Add expect_password to disable password warnings in rlm_ldap

diff --git a/raddb/mods-available/ldap b/raddb/mods-available/ldap
index 3c11751c60b09f4206b0f0ca958f6bdd82d8bdf1..44c0e1f541cf3b90a52a3799d5ee32a9df2b58ed 100644 (file)
--- a/raddb/mods-available/ldap
+++ b/raddb/mods-available/ldap
@@ -373,6 +373,14 @@ ldap {
                #  to indicate that the user should be suspended.
                #
 #              access_value_suspend = 'suspended'
+
+               #
+               #  expect_password:: When set to no, disable warnings for missing password
+               #  attributes in user objects returned from LDAP.  This is useful for
+               #  ISP environments where some subscribers have passwords set, and others
+               #  do not (e.g. mixed IPoE and PPPoE).
+               #
+#              expect_password = no
        }
 
        #

diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c
index 1024604839519454eb0a647d1e960cb622003537..b19e616a80f853842417ba67673ad44b8357abab 100644 (file)
--- a/src/modules/rlm_ldap/rlm_ldap.c
+++ b/src/modules/rlm_ldap/rlm_ldap.c
@@ -104,6 +104,7 @@ static conf_parser_t user_config[] = {
        { FR_CONF_OFFSET("access_positive", rlm_ldap_t, user.access_positive), .dflt = "yes" },
        { FR_CONF_OFFSET("access_value_negate", rlm_ldap_t, user.access_value_negate), .dflt = "false" },
        { FR_CONF_OFFSET("access_value_suspend", rlm_ldap_t, user.access_value_suspend), .dflt = "suspended" },
+       { FR_CONF_OFFSET_IS_SET("expect_password", FR_TYPE_BOOL, 0, rlm_ldap_t, user.expect_password) },
        CONF_PARSER_TERMINATOR
 };
 
@@ -1655,7 +1656,7 @@ static unlang_action_t mod_authorize_resume(rlm_rcode_t *p_result, UNUSED int *p
                        if (fr_ldap_map_do(request, inst->valuepair_attr,
                                           &autz_ctx->expanded, autz_ctx->entry) > 0) rcode = RLM_MODULE_UPDATED;
                        REXDENT();
-                       rlm_ldap_check_reply(request, autz_ctx->dlinst->name, call_env->expect_password->vb_bool, autz_ctx->ttrunk);
+                       rlm_ldap_check_reply(request, inst, autz_ctx->dlinst->name, call_env->expect_password->vb_bool, autz_ctx->ttrunk);
                }
                FALL_THROUGH;
 

diff --git a/src/modules/rlm_ldap/rlm_ldap.h b/src/modules/rlm_ldap/rlm_ldap.h
index 22cddf3c591a74b939e9963662152fd56f3ebd30..afdbfe5ad7ca29b2137aafa93f4fd8060030da28 100644 (file)
--- a/src/modules/rlm_ldap/rlm_ldap.h
+++ b/src/modules/rlm_ldap/rlm_ldap.h
@@ -50,6 +50,9 @@ typedef struct {
                char const      *access_value_suspend;          //!< Value that indicates suspension.  Is not affected by
                                                                ///< access_positive and will always allow access, but will apply
                                                                ///< a different profile.
+               bool            expect_password;                //!< Allow the user to forcefully decide if a password should be
+                                                               ///< expected.  Controls whether warnings are issued.
+               bool            expect_password_is_set;         //!< Whether an expect password value was provided.
        } user;
 
        /*
@@ -258,7 +261,7 @@ unlang_action_t rlm_ldap_find_user_async(TALLOC_CTX *ctx, rlm_ldap_t const *inst
 
 ldap_access_state_t rlm_ldap_check_access(rlm_ldap_t const *inst, request_t *request, LDAPMessage *entry);
 
-void rlm_ldap_check_reply(request_t *request, char const *inst_name, bool expect_password, fr_ldap_thread_trunk_t const *ttrunk);
+void rlm_ldap_check_reply(request_t *request, rlm_ldap_t *inst, char const *inst_name, bool expect_password, fr_ldap_thread_trunk_t const *ttrunk);
 
 /*
  *     groups.c - Group membership functions.

diff --git a/src/modules/rlm_ldap/user.c b/src/modules/rlm_ldap/user.c
index 9b04d80636f9fce6302b543c789e83e3907186db..2be5316bd858286318a4e4266dd6e7c3be9de668 100644 (file)
--- a/src/modules/rlm_ldap/user.c
+++ b/src/modules/rlm_ldap/user.c
@@ -254,7 +254,7 @@ void rlm_ldap_check_reply(request_t *request, rlm_ldap_t const *inst, char const
        *       Expect_password is set when we process the mapping, and is only true if there was a mapping between
        *       an LDAP attribute and a password reference attribute in the control list.
        */
-       if (!expect_password || !RDEBUG_ENABLED2) return;
+       if ((inst->user.expect_password_is_set && !inst->user.expect_password) || !expect_password || !RDEBUG_ENABLED2) return;
 
        parent = fr_pair_find_by_da_nested(&request->control_pairs, NULL, attr_password);
        if (!parent) parent = request->control_ctx;