Re: ldap support: eudc and ldap.el

[Thomas Fitzsimmons <fitzsim@fitzsim.org>]

Stefan Monnier <monnier@iro.umontreal.ca> writes:

>> I've got it working to my satisfaction now, but I consider most of the
>> changes I made hacks.  It would definitely be nice to see EUDC/ldap.el
>> modernized.
>
> Patches welcome.  You could post your hacks as patches included in
> a bug-report.  Even if it's not "good enough", it can be very useful
> since someone else may be able to improve/clean it.

OK, I'm readying my patches for submission.  One area where I could use
some guidance is how to improve ldap.el's interaction with the
ldapsearch process.

Currently the password is passed as a command-line argument:

(defun ldap-search-internal (search-plist)
[...]
      (if (and passwd
	       (not (equal "" passwd)))
	  (setq arglist (nconc arglist (list (format "-w%s" passwd)))))
[...]
      (apply #'call-process ldap-ldapsearch-prog
	     ;; Ignore stderr, which can corrupt results
	     nil (list buf nil) nil
	     (append arglist ldap-ldapsearch-args filter))

which means it can be seen in clear text in the process list by other
users on the system.

ldapsearch provides a -W option to prompt for the password and receive
it on stdin, so I'm trying to use that instead.  I hacked an
implementation using a sentinel, but it's too simplistic (it does a
timed wait instead of watching for the prompt).

The steps are: 1) run the process, 2) wait for the "Enter LDAP
Password:" prompt, 3) send the contents of the passwd variable to the
process's stdin.

Can you recommend an approach to implementing those steps?  Should I do
a full process-filter-based implementation or is there a simpler way?

Thanks,
Thomas