[Feature]: Allow EXTERNAL LDAP binding (for Google Workspace)

Snipe-IT Version

v8.7.1

How can we help?

Testing LDAP sync with Google Workspace, and I found out SnipeIT always require auth binding even when not strictly necessary.

Google Workspace provides KEY+CERT for authentication, making binding optional. Works fine with ldapsearch:

LDAPTLS_CERT=$PWD/Google_2029_08_17_30378.crt LDAPTLS_KEY=$PWD/Google_2029_08_17_30378.key /opt/homebrew/opt/openldap/bin/ldapsearch -H ldaps://ldap.google.com -Y EXTERNAL -b 'dc=acme,dc=com' '(objectClass=inetOrgPerson)' uid mail

Cert auth with SASL EXTERNAL works fine and returns results.

However, SnipeIT doesn't allow that. bindAdminToLdap() only calls ldap_bind() (simple), so without bind credentials it can do the anonymous bind that returns 0 users, but not the SASL EXTERNAL bind.

If no username is provided, it should try ldap_sasl_bind($connection, null, null, 'EXTERNAL'), falling back to anonymous.

Footnote: I know I can create bind credentials and the guide clearly explains how to do that, but for some reasons those credentials are not working for me (tried re-creating 3 times), and certs should be enough in this case.

Code of Conduct

• I agree to follow this project's Code of Conduct