janiussyafiq opened a new pull request, #13762: URL: https://github.com/apache/apisix/pull/13762
### Description Adds the `ldap-auth-advanced` plugin (priority 2541), bringing Kong `ldap-auth-advanced` parity for core authentication: search-then-bind (AD `sAMAccountName` shape), service-account or anonymous search bind, `user_dn` Consumer association, LDAPS/StartTLS, LDAP filter-injection defense, and a strict 401-vs-500 auth/transport error split. This is part 1 of 3 (core authentication); group collection/authorization and credential caching/anonymous-consumer follow in separate PRs. Prior discussion in #8958. This PR also bumps `lua-resty-ldap` 0.1.0 -> 0.3.0. Under 0.1.0, the existing `ldap-auth` plugin's `tls_verify` option was a silent no-op (the library read a different field name); 0.3.0 fixes this, so `tls_verify: true` configs now perform real certificate verification. This also required regenerating `t/certs/localhost_slapd_cert.pem` (same key, same test CA) to add a `subjectAltName` (`DNS:test.com, DNS:localhost, IP:127.0.0.1`) — the old cert had `CN=test.com` but no SAN, and nginx's hostname verification does not fall back to CN, so the newly-real `ldap-auth` TLS-verify test started failing a certificate host-mismatch check that the 0.1.0 bug had been silently masking. #### Which issue(s) this PR fixes: Related: #8958 ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change (docs in a follow-up PR) - [x] I have verified that this change is backward compatible (the `lua-resty-ldap` bump activates real `tls_verify` certificate verification, previously a silent no-op under 0.1.0 -- see description) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
