shreemaan-abhishek opened a new pull request, #13805: URL: https://github.com/apache/apisix/pull/13805
### Description `ldap_authenticate()` returns the bind DN it assembled as its third value, with the username escaped per [RFC 4514 ยง2.4](https://datatracker.ietf.org/doc/html/rfc4514#section-2.4). The plugin discarded that value and rebuilt the same string by raw concatenation: ```lua local user_dn = conf.uid .. "=" .. user.username .. "," .. conf.base_dn ``` The two forms diverge as soon as the username carries a character that has structural meaning in a distinguished name (`,` `+` `=` `<` `>` `;` `"` `\`). An entry whose RDN value holds a comma binds against `cn=comma\,user,ou=users,dc=example,dc=org`, a single RDN, and is then looked up under `cn=comma,user,ou=users,dc=example,dc=org`, a two-component path. So the request either matches no consumer or matches one that belongs to a different directory entry. This PR uses the DN the client already produced instead of rebuilding it, which keeps the bind target and the consumer key the same string by construction. **Backward compatibility:** a consumer whose `user_dn` was written in the unescaped form to match the previous behaviour stops matching. This only affects directory entries whose RDN value contains one of the characters above, and the doc note added here spells out the escaped form to use. Every DN without those characters is unchanged. **Tests:** the CI directory fixture gains an entry whose `cn` value is `comma,user`. Two cases assert that a consumer keyed on the escaped DN matches and one keyed on the raw expansion does not. #### Which issue(s) this PR fixes: <!-- *Automatically closes linked issue when PR is merged. Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`. --> Fixes # ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
