From ab7dc4b524c3e2ad5153acfdbfa879a9e62d2dbe Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Wed, 17 Feb 2021 17:31:36 +0100 Subject: dirmngr: Support new gpgNtds parameter in LDAP keyserver URLs. * dirmngr/ldap-parse-uri.c (ldap_parse_uri): Support a new gpgNtds extension. * dirmngr/ks-engine-ldap.c (my_ldap_connect): Do ldap_init always with hostname - which is NULL and thus the same if not given. Fix minor error in error code handling. -- Note that "gpgNtds" is per RFC-4512 case insensitive and has not yet been officially regisetered. Thus for correctness the OID can be used: 1.3.6.1.4.1.11591.2.5 LDAP URL extensions 1.3.6.1.4.1.11591.2.5.1 gpgNtds=1 (auth. with current user) Note that the value must be 1; all other values won't enable AD authentication and are resevered for future use. This has been cherry-picked from the 2.2 branch, commit 55f46b33df08e8e0ea520ade5f73b321bc01d705 Signed-off-by: Werner Koch --- doc/dirmngr.texi | 2 ++ 1 file changed, 2 insertions(+) (limited to 'doc/dirmngr.texi') diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi index 33a84244c..0dd34901a 100644 --- a/doc/dirmngr.texi +++ b/doc/dirmngr.texi @@ -332,6 +332,8 @@ built-in default of @code{hkps://hkps.pool.sks-keyservers.net}. Windows users with a keyserver running on their Active Directory should use @code{ldap:///} for @var{name} to access this directory. +As an alternative it is also possible to add @code{gpgNtds=1} as +extension (i.e. after the fourth question mark). For accessing anonymous LDAP keyservers @var{name} is in general just a @code{ldaps://ldap.example.com}. A BaseDN parameter should never be -- cgit v1.2.3