remove '&' from ldap

diff --git a/doc/antora/modules/reference/pages/raddb/mods-available/ldap.adoc b/doc/antora/modules/reference/pages/raddb/mods-available/ldap.adoc
index 9324928769f8af122be8a6930af3d3d08ef5ebd4..2a8fb9a9991d7ad0a26ba8ffc021451c1ccc8bc5 100644 (file)
--- a/doc/antora/modules/reference/pages/raddb/mods-available/ldap.adoc
+++ b/doc/antora/modules/reference/pages/raddb/mods-available/ldap.adoc
@@ -1,3 +1,7 @@
+
+
+
+
 = LDAP (Lightweight Directory Access Protocol) Module
 
 The `ldap` module allows LDAP directory entries to be retrieved, modified,
@@ -196,8 +200,8 @@ e.g:
 [source, unlang]
 ----
 ldap
-if ((ok || updated) && &User-Password) {
-       &control.Auth-Type := ::ldap
+if ((ok || updated) && User-Password) {
+       control.Auth-Type := ::ldap
 }
 ----
 ====
@@ -462,8 +466,8 @@ specified by 'default' or in the user or group objects.
 
 default:: The default profile. This may be a DN or an attribute reference.
 
-NOTE: To get old v2.2.x style behaviour, or to use the `&User-Profile` attribute
-to specify the default profile, set this to `&control.User-Profile`.
+NOTE: To get old v2.2.x style behaviour, or to use the `User-Profile` attribute
+to specify the default profile, set this to `control.User-Profile`.
 
 
 
@@ -500,6 +504,22 @@ or the attributes do not have an ORDERING rule, the search will fail.
 
 
 
+check_attribute:: The LDAP attribute containing conditions which
+will be evaluated to determine whether a profile should be applied.
+
+
+
+fallthrough_attribute:: The LDAP attribute containing a condition
+which will be evaluated to determine whether more profiles should
+be applied after this one.
+
+
+
+fallthrough_def:: If the attribute referenced in fallthrough_attribute
+is not in the reply, what should be the default behaviour
+
+
+
 ### Modify user object on receiving Accounting-Request
 
 Useful for recording things like the last time the user logged
@@ -792,8 +812,8 @@ in LDAP URIs and DNs, and will not be escaped or modified.
 
 [source,unlang]
 ----
-&my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
-&reply.Reply-Message := "The LDAP url is %ldap.uri.escape(%{my-string}}"
+my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
+reply.Reply-Message := "The LDAP url is %ldap.uri.escape(%{my-string}}"
 ----
 
 .Output
@@ -814,7 +834,7 @@ usually prohibited.
 
 [source,unlang]
 ----
-&my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
+my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
 ----
 
 ### %ldap.uri.unescape(...)
@@ -827,8 +847,8 @@ Unescape a string for use in an LDAP filter or DN.
 
 [source,unlang]
 ----
-&my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?\28objectClass=radiusprofile\29"
-&reply.Reply-Message := "The LDAP url is %ldap.uri.unescape(%{my-string})"
+my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?\28objectClass=radiusprofile\29"
+reply.Reply-Message := "The LDAP url is %ldap.uri.unescape(%{my-string})"
 ----
 
 .Output
@@ -877,29 +897,29 @@ ldap {
        }
 #      valuepair_attribute = 'radiusAttribute'
        update {
-               &control.Password.With-Header   += 'userPassword'
-#              &control.Password.NT            := 'ntPassword'
-#              &reply.Reply-Message            := 'radiusReplyMessage'
-#              &reply.Tunnel-Type              := 'radiusTunnelType'
-#              &reply.Tunnel-Medium-Type       := 'radiusTunnelMediumType'
-#              &reply.Tunnel-Private-Group-ID  := 'radiusTunnelPrivategroupId'
-               &control                        += 'radiusControlAttribute'
-               &request                        += 'radiusRequestAttribute'
-               &reply                          += 'radiusReplyAttribute'
+               control.Password.With-Header    += 'userPassword'
+#              control.Password.NT             := 'ntPassword'
+#              reply.Reply-Message             := 'radiusReplyMessage'
+#              reply.Tunnel-Type               := 'radiusTunnelType'
+#              reply.Tunnel-Medium-Type        := 'radiusTunnelMediumType'
+#              reply.Tunnel-Private-Group-ID   := 'radiusTunnelPrivategroupId'
+               control                 += 'radiusControlAttribute'
+               request                 += 'radiusRequestAttribute'
+               reply                           += 'radiusReplyAttribute'
        }
 #      edir = no
 #      edir_autz = no
        user {
                base_dn = "${..base_dn}"
-               filter = "(uid=%{&Stripped-User-Name || &User-Name})"
-#              filter = "(&(objectClass=user)(sAMAccountName=%{&Stripped-User-Name || &User-Name})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
+               filter = "(uid=%{&Stripped-User-Name || User-Name})"
+#              filter = "(&(objectClass=user)(sAMAccountName=%{Stripped-User-Name || User-Name})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
                sasl {
 #                      mech = 'PLAIN'
-#                      authname = &User-Name
-#                      proxy = &User-Name
+#                      authname = User-Name
+#                      proxy = User-Name
 #                      realm = 'example.org'
                }
-#              password_attribute = &User-Password
+#              password_attribute = User-Password
 #              scope = 'sub'
 #              sort_by = '-uid'
 #              access_attribute = 'dialupAccess'
@@ -913,7 +933,7 @@ ldap {
                filter = '(objectClass=posixGroup)'
 #              scope = 'sub'
 #              name_attribute = cn
-#              membership_filter = "(|(member=%{control.Ldap-UserDn})(memberUid=%{&Stripped-User-Name || &User-Name}))"
+#              membership_filter = "(|(member=%{control.Ldap-UserDn})(memberUid=%{Stripped-User-Name || User-Name}))"
                membership_attribute = 'memberOf'
 #              cacheable_name = 'no'
 #              cacheable_dn = 'no'
@@ -929,6 +949,9 @@ ldap {
 #              attribute = 'radiusProfileDn'
 #              attribute_suspend = 'radiusProfileDn'
 #              sort_by = 'radiusProfilePriority'
+#              check_attribute = 'radiusProfileCondition'
+#              fallthrough_attribute = 'radiusProfileFallthrough'
+#              fallthrough_default = yes
        }
        accounting {
                start {

diff --git a/raddb/mods-available/ldap b/raddb/mods-available/ldap
index d455637423551ea0d9d4b22aa718ed3283388dbe..66b33c08611e25884cea94c2d7fc463b7778f6f3 100644 (file)
--- a/raddb/mods-available/ldap
+++ b/raddb/mods-available/ldap
@@ -191,19 +191,19 @@ ldap {
        #  update { ... }::
        #
        update {
-               &control.Password.With-Header   += 'userPassword'
-#              &control.Password.NT            := 'ntPassword'
-#              &reply.Reply-Message            := 'radiusReplyMessage'
-#              &reply.Tunnel-Type              := 'radiusTunnelType'
-#              &reply.Tunnel-Medium-Type       := 'radiusTunnelMediumType'
-#              &reply.Tunnel-Private-Group-ID  := 'radiusTunnelPrivategroupId'
+               control.Password.With-Header    += 'userPassword'
+#              control.Password.NT             := 'ntPassword'
+#              reply.Reply-Message             := 'radiusReplyMessage'
+#              reply.Tunnel-Type               := 'radiusTunnelType'
+#              reply.Tunnel-Medium-Type        := 'radiusTunnelMediumType'
+#              reply.Tunnel-Private-Group-ID   := 'radiusTunnelPrivategroupId'
 
                #  NOTE: Where only a list is specified as the RADIUS attribute,
                #  the value of the LDAP attribute is parsed as a valuepair
                #  in the same format as the 'valuepair_attribute' (above).
-               &control                        += 'radiusControlAttribute'
-               &request                        += 'radiusRequestAttribute'
-               &reply                          += 'radiusReplyAttribute'
+               control                 += 'radiusControlAttribute'
+               request                 += 'radiusRequestAttribute'
+               reply                           += 'radiusReplyAttribute'
        }
 
        #
@@ -230,8 +230,8 @@ ldap {
        #  [source, unlang]
        #  ----
        #  ldap
-       #  if ((ok || updated) && &User-Password) {
-       #       &control.Auth-Type := ::ldap
+       #  if ((ok || updated) && User-Password) {
+       #       control.Auth-Type := ::ldap
        #  }
        #  ----
        #  ====
@@ -250,7 +250,7 @@ ldap {
                #  filter:: Filter for user objects, should be specific enough
                #  to identify a single user object.
                #
-               filter = "(uid=%{&Stripped-User-Name || &User-Name})"
+               filter = "(uid=%{&Stripped-User-Name || User-Name})"
 
                #  For Active Directory nested group, you should comment out the previous 'filter = ...'
                #  and use the below. Where 'group' is the group you are querying for.
@@ -263,7 +263,7 @@ ldap {
                #
                #  See: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx
                #
-#              filter = "(&(objectClass=user)(sAMAccountName=%{&Stripped-User-Name || &User-Name})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
+#              filter = "(&(objectClass=user)(sAMAccountName=%{Stripped-User-Name || User-Name})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
 
                #
                #  sasl { ... }:: SASL parameters to use for user binds
@@ -285,12 +285,12 @@ ldap {
                        #  authname:: SASL authentication name.  Mechanism specific value
                        #  to use when prompted for the client authentication name.
                        #
-#                      authname = &User-Name
+#                      authname = User-Name
 
                        #
                        #  proxy:: SASL authorisation identity to proxy.
                        #
-#                      proxy = &User-Name
+#                      proxy = User-Name
 
                        #
                        #  realm:: SASL realm. Used for kerberos.
@@ -309,7 +309,7 @@ ldap {
                #  Service, CN=Windows NT, CN=Services, CN=Configuration` object.  Modify the
                #  `msDS-Other-Settings` attribute, and add a new entry for `DenyUnauthenticatedBind=1`.
                #
-#              password_attribute = &User-Password
+#              password_attribute = User-Password
 
                #
                #  scope:: Search scope, may be `base`, `one`, `sub' or `children`.
@@ -426,7 +426,7 @@ ldap {
                #  That is, group objects with attributes that identify
                #  members (the inverse of `membership_attribute`).
                #
-#              membership_filter = "(|(member=%{control.Ldap-UserDn})(memberUid=%{&Stripped-User-Name || &User-Name}))"
+#              membership_filter = "(|(member=%{control.Ldap-UserDn})(memberUid=%{Stripped-User-Name || User-Name}))"
 
                #
                #  membership_attribute:: The attribute, in user objects, which contain
@@ -532,8 +532,8 @@ ldap {
                #
                #  default:: The default profile. This may be a DN or an attribute reference.
                #
-               #  NOTE: To get old v2.2.x style behaviour, or to use the `&User-Profile` attribute
-               #  to specify the default profile, set this to `&control.User-Profile`.
+               #  NOTE: To get old v2.2.x style behaviour, or to use the `User-Profile` attribute
+               #  to specify the default profile, set this to `control.User-Profile`.
                #
 #              default = 'cn=radprofile,dc=example,dc=org'
 
@@ -957,8 +957,8 @@ ldap {
 #
 #  [source,unlang]
 #  ----
-#  &my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
-#  &reply.Reply-Message := "The LDAP url is %ldap.uri.escape(%{my-string}}"
+#  my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
+#  reply.Reply-Message := "The LDAP url is %ldap.uri.escape(%{my-string}}"
 #  ----
 #
 #  .Output
@@ -979,7 +979,7 @@ ldap {
 #
 #  [source,unlang]
 #  ----
-#  &my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
+#  my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
 #  ----
 #
 #  ### %ldap.uri.unescape(...)
@@ -992,8 +992,8 @@ ldap {
 #
 #  [source,unlang]
 #  ----
-#  &my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?\28objectClass=radiusprofile\29"
-#  &reply.Reply-Message := "The LDAP url is %ldap.uri.unescape(%{my-string})"
+#  my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?\28objectClass=radiusprofile\29"
+#  reply.Reply-Message := "The LDAP url is %ldap.uri.unescape(%{my-string})"
 #  ----
 #
 #  .Output

diff --git a/src/tests/modules/ldap/xlat_profile.unlang b/src/tests/modules/ldap/xlat_profile.unlang
index 0f33744b7b6f285a01f3b775bb7f3befa3672a91..f4c978866e61ee21cbecd16728735f6a751a68ff 100644 (file)
--- a/src/tests/modules/ldap/xlat_profile.unlang
+++ b/src/tests/modules/ldap/xlat_profile.unlang
@@ -85,7 +85,7 @@ reply := {}
 
 # Re-run the above with a different user name - the profile with "Guten Tag"
 # as the reply message has a condition of User-Name == bob
-&User-Name := 'john'
+User-Name := 'john'
 if (!%ldap.profile('cn=nested,ou=profiles,dc=example,dc=com')) {
        test_fail
 }