While ldaptls=1 provides an RFC 4513 conforming way to do LDAP
authentication with TLS encryption, there was an earlier de facto
standard way to do LDAP over SSL called LDAPS. Even though it's not
enshrined in a standard, it's still widely used and sometimes required
by organizations' network policies. There seems to be no reason not to
support it when available in the client library. Therefore, add support
when using OpenLDAP 2.4+ or Windows. It can be configured with
ldapscheme=ldaps or ldapurl=ldaps://...
Add tests for both ways of requesting LDAPS and a test for the
pre-existing ldaptls=1. Modify the 001_auth.pl test for "diagnostic
messages", which was previously relying on the server rejecting
ldaptls=1.
Author: Thomas Munro
Reviewed-By: Peter Eisentraut
Discussion: https://postgr.es/m/CAEepm=1s+pA-LZUjQ-9GQz0Z4rX_eK=DFXAF1nBQ+ROPimuOYQ@mail.gmail.com
# note bad ldapprefix with a question mark that triggers a diagnostic message
unlink($node->data_dir.'/pg_hba.conf');
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapserver=$ldap_server ldapport=$ldap_port ldapprefix="?uid=" ldapsuffix=""});
$node->reload;
$ENV{"PGPASSWORD"}='secret1';
test_access($node,'test1',2,'any attempt fails due to bad search pattern');
note"TLS";
# request StartTLS with ldaptls=1
unlink($node->data_dir.'/pg_hba.conf');
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapserver=$ldap_server ldapport=$ldap_port ldapbasedn="$ldap_basedn" ldapsearchfilter="(uid=\$username)" ldaptls=1});
$node->reload;
$ENV{"PGPASSWORD"}='secret1';
test_access($node,'test1',0,'StartTLS');
# request LDAPS with ldapscheme=ldaps
unlink($node->data_dir.'/pg_hba.conf');
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapserver=$ldap_server ldapscheme=ldaps ldapport=$ldaps_port ldapbasedn="$ldap_basedn" ldapsearchfilter="(uid=\$username)"});
$node->reload;
$ENV{"PGPASSWORD"}='secret1';
test_access($node,'test1',0,'LDAPS');
# request LDAPS with ldapurl=ldaps://...
unlink($node->data_dir.'/pg_hba.conf');
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapurl="$ldaps_url/$ldap_basedn??sub?(uid=\$username)"});
$node->reload;
$ENV{"PGPASSWORD"}='secret1';
test_access($node,'test1',0,'LDAPS with URL');
# bad combination of LDAPS and StartTLS
unlink($node->data_dir.'/pg_hba.conf');
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapserver=$ldap_server ldapport=$ldap_port ldapprefix="uid=" ldapsuffix=",dc=example,dc=net" ldaptls=1});
$node->append_conf('pg_hba.conf',qq{local all all ldap ldapurl="$ldaps_url/$ldap_basedn??sub?(uid=\$username)" ldaptls=1});
$node->reload;
$ENV{"PGPASSWORD"}='secret1';
test_access($node,'test1',2,'any attempt fails due to unsupported TLS');
test_access($node,'test1',2,'bad combination of LDAPS and StartTLS');
Peter Eisentraut
8 years ago