[8.4.21] ldap_connect(): Could not create new security context

[Commifreak]

Description

The following code:

<?php
ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);


if (isset($_SERVER['HOME']) && strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
	$ldaprcfile = $_SERVER['HOME'] . '/.ldaprc';
	if (!file_exists($ldaprcfile)) {
		@file_put_contents($ldaprcfile, 'TLS_REQCERT allow')
	}
	putenv('LDAPCONF=' . $ldaprcfile);
}
putenv('LDAPTLS_REQCERT=allow');
putenv('TLS_REQCERT=allow');


$hostPrefix = 'ldaps://my.ldap.server';
$port       = 636;


ldap_set_option(null, LDAP_OPT_NETWORK_TIMEOUT, 5);
$l = ldap_connect($hostPrefix, $port);
if (!$l) {
	echo "Connect to $hostPrefix:$port failed!";

}

ldap_set_option($l, LDAP_OPT_NETWORK_TIMEOUT, 5);
ldap_set_option($l, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($l, LDAP_OPT_REFERRALS, 0);

$bind_dn = 'xxxxx';


$b = ldap_bind($l, $bind_dn, 'xxxxx');
if (!$b && ldap_errno($l) === -1) { // -1 = No TCP connection
	echo "Connect try #$connTry failed!";
}


if (!$b) {
	echo 'Bind failed! ' . ldap_error($l) . ' - Errno: ' . ldap_errno($l);
}

3


$result = ldap_search($l, 'dc=ldap', '(mail=*me*)', ['mail'], 0, -1, -1, LDAP_DEREF_NEVER);
$entries = ldap_get_entries($l, $result);

Resulted in this output:

PHP Warning:  ldap_connect(): Could not create new security context in /root/ldap_test.php on line 35

But I expected this output instead:

-

Maybe this is a known bug, following up from #18529 ?

Only 8.4 is not working:

PHP Version	Result
7.3.33-32+ubuntu22.04.1+deb.sury.org+1	OK
1:7.4.33-28+ubuntu22.04.1+deb.sury.org+1	OK
1:8.0.30-22+ubuntu22.04.1+deb.sury.org+1	OK
8.1.34-6+ubuntu22.04.1+deb.sury.org+1	OK
8.2.31-3+ubuntu22.04.1+deb.sury.org+1	OK
8.3.31-3+ubuntu22.04.1+deb.sury.org+1	OK
8.4.21-3+ubuntu22.04.1+deb.sury.org+1	ldap_connect(): Could not create new security context
8.5.6-3+ubuntu22.04.1+deb.sury.org+1	OK

PHP Version

PHP 8.4.21 (cli) (built: May 14 2026 16:00:34) (NTS)
Copyright (c) The PHP Group
Built by Ubuntu
Zend Engine v4.4.21, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.21, Copyright (c), by Zend Technologies
    with Xdebug v3.5.0, Copyright (c) 2002-2025, by Derick Rethans

Operating System

Ubuntu 22.04

[devnexen]

Hi @Commifreak is each php version linked to the same ldap library version ?

[Commifreak]

Sorry, could you guide me how to test that?

[devnexen]

<php binary> --ri ldap

for ex.

[Commifreak]

PHP8.3:

ldap

LDAP Support => enabled
Total Links => 0/unlimited
API Version => 3001
Vendor Name => OpenLDAP
Vendor Version => 20520
SASL Support => Enabled

Directive => Local Value => Master Value
ldap.max_links => Unlimited => Unlimited

PHP8.4:

ldap

LDAP Support => enabled
Total Links => 0/unlimited
API Version => 3001
Vendor Name => OpenLDAP
Vendor Version => 20520
SASL Support => Enabled

Directive => Local Value => Master Value
ldap.max_links => Unlimited => Unlimited

PHP8.5:

ldap

LDAP Support => enabled
Total Links => 0/unlimited
API Version => 3001
Vendor Name => OpenLDAP
Vendor Version => 20520
SASL Support => Enabled

Directive => Local Value => Master Value
ldap.max_links => Unlimited => Unlimited

Installed php-ldap versions:

ii  libldap-2.5-0:amd64                    2.5.20+dfsg-0ubuntu0.22.04.1                              amd64        OpenLDAP libraries
ii  libldap-common                         2.5.20+dfsg-0ubuntu0.22.04.1                              all          OpenLDAP common files for libraries

ii  php7.3-ldap                            7.3.33-32+ubuntu22.04.1+deb.sury.org+1                    amd64        LDAP module for PHP
ii  php7.4-ldap                            1:7.4.33-28+ubuntu22.04.1+deb.sury.org+1                  amd64        LDAP module for PHP
ii  php8.0-ldap                            1:8.0.30-22+ubuntu22.04.1+deb.sury.org+1                  amd64        LDAP module for PHP
ii  php8.1-ldap                            8.1.34-6+ubuntu22.04.1+deb.sury.org+1                     amd64        LDAP module for PHP
ii  php8.2-ldap                            8.2.31-3+ubuntu22.04.1+deb.sury.org+1                     amd64        LDAP module for PHP
ii  php8.3-ldap                            8.3.31-3+ubuntu22.04.1+deb.sury.org+1                     amd64        LDAP module for PHP
ii  php8.4-ldap                            8.4.21-3+ubuntu22.04.1+deb.sury.org+1                     amd64        LDAP module for PHP
ii  php8.5-ldap                            8.5.6-3+ubuntu22.04.1+deb.sury.org+1                      amd64        LDAP module for PHP

[devnexen]

what surprises me, in that case, is 8.5 works. Any idea @Girgias ?

[Commifreak]

Do you see any relations to #18529 ?

[devnexen]

Since you have this

ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);

can you redirect of your script the output to stderr with 8.4 ? e.g. 2> debug.log

[Commifreak]

Sure, this is the (sanitized) output from the script above.

PHP Warning:  ldap_connect(): Could not create new security context in /root/ldap_test.php on line 22
PHP Stack trace:
PHP   1. {main}() /root/ldap_test.php:0
PHP   2. ldap_connect($uri = 'ldaps://ldapserver', $port = 636) /root/ldap_test.php:22
PHP Fatal error:  Uncaught TypeError: ldap_set_option(): Argument #1 ($ldap) must be of type ?LDAP\Connection, false given in /root/ldap_test.php:28
Stack trace:
#0 /root/ldap_test.php(28): ldap_set_option()
#1 {main}
  thrown in /root/ldap_test.php on line 28