public inbox for [email protected]  

help / color / mirror / Atom feed

From: Peter Eisentraut <[email protected]>
To: Jacob Champion <[email protected]>
To: PostgreSQL Hackers <[email protected]>
Subject: Re: Document use of ldapurl with LDAP simple bind
Date: Fri, 28 Jun 2024 09:11:42 +0200
Message-ID: <[email protected]> (raw)
In-Reply-To: <CAOYmi+nyg9gE0LeP=xQ3AgyQGR=5ZZMkVVbWd0uR8XQmg_dd5Q@mail.gmail.com>
References: <CAOYmi+nyg9gE0LeP=xQ3AgyQGR=5ZZMkVVbWd0uR8XQmg_dd5Q@mail.gmail.com>

On 24.05.24 20:54, Jacob Champion wrote:
> Our documentation implies that the ldapurl setting in pg_hba is used
> for search+bind mode only. It was pointed out to me recently that this
> is not true, and if you're dealing with simple bind on a non-standard
> scheme or port, then ldapurl makes the HBA easier to read:
> 
>      ... ldap ldapurl="ldaps://ldap.example.net:49151" ldapprefix="cn="
> ldapsuffix=", dc=example, dc=net"
> 
> 0001 tries to document this helpful behavior a little better, and 0002
> pins it with a test. WDYT?

Yes, this looks correct.  Since ldapurl is really just a shorthand that 
is expanded to various other parameters, it makes sense that it would 
work for simple bind as well.

hba.c has this error message:

"cannot use ldapbasedn, ldapbinddn, ldapbindpasswd, ldapsearchattribute, 
ldapsearchfilter, or ldapurl together with ldapprefix"

This appears to imply that specifying ldapurl is only applicable for 
search+bind.  Maybe that whole message should be simplified to something 
like

"configuration mixes arguments for simple bind and search+bind"

(The old wording also ignores that the error might arise via "ldapsuffix".)

view thread (4+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: Document use of ldapurl with LDAP simple bind
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox