-
Notifications
You must be signed in to change notification settings - Fork 39
Description
Is your feature request related to a problem? Please describe.
When using Kerberos authentication and LDAPS protocol on Windows, with some (not all) LDAP server products, Bind
fails with message:
Server Down. Result: 81. Method: ldap_connect
After some experimentation with Microsoft's DirectoryServices package, I've figured out that in this case, the client certificate should be set to null
, which is currently not possible because of this line:
https://github.com/flamencist/ldap4net/blob/master/LdapForNet/Native/LdapNativeWindows.cs#L44
That should set certificateHandle
to IntPtr.Zero
and return false
when the certificate is null
.
Describe the solution you'd like
SetClientCertificate
should accept null
and handle this case properly in the native callback.
Describe alternatives you've considered
Workaround is to call SetOption
, and pass a native callback that returns false
:
connection.SetOption(
Native.LdapOption.LDAP_OPT_CLIENT_CERTIFICATE,
Marshal.GetFunctionPointerForDelegate<QUERYCLIENTCERT>(
(IntPtr connection, IntPtr trustedCAs, ref IntPtr certificateHandle) =>
{
certificateHandle = IntPtr.Zero;
return false;
}));
Note: you have to copy the definition of QUERYCLIENTCERT
because it's internal:
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
internal delegate bool QUERYCLIENTCERT(IntPtr connection, IntPtr trustedCAs, ref IntPtr certificateHandle);
Additional context
This bug/limitation might be the root cause of #106