On Jun 30, 2015, at 3:50 PM, Michael Ströder <michael@stroeder.com> wrote:
Michael Ströder wrote:
Arran Cudbard-Bell wrote:
OK, should work now.
These cases both work:
server = 'ldap://localhost:1390' server = 'localhost:1390'
This does not work: server = 'ldapi://%2Ftmp%2Fopenldap-socket'
=> "Failed recombining URL components"
And this fails too:
server = 'ldapi://'
rlm_ldap (ldap): Bind with uid=radiusd,ou=sys,dc=stroeder,dc=local to ldapi://:389 failed: Can't contact LDAP server ^^^^^
As said you should not do any recombination and pass the string as is to libldap. This would save you a lot of headache.
TBH LDAP URLs are the wrong thing to use to specify a server, but we have no choice, the the OpenLDAP guys don't provide an interface to specify the connection type for a handle. The string recombination is done because we need to set a port. If the user specifies: server = 'ldap://example.org' port = 1300 They would (and did) wonder why the server was still attempting to connect on port 389. So whilst in theory, in a perfect world, it would be nice to pass through the URLs unmolested, in this case we can't (except for ldapi://). Why not just get rid of port? ----------------------------- Because not all versions of libldap or LDAP libraries support LDAP urls, plus we need it for legacy compatibility. Why not just disallow URLs? --------------------------- We likely will for v3.1.x, because the current code is ridiculously complex for what is does. We'll then have a scheme configuration option to specify ldapi, ldapc, ldaps or ldap, which will make integrating with other LDAP implementations easier. If ldap_initialize is the only interface for specifying the scheme, then we'll construct a URL behind the scenes and pass that to it. -Arran rlm_ldap (ldap): Opening additional connection (0), 1 of 100 pending slots used rlm_ldap (ldap): Connecting to ldapi:// rlm_ldap (ldap): Bind with cn=admin,dc=foo,dc=com to ldapi:// failed: Can't contact LDAP server rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/freeradius/etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap" rlm_ldap (ldap): Opening additional connection (0), 1 of 100 pending slots used rlm_ldap (ldap): Connecting to ldapi://%2Ftmp%2Fopenldap-socket rlm_ldap (ldap): Bind with cn=admin,dc=foo,dc=com to ldapi://%2Ftmp%2Fopenldap-socket failed: Can't contact LDAP server rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /usr/local/freeradius/etc/raddb/mods-enabled/ldap[8]: Instantiation failed for module "ldap"