Zend/Apache 的 LDAP 失败

Question

我有一个非常简单的 php ldap 脚本，仅在与 Zend 和 Apache 一起运行时才会失败。当我从命令行运行这个脚本时，它通过了。运行 strace，我可以看到行为发生变化的地方，但我不知道为什么。我已确认正在读取相同的 ldap.conf 并加载相同的 ldap.so。

我相信这是因为证书问题，但我的设置应该忽略证书问题。

版本信息（从 php 和 apache 运行时这些似乎是相同的）：

OpenSSL:   0.9.8o 01 Jun 2010
OpenLdap:  $Id: ldap.c 313665 2011-07-25 11:42:53Z felipe $
Zend:      5.5
PHP:       5.3.8


<?php
      ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
      putenv('LDAPTLS_REQCERT=never');
      $ds = ldap_connect("ldaps://myserver.com:636");
      $db = ldap_bind($ds, 'user', 'pass');
?>

在我的 ldap.conf 中，我只有“TLS_REQCERT never”。我意识到这是上面重复的。

在 apache 下运行时，我从 ldap 得到以下跟踪：

ldap_create 
ldap_url_parse_ext(ldaps://myserver.com:636)
ldap_bind_s 
ldap_simple_bind_s 
ldap_sasl_bind_s 
ldap_sasl_bind
ldap_send_initial_request 
ldap_new_connection 1 1 0
ldap_int_open_connection 
ldap_connect_to_host: TCP myserver.com:636 
ldap_new_socket: 20 
ldap_prepare_socket: 20
ldap_connect_to_host: Trying <myip>:636 
ldap_pvt_connect: fd: 20 tm: -1 async: 0 
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A 
TLS trace: SSL_connect:SSLv3 read server hello A 
TLS certificate verification: depth: 0, err: 20, subject: /CN=mycn.com,
    issuer: /CN=Collaboration Services CA 
TLS certificate verification: Error, unable to get local issuer certificate 
TLS trace: SSL_connect:SSLv3 read server certificate A 
TLS trace: SSL_connect:SSLv3 read server certificate request A 
TLS trace: SSL_connect:SSLv3 read server done A 
TLS trace: SSL_connect:SSLv3 write client certificate A 
TLS trace: SSL_connect:SSLv3 write client key exchange A 
TLS trace: SSL_connect:error in SSLv3 write finished A
TLS trace: SSL_connect:error in SSLv3 write finished A 
TLS: can't connect: error:140D308A:SSL routines:TLS1_SETUP_KEY_BLOCK:cipher or hash unavailable. 
ldap_err2string

在命令行上使用相同的 php 可执行文件运行相同的脚本时，我得到：

ldap_create
ldap_url_parse_ext(ldaps://myserver.com:636)
ldap_bind_s
ldap_simple_bind_s
ldap_sasl_bind_s
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP myserver.com:636
ldap_new_socket: 4
ldap_prepare_socket: 4
ldap_connect_to_host: Trying <my ip>:636
ldap_pvt_connect: fd: 4 tm: -1 async: 0
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 0, err: 20, subject: /CN=myserver.com, issuer: /CN=Collaboration Services CA
TLS certificate verification: Error, unable to get local issuer certificate
TLS trace: SSL_connect:SSLv3 read server certificate A
TLS trace: SSL_connect:SSLv3 read server certificate request A
TLS trace: SSL_connect:SSLv3 read server done A
TLS trace: SSL_connect:SSLv3 write client certificate A
TLS trace: SSL_connect:SSLv3 write client key exchange A
TLS trace: SSL_connect:SSLv3 write change cipher spec A
TLS trace: SSL_connect:SSLv3 write finished A
TLS trace: SSL_connect:SSLv3 flush data
TLS trace: SSL_connect:SSLv3 read finished A
ldap_open_defconn: successful
ldap_send_server_request

Answer 1

当检查运行 strace 的结果显示它没有打开我的 ldap.conf 文件的权限时，我终于解决了这个问题。打开权限解决了该问题。但是，应该不需要该文件，因为它仅具有与环境变量相同的设置：

putenv('LDAPTLS_REQCERT=never');