On 03.07.23 11:53, Peter Eisentraut wrote:
> On 23.03.23 02:45, Anatoly Zaretsky wrote:
>> Comments in src/backend/libpq/auth.c [1] say:
>> (after successfully finding the final DN to check the user-supplied
>> password against)
>> /* Unbind and disconnect from the LDAP server */
>> and later
>> /*
>> * Need to re-initialize the LDAP connection, so that we can bind to
>> * it with a different username.
>> */
>>
>> But the protocol actually permits multiple subsequent authentications
>> ("binds" in LDAP parlance) over a single connection [2].
>> Moreover, inspection of the code revision history of mod_authnz_ldap,
>> pam_ldap, Bugzilla, and MediaWiki LDAP authentication plugin, shows
>> that they've been doing this bind-after-search over the same LDAP
>> connection for ~20 years without any evidence of interoperability
>> troubles.
>
>> So, it seems like the whole connection re-initialization thing was
>> just a confusion caused by this very unfortunate "historical"
>> naming, and can be safely removed, thus saving quite a few
>> network round-trips, especially for the case of ldaps/starttls.
>
> Your reasoning and your patch look correct to me.
committed
