Verifying user's credentials with LDAP using Net::LDAP - perl

Question

I have an username and password and I need to verify that the username and password is found in the LDAP before letting the user into my system. I'm a newbie in LDAP and was quite confused about some terms. I know I need to bind the admin user and perform a search to check if I can find the username and password in LDAP. Then I should bind the user with the username and password.
Firstly, I don't quite understand why I need to bind the username and password at the last step.
Secondly, how do I bind the admin user? I know it should be in this format
bind("DN, OU and stuff",password=>$password)
What is the $password that I am suppose to pass?
Many thanks for your help!

Answer 1

The LDAP protocol is based on a request-response framework, with the exception of the unsolicited notification. The LDAP client transmits a correctly formed request to the LDAP server and then reads the response.
When an LDAP client connects to the server, the connection is not authenticated. In order to change the authentication state of a connection, the LDAP client transmits a "BIND" request to the server. A "BIND" request is either:
a simple BIND (distinguished name and credentials (password))
a SASL BIND (distinguished name or user name transmitted with other information, depending on the SASL mechanism
The server then determines whether the credentials are correct, and if they are, then the server changes the authentication state of the connection to that of the username or distinguished name and transmits a BIND response to the LDAP client. If the result code in the BIND response is 0 then the LDAP client knows that the user or distinguished name exists and the credentials are correct - there is no need to search for the user if the base object is already known.
If the connection already exists (for example, if connection pooling is used), then the client can request information about the authentication state of the connection using the authorization identity request control or the who am i? extended request. Some directory servers also support the account usable request control (which is not specified in any standards documentation but was invented by Sun Microsystems).
The base DN is the distinguished name from which a search "starts", that is, the search response would include the base DN and entries one level below the base DN if the search scope were one and all entries below the base DN if the search scope was sub or whole subtree.

Answer 2

Binding as the admin gives you access to search for the user. Binding as the user ensures that the password is correct.

Answer 3

1/ do an anonymous search if possible to lookup the dn
2/ do a bind test to verify the password
Just give you some idea, you need to fix some of the code below to match your case.
#!/usr/bin/perl
use Net::LDAP;
my $ldap = Net::LDAP->new($hostname, version => 2);
$mesg = $ldap->search(
base => $baseDN,
filter => "uid=$username",
attrs => ['dn']
);
$result = (1==0);
if ($mesg->code) {
foreach $entry ($mesg->entries) {
$dn = $entry->dn;
$bmesg = $ldap->bind($dn, $password);
$result = $bmesg->code
}
}
if ($result) {
print "Authenticated";
}

Answer 4

While the Perl example provided by Ken will work, its technically not the right approach. Searching is completely different versus a simple credential verification. While I won't go into the "why" on this remark, just understand that searching can behave in a misleading way, depending on how the server is configured.
As Terry mentioned, one method is the WhoAmI operation. Here's a CPAN page on the subject:
http://search.cpan.org/~marschap/perl-ldap-0.56/lib/Net/LDAP/Extension/WhoAmI.pm
As you can see, the WhoAmI operation is pretty simple when compared to a search. Only a username and password (of some kind) are needed. No filters nor search attributes are needed (nor accepted).
Basically, in laymen's terms, the WhoAmI operation would work like this (conversationally):
Client: "My name is [[insert DN here]], and my password is [[insert password here]]. Am I valid?"
Server: [[insert 'yes' or 'no' answer here]]
I hope this helps...
Max