Php ldap登录问题

此脚本在尝试登录时的问题是，用户可以在用户名字段中仅使用用户名而在密码字段中不使用密码登录。他们还可以使用正确的用户名和密码登录。但是，当使用正确的用户名和错误的密码时，登录失败。我找了一点，但没找到多少。这是我的

<?php 
    session_start();
    include('config/db.php');
    //echo phpinfo();
    if(isset($_REQUEST['hdn_submit']) && $_REQUEST['hdn_submit']=="1"){ 

        $ldaprdn = $_POST['username'] . '@domain';
        $uname = $_POST['username'];
        $ldappass = $_POST['password'];
        //$ldapconn = ldap_connect(" old IP address",port)or die("Could not connect to LDAP server.");
        $ldapconn = ldap_connect("IP address",port)or die("Could not connect to LDAP server.");
        //echo $ldaprdn;
        if ($ldapconn)
        {
            //ldap_set_option($ldapconn,LDAP_OPT_PROTOCOL_VERSION,3) or die("Could not set ldap protocol version");
            // binding to ldap server
            $ldapbind = @ldap_bind($ldapconn,$ldaprdn,$ldappass);
            // verify binding
            if ($ldapbind)
            {
                //login successfull 
                $_SESSION['checkin'] = date('d/m/Y h:i:s A');
                $_SESSION['user_name'] = $_REQUEST['username'];

                header('Location: index.php');

            }
            else
            {
                //echo 'hello';
                echo '<script language="javascript">alert("Invalid Login. Please try again!")</script>;';
                $_SESSION['LoggedIn'] = '0';

            }

        }

    }

 ?>

<?php  include_once('template/header.php'); ?>
<div class="row page-area">

  <div class="panel panel-primary" style="width:300px; margin:100px auto;">
    <div class="panel-heading">User Login</div>
    <div class="panel-body">
      <form class="form-signin" method="post" action="">

          <?php if($msg!=''){ ?>
          <p class="bg-primary"><?php echo $msg; ?></p>
          <?php } ?>

          <input name="username" type="text" class="form-control" placeholder="User Name" required autofocus><br/>
          <input type="password" name="password" class="form-control" placeholder="User Password" required><br/>
          <button class="btn btn-lg btn-primary btn-block" type="submit">
              Sign In
          </button>
          <input type="hidden" name="hdn_submit" value="1">
      </form>
    </div>
  </div>

</div>

<?php  include_once('template/footer.php'); ?>

用户登录





登录

当他们在没有密码的情况下“登录”时，后端目录服务器很可能以匿名方式绑定会话

如果在目录服务器上禁用匿名绑定，则会出现故障。

<?php 
    session_start();
    include('config/db.php');
    //echo phpinfo();
    if(isset($_REQUEST['hdn_submit']) && $_REQUEST['hdn_submit']=="1"){ 

        $ldaprdn = $_POST['username'] . '@domain';
        $uname = $_POST['username'];
        $ldappass = $_POST['password'];
        //$ldapconn = ldap_connect("IP",port)or die("Could not connect to LDAP server.");
        $ldapconn = ldap_connect("IP",port)or die("Could not connect to LDAP server.");
        //echo $ldaprdn;
        if ($ldapconn)
        {
            //ldap_set_option($ldapconn,LDAP_OPT_PROTOCOL_VERSION,3) or die("Could not set ldap protocol version");
            // binding to ldap server
            if($ldaprdn!="" && $ldappass!=""){
                $ldapbind = @ldap_bind($ldapconn,$ldaprdn,$ldappass);
                // verify binding
                if ($ldapbind)
                {
                    //login successfull 
                    $_SESSION['checkin'] = date('d/m/Y h:i:s A');
                    $_SESSION['user_name'] = $_REQUEST['username'];

                    header('Location: index.php');

                }
                else
                {
                    //echo 'hello';
                    echo '<script language="javascript">alert("Invalid Login. Please try again!")</script>;';
                    $_SESSION['LoggedIn'] = '0';

                }
            }else{
                    echo '<script language="javascript">alert("Invalid Login. Please try again!")</script>;';
                    $_SESSION['LoggedIn'] = '0';
            }

        }

    }

 ?>

我想补充一点，您应该验证表单中是否提供了userID和密码值，并且在没有“真实”值的情况下拒绝提交到LDAP服务器。（即没有空字符串或空值）Dave Bennet如果禁用我无法控制的匿名绑定时出现问题怎么办？有使用专用绑定帐户的选项吗？jeemster，我不敢相信我忽略了这一点。谢谢，我让它工作了。然后正如@jeemster所说，你的应用程序应该防止ldap连接尝试使用空密码。如果您正在使用用户的连接进行任何操作，如果匿名绑定，则该连接可能不包含您所需的信息；它当然不允许更新。但是如果你使用一个服务帐户来做这些事情，那么你基本上会让这个人免费进入fron doo。