On 03.07.23 11:53, Peter Eisentraut wrote:
On 23.03.23 02:45, Anatoly Zaretsky wrote:
Comments in src/backend/libpq/auth.c [1] say:
(after successfully finding the final DN to check the user-supplied
password against)
/* Unbind and disconnect from the LDAP server */
and later
/*
* Need to re-initialize the LDAP connection, so that we can bind to
* it with a different username.
*/
But the protocol actually permits multiple subsequent authentications
("binds" in LDAP parlance) over a single connection [2].
Moreover, inspection of the code revision history of mod_authnz_ldap,
pam_ldap, Bugzilla, and MediaWiki LDAP authentication plugin, shows
that they've been doing this bind-after-search over the same LDAP
connection for ~20 years without any evidence of interoperability
troubles.
So, it seems like the whole connection re-initialization thing was
just a confusion caused by this very unfortunate "historical"
naming, and can be safely removed, thus saving quite a few
network round-trips, especially for the case of ldaps/starttls.
Your reasoning and your patch look correct to me.
committed
