ldap: Add option to disable following referrals.

Thanks to Daniel Tsosie for implementing this!

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3196 44740490-163a-0410-bde0-09ae8108e29a

config-templates/authsources.php

@@ -238,6 +238,9 @@ $config = array(
 		// The default is 0, which means no timeout.
 		'timeout' => 0,
 
+		// Set whether to follow referrals. AD Controllers may require FALSE to function.
+		'referrals' => TRUE,
+
 		// Which attributes should be retrieved from the LDAP server.
 		// This can be an array of attribute names, or NULL, in which case
 		// all attributes are fetched.

lib/SimpleSAML/Auth/LDAP.php

@@ -49,16 +49,18 @@ class SimpleSAML_Auth_LDAP {
 	 * @param bool $debug
 	 * @param int $timeout
 	 * @param int $port
+	 * @param bool $referrals
 	 */
 	// TODO: Flesh out documentation.
-	public function __construct($hostname, $enable_tls = TRUE, $debug = FALSE, $timeout = 0, $port = 389) {
+	public function __construct($hostname, $enable_tls = TRUE, $debug = FALSE, $timeout = 0, $port = 389, $referrals = TRUE) {
 
 		// Debug.
 		SimpleSAML_Logger::debug('Library - LDAP __construct(): Setup LDAP with ' .
 			'host=\'' . $hostname .
 			'\', tls=' . var_export($enable_tls, true) .
 			', debug=' . var_export($debug, true) .
-			', timeout=' . var_export($timeout, true));
+			', timeout=' . var_export($timeout, true) .
+			', referrals=' . var_export($referrals, true));
 
 		/*
 		 * Set debug level before calling connect. Note that this passes
@@ -81,6 +83,10 @@ class SimpleSAML_Auth_LDAP {
 		if (!@ldap_set_option($this->ldap, LDAP_OPT_PROTOCOL_VERSION, 3))
 			throw $this->makeException('Library - LDAP __construct(): Failed to set LDAP Protocol version (LDAP_OPT_PROTOCOL_VERSION) to 3', ERR_INTERNAL);
 
+		/* Set referral option */
+		if (!@ldap_set_option($this->ldap, LDAP_OPT_REFERRALS, $referrals))
+			throw $this->makeException('Library - LDAP __construct(): Failed to set LDAP Referrals (LDAP_OPT_REFERRALS) to '.$referrals, ERR_INTERNAL);
+
 		// Set timeouts, if supported.
 		// (OpenLDAP 2.x.x or Netscape Directory SDK x.x needed).
 		$this->timeout = $timeout;

modules/ldap/lib/ConfigHelper.php

@@ -46,6 +46,11 @@ class sspmod_ldap_ConfigHelper {
 	 */
 	private $timeout;
 
+	/**
+	 * Whether to follow referrals
+	 */
+	private $referrals;
+
 
 	/**
 	 * Whether we need to search for the users DN.
@@ -126,6 +131,7 @@ class sspmod_ldap_ConfigHelper {
 		$this->enableTLS = $config->getBoolean('enable_tls', FALSE);
 		$this->debug = $config->getBoolean('debug', FALSE);
 		$this->timeout = $config->getInteger('timeout', 0);
+		$this->referrals = $config->getBoolean('referrals', TRUE);
 		$this->searchEnable = $config->getBoolean('search.enable', FALSE);
 		$this->privRead = $config->getBoolean('priv.read', FALSE);
 
@@ -172,7 +178,7 @@ class sspmod_ldap_ConfigHelper {
 			throw new SimpleSAML_Error_Error('WRONGUSERPASS');
 		}
 
-		$ldap = new SimpleSAML_Auth_LDAP($this->hostname, $this->enableTLS, $this->debug, $this->timeout);
+		$ldap = new SimpleSAML_Auth_LDAP($this->hostname, $this->enableTLS, $this->debug, $this->timeout, 389, $this->referrals);
 
 		if (!$this->searchEnable) {
 			$ldapusername = addcslashes($username, ',+"\\<>;*');
@@ -239,7 +245,9 @@ class sspmod_ldap_ConfigHelper {
 		$ldap = new SimpleSAML_Auth_LDAP($this->hostname,
 			$this->enableTLS,
 			$this->debug,
-			$this->timeout);
+			$this->timeout,
+			389,
+			$this->referrals);
 
 		if ($attribute == NULL)
 			$attribute = $this->searchAttributes;
@@ -255,7 +263,9 @@ class sspmod_ldap_ConfigHelper {
 		$ldap = new SimpleSAML_Auth_LDAP($this->hostname,
 			$this->enableTLS,
 			$this->debug,
-			$this->timeout);
+			$this->timeout,
+			389,
+			$this->referrals);
 
 		return $ldap->getAttributes($dn, $attributes);
 	}