CODEWITHSUNDEEP
c#openldap
Jonathan Beerhalter
Jonathan Beerhalter

Reputation: 7407

Why does open OpenLDAP require a cn=username?

I'm connecting to OpenLDAP with C#, and when I pass in my username and password, I have to pass them into my LdapConnection object as cn=Username, Password. If I just pass in username and password my call to Bind fails. Why do I have to do that? Is something misconfigured on my OpenLDAP server?

Upvotes: 1

Views: 467

Answers (1)

X3074861X
X3074861X

Reputation: 3819

It's just a byproduct of the implementation. Novell's eDirectory solution takes a very similar approach, and I use the same Novell.Directory.Ldap code to handle bind requests to both eDirectory and OpenLDAP. Now obviously, the users themselves shouldn't have to enter their entire CN when authorizing - we can just issue a search for them, based of thier UID :

//Setup the initial bind for the admin user
var lc = new LdapConnection();
lc.SecureSocketLayer = SSL;
lc.UserDefinedServerCertValidationDelegate += delegate { return true; };
lc.Connect(ServerName, Port);
lc.Constraints.TimeLimit = Timeout;
lc.Bind(AdminUsername, AdminPassword);

Now I just filter for the user, and bind using their distinguished name, or full container name (CN) :

//Ex. (uid=jsmith)
string filter = config.LdapAuth.LdapFilter.Replace("{{uid}}", username);

//Find the user we're trying to authorize
var lsc = lc.Search(config.LdapAuth.LdapDomain, LdapConnection.SCOPE_SUB, filter, null, false);

if (lsc.hasMore())
{
    LdapEntry nextEntry = lsc.next();

    //Check the Entries DN so we can properly bind 
    lc.Bind(nextEntry.DN, Password);
}

This was the most widely used approach I could find, and it's worked quite well so far.

Upvotes: 1

Related Questions