6 commits

Author	SHA1	Message	Date
Michael Aldridge	31b9b295aa	internal/ldap: Answer base-object searches for one entry ... HashiCorp Vault reads the attributes of the user it just bound as by issuing a base-object "(objectClass=*)" search whose base DN is the user's own DN, and has no option to turn that step off. Those searches named a leaf entry rather than a container, so nothing routed them and login failed with unwillingToPerform. A single entry is now looked up by ID or name and returned under the DN the client asked for, advertising objectClass as the other entries do. An unknown name reports noSuchObject so clients can distinguish it from an empty result, an entry that does not match the filter succeeds with no entries as RFC 4511 requires, and filter shapes we cannot evaluate are refused instead of guessed at. The catch-all route is limited to base-object scope so searches with an unknown subtree base are still refused, which keeps a renamed server from answering its old base DN. 💘 Generated with Crush Assisted-by: Crush:qwen38_flash_next_mtp	2026-11-02 19:59:53 -06:00
Michael Aldridge	a33df9fd7e	Switch to the maintained vjeantet LDAP server fork	2026-11-01 22:17:59 -06:00
Michael Aldridge	7e47e45109	internal/ldap: Fix panic on malformed bind DNs	2026-11-01 18:02:56 -06:00
Michael Aldridge	5789f11056	internal/ldap: Synchronize path	2020-08-23 00:52:38 -07:00
Michael Aldridge	83e78da739	internal/ldap: Handle bind	2020-08-22 20:49:54 -07:00
Michael Aldridge	b3783dffb5	internal/ldap: Initial boilerplate	2020-08-21 00:03:53 -07:00