Re: slapd bind method codes

[masarati@aero.polimi.it]

> Hi folks,
>
> When clients bind with a provider and the provider's loglevel is set
> to stats, bind events show up frequently in the log. Often, some
> logged bind events have only a blank dn along with a "method" code.
> Here are two separate examples:
>
>     slapd[903]: conn=1021 op=0 BIND dn="" method=128
>
>     slapd[903]: conn=1020 op=0 BIND dn="" method=163

There lines are intended to log a bind request; a second line will
indicate the mechanism used and the resulting ssf.

> Two questions:
>
> 1.) What do these method codes mean? Perhaps there list somewhere
>      that explains all possible method codes.

See LDAP_AUTH_* macros in ldap.h; 128 (0x80) means SIMPLE; 163 (0xa3)
means SASL.

> 2.) When a method code is shown, as in the examples above, why is
>      the value for the dn empty?

An empty DN is perfectly legitimate in both bind methods illustrated
above.  In the case of SIMPLE bind it indicates anonymous; in the case of
SASL bind the requested DN is not relevant; the actual DN will be
constructed according to the mechanism, and might eventually be mapped
according to authz-regexp directives.

p.