From: Howard Chu <hyc@openldap.org>
Date: Wed, 19 Jun 2019 11:29:02 +0000 (+0100)
Subject: ITS#9038 restrict rootDN proxyauthz to its own DBs.
X-Git-Tag: OPENLDAP_REL_ENG_2_4_48~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f120d0e461178b5974694876ba2d2bdba4f7d122;p=thirdparty%2Fopenldap.git

ITS#9038 restrict rootDN proxyauthz to its own DBs.

Treat as normal user for any other DB.
---

diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index 64c70537d1..b3727eafe1 100644
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -2062,12 +2062,13 @@ int slap_sasl_authorized( Operation *op,
 		goto DONE;
 	}
 
-	/* Allow the manager to authorize as any DN. */
-	if( op->o_conn->c_authz_backend &&
-		be_isroot_dn( op->o_conn->c_authz_backend, authcDN ))
+	/* Allow the manager to authorize as any DN in its own DBs. */
 	{
-		rc = LDAP_SUCCESS;
-		goto DONE;
+		Backend *zbe = select_backend( authzDN, 1 );
+		if ( zbe && be_isroot_dn( zbe, authcDN )) {
+			rc = LDAP_SUCCESS;
+			goto DONE;
+		}
 	}
 
 	/* Check source rules */