Draft: fix for iad format when DN is in uri, I think...

[zricethezav]

Description:

Steps to reproduce buggy behavior currently in main

docker run -p 389:389 --rm -it --env LDAP_ORGANISATION="truffle" --env LDAP_DOMAIN="trufflesecurity.com" --env LDAP_ADMIN_PASSWORD="thisisnotsecure" --env LDAP_TLS_VERIFY_CLIENT=try --LDAP_ROOT=dc=trufflesecurity,dc=com --detach osixia/openldap:1.5.0

echo "ou = dso.OpenDSObject(\"LDAP://127.0.0.1/cn=admin,DC=trufflesecurity,DC=com\", \"admin\", \"thisisnotsecure\", 1)" > ldapbug.txt

trufflehog filesystem --no-update ldapbug.txt

Notice no verified secrets.

Now checkout ldap-bug, then run:

go build && ./trufflehog filesystem --no-update ldapbug.txt

Notice there are now verified secrets!

---

This probably needs some more polish and LDAP is out of my wheelhouse but it looks like the Bind:

// Bind performs a bind with the given username and password.
//
// It does not allow unauthenticated bind (i.e. empty password). Use the UnauthenticatedBind method
// for that.
func (l *Conn) Bind(username, password string) error {
	req := &SimpleBindRequest{
		Username:           username,
		Password:           password,
		AllowEmptyPassword: false,
	}
	_, err := l.SimpleBind(req)
	return err
}

requires the full DN (for this example it's cn=admin,DC=trufflesecurity,DC=com) in some cases?

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

[rgmz]

This probably needs some more polish and LDAP is out of my wheelhouse but it looks like the Bind:

Bind usually requires the full DistinguishedName OR distinct username attribute.

Active Directory used to use sAMAccountName (e.g., jdoe) as the username, however, if you have multiple forests then you'd need to do jdoe@domain. Now UserPrincipalName is preferred. https://pleasantpasswords.com/info/pleasant-password-server/i-ldap-and-ad/active-directory-and-samaccountnames

Not sure about other LDAP implementations.

[zricethezav]

Bind usually requires the full DistinguishedName OR distinct username attribute.

@rgmz anyone to determine which one to use? This change attempts both if a username returns an err