auth: Add mechanism filter for passdbs

diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index aefa0ad217306efe8be50e45507bd703af124039..4ba7069ed2d1369e4783dcf8c02e9db94d67f5ad 100644 (file)
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -614,6 +614,16 @@ static bool
 auth_request_want_skip_passdb(struct auth_request *request,
                              struct auth_passdb *passdb)
 {
+       /* if mechanism is not supported, skip */
+       const char *const *mech = passdb->passdb->mechanisms;
+
+       /* if request->mech == NULL it means we are doing
+          lookup without authentication and should not match this */
+       if (mech != NULL && (request->mech == NULL ||
+            !str_array_icase_find(mech, request->mech->mech_name))) {
+               return TRUE;
+       }
+
        /* skip_password_check basically specifies if authentication is
           finished */
        bool authenticated = request->skip_password_check;

diff --git a/src/auth/auth-settings.c b/src/auth/auth-settings.c
index 00a815c0958cf98b29aa94f8e854dd37e807388c..101a4b2c9d256d88dfb6d3683b75ffa87dff5831 100644 (file)
--- a/src/auth/auth-settings.c
+++ b/src/auth/auth-settings.c
@@ -113,6 +113,7 @@ static const struct setting_define auth_passdb_setting_defines[] = {
        DEF(SET_STR, args),
        DEF(SET_STR, default_fields),
        DEF(SET_STR, override_fields),
+       DEF(SET_STR, mechanisms),
 
        DEF(SET_ENUM, skip),
        DEF(SET_ENUM, result_success),
@@ -133,6 +134,7 @@ static const struct auth_passdb_settings auth_passdb_default_settings = {
        .args = "",
        .default_fields = "",
        .override_fields = "",
+       .mechanisms = "",
 
        .skip = "never:authenticated:unauthenticated",
        .result_success = "return-ok:return:return-fail:continue:continue-ok:continue-fail",

diff --git a/src/auth/auth-settings.h b/src/auth/auth-settings.h
index 1daf9c18b52242ab008f5d4e7c543144fa542f6a..f7839643d0a4143aa092cd4f75b477281c1b303c 100644 (file)
--- a/src/auth/auth-settings.h
+++ b/src/auth/auth-settings.h
@@ -10,6 +10,7 @@ struct auth_passdb_settings {
        const char *args;
        const char *default_fields;
        const char *override_fields;
+       const char *mechanisms;
 
        const char *skip;
        const char *result_success;

diff --git a/src/auth/passdb.c b/src/auth/passdb.c
index f33034c7c50fa59302c4c5411295138d207596d9..112bdc95fbc1b6a4bca09f876824b80df91eedae 100644 (file)
--- a/src/auth/passdb.c
+++ b/src/auth/passdb.c
@@ -223,6 +223,13 @@ passdb_preinit(pool_t pool, const struct auth_passdb_settings *set)
        passdb->id = ++auth_passdb_id;
        passdb->iface = *iface;
        passdb->args = p_strdup(pool, set->args);
+       if (*set->mechanisms == '\0') {
+               passdb->mechanisms = NULL;
+       } else if (strcasecmp(set->mechanisms, "none") == 0) {
+               passdb->mechanisms = (const char *const[]){NULL};
+       } else {
+               passdb->mechanisms = (const char* const*)p_strsplit_spaces(pool, set->mechanisms, " ,");
+       }
 
        array_append(&passdb_modules, &passdb, 1);
        return passdb;

diff --git a/src/auth/passdb.h b/src/auth/passdb.h
index 922ec00912f008ee3c88d22a36a72b98db1dc447..636537b8afa531c29c03334fc68c713b9cf5a065 100644 (file)
--- a/src/auth/passdb.h
+++ b/src/auth/passdb.h
@@ -62,6 +62,9 @@ struct passdb_module {
        /* Default password scheme for this module.
           If cache_key is set, must not be NULL. */
        const char *default_pass_scheme;
+       /* Supported authentication mechanisms, NULL is all, [NULL] is none*/
+       const char *const *mechanisms;
+
        /* If blocking is set to TRUE, use child processes to access
           this passdb. */
        bool blocking;