Autoload rlm_ldap attributes

diff --git a/src/modules/rlm_ldap/groups.c b/src/modules/rlm_ldap/groups.c
index 5a7d294432647bb6cbdba47e9a33838b9587e32e..332ed9af557d9e1ec70ccfd542afac3fb363d6b4 100644 (file)
--- a/src/modules/rlm_ldap/groups.c
+++ b/src/modules/rlm_ldap/groups.c
@@ -804,9 +804,9 @@ finish:
 
 /** Check group membership attributes to see if a user is a member.
  *
- * @param[in] inst rlm_ldap configuration.
- * @param[in] request Current request.
- * @param[in] check vp containing the group value (name or dn).
+ * @param[in] inst     rlm_ldap configuration.
+ * @param[in] request  Current request.
+ * @param[in] check    vp containing the group value (name or dn).
  *
  * @return One of the RLM_MODULE_* values.
  */
@@ -814,32 +814,29 @@ rlm_rcode_t rlm_ldap_check_cached(rlm_ldap_t const *inst, REQUEST *request, VALU
 {
        VALUE_PAIR      *vp;
        int             ret;
-       vp_cursor_t     cursor;
-
-       fr_pair_cursor_init(&cursor, &request->control);
+       fr_cursor_t     cursor;
 
        /*
         *      We return RLM_MODULE_INVALID here as an indication
         *      the caller should try a dynamic group lookup instead.
         */
-       vp = fr_pair_cursor_next_by_num(&cursor, fr_dict_vendor_num_by_da(inst->cache_da),
-                                       inst->cache_da->attr, TAG_ANY);
+       vp = fr_cursor_talloc_iter_init(&cursor, &request->control,
+                                       fr_pair_iter_next_by_da, inst->cache_da, VALUE_PAIR);
        if (!vp) return RLM_MODULE_INVALID;
-       fr_pair_cursor_first(&cursor);
 
-       while ((vp = fr_pair_cursor_next_by_num(&cursor, fr_dict_vendor_num_by_da(inst->cache_da),
-                                               inst->cache_da->attr, TAG_ANY))) {
+       for (vp = fr_cursor_current(&cursor);
+            vp;
+            vp = fr_cursor_next(&cursor)) {
                ret = fr_pair_cmp_op(T_OP_CMP_EQ, vp, check);
                if (ret == 1) {
                        RDEBUG2("User found. Matched cached membership");
                        return RLM_MODULE_OK;
                }
 
-               if (ret < -1) {
-                       return RLM_MODULE_FAIL;
-               }
+               if (ret < -1) return RLM_MODULE_FAIL;
        }
 
        RDEBUG2("Cached membership not found");
+
        return RLM_MODULE_NOTFOUND;
 }

diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c
index bdcca49768d3eab63fe2880fc085b96aaec59666..d73cb61e8fec08b0b1ee462b541d7911d5d45653 100644 (file)
--- a/src/modules/rlm_ldap/rlm_ldap.c
+++ b/src/modules/rlm_ldap/rlm_ldap.c
@@ -233,14 +233,24 @@ fr_dict_autoload_t rlm_ldap_dict[] = {
        { NULL }
 };
 
-static fr_dict_attr_t const *attr_cleartext_password;
+fr_dict_attr_t const *attr_cleartext_password;
+fr_dict_attr_t const *attr_crypt_password;
+fr_dict_attr_t const *attr_ldap_userdn;
+fr_dict_attr_t const *attr_nt_password;
+fr_dict_attr_t const *attr_password_with_header;
 
-static fr_dict_attr_t const *attr_user_name;
+fr_dict_attr_t const *attr_user_password;
+fr_dict_attr_t const *attr_user_name;
 
 extern fr_dict_attr_autoload_t rlm_ldap_dict_attr[];
 fr_dict_attr_autoload_t rlm_ldap_dict_attr[] = {
        { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+       { .out = &attr_crypt_password, .name = "Crypt-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+       { .out = &attr_ldap_userdn, .name = "LDAP-UserDN", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+       { .out = &attr_nt_password, .name = "NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+       { .out = &attr_password_with_header, .name = "Password-With-Header", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
 
+       { .out = &attr_user_password, .name = "User-Password", .type = FR_TYPE_STRING, .dict = &dict_radius },
        { .out = &attr_user_name, .name = "User-Name", .type = FR_TYPE_STRING, .dict = &dict_radius },
 
        { NULL }
@@ -706,8 +716,9 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void
        }
 
        if (!request->password ||
-           (request->password->da->attr != FR_USER_PASSWORD)) {
+           (request->password->da != attr_user_password)) {
                RWDEBUG("You have set \"Auth-Type := LDAP\" somewhere");
+               RWDEBUG("without checking if User-Password is present");
                RWDEBUG("*********************************************");
                RWDEBUG("* THAT CONFIGURATION IS WRONG.  DELETE IT.   ");
                RWDEBUG("* YOU ARE PREVENTING THE SERVER FROM WORKING");

diff --git a/src/modules/rlm_ldap/rlm_ldap.h b/src/modules/rlm_ldap/rlm_ldap.h
index e1bf7a209df87a4efd7da058c8d7eab72cbda1aa..52c8fd3a703ff95145a8ecd2fdb0f32cee6d8384 100644 (file)
--- a/src/modules/rlm_ldap/rlm_ldap.h
+++ b/src/modules/rlm_ldap/rlm_ldap.h
@@ -148,6 +148,15 @@ struct ldap_inst_s {
        uint32_t        ldap_debug;                     //!< Debug flag for the SDK.
 };
 
+extern fr_dict_attr_t const *attr_cleartext_password;
+extern fr_dict_attr_t const *attr_crypt_password;
+extern fr_dict_attr_t const *attr_ldap_userdn;
+extern fr_dict_attr_t const *attr_nt_password;
+extern fr_dict_attr_t const *attr_password_with_header;
+
+extern fr_dict_attr_t const *attr_user_password;
+extern fr_dict_attr_t const *attr_user_name;
+
 /*
  *     user.c - User lookup functions
  */

diff --git a/src/modules/rlm_ldap/user.c b/src/modules/rlm_ldap/user.c
index e7606d572de416f5f331e83d999755576ef41d56..53797a8fa3530c6c24a855113f95d628df6db53f 100644 (file)
--- a/src/modules/rlm_ldap/user.c
+++ b/src/modules/rlm_ldap/user.c
@@ -86,9 +86,9 @@ char const *rlm_ldap_find_user(rlm_ldap_t const *inst, REQUEST *request, fr_ldap
         *      If the caller isn't looking for the result we can just return the current userdn value.
         */
        if (!force) {
-               vp = fr_pair_find_by_num(request->control, 0, FR_LDAP_USERDN, TAG_ANY);
+               vp = fr_pair_find_by_da(request->control, attr_ldap_userdn, TAG_ANY);
                if (vp) {
-                       RDEBUG("Using user DN from request \"%s\"", vp->vp_strvalue);
+                       RDEBUG("Using user DN from request \"%pV\"", &vp->data);
                        *rcode = RLM_MODULE_OK;
                        return vp->vp_strvalue;
                }
@@ -199,11 +199,11 @@ char const *rlm_ldap_find_user(rlm_ldap_t const *inst, REQUEST *request, fr_ldap
         *      we pass the string back to libldap we must not alter it.
         */
        RDEBUG("User object found at DN \"%s\"", dn);
-       vp = fr_pair_make(request, &request->control, "LDAP-UserDN", NULL, T_OP_EQ);
-       if (vp) {
-               fr_pair_value_strcpy(vp, dn);
-               *rcode = RLM_MODULE_OK;
-       }
+
+       MEM(pair_update_control(&vp, attr_ldap_userdn) >= 0);
+       fr_pair_value_strcpy(vp, dn);
+       *rcode = RLM_MODULE_OK;
+
        ldap_memfree(dn);
 
 finish:
@@ -271,11 +271,11 @@ void rlm_ldap_check_reply(rlm_ldap_t const *inst, REQUEST *request, fr_ldap_conn
        */
        if (!inst->expect_password || (rad_debug_lvl < L_DBG_LVL_2)) return;
 
-       if (!fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY) &&
-           !fr_pair_find_by_num(request->control, 0, FR_NT_PASSWORD, TAG_ANY) &&
-           !fr_pair_find_by_num(request->control, 0, FR_USER_PASSWORD, TAG_ANY) &&
-           !fr_pair_find_by_num(request->control, 0, FR_PASSWORD_WITH_HEADER, TAG_ANY) &&
-           !fr_pair_find_by_num(request->control, 0, FR_CRYPT_PASSWORD, TAG_ANY)) {
+       if (!fr_pair_find_by_da(request->control, attr_cleartext_password, TAG_ANY) &&
+           !fr_pair_find_by_da(request->control, attr_nt_password, TAG_ANY) &&
+           !fr_pair_find_by_da(request->control, attr_user_password, TAG_ANY) &&
+           !fr_pair_find_by_da(request->control, attr_password_with_header, TAG_ANY) &&
+           !fr_pair_find_by_da(request->control, attr_crypt_password, TAG_ANY)) {
                switch (conn->directory->type) {
                case FR_LDAP_DIRECTORY_ACTIVE_DIRECTORY:
                        RWDEBUG("!!! Found map between LDAP attribute and a FreeRADIUS password attribute");