LDAP-Sync.Directory-Root-DN has to be marked safe to use as a DN

diff --git a/doc/antora/modules/raddb/pages/sites-available/ldap_sync.adoc b/doc/antora/modules/raddb/pages/sites-available/ldap_sync.adoc
index 095121bb6bed7ad668b92a0969605c421f55cad1..532413f637b4caffae47e1abeccd31c5bc94db82 100644 (file)
--- a/doc/antora/modules/raddb/pages/sites-available/ldap_sync.adoc
+++ b/doc/antora/modules/raddb/pages/sites-available/ldap_sync.adoc
@@ -504,7 +504,7 @@ server ldap_sync {
                debug_request
 #              if (!&reply.LDAP-Sync.Cookie) {
 #                      string csn
-#                      &csn := %concat(%ldap("ldap:///%{LDAP-Sync.Directory-Root-DN}?contextCSN?base"), ';')
+#                      &csn := %concat(%ldap("ldap:///%ldap.uri.safe(%{LDAP-Sync.Directory-Root-DN})?contextCSN?base"), ';')
 #                      &reply.LDAP-Sync.Cookie := "rid=000,csn=%{csn}"
 #              }
        }

diff --git a/raddb/sites-available/ldap_sync b/raddb/sites-available/ldap_sync
index 030ec651f116fe87427aac540a4a0e2b0150040a..f9bf3a99d9b291a449b7e31f958e7e52353fd387 100644 (file)
--- a/raddb/sites-available/ldap_sync
+++ b/raddb/sites-available/ldap_sync
@@ -383,7 +383,7 @@ server ldap_sync {
 #              if (!&reply.LDAP-Sync.Cookie) {
 #                      string csn
 #
-#                      &csn := %concat(%ldap("ldap:///%{LDAP-Sync.Directory-Root-DN}?contextCSN?base"), ';')
+#                      &csn := %concat(%ldap("ldap:///%ldap.uri.safe(%{LDAP-Sync.Directory-Root-DN})?contextCSN?base"), ';')
 #                      &reply.LDAP-Sync.Cookie := "rid=000,csn=%{csn}"
 #              }
        }

diff --git a/src/tests/ldap_sync/rfc4533/config/radiusd.conf b/src/tests/ldap_sync/rfc4533/config/radiusd.conf
index 7b21fb5042950fcbb590bf504ed3372be68082c8..01b0dec7fb244dc2f1c9960fec672c2bca2cd029 100644 (file)
--- a/src/tests/ldap_sync/rfc4533/config/radiusd.conf
+++ b/src/tests/ldap_sync/rfc4533/config/radiusd.conf
@@ -194,7 +194,7 @@ server test {
        load Cookie {
                string csn
 
-               &csn := %concat(%ldap("ldap:///%{LDAP-Sync.Directory-Root-DN}?contextCSN?base"), ';')
+               &csn := %concat(%ldap("ldap:///%ldap.uri.safe(%{LDAP-Sync.Directory-Root-DN})?contextCSN?base"), ';')
                &reply.LDAP-Sync.Cookie := "rid=000,csn=%{csn}"
        }