Question

I am currently developing a small internal PHP application which requires login. The credentials will be authenticated using LDAP, but I am wondering how secure it is to pass the AD username and password through a form?

Authentication page code:

    <?php

// using ldap bind
$ldaprdn  = $_POST['username'];
$ldappass = $_POST['password'];
// connect to ldap server
$ldapconn = ldap_connect("SERVERNAME")
    or die("Could not connect to LDAP server.");

if ($ldapconn) {

    // binding to ldap server
    $ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);

    // verify binding
    if ($ldapbind) {
        echo "LDAP bind successful...";
    } else {
        echo "LDAP bind failed...";
    }

}

?>

Answer 1

Use

• https
• Post/Redirect/Get
• Make sure your utility is not connected to the Internet, only your intranet
• CSRF Protection
• Don’t store this information in cookies, files, etc.