使用NTLM检查LDAP/active directory中的用户凭据

我有一个apachephp服务器,我正试图在其中使用现有的活动目录来实现权限。

我们选择NTLM来自动对windows用户进行身份验证,这一部分似乎正在工作,我正在检索用户名和NTLM挑战的答案。

我正在使用PHP ldap函数与active directory通信(与服务帐户),到目前为止,我可以检索用户组并检查用户名是否存在,但我无法作为用户进行连接以验证密码: $success = @ldap_bind($ad, "$username@$domain}", $password) or die('Could not bind to AD.');

在这里,我可以使用明文密码进行连接,但只有所谓的“NTLM响应安全缓冲区”。

有可能将NTLM和LDAP链接起来吗?如何链接? 是PHP吗 ldap_bind 根本不支持NTLM?

我读过 here 可以将质询和用户NTLM响应作为“NETLOGON_NETWORK_INFO”进行传输,但我找不到任何相关文档。

我还发现 a laravel library 声称要这么做,但查看代码,我发现了我已经测试过的内容: @ldap_bind 需要明文密码。

我的问题可能类似于 this unanswered question ,但很少有结果将LDAP和NTLM关联起来。

以下是我接手该项目时服务器上的NTLM实现:

$headers = apache_request_headers();

if (@$_SERVER['HTTP_VIA'] != NULL) {
    //echo "Proxy bypass!";
}
elseif(!isset($headers['Authorization']) || $headers['Authorization'] == NULL) {
    header( "HTTP/1.0 401 Unauthorized" );
    header( "WWW-Authenticate: NTLM" );
    exit;
}

if(isset($headers['Authorization']) && substr($headers['Authorization'],0,5) == 'NTLM ') {
    $chaine    = substr($headers['Authorization'], 5);
    $chained64 = base64_decode($chaine);

    if(ord($chained64[8]) == 1) {
        $retAuth   = "NTLMSSP".chr(000).chr(002).chr(000).chr(000).chr(000).chr(000).chr(000).chr(000);
        $retAuth   .= chr(000).chr(040).chr(000).chr(000).chr(000).chr(001).chr(130).chr(000).chr(000);
        $retAuth   .= chr(000).chr(002).chr(002).chr(002).chr(000).chr(000).chr(000).chr(000).chr(000);
        $retAuth   .= chr(000).chr(000).chr(000).chr(000).chr(000).chr(000).chr(000);
        $retAuth64 = trim(base64_encode($retAuth));

        header( "HTTP/1.0 401 Unauthorized" );
        header( "WWW-Authenticate: NTLM $retAuth64" );
        exit;
    }   
    if(ord($chained64[8]) == 3) {
        //LM Response Security Buffer: 
        $lenght_LMRSB = (ord($chained64[15])*256 + ord($chained64[14]));
        $offset_LMRSB = (ord($chained64[17])*256 + ord($chained64[16]));
        $LMRSB = str_replace("\0","",substr($chained64, $offset_LMRSB, $lenght_LMRSB));
    
        //NTLM Response Security Buffer:
        $lenght_NTLMRSB = (ord($chained64[23])*256 + ord($chained64[22]));
        $offset_NTLMRSB = (ord($chained64[25])*256 + ord($chained64[24]));
        $NTLMRSB = str_replace("\0","",substr($chained64, $offset_NTLMRSB, $lenght_NTLMRSB));

        //Domain:
        $lenght_domain = (ord($chained64[31])*256 + ord($chained64[30]));
        $offset_domain = (ord($chained64[33])*256 + ord($chained64[32]));   
        $domain = str_replace("\0","",substr($chained64, $offset_domain, $lenght_domain));

        //Login:
        $lenght_login = (ord($chained64[39])*256 + ord($chained64[38]));
        $offset_login = (ord($chained64[41])*256 + ord($chained64[40]));
        $login = str_replace("\0","",substr($chained64, $offset_login, $lenght_login));

        echo "$LMRSB<br>";
        echo "$NTLMRSB<br>";

        //HERE i would like to verify credentials against my active directory before accepting the username as a real logged user
        $_SESSION["utilisateur"] = $login;
    }
}