Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtp (Exim 4.84_2) (envelope-from ) id 1diLzX-000603-JB for pgsql-admin@arkaria.postgresql.org; Thu, 17 Aug 2017 14:41:47 +0000 Received: from localhost ([127.0.0.1] helo=postgresql.org) by malur.postgresql.org with smtp (Exim 4.84_2) (envelope-from ) id 1diLzX-0002d1-5r for pgsql-admin@arkaria.postgresql.org; Thu, 17 Aug 2017 14:41:47 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1diLxh-0006sy-NS for pgsql-admin@postgresql.org; Thu, 17 Aug 2017 14:39:53 +0000 Received: from host3.dynacom.ondsl.gr ([62.103.35.211] helo=smadev.internal.net) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1diLxe-0004nj-0v for pgsql-admin@postgresql.org; Thu, 17 Aug 2017 14:39:53 +0000 Received: from smadev.internal.net (smadev [10.9.200.131]) by smadev.internal.net (8.15.2/8.15.2) with ESMTP id v7HEdlIG088022 for ; Thu, 17 Aug 2017 17:39:47 +0300 (EEST) (envelope-from achill@matrix.gatewaynet.com) Subject: Re: LDAP authentication failes with more than one entry returned To: pgsql-admin@postgresql.org References: <56022b23f1d5415cb99d16d824fe7935@HE101867.emea1.cds.t-internal.com> From: Achilleas Mantzios Message-ID: <503e611f-29d8-b95e-b6cb-f74225e793ea@matrix.gatewaynet.com> Date: Thu, 17 Aug 2017 17:39:47 +0300 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:52.0) Gecko/20100101 Thunderbird/52.0 MIME-Version: 1.0 In-Reply-To: <56022b23f1d5415cb99d16d824fe7935@HE101867.emea1.cds.t-internal.com> Content-Type: multipart/alternative; boundary="------------9B065FB2D7E711C2BC4BEF02" Content-Language: en-US List-Archive: List-Help: List-ID: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-Mailing-List: pgsql-admin Precedence: bulk Sender: pgsql-admin-owner@postgresql.org This is a multi-part message in MIME format. --------------9B065FB2D7E711C2BC4BEF02 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit On 17/08/2017 16:58, Michael.Haertel@t-systems.com wrote: > > Hello list, > > I configured postgreSQL to only allow users that are administered in LDAP to connect to one particular database on my PostgreSQL host. This works fine as long as only one entry is returned for the > combination of “ldapbasedn” and “ldapsearchattribute”. > Why don't you go the simple bind mode route? Just specify ldapprefix, ldapsuffix to construct your bind DN, this should by definition be unique. > I currently match the LDAP attribute UID against the login name. Problem is that the users exist several times in the specified (sub-) directory tree. Everything works if the user only exists once > within the specified “ldapbasedn”. > > How to deal with that problem? > > I think it is common practice to have several sub-trees, one per organizational unit for example. Within that OU there are several sub-trees that define privileges for SAMBA shares, database > connections or other purposes. Because I need to search for the users across several OUs, I can’t give the path to only one sub-tree. > > I am currently on windows so I can’t test the ldapurl feature. > > Would it be possible to use the ldapurl directive to allow an ldapsearch across different 1^st level trees but only look for users within one particular sub-tree in each of the 1^st level trees? > > Thank you very much for your comments, > > Michael Härtel > -- Achilleas Mantzios IT DEV Lead IT DEPT Dynacom Tankers Mgmt --------------9B065FB2D7E711C2BC4BEF02 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
On 17/08/2017 16:58, Michael.Haertel@t-systems.com wrote:

Hello list,

 

I configured postgreSQL to only allow users that are administered in LDAP to connect to one particular database on my PostgreSQL host. This works fine as long as only one entry is returned for the combination of “ldapbasedn” and “ldapsearchattribute”.


Why don't you go the simple bind mode route? Just specify ldapprefix, ldapsuffix to construct your bind DN, this should by definition be unique.

 

I currently match the LDAP attribute UID against the login name. Problem is that the users exist several times in the specified (sub-) directory tree. Everything works if the user only exists once within the specified “ldapbasedn”.

 

How to deal with that problem?

 

I think it is common practice to have several sub-trees, one per organizational unit for example. Within that OU there are several sub-trees that define privileges for SAMBA shares, database connections or other purposes. Because I need to search for the users across several OUs, I can’t give the path to only one sub-tree.

 

I am currently on windows so I can’t test the ldapurl feature.

 

Would it be possible to use the ldapurl directive to allow an ldapsearch across different 1st level trees but only look for users within one particular sub-tree in each of the 1st level trees?

 

Thank you very much for your comments,

 

Michael Härtel


-- 
Achilleas Mantzios
IT DEV Lead
IT DEPT
Dynacom Tankers Mgmt
--------------9B065FB2D7E711C2BC4BEF02--