ldapi:// scheme handling incorrect

[mistotebe]

Describe the bug
This module doesn't agree with all other ldap client implementations on how to parse a ldapi:// URL. Everyone else expects ldapi://escaped_path/dn where this module reads as ldapi://ignored/path.

For ldapX urls, the "path" portion of the URL is reserved for a DN (e.g. search base), see RFC4516, and for ldapi:// the socket location is supposed be stored in the "host" part. Also see man 5 ldap.conf for example.

To Reproduce
Compare ldapsearch -H ldapi://encoded_path and DialURL("ldapi://encoded_path"), DialURL connects to the "default" path.

And then compare e.g. ldapsearch -H ldapi:///path (will fail) and DialURL("ldapi:///path"), this module uses the DN part of the URL instead.

Expected behavior
Parse ldapi://escaped_path/dn as intended.

Code snippets
See above

Additional context
If (temporary?) backwards compatibility is desired, an ldapi:// URL with an empty "host" part and a path argument containing a / might be considered as existing behaviour.

[cpuschma]

Hi @mistotebe ,

thanks for pointing this out. You're right, the current implementation disregards the DN passed to the DialURL function. This is not solely a problem for the ldapi implementation but for the entirety of go-ldap:

ldap/v3/conn.go

Lines 161 to 195 in 06d7bd9

	func (dc *DialContext) dial(u *url.URL) (net.Conn, error) {
	if u.Scheme == "ldapi" {
	if u.Path == "" || u.Path == "/" {
	u.Path = "/var/run/slapd/ldapi"
	}
	return dc.dialer.Dial("unix", u.Path)
	}
	host, port, err := net.SplitHostPort(u.Host)
	if err != nil {
	// we assume that error is due to missing port
	host = u.Host
	port = ""
	}
	switch u.Scheme {
	case "cldap":
	if port == "" {
	port = DefaultLdapPort
	}
	return dc.dialer.Dial("udp", net.JoinHostPort(host, port))
	case "ldap":
	if port == "" {
	port = DefaultLdapPort
	}
	return dc.dialer.Dial("tcp", net.JoinHostPort(host, port))
	case "ldaps":
	if port == "" {
	port = DefaultLdapsPort
	}
	return tls.DialWithDialer(dc.dialer, "tcp", net.JoinHostPort(host, port), dc.tlsConfig)
	}
	return nil, fmt.Errorf("Unknown scheme '%s'", u.Scheme)
	}

Looks like this was introduced in 2517798 (#249).

I'll have a look. One approach I'm thinking of is saving the DN in the context of the connection and use it search requests if no SearchBase is set explicitly. This shouldn't break backwards compatibility. Any PRs are welcome ❤️

References:

• https://datatracker.ietf.org/doc/html/draft-chu-ldap-ldapi-00#section-4.1
• https://datatracker.ietf.org/doc/html/rfc4516#section-2

[mistotebe]

Yes, it looks like that code is using u.Path instead of u.Host (u.Path is the DN here). But it looks like net/url is unhappy to parse things like ldapi://%2fvar%2frun%2fldapi/ which is a valid ldapi URL as per the draft above.