autofs-5.0.5 - add simple bind authentication From: James Y Knight This patch adds the ability to do a simple bind against an LDAP server with the configured username and password. --- CHANGELOG | 1 + include/lookup_ldap.h | 1 + modules/lookup_ldap.c | 21 +++++++++++++-------- samples/autofs_ldap_auth.conf | 16 +++++++++------- 4 files changed, 24 insertions(+), 15 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 5973824..d95542d 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -28,6 +28,7 @@ - fix ampersand escape in auto.smb. - add locality as valid ldap master map attribute. - add locality as valid ldap master map attribute fix. +- add simple bind authentication. 03/09/2009 autofs-5.0.5 ----------------------- diff --git a/include/lookup_ldap.h b/include/lookup_ldap.h index dcae220..1e1c7a4 100644 --- a/include/lookup_ldap.h +++ b/include/lookup_ldap.h @@ -97,6 +97,7 @@ struct lookup_context { #define LDAP_AUTH_NOTREQUIRED 0x0001 #define LDAP_AUTH_REQUIRED 0x0002 #define LDAP_AUTH_AUTODETECT 0x0004 +#define LDAP_AUTH_USESIMPLE 0x0008 /* lookup_ldap.c */ LDAP *init_ldap_connection(unsigned logopt, const char *uri, struct lookup_context *ctxt); diff --git a/modules/lookup_ldap.c b/modules/lookup_ldap.c index 8387951..d7d4f71 100644 --- a/modules/lookup_ldap.c +++ b/modules/lookup_ldap.c @@ -137,11 +137,13 @@ static void uris_mutex_unlock(struct lookup_context *ctxt) return; } -int bind_ldap_anonymous(unsigned logopt, LDAP *ldap, const char *uri, struct lookup_context *ctxt) +int bind_ldap_simple(unsigned logopt, LDAP *ldap, const char *uri, struct lookup_context *ctxt) { int rv; - if (ctxt->version == 2) + if (ctxt->auth_required == LDAP_AUTH_USESIMPLE) + rv = ldap_simple_bind_s(ldap, ctxt->user, ctxt->secret); + else if (ctxt->version == 2) rv = ldap_simple_bind_s(ldap, ctxt->base, NULL); else rv = ldap_simple_bind_s(ldap, NULL, NULL); @@ -517,12 +519,12 @@ static int do_bind(unsigned logopt, LDAP *ldap, const char *uri, struct lookup_c rv = autofs_sasl_bind(logopt, ldap, ctxt); debug(logopt, MODPREFIX "autofs_sasl_bind returned %d", rv); } else { - rv = bind_ldap_anonymous(logopt, ldap, uri, ctxt); - debug(logopt, MODPREFIX "ldap anonymous bind returned %d", rv); + rv = bind_ldap_simple(logopt, ldap, uri, ctxt); + debug(logopt, MODPREFIX "ldap simple bind returned %d", rv); } #else - rv = bind_ldap_anonymous(logopt, ldap, uri, ctxt); - debug(logopt, MODPREFIX "ldap anonymous bind returned %d", rv); + rv = bind_ldap_simple(logopt, ldap, uri, ctxt); + debug(logopt, MODPREFIX "ldap simple bind returned %d", rv); #endif if (rv != 0) @@ -971,11 +973,13 @@ int parse_ldap_config(unsigned logopt, struct lookup_context *ctxt) auth_required = LDAP_AUTH_NOTREQUIRED; else if (!strcasecmp(authrequired, "autodetect")) auth_required = LDAP_AUTH_AUTODETECT; + else if (!strcasecmp(authrequired, "simple")) + auth_required = LDAP_AUTH_USESIMPLE; else { error(logopt, MODPREFIX "The authrequired property must have value " - "\"yes\", \"no\" or \"autodetect\"."); + "\"yes\", \"no\", \"autodetect\", or \"simple\"."); ret = -1; goto out; } @@ -991,7 +995,8 @@ int parse_ldap_config(unsigned logopt, struct lookup_context *ctxt) goto out; } - if (authtype && authtype_requires_creds(authtype)) { + if (auth_required == LDAP_AUTH_USESIMPLE || + (authtype && authtype_requires_creds(authtype))) { ret = get_property(logopt, root, "user", &user); ret |= get_property(logopt, root, "secret", &secret); if (ret != 0 || (!user || !secret)) { diff --git a/samples/autofs_ldap_auth.conf b/samples/autofs_ldap_auth.conf index a1f60c0..be5e7dd 100644 --- a/samples/autofs_ldap_auth.conf +++ b/samples/autofs_ldap_auth.conf @@ -17,17 +17,19 @@ tlsrequired - This flag tells whether the ldap connection must be authrequired - This option tells whether an authenticated connection to the ldap server is required in order to perform ldap queries. - If this flag is set to yes, then only authenticated connections + If the flag is set to yes, only sasl authenticated connections will be allowed. If it is set to no then authentication is not - needed for ldap server connections. Finally, if it is set to - autodetect then the ldap server will be queried to establish - a suitable authentication mechanism. If no suitable mechanism - can be found, connections to the ldap server are made without - authentication. - Legal values for this option include: + needed for ldap server connections. If it is set to autodetect + then the ldap server will be queried to establish a suitable sasl + authentication mechanism. If no suitable mechanism can be found, + connections to the ldap server are made without authentication. + Finally, if it is set to simple, then simple authentication will + be used instead of SASL. + "yes" "no" "autodetect" + "simple" authtype - This attribute can be used to specify a preferred authentication mechanism. In normal operations, the