php/php-src — pull request #382 by pwillred (2013-07-09 22:14:03+00:00)
Title: Added support for not canonicalizing the SASL realm on sasl_binds for LDAP

This patch adds an additional parameter to ldap_sasl_bind in the ldap extension to allow developers to avoid canonicalizing the realm during SASL binds.

Currently, php always canonicalizes the hostname for SASL binds. If reverse DNS is not properly set up or cannot be modified by the site administrator, this can result in SASL attempting to make requests using an incorrect realm. In particular, when using GSSAPI, the server will ignore the SASL realm option and delegate that to GSSAPI. This can result in GSSAPI attempting to acquire a cross realm ticket to a nonexistant realm, resulting in the bind failing with a "Local Error" from GSSAPI.

Similar functionality can be found in the "-N" option in ldapsearch from OpenLDAP.