diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
index 9fc583c..fc92ef9 100644
--- a/doc/src/sgml/client-auth.sgml
+++ b/doc/src/sgml/client-auth.sgml
@@ -1520,6 +1520,14 @@ ldap://host[:port]/
+
+ ldapreferrals
+
+
+ Specifies if referrals are automatically chased. Set to 1 to enable chasing, 0 to disable chasing. The default behaviour is specifed by the LDAP client library.
+
+
+
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 415b614..e289360 100644
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -2061,6 +2061,30 @@ InitializeLDAPConnection(Port *port, LDAP **ldap)
return STATUS_ERROR;
}
+ if (port->hba->ldapreferrals == TRI_YES)
+ {
+
+ if ((r = ldap_set_option(*ldap, LDAP_OPT_REFERRALS, LDAP_OPT_ON )) != LDAP_SUCCESS)
+ {
+ ldap_unbind(*ldap);
+ ereport(LOG,
+ (errmsg("Could not set LDAP referrals: %s", ldap_err2string(r))));
+ return STATUS_ERROR;
+ }
+ }
+
+ if (port->hba->ldapreferrals == TRI_NO)
+ {
+
+ if ((r = ldap_set_option(*ldap, LDAP_OPT_REFERRALS, LDAP_OPT_OFF )) != LDAP_SUCCESS)
+ {
+ ldap_unbind(*ldap);
+ ereport(LOG,
+ (errmsg("Could not set LDAP referrals: %s", ldap_err2string(r))));
+ return STATUS_ERROR;
+ }
+ }
+
if (port->hba->ldaptls)
{
#ifndef WIN32
diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c
index 91f6ced..149efeb 100644
--- a/src/backend/libpq/hba.c
+++ b/src/backend/libpq/hba.c
@@ -1218,7 +1218,10 @@ parse_hba_line(List *line, int line_num, char *raw_line)
#endif
else if (strcmp(token->string, "ldap") == 0)
#ifdef USE_LDAP
+ {
parsedline->auth_method = uaLDAP;
+ parsedline->ldapreferrals = TRI_DEFAULT;
+ }
#else
unsupauth = "ldap";
#endif
@@ -1529,6 +1532,15 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num)
else
hbaline->ldaptls = false;
}
+ else if (strcmp(name, "ldapreferrals") == 0)
+ {
+ REQUIRE_AUTH_OPTION(uaLDAP, "ldapreferrals", "ldap");
+ if (strcmp(val, "1") == 0)
+ hbaline->ldapreferrals = TRI_YES;
+ else if (strcmp(val, "0") == 0)
+ hbaline->ldapreferrals = TRI_NO;
+
+ }
else if (strcmp(name, "ldapserver") == 0)
{
REQUIRE_AUTH_OPTION(uaLDAP, "ldapserver", "ldap");
diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h
index 73ae510..d7fe64b 100644
--- a/src/include/libpq/hba.h
+++ b/src/include/libpq/hba.h
@@ -50,6 +50,13 @@ typedef enum ConnType
ctHostNoSSL
} ConnType;
+enum trivalue
+{
+ TRI_DEFAULT,
+ TRI_NO,
+ TRI_YES
+};
+
typedef struct HbaLine
{
int linenumber;
@@ -66,6 +73,7 @@ typedef struct HbaLine
char *usermap;
char *pamservice;
bool ldaptls;
+ enum trivalue ldapreferrals;
char *ldapserver;
int ldapport;
char *ldapbinddn;