Allow NULL user object filter

If the DN of the user object can be constructed from attributes in the request, there's no need to apply a filter, and scope = base can be used.

diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c
index 6d379e0a6b220ea8967c56a8eda81ec097051246..2ece1092dcbca9a4aab7618ab16fc350222ed5ed 100644 (file)
--- a/src/modules/rlm_ldap/ldap.c
+++ b/src/modules/rlm_ldap/ldap.c
@@ -874,6 +874,7 @@ char const *rlm_ldap_find_user(ldap_instance_t const *inst, REQUEST *request, ld
        int             ldap_errno;
        char            *dn = NULL;
        char            filter[LDAP_MAX_FILTER_STR_LEN];
+       char            *filter_p = NULL;
        char            base_dn[LDAP_MAX_DN_STR_LEN];
 
        bool freeit = false;                                    //!< Whether the message should
@@ -918,11 +919,16 @@ char const *rlm_ldap_find_user(ldap_instance_t const *inst, REQUEST *request, ld
                (*pconn)->rebound = false;
        }
 
-       if (radius_xlat(filter, sizeof(filter), request, inst->userobj_filter, rlm_ldap_escape_func, NULL) < 0) {
-               REDEBUG("Unable to create filter");
-               *rcode = RLM_MODULE_INVALID;
+       if (inst->userobj_filter) {
+               if (radius_xlat(filter, sizeof(filter), request, inst->userobj_filter,
+                               rlm_ldap_escape_func, NULL) < 0) {
+                       REDEBUG("Unable to create filter");
+                       *rcode = RLM_MODULE_INVALID;
 
-               return NULL;
+                       return NULL;
+               }
+
+               filter_p = filter;
        }
 
        if (radius_xlat(base_dn, sizeof(base_dn), request, inst->userobj_base_dn, rlm_ldap_escape_func, NULL) < 0) {
@@ -932,7 +938,7 @@ char const *rlm_ldap_find_user(ldap_instance_t const *inst, REQUEST *request, ld
                return NULL;
        }
 
-       status = rlm_ldap_search(inst, request, pconn, base_dn, inst->userobj_scope, filter, attrs, result);
+       status = rlm_ldap_search(inst, request, pconn, base_dn, inst->userobj_scope, filter_p, attrs, result);
        switch (status) {
        case LDAP_PROC_SUCCESS:
                break;

diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c
index 9592656c901c9ead0de9e7052b12783e279e84f7..5056757dc713eefd6326702666f38dd03ed894ac 100644 (file)
--- a/src/modules/rlm_ldap/rlm_ldap.c
+++ b/src/modules/rlm_ldap/rlm_ldap.c
@@ -115,7 +115,7 @@ static CONF_PARSER profile_config[] = {
  *     User configuration
  */
 static CONF_PARSER user_config[] = {
-       { "filter", FR_CONF_OFFSET(PW_TYPE_STRING, ldap_instance_t, userobj_filter), "(uid=%u)" },
+       { "filter", FR_CONF_OFFSET(PW_TYPE_STRING, ldap_instance_t, userobj_filter), NULL },
        { "scope", FR_CONF_OFFSET(PW_TYPE_STRING, ldap_instance_t, userobj_scope_str), "sub" },
        { "base_dn", FR_CONF_OFFSET(PW_TYPE_STRING, ldap_instance_t, userobj_base_dn), "" },