timkite

Ah ha! Got it working via a very similar hack to the one I had to use for wpDirAuth to make it work.

(if this is a duplicate post, I apologize, but it looks like the editor ate my initial reply attempt)

If you look at the manual for ldap_connect(), you’ll see that the port option is ignored if you supply an ldap:// or ldaps:// URI, meaning that without string manipulation, you can’t use a non-default port. However, if you send an empty variable in position 2, ldap_connect() complains that it needs to be a long, even though it’ll ignore it.

To hack it into working, I changed this line (1256):
$ldap = ldap_connect( $auth_settings['ldap_host'], $auth_settings['ldap_port'] );

…to this:
$ldap = ldap_connect( $auth_settings['ldap_host'] . ":" . $auth_settings['ldap_port'] );

And it works! For my situation specifically, anyway. What you need to do is actually look at the ldap_host parameter and decide if it’s a URI. If it is, concatenate ldap_port onto the end of it with a colon and trigger ldap_connect() with a single parameter. If it’s not a URI, do it the way you’re doing it now. For example, replace line 1256 with (there is probably a better way to do this!):

if ( substr( $auth_settings['ldap_host'], 0, 7 ) === "ldap://" || substr( $auth_settings['ldap_host'], 0, 8 ) === "ldaps://" ) {
	$ldap = ldap_connect( $auth_settings['ldap_host'] . ":" . $auth_settings['ldap_port'] );
} else {
	$ldap = ldap_connect( $auth_settings['ldap_host'], $auth_settings['ldap_port'] );
}

It’s actually not AD, though I could try AD if needed. I just already have a service account for LDAP.

Our current LDAP is based on ApacheDS. It’s slated to be upgraded to a fully standard OpenLDAP server at some point in the future, but I don’t have an ETA on that.

With the full URL including ldaps:// in the LDAP Host field, the custom port in the LDAP Port field, and Use TLS disabled, attempted LDAP user logins will just sit and sit until timing out, at which point the login prompt does its little “no” shake and I get an “invalid username”, with no errors output by PHP into the log (it does display an error if I try to put the port in the LDAP Host URL). I’m using otherwise the same configuration parameters for the LDAP service that wpDirAuth uses and also that HTTPD uses for native directory security on non-WordPress sites.