Lighttpd

Same situation here. And I wrote a very similar patch today :-)

After testing the patch I got a tip from a co-worker that my base DN was too broad, i.e. "dc=example,dc=com", and with his help we changed it to something like "ou=users,dc=example,dc=com". With this more specific base DN, unpatched lighttpd works. (I use this now, but would prefer the broad base DN to work too. It seems e.g. Apache and Gogs can handle the broad base DN.)

Observation: Apache has a runtime option whether to follow referrals called LDAPReferrals, https://httpd.apache.org/docs/2.4/mod/mod_ldap.html#ldapreferrals. It defaults to "on". That makes me wonder if Apache does re-authentication with user/pw when following the referral. I found this snippet in $APACHE_SRC/modules/ldap/util_ldap.c, which seems to support this idea:

     if (ldc->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
        /* Now that we have an ldap struct, add it to the referral list for rebinds. */
        rc = apr_ldap_rebind_add(ldc->rebind_pool, ldc->ldap, ldc->binddn, ldc->bindpw);

Gogs does not have any "referral" option (and no mention of "referral" in its documentation), but also works (unmodified) against our LDAP server. (I grepped for "referral" in its source code but didn't understand whether it followed them or not.)

For those following this, please be aware there is a memory leak patch for mod_authn_ldap in git master, which will be part of lighttpd 1.4.49 (not yet released). See #2849

Untested patch which follows referrals and rebinds using authentication (not anonymous) for ldap searches, but disables referrals when binding only to verify user auth. Feedback appreciated.

--- a/src/mod_authn_ldap.c
+++ b/src/mod_authn_ldap.c
@@ -12,6 +12,7 @@

 typedef struct {
     LDAP *ldap;
+    server *srv;

     buffer *auth_ldap_hostname;
     buffer *auth_ldap_basedn;
@@ -450,6 +451,18 @@ static int mod_authn_ldap_bind(server *srv, LDAP *ld, const
 char *dn, const char
     return ret;
 }

+static int mod_authn_ldap_rebind_proc (LDAP *ld, LDAP_CONST char *url, ber_tag_
t ldap_request, ber_int_t msgid, void *params) {
+    plugin_config *s = (plugin_config *)params;
+    UNUSED(url);
+    UNUSED(ldap_request);
+    UNUSED(msgid);
+    return !buffer_string_is_empty(s->auth_ldap_binddn)
+      ? mod_authn_ldap_bind(s->srv, ld,
+                            s->auth_ldap_binddn->ptr,
+                            s->auth_ldap_bindpw->ptr)
+      : mod_authn_ldap_bind(s->srv, ld, NULL, NULL);
+}
+
 static LDAPMessage * mod_authn_ldap_search(server *srv, plugin_config *s, char *base, char *filter) {
     LDAPMessage *lm = NULL;
     char *attrs[] = { LDAP_NO_ATTRS, NULL };
@@ -484,11 +497,8 @@ static LDAPMessage * mod_authn_ldap_search(server *srv, plugin_config *s, char *
         return NULL;
     }

-    ret = !buffer_string_is_empty(s->auth_ldap_binddn)
-      ? mod_authn_ldap_bind(srv, s->ldap,
-                            s->auth_ldap_binddn->ptr,
-                            s->auth_ldap_bindpw->ptr)
-      : mod_authn_ldap_bind(srv, s->ldap, NULL, NULL);
+    ldap_set_rebind_proc(s->ldap, mod_authn_ldap_rebind_proc, s);
+    ret = mod_authn_ldap_rebind_proc(s->ldap, NULL, 0, 0, s);
     if (LDAP_SUCCESS != ret) {
         ldap_destroy(s->ldap);
         s->ldap = NULL;
@@ -588,6 +598,8 @@ static handler_t mod_authn_ldap_basic(server *srv, connection *con, void *p_d, c
     handler_t rc;

     mod_authn_ldap_patch_connection(srv, con, p);
+    p->anon_conf->srv = srv;
+    p->conf.srv = srv;

     if (pw[0] == '\0' && !p->conf.auth_ldap_allow_empty_pw)
         return HANDLER_ERROR;
@@ -634,6 +646,17 @@ static handler_t mod_authn_ldap_basic(server *srv, connection *con, void *p_d, c
         return HANDLER_ERROR;
     }

+    /* Disable referral tracking.  Target user should be in provided scope */
+    {
+        int ret = ldap_set_option(ld, LDAP_OPT_REFERRALS, LDAP_OPT_OFF);
+        if (LDAP_OPT_SUCCESS != ret) {
+            mod_authn_ldap_err(srv,__FILE__,__LINE__,"ldap_set_option()",ret);
+            ldap_destroy(ld);
+            if (dn != p->ldap_filter->ptr) ldap_memfree(dn);
+            return HANDLER_ERROR;
+        }
+    }
+
     if (LDAP_SUCCESS != mod_authn_ldap_bind(srv, ld, dn, pw)) {
         ldap_destroy(ld);
         if (dn != p->ldap_filter->ptr) ldap_memfree(dn);