Securely send password to LDAP server using PHP

Question

What I am trying to do is set up a login screen. I collect the user's credentials and verify it using an ldap server before allowing the user to take a quiz.

<?php
session_start();
$user = $_POST['user'];
$domain = 'DOMAIN';
$password = $_POST['password'];
$ldapserver="ldap.example.server";
$ldapport=389;
$ldap = ldap_connect($ldapserver,$ldapport);

if ($bind = @ldap_bind($ldap,"{$user}@{$domain}", $password)){
    $_SESSION["user"] = '$user';
    header('Location: quiz.php');
}
else {
    header('Location: login.html');
}

?>

When I use wireshark to sniff the packets, i can see the username and password clearly. Is there a way to bind to an LDAP server without sending the password in plain text? The site doesnt have https. The owner does not want to buy a SSL certificate, nor is he interest in a self-signed one.

TheGentleman · Accepted Answer · 2015-04-13 19:37:10Z

1

Does your ldap server support ldaps and have a certificate? That would be the easiest way to do this and your site wouldn't need a certificate. You'd just change your code slightly. Assuming your server uses the default ldaps port:

$ldapserver = 'ldaps://ldap.example.server';
$ldapport = 636;

edited Apr 13, 2015 at 19:37

answered Apr 13, 2015 at 17:10

TheGentleman

2,40715 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Harry Singh Over a year ago

So i was able to connect to the server but not able to bind. The credentials are the same as they were before. Any ideas on why i cant bind?

TheGentleman Over a year ago

Hmm, does the hostname in $ldapserver match the CN on the certificate?

Harry Singh Over a year ago

I have no idea. I dont have access to the server but I'll check to see. Thanks for pointing me in the right direction :)

Collectives™ on Stack Overflow

Securely send password to LDAP server using PHP

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related