flamencist / flamencist/ldap4net
Allow setting client certificate to `null`
- Dominant language
- C#
- Stars
- 225
- Forks
- 39
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
When using Kerberos authentication and LDAPS protocol on Windows, with some (not all) LDAP server products, `Bind` fails with message:
> Server Down. Result: 81. Method: ldap_connect
After some experimentation with Microsoft's DirectoryServices package, I've figured out that in this case, the client certificate should be set to `null`, which is currently not possible because of this line:
https://github.com/flamencist/ldap4net/blob/master/LdapForNet/Native/LdapNativeWindows.cs#L44
That should set `certificateHandle` to `IntPtr.Zero` and return `false` when the certificate is `null`.
**Describe the solution you'd like**
`SetClientCertificate` should accept `null` and handle this case properly in the native callback.
**Describe alternatives you've considered**
Workaround is to call `SetOption` , and pass a native callback that returns `false`:
```cs
connection.SetOption(
Native.LdapOption.LDAP_OPT_CLIENT_CERTIFICATE,
Marshal.GetFunctionPointerForDelegate(
(IntPtr connection, IntPtr trustedCAs, ref IntPtr certificateHandle) =>
{
certificateHandle = IntPtr.Zero;
return false;
}));
```
Note: you have to copy the definition of `QUERYCLIENTCERT` because it's internal:
```cs
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
internal delegate bool QUERYCLIENTCERT(IntPtr connection, IntPtr trustedCAs, ref IntPtr certificateHandle);
```
**Additional context**
This bug/limitation might be the root cause of #106
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.