Get number of AD errors with LDAP and PHP (ldap function return unprecise error)

Question

I'm making an application with uses PHP to connect to Active Directory (AD), using LDAP protocol. Works fine, my problem is how to catch the specific errors if the login operations fails. Today, the application only shows if the login worked or not, example: suppose that the username is expired in AD, the system will show that the "username/password is invalid" because we don't verify specific returns of LDAP. Ok, let's go to the problem itself, below is my code that I expect to catch specific errors. ``` <?php if (! ($bind = @ldap_bind ( $connect, "DOMAIN\" . strtoupper ( $this->user), $this->password))) { error_log ( "Autentication fails LDAP (user: $this->user)" ); return ldap_errno ( $connect ); ?> ``` That function, ldap_errno, returns me the number of what happened, based on this table: (There are more, see link below) 48 LDAP_INAPPROPRIATE_AUTH 49 LDAP_INVALID_CREDENTIALS 49 / 52e AD_INVALID CREDENTIALS 49 / 525 USER NOT FOUND 49 / 530 NOT_PERMITTED_TO_LOGON_AT_THIS_TIME 49 /…

Accepted Answer

After spend a lot of hours in search I found the solution!

I have founded in this page : http://php.net/manual/en/function.ldap-get-option.php

basically you have to define a new constant variable called LDAP_OPT_DIAGNOSTIC_MESSAGE

like this

```
define('LDAP_OPT_DIAGNOSTIC_MESSAGE', 0x0032);
```

and then

```
ldap_get_option($conn, LDAP_OPT_DIAGNOSTIC_MESSAGE, $extended_error);
```

With that, LDAP will give you extended error and you will be able to know what really happened, the value will be put in $extended_error.

Get number of AD errors with LDAP and PHP (ldap function return unprecise error)

Solution

Problem