pfSense

diff --git a/src/etc/inc/auth.inc b/src/etc/inc/auth.inc
index 7c87c5c431..057230dc96 100644
--- a/src/etc/inc/auth.inc
+++ b/src/etc/inc/auth.inc
@@ -1086,13 +1086,14 @@ function ldap_test_connection($authcfg) {
     }

     /* connect and see if server is up */
-    $error = false;
     if (!($ldap = ldap_connect($ldapserver))) {
-        $error = true;
-    }
-
-    if ($error == true) {
-        logger(LOG_ERR, localize_text("Could not connect to server %s.", $authcfg['name']), LOG_PREFIX_AUTHPROVIDER_LDAP);
+        logger(LOG_ERR,
+            localize_text(
+                '%scould not connect to server "%s"%s',
+                (g_get('debug') ? 'ldap_test_connection() ' : ''),
+                $authcfg['name'],
+            ), LOG_PREFIX_AUTHPROVIDER_LDAP
+        );
         return false;
     }

@@ -1121,7 +1122,13 @@ function ldap_setup_caenv($ldap, $authcfg) {
         $param = array('caref' => $authcfg['ldap_caref']);
         $cachain = ca_chain($param);
         if (!$caref) {
-            logger(LOG_ERR, localize_text("Could not lookup CA by reference for host %s.", $authcfg['ldap_caref']), LOG_PREFIX_AUTHPROVIDER_LDAP);
+            logger(LOG_ERR,
+                localize_text(
+                    '%scould not lookup CA by reference for host "%s"%s',
+                    (g_get('debug') ? 'ldap_setup_caenv() ' : ''),
+                    $authcfg['ldap_caref'],
+                ), LOG_PREFIX_AUTHPROVIDER_LDAP
+            );
             /* XXX: Prevent for credential leaking since we cannot setup the CA env. Better way? */
             ldap_set_option($ldap, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_HARD);
             return;
@@ -1173,13 +1180,14 @@ function ldap_test_bind($authcfg) {
     }

     /* connect and see if server is up */
-    $error = false;
     if (!($ldap = ldap_connect($ldapserver))) {
-        $error = true;
-    }
-
-    if ($error == true) {
-        logger(LOG_ERR, localize_text("Could not connect to server %s.", $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+        logger(LOG_ERR,
+            localize_text(
+                '%scould not connect to server "%s"%s',
+                (g_get('debug') ? 'ldap_test_bind() ' : ''),
+                $ldapname
+            ), LOG_PREFIX_AUTHPROVIDER_LDAP
+        );
         return false;
     }

@@ -1194,7 +1202,14 @@ function ldap_test_bind($authcfg) {

     if (strstr($authcfg['ldap_urltype'], "STARTTLS")) {
         if (!(@ldap_start_tls($ldap))) {
-            logger(LOG_ERR, localize_text("%s could not STARTTLS to server %s.", 'ldap_test_bind()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+            logger(LOG_ERR,
+                localize_text(
+                    '%scould not STARTTLS to server "%s"%s',
+                    (g_get('debug') ? 'ldap_test_bind() ' : ''),
+                    $ldapname,
+                    (': ' . ldap_error($ldap))
+                ), LOG_PREFIX_AUTHPROVIDER_LDAP
+            );
             @ldap_close($ldap);
             return false;
         }
@@ -1204,10 +1219,26 @@ function ldap_test_bind($authcfg) {
     $ldapbindpw = isset($authcfg['ldap_utf8']) ? mb_convert_encoding($ldapbindpw, 'UTF-8') : $ldapbindpw;
     if ($ldapanon == true) {
         if (!($res = @ldap_bind($ldap))) {
+            logger(LOG_ERR,
+                localize_text(
+                    '%scould not bind anonymously to server "%s"%s',
+                    (g_get('debug') ? 'ldap_test_bind() ' : ''),
+                    $ldapname,
+                    (': ' . ldap_error($ldap))
+                ), LOG_PREFIX_AUTHPROVIDER_LDAP
+            );
             @ldap_close($ldap);
             return false;
         }
     } else if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
+        logger(LOG_ERR,
+            localize_text(
+                '%scould not bind to server "%s"%s',
+                (g_get('debug') ? 'ldap_test_bind() ' : ''),
+                $ldapname,
+                (': ' . ldap_error($ldap))
+            ), LOG_PREFIX_AUTHPROVIDER_LDAP
+        );
         @ldap_close($ldap);
         return false;
     }
@@ -1292,12 +1323,26 @@ function ldap_get_user_ous($show_complete_ou, $authcfg) {
     $ldapbindpw = isset($authcfg['ldap_utf8']) ? mb_convert_encoding($ldapbindpw, 'UTF-8') : $ldapbindpw;
     if ($ldapanon == true) {
         if (!($res = @ldap_bind($ldap))) {
-            logger(LOG_ERR, localize_text("%s could not bind anonymously to server %s.", 'ldap_get_user_ous()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+            logger(LOG_ERR,
+                localize_text(
+                    '%scould not bind anonymously to server "%s"%s',
+                    (g_get('debug') ? 'ldap_get_user_ous() ' : ''),
+                    $ldapname,
+                    (': ' . ldap_error($ldap))
+                ), LOG_PREFIX_AUTHPROVIDER_LDAP
+            );
             @ldap_close($ldap);
             return $ous;
         }
     } else if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
-        logger(LOG_ERR, localize_text("%s could not bind to server %s.", 'ldap_get_user_ous()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+        logger(LOG_ERR,
+            localize_text(
+                '%scould not bind anonymously to server "%s"%s',
+                (g_get('debug') ? 'ldap_get_user_ous() ' : ''),
+                $ldapname,
+                (': ' . ldap_error($ldap))
+            ), LOG_PREFIX_AUTHPROVIDER_LDAP
+        );
         @ldap_close($ldap);
         return $ous;
     }
@@ -1403,13 +1448,14 @@ function ldap_get_groups($username, $authcfg) {
     $memberof = array();

     /* connect and see if server is up */
-    $error = false;
     if (!($ldap = ldap_connect($ldapserver))) {
-        $error = true;
-    }
-
-    if ($error == true) {
-        logger(LOG_ERR, localize_text("%s Could not connect to server %s.", 'ldap_get_groups()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+        logger(LOG_ERR,
+            localize_text(
+                '%scould not connect to server "%s"%s',
+                (g_get('debug') ? 'ldap_get_groups() ' : ''),
+                $ldapname,
+            ), LOG_PREFIX_AUTHPROVIDER_LDAP
+        );
         return $memberof;
     }

@@ -1424,7 +1470,14 @@ function ldap_get_groups($username, $authcfg) {

     if (strstr($authcfg['ldap_urltype'], "STARTTLS")) {
         if (!(@ldap_start_tls($ldap))) {
-            logger(LOG_ERR, localize_text("%s could not STARTTLS to server %s.", 'ldap_get_groups()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+            logger(LOG_ERR,
+                localize_text(
+                    '%scould not STARTTLS to server "%s"%s',
+                    (g_get('debug') ? 'ldap_get_groups() ' : ''),
+                    $ldapname,
+                    (': ' . ldap_error($ldap))
+                ), LOG_PREFIX_AUTHPROVIDER_LDAP
+            );
             @ldap_close($ldap);
             return array();
         }
@@ -1435,12 +1488,26 @@ function ldap_get_groups($username, $authcfg) {
     $ldapbindpw = isset($authcfg['ldap_utf8']) ? mb_convert_encoding($ldapbindpw, 'UTF-8') : $ldapbindpw;
     if ($ldapanon == true) {
         if (!($res = @ldap_bind($ldap))) {
-            logger(LOG_ERR, localize_text("%s could not bind anonymously to server %s.", 'ldap_get_groups()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+            logger(LOG_ERR,
+                localize_text(
+                    '%scould not bind anonymously to server "%s"%s',
+                    (g_get('debug') ? 'ldap_get_groups() ' : ''),
+                    $ldapname,
+                    (': ' . ldap_error($ldap))
+                ), LOG_PREFIX_AUTHPROVIDER_LDAP
+            );
             @ldap_close($ldap);
             return array();
         }
     } else if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
-        logger(LOG_ERR, localize_text("%s could not bind to server %s.", 'ldap_get_groups()', $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+        logger(LOG_ERR,
+            localize_text(
+                '%scould not bind to server "%s"%s',
+                (g_get('debug') ? 'ldap_get_groups() ' : ''),
+                $ldapname,
+                (': ' . ldap_error($ldap))
+            ), LOG_PREFIX_AUTHPROVIDER_LDAP
+        );
         @ldap_close($ldap);
         return $memberof;
     }
@@ -1528,7 +1595,13 @@ function ldap_backed($username, $passwd, $authcfg, &$attributes = array()) {
     }

     if (!function_exists("ldap_connect")) {
-        logger(LOG_CRIT, localize_text("unable to find %s function.", 'ldap_connect()'), LOG_PREFIX_AUTHPROVIDER_LDAP);
+        logger(LOG_CRIT,
+            localize_text(
+                "%sunable to find %s function.",
+                (g_get('debug') ? 'ldap_backed() ' : ''),
+                'ldap_connect()'
+            ), LOG_PREFIX_AUTHPROVIDER_LDAP
+        );
         $attributes['error_message'] = gettext("Internal error during authentication.");
         return null;
     }
@@ -1609,17 +1682,14 @@ function ldap_backed($username, $passwd, $authcfg, &$attributes = array()) {
     }

     /* Make sure we can connect to LDAP */
-    $error = false;
     if (!($ldap = ldap_connect($ldapserver))) {
-        $error = true;
-    }
-
-    if (g_get('debug')) {
-        logger(LOG_DEBUG, localize_text("LDAP connection error flag: %s", var_export($error, true)), LOG_PREFIX_AUTHPROVIDER_LDAP);
-    }
-
-    if ($error == true) {
-        $errormsg = sprintf(gettext("ERROR! Could not connect to server %s."), $ldapname);
+        logger(LOG_DEBUG,
+            localize_text(
+                '%scould not connect to server "%s"%s',
+                (g_get('debug') ? 'ldap_backed() ' : ''),
+                $ldapname
+            ), LOG_PREFIX_AUTHPROVIDER_LDAP
+        );
         $attributes['error_message'] = gettext("Error : could not connect to authentication server.");
         return null;
     }
@@ -1635,7 +1705,14 @@ function ldap_backed($username, $passwd, $authcfg, &$attributes = array()) {

     if (strstr($authcfg['ldap_urltype'], "STARTTLS")) {
         if (!(@ldap_start_tls($ldap))) {
-            logger(LOG_ERR, localize_text("could not connect to LDAP server %s using STARTTLS.", $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
+            logger(LOG_ERR,
+                localize_text(
+                    '%scould not STARTTLS to server "%s"%s',
+                    (g_get('debug') ? 'ldap_backed() ' : ''),
+                    $ldapname,
+                    (': ' . ldap_error($ldap))
+                ), LOG_PREFIX_AUTHPROVIDER_LDAP
+            );
             $attributes['error_message'] = gettext("Error : could not connect to authentication server.");
             @ldap_close($ldap);
             return null;
@@ -1643,20 +1720,32 @@ function ldap_backed($username, $passwd, $authcfg, &$attributes = array()) {
     }

     /* ok, its up.  now, lets bind as the bind user so we can search it */
-    $error = false;
     $ldapbindun = isset($authcfg['ldap_utf8']) ? mb_convert_encoding($ldapbindun, 'UTF-8') : $ldapbindun;
     $ldapbindpw = isset($authcfg['ldap_utf8']) ? mb_convert_encoding($ldapbindpw, 'UTF-8') : $ldapbindpw;
     if ($ldapanon == true) {
         if (!($res = @ldap_bind($ldap))) {
-            $error = true;
+            logger(LOG_ERR,
+                localize_text(
+                    '%scould not bind anonymously to server "%s"%s',
+                    (g_get('debug') ? 'ldap_backed() ' : ''),
+                    $ldapname,
+                    (': ' . ldap_error($ldap))
+                ), LOG_PREFIX_AUTHPROVIDER_LDAP
+            );
+            @ldap_close($ldap);
+            $attributes['error_message'] = gettext("Error : could not connect to authentication server.");
+            return null;
         }
     } else if (!($res = @ldap_bind($ldap, $ldapbindun, $ldapbindpw))) {
-        $error = true;
-    }
-
-    if ($error == true) {
+        logger(LOG_ERR,
+            localize_text(
+                '%scould not bind to server "%s"%s',
+                (g_get('debug') ? 'ldap_backed() ' : ''),
+                $ldapname,
+                (': ' . ldap_error($ldap))
+            ), LOG_PREFIX_AUTHPROVIDER_LDAP
+        );
         @ldap_close($ldap);
-        logger(LOG_ERR, localize_text("Could not bind to LDAP server %s. Please check the bind credentials.", $ldapname), LOG_PREFIX_AUTHPROVIDER_LDAP);
         $attributes['error_message'] = gettext("Error : could not connect to authentication server.");
         return null;
     }
@@ -1675,7 +1764,7 @@ function ldap_backed($username, $passwd, $authcfg, &$attributes = array()) {
     /*  that way we don't have to search twice.                      */
     /*****************************************************************/
     if (g_get('debug')) {
-        logger(LOG_ERR, localize_text("Now Searching for %s in directory.", $username), LOG_PREFIX_AUTHPROVIDER_LDAP);
+        logger(LOG_DEBUG, localize_text("Now Searching for %s in directory.", $username), LOG_PREFIX_AUTHPROVIDER_LDAP);
     }
     /* Iterate through the user containers for search */
     foreach ($ldac_splits as $i => $ldac_split) {