Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitaa2fec0

Browse files
committed
Add support for LDAP URLs
Allow specifying LDAP authentication parameters as RFC 4516 LDAP URLs.
1 parent26374f2 commitaa2fec0

File tree

4 files changed

+97
-2
lines changed

4 files changed

+97
-2
lines changed

‎doc/src/sgml/client-auth.sgml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1486,6 +1486,34 @@ omicron bryanh guest1
14861486
</para>
14871487
</listitem>
14881488
</varlistentry>
1489+
<varlistentry>
1490+
<term><literal>ldapurl</literal></term>
1491+
<listitem>
1492+
<para>
1493+
An RFC 4516 LDAP URL. This is an alternative way to write most of the
1494+
other LDAP options in a more compact and standard form. The format is
1495+
<synopsis>
1496+
ldap://[<replaceable>user</replaceable>[:<replaceable>password</replaceable>]@]<replaceable>host</replaceable>[:<replaceable>port</replaceable>]/<replaceable>basedn</replaceable>[?[<replaceable>attribute</replaceable>][?[<replaceable>scope</replaceable>]]]
1497+
</synopsis>
1498+
<replaceable>scope</replaceable> must be one
1499+
of <literal>base</literal>, <literal>one</literal>, <literal>sub</literal>,
1500+
typically the latter. Only one attribute is used, and some other
1501+
components of standard LDAP URLs such as filters and extensions are
1502+
not supported.
1503+
</para>
1504+
1505+
<para>
1506+
To use encrypted LDAP connections, the <literal>ldaptls</literal>
1507+
option has to be used in addition to <literal>ldapurl</literal>.
1508+
The <literal>ldaps</literal> URL scheme (direct SSL connection) is not
1509+
supported.
1510+
</para>
1511+
1512+
<para>
1513+
LDAP URLs are currently only supported with OpenLDAP, not on Windows.
1514+
</para>
1515+
</listitem>
1516+
</varlistentry>
14891517
</variablelist>
14901518
</para>
14911519

@@ -1520,6 +1548,15 @@ host ... ldap ldapserver=ldap.example.net ldapbasedn="dc=example, dc=net" ldapse
15201548
If that second connection succeeds, the database access is granted.
15211549
</para>
15221550

1551+
<para>
1552+
Here is the same search+bind configuration written as a URL:
1553+
<programlisting>
1554+
host ... ldap lapurl="ldap://ldap.example.net/dc=example,dc=net?uid?sub"
1555+
</programlisting>
1556+
Some other software that supports authentication against LDAP uses the
1557+
same URL format, so it will be easier to share the configuration.
1558+
</para>
1559+
15231560
<tip>
15241561
<para>
15251562
Since LDAP often uses commas and spaces to separate the different

‎src/backend/libpq/auth.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2209,7 +2209,7 @@ CheckLDAPAuth(Port *port)
22092209

22102210
r=ldap_search_s(ldap,
22112211
port->hba->ldapbasedn,
2212-
LDAP_SCOPE_SUBTREE,
2212+
port->hba->ldapscope,
22132213
filter,
22142214
attributes,
22152215
0,

‎src/backend/libpq/hba.c

Lines changed: 58 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,13 @@
3737
#include"utils/lsyscache.h"
3838
#include"utils/memutils.h"
3939

40+
#ifdefUSE_LDAP
41+
#ifndefWIN32
42+
#include<ldap.h>
43+
#endif
44+
/* currently no Windows LDAP needed in this file */
45+
#endif
46+
4047

4148
#defineatooid(x) ((Oid) strtoul((x), NULL, 10))
4249
#defineatoxid(x) ((TransactionId) strtoul((x), NULL, 10))
@@ -1336,7 +1343,7 @@ parse_hba_line(List *line, int line_num)
13361343
{
13371344
ereport(LOG,
13381345
(errcode(ERRCODE_CONFIG_FILE_ERROR),
1339-
errmsg("cannot use ldapbasedn, ldapbinddn, ldapbindpasswd, orldapsearchattribute together with ldapprefix"),
1346+
errmsg("cannot use ldapbasedn, ldapbinddn, ldapbindpasswd,ldapsearchattribute,orldapurl together with ldapprefix"),
13401347
errcontext("line %d of configuration file \"%s\"",
13411348
line_num,HbaFileName)));
13421349
returnNULL;
@@ -1378,6 +1385,8 @@ parse_hba_line(List *line, int line_num)
13781385
staticbool
13791386
parse_hba_auth_opt(char*name,char*val,HbaLine*hbaline,intline_num)
13801387
{
1388+
hbaline->ldapscope=LDAP_SCOPE_SUBTREE;
1389+
13811390
if (strcmp(name,"map")==0)
13821391
{
13831392
if (hbaline->auth_method!=uaIdent&&
@@ -1437,6 +1446,54 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
14371446
REQUIRE_AUTH_OPTION(uaPAM,"pamservice","pam");
14381447
hbaline->pamservice=pstrdup(val);
14391448
}
1449+
elseif (strcmp(name,"ldapurl")==0)
1450+
{
1451+
LDAPURLDesc*urldata;
1452+
intrc;
1453+
1454+
REQUIRE_AUTH_OPTION(uaLDAP,"ldapurl","ldap");
1455+
1456+
#ifdefLDAP_API_FEATURE_X_OPENLDAP
1457+
rc=ldap_url_parse(val,&urldata);
1458+
if (rc!=LDAP_SUCCESS)
1459+
{
1460+
ereport(LOG,
1461+
(errcode(ERRCODE_CONFIG_FILE_ERROR),
1462+
errmsg("could not parse LDAP URL \"%s\": %s",val,ldap_err2string(rc))));
1463+
return false;
1464+
}
1465+
1466+
if (strcmp(urldata->lud_scheme,"ldap")!=0)
1467+
{
1468+
ereport(LOG,
1469+
(errcode(ERRCODE_CONFIG_FILE_ERROR),
1470+
errmsg("unsupported LDAP URL scheme: %s",urldata->lud_scheme)));
1471+
ldap_free_urldesc(urldata);
1472+
return false;
1473+
}
1474+
1475+
hbaline->ldapserver=pstrdup(urldata->lud_host);
1476+
hbaline->ldapport=urldata->lud_port;
1477+
hbaline->ldapbasedn=pstrdup(urldata->lud_dn);
1478+
1479+
if (urldata->lud_attrs)
1480+
hbaline->ldapsearchattribute=pstrdup(urldata->lud_attrs[0]);/* only use first one */
1481+
hbaline->ldapscope=urldata->lud_scope;
1482+
if (urldata->lud_filter)
1483+
{
1484+
ereport(LOG,
1485+
(errcode(ERRCODE_CONFIG_FILE_ERROR),
1486+
errmsg("filters not supported in LDAP URLs")));
1487+
ldap_free_urldesc(urldata);
1488+
return false;
1489+
}
1490+
ldap_free_urldesc(urldata);
1491+
#else/* not OpenLDAP */
1492+
ereport(LOG,
1493+
(errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
1494+
errmsg("LDAP URLs not supported on this platform")));
1495+
#endif/* not OpenLDAP */
1496+
}
14401497
elseif (strcmp(name,"ldaptls")==0)
14411498
{
14421499
REQUIRE_AUTH_OPTION(uaLDAP,"ldaptls","ldap");

‎src/include/libpq/hba.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ typedef struct HbaLine
7171
char*ldapbindpasswd;
7272
char*ldapsearchattribute;
7373
char*ldapbasedn;
74+
intldapscope;
7475
char*ldapprefix;
7576
char*ldapsuffix;
7677
boolclientcert;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp