如何使用 golang 绑定到带有 TLS 的 LDAP 服务器？

Question

我有以下代码在绑定到没有 TLS/SSL 的 LDAP 服务器时完美运行，但是当我尝试绑定到具有 TLS 设置的 LDAP 服务器时，它不会绑定。/*In order to use this program, the user needs to get the package by running the following command:go get gopkg.in/ldap.v2*/package mainimport (  "fmt"  "strings"  "gopkg.in/ldap.v2"  "os")//Gives constants to be used for binding to and searching the LDAP server.const (  ldapServer = "ldaps://test.com:636"  ldapBind = "CN=ad_binder,CN=Users,DC=dev,DC=test,DC=com"  ldapPassword = "Password"  filterDN = "(objectclass=*)"  baseDN = "dc=dev,dc=test,dc=com"  loginUsername = "ad_binder"  loginPassword = "Password")//Main function, which is executed.func main() {  conn, err := connect()  //If there is an error connecting to server, prints this  if err != nil {    fmt.Printf("Failed to connect. %s", err)    return  }  //Close the connection at a later time.  defer conn.Close()  //Declares err to be list(conn), and checks if any errors. It prints the error(s) if there are any.  if err := list(conn); err != nil {    fmt.Printf("%v", err)    return  }    //Declares err to be auth(conn), and checks if any errors. It prints the error(s) if there are any.  if err := auth(conn); err != nil {    fmt.Printf("%v", err)    return  }}//This function is used to connect to the LDAP server.func connect() (*ldap.Conn, error) {  conn, err := ldap.Dial("tcp", ldapServer)  if err != nil {    return nil, fmt.Errorf("Failed to connect. %s", err)  }  if err := conn.Bind(ldapBind, ldapPassword); err != nil {    return nil, fmt.Errorf("Failed to bind. %s", err)  }  return conn, nil}//This function is used to search the LDAP server as well as output the attributes of the entries.func list(conn *ldap.Conn) error {  //This gets the command line argument and saves it in the form "(argument=*)"  arg := ""  filter := ""  if len(os.Args) > 1{    arg = os.Args[1]    fmt.Println(arg)这很奇怪，因为它可以与不同的 LDAP 服务器一起正常工作，但具有以下功能：ldapServer = "10.1.30.47:389"代替ldapServer = "ldaps://test.com:636"所以任何帮助将不胜感激，谢谢！

Answer 1

gopkg.in/ldap.v2不支持 URI 寻址（即您不能将方案放在ldap://网络ldaps://地址之前）。

注意： 通过DialURLgopkg.in/ldap.v3支持 URI 拨号 ( ) 。ldaps://test.com

如果您使用gopkg.in/ldap.v2，您仍然可以建立直接 TLS 连接，但您必须使用该功能DialTLS，并使用网络地址（不是 URI）：

// addr    = "10.1.30.47:389"

// tlsAddr = "10.1.30.47:636"

// conn, err = ldap.Dial("tcp", addr)           // non-TLS

// serverName = "test.com"   TLS cert name will be verified

// serverName = ""           TLS verify will be disabled (DON'T DO THIS IN PRODUCTION)

tlsConf, err := getTLSconfig(serverName)

if err != nil { /* */ }

conn, err = ldap.DialTLS("tcp", tlsAddr, tlsConf)

上面需要 a *tls.Config，所以使用一个辅助函数，如：

func getTLSconfig(tlsName string) (tlsC *tls.Config, err error) {

    if tlsName != "" {

        tlsC = &tls.Config{

            ServerName: tlsName,

        }

        return

    }

    log.Println("No TLS verification enabled! ***STRONGLY*** recommend adding a trust file to the config.")

    tlsC = &tls.Config{

        InsecureSkipVerify: true,

    }

    return

}