able to authenticate on the new one (Redhat 7).

The external server is currently running Redhat 7 running PHP 5.4.16 with LDAP support enabled (php-ldap).

The internal server is currently a Windows Server 2008 box with LDAP and Active Directory.

The code below is the current PHP I am using that was able to connect on the old server, but having problems on the new server. It basically uses the PHP LDAP connection string and tries to bind. I have replaced some personal information with identifiers. (USERNAME,subdomain,etc)

<?php

$adServer = "ldaps://subdomain.domain.edu";

$ldap = ldap_connect($adServer);
$username = 'USERNAME';
$password = 'PASS';

$ldaprdn = 'DOMAIN' . "\\" . $username;

ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);

$bind = @ldap_bind($ldap, $ldaprdn, $password);


if ($bind) {
    $filter="(sAMAccountName=$username)";
    $result = ldap_search($ldap,"dc=subdomain,dc=domain,dc=edu",$filter);
    ldap_sort($ldap,$result,"sn");
    $info = ldap_get_entries($ldap, $result);
    for ($i=0; $i<$info["count"]; $i++)
    {
        if($info['count'] > 1)
            break;
        echo "<p>You are accessing <strong> ". $info[$i]["sn"][0] .", " . $info[$i]["givenname"][0] ."</strong><br /> (" . $info[$i]["samaccountname"][0] .")</p>\n";
        echo '<pre>';
        var_dump($info);
        echo '</pre>';
        $userDn = $info[$i]["distinguishedname"][0];
    }
    @ldap_close($ldap);
} else {
    $msg = "Invalid email address / password";
    echo $msg;
}

?>

On the new server I am able to connect to the ldap server just fine using this ldapsearch command:

ldapsearch -x -LLL -h sub-domain.domain.edu -D 'CN=DOMAIN\USERNAME' -w 'PASS' -b "dc=subdomain,dc=domain,dc=edu" -s sub "(objectClass=user)" givenName

Here is my ldap.conf file (/etc/openldap/ldap.conf, New Server)

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

#TLS_CACERTDIR  /etc/openldap/certs

# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON    on
TLS_REQCERT never

This is what I get in my error logs (new Server):

ldap_create
ldap_url_parse_ext(ldaps://subdomain.domain.edu)
ldap_bind_s
ldap_simple_bind_s
ldap_sasl_bind_s
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP subdomain.domain.edu:636
ldap_new_socket: 10
ldap_prepare_socket: 10
ldap_connect_to_host: Trying XXX.18X.XX.19:636
ldap_pvt_connect: fd: 10 tm: -1 async: 0
attempting to connect:
connect errno: 13
ldap_close_socket: 10
ldap_new_socket: 10
ldap_prepare_socket: 10
ldap_connect_to_host: Trying XXX.18X.XX.24:636
ldap_pvt_connect: fd: 10 tm: -1 async: 0
attempting to connect:
connect errno: 13
ldap_close_socket: 10
ldap_new_socket: 10
ldap_prepare_socket: 10
ldap_connect_to_host: Trying XXX.18X.XX.41:636
ldap_pvt_connect: fd: 10 tm: -1 async: 0
attempting to connect:
connect errno: 13
ldap_close_socket: 10
ldap_new_socket: 10
ldap_prepare_socket: 10
ldap_connect_to_host: Trying 2002:XXXX:XXXX::XXXX:XXXX 636
ldap_pvt_connect: fd: 10 tm: -1 async: 0
attempting to connect:
connect errno: 13
ldap_close_socket: 10
ldap_err2string
[Mon Feb 23 15:20:28.689775 2015] [:error] [pid 12299] [client 10.25.XX.XX:53630] PHP Warning:  ldap_bind(): Unable to bind to server: Can't contact LDAP server in /var/www/html/index2.php on line 19

mikeDvorak mikeDvorak · Accepted Answer · 2015-02-26T17:17:32

After searching for a few more days, I came up with the answer. SELinux. To be more specific, the SELinux Booleans that are set. httpd_can_network_connect is the one we're looking at:

httpd_can_network_connect (HTTPD Service):: Allow HTTPD scripts and modules to connect to the network.

This command can be used to turn it on:

setsebool -P httpd_can_network_connect on

I solved this by finding this answer:

LDAP works with PHP CLI but not through apache

PHP LDAP Connection Can't Contact LDAP Server

1 Answers