From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Sat, 10 Dec 2022 11:50:27 +0000 (+0000)
Subject: ext_kerberos_ldap_group_acl: Support -b with -D (#1207)
X-Git-Tag: SQUID_6_0_1~56
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=71f62e86ef0dde610129f5296a30853afd84294c;p=thirdparty%2Fsquid.git

ext_kerberos_ldap_group_acl: Support -b with -D (#1207)

When both '-b' (i.e. bind DN) and '-D' (i.e. Kerberos domain) options
are specified, '-b' is ignored completely. This breaks the helper when a
search subtree has to be limited (e.g., when using FreeIPA).

Fix it to take '-b' into account if it was specified with '-D'.
---

diff --git a/src/acl/external/kerberos_ldap_group/support_ldap.cc b/src/acl/external/kerberos_ldap_group/support_ldap.cc
index e0c8950f5b..afd7b73ec4 100644
--- a/src/acl/external/kerberos_ldap_group/support_ldap.cc
+++ b/src/acl/external/kerberos_ldap_group/support_ldap.cc
@@ -1115,7 +1115,11 @@ get_memberof(struct main_args *margs, char *user, char *domain, char *group)
                   "%s| %s: DEBUG: Error during initialisation of ldap connection: %s\n",
                   LogTime(), PROGRAM, strerror(errno));
         }
-        bindp = convert_domain_to_bind_path(domain);
+        if (margs->lbind) {
+            bindp = xstrdup(margs->lbind);
+        } else {
+            bindp = convert_domain_to_bind_path(domain);
+        }
     }
     if ((!domain || !ld) && margs->lurl && strstr(margs->lurl, "://")) {
         char *hostname;