diff options
| author | Peter Eisentraut <peter@eisentraut.org> | 2023-07-09 08:22:34 +0200 |
|---|---|---|
| committer | Peter Eisentraut <peter@eisentraut.org> | 2023-07-09 08:51:46 +0200 |
| commit | f8d03ea727e48c894174c4e5e6ebafc3a17ab3f7 (patch) | |
| tree | be1e69c5a7e81c800da5c867c4fbe6f6c973be32 /src/backend/libpq/auth.c | |
| parent | 89333db963af20988fc407463ea626b1c41404e8 (diff) | |
| download | postgresql-f8d03ea727e48c894174c4e5e6ebafc3a17ab3f7.tar.gz postgresql-f8d03ea727e48c894174c4e5e6ebafc3a17ab3f7.zip | |
Remove unnecessary unbind in LDAP search+bind mode
Comments in src/backend/libpq/auth.c say: (after successfully finding
the final DN to check the user-supplied password against)
/* Unbind and disconnect from the LDAP server */
and later
/*
* Need to re-initialize the LDAP connection, so that we can bind to
* it with a different username.
*/
But the protocol actually permits multiple subsequent authentications
("binds") over a single connection.
So, it seems like the whole connection re-initialization thing was
just a confusion and can be safely removed, thus saving quite a few
network round-trips, especially for the case of ldaps/starttls.
Author: Anatoly Zaretsky <anatoly.zaretsky@gmail.com>
Discussion: https://www.postgresql.org/message-id/flat/CALbq6kmJ-1+58df4B51ctPfTOSyPbY8Qi2=ct8oR=i4TamkUoQ@mail.gmail.com
Diffstat (limited to 'src/backend/libpq/auth.c')
| -rw-r--r-- | src/backend/libpq/auth.c | 25 |
1 files changed, 0 insertions, 25 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index a98b934a8e2..2b119e9ca45 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -2611,31 +2611,6 @@ CheckLDAPAuth(Port *port) pfree(filter); ldap_memfree(dn); ldap_msgfree(search_message); - - /* Unbind and disconnect from the LDAP server */ - r = ldap_unbind_s(ldap); - if (r != LDAP_SUCCESS) - { - ereport(LOG, - (errmsg("could not unbind after searching for user \"%s\" on server \"%s\"", - fulluser, server_name))); - pfree(passwd); - pfree(fulluser); - return STATUS_ERROR; - } - - /* - * Need to re-initialize the LDAP connection, so that we can bind to - * it with a different username. - */ - if (InitializeLDAPConnection(port, &ldap) == STATUS_ERROR) - { - pfree(passwd); - pfree(fulluser); - - /* Error message already sent */ - return STATUS_ERROR; - } } else fulluser = psprintf("%s%s%s", |