Обсуждение: LDAP referrals

Поиск
Список
Период
Сортировка

LDAP referrals

От
James Sewell
Дата:
Hello All,

Is there a way to disable chasing LDAP referrals in PostgreSQL?

Take the following LDAP config options from pg_hba.conf

ldapserver=server.org.com 
ldapbinddn="cn=bindUser,cn=users,dc=core,dc=dir,dc=org,dc=com" 
ldapbindpasswd="bindPass" ldapbasedn="dc=core,dc=dir,dc=org,dc=com" 
ldapsearchattribute="sAMAccountName"

From ldapsearch I can do the following search:

ldapsearch  -x -h server.org.com \
   -D "cn=bindUser,cn=users,dc=core,dc=dir,dc=org,dc=com" -W \
   -b "dc=core,dc=dir,dc=org,dc=com" \
   "sAMAccountName=searchUser" sAMAccountName

Which gives me the following response:

# extended LDIF
#
# LDAPv3
# base <dc=core,dc=dir,dc=org,dc=com> with scope subtree
# filter: sAMAccountName=searchUser
# requesting: sAMAccountName
#

# d248265, People, eProfile, server.org.com
dn: CN=searchUser,OU=People,OU=eProfile,DC=core,DC=dir,DC=org,DC=com
sAMAccountName: searchUser

# search reference
 =com

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 1
# numReferences: 1

Which is expected.

If I run psql like so:

 psql -U d248265 -h 127.0.0.1 dccn

then it hangs. From a packet capture I've determined that in this time it is trying to resolve the referral, which is broken and times out.

I can verify this by re-running the above ldapsearch with the -C option (automatically chase referrals). This hangs as well.

I know that the real root cause if my broken LDAP server, but is there a way to disable chasing referrals?


Cheers,
James Sewell



James Sewell
PostgreSQL Team Lead / Solutions Architect
_____________________________________


http://www.lisasoft.com/sites/lisasoft/files/u1/2013hieghtslogan_0.png

Level 2, 50 Queen St,
Melbourne, VIC, 3000

P: 03 8370 8000   F: 03 8370 8099  W: www.lisasoft.com


The contents of this email are confidential and may be subject to legal or professional privilege and copyright. No representation is made that this email is free of viruses or other defects. If you have received this communication in error, you may not copy or distribute any part of it or otherwise disclose its contents to anyone. Please advise the sender of your incorrect receipt of this correspondence.
Вложения

Re: LDAP referrals

От
Magnus Hagander
Дата:

On Wed, Jun 26, 2013 at 3:47 AM, James Sewell <james.sewell@lisasoft.com> wrote:
Hello All,

Is there a way to disable chasing LDAP referrals in PostgreSQL?

There is not, at this point. It would probably be fairly trivial to add a pg_hba parameter to turn it off (since it's, AFAIK, just a call to ldap_set_option), but it's not possible to do with current versions of PostgreSQL.
 
<snip>

You could try injecting a simple ldap_set_opttion() that turns off LDAP_OPT_REFERRALS in InitializeLdapConnection() in auth.c, to see if that works. If it solves the problem, it might be worth turning it into an actual option.


If I run psql like so:

 psql -U d248265 -h 127.0.0.1 dccn

then it hangs. From a packet capture I've determined that in this time it is trying to resolve the referral, which is broken and times out.

As you say, a quick fix would of course be to fix your server not to send broken referrals ;)

But I can see how it could perhaps still be useful to be able to block referrals. I think the reason it's not in there already is mainly that it doesn't make much sense for the actual login bind - but it does make more sense for the search step that happens before the bind.

--
 Magnus Hagander
 Me: http://www.hagander.net/
 Work: http://www.redpill-linpro.com/