Re: LDAP v3 bind

On Tue, 2003-06-24 at 20:13, Guido Trotter wrote:
> On Mon, Jun 23, 2003 at 04:59:22PM -0500, Manuel Amador (Rudd-O) wrote:
> 
> Hi,
> 
> > There might be a bug in the feature, but since the V3 code was shipped in a
> > patch, and I don't have V3 LDAP servers to test against, that might be
> > understandable (although not acceptable for a production release, right?).
> > 
> 
> Openldap 2.1 by default disallows v2 connections. But Openldap 2.0 supports
> bind in v3 mode, and can block v2 ones simply adding
> 
> disallow bind_v2
> 
> to the config file. So this can be tested with any recent Openldap server.
> 
> > Can someone help me track the thing and fix it?  that would be function
> > connection_profile_connect in the file profile.c.  
> > 
> 
> I've investigated into it. The problem was that ldap_set_option should be
> called *before* actually doing any bind to the server, otherwise the
> protocol version doesn't affect the previous bind, which, if the server
> don't support LDAPv2, fails and returns "Protocol Error".
> 
> So I've patched the code simply moving the option selection before the
> actual bind, tried with a server that disallows LDAPv2, and it worked. 
> I attach the patch to this mail, hoping you'll include it.

This certainly looks like what Samba does.

This is also the point to do TLS, if you want to do that. (You would not
want to put the password in the clear, then to TLS would you :-)

Andrew Bartlett

-- 
Andrew Bartlett                                 [email protected]
Manager, Authentication Subsystems, Samba Team  [email protected]
Student Network Administrator, Hawker College   [email protected]
http://samba.org     http://build.samba.org     http://hawkerc.net

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQA++EOww6AkmCjZ77cRAn+zAKCbrJLa/FpKULv5fMCLJ1wgvP445wCdE/hB
xOYdmpJlpBGQ67x1yaTSxFs=
=KwN5
-----END PGP SIGNATURE-----