Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf68d85b

Browse files
committed
ldapurl is supported with simple bind
The docs currently imply that ldapurl is for search+bind only, butthat's not true. Rearrange the docs to cover this better.Add a test ldapurl with simple bind. This was previously allowed butunexercised, and now that it's documented it'd be good to pin thebehavior.Improve error when mixing LDAP bind modes. The option names had gonestale; replace them with a more general statement.Author: Jacob Champion <jacob.champion@enterprisedb.com>Discussion:https://www.postgresql.org/message-id/flat/CAOYmi+nyg9gE0LeP=xQ3AgyQGR=5ZZMkVVbWd0uR8XQmg_dd5Q@mail.gmail.com
1 parent935e675 commitf68d85b

File tree

3 files changed

+38
-5
lines changed

3 files changed

+38
-5
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1910,13 +1910,19 @@ omicron bryanh guest1
19101910
</para>
19111911
</listitem>
19121912
</varlistentry>
1913+
</variablelist>
1914+
</para>
1915+
1916+
<para>
1917+
The following option may be used as an alternative way to write some of the
1918+
above LDAP options in a more compact and standard form:
1919+
<variablelist>
19131920
<varlistentry>
19141921
<term><literal>ldapurl</literal></term>
19151922
<listitem>
19161923
<para>
19171924
An <ulink url="https://datatracker.ietf.org/doc/html/rfc4516">RFC 4516</ulink>
1918-
LDAP URL. This is an alternative way to write some of the
1919-
other LDAP options in a more compact and standard form. The format is
1925+
LDAP URL. The format is
19201926
<synopsis>
19211927
ldap[s]://<replaceable>host</replaceable>[:<replaceable>port</replaceable>]/<replaceable>basedn</replaceable>[?[<replaceable>attribute</replaceable>][?[<replaceable>scope</replaceable>][?[<replaceable>filter</replaceable>]]]]
19221928
</synopsis>
@@ -1958,7 +1964,8 @@ ldap[s]://<replaceable>host</replaceable>[:<replaceable>port</replaceable>]/<rep
19581964

19591965
<para>
19601966
It is an error to mix configuration options for simple bind with options
1961-
for search+bind.
1967+
for search+bind. To use <literal>ldapurl</literal> in simple bind mode, the
1968+
URL must not contain a <literal>basedn</literal> or query elements.
19621969
</para>
19631970

19641971
<para>
@@ -1994,6 +2001,16 @@ host ... ldap ldapserver=ldap.example.net ldapprefix="cn=" ldapsuffix=", dc=exam
19942001
succeeds, the database access is granted.
19952002
</para>
19962003

2004+
<para>
2005+
Here is a different simple-bind configuration, which uses the LDAPS scheme
2006+
and a custom port number, written as a URL:
2007+
<programlisting>
2008+
host ... ldap ldapurl="ldaps://ldap.example.net:49151" ldapprefix="cn=" ldapsuffix=", dc=example, dc=net"
2009+
</programlisting>
2010+
This is slightly more compact than specifying <literal>ldapserver</literal>,
2011+
<literal>ldapscheme</literal>, and <literal>ldapport</literal> separately.
2012+
</para>
2013+
19972014
<para>
19982015
Here is an example for a search+bind configuration:
19992016
<programlisting>

‎src/backend/libpq/hba.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1907,10 +1907,10 @@ parse_hba_line(TokenizedAuthLine *tok_line, int elevel)
19071907
{
19081908
ereport(elevel,
19091909
(errcode(ERRCODE_CONFIG_FILE_ERROR),
1910-
errmsg("cannotuse ldapbasedn, ldapbinddn, ldapbindpasswd, ldapsearchattribute, ldapsearchfilter, or ldapurl together with ldapprefix"),
1910+
errmsg("cannotmix options for simple bind and search+bind modes"),
19111911
errcontext("line %d of configuration file \"%s\"",
19121912
line_num,file_name)));
1913-
*err_msg="cannotuse ldapbasedn, ldapbinddn, ldapbindpasswd, ldapsearchattribute, ldapsearchfilter, or ldapurl together with ldapprefix";
1913+
*err_msg="cannotmix options for simple bind and search+bind modes";
19141914
returnNULL;
19151915
}
19161916
}

‎src/test/ldap/t/001_auth.pl

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,22 @@ sub test_access
145145

146146
note"LDAP URLs";
147147

148+
unlink($node->data_dir .'/pg_hba.conf');
149+
$node->append_conf('pg_hba.conf',
150+
qq{local all all ldap ldapurl="$ldap_url" ldapprefix="uid=" ldapsuffix=",dc=example,dc=net"}
151+
);
152+
$node->restart;
153+
154+
$ENV{"PGPASSWORD"} ='wrong';
155+
test_access($node,'test0', 2,
156+
'simple bind with LDAP URL authentication fails if user not found in LDAP'
157+
);
158+
test_access($node,'test1', 2,
159+
'simple bind with LDAP URL authentication fails with wrong password');
160+
$ENV{"PGPASSWORD"} ='secret1';
161+
test_access($node,'test1', 0,
162+
'simple bind with LDAP URL authentication succeeds');
163+
148164
unlink($node->data_dir .'/pg_hba.conf');
149165
$node->append_conf('pg_hba.conf',
150166
qq{local all all ldap ldapurl="$ldap_url/$ldap_basedn?uid?sub"});

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp