Bug 17113 - Unable to search multi-domain Active Directory forest due LDAP required base
Summary: Unable to search multi-domain Active Directory forest due LDAP required base
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low normal (vote)
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-11 19:24 UTC by Sven Coenye
Modified: 2020-01-11 14:56 UTC (History)
2 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sven Coenye 2016-08-11 19:24:39 UTC
Auth_with_ldap currently prevents the use of an empty base due to the presence of

my $base = $ldap->{base} or die ldapserver_error('base');

An AD Global Catalog search will automatically query all domains in a forest if a blank base is specified, but otherwise limits the search to the domain matching the base. Not being able to specify an empty base makes things difficult if the forest contains disjoint domains that cannot be combined into a single search base.

(Uncertain how this interacts with the work on bug 8993, but being able to use the forest wide Global Catalog searches removes a lot of the contortions needed to direct requests to the correct host responsible for a domain.)