LDAP connection restricted to dynamic bind

[viharm]

Currently phpLDAPauth uses anonymous dynamic bind for all LDAP connections.

This functionality must be extended to include authenticated bind option to bind with a separate user.

[viharm]

Suggest adding this through the PHP ldap_bind function.

Additional checks:

• Add checks for bind credentials in input.
• Add flags for authenticated bind, and if separate credentials not provided then use the credentials which will be subsequently used for authentication.

[viharm]

Assessment of issue was incorrect. phpLDAPauth does not use unauthenticated bind.

The credentials of the user being validated are used to perform authenticated bind.

The real issue is to have a logic for having a separate user to bind the directory with; and then authenticate the target user by performing search, etc.

This is significantly differently to the current architecture of phpLDAPauth, but is a worthwhile improvement to the functionality. This will require a major rewrite of the authentication logic.

[viharm]

Even if LDAP directory servers require a static user to bind with the directory, the counter-proposal is to ignore such static credentials and use the target credentials to bind. This ensures that the authentication process is carried out by the directory service.

The only other alternative to deploy this logic is as follows:

1. The static user binds to the directory by authenticating themself.
2. The static user searches the directory for the target user (user being authenticated).
3. If found, the static user retrieves the target user’s details from the directory.
4. phpLDAPauth compares the supplied password with the one stored in the directory. This may need pass the hashing method to phpLDAPauth.

A separate study will need to be carried out if LDAP servers allow reading of users' passwords by a static user.

This will be demoted to a low-priority item, and will only be done if there is sufficient demand. Retrieving user’s details will be done as part of #7.

‌

[viharm]

Even if LDAP directory servers require a static user to bind with the directory, the counter-proposal is to ignore such static credentials and use the target credentials to bind. This ensures that the authentication process is carried out by the directory service.

The only other alternative to deploy this logic is as follows:

The static user binds to the directory by authenticating themself.

The static user searches the directory for the target user (user being authenticated).

If found, the static user retrieves the target user’s details from the directory.

phpLDAPauth compares the supplied password with the one stored in the directory. This may need pass the hashing method to phpLDAPauth.

A separate study will need to be carried out if LDAP servers allow reading of users' passwords by a static user.

This will be demoted to a low-priority item, and will only be done if there is sufficient demand. Retrieving user’s details will be done as part of #7.