LDAP connector doesn't escape input

[ericchiang]

A hypothetical setup of the LDAP connector is to auth without search against a specific directory.

    {
        "type": "ldap",
        "id": "ldap",
        "host": "127.0.0.1:389",
        "useTLS": true,
        "baseDN": "cn=users,cn=accounts,dc=auth,dc=example,dc=com",
        "bindTemplate": "uid=%u,%d"
    }

If I enter the username "janedoe" the result bind becomes

uid=janedoe,cn=users,cn=accounts,dc=auth,dc=example,dc=com

However I can trivially access sub directories by including them in my username. E.g. "janedoe,cn=admins" would become

uid=janedoe,cn=admins,cn=users,cn=accounts,dc=auth,dc=example,dc=com

Investigate proper escape strategies for LDAP DN entries.

[ericchiang]

Further reading:

• http://www.rlmueller.net/CharactersEscaped.htm
• http://social.technet.microsoft.com/wiki/contents/articles/5312.active-directory-characters-to-escape.aspx