[PEAR-BUG] Doc #18420 [Csd->Opn]: connect() option bindpw is not necessarily a password

Edit report at http://pear.php.net/bugs/bug.php?id=18420&edit=1

 ID:               18420
 Updated by:       [email protected]
 Reported By:      chealer at gmail dot com
 Summary:          connect() option bindpw is not necessarily a password
-Status:           Closed
+Status:           Open
 Type:             Documentation Problem
 Package:          Net_LDAP2
 Package Version:  2.0.11
 PHP Version:      5.3.6
 Assigned To:      beni
 Roadmap Versions: 
 New Comment:

-Status: Closed
+Status: Open
Hi,
thanks for the change, but if I'm seeing the change right, I don't
consider it fixes this issue. This is the description I'm currently
seeing on
http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
:
Password for the binddn. If the credentials are wrong, the bind will
fail server-side and an anonymous bind will be established instead.

This still describes bindpw as a password for the binddn. But this is
not necessarily the case.

If the string is non-empty, bindpw is indeed considered as the password
for the binddn.
But, an empty strings instructs to attempt an unauthenticated bind,
unless binddn was also empty, in which case an anonymous bind is
attempted.


Previous Comments:
------------------------------------------------------------------------

[2011-07-18 14:59:17] beni

-Status: Verified
+Status: Closed
This bug has been fixed in SVN.

If this was a documentation problem, the fix will appear on pear.php.net
by the end of next Sunday (CET).

If this was a problem with the pear.php.net website, the change should
be live shortly.

Otherwise, the fix will appear in the package's next release.

Thank you for the report and for helping us make PEAR better.

------------------------------------------------------------------------

[2011-04-04 06:33:13] beni

-Status:      Open
+Status:      Verified
-Assigned To:
+Assigned To: beni
Hello, you are right. This definitely needs enhanced documentation.

------------------------------------------------------------------------

[2011-04-02 23:35:41] chealer

Description:
------------
The description of the bindpw option for connect() is inexact. It
reads:

Password for the binddn

In fact bindpw can also be the empty string if one wants to request
unauthenticated (or anonymous) authentication.

This is more than an undocumented feature. By taking an empty bindpw and
sending it raw to an LDAP server, Net_LDAP2 is requesting
unauthenticated authentification, which is not what one would expect
from the current documentation. This can cause critical security issues.
See http://tools.ietf.org/html/rfc4513#section-6.3.1 on this issue.

------------------------------------------------------------------------


-- 
Edit this bug report at http://pear.php.net/bugs/bug.php?id=18420&edit=1