LDAP Client x509 Certificate Authentication

Google announced their LDAP service: https://support.google.com/cloudidentity/answer/9089736 and we wanted to see if we could get it working for our users.

However, it requires a client certificate to authenticate to the server, which SimpleSAMLphp doesn't support: https://simplesamlphp.org/docs/stable/ldap:ldap . It seems to only support username/password for client authentication.

It would be nice to be able to support client cert/key for authentication in addition to username/password. OpenLDAP supports it using TLS_CERT and TLS_KEY.

It seems that support for this may have only come into PHP in version 7.1: http://php.net/manual/en/function.ldap-set-option.php

Commencez par la documentation LDAP de SimpleSAMLphp et la référence de ldap_set_option de PHP liées dans l’issue. Déterminez comment les certificats et les clés client doivent être configurés en complément de l’authentification par nom d’utilisateur et mot de passe, y compris les versions de PHP prises en charge. La tâche est terminée lorsque l’authentification LDAP peut utiliser le flux basé sur les certificats sans supprimer le flux existant basé sur les identifiants.