BUG #7659: LDAP auth does not search the subtree

From: kevin(at)rootsmith(dot)ca
To: pgsql-bugs(at)postgresql(dot)org
Subject: BUG #7659: LDAP auth does not search the subtree
Date: 2012-11-14 19:51:45
Message-ID: E1TYizx-0000RZ-EU@wrigleys.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

The following bug has been logged on the website:

Bug reference: 7659
Logged by: Kevin Smith
Email address: kevin(at)rootsmith(dot)ca
PostgreSQL version: 9.2.1
Operating system: CentOS5
Description:

I have the following in my pg_hba.conf file:

host all +ldap 127.0.0.1/32 ldap ldapserver=<myserver> ldapport=389
ldapbasedb="<my base dn>" ldapbinddn="<my bind dn>" ldapbindpasswd=<passwd>
ldapsearchattribute=<search_attr>

If I try to connect from the localhost with a valid ldap account, it fails.
Note that the <search_attr> is located in objects, one level deeper than the
<my base dn> given.

The error in the log is as follows:

could not search LDAP for filter "(<search_attr>=<my_user>)" on server
"<myserver>": error code 1

However, when I do the following on the command line, it works:

ldapsearch -x -L -b "<my base dn>" -D "<my bind dn>" -w <passwd> -H
ldap://<myserver>:389 "(<search_attr>=my_user)"

When I change the configuration in pg_hba.conf so that the ldapbasedn is
exactly on the same level as where the user resides, it works perfectly.

The documentation states "The search will be performed over the subtree at
ldapbasedn" but this does not appear to be the case from my testing. The
scope appears to be defaulting to be just searching the base.

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Tom Lane 2012-11-14 19:57:43 Re: BUG #7658: the result of pg_get_viewdef can NOT execute directly
Previous Message limkimhuot 2012-11-14 18:11:03 Re: BUG #7628: Installation of PostgreSQL 9.2.1 on Windows 7 may take too long