|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2006-10-28 14:44 UTC] lee dot essen at nowonline dot co dot uk
Description: ------------ ** Caveat: I am not an LDAP, PHP or SASL expert, so I could be a long way off the mark here ** This is similar to bug 35611 (which is marked as Bogus!) and related to 30189, but I believe the problem is with authcid and not authzid. ldap_sasl_bind sends the binddn as the authcid, this behaviour differs to the standard ldapsearch etc utilities when using "-U" to send a username. This basically means that I cannot get it to bind to my ldap server, looking at the slapd debug it seems to send a username like... username="cn=My Name,ou=People,..." ... when I look at the debug from using an ldapsearch -U it gets a username="shortname" type output. By hacking the code to add another option (authcid) to the php ldap_sasl_bind function and sending that for the authcid instead of binddn everything works perfectly. A simple example is that you don't need to provide a BindDN to ldapsearch if you use -U, this is because the username will be mapped by the authz-regex to a real object. If you don't specify a binddn with PHP you get a "SASL bind in progress" error, and if you just specify a username then it fails with "invalid dn". (I can provide a very simple patch that fixes the problem if it helps) Reproduce code: --------------- See description above. Expected result: ---------------- See description above. Actual result: -------------- See description above. PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Wed Jan 22 11:01:28 2025 UTC |
==BEGIN php-5.1.6_ldap_sasl_bind-authcid.diff== --- original/php-5.1.6/ext/ldap/ldap.c 2006-01-01 15:50:08.000000000 +0300 +++ work/php-5.1.6/ext/ldap/ldap.c 2007-03-25 00:50:23.000000000 +0300 @@ -499,14 +499,14 @@ /* {{{ _php_sasl_setdefs */ -static php_ldap_bictx *_php_sasl_setdefs(LDAP *ld, char *sasl_mech, char *sasl_realm, char *binddn, char *pass, char *sasl_authz_id) +static php_ldap_bictx *_php_sasl_setdefs(LDAP *ld, char *sasl_mech, char *sasl_realm, char *sasl_authc_id, char *pass, char *sasl_authz_id) { php_ldap_bictx *ctx; ctx = ber_memalloc(sizeof(php_ldap_bictx)); ctx->mech = (sasl_mech) ? ber_strdup(sasl_mech) : NULL; ctx->realm = (sasl_realm) ? ber_strdup(sasl_realm) : NULL; - ctx->authcid = (binddn) ? ber_strdup(binddn) : NULL; + ctx->authcid = (sasl_authc_id) ? ber_strdup(sasl_authc_id) : NULL; ctx->passwd = (pass) ? ber_strdup(pass) : NULL; ctx->authzid = (sasl_authz_id) ? ber_strdup(sasl_authz_id) : NULL; @@ -583,18 +583,19 @@ char *pass = NULL; char *sasl_mech = NULL; char *sasl_realm = NULL; + char *sasl_authc_id = NULL; char *sasl_authz_id = NULL; char *props = NULL; - int rc, dn_len, pass_len, mech_len, realm_len, authz_id_len, props_len; + int rc, dn_len, pass_len, mech_len, realm_len, authc_id_len, authz_id_len, props_len; php_ldap_bictx *ctx; - if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|ssssss", &link, &binddn, &dn_len, &pass, &pass_len, &sasl_mech, &mech_len, &sasl_realm, &realm_len, &sasl_authz_id, &authz_id_len, &props, &props_len) == FAILURE) { + if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|sssssss", &link, &binddn, &dn_len, &pass, &pass_len, &sasl_mech, &mech_len, &sasl_realm, &realm_len, &sasl_authc_id, &authc_id_len, &sasl_authz_id, &authz_id_len, &props, &props_len) == FAILURE) { RETURN_FALSE; } ZEND_FETCH_RESOURCE(ld, ldap_linkdata *, &link, -1, "ldap link", le_link); - ctx = _php_sasl_setdefs(ld->link, sasl_mech, sasl_realm, binddn, pass, sasl_authz_id); + ctx = _php_sasl_setdefs(ld->link, sasl_mech, sasl_realm, sasl_authc_id, pass, sasl_authz_id); if (props) { ldap_set_option(ld->link, LDAP_OPT_X_SASL_SECPROPS, props); ==BEGIN php-5.1.6_ldap_sasl_bind-authcid.diff== I looked in sources of ldapsearch and did like that guys. Here is ldap_sasl_bind definition from http://www.php.net/manual/ru/function.ldap-sasl-bind.php: bool ldap_sasl_bind ( resource link [, string binddn [, string password [, string sasl_mech [, string sasl_realm [, string sasl_authz_id [, string props]]]]]] ) I've added authc_id argument to ldap_sasl_bind function into position of authz_id argument: bool ldap_sasl_bind ( resource link [, string binddn [, string password [, string sasl_mech [, string sasl_realm [, string sasl_authc_id [, string sasl_authz_id [, string props]]]]]]] ) phplpadadmin works fine after that! I use login_dn as "uid=username,ou=People,dc=example,dc=com". Phpldapadmin sets authz_id as "username". ldap_sasl_bind use that authz_id as authc_id. P.S. there similar bugs 35611 and 32055