From: Arran Cudbard-Bell Date: Mon, 21 May 2018 08:48:38 +0000 (+0600) Subject: Autoload rlm_ldap attributes X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1349ed0732eb1858f00216248edbc5622b4181e6;p=thirdparty%2Ffreeradius-server.git Autoload rlm_ldap attributes --- diff --git a/src/modules/rlm_ldap/groups.c b/src/modules/rlm_ldap/groups.c index 5a7d2944326..332ed9af557 100644 --- a/src/modules/rlm_ldap/groups.c +++ b/src/modules/rlm_ldap/groups.c @@ -804,9 +804,9 @@ finish: /** Check group membership attributes to see if a user is a member. * - * @param[in] inst rlm_ldap configuration. - * @param[in] request Current request. - * @param[in] check vp containing the group value (name or dn). + * @param[in] inst rlm_ldap configuration. + * @param[in] request Current request. + * @param[in] check vp containing the group value (name or dn). * * @return One of the RLM_MODULE_* values. */ @@ -814,32 +814,29 @@ rlm_rcode_t rlm_ldap_check_cached(rlm_ldap_t const *inst, REQUEST *request, VALU { VALUE_PAIR *vp; int ret; - vp_cursor_t cursor; - - fr_pair_cursor_init(&cursor, &request->control); + fr_cursor_t cursor; /* * We return RLM_MODULE_INVALID here as an indication * the caller should try a dynamic group lookup instead. */ - vp = fr_pair_cursor_next_by_num(&cursor, fr_dict_vendor_num_by_da(inst->cache_da), - inst->cache_da->attr, TAG_ANY); + vp = fr_cursor_talloc_iter_init(&cursor, &request->control, + fr_pair_iter_next_by_da, inst->cache_da, VALUE_PAIR); if (!vp) return RLM_MODULE_INVALID; - fr_pair_cursor_first(&cursor); - while ((vp = fr_pair_cursor_next_by_num(&cursor, fr_dict_vendor_num_by_da(inst->cache_da), - inst->cache_da->attr, TAG_ANY))) { + for (vp = fr_cursor_current(&cursor); + vp; + vp = fr_cursor_next(&cursor)) { ret = fr_pair_cmp_op(T_OP_CMP_EQ, vp, check); if (ret == 1) { RDEBUG2("User found. Matched cached membership"); return RLM_MODULE_OK; } - if (ret < -1) { - return RLM_MODULE_FAIL; - } + if (ret < -1) return RLM_MODULE_FAIL; } RDEBUG2("Cached membership not found"); + return RLM_MODULE_NOTFOUND; } diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c index bdcca49768d..d73cb61e8fe 100644 --- a/src/modules/rlm_ldap/rlm_ldap.c +++ b/src/modules/rlm_ldap/rlm_ldap.c @@ -233,14 +233,24 @@ fr_dict_autoload_t rlm_ldap_dict[] = { { NULL } }; -static fr_dict_attr_t const *attr_cleartext_password; +fr_dict_attr_t const *attr_cleartext_password; +fr_dict_attr_t const *attr_crypt_password; +fr_dict_attr_t const *attr_ldap_userdn; +fr_dict_attr_t const *attr_nt_password; +fr_dict_attr_t const *attr_password_with_header; -static fr_dict_attr_t const *attr_user_name; +fr_dict_attr_t const *attr_user_password; +fr_dict_attr_t const *attr_user_name; extern fr_dict_attr_autoload_t rlm_ldap_dict_attr[]; fr_dict_attr_autoload_t rlm_ldap_dict_attr[] = { { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius }, + { .out = &attr_crypt_password, .name = "Crypt-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius }, + { .out = &attr_ldap_userdn, .name = "LDAP-UserDN", .type = FR_TYPE_STRING, .dict = &dict_freeradius }, + { .out = &attr_nt_password, .name = "NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, + { .out = &attr_password_with_header, .name = "Password-With-Header", .type = FR_TYPE_STRING, .dict = &dict_freeradius }, + { .out = &attr_user_password, .name = "User-Password", .type = FR_TYPE_STRING, .dict = &dict_radius }, { .out = &attr_user_name, .name = "User-Name", .type = FR_TYPE_STRING, .dict = &dict_radius }, { NULL } @@ -706,8 +716,9 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void } if (!request->password || - (request->password->da->attr != FR_USER_PASSWORD)) { + (request->password->da != attr_user_password)) { RWDEBUG("You have set \"Auth-Type := LDAP\" somewhere"); + RWDEBUG("without checking if User-Password is present"); RWDEBUG("*********************************************"); RWDEBUG("* THAT CONFIGURATION IS WRONG. DELETE IT. "); RWDEBUG("* YOU ARE PREVENTING THE SERVER FROM WORKING"); diff --git a/src/modules/rlm_ldap/rlm_ldap.h b/src/modules/rlm_ldap/rlm_ldap.h index e1bf7a209df..52c8fd3a703 100644 --- a/src/modules/rlm_ldap/rlm_ldap.h +++ b/src/modules/rlm_ldap/rlm_ldap.h @@ -148,6 +148,15 @@ struct ldap_inst_s { uint32_t ldap_debug; //!< Debug flag for the SDK. }; +extern fr_dict_attr_t const *attr_cleartext_password; +extern fr_dict_attr_t const *attr_crypt_password; +extern fr_dict_attr_t const *attr_ldap_userdn; +extern fr_dict_attr_t const *attr_nt_password; +extern fr_dict_attr_t const *attr_password_with_header; + +extern fr_dict_attr_t const *attr_user_password; +extern fr_dict_attr_t const *attr_user_name; + /* * user.c - User lookup functions */ diff --git a/src/modules/rlm_ldap/user.c b/src/modules/rlm_ldap/user.c index e7606d572de..53797a8fa35 100644 --- a/src/modules/rlm_ldap/user.c +++ b/src/modules/rlm_ldap/user.c @@ -86,9 +86,9 @@ char const *rlm_ldap_find_user(rlm_ldap_t const *inst, REQUEST *request, fr_ldap * If the caller isn't looking for the result we can just return the current userdn value. */ if (!force) { - vp = fr_pair_find_by_num(request->control, 0, FR_LDAP_USERDN, TAG_ANY); + vp = fr_pair_find_by_da(request->control, attr_ldap_userdn, TAG_ANY); if (vp) { - RDEBUG("Using user DN from request \"%s\"", vp->vp_strvalue); + RDEBUG("Using user DN from request \"%pV\"", &vp->data); *rcode = RLM_MODULE_OK; return vp->vp_strvalue; } @@ -199,11 +199,11 @@ char const *rlm_ldap_find_user(rlm_ldap_t const *inst, REQUEST *request, fr_ldap * we pass the string back to libldap we must not alter it. */ RDEBUG("User object found at DN \"%s\"", dn); - vp = fr_pair_make(request, &request->control, "LDAP-UserDN", NULL, T_OP_EQ); - if (vp) { - fr_pair_value_strcpy(vp, dn); - *rcode = RLM_MODULE_OK; - } + + MEM(pair_update_control(&vp, attr_ldap_userdn) >= 0); + fr_pair_value_strcpy(vp, dn); + *rcode = RLM_MODULE_OK; + ldap_memfree(dn); finish: @@ -271,11 +271,11 @@ void rlm_ldap_check_reply(rlm_ldap_t const *inst, REQUEST *request, fr_ldap_conn */ if (!inst->expect_password || (rad_debug_lvl < L_DBG_LVL_2)) return; - if (!fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY) && - !fr_pair_find_by_num(request->control, 0, FR_NT_PASSWORD, TAG_ANY) && - !fr_pair_find_by_num(request->control, 0, FR_USER_PASSWORD, TAG_ANY) && - !fr_pair_find_by_num(request->control, 0, FR_PASSWORD_WITH_HEADER, TAG_ANY) && - !fr_pair_find_by_num(request->control, 0, FR_CRYPT_PASSWORD, TAG_ANY)) { + if (!fr_pair_find_by_da(request->control, attr_cleartext_password, TAG_ANY) && + !fr_pair_find_by_da(request->control, attr_nt_password, TAG_ANY) && + !fr_pair_find_by_da(request->control, attr_user_password, TAG_ANY) && + !fr_pair_find_by_da(request->control, attr_password_with_header, TAG_ANY) && + !fr_pair_find_by_da(request->control, attr_crypt_password, TAG_ANY)) { switch (conn->directory->type) { case FR_LDAP_DIRECTORY_ACTIVE_DIRECTORY: RWDEBUG("!!! Found map between LDAP attribute and a FreeRADIUS password attribute");