From e5def4bc3e693a1b5a7996058308cc7ad248c9c9 Mon Sep 17 00:00:00 2001
From: LukasK13 <spam.lukas.klass@gmail.com>
Date: Thu, 27 Feb 2020 21:15:22 +0100
Subject: [PATCH 1/2] Allow service user for determining DN

---
 ldap-auth.sh | 36 +++++++++++++++++++++++++-----------
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/ldap-auth.sh b/ldap-auth.sh
index ad6ffe8..284b57b 100755
--- a/ldap-auth.sh
+++ b/ldap-auth.sh
@@ -90,6 +90,13 @@ USERNAME_PATTERN='^[a-z|A-Z|0-9|_|-|.]+$'
 # You could process them in your own on_auth_success hook.
 #ATTRS="cn"
 
+# If you want to use a service user account for determining the dn
+# (i.e. if your server uses cn= instead of uid= for the dn)
+# In this case, BASEDN should be look like "ou=people,dc=example,dc=com"
+# and SCOPE should be set to "sub".
+# BINDDN="cn=serviceUser,ou=people,dc=example,dc=com"
+# BINDPASS="passwordOfServiceUser"
+
 # When the timeout (in seconds) is exceeded (e.g. due to slow networking),
 # authentication fails.
 TIMEOUT=3
@@ -129,17 +136,24 @@ ldap_auth_curl() {
 }
 
 ldap_auth_ldapsearch() {
-	common_opts="-o nettimeout=$TIMEOUT -H $SERVER -x"
-	[ -z "$DEBUG" ] || common_opts="-v $common_opts"
-	if [ -z "$BASEDN" ]; then
-		output=$(ldapwhoami $common_opts -D "$USERDN" -w "$password")
-	else
-		output=$(ldapsearch $common_opts -LLL \
-			-D "$USERDN" -w "$password" \
-			-s "$SCOPE" -b "$BASEDN" "$FILTER" dn $ATTRS)
-	fi
-	[ $? -ne 0 ] && return 1
-	return 0
+        common_opts="-o nettimeout=$TIMEOUT -H $SERVER -x"
+        [ -z "$DEBUG" ] || common_opts="-v $common_opts"
+        if [ -z "$BASEDN" ]; then
+                output=$(ldapwhoami $common_opts -D "$USERDN" -w "$password")
+        elif [ -z "$BINDDN"]; then
+                output=$(ldapsearch $common_opts -LLL \
+                        -D "$USERDN" -w "$password" \
+                        -s "$SCOPE" -b "$BASEDN" "$FILTER" dn $ATTRS)
+        else
+                dn=$(ldapsearch $common_opts -LLL \
+                        -D "$BINDDN" -w "$BINDPASS" \
+                        -s sub -b "$BASEDN"  "(uid=$(ldap_dn_escape $username))" dn | grep 'dn: ' | sed 's/dn: //')
+                output=$(ldapsearch $common_opts -LLL \
+                        -D "$dn" -w "$password" \
+                        -s "$SCOPE" -b "$dn" "$FILTER" dn $ATTRS)
+        fi
+        [ $? -ne 0 ] && return 1
+        return 0
 }
 
 

From ce3adffbcfa384c0d6b7656b85e4086dc5e2f7fb Mon Sep 17 00:00:00 2001
From: LukasK13 <spam.lukas.klass@gmail.com>
Date: Sat, 21 Mar 2020 18:15:22 +0100
Subject: [PATCH 2/2] Create .gitignore

---
 .gitignore | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 .gitignore

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..9bea433
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+
+.DS_Store