Merge r1125646 from trunk:

Some LDAP servers (wrongly) return LDAP_CONSTRAINT_VIOLATION if a user is
locked due to too many password retries. This should not cause an internal
server error but be treated as "auth denied".

Submitted by: sf
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1162864 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 4027cf983a9a36b66ef891b76d95809f706fb538..cf22c79862ccd6e39d6dec6faa53c087cd5c2856 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.2.20
 
+  *) mod_authnz_ldap: If the LDAP server returns constraint violation,
+     don't treat this as an error but as "auth denied". [Stefan Fritsch]
+
   *) mod_reqtimeout: Fix a timed out connection going into the keep-alive
      state after a timeout when discarding a request body. PR 51103.
      [Stefan Fritsch]

diff --git a/STATUS b/STATUS
index 29a10ebf1366682fdba73ea023d7840d8d93ffc8..9d635d67e7e12b65638fdf6acfe172f8f8626155 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -92,11 +92,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  * mod_authnz_ldap: Treat 'constraint violation' as auth denied, not as
-    internal server error.
-    Trunk patch: http://svn.apache.org/viewvc?rev=1125646&view=rev
-    2.2.x patch: trunk patch works except for CHANGES
-    +1: sf, covener, jim
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]

diff --git a/modules/aaa/mod_authnz_ldap.c b/modules/aaa/mod_authnz_ldap.c
index 037bbcffdabe56d9790b6ac01a5546bbaf7ece83..ce1af3db4de82c18408505815fceae0985f32d09 100644 (file)
--- a/modules/aaa/mod_authnz_ldap.c
+++ b/modules/aaa/mod_authnz_ldap.c
@@ -464,6 +464,12 @@ start_over:
 #ifdef LDAP_INSUFFICIENT_RIGHTS
                  : (LDAP_INSUFFICIENT_RIGHTS == result) ? AUTH_DENIED
 #endif
+#endif
+#ifdef LDAP_CONSTRAINT_VIOLATION
+    /* At least Sun Directory Server sends this if a user is
+     * locked. This is not covered by LDAP_SECURITY_ERROR.
+     */
+                 : (LDAP_CONSTRAINT_VIOLATION == result) ? AUTH_DENIED
 #endif
                  : AUTH_GENERAL_ERROR;
     }