Details
-
Type:
Bug
-
Status:
Resolved
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 1.7.1
-
Fix Version/s: 1.9.0
-
Component/s: Zend_Auth_Adapter_Ldap
-
Labels:None
-
Tags:
Description
We were looking into authenticating our webapp users based on their email addresses via LDAP, but if you pass an arbitrary email address to a Zend_Auth_Adapter_Ldap:
1. WITH an accountDomainName set (and inferred accountCanonicalForm = 4), it treats the email address as a domain-qualified username and the authentication attempt fails for any user whose email domain is not accountDomainName - since the LDAP server is understood to be an authority only for accountDomainName, you get a domain mismatch.
2. WITHOUT an accountDomainName set (and inferred accountCanonicalForm = 2), it canonicalizes the "@" and everything after it right off the domain, and you end up with only the local part of the user's email address being passed to the LDAP server, which of course doesn't match if you're querying by email address with the following (correct) filter: "(&(objectClass=inetOrgPerson)(mail=%s))", as opposed to the default.
If you try to force accountCanonicalForm = 4 to include the domain without specifying an accountDomainName, it throws an exception.
To verify the behavior we were seeing, we tried using cn instead of mail as the RDN by setting cn= the email address minus its "@", and set the filter to "(&(objectClass=inetOrgPerson)(cn=%s))". This authenticated successfully.
An email address is not a qualified account name. It is just an email address. What you want is basically ACCTNAME_FORM_EMAIL = 5 with corresponding logic to canonicalize the account name to the mail attribute. Which is to say Zend_Auth_Adapter_Ldap simply does not implement this.
Note that I think this would require querying the LDAP server which would slow things down a little.
I agree this should be implemented but I will not be active on this project for the foreseeable future.
You could extend Zend_Ldap to add the desired behavior (and then you would have to also extend Zend_Auth_Adapter_Ldap so that it used your extended Zend_Ldap).
Finally, this should really be assigned to Zend_Ldap and not Zend_Auth_Adapter_Ldap as Zend_Ldap is where the actual name canonicalization occurs.