Apply attribute maps before profiles

diff --git a/raddb/mods-available/ldap b/raddb/mods-available/ldap
index 8de2aec42bf57a29966478385bee0db2c58ba56d..3c11751c60b09f4206b0f0ca958f6bdd82d8bdf1 100644 (file)
--- a/raddb/mods-available/ldap
+++ b/raddb/mods-available/ldap
@@ -182,6 +182,9 @@ ldap {
        #  section name to set default destination requests/lists
        #  for `<fr attr>s` with no list qualifiers.
        #
+       #  These attribute maps are applied _before_ any profiles, meaning that
+       #  the values here can be referenced in profiles using expansions.
+       #
        #  NOTE: LDAP attribute names should be single quoted unless you want
        #  the name to be derived from an xlat expansion, or an attribute ref.
        #

diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c
index ee7141b6556399fcce54988ad4dfff7d9cea3d14..8c16ac53ec7e593763da21b21c5a67c398a18dad 100644 (file)
--- a/src/modules/rlm_ldap/rlm_ldap.c
+++ b/src/modules/rlm_ldap/rlm_ldap.c
@@ -1631,6 +1631,7 @@ static unlang_action_t mod_authorize_resume(rlm_rcode_t *p_result, UNUSED int *p
                goto skip_edir;
 
        case LDAP_AUTZ_POST_EDIR:
+       {
                /*
                 *      The result of the eDirectory user bind will be in p_result.
                 *      Anything other than RLM_MODULE_OK is a failure.
@@ -1640,8 +1641,25 @@ static unlang_action_t mod_authorize_resume(rlm_rcode_t *p_result, UNUSED int *p
                        goto finish;
                }
 
+       }
+       FALL_THROUGH;
+
+#endif
+       case LDAP_AUTZ_MAP:
+#ifdef WITH_EDIR
        skip_edir:
 #endif
+               if (!map_list_empty(call_env->user_map) || inst->valuepair_attr) {
+                       RDEBUG2("Processing user attributes");
+                       RINDENT();
+                       if (fr_ldap_map_do(request, inst->valuepair_attr,
+                                          &autz_ctx->expanded, autz_ctx->entry) > 0) rcode = RLM_MODULE_UPDATED;
+                       REXDENT();
+                       rlm_ldap_check_reply(request, autz_ctx->dlinst->name, call_env->expect_password->vb_bool, autz_ctx->ttrunk);
+               }
+               FALL_THROUGH;
+
+       case LDAP_AUTZ_DEFAULT_PROFILE:
                /*
                 *      Apply ONE user profile, or a default user profile.
                 */
@@ -1743,17 +1761,6 @@ static unlang_action_t mod_authorize_resume(rlm_rcode_t *p_result, UNUSED int *p
                                break;
                        }
                }
-               FALL_THROUGH;
-
-       case LDAP_AUTZ_MAP:
-               if (!map_list_empty(call_env->user_map) || inst->valuepair_attr) {
-                       RDEBUG2("Processing user attributes");
-                       RINDENT();
-                       if (fr_ldap_map_do(request, inst->valuepair_attr,
-                                          &autz_ctx->expanded, autz_ctx->entry) > 0) rcode = RLM_MODULE_UPDATED;
-                       REXDENT();
-                       rlm_ldap_check_reply(request, autz_ctx->dlinst->name, call_env->expect_password->vb_bool, autz_ctx->ttrunk);
-               }
        }
 
 finish:

diff --git a/src/modules/rlm_ldap/rlm_ldap.h b/src/modules/rlm_ldap/rlm_ldap.h
index 5a40a8bec514ec59c731463fffc3d4075d2a9f70..3c0f82e810b0c5e9c2205fe9b7f4f67b5ec0de0e 100644 (file)
--- a/src/modules/rlm_ldap/rlm_ldap.h
+++ b/src/modules/rlm_ldap/rlm_ldap.h
@@ -167,9 +167,10 @@ typedef enum {
        LDAP_AUTZ_EDIR_BIND,
        LDAP_AUTZ_POST_EDIR,
 #endif
+       LDAP_AUTZ_MAP,
+       LDAP_AUTZ_DEFAULT_PROFILE,
        LDAP_AUTZ_POST_DEFAULT_PROFILE,
        LDAP_AUTZ_USER_PROFILE,
-       LDAP_AUTZ_MAP
 } ldap_autz_status_t;
 
 /** User's access state