LDAP_BIND(3LDAP) LDAP Library Functions LDAP_BIND(3LDAP)
NAME
ldap_bind, ldap_bind_s, ldap_sasl_bind, ldap_sasl_bind_s,
ldap_simple_bind, ldap_simple_bind_s, ldap_unbind, ldap_unbind_s,
ldap_unbind_ext, ldap_set_rebind_proc, ldap_sasl_interactive_bind_s -
LDAP bind functions
SYNOPSIS
cc [
flag... ]
file... -lldap [
library... ]
#include <lber.h>
#include <ldap.h>
int ldap_bind(
LDAP *ld,
char *who,
char *cred,
int method);
int ldap_bind_s(
LDAP *ld,
char *who,
char *cred,
int method);
int ldap_simple_bind(
LDAP *ld,
char *who,
char *passwd);
int ldap_simple_bind_s(
LDAP *ld,
char *who,
char *passwd);
int ldap_unbind(
LDAP *ld);
int ldap_unbind_s(
LDAP *ld);
int ldap_unbind_ext(
LDAP *ld,
LDAPControl **serverctrls,
LDAPControl **clientctrls);
void ldap_set_rebind_proc(
LDAP *ld,
int (*rebindproc);
int ldap_sasl_bind(
LDAP *ld,
char *dn,
char *mechanism,
struct berval **serverctrls,
LDAPControl **clientctrls,
int *msgidp);
int ldap_sasl_bind_s(
LDAP *ld,
char *dn,
char *mechanism,
struct berval *cred,
LDAPControl **serverctrls,
LDAPControl **clientctrls);
int ldap_sasl_interactive_bind_s(
LDAP *ld,
char *dn,
char *saslMechanism,
LDAPControl **sctrl,
LDAPControl **cctrl,
LDAPControl **unsigned flags,
LDAP_SASL_INTERACT_PROC *callback,
void *defaults);
DESCRIPTION
These functions provide various interfaces to the LDAP bind operation.
After a connection is made to an LDAP server, the
ldap_bind() function
returns the message ID of the request initiated. The
ldap_bind_s() function returns an LDAP error code.
Simple Authentication
The simplest form of the bind call is
ldap_simple_bind_s(). The function
takes the DN (Distinguished Name) of the
dn parameter and the
userPassword associated with the entry in
passwd to return an LDAP error
code. See
ldap_error(3LDAP).
The
ldap_simple_bind() call is asynchronous. The function takes the same
parameters as
ldap_simple_bind_s() but initiates the bind operation and
returns the message ID of the request sent. The result of the operation
can be obtained by a subsequent call to
ldap_result(3LDAP).
General Authentication
The
ldap_bind() and
ldap_bind_s() functions are used to select the
authentication method at runtime. Both functions take an extra
method parameter to set the authentication method. For simple authentication,
the
method parameter is set to
LDAP_AUTH_SIMPLE. The
ldap_bind() function
returns the message id of the request initiated. The
ldap_bind_s() function returns an LDAP error code.
SASL Authentication
The
ldap_sasl_bind() and
ldap_sasl_bind_s() functions are used for
general and extensible authentication over LDAP through the use of the
Simple Authentication Security Layer. The routines both take the
DN to
bind as the authentication method. A dotted-string representation of an
OID identifies the method, and the
berval structure holds the
credentials. The special constant value
LDAP_SASL_SIMPLE ("") can be
passed to request simple authentication. Otherwise, the
ldap_simple_bind() function or the
ldap_simple_bind_s() function can be
used.
The
ldap_sasl_interactive_bind_s() helper function takes its data and
performs the necessary
ldap_sasl_bind() and associated SASL library
authentication sequencing with the LDAP server that uses the provided
connection (
ld).
Upon a successful bind, the
ldap_sasl_bind() function will, if negotiated
by the SASL interface, install the necessary internal
libldap plumbing to
enable SASL integrity and privacy (over the wire encryption) with the
LDAP server.
The
LDAP_SASL_INTERACTIVE option flag is passed to the libldap API
through the flags argument of the API. The flag tells the API to use the
SASL interactive mode and to have the API request SASL authentication
data through the
LDAP_SASL_INTERACTIVE_PROC callback as needed. The
callback provided is in the form:
typedef int (LDAP_SASL_INTERACT_PROC)
(LDAP *ld, unsigned flags, void* defaults, void *interact);
The user-provided SASL callback is passed to the current LDAP connection
pointer, the current flags field, an optional pointer to user-defined
data, and the list of
sasl_interact_t authentication values requested by
libsasl(3LIB) to complete authentication.
The user-defined callback collects and returns the authentication
information in the
sasl_interact_t array according to
libsasl rules. The
authentication information can include user IDs, passwords, realms, or
other information defined by SASL. The SASL library uses this date during
sequencing to complete authentication.
Unbinding
The
ldap_unbind() call is used to unbind from a directory, to terminate
the current association, and to free the resources contained in the
ld structure. Once the function is called, the connection to the LDAP server
is closed and the
ld structure is invalid. The
ldap_unbind_s() and
ldap_unbind() calls are identical and synchronous in nature.
The
ldap_unbind_ext() function is used to unbind from a directory, to
terminate the current association, and to free the resources contained in
the LDAP structure. Unlike
ldap_unbind() and
ldap_unbind_s(), both server
and client controls can be explicitly included with
ldap_unbind_ext() requests. No server response is made to an unbind request and responses
should not be expected from server controls included with unbind
requests.
Rebinding While Following Referral
The
ldap_set_rebind_proc() call is used to set a function called back to
obtain bind credentials. The credentials are used when a new server is
contacted after an LDAP referral. If
ldap_set_rebind_proc() is never
called, or if it is called with a
NULL rebindproc parameter, an
unauthenticated simple LDAP bind is always done when chasing referrals.
The
rebindproc() function is declared as shown below:
int rebindproc(LDAP *ld, char **whop, char **credp,
int *methodp, int freeit);
The LDAP library first calls the
rebindproc() to obtain the referral bind
credentials. The
freeit parameter is zero. The
whop,
credp, and
methodp parameters should be set as appropriate. If
rebindproc() returns
LDAP_SUCCESS, referral processing continues. The
rebindproc() is called
a second time with a non-zero
freeit value to give the application a
chance to free any memory allocated in the previous call.
If anything but
LDAP_SUCCESS is returned by the first call to
rebindproc(), referral processing is stopped and the error code is
returned for the original LDAP operation.
RETURN VALUES
Make a call to
ldap_result(3LDAP) to obtain the result of a bind
operation.
ERRORS
Asynchronous functions will return
-1 in case of error. See
ldap_error(3LDAP) for more information on error codes returned. If no
credentials are returned, the result parameter is set to
NULL.
ATTRIBUTES
See
attributes(7) for descriptions of the following attributes:
+--------------------+-----------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+--------------------+-----------------+
|Interface Stability | Evolving |
+--------------------+-----------------+
|MT-Level | Safe |
+--------------------+-----------------+
SEE ALSO
ldap(3LDAP),
ldap_error(3LDAP),
ldap_open(3LDAP),
ldap_result(3LDAP),
libsasl(3LIB),
attributes(7) January 14, 2004
LDAP_BIND(3LDAP)