_ldapauth_user_lookup seems to loop through all the possible base DNs, even when it has already found a match. This might slow things down, though I don't understand the logic enough to tell if it keeps looping in case there could be a "better match".

Comments

kreaper’s picture

kreaper commented
Assigned: Unassigned » kreaper
Category: bug » task
Status: Active » Postponed (maintainer needs more info)

markdionne

this is from the legacy codebase. I am not sure how many implementations have actually come to rely on this ?
Based on the code flow, the routine is designed to return the last match.

In LDAP-speak, I would think that given multiple base DNs, the most specific successful match should be used.

I would like to carry out a discussion about this and see what others think before committing to change the code flow.

johnbarclay’s picture

johnbarclay commented
Status: Postponed (maintainer needs more info) » Closed (won't fix)

Closing 4.7 issues to clean out issue queue.