Re: LDAP v3 bind
Guido Trotter <[email protected]>
| Newsgroups | gmane.network.directoryadmin |
|---|---|
| Message-ID | <[email protected]> |
On Mon, Jun 23, 2003 at 04:59:22PM -0500, Manuel Amador (Rudd-O) wrote: Hi, > There might be a bug in the feature, but since the V3 code was shipped in a > patch, and I don't have V3 LDAP servers to test against, that might be > understandable (although not acceptable for a production release, right?). > Openldap 2.1 by default disallows v2 connections. But Openldap 2.0 supports bind in v3 mode, and can block v2 ones simply adding disallow bind_v2 to the config file. So this can be tested with any recent Openldap server. > Can someone help me track the thing and fix it? that would be function > connection_profile_connect in the file profile.c. > I've investigated into it. The problem was that ldap_set_option should be called *before* actually doing any bind to the server, otherwise the protocol version doesn't affect the previous bind, which, if the server don't support LDAPv2, fails and returns "Protocol Error". So I've patched the code simply moving the option selection before the actual bind, tried with a server that disallows LDAPv2, and it worked. I attach the patch to this mail, hoping you'll include it. Bye, Guido
03_bindaftersetoption.dpatch
(text/plain, 1.8 KB)
#!/bin/sh -e ## 03_bindaftersetoption.dpatch by Guido Trotter <[email protected]> ## ## All lines beginning with `## DP:' are a description of the patch. ## DP: Bind to the LDAP server only after chosing LDAPv3 protocol. if [ $# -ne 1 ]; then echo >&2 "`basename $0`: script expects -patch|-unpatch as argument" exit 1 fi [ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts patch_opts="${patch_opts:--f --no-backup-if-mismatch}" case "$1" in -patch) patch $patch_opts -p1 < $0;; -unpatch) patch $patch_opts -p1 -R < $0;; *) echo >&2 "`basename $0`: script expects -patch|-unpatch as argument" exit 1;; esac exit 0 @DPATCH@ diff -urNad /home/ultrotter/docs/projects/deb/directory-administrator-1.5.1/src/profile.c directory-administrator-1.5.1/src/profile.c --- /home/ultrotter/docs/projects/deb/directory-administrator-1.5.1/src/profile.c 2003-06-12 14:52:09.000000000 +0200 +++ directory-administrator-1.5.1/src/profile.c 2003-06-24 12:00:56.000000000 +0200 @@ -308,6 +308,10 @@ # endif } + version = LDAP_VERSION3; + if (ldap_set_option(connectionhandler, LDAP_OPT_PROTOCOL_VERSION, + &version)!= LDAP_OPT_SUCCESS) g_print("Could not set protocol version 3, continuing anyway\n" ); + if (userid && strlen(userid) > 0 && strchr(userid,'=') == NULL) { // nos pasaron un UNIX user ID - tratemos de buscarlo ldap_errors = ldap_simple_bind_s (connectionhandler, NULL, NULL); @@ -347,9 +351,6 @@ ldap_errors = ldap_simple_bind_s (connectionhandler, userid, connection_profile_get_password (conn)); - version = LDAP_VERSION3; - if (ldap_set_option(connectionhandler, LDAP_OPT_PROTOCOL_VERSION, - &version)!= LDAP_OPT_SUCCESS) g_print("Could not set protocol version 3, continuing anyway\n" ); if (ldap_errors) {