flamencist / flamencist/ldap4net

Allow setting client certificate to `null`

Open
#175 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
225
Forks
39
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**

When using Kerberos authentication and LDAPS protocol on Windows, with some (not all) LDAP server products, `Bind` fails with message:
> Server Down. Result: 81. Method: ldap_connect

After some experimentation with Microsoft's DirectoryServices package, I've figured out that in this case, the client certificate should be set to `null`, which is currently not possible because of this line:
https://github.com/flamencist/ldap4net/blob/master/LdapForNet/Native/LdapNativeWindows.cs#L44
That should set `certificateHandle` to `IntPtr.Zero` and return `false` when the certificate is `null`.

**Describe the solution you'd like**

`SetClientCertificate` should accept `null` and handle this case properly in the native callback.

**Describe alternatives you've considered**

Workaround is to call `SetOption` , and pass a native callback that returns `false`:
```cs
connection.SetOption(
Native.LdapOption.LDAP_OPT_CLIENT_CERTIFICATE,
Marshal.GetFunctionPointerForDelegate(
(IntPtr connection, IntPtr trustedCAs, ref IntPtr certificateHandle) =>
{
certificateHandle = IntPtr.Zero;
return false;
}));
```

Note: you have to copy the definition of `QUERYCLIENTCERT` because it's internal:

```cs
[UnmanagedFunctionPointer(CallingConvention.Cdecl)]
internal delegate bool QUERYCLIENTCERT(IntPtr connection, IntPtr trustedCAs, ref IntPtr certificateHandle);
```

**Additional context**
This bug/limitation might be the root cause of #106

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.