diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index 9fc583c..fc92ef9 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -1520,6 +1520,14 @@ ldap://host[:port]/ + + ldapreferrals + + + Specifies if referrals are automatically chased. Set to 1 to enable chasing, 0 to disable chasing. The default behaviour is specifed by the LDAP client library. + + + diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index 415b614..e289360 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -2061,6 +2061,30 @@ InitializeLDAPConnection(Port *port, LDAP **ldap) return STATUS_ERROR; } + if (port->hba->ldapreferrals == TRI_YES) + { + + if ((r = ldap_set_option(*ldap, LDAP_OPT_REFERRALS, LDAP_OPT_ON )) != LDAP_SUCCESS) + { + ldap_unbind(*ldap); + ereport(LOG, + (errmsg("Could not set LDAP referrals: %s", ldap_err2string(r)))); + return STATUS_ERROR; + } + } + + if (port->hba->ldapreferrals == TRI_NO) + { + + if ((r = ldap_set_option(*ldap, LDAP_OPT_REFERRALS, LDAP_OPT_OFF )) != LDAP_SUCCESS) + { + ldap_unbind(*ldap); + ereport(LOG, + (errmsg("Could not set LDAP referrals: %s", ldap_err2string(r)))); + return STATUS_ERROR; + } + } + if (port->hba->ldaptls) { #ifndef WIN32 diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c index 91f6ced..149efeb 100644 --- a/src/backend/libpq/hba.c +++ b/src/backend/libpq/hba.c @@ -1218,7 +1218,10 @@ parse_hba_line(List *line, int line_num, char *raw_line) #endif else if (strcmp(token->string, "ldap") == 0) #ifdef USE_LDAP + { parsedline->auth_method = uaLDAP; + parsedline->ldapreferrals = TRI_DEFAULT; + } #else unsupauth = "ldap"; #endif @@ -1529,6 +1532,15 @@ parse_hba_auth_opt(char *name, char *val, HbaLine *hbaline, int line_num) else hbaline->ldaptls = false; } + else if (strcmp(name, "ldapreferrals") == 0) + { + REQUIRE_AUTH_OPTION(uaLDAP, "ldapreferrals", "ldap"); + if (strcmp(val, "1") == 0) + hbaline->ldapreferrals = TRI_YES; + else if (strcmp(val, "0") == 0) + hbaline->ldapreferrals = TRI_NO; + + } else if (strcmp(name, "ldapserver") == 0) { REQUIRE_AUTH_OPTION(uaLDAP, "ldapserver", "ldap"); diff --git a/src/include/libpq/hba.h b/src/include/libpq/hba.h index 73ae510..d7fe64b 100644 --- a/src/include/libpq/hba.h +++ b/src/include/libpq/hba.h @@ -50,6 +50,13 @@ typedef enum ConnType ctHostNoSSL } ConnType; +enum trivalue +{ + TRI_DEFAULT, + TRI_NO, + TRI_YES +}; + typedef struct HbaLine { int linenumber; @@ -66,6 +73,7 @@ typedef struct HbaLine char *usermap; char *pamservice; bool ldaptls; + enum trivalue ldapreferrals; char *ldapserver; int ldapport; char *ldapbinddn;