Hi, we have no anonymus account on our ldap server, the bind takes place with the userdn and password. In the "ldap_authentification.inc" function _ldap_authentication_user_login_authenticate_validate(&$form_state) is the iteration over the configured ldap server where the ldap_bind takes place with the anonym user, an option in the settings to deactivate the anonym would be nice. 

 // file: ldap_authentification.inc

function _ldap_authentication_user_login_authenticate_validate(&$form_state){

 // (...)

// Line: 189
  foreach ($auth_conf->servers as $sid => $ldap_server) {
      $authentication_result = LDAP_AUTHENTICATION_RESULT_FAIL_GENERIC;
    $result = $ldap_server->connect();
    
    if ($result != LDAP_SUCCESS) {
      $authentication_result = LDAP_AUTHENTICATION_RESULT_FAIL_CONNECT;
      continue; // next server, please
    }	
        
    // ========= Changes ==========
    // BEFORE: $results = $ldap_server->bind(); 
    // I changed it to:
    $_userdn = $ldap_server->user_attr . '=' . $name.(!empty($ldap_server->basedn[0]) ? ",".$ldap_server->basedn[0] : "");
    $result = $ldap_server->bind($_userdn, $pass);
    // =========================
    if ($result != LDAP_SUCCESS) {
      $authentication_result = LDAP_AUTHENTICATION_RESULT_FAIL_BIND;
      continue; // next server, please
    }
  ...
}
CommentFileSizeAuthor
#5 1104366-non_anonym_ldap_bind-4.patch3.49 KBcezaryrk

Comments

johnbarclay’s picture

johnbarclay commented
Assigned: Unassigned » johnbarclay
Priority: Normal » Major
cezaryrk’s picture

cezaryrk commented

Thanks for looking in this issue. My current problem with this simple workaround is, that if the username or password is wrong i get the error message "Failed to bind ldap server", but i try to find a solution for that. Post my solution when i have one ;)

johnbarclay’s picture

johnbarclay commented

If you are in a big hurry, you might also look at the ldap_integration project for drupal 6. it does exactly what you are talking about. I just haven't put the funcitonality in yet and I'm busy the next few days.

cezaryrk’s picture

cezaryrk commented

thx, alright i look in to it, if i create something usefull, i add a patch to this issue

cezaryrk’s picture

cezaryrk commented
StatusFileSize
new 1104366-non_anonym_ldap_bind-4.patch3.49 KB

I looked in the ldap_integration, but it doesn't support the direct bind with userdn + pass. I'm currently thinking that only i have the problem :), but in case i'm not the only one, her's the patch. It add's a checkbox in the user-section of the server configuration enabling/disabling the ldap_bind with userdn and pass.

johnbarclay’s picture

johnbarclay commented
Status: Active » Needs review

Thanks.

I planned to support this by binding with the users credentials when no dn for non-anonymous search was present. Does this seem adequate? This keeps the binding model associated with the server rather than associated with the authentication or authorization component.

The overall idea being each server configuration would be a permutation of binding type, base dns, etc to meet the needs of various ldap modules. Not simply one server configuration per physical ldap server. Thus one ldap server might be setup simply for ldap provisioning to use with a somewhat powerful binding user and narrow base dns. Another might be for authentication with no anonymous user at all.

johnbarclay’s picture

johnbarclay commented

The line $_userdn = $ldap_server->user_attr . '=' . $name.(!empty($ldap_server->basedn[0]) ? ",".$ldap_server->basedn[0] : ""); only works if the user_attr added to the beginning of a basedn creates
the full dn.

Since this method wasn't supported in ldapauth (method 2 below), I've split the binding into 3 options:


1. LDAP_SERVERS_BIND_METHOD_NONANON => 'Non Anonymous Bind. Use credentials in following section to
bind to ldap. This option is usually a best practice.',

2. LDAP_SERVERS_BIND_METHOD_USER => 'Bind with Users Credentials. Use users\' entered credentials
to bind to LDAP. This is only useful for modules that work during user logon such
as ldap authentication and ldap authorization. This option is not a best practice in most cases.
The users dn must be of the form "cn=[username],[base dn]" for this option to work.',

3. LDAP_SERVERS_BIND_METHOD_ANON => 'Anonymous Bind. Use no credentials to bind to ldap server.
Will not work on most ldaps.',

I

johnbarclay’s picture

johnbarclay commented

I ended up allowing all 3 types of bindings. I renamed non anonymous to service account binding since there were technically 2 non anonymous binding approaches. I also added an expression for deriving the DN of a user.

I don't have an ldap server to test anonymous binding, but the other 2 approaches work well so should solve this issue for everyone.

cezaryrk’s picture

cezaryrk commented

Cool, thanks! But i found a little bug in the admin settings. When you select METHOD_USER or METHOD_ANON and you clear the "Service Account DN" field, an validation error occures "Invalid format for: ." from the ldap_baddn function in LdapServerAdmin.class.php:389. I added

 // LdapServerAdmin.class.php
// Line: 389
    if($this->bind_method == LDAP_SERVERS_BIND_METHOD_SERVICE_ACCT){ // Only for service account
       $result = ldap_baddn($this->binddn, t('Service Account DN'));
       if ($result['boolean'] == FALSE) {
         $errors['binddn'] =  $result['text'];
       }
    }
johnbarclay’s picture

johnbarclay commented
Status: Needs review » Closed (fixed)

Thanks. I committed this to 7.x-1.x-dev