title: LDAP Authentication in PHP - Authenticated without giving a password
body: <p>I'm getting a strange behavior on my LDAP Authentication, I need this to authenticate users with their AD credentials, this is what I have:</p>
  
  <pre><code>session_start(); 
  $adServer = "MY IP"; 
  $ldapconn = ldap_connect($adServer) or $this-&gt;msg = "Could not connect to LDAP server.";
  
  $ldaprdn = "DOMAIN\\" . $_POST["username"];
  $ldapbind = ldap_bind($ldapconn, $ldaprdn, $_POST["password"]);
  
  if ($ldapbind) {
  //$msg = "Successfully Authenticated";
      $_SESSION['loggedin'] = 1;
      $_SESSION['username'] = $username;
      header("Location: ../main.php");
  } else {
      header("Location: ../index.php?login_failed=1");
  }
  </code></pre>
  
  <p>This is the different behaviors I get:</p>
  
  <ul>
  <li>No username / No Password = authenticated (BAD)</li>
  <li>Username / No Password = authenticated (BAD)</li>
  <li>Incorrect Username/Password (both fields were given) = not authenticated</li>
  <li>Correct Username/Password (both fields were given) = authenticated</li>
  </ul>
  
  <p>I find this hard to muster, all users are being validated if the password field is not being used. But if I do use the password field it only authenticates users with the correct credentials..</p>
  
  <p>Am I doing something wrong here or should I start nagging the IT people?</p>