Uh oh!
There was an error while loading. Please reload this page.
Change LoadDomainInfo to honor requested LDAP port - #89787
Conversation
dotnet#65894 LoadDomainInfo builds an LDAP Uri that ignores the requested port. If LDAPS/636 is requested, traffic still goes to 389 for this request.
ghost
commented
Aug 1, 2023
Tagging subscribers to this area: @dotnet/area-system-directoryservices, @jay98014 Issue DetailsLoadDomainInfo builds an LDAP Uri that ignores the requested port. If LDAPS/636 is requested, traffic still goes to 389 for this request. For environments where port 389 is blocked, this causes calls such as GroupPrincipal.GetMembers() to fail. This PR will use the specified port for the call, 389 if no port is specified, or 636 if LDAPS is specified.
|
Fixing CA1311
steveharter
commented
Aug 2, 2023
PTAL @jay98014 and @kumarravi |
kumarravik78c
left a comment
There was a problem hiding this comment.
I have validated this PR on my local set up and made sure this fixes the issue, hence approving.
steveharter
left a comment
There was a problem hiding this comment.
Approving based on approval from @kumarravik78c
| // Pull the requested port number | ||
| Uri ldapUri = new Uri(this.ctxBase.Path); | ||
| int port = ldapUri.Port != -1 ? ldapUri.Port : (ldapUri.Scheme.ToUpperInvariant() == "LDAPS" ? 636 : 389); |
There was a problem hiding this comment.
String.Equals(..., StringComparison.OrdinalIgnoreCase) avoids an unnecessary allocation.
Fixes#65894
LoadDomainInfo builds an LDAP Uri that ignores the requested port. If LDAPS/636 is requested, traffic still goes to 389 for this request. For environments where port 389 is blocked, this causes calls such as GroupPrincipal.GetMembers() to fail when the group is Domain Local or Universal. We do not seem to call LoadDomainInfo for Global groups.
This PR will use the specified port for the call, 389 if no port is specified, or 636 if LDAPS is specified.