database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-27 12:41:57 +03:00
Code Activity

Add DNS SRV support for LDAP server discovery.

Browse Source 
LDAP servers can be advertised on a network with RFC 2782 DNS SRV
records.  The OpenLDAP command-line tools automatically try to find
servers that way, if no server name is provided by the user.  Teach
PostgreSQL to do the same using OpenLDAP's support functions, when
building with OpenLDAP.

For now, we assume that HAVE_LDAP_INITIALIZE (an OpenLDAP extension
available since OpenLDAP 2.0 and also present in Apple LDAP) implies
that you also have ldap_domain2hostlist() (which arrived in the same
OpenLDAP version and is also present in Apple LDAP).

Author: Thomas Munro
Reviewed-by: Daniel Gustafsson
Discussion: https://postgr.es/m/CAEepm=2hAnSfhdsd6vXsM6VZVN0br-FbAZ-O+Swk18S5HkCP=A@mail.gmail.com
This commit is contained in:
Thomas Munro
2019-03-21 15:19:03 +13:00
parent 8aa9dd74b3
commit 0f086f84ad
3 changed files with 130 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
doc/src/sgml/client-auth.sgml
View File

@ -1655,7 +1655,8 @@ ldap[s]://<replaceable>host</replaceable>[:<replaceable>port</replaceable>]/<rep
</para>
<para>
LDAP URLs are currently only supported with OpenLDAP, not on Windows.
LDAP URLs are currently only supported with
<productname>OpenLDAP</productname>, not on Windows.
</para>
</listitem>
</varlistentry>
@ -1678,6 +1679,15 @@ ldap[s]://<replaceable>host</replaceable>[:<replaceable>port</replaceable>]/<rep
<literal>ldapsearchattribute=uid</literal>.
</para>
<para>
If <productname>PostgreSQL</productname> was compiled with
<productname>OpenLDAP</productname> as the LDAP client library, the
<literal>ldapserver</literal> setting may be omitted. In that case, a
list of hostnames and ports is looked up via RFC 2782 DNS SRV records.
The name <literal>_ldap._tcp.DOMAIN</literal> is looked up, where
<literal>DOMAIN</literal> is extracted from <literal>ldapbasedn</literal>.
</para>
<para>
Here is an example for a simple-bind LDAP configuration:
<programlisting>
@ -1723,6 +1733,15 @@ host ... ldap ldapserver=ldap.example.net ldapbasedn="dc=example, dc=net" ldapse
</programlisting>
</para>
<para>
Here is an example for a search+bind configuration that uses DNS SRV
discovery to find the hostname(s) and port(s) for the LDAP service for the
domain name <literal>example.net</literal>:
<programlisting>
host ... ldap ldapbasedn="dc=example,dc=net"
</programlisting>
</para>
<tip>
<para>
Since LDAP often uses commas and spaces to separate the different