From ab7dc4b524c3e2ad5153acfdbfa879a9e62d2dbe Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Wed, 17 Feb 2021 17:31:36 +0100 Subject: dirmngr: Support new gpgNtds parameter in LDAP keyserver URLs. * dirmngr/ldap-parse-uri.c (ldap_parse_uri): Support a new gpgNtds extension. * dirmngr/ks-engine-ldap.c (my_ldap_connect): Do ldap_init always with hostname - which is NULL and thus the same if not given. Fix minor error in error code handling. -- Note that "gpgNtds" is per RFC-4512 case insensitive and has not yet been officially regisetered. Thus for correctness the OID can be used: 1.3.6.1.4.1.11591.2.5 LDAP URL extensions 1.3.6.1.4.1.11591.2.5.1 gpgNtds=1 (auth. with current user) Note that the value must be 1; all other values won't enable AD authentication and are resevered for future use. This has been cherry-picked from the 2.2 branch, commit 55f46b33df08e8e0ea520ade5f73b321bc01d705 Signed-off-by: Werner Koch --- dirmngr/ks-engine-ldap.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) (limited to 'dirmngr/ks-engine-ldap.c') diff --git a/dirmngr/ks-engine-ldap.c b/dirmngr/ks-engine-ldap.c index 08d621944..52a14a11c 100644 --- a/dirmngr/ks-engine-ldap.c +++ b/dirmngr/ks-engine-ldap.c @@ -519,18 +519,12 @@ my_ldap_connect (parsed_uri_t uri, LDAP **ldap_connp, #endif } - if (uri->ad_current) - ldap_conn = ldap_init (NULL, uri->port); - else - ldap_conn = ldap_init (uri->host, uri->port); + ldap_conn = ldap_init (uri->host, uri->port); if (!ldap_conn) { err = gpg_err_code_from_syserror (); - if (uri->ad_current) - log_error ("error initializing LDAP for current user\n"); - else - log_error ("error initializing LDAP for (%s://%s:%d)\n", - uri->scheme, uri->host, uri->port); + log_error ("error initializing LDAP for (%s://%s:%d)\n", + uri->scheme, uri->host, uri->port); goto out; } @@ -611,15 +605,16 @@ my_ldap_connect (parsed_uri_t uri, LDAP **ldap_connp, npth_unprotect (); err = ldap_bind_s (ldap_conn, NULL, NULL, LDAP_AUTH_NEGOTIATE); npth_protect (); -#else - err = gpg_error (GPG_ERR_NOT_SUPPORTED); -#endif if (err != LDAP_SUCCESS) { log_error ("error binding to LDAP via AD: %s\n", ldap_err2string (err)); goto out; } +#else + err = gpg_error (GPG_ERR_NOT_SUPPORTED); + goto out; +#endif } else if (uri->auth) { -- cgit v1.2.3