mirror of
https://git.openldap.org/openldap/openldap.git
synced 2024-12-21 03:10:25 +08:00
228 lines
8.6 KiB
Groff
228 lines
8.6 KiB
Groff
.TH LDAP_BIND 3 "RELEASEDATE" "OpenLDAP LDVERSION"
|
|
.\" $OpenLDAP$
|
|
.\" Copyright 1998-2003 The OpenLDAP Foundation All Rights Reserved.
|
|
.\" Copying restrictions apply. See COPYRIGHT/LICENSE.
|
|
.SH NAME
|
|
ldap_bind, ldap_bind_s, ldap_simple_bind, ldap_simple_bind_s, ldap_kerberos_bind_s, ldap_kerberos_bind1, ldap_kerberos_bind1_s, ldap_kerberos_bind2, ldap_kerberos_bind2_s, ldap_sasl_bind, ldap_sasl_bind_s, ldap_sasl_interactive_bind_s, ldap_parse_sasl_bind_result, ldap_unbind, ldap_unbind_s \- LDAP bind routines
|
|
.SH LIBRARY
|
|
OpenLDAP LDAP (libldap, -lldap)
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.B #include <ldap.h>
|
|
.LP
|
|
.BI "int ldap_bind(LDAP *" ld ", const char *" who ", const char *" cred ","
|
|
.RS
|
|
.BI "int " method ");"
|
|
.RE
|
|
.LP
|
|
.BI "int ldap_bind_s(LDAP *" ld ", const char *" who ", const char *" cred ","
|
|
.RS
|
|
.BI "int " method ");"
|
|
.RE
|
|
.LP
|
|
.BI "int ldap_simple_bind(LDAP *" ld ", const char *" who ", const char *" passwd ");"
|
|
.LP
|
|
.BI "int ldap_simple_bind_s(LDAP *" ld ", const char *" who ", const char *" passwd ");"
|
|
.LP
|
|
.BI "int ldap_kerberos_bind_s(LDAP *" ld ", const char *" who ");"
|
|
.LP
|
|
.BI "int ldap_kerberos_bind1(LDAP *" ld ", const char *" who ");"
|
|
.LP
|
|
.BI "int ldap_kerberos_bind1_s(LDAP *" ld ", const char *" who ");"
|
|
.LP
|
|
.BI "int ldap_kerberos_bind2(LDAP *" ld ", const char *" who ");"
|
|
.LP
|
|
.BI "int ldap_kerberos_bind2_s(LDAP *" ld ", const char *" who ");"
|
|
.LP
|
|
.BI "int ldap_sasl_bind(LDAP *" ld ", const char *" dn ", const char *" mechanism ","
|
|
.RS
|
|
.BI "struct berval *" cred ", LDAPControl *" sctrls "[],"
|
|
.BI "LDAPControl *" cctrls "[], int *" msgidp ");"
|
|
.RE
|
|
.LP
|
|
.BI "int ldap_sasl_bind_s(LDAP *" ld ", const char *" dn ", const char *" mechanism ","
|
|
.RS
|
|
.BI "struct berval *" cred ", LDAPControl *" sctrls "[],"
|
|
.BI "LDAPControl *" cctrls "[], struct berval **" servercredp ");"
|
|
.RE
|
|
.LP
|
|
.BI "int ldap_parse_sasl_bind_result(LDAP *" ld ", LDAPMessage *" res ","
|
|
.RS
|
|
.BI "struct berval **" servercredp ", int " freeit ");"
|
|
.RE
|
|
.LP
|
|
.BI "int ldap_sasl_interactive_bind_s(LDAP *" ld ", const char *" dn ","
|
|
.RS
|
|
.BI "const char *" mechs ", struct berval *" cred ","
|
|
.BI "LDAPControl *" sctrls "[], LDAPControl *" cctrls "[],"
|
|
.BI "unsigned " flags ", LDAP_SASL_INTERACT_PROC *" interact ","
|
|
.BI "void *" defaults ");"
|
|
.RE
|
|
.LP
|
|
.BI "int ldap_unbind(LDAP *" ld ");"
|
|
.LP
|
|
.BI "int ldap_unbind_s(LDAP *" ld ");"
|
|
.\" .LP
|
|
.\" .ft B
|
|
.\" void ldap_set_rebind_proc( ld, rebindproc )
|
|
.\" .ft
|
|
.\" LDAP *ld;
|
|
.\" int (*rebindproc)();
|
|
.SH DESCRIPTION
|
|
.LP
|
|
These routines provide various interfaces to the LDAP bind operation.
|
|
After an association with an LDAP server is made using
|
|
.BR ldap_init (3),
|
|
an LDAP bind operation should be performed before other operations are
|
|
attempted over the connection. An LDAP bind is required when using
|
|
Version 2 of the LDAP protocol; it is optional for Version 3 but is
|
|
usually needed due to security considerations.
|
|
.LP
|
|
There are many types of bind calls, providing simple authentication, Kerberos
|
|
version 4 authentication, and general routines to do either one, as
|
|
well as calls using
|
|
.B SASL
|
|
(Simple Authentication and Security Layer)
|
|
that can negotiate one of many different kinds of authentication.
|
|
Both synchronous and asynchronous versions of each variant of the bind
|
|
call are provided. All routines
|
|
take \fIld\fP as their first parameter, as returned from
|
|
.BR ldap_init (3).
|
|
.LP
|
|
Kerberos version 4 has been superseded by Kerberos version 5, and the
|
|
Kerberos version 4 support is only provided for backward compatibility. The
|
|
SASL interfaces should be used for new applications. SASL provides
|
|
a general interface for using Kerberos versions 4 and 5 and many other
|
|
security systems.
|
|
.LP
|
|
.SH SIMPLE AUTHENTICATION
|
|
The simplest form of the bind call is
|
|
.BR ldap_simple_bind_s() .
|
|
It takes the DN to bind as in \fIwho\fP, and the userPassword associated
|
|
with the entry in \fIpasswd\fP. It returns an LDAP error indication
|
|
(see
|
|
.BR ldap_error (3)).
|
|
The
|
|
.B ldap_simple_bind()
|
|
call is asynchronous,
|
|
taking the same parameters but only initiating the bind operation and
|
|
returning the message id of the request it sent. The result of the
|
|
operation can be obtained by a subsequent call to
|
|
.BR ldap_result (3).
|
|
.SH KERBEROS AUTHENTICATION
|
|
If the LDAP library and LDAP server being contacted have been
|
|
compiled with the KERBEROS option defined,
|
|
Kerberos version 4 authentication can be performed. As mentioned above,
|
|
these Kerberos routines are provided only for backward compatibility.
|
|
.LP
|
|
These routines assume the user already
|
|
has obtained a ticket granting ticket. The routines take \fIwho\fP, the DN
|
|
of the entry to bind as. The
|
|
.B ldap_kerberos_bind_s()
|
|
routine does both steps of the Kerberos binding process synchronously. The
|
|
.B ldap_kerberos_bind1_s()
|
|
and
|
|
.B ldap_kerberos_bind2_s()
|
|
routines allow synchronous access to the
|
|
individual steps, authenticating to the LDAP server and X.500 DSA, respectively.
|
|
The
|
|
.B ldap_kerberos_bind1()
|
|
and
|
|
.B ldap_kerberos_bind2()
|
|
routines provide equivalent asynchronous access.
|
|
.LP
|
|
The
|
|
.B ldap_kerberos_bind_s()
|
|
routine is used to perform both authentication steps when contacting
|
|
an LDAP server that is a gateway to an X.500 DSA. This kind of server
|
|
configuration is only supported in the (very old) University of Michigan LDAP
|
|
release. The OpenLDAP package no longer provides this gateway server.
|
|
The standalone LDAP server provided in OpenLDAP may still be configured
|
|
with Kerberos version 4 support, but it only requires one authentication
|
|
step, and will return an error if the second step is attempted. Therefore,
|
|
only the
|
|
.B ldap_kerberos_bind1()
|
|
routine or its synchronous equivalent may be used when contacting an
|
|
OpenLDAP server.
|
|
.SH GENERAL AUTHENTICATION
|
|
The
|
|
.B ldap_bind()
|
|
and
|
|
.B ldap_bind_s()
|
|
routines can be used when the
|
|
authentication method to use needs to be selected at runtime. They
|
|
both take an extra \fImethod\fP parameter selecting the authentication
|
|
method to use. It should be set to one of LDAP_AUTH_SIMPLE,
|
|
LDAP_AUTH_KRBV41, or LDAP_AUTH_KRBV42, to select simple authentication,
|
|
Kerberos authentication to the LDAP server, or Kerberos authentication
|
|
to the X.500 DSA, respectively.
|
|
.B ldap_bind()
|
|
returns the message id of the request it initiates.
|
|
.B ldap_bind_s()
|
|
returns an LDAP error indication.
|
|
.SH SASL AUTHENTICATION
|
|
Description still under construction...
|
|
.SH UNBINDING
|
|
The
|
|
.B ldap_unbind()
|
|
call is used to unbind from the directory,
|
|
terminate the current association, and free the resources contained
|
|
in the \fIld\fP structure. Once it is called, the connection to
|
|
the LDAP server is closed, and the \fIld\fP structure is invalid.
|
|
The
|
|
.B ldap_unbind_s()
|
|
call is just another name for
|
|
.BR ldap_unbind() ;
|
|
both of these calls are synchronous in nature.
|
|
.\" .SH RE-BINDING WHILE FOLLOWING REFERRALS
|
|
.\" The
|
|
.\" .B ldap_set_rebind_proc()
|
|
.\" call is used to set a routine that will be called back to obtain bind
|
|
.\" credentials used when a new server is contacted during the following of
|
|
.\" an LDAP referral. Note that this function is only available when the
|
|
.\" LDAP libraries are compiled with LDAP_REFERRALS defined and is only
|
|
.\" used when the ld_options field in the LDAP structure has
|
|
.\" LDAP_OPT_REFERRALS set (this is the default). If
|
|
.\" .B ldap_set_rebind_proc()
|
|
.\" is never called, or if it is called with a NULL \fIrebindproc\fP
|
|
.\" parameter, an unauthenticated simple LDAP bind will always be done
|
|
.\" when chasing referrals.
|
|
.\" .LP
|
|
.\" \fIrebindproc\fP should be a function that is declared like this:
|
|
.\" .LP
|
|
.\" .nf
|
|
.\" int rebindproc( LDAP *ld, char **whop, char **credp,
|
|
.\" int *methodp, int freeit );
|
|
.\" .fi
|
|
.\" .LP
|
|
.\" The LDAP library will first call the rebindproc to obtain the
|
|
.\" referral bind credentials, and the \fIfreeit\fP parameter will be
|
|
.\" zero. The \fIwhop\fP, \fIcredp\fP, and \fImethodp\fP should be
|
|
.\" set as appropriate. If the rebindproc returns LDAP_SUCCESS, referral
|
|
.\" processing continues, and the rebindproc will be called a second
|
|
.\" time with \fIfreeit\fP non-zero to give your application a chance to
|
|
.\" free any memory allocated in the previous call.
|
|
.\" .LP
|
|
.\" If anything but LDAP_SUCCESS is returned by the first call to
|
|
.\" the rebindproc, then referral processing is stopped and that error code
|
|
.\" is returned for the original LDAP operation.
|
|
.SH ERRORS
|
|
Asynchronous routines will return -1 in case of error, setting the
|
|
\fIld_errno\fP parameter of the \fIld\fP structure. Synchronous
|
|
routines return whatever \fIld_errno\fP is set to. See
|
|
.BR ldap_error (3)
|
|
for more information.
|
|
.SH SEE ALSO
|
|
.BR ldap (3),
|
|
.BR ldap_error (3),
|
|
.BR ldap_open (3),
|
|
.B RFC 2222
|
|
(http://www.ietf.org),
|
|
.B Cyrus SASL
|
|
(http://asg.web.cmu.edu/sasl/)
|
|
.SH ACKNOWLEDGEMENTS
|
|
.B OpenLDAP
|
|
is developed and maintained by The OpenLDAP Project (http://www.openldap.org/).
|
|
.B OpenLDAP
|
|
is derived from University of Michigan LDAP 3.3 Release.
|