Stdlib: ldap_connect_wallet() missing when ldap advertised — VM impl present, wallet gate never enables (re-#20638, ext/ldap/ldap.c)

[PurHur]

Category

stdlib · php-src-strict · ext/ldap Oracle wallet · pillar 4

Problem

Closed as implemented in #20638, but with ldap advertised (PHP_COMPILER_ENABLE_LDAP=1, extension_loaded('ldap') === true), ldap_connect_wallet() is still absent from the function table. Implementation exists at ext/ldap/ldap_connect_wallet.php and Module.php adds it only when LdapExtensionPolicy::advertisesWalletConnect() — which requires VmLdapNative::walletAvailable() and is false in the pinned dev container.

Repro	Zend 8.3+ (ldap + Oracle wallet build)	VM (2026-08-06)
extension_loaded('ldap')	true	true
function_exists('ldap_exop_sync')	true	true
function_exists('ldap_connect_wallet')	true	false

php-src reference

• php/php-src ext/ldap/ldap.stub.php — ldap_connect_wallet(?string $uri, string $wallet, string $password, int $auth_mode = GSLC_SSL_NO_AUTH)
• php/php-src ext/ldap/ldap.c — PHP_FUNCTION(ldap_connect_wallet) behind HAVE_ORALDAP

PHP implementation target

• ext/ldap/LdapExtensionPolicy.php — advertisesWalletConnect() + GSLC_SSL_* constants when wallet libs reachable (match php-src HAVE_ORALDAP gate, not phantom on default profile)
• ext/ldap/ldap_connect_wallet.php — VM execute path already present; add JIT lowering (currently throws #20638)
• ext/ldap/Module.php — register wallet fn + constants with the policy gate

Repro

./script/docker-exec.sh -- bash -lc \
  'PHP_COMPILER_ENABLE_LDAP=1 PHP_COMPILER_PROFILE=8.4 php bin/vm.php test/repro/maintainer_gap_ldap_connect_wallet_missing.php'
# expect: wallet_fn=1 when Oracle wallet LDAP is available
# actual (no wallet libs): wallet_fn=0 while ext/ldap loaded

Done when

• When ldap is advertised and wallet connect is available, ldap_connect_wallet() + GSLC_SSL_* constants match Zend
• When wallet libs absent, function stays absent (E_USER_WARNING stub path on direct call is ok for dev boxes without Oracle)
• JIT/AOT lowering for wallet connect (or documented VM-only with compliance skip reason)
• php-src-strict; no php-compiler-strict shortcut

Gate snapshot when filing (2026-08-06)

• inventory OK 7119/7119; user_release_ready: yes

[PurHur]

claim: PHP Compiler STD Lib Advanced — batch (issues #27675, #27676, #28087) — queued after #29820

[PurHur]

Handoff / blocker (after batch #29820/#27675/#27676 merged)

Pinned php-compiler:22.04-dev has OpenLDAP FFI for ldap_* under PHP_COMPILER_ENABLE_LDAP=1, but VmLdapNative::walletAvailable() is false (no Oracle HAVE_ORALDAP / wallet libs). Policy correctly withholds ldap_connect_wallet + GSLC_SSL_* — matching the issue Done-when: "When wallet libs absent, function stays absent".

Not a parity bug on this host: inventing the symbol without wallet support would be a phantom vs php-src HAVE_ORALDAP.

Remaining work (needs Oracle-wallet-capable env or explicit fake):

1. JIT lowering in ldap_connect_wallet::call (currently LogicException #20638) once walletAvailable() can be true
2. Compliance @requires / skip policy documenting wallet-optional CI
3. Optional: unit test that advertisesWalletConnect() tracks walletAvailable() without enabling phantoms

Unclaiming for workers with Oracle LDAP wallet libs, or for a follow-up scoped only to JIT once a wallet stub probe exists.

[PurHur]

unclaim: PHP Compiler STD Lib Advanced — blocked without Oracle wallet LDAP libs in pinned container (see handoff).

[PurHur]

skip: Worker Lane C — blocked per prior handoff (no Oracle wallet libs in pinned container); not claiming.

[PurHur]

JIT lowering for `ldap_connect_wallet()` landed in #31999 (#31984). Advertise gate unchanged: function stays absent unless `VmLdapNative::walletAvailable()` (Oracle `ldap_init_SSL`). Pinned container still has wallet_fn=0; this issue stays open for the HAVE_ORALDAP advertise path.

[PurHur]

claim: stdlib+AOT lane 2026-08-22T15:20Z — investigating wallet gate + JIT/AOT lowering

[PurHur]

Unclaim — wallet=0 without Oracle ldap_init_SSL ABI is correct per done-when; JIT/AOT lowering landed in #31984. No code change needed in dev container.

[PurHur]

Verified on master @ 974f69d (2026-08-22, php-compiler:22.04-dev):

Done-when checklist

• Policy gate: LdapExtensionPolicy::advertisesWalletConnect() = extension advertised and VmLdapNative::walletAvailable() (php-src HAVE_ORALDAP shape). Without Oracle ldap_init_SSL ABI, wallet=0 is correct — not a missing registration bug.
• JIT/AOT lowering: landed in Stdlib: ldap_connect_wallet() JIT lowering missing — VM path only (ext/ldap/ldap.c, re-#28087) #31984 / Stdlib: ldap_connect_wallet() JIT lowering via LdapDnJitHelper (#31984) #31999 (JitLdapConnectWallet, LdapRuntime::ensureLinked, __compiler_ldap_connect_wallet bridge).
• Withhold path: LdapDnJitHelper::connectWallet emits E_USER_WARNING + returns false when ABI absent.
• Compliance: ext/ldap_connect_wallet_withhold.phpt (wallet_no / gslc_no with ENABLE_LDAP=1).
• Unit: ./script/phpunit.sh --filter 'LdapConnectWallet|LdapExtensionPolicy|ldap_connect_wallet' → 8/8 OK.

Repro:

./script/docker-exec.sh -- bash -lc 'PHP_COMPILER_ENABLE_LDAP=1 PHP_COMPILER_PROFILE=8.4 php bin/vm.php test/repro/issue_31984_ldap_connect_wallet_jit.php'
# ldap=1 wallet=0 ok

Wallet-capable hosts (Oracle libs present) cannot be exercised in the pinned dev image; behavior there follows VmLdapNative::oracleFfi() probe on libclntsh.so*.