为什么 ldap_bind 无法针对 SimpleAD 进行身份验证？

Question

我有一个 AD ldap.patontheback.org，我正在尝试 ldap_bind 使用默认管理员帐户。我可以成功使用远程桌面来管理用户的同一帐户。

$ldapconn = ldap_connect("ldap://172.31.22.45");
ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
ldap_bind($ldapconn, "cn=Administrator,dc=ldap,dc=patontheback,dc=org", "<my password>");

可以连接，但不进行身份验证：

ldap_sasl_bind_s
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP 172.31.22.45:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 172.31.22.45:389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ldap_result ld 0x2bb31e0 msgid 1
wait4msg ld 0x2bb31e0 msgid 1 (infinite timeout)
wait4msg continue ld 0x2bb31e0 msgid 1 all 1
** ld 0x2bb31e0 Connections:
* host: 172.31.22.45  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon May  9 13:45:10 2016


** ld 0x2bb31e0 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x2bb31e0 request count 1 (abandoned 0)
** ld 0x2bb31e0 Response Queue:
   Empty
  ld 0x2bb31e0 response count 0
ldap_chkResponseList ld 0x2bb31e0 msgid 1 all 1
ldap_chkResponseList returns ld 0x2bb31e0 NULL
ldap_int_select
read1msg: ld 0x2bb31e0 msgid 1 all 1
read1msg: ld 0x2bb31e0 msgid 1 message type bind
read1msg: ld 0x2bb31e0 0 new referrals
read1msg:  mark request completed, ld 0x2bb31e0 msgid 1
request done: ld 0x2bb31e0 msgid 1
res_errno: 49, res_error: <Simple Bind Failed: NT_STATUS_LOGON_FAILURE>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
ldap_parse_result
ldap_msgfree
ldap_err2string
PHP Warning:  ldap_bind(): Unable to bind to server: Invalid credentials in php shell code on line 1

我已经三次检查密码是否正确。我从 windows 服务器获得的 LDAP 的 IP：

C:\Users\Administrator>nslookup ldap.patontheback.org
Server:  AWS-4A06F0BDB6.ldap.patontheback.org
Address:  172.31.22.45

Name:    ldap.patontheback.org
Addresses:  172.31.22.45
          172.31.2.194

我到底错过了什么？

Answer 1

所以我可以使用 UPN 作为标识让它工作：

ldap_bind($ldapconn, "Administrator@ldap.patontheback.org", "<password>");

它有效，但无法解释为什么另一种方法无效。

Answer 2

对于那些像我后来一样提出这个问题的人，正确的做法是

ldap_bind($ldapconn, "cn=Administrator,cn=Users,dc=ldap,dc=patontheback,dc=org", "<my password>");

cn=Users 是必须包含的路径。

为什么 ldap_bind 无法针对 SimpleAD 进行身份验证？

Why is ldap_bind failing to authenticate against SimpleAD?

ldap

active-directory

aws-directory-services