ActiveDirectory Class

Properties   Methods   Events   Config Settings   Errors  

The ActiveDirectory class can be used to authenticate users against Active Directory using Kerberos 5.0.

Class Name

IPWorksAuth_ActiveDirectory

Procedural Interface

 ipworksauth_activedirectory_open();
 ipworksauth_activedirectory_close($res);
 ipworksauth_activedirectory_register_callback($res, $id, $function);
 ipworksauth_activedirectory_get_last_error($res);
 ipworksauth_activedirectory_get_last_error_code($res);
 ipworksauth_activedirectory_set($res, $id, $index, $value);
 ipworksauth_activedirectory_get($res, $id, $index);
 ipworksauth_activedirectory_do_authenticate($res);
 ipworksauth_activedirectory_do_changepassword($res, $user, $oldpassword, $newpassword);
 ipworksauth_activedirectory_do_config($res, $configurationstring);
 ipworksauth_activedirectory_do_doevents($res);
 ipworksauth_activedirectory_do_interrupt($res);
 ipworksauth_activedirectory_do_listcomputers($res);
 ipworksauth_activedirectory_do_listgroupmembers($res, $group);
 ipworksauth_activedirectory_do_listgroups($res);
 ipworksauth_activedirectory_do_listusergroups($res, $user);
 ipworksauth_activedirectory_do_reset($res);

Remarks

The ActiveDirectory class authenticates users against Active Directory. Authentication is performed using the Kerberos protocol defined in RFC 1510 and RFC 4120.

Authentication

When Authenticate is called the class will attempt to authenticate the user with the Active Directory server. The class will communicate with the ADHost to obtain a service ticket and populate AuthToken. The following properties are required when calling this method:

• SPN (required)
• User (required)
• Password (required)
• ADHost (required)

A typical sequence of messages would be:

• KRB_AS_REQ -> KDC
• KRB_AS_REP <- KDC
• KRB_TGS_REQ -> KDC
• KRB_TGS_REP <- KDC
• AuthToken is populated with the constructed KRB_AP_REP message.

Communication with the ADHost can be seen through the PITrail event.

Property List

---

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

ADHost Property (IPWorksAuth_ActiveDirectory Class)

The domain name or IP address of the Active Directory server.

Object Oriented Interface

public function getADHost();
public function setADHost($value);

Procedural Interface

ipworksauth_activedirectory_get($res, 1 );
ipworksauth_activedirectory_set($res, 1, $value );

Default Value

''

Remarks

This property specifies the IP address (IP number in dotted internet format) or Domain Name of the Active Directory server.

If this property is set to a Domain Name, a DNS request is initiated and upon successful termination of the request, this property is set to the corresponding address. If the search is not successful, an error is returned.

Data Type

String

ADPort Property (IPWorksAuth_ActiveDirectory Class)

The port for the Active Directory server.

Object Oriented Interface

public function getADPort();
public function setADPort($value);

Procedural Interface

ipworksauth_activedirectory_get($res, 2 );
ipworksauth_activedirectory_set($res, 2, $value );

Default Value

88

Remarks

This property specifies the port for the Active Directory server. The default value is 88.

Data Type

Integer

AuthMechanism Property (IPWorksAuth_ActiveDirectory Class)

The authentication mechanism to be used when connecting to the Active Directory server.

Object Oriented Interface

public function getAuthMechanism();
public function setAuthMechanism($value);

Procedural Interface

ipworksauth_activedirectory_get($res, 3 );
ipworksauth_activedirectory_set($res, 3, $value );

Default Value

6

Remarks

This property specifies the authentication mechanism used. Possible values are:

Data Type

Integer

AuthToken Property (IPWorksAuth_ActiveDirectory Class)

The authentication token.

Object Oriented Interface

public function getAuthToken();

Procedural Interface

ipworksauth_activedirectory_get($res, 4 );

Default Value

''

Remarks

This property holds the authentication token.

This property will be populated after calling Authenticate. This may be used in by another entity to authenticate to the service. For instance this may be used in HTTP to authenticate to a web service.

The content of this property is a KRB_AP_REQ message. This is sometimes referred to as an "Authentication Header". It is comprised of the service ticket that was obtained from the TGS and an encrypted authenticator.

This property is read-only.

Data Type

Binary String

Password Property (IPWorksAuth_ActiveDirectory Class)

The user's password.

Object Oriented Interface

public function getPassword();
public function setPassword($value);

Procedural Interface

ipworksauth_activedirectory_get($res, 5 );
ipworksauth_activedirectory_set($res, 5, $value );

Default Value

''

Remarks

This property specifies the user's password. This must be set before calling Authenticate.

Data Type

String

SPN Property (IPWorksAuth_ActiveDirectory Class)

The Service Principal Name (SPN).

Object Oriented Interface

public function getSPN();
public function setSPN($value);

Procedural Interface

ipworksauth_activedirectory_get($res, 6 );
ipworksauth_activedirectory_set($res, 6, $value );

Default Value

''

Remarks

This property specifies the Service Principal Name (SPN). This must be set before calling Authenticate.

Data Type

String

Timeout Property (IPWorksAuth_ActiveDirectory Class)

The timeout for the class.

Object Oriented Interface

public function getTimeout();
public function setTimeout($value);

Procedural Interface

ipworksauth_activedirectory_get($res, 7 );
ipworksauth_activedirectory_set($res, 7, $value );

Default Value

60

Remarks

If the Timeout property is set to 0, all operations will run uninterrupted until successful completion or an error condition is encountered.

If Timeout is set to a positive value, the class will wait for the operation to complete before returning control.

The class will use DoEvents to enter an efficient wait loop during any potential waiting period, making sure that all system events are processed immediately as they arrive. This ensures that the host application does not freeze and remains responsive.

If Timeout expires, and the operation is not yet complete, the class fails with an error.

Note: By default, all timeouts are inactivity timeouts, that is, the timeout period is extended by Timeout seconds when any amount of data is successfully sent or received.

The default value for the Timeout property is 60 seconds.

Data Type

Integer

User Property (IPWorksAuth_ActiveDirectory Class)

The name and domain of the user to authenticate.

Object Oriented Interface

public function getUser();
public function setUser($value);

Procedural Interface

ipworksauth_activedirectory_get($res, 8 );
ipworksauth_activedirectory_set($res, 8, $value );

Default Value

''

Remarks

This property specifies the name and realm/domain of the user. The value specified must be in one of the following formats:

• user@domain
• domain/user

Data Type

String

Authenticate Method (IPWorksAuth_ActiveDirectory Class)

Authenticates the user.

Object Oriented Interface

public function doAuthenticate();

Procedural Interface

ipworksauth_activedirectory_do_authenticate($res);

Remarks

This method authenticates the User.

Authentication

When Authenticate is called the class will attempt to authenticate the user with the Active Directory server. The class will communicate with the ADHost to obtain a service ticket and populate AuthToken. The following properties are required when calling this method:

• SPN (required)
• User (required)
• Password (required)
• ADHost (required)

A typical sequence of messages would be:

• KRB_AS_REQ -> KDC
• KRB_AS_REP <- KDC
• KRB_TGS_REQ -> KDC
• KRB_TGS_REP <- KDC
• AuthToken is populated with the constructed KRB_AP_REP message.

Communication with the ADHost can be seen through the PITrail event.

ChangePassword Method (IPWorksAuth_ActiveDirectory Class)

Changes the password for the specified user.

Object Oriented Interface

public function doChangePassword($user, $oldpassword, $newpassword);

Procedural Interface

ipworksauth_activedirectory_do_changepassword($res, $user, $oldpassword, $newpassword);

Remarks

This method changes the password for the specified user.

The User parameter is the name of the user for which the password will be changed. OldPassword specifies the current password and NewPassword specifies the new password.

Note: This operation can only be performed over the SSL Port. Set ADPort to the SSL port of the server (typically 636) before calling this method.

Note: If the user is an administrator the old password is not required.

Config Method (IPWorksAuth_ActiveDirectory Class)

Sets or retrieves a configuration setting.

Object Oriented Interface

public function doConfig($configurationstring);

Procedural Interface

ipworksauth_activedirectory_do_config($res, $configurationstring);

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

DoEvents Method (IPWorksAuth_ActiveDirectory Class)

This method processes events from the internal message queue.

Object Oriented Interface

public function doEvents();

Procedural Interface

ipworksauth_activedirectory_do_doevents($res);

Remarks

When DoEvents is called, the class processes any available events. If no events are available, it waits for a preset period of time, and then returns.

Interrupt Method (IPWorksAuth_ActiveDirectory Class)

This method interrupts the current method.

Object Oriented Interface

public function doInterrupt();

Procedural Interface

ipworksauth_activedirectory_do_interrupt($res);

Remarks

If there is no method in progress, Interrupt simply returns, doing nothing.

ListComputers Method (IPWorksAuth_ActiveDirectory Class)

Lists all computers in the directory.

Object Oriented Interface

public function doListComputers();

Procedural Interface

ipworksauth_activedirectory_do_listcomputers($res);

Remarks

This method lists all computers in the directory. The ComputerList event will be fired once for each computer returned.

ListGroupMembers Method (IPWorksAuth_ActiveDirectory Class)

List all members of a group.

Object Oriented Interface

public function doListGroupMembers($group);

Procedural Interface

ipworksauth_activedirectory_do_listgroupmembers($res, $group);

Remarks

This method lists all members of the specified group. The UserList event will be fired once for each member returned.

ListGroups Method (IPWorksAuth_ActiveDirectory Class)

List all groups in the directory.

Object Oriented Interface

public function doListGroups();

Procedural Interface

ipworksauth_activedirectory_do_listgroups($res);

Remarks

This method lists all groups in the directory. The GroupList event will be fired once for each group returned.

ListUserGroups Method (IPWorksAuth_ActiveDirectory Class)

Lists all groups a user is a part of.

Object Oriented Interface

public function doListUserGroups($user);

Procedural Interface

ipworksauth_activedirectory_do_listusergroups($res, $user);

Remarks

This method lists all groups that the user specified by user is a part of. The GroupList event will fire once for each group the user is a part of.

Reset Method (IPWorksAuth_ActiveDirectory Class)

Resets the class properties to their default values.

Object Oriented Interface

public function doReset();

Procedural Interface

ipworksauth_activedirectory_do_reset($res);

Remarks

This method resets the properties to their default values.

ComputerList Event (IPWorksAuth_ActiveDirectory Class)

Fired for each computer entry returned.

Object Oriented Interface

public function fireComputerList($param);

Procedural Interface

ipworksauth_activedirectory_register_callback($res, 1, array($this, 'fireComputerList'));

Parameter List

 'name'
 'operatingsystem'
 'lastlogon'
 'logoncount'
 'dn'

Remarks

This event is fired once for each computer returned when the ListComputers method is called.

Error Event (IPWorksAuth_ActiveDirectory Class)

Fired when information is available about errors during data delivery.

Object Oriented Interface

public function fireError($param);

Procedural Interface

ipworksauth_activedirectory_register_callback($res, 2, array($this, 'fireError'));

Parameter List

 'errorcode'
 'description'

Remarks

The Error event is fired in case of exceptional conditions during message processing. Normally the class fails with an error.

The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.

GroupList Event (IPWorksAuth_ActiveDirectory Class)

Fired for each group entry returned.

Object Oriented Interface

public function fireGroupList($param);

Procedural Interface

ipworksauth_activedirectory_register_callback($res, 3, array($this, 'fireGroupList'));

Parameter List

 'name'
 'description'
 'dn'

Remarks

This event is fired once for each group entry returned when either of the ListGroups or ListUserGroups methods are called.

Log Event (IPWorksAuth_ActiveDirectory Class)

Fires once for each log message.

Object Oriented Interface

public function fireLog($param);

Procedural Interface

ipworksauth_activedirectory_register_callback($res, 4, array($this, 'fireLog'));

Parameter List

 'loglevel'
 'message'
 'logtype'

Remarks

This event fires once for each log message generated by the class. The verbosity is controlled by the LogLevel setting.

LogLevel indicates the level of the Message. Possible values are:

The value 1 (Info) logs basic information, including the URL, HTTP version, and status details.

The value 2 (Verbose) logs additional information about the request and response.

The value 3 (Debug) logs the headers and body for both the request and response, as well as additional debug information (if any).

LogType identifies the type of log entry. Possible values are:

• Info
• Verbose
• Debug

PITrail Event (IPWorksAuth_ActiveDirectory Class)

Traces the messages sent to the server, and the respective replies.

Object Oriented Interface

public function firePITrail($param);

Procedural Interface

ipworksauth_activedirectory_register_callback($res, 5, array($this, 'firePITrail'));

Parameter List

 'direction'
 'message'

Remarks

The PITrail event is useful for debugging purposes. It shows all the interaction between the client and the server. To include the raw packets set LogKerberosPackets to True.

The Message parameter contains the full text of the message. The Direction parameter shows the originator of the message:

UserList Event (IPWorksAuth_ActiveDirectory Class)

Fired once for each user entry returned.

Object Oriented Interface

public function fireUserList($param);

Procedural Interface

ipworksauth_activedirectory_register_callback($res, 6, array($this, 'fireUserList'));

Parameter List

 'name'
 'description'
 'lastlogon'
 'memberof'
 'dn'

Remarks

This event is fired once for each user entry returned when the ListGroupMembers method is called.

Config Settings (ActiveDirectory Class)

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

ActiveDirectory Config Settings

TCPClient Config Settings

Socket Config Settings

Base Config Settings

Trappable Errors (ActiveDirectory Class)

AD Errors

UDP Errors

TCP/IP Errors