LDAP Search/Bind function

Question

I'm trying to create an authentication function that can perform a search/bind.
The algorithm for this is as follows:
1) Bind to the LDAP server as the application (ie: admin username and password)
2) Search the LDAP directory for the sign-in username %userid%
3) Get the DN of that entry
4) Unbind as the application
5) Bind as the sign-in username %userid% with the DN from above
I'm pretty sure that this is possible with the DBMS_LDAP and DBMS_LDAP_UTL packages, but I'm not sure how to put it all together. Does anyone out there know if a function such as this already exists?
Thanks,
Logan

Answer 1

Well, I figured it out.
create or replace FUNCTION F_Authenticate (p_username in varchar2, p_password in varchar2)
      RETURN BOOLEAN
   IS
      CURSOR ldap_param_cur
      IS
         SELECT *
           FROM ldap_parameters;
      ldap_param_rec   ldap_param_cur%ROWTYPE;
      l_session        DBMS_LDAP.SESSION;
      l_srch_attr      DBMS_LDAP.STRING_COLLECTION;
      l_attr_values    DBMS_LDAP.STRING_COLLECTION;
      l_result         DBMS_LDAP.MESSAGE;
      l_entry          DBMS_LDAP.MESSAGE;
      l_dn             VARCHAR2 (200);
      l_retval         PLS_INTEGER;
      multiple_uid     EXCEPTION;
      no_ldap_entry    EXCEPTION;
   BEGIN
      -- get parameters from uvic_ldap_parameters table
      OPEN ldap_param_cur;
      FETCH ldap_param_cur
       INTO ldap_param_rec;
      -- if the cursor returns no records display error message and exit
      IF ldap_param_cur%NOTFOUND
      THEN
         DBMS_OUTPUT.PUT_LINE
             ( 'LDAP Parameters not configured in UVIC_LDAP_PARAMETERS table'
         CLOSE ldap_param_cur;
         RETURN FALSE;
      END IF;
      CLOSE ldap_param_cur;
      DBMS_LDAP.use_exception := TRUE;
      BEGIN
         -- open session to ldap server
         l_session :=
            DBMS_LDAP.init (ldap_param_rec.ldap_host,
                            ldap_param_rec.ldap_port
         -- bind with credentials from cursor
         l_retval :=
            DBMS_LDAP.simple_bind_s (l_session,
                                     ldap_param_rec.search_credential,
                                     ldap_param_rec.search_passwd
         -- run ldap search
         l_retval :=
            DBMS_LDAP.search_s (l_session,
                                ldap_param_rec.search_base,
                                DBMS_LDAP.SCOPE_SUBTREE,
                                ldap_param_rec.search_filter || p_username,
                                l_srch_attr,
                                0,
                                l_result
         -- count the search result records
         l_retval := DBMS_LDAP.count_entries (l_session, l_result);
         -- if multiple search result records raise exception
         -- the userid should be unique and only return 1 search record
         IF l_retval > 1
         THEN
            RAISE multiple_uid;
         ELSIF NVL (l_retval, 0) = 0
         THEN
            RAISE no_ldap_entry;
         END IF;
         -- select first entry from ldap search record
         l_entry := DBMS_LDAP.first_entry (l_session, l_result);
         -- get the distinguished name from the ldap record
         l_dn := DBMS_LDAP.get_dn (l_session, l_entry);
         -- close ldap session used to retrieve search results
         l_retval := DBMS_LDAP.unbind_s (l_session);
         -- open session to ldap server
         l_session :=
            DBMS_LDAP.init (ldap_param_rec.ldap_host,
                            ldap_param_rec.ldap_port);
         -- bind using ldap search results distinguished name and password
         -- if the bind is successful the user can login
         l_retval := DBMS_LDAP.simple_bind_s (l_session, l_dn, p_password);
         -- close ldap session
         l_retval := DBMS_LDAP.unbind_s (l_session);
         RETURN TRUE;
      EXCEPTION
         WHEN multiple_uid
         THEN
            l_retval := DBMS_LDAP.unbind_s (l_session);
            DBMS_OUTPUT.PUT_LINE('Multiple LDAP entries found.'
            RETURN FALSE;
         WHEN no_ldap_entry
         THEN
            l_retval := DBMS_LDAP.unbind_s (l_session);
            DBMS_OUTPUT.PUT_LINE ('No LDAP records found.'
            RETURN FALSE;
         WHEN OTHERS
         THEN
            l_retval := DBMS_LDAP.unbind_s (l_session);
            DBMS_OUTPUT.PUT_LINE ('LDAP Error. Unknown type.');
            RETURN FALSE;
      END;
   EXCEPTION
      WHEN OTHERS
      THEN
         l_retval := DBMS_LDAP.unbind_s (l_session);
         DBMS_OUTPUT.PUT_LINE ('LDAP Error. Unknown type.');
         RETURN FALSE;
   END F_Authenticate;