问题描述
在PHP 5.6和OpenLDAP 40年2月4日的EL7系统上工作。
Working on an EL7 system with PHP 5.6 and openldap 2.4.40.
我能使用ldapsearch查询远程LDAPS服务器：
I'm able to query the remote ldaps server using ldapsearch:
使用ldapsearch -H LDAPS：//ldap.example.com -D
CN = serviceaccount，OU =服务，DC =例如，DC = com的-x -wsapass-LLL
-bDC =例如，DC = com的CN =A codeR
这将返回用户期望的数据$ C $铬。
This returns expected data on user acoder.
移动到PHP，我试图使用相同的凭据上面绑定到同一个服务器，并通过（sapass）。
Moving to PHP, I'm attempting to bind to the same server using the same credentials and pass (sapass) above.
// server settings
$srvc_id = 'serviceaccount';
$srvc_pass = "somepass";
$ldap_host = "ldaps://ldap.example.com";
$srvc_dn = "CN=$srvc_id,OU=Services,DC=example,DC=com";
$user_filter = "(uid=$form_user)";
$ldap_conn = ldap_connect($ldap_host);
if ($ldap_conn)
{
echo "<p>Connected to \$ldap_host $ldap_host at line ";
$r = ldap_bind($ldap_conn, $srvc_dn, $srvc_pass);
if (!$r)
{
echo "<p>failed to bind with service account credentials.";
} else {
echo "<p>binded OK.";
}
}
如果我暂时将它添加到 /etc/openldap/ldap.conf中，脚本如下：
If I temporarily add this to /etc/openldap/ldap.conf, the script works:
TLS_REQCERT never
在我评论说出来，该脚本失败，无法联系LDAP服务器。
Once I comment that out, the script fails with "Can't contact LDAP server".
如果我想补充 TLS_CACERTDIR的/ etc / openldap中/证书到的ldap.conf ，堪称当脚本工作正常从命令行。
If I add TLS_CACERTDIR /etc/openldap/certs to ldap.conf, the script works fine when called from command line.
TLS_CACERTDIR /etc/openldap/certs
# TLS_REQCERT never ### only use for testing ###
这似乎像httpd不读书的必要凭证，因此无法与远程LDAP服务器进行通信。
It seems like httpd isn't reading a necessary certificate and is thus not able to communicate with the remote LDAP server.
我看用EL6工作的PHP / LDAP设置教程和我运行EL7。
The PHP/LDAP setup tutorials I've looked at work with EL6, and I am running EL7.
推荐答案
解决了！
SELinux的运行是强制。如果我暂时禁用了SELinux中，LDAP测试脚本在浏览器中运行良好。
SELinux is running Enforced. If I temporarily disabled SELinux, the ldap test script worked fine in a browser.
这使我这个这的。在这里，我们学到：
That led me to this helpful answer and this CentOS Wiki on SELinux. Here we learn:
的SELinux不允许你httpd后台交谈的LDAP
服务器在同一台机器上。
啊。原来的SELinux有细粒度开关众多，让来自不同流程的具体活动。以我为例，SELinux的配置被开箱，以禁止LDAP连接（即使LDAPS在firewalld启用）的。
Ah. It turns out SELinux has a multitude of fine-grained switches to allow specific activity from different processes. In my case, SELinux was configured out of the box to disallow LDAP connectivity (even though ldaps is enabled in firewalld).
您可以通过检查的httpd的SELinux配置：
You can check SELinux configuration of httpd using:
getsebool -a | grep httpd
返回：
[acoder@myboxen]# getsebool -a | grep httpd
httpd_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_check_spam --> off
httpd_can_connect_ftp --> off
httpd_can_connect_ldap --> off
httpd_can_connect_mythtv --> off
httpd_can_connect_zabbix --> off
httpd_can_network_connect --> off
要通过启用SELinux的httpd的网络连接：
To enable SELinux network connectivity through httpd:
setsebool -P httpd_can_network_connect on
没有必要重新启动Apache。我的LDAP脚本从这一刻起工作得很好。
No need to restart Apache. My ldap script worked fine from that moment on.
如上所述，一定要删除 TLS_REQCERT从不从 /etc/openldap/ldap.conf中和当然设置SELinux的回强制与 setenforce 1 。
As above, be sure to remove TLS_REQCERT never from your /etc/openldap/ldap.conf and of course set SELinux back to Enforcing with setenforce 1.
希望这是帮助他人。
这篇关于的ldap_bind（）失败，＆QUOT;无法联系LDAP服务器＆QUOT;的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！