--- a/Auth_with_ldap.pm 2021-07-28 16:07:06.881785587 -0400 +++ b/Auth_with_ldap.pm 2021-07-28 16:06:36.333919147 -0400 @@ -126,7 +126,10 @@ # first, LDAP authentication if ( $ldap->{auth_by_bind} ) { my $principal_name; - if ( $config{anonymous} ) { + + # If anon bind, bind and search + + if ( $config{anonymous} ) { # Perform an anonymous bind my $res = $db->bind; @@ -134,14 +137,38 @@ warn "Anonymous LDAP bind failed: " . description($res); return 0; } - + # Perform a LDAP search for the given username my $search = search_method( $db, $userid ) - or return 0; # warnings are in the sub + or return 0; # warnings are in the sub + $userldapentry = $search->shift_entry; + $principal_name = $userldapentry->dn; + } + # if not anon bind, but we have a service account, search wtih that. + # $ldapname is the service account, if that is defined we assume + # we search wtih that. + + elsif ($ldapname) { + + # Perform an authenticated bind with the service account + my $res = $db->bind($ldapname, password => $ldappassword); + if ( $res->code ) { + warn "Authenticated LDAP bind failed: " . description($res); + return 0; + } + + # Perform a LDAP search for the given username + my $search = search_method( $db, $userid ) + or return 0; # warnings are in the sub $userldapentry = $search->shift_entry; $principal_name = $userldapentry->dn; } - else { + + # And if we don't have a service account, we use principal_name to + # figoure out our base DN. Hope all our users are in the same OU. + + else { + $principal_name = $ldap->{principal_name}; if ( $principal_name and $principal_name =~ /\%/ ) { $principal_name = sprintf( $principal_name, $userid );