Use Windows Login in PHP Applications

As a developer you may run into a situation such as what I had, numerous applications deployed and or created and deployed.

With multiple logins for all the apps, we had to find way to integrate all logins for better management and maintenance.

Since we were using Apache with a PHP server, the solution was to find a way to consolidate the logins usin PHP.

The answer is ldap() (Lightweight Directory Access Protocol), this built in function through PHP, allows you to create username and password schemes using existing Windows authentication.

Take this snippet:

$ldaprdn = 'myName@timbuckTwo.com'; // ldap rdn or dn
$ldappass = 'password'; // associated password

// connect to ldap server
$ldapconn = ldap_connect("Ip address or domain name")or die("Could not connect to LDAP server.");

That is all it takes to connect to your windows login using PHP.

Now for the practical example:

$ldaprdn = $_POST['username']; // ldap rdn or dn
$ldappass = $_POST['password']; // associated password

// connect to ldap server
$ldapconn = ldap_connect("Ip address or domain name")or die("Could not connect to LDAP server.");

The values can be passed on using a web form with the text field names of username and password:

See form code below:

<form name="form1" method="post" action="">
<table>
<tr>
<th colspan="2"><div align="center"><?=$errorMess;?></div></th>
</tr>
<tr>
<td width="76">Username</td>
<td width="324"><input class="<?=$aClass;?>" type="text" name="username" id="username" value="<?=$_POST['username'];?>"></td>
</tr>
<tr>
<td>Password</td>
<td><input class="<?=$aClass;?>" type="password" name="password" id="password" value="<?=$_POST['password'];?>"></td>
</tr>
<tr>
<td colspan="2"><input type="submit" name="Submit" id="Submit" value="Submit"></td>
</tr>
</table>
</form>

Using the multi purpose pages described in my other tutorial about forms, you can see how the logic of before we push Submit and after we push Submit.

After pushing Submit this snippet runs:

// using ldap bind
$ldaprdn = $_POST['username']; // ldap rdn or dn
$ldappass = $_POST['password']; // associated password

//lets concatenate the proper username:

$ldaprdn = $_POST['username'] . "@whatever the domain name is";

// connect to ldap server
$ldapconn = ldap_connect("ldap.example.com")
or die("Could not connect to LDAP server.");

if ($ldapconn) {

// binding to ldap server
$ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);

// verify binding
if ($ldapbind) {
echo "LDAP bind successful...";
} else {
echo "LDAP bind failed...";
}

}

We contactenated or connected the username and the domain extension to create the proper credentials to pass on to Active Directory.

Now using this knowledge, you can create authentication using the built in Windows login, no creating usernames and passwords, Windows can manage that, leaving you to script and create.

Recap:

We went over basic authentication using a small script and how you can incorporate such a script in a real life scenario.

I invite you to look at the ldap() function and its companions, it does alot more than what we went over, you can search, create and delete and modify users listed on Active Directory using the function.

I will be listing other real world scenarios in the articles to come, please come and do book mark me.

Thank you.