LDAP authorization and authentication module. More...

#include <freeradius-devel/util/debug.h>
#include <freeradius-devel/util/table.h>
#include <freeradius-devel/util/uri.h>
#include <freeradius-devel/util/value.h>
#include <freeradius-devel/ldap/conf.h>
#include <freeradius-devel/ldap/base.h>
#include <freeradius-devel/server/map_proc.h>
#include <freeradius-devel/server/module_rlm.h>
#include <freeradius-devel/server/rcode.h>
#include <freeradius-devel/unlang/xlat_func.h>
#include <freeradius-devel/unlang/action.h>
#include <ldap.h>
#include "rlm_ldap.h"

Include dependency graph for rlm_ldap.c:

Go to the source code of this file.

Data Structures
struct	ldap_auth_call_env_t

struct	ldap_auth_ctx_t
	Holds state of in progress async authentication. More...

struct	ldap_map_ctx_t
	Holds state of in progress LDAP map. More...

struct	ldap_update_rules_t
	Parameters to allow ldap_update_section_parse to be reused. More...

struct	ldap_user_modify_ctx_t
	Holds state of in progress ldap user modifications. More...

struct	ldap_usermod_call_env_t

struct	ldap_xlat_profile_call_env_t
	Call environment used in the profile xlat. More...

struct	ldap_xlat_profile_ctx_t

struct	rlm_ldap_boot_t

Macros
#define	CHECK_EXPANDED_SPACE(_expanded) fr_assert((size_t)_expanded->count < (NUM_ELEMENTS(_expanded->attrs) - 1));

#define	LDAP_URI_SAFE_FOR (fr_value_box_safe_for_t)fr_ldap_uri_escape_func
	This is the common function that actually ends up doing all the URI escaping. More...

#define	REPEAT_LDAP_MEMBEROF_XLAT_RESULTS

#define	REPEAT_MOD_AUTHORIZE_RESUME

#define	USER_CALL_ENV_COMMON(_struct)

Enumerations
enum	ldap_schemes_t { LDAP_SCHEME_UNIX = 0 , LDAP_SCHEME_TCP , LDAP_SCHEME_TCP_SSL }

Functions
static int	autz_ctx_free (ldap_autz_ctx_t *autz_ctx)
	Ensure authorization context is properly cleared up. More...

static char *	host_uri_canonify (request_t request, LDAPURLDesc url_parsed, fr_value_box_t *url_in)
	Produce canonical LDAP host URI for finding trunks. More...

static int	ldap_group_filter_parse (TALLOC_CTX ctx, void out, tmpl_rules_t const t_rules, CONF_ITEM ci, call_env_ctx_t const cec, UNUSED call_env_parser_t const rule)

static int	ldap_group_filter_parse (TALLOC_CTX ctx, void out, tmpl_rules_t const t_rules, UNUSED CONF_ITEM ci, call_env_ctx_t const cec, UNUSED call_env_parser_t const rule)

static xlat_action_t	ldap_group_xlat (TALLOC_CTX ctx, fr_dcursor_t out, xlat_ctx_t const xctx, request_t request, fr_value_box_list_t *in)
	Check for a user being in a LDAP group. More...

static void	ldap_group_xlat_cancel (UNUSED request_t request, UNUSED fr_signal_t action, void uctx)
	Cancel an in-progress query for the LDAP group membership xlat. More...

static unlang_action_t	ldap_group_xlat_results (rlm_rcode_t p_result, UNUSED int priority, request_t request, void uctx)
	Run the state machine for the LDAP membership xlat. More...

static xlat_action_t	ldap_group_xlat_resume (TALLOC_CTX ctx, fr_dcursor_t out, xlat_ctx_t const xctx, UNUSED request_t request, UNUSED fr_value_box_list_t *in)
	Process the results of evaluating LDAP group membership. More...

static unlang_action_t	ldap_group_xlat_user_find (UNUSED rlm_rcode_t p_result, UNUSED int priority, request_t request, void uctx)
	User object lookup as part of group membership xlat. More...

static int	ldap_map_verify (CONF_SECTION cs, UNUSED void const mod_inst, UNUSED void proc_inst, tmpl_t const src, UNUSED map_list_t const *maps)

static xlat_action_t	ldap_profile_xlat (UNUSED TALLOC_CTX ctx, UNUSED fr_dcursor_t out, xlat_ctx_t const xctx, request_t request, fr_value_box_list_t *in)
	Expand an LDAP URL into a query, applying the results using the user update map. More...

static xlat_action_t	ldap_profile_xlat_resume (TALLOC_CTX ctx, fr_dcursor_t out, xlat_ctx_t const xctx, UNUSED request_t request, UNUSED fr_value_box_list_t *in)
	Return whether evaluating the profile was successful. More...

static void	ldap_query_timeout (UNUSED fr_event_list_t el, UNUSED fr_time_t now, void uctx)
	Callback when LDAP query times out. More...

static int	ldap_update_section_parse (TALLOC_CTX ctx, call_env_parsed_head_t out, tmpl_rules_t const t_rules, CONF_ITEM ci, call_env_ctx_t const cec, call_env_parser_t const rule)

static int	ldap_update_section_parse (TALLOC_CTX ctx, call_env_parsed_head_t out, tmpl_rules_t const t_rules, CONF_ITEM ci, UNUSED call_env_ctx_t const cec, call_env_parser_t const rule)

static xlat_action_t	ldap_uri_escape_xlat (TALLOC_CTX ctx, fr_dcursor_t out, UNUSED xlat_ctx_t const xctx, request_t request, fr_value_box_list_t *in)
	Escape LDAP string. More...

static int	ldap_uri_part_escape (fr_value_box_t vb, UNUSED void uctx)
	Escape function for a part of an LDAP URI. More...

static xlat_action_t	ldap_uri_unescape_xlat (TALLOC_CTX ctx, fr_dcursor_t out, UNUSED xlat_ctx_t const xctx, request_t request, fr_value_box_list_t *in)
	Unescape LDAP string. More...

static xlat_action_t	ldap_xlat (UNUSED TALLOC_CTX ctx, UNUSED fr_dcursor_t out, xlat_ctx_t const xctx, request_t request, fr_value_box_list_t *in)
	Expand an LDAP URL into a query, and return a string result from that query. More...

static int	ldap_xlat_profile_ctx_free (ldap_xlat_profile_ctx_t *to_free)

static xlat_action_t	ldap_xlat_resume (TALLOC_CTX ctx, fr_dcursor_t out, xlat_ctx_t const xctx, request_t request, UNUSED fr_value_box_list_t *in)
	Callback when resuming after async ldap query is completed. More...

static void	ldap_xlat_signal (xlat_ctx_t const xctx, request_t request, UNUSED fr_signal_t action)
	Callback for signalling async ldap query. More...

static int	ldap_xlat_uri_parse (LDAPURLDesc uri_parsed, char host_out, bool free_host_out, request_t request, char host_default, fr_value_box_t uri_in)
	Utility function for parsing LDAP URLs. More...

static int	map_ctx_free (ldap_map_ctx_t *map_ctx)
	Ensure map context is properly cleared up. More...

static unlang_action_t	mod_accounting (rlm_rcode_t p_result, module_ctx_t const mctx, request_t *request)

static unlang_action_t	mod_authenticate (rlm_rcode_t p_result, module_ctx_t const mctx, request_t *request)

static unlang_action_t	mod_authenticate_resume (rlm_rcode_t p_result, UNUSED int priority, request_t request, void uctx)
	Initiate async LDAP bind to authenticate user. More...

static unlang_action_t	mod_authenticate_start (rlm_rcode_t p_result, UNUSED int priority, request_t request, void uctx)
	Perform async lookup of user DN if required for authentication. More...

static unlang_action_t	mod_authorize (rlm_rcode_t p_result, module_ctx_t const mctx, request_t *request)

static void	mod_authorize_cancel (UNUSED request_t request, UNUSED fr_signal_t action, void uctx)
	Clear up when cancelling a mod_authorize call. More...

static unlang_action_t	mod_authorize_resume (rlm_rcode_t p_result, UNUSED int priority, request_t request, void uctx)
	Resume function called after each potential yield in LDAP authorization. More...

static unlang_action_t	mod_authorize_start (UNUSED rlm_rcode_t p_result, UNUSED int priority, request_t request, void uctx)
	Start LDAP authorization with async lookup of user DN. More...

static int	mod_bootstrap (module_inst_ctx_t const *mctx)
	Bootstrap the module. More...

static int	mod_detach (module_detach_ctx_t const *mctx)
	Detach from the LDAP server and cleanup internal state. More...

static int	mod_instantiate (module_inst_ctx_t const *mctx)
	Instantiate the module. More...

static int	mod_load (void)

static unlang_action_t	mod_map_proc (rlm_rcode_t p_result, void const mod_inst, UNUSED void proc_inst, request_t request, fr_value_box_list_t url, map_list_t const maps)
	Perform a search and map the result of the search to server attributes. More...

static unlang_action_t	mod_map_resume (rlm_rcode_t p_result, UNUSED int priority, request_t request, void uctx)
	Process the results of an LDAP map query. More...

static unlang_action_t	mod_post_auth (rlm_rcode_t p_result, module_ctx_t const mctx, request_t *request)

static int	mod_thread_detach (module_thread_inst_ctx_t const *mctx)
	Clean up thread specific data structure. More...

static int	mod_thread_instantiate (module_thread_inst_ctx_t const *mctx)
	Initialise thread specific data structure. More...

static void	mod_unload (void)

static int	parse_sub_section (module_inst_ctx_t const mctx, CONF_SECTION parent, ldap_acct_section_t *config, char const name)
	Parse an accounting sub section. More...

static unlang_action_t	user_modify (rlm_rcode_t p_result, rlm_ldap_t const inst, request_t request, ldap_acct_section_t section, ldap_usermod_call_env_t *call_env)
	Modify user's object in LDAP. More...

static void	user_modify_cancel (UNUSED request_t request, UNUSED fr_signal_t action, void uctx)
	Cancel an in progress user modification. More...

static unlang_action_t	user_modify_final (rlm_rcode_t p_result, UNUSED int priority, request_t request, void uctx)
	Handle results of user modification. More...

static unlang_action_t	user_modify_resume (rlm_rcode_t p_result, UNUSED int priority, request_t request, void uctx)
	Take the retrieved user DN and launch the async modification. More...

static unlang_action_t	user_modify_start (UNUSED rlm_rcode_t p_result, UNUSED int priority, request_t request, void uctx)
	Perform async lookup of user DN if required for user modification. More...

Variables
static const conf_parser_t	acct_section_config []

fr_dict_attr_t const *	attr_cleartext_password

fr_dict_attr_t const *	attr_crypt_password

static fr_dict_attr_t const *	attr_expr_bool_enum

fr_dict_attr_t const *	attr_ldap_userdn

fr_dict_attr_t const *	attr_nt_password

fr_dict_attr_t const *	attr_password

fr_dict_attr_t const *	attr_password_with_header

static const call_env_method_t	authenticate_method_env

static const call_env_method_t	authorize_method_env

static fr_dict_t const *	dict_freeradius

static conf_parser_t	group_config []

static fr_uri_part_t const	ldap_dn_parts []

static xlat_arg_parser_t const	ldap_group_xlat_arg []

static xlat_arg_parser_t const	ldap_safe_xlat_arg []

static xlat_arg_parser_t const	ldap_uri_escape_xlat_arg []

static fr_uri_part_t const	ldap_uri_parts []

static fr_table_num_sorted_t const	ldap_uri_scheme_table []

static size_t	ldap_uri_scheme_table_len = NUM_ELEMENTS(ldap_uri_scheme_table)

static xlat_arg_parser_t const	ldap_uri_unescape_xlat_arg []

static xlat_arg_parser_t const	ldap_xlat_arg []

static const conf_parser_t	module_config []

static conf_parser_t	profile_config []

module_rlm_t	rlm_ldap

fr_dict_autoload_t	rlm_ldap_dict []

fr_dict_attr_autoload_t	rlm_ldap_dict_attr []

global_lib_autoinst_t const *	rlm_ldap_lib []

static const call_env_parser_t	sasl_call_env []

static conf_parser_t	user_config []

static const call_env_method_t	usermod_method_env

static const call_env_method_t	xlat_memberof_method_env

static const call_env_method_t	xlat_profile_method_env

Detailed Description

LDAP authorization and authentication module.

Id: eaf3a74c5207144d24b4c6762ad0889d13626668

Author: Arran Cudbard-Bell (a.cud.nosp@m.bard.nosp@m.b@fre.nosp@m.erad.nosp@m.ius.o.nosp@m.rg); Alan DeKok (aland.nosp@m.@fre.nosp@m.eradi.nosp@m.us.o.nosp@m.rg)

Copyright: 2012,2015 Arran Cudbard-Bell (a.cud.nosp@m.bard.nosp@m.b@fre.nosp@m.erad.nosp@m.ius.o.nosp@m.rg); 2013,2015 Network RADIUS SAS (legal.nosp@m.@net.nosp@m.workr.nosp@m.adiu.nosp@m.s.com); 2012 Alan DeKok (aland.nosp@m.@fre.nosp@m.eradi.nosp@m.us.o.nosp@m.rg); 1999-2013 The FreeRADIUS Server Project.

Id: f4189ab2336d05b39863ec7b67eb85ce59007149

Author: Arran Cudbard-Bell (a.cud.nosp@m.bard.nosp@m.b@fre.nosp@m.erad.nosp@m.ius.o.nosp@m.rg); Alan DeKok (aland.nosp@m.@fre.nosp@m.eradi.nosp@m.us.o.nosp@m.rg)

Copyright: 2012,2015 Arran Cudbard-Bell (a.cud.nosp@m.bard.nosp@m.b@fre.nosp@m.erad.nosp@m.ius.o.nosp@m.rg); 2013,2015 Network RADIUS SAS (legal.nosp@m.@net.nosp@m.workr.nosp@m.adiu.nosp@m.s.com); 2012 Alan DeKok (aland.nosp@m.@fre.nosp@m.eradi.nosp@m.us.o.nosp@m.rg); 1999-2013 The FreeRADIUS Server Project.

Definition in file rlm_ldap.c.

Data Structure Documentation

◆ ldap_auth_call_env_t

struct ldap_auth_call_env_t

Definition at line 57 of file rlm_ldap.c.

Collaboration diagram for ldap_auth_call_env_t:

Data Fields
fr_value_box_t	password
tmpl_t const *	password_tmpl
fr_value_box_t	user_base
fr_value_box_t	user_filter
fr_value_box_t	user_sasl_authname
fr_value_box_t	user_sasl_mech
fr_value_box_t	user_sasl_proxy
fr_value_box_t	user_sasl_realm

◆ ldap_auth_ctx_t

struct ldap_auth_ctx_t

Holds state of in progress async authentication.

Definition at line 346 of file rlm_ldap.c.

Collaboration diagram for ldap_auth_ctx_t:

Data Fields
ldap_auth_call_env_t *	call_env
char const *	dn
rlm_ldap_t const *	inst
char const *	password
fr_ldap_thread_t *	thread

◆ ldap_map_ctx_t

struct ldap_map_ctx_t

Holds state of in progress LDAP map.

Definition at line 371 of file rlm_ldap.c.

Collaboration diagram for ldap_map_ctx_t:

Data Fields
fr_ldap_map_exp_t	expanded
LDAPURLDesc *	ldap_url
map_list_t const *	maps
fr_ldap_query_t *	query

◆ ldap_update_rules_t

struct ldap_update_rules_t

Parameters to allow ldap_update_section_parse to be reused.

Definition at line 208 of file rlm_ldap.c.

Data Fields
ssize_t	expect_password_offset
size_t	map_offset

◆ ldap_user_modify_ctx_t

struct ldap_user_modify_ctx_t

Holds state of in progress ldap user modifications.

Definition at line 357 of file rlm_ldap.c.

Collaboration diagram for ldap_user_modify_ctx_t:

Data Fields
ldap_usermod_call_env_t *	call_env
char const *	dn
rlm_ldap_t const *	inst
LDAPMod *	mod_p[LDAP_MAX_ATTRMAP+1]
LDAPMod	mod_s[LDAP_MAX_ATTRMAP]
char *	passed[LDAP_MAX_ATTRMAP *2]
fr_ldap_query_t *	query
fr_ldap_thread_trunk_t *	ttrunk

◆ ldap_usermod_call_env_t

struct ldap_usermod_call_env_t

Definition at line 68 of file rlm_ldap.c.

Collaboration diagram for ldap_usermod_call_env_t:

Data Fields
fr_value_box_t	user_base
fr_value_box_t	user_filter

◆ ldap_xlat_profile_call_env_t

struct ldap_xlat_profile_call_env_t

Call environment used in the profile xlat.

Definition at line 75 of file rlm_ldap.c.

Collaboration diagram for ldap_xlat_profile_call_env_t:

Data Fields
fr_value_box_t	profile_filter	Filter to use when searching for users.
map_list_t *	profile_map	List of maps to apply to the profile.

◆ ldap_xlat_profile_ctx_t

struct ldap_xlat_profile_ctx_t

Definition at line 1025 of file rlm_ldap.c.

Collaboration diagram for ldap_xlat_profile_ctx_t:

Data Fields
fr_ldap_map_exp_t	expanded
fr_ldap_result_code_t	ret
LDAPURLDesc *	url

◆ rlm_ldap_boot_t

struct rlm_ldap_boot_t

Definition at line 52 of file rlm_ldap.c.

Collaboration diagram for rlm_ldap_boot_t:

Data Fields
fr_dict_attr_t const *	cache_da
fr_dict_attr_t const *	group_da

Macro Definition Documentation

◆ CHECK_EXPANDED_SPACE

#define CHECK_EXPANDED_SPACE ( _expanded ) fr_assert((size_t)_expanded->count < (NUM_ELEMENTS(_expanded->attrs) - 1));

◆ LDAP_URI_SAFE_FOR

#define LDAP_URI_SAFE_FOR (fr_value_box_safe_for_t)fr_ldap_uri_escape_func

This is the common function that actually ends up doing all the URI escaping.

Definition at line 393 of file rlm_ldap.c.

◆ REPEAT_LDAP_MEMBEROF_XLAT_RESULTS

#define REPEAT_LDAP_MEMBEROF_XLAT_RESULTS

Value:

        if (unlang_function_repeat_set(request, ldap_group_xlat_results) < 0) do { \
                rcode = RLM_MODULE_FAIL; \
                goto finish; \
        } while (0)

Definition at line 856 of file rlm_ldap.c.

◆ REPEAT_MOD_AUTHORIZE_RESUME

#define REPEAT_MOD_AUTHORIZE_RESUME

Value:

        if (unlang_function_repeat_set(request, mod_authorize_resume) < 0) do { \
                rcode = RLM_MODULE_FAIL; \
                goto finish; \
        } while (0)

Definition at line 1529 of file rlm_ldap.c.

◆ USER_CALL_ENV_COMMON

#define USER_CALL_ENV_COMMON ( _struct )

Value:

{ FR_CALL_ENV_OFFSET("base_dn", FR_TYPE_STRING, CALL_ENV_FLAG_REQUIRED | CALL_ENV_FLAG_CONCAT, _struct, user_base), .pair.dflt = "", .pair.dflt_quote = T_SINGLE_QUOTED_STRING }, \

{ FR_CALL_ENV_OFFSET("filter", FR_TYPE_STRING, CALL_ENV_FLAG_NULLABLE | CALL_ENV_FLAG_CONCAT, _struct, user_filter), .pair.dflt = "(&)", .pair.dflt_quote = T_SINGLE_QUOTED_STRING }

CALL_ENV_FLAG_CONCAT

@ CALL_ENV_FLAG_CONCAT

If the tmpl produced multiple boxes they should be concatenated.

Definition: call_env.h:76

CALL_ENV_FLAG_REQUIRED

@ CALL_ENV_FLAG_REQUIRED

Associated conf pair or section is required.

Definition: call_env.h:75

CALL_ENV_FLAG_NULLABLE

@ CALL_ENV_FLAG_NULLABLE

Tmpl expansions are allowed to produce no output.

Definition: call_env.h:80

FR_CALL_ENV_OFFSET

#define FR_CALL_ENV_OFFSET(_name, _cast_type, _flags, _struct, _field)

Specify a call_env_parser_t which writes out runtime results to the specified field.

Definition: call_env.h:335

FR_TYPE_STRING

@ FR_TYPE_STRING

String of printable characters.

Definition: merged_model.c:83

T_SINGLE_QUOTED_STRING

@ T_SINGLE_QUOTED_STRING

Definition: token.h:122

Definition at line 185 of file rlm_ldap.c.

Enumeration Type Documentation

◆ ldap_schemes_t

enum ldap_schemes_t

Enumerator
LDAP_SCHEME_UNIX
LDAP_SCHEME_TCP
LDAP_SCHEME_TCP_SSL

Definition at line 378 of file rlm_ldap.c.

Function Documentation

◆ autz_ctx_free()

static int autz_ctx_free ( ldap_autz_ctx_t * autz_ctx )

static

Ensure authorization context is properly cleared up.

Definition at line 1842 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ host_uri_canonify()

static char* host_uri_canonify	(	request_t *	request,
		LDAPURLDesc *	url_parsed,
		fr_value_box_t *	url_in
	)

inlinestatic

Produce canonical LDAP host URI for finding trunks.

Definition at line 648 of file rlm_ldap.c.

Here is the caller graph for this function:

◆ ldap_group_filter_parse() [1/2]

static int ldap_group_filter_parse	(	TALLOC_CTX *	ctx,
		void *	out,
		tmpl_rules_t const *	t_rules,
		CONF_ITEM *	ci,
		call_env_ctx_t const *	cec,
		UNUSED call_env_parser_t const *	rule
	)

static

◆ ldap_group_filter_parse() [2/2]

static int ldap_group_filter_parse	(	TALLOC_CTX *	ctx,
		void *	out,
		tmpl_rules_t const *	t_rules,
		UNUSED CONF_ITEM *	ci,
		call_env_ctx_t const *	cec,
		UNUSED call_env_parser_t const *	rule
	)

static

Definition at line 2352 of file rlm_ldap.c.

Here is the call graph for this function:

◆ ldap_group_xlat_cancel()

static void ldap_group_xlat_cancel	(	UNUSED request_t *	request,
		UNUSED fr_signal_t	action,
		void *	uctx
	)

static

Cancel an in-progress query for the LDAP group membership xlat.

Definition at line 847 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ ldap_group_xlat_results()

static unlang_action_t ldap_group_xlat_results	(	rlm_rcode_t *	p_result,
		UNUSED int *	priority,
		request_t *	request,
		void *	uctx
	)

static

Run the state machine for the LDAP membership xlat.

This is called after each async lookup is completed

Definition at line 866 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ ldap_group_xlat_resume()

static xlat_action_t ldap_group_xlat_resume	(	TALLOC_CTX *	ctx,
		fr_dcursor_t *	out,
		xlat_ctx_t const *	xctx,
		UNUSED request_t *	request,
		UNUSED fr_value_box_list_t *	in
	)

static

Process the results of evaluating LDAP group membership.

Definition at line 914 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ ldap_group_xlat_user_find()

static unlang_action_t ldap_group_xlat_user_find	(	UNUSED rlm_rcode_t *	p_result,
		UNUSED int *	priority,
		request_t *	request,
		void *	uctx
	)

static

User object lookup as part of group membership xlat.

Called if the ldap membership xlat is used and the user DN is not already known

Definition at line 831 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ ldap_map_verify()

static int ldap_map_verify	(	CONF_SECTION *	cs,
		UNUSED void const *	mod_inst,
		UNUSED void *	proc_inst,
		tmpl_t const *	src,
		UNUSED map_list_t const *	maps
	)

static

Definition at line 1190 of file rlm_ldap.c.

Here is the caller graph for this function:

◆ ldap_profile_xlat_resume()

static xlat_action_t ldap_profile_xlat_resume	(	TALLOC_CTX *	ctx,
		fr_dcursor_t *	out,
		xlat_ctx_t const *	xctx,
		UNUSED request_t *	request,
		UNUSED fr_value_box_list_t *	in
	)

static

Return whether evaluating the profile was successful.

Definition at line 1034 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ ldap_query_timeout()

static void ldap_query_timeout	(	UNUSED fr_event_list_t *	el,
		UNUSED fr_time_t	now,
		void *	uctx
	)

static

Callback when LDAP query times out.

Definition at line 531 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ ldap_update_section_parse() [1/2]

static int ldap_update_section_parse	(	TALLOC_CTX *	ctx,
		call_env_parsed_head_t *	out,
		tmpl_rules_t const *	t_rules,
		CONF_ITEM *	ci,
		call_env_ctx_t const *	cec,
		call_env_parser_t const *	rule
	)

static

◆ ldap_update_section_parse() [2/2]

static int ldap_update_section_parse	(	TALLOC_CTX *	ctx,
		call_env_parsed_head_t *	out,
		tmpl_rules_t const *	t_rules,
		CONF_ITEM *	ci,
		UNUSED call_env_ctx_t const *	cec,
		call_env_parser_t const *	rule
	)

static

Definition at line 2273 of file rlm_ldap.c.

Here is the call graph for this function:

◆ ldap_uri_part_escape()

static int ldap_uri_part_escape	(	fr_value_box_t *	vb,
		UNUSED void *	uctx
	)

static

Escape function for a part of an LDAP URI.

Definition at line 501 of file rlm_ldap.c.

Here is the call graph for this function:

◆ ldap_xlat_profile_ctx_free()

static int ldap_xlat_profile_ctx_free ( ldap_xlat_profile_ctx_t * to_free )

static

Definition at line 1047 of file rlm_ldap.c.

Here is the caller graph for this function:

◆ ldap_xlat_resume()

static xlat_action_t ldap_xlat_resume	(	TALLOC_CTX *	ctx,
		fr_dcursor_t *	out,
		xlat_ctx_t const *	xctx,
		request_t *	request,
		UNUSED fr_value_box_list_t *	in
	)

static

Callback when resuming after async ldap query is completed.

Definition at line 557 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ ldap_xlat_signal()

static void ldap_xlat_signal	(	xlat_ctx_t const *	xctx,
		request_t *	request,
		UNUSED fr_signal_t	action
	)

static

Callback for signalling async ldap query.

Definition at line 604 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ ldap_xlat_uri_parse()

static int ldap_xlat_uri_parse	(	LDAPURLDesc **	uri_parsed,
		char **	host_out,
		bool *	free_host_out,
		request_t *	request,
		char *	host_default,
		fr_value_box_t *	uri_in
	)

static

Utility function for parsing LDAP URLs.

All LDAP xlat functions that work with LDAP URLs should call this function to parse the URL.

Parameters

[out]	uri_parsed	LDAP URL parsed. Must be freed with ldap_url_desc_free.
[out]	host_out	host name to use for the query. Must be freed with ldap_mem_free if free_host_out is true.
[out]	free_host_out	True if host_out should be freed.
[in]	request	Request being processed.
[in]	host_default	Default host to use if the URL does not specify a host.
[in]	uri_in	URI to parse.

Returns

0 on success.
-1 on failure.

Definition at line 679 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ map_ctx_free()

static int map_ctx_free ( ldap_map_ctx_t * map_ctx )

static

Ensure map context is properly cleared up.

Definition at line 1303 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ mod_accounting()

static unlang_action_t mod_accounting	(	rlm_rcode_t *	p_result,
		module_ctx_t const *	mctx,
		request_t *	request
	)

static

Definition at line 2200 of file rlm_ldap.c.

Here is the call graph for this function:

◆ mod_authenticate()

static unlang_action_t mod_authenticate	(	rlm_rcode_t *	p_result,
		module_ctx_t const *	mctx,
		request_t *	request
	)

static

Definition at line 1469 of file rlm_ldap.c.

Here is the call graph for this function:

◆ mod_authenticate_resume()

static unlang_action_t mod_authenticate_resume	(	rlm_rcode_t *	p_result,
		UNUSED int *	priority,
		request_t *	request,
		void *	uctx
	)

static

Initiate async LDAP bind to authenticate user.

Definition at line 1426 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ mod_authenticate_start()

static unlang_action_t mod_authenticate_start	(	rlm_rcode_t *	p_result,
		UNUSED int *	priority,
		request_t *	request,
		void *	uctx
	)

static

Perform async lookup of user DN if required for authentication.

Definition at line 1408 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ mod_authorize()

static unlang_action_t mod_authorize	(	rlm_rcode_t *	p_result,
		module_ctx_t const *	mctx,
		request_t *	request
	)

static

Definition at line 1849 of file rlm_ldap.c.

Here is the call graph for this function:

◆ mod_authorize_cancel()

static void mod_authorize_cancel	(	UNUSED request_t *	request,
		UNUSED fr_signal_t	action,
		void *	uctx
	)

static

Clear up when cancelling a mod_authorize call.

Definition at line 1832 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ mod_authorize_resume()

static unlang_action_t mod_authorize_resume	(	rlm_rcode_t *	p_result,
		UNUSED int *	priority,
		request_t *	request,
		void *	uctx
	)

static

Resume function called after each potential yield in LDAP authorization.

Some operations may or may not yield. E.g. if group membership is read from an attribute returned with the user object and is already in the correct form, that will not yield. Hence, each state may fall through to the next.

Parameters

p_result	Result of current authorization.
priority	Unused.
request	Current request.
uctx	Current authorization context.

Returns: One of the RLM_MODULE_* values.

Definition at line 1548 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ mod_authorize_start()

static unlang_action_t mod_authorize_start	(	UNUSED rlm_rcode_t *	p_result,
		UNUSED int *	priority,
		request_t *	request,
		void *	uctx
	)

static

Start LDAP authorization with async lookup of user DN.

Definition at line 1520 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ mod_bootstrap()

static int mod_bootstrap ( module_inst_ctx_t const * mctx )

static

Bootstrap the module.

Define attributes.

Parameters

[in] mctx configuration data.

Returns

0 on success.
< 0 on failure.

Definition at line 2652 of file rlm_ldap.c.

Here is the call graph for this function:

◆ mod_detach()

static int mod_detach ( module_detach_ctx_t const * mctx )

static

Detach from the LDAP server and cleanup internal state.

Definition at line 2224 of file rlm_ldap.c.

◆ mod_instantiate()

static int mod_instantiate ( module_inst_ctx_t const * mctx )

static

Instantiate the module.

Creates a new instance of the module reading parameters from a configuration section.

Parameters

[in] mctx configuration data.

Returns

0 on success.
< 0 on failure.

Definition at line 2431 of file rlm_ldap.c.

Here is the call graph for this function:

◆ mod_load()

static int mod_load ( void )

static

Definition at line 2721 of file rlm_ldap.c.

Here is the call graph for this function:

◆ mod_map_proc()

static unlang_action_t mod_map_proc	(	rlm_rcode_t *	p_result,
		void const *	mod_inst,
		UNUSED void *	proc_inst,
		request_t *	request,
		fr_value_box_list_t *	url,
		map_list_t const *	maps
	)

static

Perform a search and map the result of the search to server attributes.

Unlike LDAP xlat, this can be used to process attributes from multiple entries.

Todo:: For xlat expansions we need to parse the raw URL first, and then apply different escape functions to the different parts.

Parameters

[out]	p_result	Result of map expansion: RLM_MODULE_NOOP no rows were returned. RLM_MODULE_UPDATED if one or more fr_pair_t were added to the request_t. RLM_MODULE_FAIL if an error occurred.
[in]	mod_inst	rlm_ldap_t
[in]	proc_inst	unused.
[in,out]	request	The current request.
[in]	url	LDAP url specifying base DN and filter.
[in]	maps	Head of the map list.

Returns: UNLANG_ACTION_CALCULATE_RESULT

Definition at line 1328 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ mod_map_resume()

static unlang_action_t mod_map_resume	(	rlm_rcode_t *	p_result,
		UNUSED int *	priority,
		request_t *	request,
		void *	uctx
	)

static

Process the results of an LDAP map query.

Parameters

[out]	p_result	Result of applying the map.
[in]	priority	Unused.
[in]	request	Current request.
[in]	uctx	Map context.

Returns: One of UNLANG_ACTION_*

Definition at line 1210 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ mod_post_auth()

static unlang_action_t mod_post_auth	(	rlm_rcode_t *	p_result,
		module_ctx_t const *	mctx,
		request_t *	request
	)

static

Definition at line 2210 of file rlm_ldap.c.

Here is the call graph for this function:

◆ mod_thread_detach()

static int mod_thread_detach ( module_thread_inst_ctx_t const * mctx )

static

Clean up thread specific data structure.

Definition at line 2368 of file rlm_ldap.c.

Here is the call graph for this function:

◆ mod_thread_instantiate()

static int mod_thread_instantiate ( module_thread_inst_ctx_t const * mctx )

static

Initialise thread specific data structure.

Definition at line 2386 of file rlm_ldap.c.

Here is the call graph for this function:

◆ mod_unload()

static void mod_unload ( void )

static

Definition at line 2742 of file rlm_ldap.c.

Here is the call graph for this function:

◆ parse_sub_section()

static int parse_sub_section	(	module_inst_ctx_t const *	mctx,
		CONF_SECTION *	parent,
		ldap_acct_section_t **	config,
		char const *	name
	)

static

Parse an accounting sub section.

Allocate a new ldap_acct_section_t and write the config data into it.

Parameters

[in]	mctx	rlm_ldap configuration.
[in]	parent	of the config section.
[out]	config	to write the sub section parameters to.

Returns

0 on success.
< 0 on failure.

Definition at line 2244 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ user_modify()

static unlang_action_t user_modify	(	rlm_rcode_t *	p_result,
		rlm_ldap_t const *	inst,
		request_t *	request,
		ldap_acct_section_t *	section,
		ldap_usermod_call_env_t *	call_env
	)

static

Modify user's object in LDAP.

Process a modification map to update a user object in the LDAP directory.

Parameters

[out]	p_result	the result of the modification.
[in]	inst	rlm_ldap instance.
[in]	request	Current request.
[in]	section	that holds the map to process.
[in]	call_env	Call environment. Contains expanded base and filter to find user.

Returns: one of the RLM_MODULE_* values.

Definition at line 2005 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ user_modify_cancel()

static void user_modify_cancel	(	UNUSED request_t *	request,
		UNUSED fr_signal_t	action,
		void *	uctx
	)

static

Cancel an in progress user modification.

Definition at line 1928 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ user_modify_final()

static unlang_action_t user_modify_final	(	rlm_rcode_t *	p_result,
		UNUSED int *	priority,
		request_t *	request,
		void *	uctx
	)

static

Handle results of user modification.

Definition at line 1940 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ user_modify_resume()

static unlang_action_t user_modify_resume	(	rlm_rcode_t *	p_result,
		UNUSED int *	priority,
		request_t *	request,
		void *	uctx
	)

static

Take the retrieved user DN and launch the async modification.

Definition at line 1969 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ user_modify_start()

static unlang_action_t user_modify_start	(	UNUSED rlm_rcode_t *	p_result,
		UNUSED int *	priority,
		request_t *	request,
		void *	uctx
	)

static

Perform async lookup of user DN if required for user modification.

Definition at line 1916 of file rlm_ldap.c.

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

◆ acct_section_config

const conf_parser_t acct_section_config[]

static

Initial value:

= {
        { FR_CONF_OFFSET_FLAGS("reference", CONF_FLAG_XLAT, ldap_acct_section_t, reference), .dflt = "." },
        CONF_PARSER_TERMINATOR
}

Definition at line 139 of file rlm_ldap.c.

◆ attr_cleartext_password

fr_dict_attr_t const* attr_cleartext_password

Definition at line 317 of file rlm_ldap.c.

◆ attr_crypt_password

fr_dict_attr_t const* attr_crypt_password

Definition at line 318 of file rlm_ldap.c.

◆ attr_expr_bool_enum

fr_dict_attr_t const* attr_expr_bool_enum

static

Definition at line 322 of file rlm_ldap.c.

◆ attr_ldap_userdn

fr_dict_attr_t const* attr_ldap_userdn

Definition at line 319 of file rlm_ldap.c.

◆ attr_nt_password

fr_dict_attr_t const* attr_nt_password

Definition at line 320 of file rlm_ldap.c.

◆ attr_password

fr_dict_attr_t const* attr_password

Definition at line 316 of file rlm_ldap.c.

◆ attr_password_with_header

fr_dict_attr_t const* attr_password_with_header

Definition at line 321 of file rlm_ldap.c.

◆ authenticate_method_env

const call_env_method_t authenticate_method_env

static

Initial value:

= {
        FR_CALL_ENV_METHOD_OUT(ldap_auth_call_env_t),
        .env = (call_env_parser_t[]) {
                { FR_CALL_ENV_SUBSECTION("user", NULL, CALL_ENV_FLAG_REQUIRED,
                                         ((call_env_parser_t[]) {
                                                USER_CALL_ENV_COMMON(ldap_auth_call_env_t),
                                                { FR_CALL_ENV_PARSE_OFFSET("password_attribute", FR_TYPE_STRING,
                                                                          CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED | CALL_ENV_FLAG_NULLABLE | CALL_ENV_FLAG_CONCAT,
                                                                          ldap_auth_call_env_t, password, password_tmpl),
                                                                          .pair.dflt = "&User-Password", .pair.dflt_quote = T_BARE_WORD },
                                                { FR_CALL_ENV_SUBSECTION("sasl", NULL, CALL_ENV_FLAG_NONE, sasl_call_env) },
                                                CALL_ENV_TERMINATOR
                                         })) },
                CALL_ENV_TERMINATOR
        }
}

Definition at line 189 of file rlm_ldap.c.

◆ authorize_method_env

const call_env_method_t authorize_method_env

static

Definition at line 213 of file rlm_ldap.c.

◆ dict_freeradius

fr_dict_t const* dict_freeradius

static

Definition at line 308 of file rlm_ldap.c.

◆ group_config

conf_parser_t group_config[]

static

Initial value:

= {
        { FR_CONF_OFFSET("filter", rlm_ldap_t, group.obj_filter) },
        { FR_CONF_OFFSET("scope", rlm_ldap_t, group.obj_scope), .dflt = "sub",
          .func = cf_table_parse_int, .uctx = &(cf_table_parse_ctx_t){ .table = fr_ldap_scope, .len = &fr_ldap_scope_len }  },
 
        { FR_CONF_OFFSET("name_attribute", rlm_ldap_t, group.obj_name_attr), .dflt = "cn" },
        { FR_CONF_OFFSET("membership_attribute", rlm_ldap_t, group.userobj_membership_attr) },
        { FR_CONF_OFFSET_FLAGS("membership_filter", CONF_FLAG_XLAT, rlm_ldap_t, group.obj_membership_filter) },
        { FR_CONF_OFFSET("cacheable_name", rlm_ldap_t, group.cacheable_name), .dflt = "no" },
        { FR_CONF_OFFSET("cacheable_dn", rlm_ldap_t, group.cacheable_dn), .dflt = "no" },
        { FR_CONF_OFFSET("cache_attribute", rlm_ldap_t, group.cache_attribute) },
        { FR_CONF_OFFSET("group_attribute", rlm_ldap_t, group.attribute) },
        { FR_CONF_OFFSET("allow_dangling_group_ref", rlm_ldap_t, group.allow_dangling_refs), .dflt = "no" },
        { FR_CONF_OFFSET("skip_on_suspend", rlm_ldap_t, group.skip_on_suspend), .dflt = "yes"},
        CONF_PARSER_TERMINATOR
}

Definition at line 119 of file rlm_ldap.c.

◆ ldap_dn_parts

fr_uri_part_t const ldap_dn_parts[]

static

Initial value:

= {
        { .name = "dn", .safe_for = LDAP_URI_SAFE_FOR , .func = ldap_uri_part_escape },
        XLAT_URI_PART_TERMINATOR
}

Definition at line 634 of file rlm_ldap.c.

◆ ldap_group_xlat_arg

xlat_arg_parser_t const ldap_group_xlat_arg[]

static

Initial value:

= {
        { .required = true, .concat = true, .type = FR_TYPE_STRING, .safe_for = LDAP_URI_SAFE_FOR },
        XLAT_ARG_PARSER_TERMINATOR
}

Definition at line 927 of file rlm_ldap.c.

◆ ldap_safe_xlat_arg

xlat_arg_parser_t const ldap_safe_xlat_arg[]

static

Initial value:

= {
        { .required = true, .concat = true, .type = FR_TYPE_STRING },
        XLAT_ARG_PARSER_TERMINATOR
}

Definition at line 400 of file rlm_ldap.c.

◆ ldap_uri_escape_xlat_arg

xlat_arg_parser_t const ldap_uri_escape_xlat_arg[]

static

Initial value:

= {
        { .required = true, .concat = true, .type = FR_TYPE_STRING, .safe_for = LDAP_URI_SAFE_FOR },
        XLAT_ARG_PARSER_TERMINATOR
}

Definition at line 395 of file rlm_ldap.c.

◆ ldap_uri_parts

fr_uri_part_t const ldap_uri_parts[]

static

Initial value:

= {
        { .name = "scheme", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L(":")), .part_adv = { [':'] = 1 }, .extra_skip = 2 },
        { .name = "host", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L(":"), L("/")), .part_adv = { [':'] = 1, ['/'] = 2 } },
        { .name = "port", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("/")), .part_adv = { ['/'] = 1 } },
        { .name = "dn", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1 }, .func = ldap_uri_part_escape },
        { .name = "attrs", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1 }},
        { .name = "scope", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1 }, .func = ldap_uri_part_escape },
        { .name = "filter", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1}, .func = ldap_uri_part_escape },
        { .name = "exts", .safe_for = LDAP_URI_SAFE_FOR, .func = ldap_uri_part_escape },
        XLAT_URI_PART_TERMINATOR
}

Definition at line 622 of file rlm_ldap.c.

◆ ldap_uri_scheme_table

fr_table_num_sorted_t const ldap_uri_scheme_table[]

static

Initial value:

= {
        { L("ldap://"),         LDAP_SCHEME_UNIX        },
        { L("ldapi://"),        LDAP_SCHEME_TCP         },
        { L("ldaps://"),        LDAP_SCHEME_TCP_SSL     },
}

Definition at line 384 of file rlm_ldap.c.

◆ ldap_uri_scheme_table_len

size_t ldap_uri_scheme_table_len = NUM_ELEMENTS(ldap_uri_scheme_table)

static

Definition at line 389 of file rlm_ldap.c.

◆ ldap_uri_unescape_xlat_arg

xlat_arg_parser_t const ldap_uri_unescape_xlat_arg[]

static

Initial value:

= {
        { .required = true, .concat = true, .type = FR_TYPE_STRING },
        XLAT_ARG_PARSER_TERMINATOR
}

Definition at line 455 of file rlm_ldap.c.

◆ ldap_xlat_arg

xlat_arg_parser_t const ldap_xlat_arg[]

static

Initial value:

= {
        { .required = true, .type = FR_TYPE_STRING, .safe_for = LDAP_URI_SAFE_FOR },
        XLAT_ARG_PARSER_TERMINATOR
}

Definition at line 639 of file rlm_ldap.c.

◆ module_config

const conf_parser_t module_config[]

static

Definition at line 144 of file rlm_ldap.c.

◆ profile_config

conf_parser_t profile_config[]

static

Initial value:

= {
        { FR_CONF_OFFSET("scope", rlm_ldap_t, profile_scope), .dflt = "base",
          .func = cf_table_parse_int, .uctx = &(cf_table_parse_ctx_t){ .table = fr_ldap_scope, .len = &fr_ldap_scope_len } },
        { FR_CONF_OFFSET("attribute", rlm_ldap_t, profile_attr) },
        { FR_CONF_OFFSET("attribute_suspend", rlm_ldap_t, profile_attr_suspend) },
        CONF_PARSER_TERMINATOR
}

Definition at line 92 of file rlm_ldap.c.

◆ rlm_ldap

module_rlm_t rlm_ldap

Definition at line 2751 of file rlm_ldap.c.

◆ rlm_ldap_dict

fr_dict_autoload_t rlm_ldap_dict

Initial value:

= {
        { .out = &dict_freeradius, .proto = "freeradius" },
        { NULL }
}

Definition at line 311 of file rlm_ldap.c.

◆ rlm_ldap_dict_attr

fr_dict_attr_autoload_t rlm_ldap_dict_attr

Initial value:

= {
        { .out = &attr_password, .name = "Password", .type = FR_TYPE_TLV, .dict = &dict_freeradius },
        { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
        { .out = &attr_crypt_password, .name = "Password.Crypt", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
        { .out = &attr_ldap_userdn, .name = "LDAP-UserDN", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
        { .out = &attr_nt_password, .name = "Password.NT", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
        { .out = &attr_password_with_header, .name = "Password.With-Header", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
        { .out = &attr_expr_bool_enum, .name = "Expr-Bool-Enum", .type = FR_TYPE_BOOL, .dict = &dict_freeradius },
 
        { NULL }
}

Definition at line 325 of file rlm_ldap.c.

◆ rlm_ldap_lib

global_lib_autoinst_t const * rlm_ldap_lib

Initial value:

= {
        &fr_libldap_global_config,
        GLOBAL_LIB_TERMINATOR
}

Definition at line 338 of file rlm_ldap.c.

◆ sasl_call_env

const call_env_parser_t sasl_call_env[]

static

Initial value:

= {
        { FR_CALL_ENV_OFFSET("mech", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, ldap_auth_call_env_t, user_sasl_mech) },
        { FR_CALL_ENV_OFFSET("authname", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, ldap_auth_call_env_t, user_sasl_authname) },
        { FR_CALL_ENV_OFFSET("proxy", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, ldap_auth_call_env_t, user_sasl_proxy) },
        { FR_CALL_ENV_OFFSET("realm", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, ldap_auth_call_env_t, user_sasl_realm) },
        CALL_ENV_TERMINATOR
}

Definition at line 84 of file rlm_ldap.c.

◆ user_config

conf_parser_t user_config[]

static

Initial value:

= {
        { FR_CONF_OFFSET("scope", rlm_ldap_t, user.obj_scope), .dflt = "sub",
          .func = cf_table_parse_int, .uctx = &(cf_table_parse_ctx_t){ .table = fr_ldap_scope, .len = &fr_ldap_scope_len } },
        { FR_CONF_OFFSET("sort_by", rlm_ldap_t, user.obj_sort_by) },
 
        { FR_CONF_OFFSET("access_attribute", rlm_ldap_t, user.obj_access_attr) },
        { FR_CONF_OFFSET("access_positive", rlm_ldap_t, user.access_positive), .dflt = "yes" },
        { FR_CONF_OFFSET("access_value_negate", rlm_ldap_t, user.access_value_negate), .dflt = "false" },
        { FR_CONF_OFFSET("access_value_suspend", rlm_ldap_t, user.access_value_suspend), .dflt = "suspended" },
        { FR_CONF_OFFSET_IS_SET("expect_password", FR_TYPE_BOOL, 0, rlm_ldap_t, user.expect_password) },
        CONF_PARSER_TERMINATOR
}

Definition at line 103 of file rlm_ldap.c.

◆ usermod_method_env

const call_env_method_t usermod_method_env

static

Initial value:

= {
        FR_CALL_ENV_METHOD_OUT(ldap_usermod_call_env_t),
        .env = (call_env_parser_t[]) {
                { FR_CALL_ENV_SUBSECTION("user", NULL, CALL_ENV_FLAG_REQUIRED,
                                         ((call_env_parser_t[]) {
                                                USER_CALL_ENV_COMMON(ldap_usermod_call_env_t),
                                                CALL_ENV_TERMINATOR
                                         })) },
 
                CALL_ENV_TERMINATOR
        }
}

Definition at line 251 of file rlm_ldap.c.

◆ xlat_memberof_method_env

const call_env_method_t xlat_memberof_method_env

static

Initial value:

= {
        FR_CALL_ENV_METHOD_OUT(ldap_xlat_memberof_call_env_t),
        .env = (call_env_parser_t[]) {
                { FR_CALL_ENV_SUBSECTION("user", NULL, CALL_ENV_FLAG_REQUIRED,
                                         ((call_env_parser_t[]) {
                                                USER_CALL_ENV_COMMON(ldap_xlat_memberof_call_env_t),
                                                CALL_ENV_TERMINATOR
                                         })) },
                { FR_CALL_ENV_SUBSECTION("group", NULL, CALL_ENV_FLAG_NONE,
                                         ((call_env_parser_t[]) {
                                                { FR_CALL_ENV_OFFSET("base_dn", FR_TYPE_STRING, CALL_ENV_FLAG_CONCAT, ldap_xlat_memberof_call_env_t, group_base) },
                                                { FR_CALL_ENV_PARSE_ONLY_OFFSET("membership_filter", FR_TYPE_STRING, CALL_ENV_FLAG_CONCAT, ldap_xlat_memberof_call_env_t, group_filter),
                                                  .pair.func = ldap_group_filter_parse,
                                                  .pair.escape = {
                                                        .func = fr_ldap_box_escape,
                                                        .safe_for = (fr_value_box_safe_for_t)fr_ldap_box_escape,
                                                        .mode = TMPL_ESCAPE_PRE_CONCAT
                                                  },
                                                  .pair.literals_safe_for = (fr_value_box_safe_for_t)fr_ldap_box_escape,
                                                },
                                                CALL_ENV_TERMINATOR
                                         })) },
                CALL_ENV_TERMINATOR
        }
}

Definition at line 264 of file rlm_ldap.c.

◆ xlat_profile_method_env

const call_env_method_t xlat_profile_method_env

static

Initial value:

= {
        FR_CALL_ENV_METHOD_OUT(ldap_xlat_profile_call_env_t),
        .env = (call_env_parser_t[]) {
                { FR_CALL_ENV_SUBSECTION_FUNC("update", CF_IDENT_ANY, CALL_ENV_FLAG_PARSE_MISSING, ldap_update_section_parse),
                                              .uctx = &(ldap_update_rules_t){
                                                .map_offset = offsetof(ldap_xlat_profile_call_env_t, profile_map),
                                                .expect_password_offset = -1
                                              } },
                { FR_CALL_ENV_SUBSECTION("profile", NULL, CALL_ENV_FLAG_NONE,
                                         ((call_env_parser_t[])  {
                                                { FR_CALL_ENV_OFFSET("filter", FR_TYPE_STRING, CALL_ENV_FLAG_CONCAT, ldap_xlat_profile_call_env_t, profile_filter),
                                                                     .pair.dflt = "(&)", .pair.dflt_quote = T_SINGLE_QUOTED_STRING }, 
                                                CALL_ENV_TERMINATOR
                                         })) },
                CALL_ENV_TERMINATOR
        }
}

Definition at line 290 of file rlm_ldap.c.

Data Structures

Macros

Enumerations

Functions

Variables

Detailed Description

Data Structure Documentation

◆ ldap_auth_call_env_t

◆ ldap_auth_ctx_t

◆ ldap_map_ctx_t

◆ ldap_update_rules_t

◆ ldap_user_modify_ctx_t

◆ ldap_usermod_call_env_t

◆ ldap_xlat_profile_call_env_t

◆ ldap_xlat_profile_ctx_t

◆ rlm_ldap_boot_t

Macro Definition Documentation

◆ CHECK_EXPANDED_SPACE

◆ LDAP_URI_SAFE_FOR

◆ REPEAT_LDAP_MEMBEROF_XLAT_RESULTS

◆ REPEAT_MOD_AUTHORIZE_RESUME

◆ USER_CALL_ENV_COMMON

Enumeration Type Documentation

◆ ldap_schemes_t

Function Documentation

◆ autz_ctx_free()

◆ host_uri_canonify()

◆ ldap_group_filter_parse() [1/2]

◆ ldap_group_filter_parse() [2/2]

◆ ldap_group_xlat_cancel()

◆ ldap_group_xlat_results()

◆ ldap_group_xlat_resume()

◆ ldap_group_xlat_user_find()

◆ ldap_map_verify()

◆ ldap_profile_xlat_resume()

◆ ldap_query_timeout()

◆ ldap_update_section_parse() [1/2]

◆ ldap_update_section_parse() [2/2]

◆ ldap_uri_part_escape()

◆ ldap_xlat_profile_ctx_free()

◆ ldap_xlat_resume()

◆ ldap_xlat_signal()

◆ ldap_xlat_uri_parse()

◆ map_ctx_free()

◆ mod_accounting()

◆ mod_authenticate()

◆ mod_authenticate_resume()

◆ mod_authenticate_start()

◆ mod_authorize()

◆ mod_authorize_cancel()

◆ mod_authorize_resume()

◆ mod_authorize_start()

◆ mod_bootstrap()

◆ mod_detach()

◆ mod_instantiate()

◆ mod_load()

◆ mod_map_proc()

◆ mod_map_resume()

◆ mod_post_auth()

◆ mod_thread_detach()

◆ mod_thread_instantiate()

◆ mod_unload()

◆ parse_sub_section()

◆ user_modify()

◆ user_modify_cancel()

◆ user_modify_final()

◆ user_modify_resume()

◆ user_modify_start()

Variable Documentation

◆ acct_section_config

◆ attr_cleartext_password

◆ attr_crypt_password

◆ attr_expr_bool_enum

◆ attr_ldap_userdn

◆ attr_nt_password

◆ attr_password

◆ attr_password_with_header

◆ authenticate_method_env

◆ authorize_method_env

◆ dict_freeradius