From 89a8718b7e3935df54a4b631fdc422c236a11127 Mon Sep 17 00:00:00 2001 From: Erik Geiser Date: Tue, 15 Apr 2025 12:49:37 +0200 Subject: [PATCH] ldapauth: Set mutual AP option explicitly --- ldapauth/ldap.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ldapauth/ldap.go b/ldapauth/ldap.go index 6764b8a..4c06242 100644 --- a/ldapauth/ldap.go +++ b/ldapauth/ldap.go @@ -26,6 +26,7 @@ import ( "github.com/go-ldap/ldap/v3" "github.com/oiweiwei/gokrb5.fork/v9/client" + "github.com/oiweiwei/gokrb5.fork/v9/iana/flags" "github.com/spf13/pflag" ) @@ -260,7 +261,10 @@ func bind( return fmt.Errorf("build SPN: %w", err) } - err = conn.GSSAPIBind(authClient, spn, creds.NTHash) + err = conn.GSSAPIBindRequestWithAPOptions(authClient, &ldap.GSSAPIBindRequest{ + ServicePrincipalName: spn, + AuthZID: creds.NTHash, + }, []int{flags.APOptionMutualRequired}) if err != nil { return fmt.Errorf("GSSAPI bind: %w", err) }