title: LDAP Auth with mysql php sessions
body: <p>i have a wierd issue sessions are not saving to global variable but they are saving to my database correctly. i have an ldap auth script that sets the sessions and i get logged in but when i refresh or goto a different page it loses the variables and its driving me insane here are the scripts minus the ldap_auth.php</p>
  
  <pre><code>&lt;?
  function sess_open($save_path, $session_name){
          $_SERVER['SessionDB']-&gt;connect();
          if ($_SERVER['SessionDB']-&gt;sess) return true;
          else return false;
  }
  
  function sess_close(){
          $_SERVER['SessionDB']-&gt;disconnect();
  }
  
  function sess_read($key){
          global $SESS_LIFE;
          $_SERVER['SessionDB']-&gt;Query('UPDATE Sessions SET Expiry="' . (time() + $SESS_LIFE) . '" WHERE SessionID="' . $key . '" AND Expiry &gt;= "' . time() . '"');
          $Value = $_SERVER['SessionDB']-&gt;oQuery('SELECT Value FROM Sessions WHERE SessionID = "' . $key . '" AND Expiry &gt;= ' . time());
          if ($Value) return $Value;
          else return '';
  }
  
  function sess_write($key, $val){
          global $SESS_LIFE;
          $Expiry = time() + $SESS_LIFE;
          $Value = addslashes($val);
          if (!$qid = $_SERVER['SessionDB']-&gt;Query('INSERT INTO Sessions VALUES ("' . $key . '", ' . $Expiry . ', "' . $Value . '")'))
                  $qid = $_SERVER['SessionDB']-&gt;Query('UPDATE Sessions SET Expiry = ' . $Expiry . ', Value = "' . $Value . '" WHERE SessionID = "' . $key . '" AND Expiry &gt; ' . time());
  
          return $qid;
  }
  
  function sess_destroy($key){
          return $_SERVER['SessionDB']-&gt;Query('DELETE FROM Sessions WHERE SessionID = "' . $key . '"');
  }
  
  function sess_gc($maxlifetime){
          return $_SERVER['SessionDB']-&gt;Query('DELETE FROM Sessions WHERE Expiry &lt; ' . time());
  }
  
  $SESS_LIFE = get_cfg_var("session.gc_maxlifetime");
  ini_set("session.save_handler", "user");
  session_set_save_handler("sess_open", "sess_close", "sess_read", "sess_write", "sess_destroy", "sess_gc");
  
  // We want a seperate one in $_SERVER['SessionDB']
  $_SERVER['SessionDB'] = new mysql_db();
  
  // Set this information appropriately based on what's in
  // our configuration file
  $_SERVER['SessionDB']-&gt;Hostname = $config-&gt;dbHost;
  $_SERVER['SessionDB']-&gt;Username = $config-&gt;dbUser;
  $_SERVER['SessionDB']-&gt;Password = $config-&gt;dbPass;
  $_SERVER['SessionDB']-&gt;Database = $config-&gt;dbName;
  
  session_start();
  foreach ($_SESSION as $key=&gt;$value)
          if (is_string($value))
                  $_SESSION[$key] = trim($value);
  
  function murder_session(){
  //      session_destroy();
  //      unset($_SESSION);
  }
  ?&gt;
  </code></pre>
  
  <p>Here is the login.php</p>
  
  <pre><code>&lt;?
  
  // check to see if user is logging out
  if(isset($_GET['out'])) {
     // destroy session
      session_unset();
      unset($_SESSION['user'],$_SESSION['access']);
      session_destroy();
  }
  
  // check to see if login form has been submitted
  if(isset($_POST['login_Username'])){
      // run information through authenticator
      if(authenticate($_POST['login_Username'],$_POST['login_Password']))
      {
          // authentication passed
  
      } else {
          // authentication failed
          $error = 1;
      }
  }
  
  // output error to user
  if (isset($error)) nice_death("Login failed: Incorrect user name, password, or rights");
  
  // output logout success
  if (isset($_GET['out'])) nice_exit("Logout successful");
  ?&gt;
  </code></pre>
  
  <p>Here is the includes file which includes the order in which they are loaded</p>
  
  <pre><code>// We prefer to use MySQL for our sessions instead of files in /tmp
  // for (somewhat obvious) security reasons. Our functions to handle this
  // are in here.
  require_once($inc_dir . 'session.inc');
  
  // Let's see if the user is trying to log in. We do this here because
  // the login form is displayed on all pages until the user logs in.
  require_once($inc_dir . 'ldap_auth.php');
  require_once($inc_dir . 'login.inc');
  </code></pre>
  
  <p>Here is the ldap script</p>
  
  <pre><code>&lt;?
  function authenticate($user, $password) {
      // Active Directory server
      $ldap_host = "x.x.x.x";
  
      // Active Directory DN
      $ldap_dn = "Here is the long LDAP String";
  
      // Domain, for purposes of constructing $user
      $ldap_usr_dom = "@here.local";
  
      // connect to active directory
      $ldap = ldap_connect($ldap_host)
          or die("Couldn't connect to LDAP Server");
  
          $x = explode('.', $user);
          $user = $x[0] . ' ' . $x[1];
  
      $dn = "cn=".$user.",";
  
      // verify user and password
      if($bind = @ldap_bind($ldap, $dn . $ldap_dn, $password)) {
          // valid
          // check presence in groups
          $filter = "(cn=" . $user . ")";
          $attr = array("memberof");
          $result = ldap_search($ldap, $ldap_dn, $filter, $attr) or exit("Unable to search LDAP server");
          $entries = ldap_get_entries($ldap, $result);
          ldap_unbind($ldap);
  
  
          $_SESSION['user'] = $user;
         // $_SESSION['access'] = $access;
          $_SESSION['LoggedIn'] = true;
  
          return true;
      } else {
          // invalid name or password
          return false;
      }
  }
  ?&gt;
  </code></pre>