Dobrica Pavlinusic <dpavlin@rot13.org> writes:
Idea is simple: instead of having single administrative user which can do LDAP compare to check password, we just bind as user who is trying to login.
Yes, this is the correct way to authenticate against an LDAP directory. As you say, it requires no privileged access to the directory beyond that granted to the authenticating user. This normal behaviour (bind as authenticating user) is available in the current development tree of Koha 3.x, and is not yet in any stable release TTBOMK. -- \ Rommel: “Don't move, or I'll turn the key on this can of Spam!” | `\ —The Goon Show, _Rommel's Treasure_ | _o__) | Ben Finney