为什么OpenLDAP认为我的代码未绑定到服务器？

问题描述

我正在尝试使用OpenLDAP C API对广告执行搜索查询。

#include <ldap.h>
#include <iostream>

int main(void)
{
    LDAP *ldp;
    auto ldap_version = LDAP_VERSION3;
    auto tls_cert_strat = LDAP_OPT_X_TLS_NEVER; //Never require identity cert from peer

    int err = ldap_initialize(&ldp,"ldap://1.1.1.1");
    if (err != LDAP_SUCCESS)
    {
        std::cerr << "unable to connect" << std::endl;
        return -1;
    }

    std::cout << "connected,err == " << ldap_err2string(err) << "\n";

    ldap_set_option(ldp,LDAP_OPT_PROTOCOL_VERSION,&ldap_version); //Set version to LDAPv3
    ldap_set_option(ldp,LDAP_OPT_X_TLS_REQUIRE_CERT,&tls_cert_strat);

    err = ldap_start_tls_s(ldp,nullptr,nullptr);
    if (err != LDAP_SUCCESS)
    {
        char* msg;
        ldap_get_option(ldp,LDAP_OPT_DIAGNOSTIC_MESSAGE,&msg);
        std::cerr << "unable to upgrade to TLS! err: " << ldap_err2string(err) << std::endl;
        std::cerr << "diagnostic msg: " << msg << "\n";
        ldap_memfree(msg);
        return -1;
    }

    std::cout << "start_tls request sent successfully,err == " << ldap_err2string(err) << "\n";

    err = ldap_tls_inplace(ldp);
    if (err != 1)
    {
        char* msg;
        ldap_get_option(ldp,&msg);
        std::cerr << "TLS handlers not installed! err: " << ldap_err2string(err) << std::endl;
        std::cerr << "diagnostic msg: " << msg << "\n";
        ldap_memfree(msg);
        return -1;
    }

    std::cout << "TLS handlers have been installed sucessfully" << "\n";

    //err = ldap_bind_s(ldp,"[email protected]","foo",LDAP_AUTH_SIMPLE);
    err = ldap_simple_bind_s(ldp,"foo");
    if (err != LDAP_SUCCESS)
    {
        char* msg;
        ldap_get_option(ldp,&msg);
        std::cerr << "Unable to bind to domain! err: " << ldap_err2string(err) << std::endl;
        std::cerr << "diagnostic msg: " << msg << "\n";
        ldap_memfree(msg);
        return -1;
    }

    std::cout << "Successfully bound to DC\n";

    char* base_dn = const_cast<char*>("dc=domain,dc=com");
    char* filters = const_cast<char*>("userPrincipalName=user");
    char* attr[4];

    attr[0] = const_cast<char*>("samaccountname");
    attr[1] = const_cast<char*>("cn");
    attr[2] = const_cast<char*>("mail");
    attr[3] = nullptr;

    LDAPMessage* ldp_msg;

    std::cout << "Executing LDAP search query\n";

    err = ldap_search_ext_s(ldp,base_dn,LDAP_SCOPE_SUBTREE,filters,attr,&ldp_msg);
    if (err != LDAP_SUCCESS)
    {
        char* msg;
        ldap_get_option(ldp,&msg);
        std::cerr << "Unable to search domain! err: " << ldap_err2string(err) << std::endl;
        std::cerr << "diagnostic msg: " << msg << "\n";
        ldap_memfree(msg);
        return -1;
    }

    std::cout << "Search executed successfully\n";

    return 0;
}

我将代码构建如下：

g++8 -D LDAP_DEPRECATED -g -std=c++17 my_ldap.cpp -o my_ldap -l ldap

但是当我执行它时，出现以下错误：

connected,err == Success
start_tls request sent successfully,err == Success
TLS handlers have been installed sucessfully
Successfully bound to DC
Executing LDAP search query
Unable to search domain! err: Operations error
diagnostic msg: 000004DC: LdapErr: DSID-0C0907E1,comment: In order to perform this operation a successful bind must be completed on the connection.,data 0,v2580

这是我感到困惑的地方：诊断消息说我没有绑定，但是鉴于ldap_simple_search_s返回了LDAP_SUCCESS，这意味着我确实成功了bind。

我会理解搜索是否失败，并显示一条消息，指出缺少授权，过滤器不匹配等。

我唯一想到的另一件事是我可能绑定了一个DN，并针对另一个DN执行了搜索，但是我检查了几次错字，却没有弹出任何文字。

仅供参考，ldap_bind_s(ldp,LDAP_AUTH_SIMPLE)具有相同的行为。 现在，如果DC不喜欢我的绑定/身份验证方法，我可以想象这会在bind调用期间引起错误，但是没有任何反应。

我曾考虑使用ldap_set_option手册页中介绍的库的内置调试功能，即LDAP_OPT_DEBUG_LEVEL选项，但是当我尝试使用一个库时，代码不会编译手册页中显示的选项中的一个（碰巧ldap.h中未定义这些选项）

我应该从什么角度去理解/解决这个问题？

解决方法

暂无找到可以解决该程序问题的有效方法，小编努力寻找整理中！

如果你已经找到好的解决方法，欢迎将解决方案带上本链接一起发送给小编。

小编邮箱:dio#foxmail.com (将#修改为@）