[4.3] Fix LDAP "Bind Directly as User"

administrator/language/en-GB/plg_authentication_ldap.ini

@@ -14,18 +14,18 @@ PLG_LDAP_FIELD_HOST_LABEL="Host"
 PLG_LDAP_FIELD_LDAPDEBUG_DESC="Enables debug hardcoded to level 7"
 PLG_LDAP_FIELD_LDAPDEBUG_LABEL="Debug"
 PLG_LDAP_FIELD_NEGOCIATE_LABEL="Negotiate TLS"
-PLG_LDAP_FIELD_PASSWORD_DESC="The Connect Password is the password of an administrative account. This is used in Authenticate then Bind and Authenticated Compare authorisation methods."
+PLG_LDAP_FIELD_PASSWORD_DESC="The Connect Password is the password of an administrative account."
 PLG_LDAP_FIELD_PASSWORD_LABEL="Connect Password"
 PLG_LDAP_FIELD_PORT_LABEL="Port"
 PLG_LDAP_FIELD_REFERRALS_DESC="This option sets the value of the LDAP_OPT_REFERRALS flag. You will need to set it to No for Windows 2003 servers."
 PLG_LDAP_FIELD_REFERRALS_LABEL="Follow Referrals"
-PLG_LDAP_FIELD_SEARCHSTRING_DESC="A query string used to search for a given User. The [search] keyword is dynamically replaced by the User-provided login. An example string is: uid=[search]. Several strings can be used separated by semicolons. Only used when searching."
+PLG_LDAP_FIELD_SEARCHSTRING_DESC="A query string used to search for a given User. The [search] keyword is dynamically replaced by the User-provided login. An example string is: uid=[search]. Several strings can be used separated by semicolons. Used after initial bind for all methods."
 PLG_LDAP_FIELD_SEARCHSTRING_LABEL="Search String"
 PLG_LDAP_FIELD_UID_DESC="LDAP Attribute which has the User's Login ID. For Active Directory this is sAMAccountName."
 PLG_LDAP_FIELD_UID_LABEL="Map: User ID"
-PLG_LDAP_FIELD_USERNAME_DESC="The Connect Username and Connect Password define connection parameters for the DN lookup phase. Two options are available:- Anonymous DN lookup (leave both fields blank); Administrative connection: Connect Username is the username of an administrative account, for example Administrator. Connect password is the actual password of your administrative account."
+PLG_LDAP_FIELD_USERNAME_DESC="The Connect Username and Connect Password define connection parameters for the DN lookup phase. Two options are available: anonymous DN lookup (Leave both fields blank) and administrative connection (Connect Username is the username of an administrative account, for example Administrator). Only used in Bind and Search method."
 PLG_LDAP_FIELD_USERNAME_LABEL="Connect Username"
-PLG_LDAP_FIELD_USERSDN_DESC="The [username] keyword is dynamically replaced by the User-provided login. An example string is: uid=[username], dc=my-domain, dc=com. Several strings can be used, separated by semicolons. Only used for direct binds."
+PLG_LDAP_FIELD_USERSDN_DESC="The [username] keyword is dynamically replaced by the User-provided login. An example string is: uid=[username], dc=my-domain, dc=com. Several strings can be used, separated by semicolons. Only used for Bind Directly as User method."
 PLG_LDAP_FIELD_USERSDN_LABEL="User's DN"
 PLG_LDAP_FIELD_V3_DESC="Default is LDAP2, but the latest versions of OpenLdap require clients to use LDAPV3."
 PLG_LDAP_FIELD_V3_LABEL="LDAP V3"

plugins/authentication/ldap/ldap.php

@@ -81,8 +81,7 @@ public function onUserAuthenticate($credentials, $options, &$response)
 			{
 				try
 				{
-					$dn = str_replace('[username]', $this->params->get('username', ''), $this->params->get('users_dn', ''));
-
+					$dn = $this->params->get('username', '');
 					$ldap->bind($dn, $this->params->get('password', ''));
 				}
 				catch (ConnectionException | LdapException $exception)
@@ -142,7 +141,12 @@ public function onUserAuthenticate($credentials, $options, &$response)
 				// We just accept the result here
 				try
 				{
-					$ldap->bind($ldap->escape($credentials['username'], '', LDAP_ESCAPE_DN), $credentials['password']);
+					if ($this->params->get('users_dn', '') == '') {
+						$dn = $credentials['username'];
+					} else {
+						$dn = str_replace('[username]', $ldap->escape($credentials['username'], '', LDAP_ESCAPE_DN), $this->params->get('users_dn', ''));
+					}
+					$ldap->bind($dn, $credentials['password']);
 				}
 				catch (ConnectionException | LdapException $exception)
 				{