do an exact match of the attribute specified in

<replaceable>ldapsearchattribute</replaceable>.

Once the user has been found in

this search, the serverdisconnects andre-binds to the directory as

this search, the server re-binds to the directory as

this user, using the password specified by the client, to verify that the

login is correct. This mode is the same as that used by LDAP authentication

schemes in other software, such as Apache <literal>mod_authnz_ldap</literal> and <literal>pam_ldap</literal>.

This method allows for significantly more flexibility

in where the user objects are located in the directory, but will cause

twoseparate connections to the LDAP server to be made.

twoadditional requests to the LDAP server to be made.

</para>

<para>

the LDAP server, perform a search for <literal>(uid=someuser)</literal>

under the specified base DN. If an entry is found, it will then attempt to

bind using that found information and the password supplied by the client.

If that secondconnection succeeds, the database access is granted.

If that secondbind succeeds, the database access is granted.

</para>

<para>

pfree(filter);

ldap_memfree(dn);

ldap_msgfree(search_message);

r=ldap_unbind_s(ldap);

if (r!=LDAP_SUCCESS)

{

ereport(LOG,

(errmsg("could not unbind after searching for user \"%s\" on server \"%s\"",

fulluser,server_name)));

pfree(passwd);

pfree(fulluser);

returnSTATUS_ERROR;

}

if (InitializeLDAPConnection(port,&ldap)==STATUS_ERROR)

{

pfree(passwd);

pfree(fulluser);

returnSTATUS_ERROR;

}

}

fulluser=psprintf("%s%s%s",