php / php/php-src

`ldap_search` not working on debian 11 with PHP8.2 and ldap module compiled from source

Open
#18,832 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Extension: ldap Status: Needs Triage
Dominant language
C
Stars
40.4k
Forks
8.1k
Avg merge
2d 13h
Merged PRs (30d)
96

Description

Description

The following code:

Hey, I use a self compiled php8.2-ldap extension in an php8.2 setup (Default PHP8.2 container from docker php 8.2.28-cli-bullseye) .
The following code always return the ldap error Operations error (ldap_error-code 1)

<?php
$ldap_host = "myhost"; 
$ldap_dn = "DC=host,DC=site";
$ldap_username = <user>; 
$ldap_password = <pw>; 
$options = [
        'host' => $ldap_host,
        'dn' => $ldap_dn,
        'username' => $ldap_username,
        'password' => $ldap_password,
];


$ldapconn = ldap_connect($options['host']);
ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ldapconn, LDAP_OPT_REFERRALS, 0);

@ldap_bind($ldapconn, $options['user'], $options['password']);

$filter = "(objectClass=*)";

@$search = ldap_list($ldapconn, $dn, $filter);

if (!$search) {
        var_dump([
                '$search' => $search,
                'error' => 'LDAP search failed',
                'ldap_error' => ldap_error($ldapconn),
                'ldap_errno' => ldap_errno($ldapconn),
                'base_dn' => $dn,
                'filter' => $filter
        ]);
}
ldap_unbind($ldapconn);

?>

ldap_connect and ldap_bind are working fine. It is also possible to get the base dn using the following codeblock:

$read = ldap_read($ldapconn, '', 'objectClass=*', ['defaultNamingContext'], 0);
$data = ldap_get_entries($ldapconn, $read);
$dn = $data[0]['defaultnamingcontext'][0] ?? null;

That means ldap_read and ldap_get_entriesare working.

If I use the same code from above on ubuntu using pre-compiled php8.2-ldap.so module from ubuntu repository, the code runs fine without any errors. So I can be sure, that the the credentials from $options are correct. Also an ldapsearch from command line with the same credentials and filters returns valid results.

I compile the php8.2-ldap module during docker-build phase using that code:

RUN apt-get update && apt-get -y install pkg-config [...] ldap-utils libldap-common libldap2-dev\
[...]
&& docker-php-ext-configure ldap --with-libdir=/lib/x86_64-linux-gnu/ \
&& docker-php-ext-install ldap \
[...]

Resulted in this output:

`Operations error`  (ldap_error-code 1)

But I expected this output instead:

I expected a list of LDAP entries

Any idea, what's goinig on here? Did a miss a compiler-option or an package?

PHP Version
PHP 8.2.4 (cli) (built: Mar 16 2023 21:25:47) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.4, Copyright (c) Zend Technologies
    with Zend OPcache v8.2.4, Copyright (c), by Zend Technologies
Operating System

Debian 11

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the ldap_list failure in the Debian 11 PHP 8.2 Docker build, using the ldap_connect, ldap_bind, ldap_read, and ldap_get_entries paths described in the report. Compare the compiled module with the working Ubuntu module and command-line ldapsearch, then document a confirmed package or compiler difference and verify that LDAP search returns entries.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, php
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.