{"id":123,"date":"2017-04-28T11:36:37","date_gmt":"2017-04-28T09:36:37","guid":{"rendered":"http:\/\/www.stepit.co.za\/wp\/?p=123"},"modified":"2018-12-04T11:42:19","modified_gmt":"2018-12-04T09:42:19","slug":"php-active-directory-authentication-using-self-signed-ssl-cert-ldaps","status":"publish","type":"post","link":"http:\/\/www.stepit.co.za\/wp\/blog\/2017\/04\/28\/php-active-directory-authentication-using-self-signed-ssl-cert-ldaps\/","title":{"rendered":"PHP Active Directory Authentication using Self Signed SSL Cert (LDAPS:\/\/)"},"content":{"rendered":"

Here is the steps I followed to get the domain controller’s SSL CA cert and configure PHP with LDAP to do LDAPS authentication on Active Directory (Domain Controller AD).<\/p>\n

  • First let get the CA cert. If you dont have it, it can be done via openssl.<\/li>\n

    To get the CA cert
    \n
    \nopenssl s_client -connect YOUR_WINDOWS_DOMAIN_NAME.YOUR_DOMAIN_EXTENTION:636
    \n<\/code>
    \nyou will see all the values but what we are interested in is the –BEGIN CERTIFICATE — and –END CERTIFICATE—
    \nso save all the output to a file :
    \n
    \nopenssl s_client -connect YOUR_WINDOWS_DOMAIN_NAME.YOUR_DOMAIN_EXTENTION:636 > ca_cert.pem
    \n<\/code>
    \nthen edit it: vi ca_cert.pem (or xed ca_cert.pem) and delete everything only leaving the –BEGIN CERTIFICATE — …. –END CERTIFICATE— including the –BEGIN CERTIFICATE — and –END CERTIFICATE— tages.<\/p>\n

    Rename the file to a more descriptive name for your CA
    \n mv ca_cert.pem MyCA.pem<\/p>\n

    To make sure you have the right Domain you can always do a nslookup to verify the domain controllers.
    \nnslookup
    \nset type=ANY
    \nyour_microsoft_domain.your_web_domain.com<\/p>\n

  • Now to install the new CA cert on the server<\/li>\n

    To see where the cert dir is located do a : openssl version -d
    \n(Mine was \/etc\/openssl\/certs)
    \nso I copy
    \n cp ca_cert.pem \/etc\/openssl\/certs
    \nand to create the HASH (You can do below or try running c_rehash in \/etc\/openssl\/certs )
    \n
    \nopenssl x509 -noout -hash -in ca-certificate-file
    \n<\/code>
    \ngrab the output hash (ie 23456789d)
    \nthen do a link
    \nln -s MaCA.crt 23456789d.0<\/p>\n

  • New verify the installed certificate<\/li>\n


    \nopenssl s_client -connect ANY_OF_THE_LDAP_SERVERS_GET_LIST_FROM_NSLOOKUP:636 -CAfile
    \n\/etc\/ssl\/certs\/MyCA.pem -verify 0
    \n<\/code><\/p>\n

  • Now to configure the LDAP to use secure LDAPS\n
  • \n

    Here is the tricky part. I have found that my PHP does not pick up the changes I have made on \/etc\/openldap\/ldap.conf .
    \nbut start there first edit : xed \/etc\/openldap\/ldap.conf (or vi \/etc\/openldap\/ldap.conf if you prefer)
    \nadd these lines:
    \nTLS_CACERT \/etc\/ssl\/certs\/23456789d.0<\/p>\n

    You can always add this to ensure that you accept all certificates
    \nTLS_REQCERT allow<\/p>\n

    now test and to see any errors you can do a
    \nsudo tail -f \/var\/log\/apache2\/error_log to see the errors<\/p>\n

    If it does not work (Like on my UNIX box HP-UX) then on your phpinfo(); page under “Environment” look for variable HOME and lets say its
    \n\/svr\/www
    \ncp \/etc\/openldap\/ldap.conf \/srv\/www\/.ldaprc<\/p>\n

  • Using PHP to autenticate<\/li>\n

    Now when its configured now you can use Active Directory Include from Source Forge<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    Here is the steps I followed to get the domain controller’s SSL CA cert and configure PHP with LDAP to do LDAPS authentication on Active Directory (Domain Controller AD). First let get the CA cert. If you dont have it, it can be done via openssl. To get the CA cert openssl s_client -connect YOUR_WINDOWS_DOMAIN_NAME.YOUR_DOMAIN_EXTENTION:636 … <\/p>\n

    Continue reading “PHP Active Directory Authentication using Self Signed SSL Cert (LDAPS:\/\/)”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[9,11,14,8,7,12,10,13,6],"class_list":["post-123","post","type-post","status-publish","format-standard","hentry","category-linux-help","tag-active-directory-ad","tag-ad","tag-cert","tag-ldaps","tag-linux","tag-microsoft-domain-authentication","tag-openssl","tag-own-ca","tag-php"],"_links":{"self":[{"href":"http:\/\/www.stepit.co.za\/wp\/wp-json\/wp\/v2\/posts\/123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.stepit.co.za\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.stepit.co.za\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.stepit.co.za\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.stepit.co.za\/wp\/wp-json\/wp\/v2\/comments?post=123"}],"version-history":[{"count":11,"href":"http:\/\/www.stepit.co.za\/wp\/wp-json\/wp\/v2\/posts\/123\/revisions"}],"predecessor-version":[{"id":335,"href":"http:\/\/www.stepit.co.za\/wp\/wp-json\/wp\/v2\/posts\/123\/revisions\/335"}],"wp:attachment":[{"href":"http:\/\/www.stepit.co.za\/wp\/wp-json\/wp\/v2\/media?parent=123"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.stepit.co.za\/wp\/wp-json\/wp\/v2\/categories?post=123"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.stepit.co.za\/wp\/wp-json\/wp\/v2\/tags?post=123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}