ldap authentication: unexpected behaviour

Hi cacti-user@,

I'm using cacti with LDAP authentication configured to authenticate with 
an OpenLDAP server.
My ldap user has no right except to bind and search for my own 
attributes in the ldap schema, so no ldap compare works with my own 
user.

In cacti I have set up the "specific DN search" option and provided a 
service account which has more privileges so it can be used to search, 
compare, etc.

The problem i'm facing is that if I check the "require group membership" 
option, cacti is trying to ldap_compare() using a ldap_bind() previously 
done with my credentials instead of the specific DN provided, which in 
my setup fails because my account can't see group attributes in the ldap 
schema.

I would have expected it to use the specific DN to ldap_compare().

Is this done on purpose ? If so, could you help me understand in which 
situation this is usefull ?
I think this can only works with a ldap server who allows your user to 
read group attributes like Microsoft Active Directory.

This patch in Authenticate() from ldap.php works for me:

[remy@cactiserver lib]# diff -u ldap.php.backup_original ldap.php
--- ldap.php.backup_original 2014-08-06 15:27:52.000000000 -0400
+++ ldap.php 2014-08-07 20:21:20.000000000 -0400
@@ -249,6 +249,19 @@
$ldap_response = @ldap_bind($ldap_conn, $this->dn, $this->password);
if ($ldap_response) {
if ($this->group_require == 1) {
+ /* if using specific DN for searching, most likely you want it for 
ldap_compare too */
+ if ($this->mode == "2") {
+ $ldap_response = @ldap_bind($ldap_conn, $this->specific_dn, 
$this->specific_password);
+ if (!$ldap_response) {
+ /* we did this in Search() before, should not happen here */
+ $ldap_error = ldap_errno($ldap_conn);
+ $output["error_num"] = "11";
+ $output["error_text"] = "General bind error, LDAP result: " . 
ldap_error($ldap_conn);
+ cacti_log("LDAP: " . $output["error_text"], false, "BIND");
+ @ldap_close($ldap_conn);
+ return $output;
+ }
+ }
/* Process group membership if required */
if ($this->group_member_type == 1) {
$ldap_group_response = @ldap_compare($ldap_conn, $this->group_dn, 
$this->group_attrib, $this->dn);

Thank you

------------------------------------------------------------------------------
Slashdot TV.  
Video for Nerds.  Stuff that matters.
http://tv.slashdot.org/