LDAP where DN does not include UID attribute

From: Robert Fleming <fleminra(at)gmail(dot)com>
To: pgsql-admin(at)postgresql(dot)org
Subject: LDAP where DN does not include UID attribute
Date: 2009-09-14 20:34:47
Message-ID: 4c0112730909141334n201cadf3x2e288528a97883ca@mail.gmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-admin

Hello,

I have an LDAP server where the DN looks like:

cn=robert fleming,cn=users,dc=abc,dc=example,dc=com

But I would like to authenticate to PostgreSQL using the "uid" LDAP
attribute, which you may notice is *not* in the DN. It seems to me that
PostgreSQL's LDAP support does not allow this.

Other software products I've seen support this by doing an LDAP query
*first*, and then fetching/building the DN from the search result, and then
using that DN to do the bind. Looking at the PostgreSQL source code, it
seems like PostgreSQL expects to be able to do a bind without doing a search
first.

==Examples for reference==
===MediaWiki===
====LocalSettings.php====
$wgLDAPServerNames = array("example"=>"ldap.example.com");
$wgLDAPSearchAttributes = array("example"=>"uid");
$wgLDAPBaseDNs = array("loral"=>"cn=users,dc=abc,dc=example,dc=com");

====LdapAuthentication.php====
see <
http://svn.wikimedia.org/viewvc/mediawiki/trunk/extensions/LdapAuthentication/LdapAuthentication.php?view=markup
>
Look for "function getUserDN"

===Bugzilla===
====params====
%param = (
'LDAPBaseDN' => 'cn=users,dc=ssd,dc=loral,dc=com',
'LDAPbinddn' => '',
'LDAPfilter' => '',
'LDAPmailattribute' => 'mail',
'LDAPserver' => 'ldap.example.com',
'LDAPstarttls' => 0,
'LDAPuidattribute' => 'uid',
...

====LDAP.pm====
see <http://mxr.mozilla.org/bugzilla/source/Bugzilla/Auth/Verify/LDAP.pm>
Look at about line 64 to see that they do a LDAP search before the LDAP
bind.

In contrast, PostgreSQL's backend/libpq/auth.c does ldap_simple_bind_s() but
never does a LDAP search.

Thanks,
Robert

Responses

Browse pgsql-admin by date

  From Date Subject
Next Message Tom Lane 2009-09-14 23:23:29 Re: LDAP where DN does not include UID attribute
Previous Message David Schnur 2009-09-14 20:19:18 Re: Does pg_dump have a 2GB file-size limit?