Re: LDAP v3 bind

Guido Trotter <[email protected]>
Newsgroups gmane.network.directoryadmin
Message-ID <[email protected]>
On Mon, Jun 23, 2003 at 04:59:22PM -0500, Manuel Amador (Rudd-O) wrote:

Hi,

> There might be a bug in the feature, but since the V3 code was shipped in a
> patch, and I don't have V3 LDAP servers to test against, that might be
> understandable (although not acceptable for a production release, right?).
> 

Openldap 2.1 by default disallows v2 connections. But Openldap 2.0 supports
bind in v3 mode, and can block v2 ones simply adding

disallow bind_v2

to the config file. So this can be tested with any recent Openldap server.

> Can someone help me track the thing and fix it?  that would be function
> connection_profile_connect in the file profile.c.  
> 

I've investigated into it. The problem was that ldap_set_option should be
called *before* actually doing any bind to the server, otherwise the
protocol version doesn't affect the previous bind, which, if the server
don't support LDAPv2, fails and returns "Protocol Error".

So I've patched the code simply moving the option selection before the
actual bind, tried with a server that disallows LDAPv2, and it worked. 
I attach the patch to this mail, hoping you'll include it.

Bye,

Guido
03_bindaftersetoption.dpatch (text/plain, 1.8 KB)
#!/bin/sh -e
## 03_bindaftersetoption.dpatch by Guido Trotter <[email protected]>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Bind to the LDAP server only after chosing LDAPv3 protocol.

if [ $# -ne 1 ]; then
    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
    exit 1
fi

[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
patch_opts="${patch_opts:--f --no-backup-if-mismatch}"

case "$1" in
       -patch) patch $patch_opts -p1 < $0;;
       -unpatch) patch $patch_opts -p1 -R < $0;;
        *)
                echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
                exit 1;;
esac

exit 0

@DPATCH@
diff -urNad /home/ultrotter/docs/projects/deb/directory-administrator-1.5.1/src/profile.c directory-administrator-1.5.1/src/profile.c
--- /home/ultrotter/docs/projects/deb/directory-administrator-1.5.1/src/profile.c	2003-06-12 14:52:09.000000000 +0200
+++ directory-administrator-1.5.1/src/profile.c	2003-06-24 12:00:56.000000000 +0200
@@ -308,6 +308,10 @@
 #   endif
   }
 
+ version = LDAP_VERSION3;
+    if (ldap_set_option(connectionhandler, LDAP_OPT_PROTOCOL_VERSION,
+        &version)!= LDAP_OPT_SUCCESS) g_print("Could not set protocol version 3, continuing anyway\n" );
+
   if (userid && strlen(userid) > 0 && strchr(userid,'=') == NULL) {
    // nos pasaron un UNIX user ID - tratemos de buscarlo
      ldap_errors = ldap_simple_bind_s (connectionhandler, NULL, NULL);
@@ -347,9 +351,6 @@
   ldap_errors = ldap_simple_bind_s (connectionhandler,
 				    userid,
 				    connection_profile_get_password (conn));
-    version = LDAP_VERSION3;
-    if (ldap_set_option(connectionhandler, LDAP_OPT_PROTOCOL_VERSION,
-        &version)!= LDAP_OPT_SUCCESS) g_print("Could not set protocol version 3, continuing anyway\n" );
 
   if (ldap_errors)
     {
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.