Subject: LDAP non-anonymous binding (and AD anonymous)

From: Brandon Knitter <[email-masked]>
Date: Fri, 12 Sep 2003 12:42:39 -0700

Pine 4.58

I was checking out some old postings and the pine code and I found that Pine
current bind anonymously to an LDAP server via the method:

    pine/bldaddr.c  line:5354
    if(ldap_simple_bind_s(ld, NULL, NULL) != LDAP_SUCCESS){

This not only makes it impossible to bind as a person, but also if you are
binding to an Active Directory (Micro$oft) server through the LDAP interface,
this will not work.  Specifically you have to bind anonymously as:

    if(ldap_simple_bind_s(ld, "anonymous", "") != LDAP_SUCCESS){

Lame, huh?  Anyhow, I was checking out some of the config code and I was able to
change that line and then use the following config setting to get into our
LDAP/ActiveDirectory server:

    ldap-servers=host:3268
"/base=cn=users,dc=company,dc=com/impl=1/rhs=0/ref=0/nosub=0/type=/srch=contains/time=/size=/cust=/nick=Exchange/matr=/catr=/satr=/gatr="
    
I haven't looking into the other code, as I'm no expert in C, but I was
wondering how hard it would be to add additional options to the ldap-servers
config option such as:

    /binddn=/bindpw=/

Adding those two options would make almost any LDAP server bindable, and would
allow for secure bindings as well.

FWIW, I had to add similar configuration options to Bugzilla to make it work
against LDAP on AD.

Thanks,

-- 
-bk

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Brandon Knitter <[email-masked]>
Date: Fri, 12 Sep 2003 15:46:17 -0700

[Should this go to the DEV list?  If so, can someone fwd for me?]

So I looked into it.  This not only allows for named binding, but also allows
for the AD stuff to work.  I've attached the patch for review.  Let me know how
I did! :)

If you have a config string like:

    ldap-servers=host:3268

Things work like always, passing NULL,NULL to the bind comand.  Now if you want
to bind as a specific person, you can just do:

    ldap-servers=host:3268
"/base=cn=users,dc=company,dc=com/impl=1/rhs=0/ref=0/nosub=0/type=/srch=contains/time=/size=/cust=/nick=Exchange/matr=/catr=/satr=/gatr=/binddn=cn=Bob
Jones,cn=user,dc=company,dc=com/bindpw=somepassword"

or in the case of AD's "anonymous" bindings:

    ldap-servers=host:3268
"/base=cn=users,dc=company,dc=com/impl=1/rhs=0/ref=0/nosub=0/type=/srch=contains/time=/size=/cust=/nick=Exchange/matr=/catr=/satr=/gatr=/binddn=anonymous/bindpw="

So, can this be rolled into 4.59? :-D

-- 
-bk

---

From: othermark <[email-masked]>
Date: Fri, 19 Sep 2003 14:56:35 +0000 (UTC)

You're patch works wunderbar!

see this url for sumbitting this patch:

http://www.math.washington.edu/~chappa/pine/faq/misc.html#suggest

I'll past from the page here:

    Can I suggest a patch? 

    I am happy to read your suggestions, to either write a new patch or to 
    improve an existing patch. If you would like a patch to be a permanent 
    part of pine just write to the pine developers team [email-masked] 

All the best,

Mark Atkinson
atkin901 at NOSPAM dot yahoo dot com
(!wired)?(coffee++):(wired);

Brandon Knitter <[email-masked]> wrote:
> [-- text/plain, encoding 8bit, charset: ISO-8859-1, 85 lines --]
>