120128 - Offer ability to use Net::LDAP for user authentication

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, enhancement, P3)

Description

[Dave Miller [:justdave]]

The patch I'm about to attach was submitted by Elliot Otchet
([e-mail]).  This patch changes Bugzilla to use Net::LDAP instead of
Mozilla::LDAP.

I think the proper course of action for us is to provide a choice, so we'll
probably need to modify this patch to use conditionals based on a preference
instead of doing just the one.

Comment 1

[Dave Miller [:justdave]]

Attachment: Patch to use Net::LDAP instead of Mozilla::LDAP

Comment 2

[John Williams]

Attachment: patch to use Net::LDAP *or* Mozilla::LDAP

This patch allows the administrator the option of using either Mozilla::LDAP or
Net::LDAP.  It also includes a couple enhancements to both: 1) the ability to
set the loginname attribute (normally 'uid'), 2) the ability bind initially
with a dn/password instead of anonymously.

Comment 3

[GavinS]

Quick question: what is the difference between Mozilla::LDAP and Net::LDAP? Does
the Net:: version still require the Netscape LDAP SDK?

Comment 4

[John Williams]

Net::LDAP uses the OpenLDAP libraries instead of Netscape's SDK.
No, Netscape's LDAP SDK is not required if you use Net::LDAP.

Comment 5

[Dave Miller [:justdave]]

*** Bug 158630 has been marked as a duplicate of this bug. ***

Comment 6

[Dave Miller [:justdave]]

I ended up rewriting this into the Bugzilla::Auth::LDAP module which plugs into
the new auth system Brad Baetz wrote, and is included in the latest megapatch on
bug 180642.  I ended up ditching the Mozilla::LDAP support.  If anyone really
strongly feels we need to still support it, I suppose we can add a module for
that, but I'm pretty sure Net::LDAP can connect to a Netscape branded server. 
Feel free to correct me if I'm wrong though.

Comment 7

[Bradley Baetz (:bbaetz)]

We now use Net::LDAP exclusively

Comment 8

[Dave Miller [:justdave]]

NOTICE to anyone using 2.16.x wishing to apply the attached patches rather than
upgrading to 2.17.4 in order to get Net::LDAP support...  please see bug 207556
before applying either of these patches.  There is a major security hole here
(any password works as long as the user exists) that you will need to resolve if
you apply these patches.  We ended up doing something different in 2.17.4 (bug
180642), and that version works okay (but it's a much larger patch)