Bug #80405 [Asn]: LDAPCONF=/etc/ldap/ldap.conf not respected
| From: | mcmic@php.net | Date: | Thu, 09 Sep 2021 15:13:14 +0000 |
| Subject: | Bug #80405 [Asn]: LDAPCONF=/etc/ldap/ldap.conf not respected | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-236510@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=80405&edit=1
ID: 80405
Updated by: mcmic@php.net
Reported by: alisun at shitmail dot de
Summary: LDAPCONF=/etc/ldap/ldap.conf not respected
Status: Assigned
Type: Bug
Package: LDAP related
Operating System: linux
PHP Version: 7.4.12
Assigned To: mcmic
Block user comment: N
Private report: N
New Comment:
Unless I missed it I see no configuration file reading in our code, so I think this is supposed to
be done by the libldap library.
We do have a test for this, which uses LDAPCONF: https://github.com/php/php-src/blob/master/ext/ldap/tests/ldap_connect_ldap_conf.phpt
So this is expected to work, at least for URI.
If the original poster is still around, could you output the result of
var_dump(
ldap_get_option($link, LDAP_OPT_X_TLS_REQUIRE_CERT, $value),
$value);
For each case, and maybe the same with the other TLS related vars.
Previous Comments:
------------------------------------------------------------------------
[2021-09-09 14:52:07] cmb@php.net
Maybe Côme can clarify?
------------------------------------------------------------------------
[2020-11-23 10:29:57] alisun at shitmail dot de
Description:
------------
Problem: $LDAPCONF is not read properly.
cat /etc/ldap/ldap.conf
TLS_CACERT=/some/path
TLS_KEY=/some/other/path
TLS_CERT=/some/otherpath
TLS_REQCERT=demand
Ex 1: no explicit environment variables, should respect /etc/ldap/ldap.conf?
Does not :D
sudo -u www-data php -a<<eof
\$dn="someDN";
\$p="somePw";
\$ldaphost = "someHost";
\$ldapport = somePort;
\$ldapconn = ldap_connect(\$ldaphost, \$ldapport);
ldap_set_option(\$ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_start_tls(\$ldapconn);
eof
PHP Warning: ldap_start_tls(): Unable to start TLS: Connect error in php shell code on line 1
Ex 2: set LDAPCONF explicity, should respect /etc/ldap/ldap.conf?
Does not either
export LDAPCONF=/etc/ldap/ldap.conf
sudo -Eu www-data php -a<<eof
\$dn="someDN";
\$p="somePw";
\$ldaphost = "someHost";
\$ldapport = somePort;
\$ldapconn = ldap_connect(\$ldaphost, \$ldapport);
ldap_set_option(\$ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_start_tls(\$ldapconn);
eof
PHP Warning: ldap_start_tls(): Unable to start TLS: Connect error in php shell code on line 1
Ex 3: use $LDAPCONF content via environment variables
Works
export LDAPTLS_CACERT=/some/path
export LDAPTLS_KEY=/some/other/path
export LDAPTLS_CERT=/some/otherpath
export LDAPTLS_REQCERT=demand
sudo -Eu wwwcloud php -a<<eof
\$dn="uid=nextcloud,ou=people,dc=physsolutions,dc=org";
\$p=">.D+c'k_]^F4F8(d";
\$ldaphost = "ldap.physsolutions.org";
\$ldapport = 389;
\$ldapconn = ldap_connect(\$ldaphost, \$ldapport);
ldap_set_option(\$ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_start_tls(\$ldapconn);
eof
# no error
Ex 4: use $HOME/.ldaprc
Works
cp /etc/ldap/ldap.conf ~www-data/.ldaprc
sudo --set-home -u www-data php -a<<eof
\$dn="someDN";
\$p="somePw";
\$ldaphost = "someHost";
\$ldapport = somePort;
\$ldapconn = ldap_connect(\$ldaphost, \$ldapport);
ldap_set_option(\$ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_start_tls(\$ldapconn);
eof
# no error
Ex 5: use $CWD/ldaprc
Works
cp /etc/ldap/ldap.conf ldaprc
sudo -u www-data php -a<<eof
\$dn="someDN";
\$p="somePw";
\$ldaphost = "someHost";
\$ldapport = somePort;
\$ldapconn = ldap_connect(\$ldaphost, \$ldapport);
ldap_set_option(\$ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_start_tls(\$ldapconn);
eof
# no error
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=80405&edit=1