On 23.03.23 02:45, Anatoly Zaretsky wrote:
> Comments in src/backend/libpq/auth.c [1] say:
> (after successfully finding the final DN to check the user-supplied
> password against)
> /* Unbind and disconnect from the LDAP server */
> and later
> /*
> * Need to re-initialize the LDAP connection, so that we can bind to
> * it with a different username.
> */
>
> But the protocol actually permits multiple subsequent authentications
> ("binds" in LDAP parlance) over a single connection [2].
> Moreover, inspection of the code revision history of mod_authnz_ldap,
> pam_ldap, Bugzilla, and MediaWiki LDAP authentication plugin, shows that
> they've been doing this bind-after-search over the same LDAP connection
> for ~20 years without any evidence of interoperability troubles.
> So, it seems like the whole connection re-initialization thing was just
> a confusion caused by this very unfortunate "historical" naming, and can
> be safely removed, thus saving quite a few network round-trips,
> especially for the case of ldaps/starttls.
Your reasoning and your patch look correct to me.