The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
Data Structures | Macros | Enumerations | Functions | Variables
rlm_ldap.c File Reference

LDAP authorization and authentication module. More...

#include <freeradius-devel/util/debug.h>
#include <freeradius-devel/util/table.h>
#include <freeradius-devel/util/uri.h>
#include <freeradius-devel/util/value.h>
#include <freeradius-devel/ldap/conf.h>
#include <freeradius-devel/ldap/base.h>
#include <freeradius-devel/server/map_proc.h>
#include <freeradius-devel/server/module_rlm.h>
#include <freeradius-devel/server/rcode.h>
#include <freeradius-devel/unlang/xlat_func.h>
#include <freeradius-devel/unlang/action.h>
#include <freeradius-devel/unlang/map.h>
#include <ldap.h>
#include "rlm_ldap.h"
+ Include dependency graph for rlm_ldap.c:

Go to the source code of this file.

Data Structures

struct  ldap_auth_call_env_t
 
struct  ldap_auth_ctx_t
 Holds state of in progress async authentication. More...
 
struct  ldap_map_ctx_t
 Holds state of in progress LDAP map. More...
 
struct  ldap_mod_tmpl_t
 
struct  ldap_update_rules_t
 Parameters to allow ldap_update_section_parse to be reused. More...
 
struct  ldap_user_modify_ctx_t
 Holds state of in progress ldap user modifications. More...
 
struct  ldap_usermod_call_env_t
 
struct  ldap_xlat_profile_call_env_t
 Call environment used in the profile xlat. More...
 
struct  ldap_xlat_profile_ctx_t
 
struct  rlm_ldap_boot_t
 

Macros

#define CHECK_EXPANDED_SPACE(_expanded)   fr_assert((size_t)_expanded->count < (NUM_ELEMENTS(_expanded->attrs) - 1));
 
#define LDAP_URI_SAFE_FOR   (fr_value_box_safe_for_t)fr_ldap_uri_escape_func
 This is the common function that actually ends up doing all the URI escaping.
 
#define REPEAT_LDAP_MEMBEROF_XLAT_RESULTS
 
#define REPEAT_MOD_AUTHORIZE_RESUME
 
#define SSS_CONTROL_BUILD(_obj)
 
#define USER_CALL_ENV_COMMON(_struct)
 
#define USERMOD_ENV(_section)
 

Enumerations

enum  ldap_schemes_t {
  LDAP_SCHEME_UNIX = 0 ,
  LDAP_SCHEME_TCP ,
  LDAP_SCHEME_TCP_SSL
}
 

Functions

static int autz_ctx_free (ldap_autz_ctx_t *autz_ctx)
 Ensure authorization context is properly cleared up.
 
static char * host_uri_canonify (request_t *request, LDAPURLDesc *url_parsed, fr_value_box_t *url_in)
 Produce canonical LDAP host URI for finding trunks.
 
static int ldap_group_filter_parse (TALLOC_CTX *ctx, void *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, UNUSED call_env_parser_t const *rule)
 
static int ldap_group_filter_parse (TALLOC_CTX *ctx, void *out, tmpl_rules_t const *t_rules, UNUSED CONF_ITEM *ci, call_env_ctx_t const *cec, UNUSED call_env_parser_t const *rule)
 
static xlat_action_t ldap_group_xlat (TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
 Check for a user being in a LDAP group.
 
static void ldap_group_xlat_cancel (UNUSED request_t *request, UNUSED fr_signal_t action, void *uctx)
 Cancel an in-progress query for the LDAP group membership xlat.
 
static unlang_action_t ldap_group_xlat_results (unlang_result_t *p_result, request_t *request, void *uctx)
 Run the state machine for the LDAP membership xlat.
 
static xlat_action_t ldap_group_xlat_resume (TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, UNUSED request_t *request, UNUSED fr_value_box_list_t *in)
 Process the results of evaluating LDAP group membership.
 
static unlang_action_t ldap_group_xlat_user_find (UNUSED unlang_result_t *p_result, request_t *request, void *uctx)
 User object lookup as part of group membership xlat.
 
static int ldap_map_verify (CONF_SECTION *cs, UNUSED void const *mod_inst, UNUSED void *proc_inst, tmpl_t const *src, UNUSED map_list_t const *maps)
 
static int ldap_mod_section_parse (TALLOC_CTX *ctx, call_env_parsed_head_t *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, call_env_parser_t const *rule)
 
static int ldap_mod_section_parse (TALLOC_CTX *ctx, call_env_parsed_head_t *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, UNUSED call_env_parser_t const *rule)
 
static xlat_action_t ldap_profile_xlat (UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
 Expand an LDAP URL into a query, applying the results using the user update map.
 
static xlat_action_t ldap_profile_xlat_resume (TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, UNUSED request_t *request, UNUSED fr_value_box_list_t *in)
 Return whether evaluating the profile was successful.
 
static void ldap_query_timeout (UNUSED fr_timer_list_t *tl, UNUSED fr_time_t now, void *uctx)
 Callback when LDAP query times out.
 
static int ldap_update_section_parse (TALLOC_CTX *ctx, call_env_parsed_head_t *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, call_env_parser_t const *rule)
 
static int ldap_update_section_parse (TALLOC_CTX *ctx, call_env_parsed_head_t *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, UNUSED call_env_ctx_t const *cec, call_env_parser_t const *rule)
 
static xlat_action_t ldap_uri_escape_xlat (TALLOC_CTX *ctx, fr_dcursor_t *out, UNUSED xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
 Escape LDAP string.
 
static int ldap_uri_part_escape (fr_value_box_t *vb, UNUSED void *uctx)
 Escape function for a part of an LDAP URI.
 
static xlat_action_t ldap_uri_unescape_xlat (TALLOC_CTX *ctx, fr_dcursor_t *out, UNUSED xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
 Unescape LDAP string.
 
static xlat_action_t ldap_xlat (UNUSED TALLOC_CTX *ctx, UNUSED fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
 Expand an LDAP URL into a query, and return a string result from that query.
 
static int ldap_xlat_profile_ctx_free (ldap_xlat_profile_ctx_t *to_free)
 
static xlat_action_t ldap_xlat_resume (TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, UNUSED fr_value_box_list_t *in)
 Callback when resuming after async ldap query is completed.
 
static void ldap_xlat_signal (xlat_ctx_t const *xctx, request_t *request, UNUSED fr_signal_t action)
 Callback for signalling async ldap query.
 
static xlat_action_t ldap_xlat_uri_attr_option (TALLOC_CTX *ctx, fr_dcursor_t *out, UNUSED xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
 Modify an LDAP URI to append an option to all attributes.
 
static int ldap_xlat_uri_parse (LDAPURLDesc **uri_parsed, char **host_out, bool *free_host_out, request_t *request, char *host_default, fr_value_box_t *uri_in)
 Utility function for parsing LDAP URLs.
 
static int map_ctx_free (ldap_map_ctx_t *map_ctx)
 Ensure map context is properly cleared up.
 
static unlang_action_t mod_authenticate (unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
 
static unlang_action_t mod_authorize (unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
 
static void mod_authorize_cancel (module_ctx_t const *mctx, UNUSED request_t *request, UNUSED fr_signal_t action)
 Clear up when cancelling a mod_authorize call.
 
static unlang_action_t mod_authorize_resume (unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
 Resume function called after each potential yield in LDAP authorization.
 
static int mod_bootstrap (module_inst_ctx_t const *mctx)
 Bootstrap the module.
 
static int mod_detach (module_detach_ctx_t const *mctx)
 Detach from the LDAP server and cleanup internal state.
 
static int mod_instantiate (module_inst_ctx_t const *mctx)
 Instantiate the module.
 
static int mod_load (void)
 
static unlang_action_t mod_map_proc (unlang_result_t *p_result, map_ctx_t const *mpctx, request_t *request, fr_value_box_list_t *url, map_list_t const *maps)
 Perform a search and map the result of the search to server attributes.
 
static unlang_action_t mod_map_resume (unlang_result_t *p_result, map_ctx_t const *mpctx, request_t *request, UNUSED fr_value_box_list_t *url, UNUSED map_list_t const *maps)
 Process the results of an LDAP map query.
 
static unlang_action_t mod_modify (unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
 Modify user's object in LDAP.
 
static int mod_thread_detach (module_thread_inst_ctx_t const *mctx)
 Clean up thread specific data structure.
 
static int mod_thread_instantiate (module_thread_inst_ctx_t const *mctx)
 Initialise thread specific data structure.
 
static void mod_unload (void)
 
static void user_modify_cancel (module_ctx_t const *mctx, UNUSED request_t *request, UNUSED fr_signal_t action)
 Cancel an in progress user modification.
 
static unlang_action_t user_modify_final (unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
 Handle results of user modification.
 
static unlang_action_t user_modify_mod_build_resume (unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
 
static unlang_action_t user_modify_resume (unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
 Take the retrieved user DN and launch the async tmpl expansion of mod_values.
 
 USERMOD_ENV (accounting)
 
 USERMOD_ENV (send)
 

Variables

fr_dict_attr_t const * attr_cleartext_password
 
fr_dict_attr_t const * attr_crypt_password
 
static fr_dict_attr_t const * attr_expr_bool_enum
 
fr_dict_attr_t const * attr_ldap_userdn
 
fr_dict_attr_t const * attr_nt_password
 
fr_dict_attr_t const * attr_password
 
fr_dict_attr_t const * attr_password_with_header
 
static const call_env_method_t authenticate_method_env
 
static const call_env_method_t authorize_method_env
 
static fr_dict_t const * dict_freeradius
 
static conf_parser_t group_config []
 
static fr_uri_part_t const ldap_dn_parts []
 
static xlat_arg_parser_t const ldap_group_xlat_arg []
 
static xlat_arg_parser_t const ldap_safe_xlat_arg []
 
static xlat_arg_parser_t const ldap_uri_attr_option_xlat_arg []
 
static xlat_arg_parser_t const ldap_uri_escape_xlat_arg []
 
static fr_uri_part_t const ldap_uri_parts []
 
static fr_table_num_sorted_t const ldap_uri_scheme_table []
 
static size_t ldap_uri_scheme_table_len = NUM_ELEMENTS(ldap_uri_scheme_table)
 
static xlat_arg_parser_t const ldap_uri_unescape_xlat_arg []
 
static xlat_arg_parser_t const ldap_xlat_arg []
 
static const conf_parser_t module_config []
 
static conf_parser_t profile_config []
 
module_rlm_t rlm_ldap
 
fr_dict_autoload_t rlm_ldap_dict []
 
fr_dict_attr_autoload_t rlm_ldap_dict_attr []
 
global_lib_autoinst_t const * rlm_ldap_lib []
 
static const call_env_parser_t sasl_call_env []
 
static conf_parser_t user_config []
 
static const call_env_method_t xlat_memberof_method_env
 
static const call_env_method_t xlat_profile_method_env
 

Detailed Description

LDAP authorization and authentication module.

Id
a0aa62a9d9ff4df8f234f01affe51e6602dff675
Author
Arran Cudbard-Bell (a.cud.nosp@m.bard.nosp@m.b@fre.nosp@m.erad.nosp@m.ius.o.nosp@m.rg)
Alan DeKok (aland.nosp@m.@fre.nosp@m.eradi.nosp@m.us.o.nosp@m.rg)
Id
238019feee0452afdfcac87b9d5225baa6232f6f
Author
Arran Cudbard-Bell (a.cud.nosp@m.bard.nosp@m.b@fre.nosp@m.erad.nosp@m.ius.o.nosp@m.rg)
Alan DeKok (aland.nosp@m.@fre.nosp@m.eradi.nosp@m.us.o.nosp@m.rg)

Definition in file rlm_ldap.c.


Data Structure Documentation

◆ ldap_auth_call_env_t

struct ldap_auth_call_env_t

Definition at line 58 of file rlm_ldap.c.

+ Collaboration diagram for ldap_auth_call_env_t:
Data Fields
fr_value_box_t password
tmpl_t const * password_tmpl
fr_value_box_t user_sasl_authname
fr_value_box_t user_sasl_mech
fr_value_box_t user_sasl_proxy
fr_value_box_t user_sasl_realm

◆ ldap_auth_ctx_t

struct ldap_auth_ctx_t

Holds state of in progress async authentication.

Definition at line 355 of file rlm_ldap.c.

+ Collaboration diagram for ldap_auth_ctx_t:
Data Fields
ldap_auth_call_env_t * call_env
char const * dn
rlm_ldap_t const * inst
char const * password
fr_ldap_thread_t * thread

◆ ldap_map_ctx_t

struct ldap_map_ctx_t

Holds state of in progress LDAP map.

Definition at line 383 of file rlm_ldap.c.

+ Collaboration diagram for ldap_map_ctx_t:
Data Fields
fr_ldap_map_exp_t expanded
LDAPURLDesc * ldap_url
map_list_t const * maps
fr_ldap_query_t * query
LDAPControl * serverctrls[LDAP_MAX_CONTROLS]

◆ ldap_mod_tmpl_t

struct ldap_mod_tmpl_t

Definition at line 67 of file rlm_ldap.c.

+ Collaboration diagram for ldap_mod_tmpl_t:
Data Fields
char const * attr
fr_token_t op
tmpl_t const * tmpl

◆ ldap_update_rules_t

struct ldap_update_rules_t

Parameters to allow ldap_update_section_parse to be reused.

Definition at line 209 of file rlm_ldap.c.

Data Fields
ssize_t expect_password_offset
size_t map_offset

◆ ldap_user_modify_ctx_t

struct ldap_user_modify_ctx_t

Holds state of in progress ldap user modifications.

Definition at line 366 of file rlm_ldap.c.

+ Collaboration diagram for ldap_user_modify_ctx_t:
Data Fields
ldap_usermod_call_env_t * call_env
size_t current_mod
char const * dn
fr_value_box_list_t expanded
size_t expanded_mods
rlm_ldap_t const * inst
LDAPMod ** mod_p
LDAPMod * mod_s
size_t num_mods
fr_ldap_query_t * query
fr_ldap_thread_trunk_t * ttrunk

◆ ldap_usermod_call_env_t

struct ldap_usermod_call_env_t

Definition at line 72 of file rlm_ldap.c.

+ Collaboration diagram for ldap_usermod_call_env_t:
Data Fields
ldap_mod_tmpl_t ** mod
fr_value_box_t user_base
fr_value_box_t user_filter

◆ ldap_xlat_profile_call_env_t

struct ldap_xlat_profile_call_env_t

Call environment used in the profile xlat.

Definition at line 80 of file rlm_ldap.c.

+ Collaboration diagram for ldap_xlat_profile_call_env_t:
Data Fields
fr_value_box_t profile_filter Filter to use when searching for users.
map_list_t * profile_map List of maps to apply to the profile.

◆ ldap_xlat_profile_ctx_t

struct ldap_xlat_profile_ctx_t

Definition at line 1140 of file rlm_ldap.c.

+ Collaboration diagram for ldap_xlat_profile_ctx_t:
Data Fields
int applied
fr_ldap_map_exp_t expanded
fr_ldap_result_code_t ret
LDAPURLDesc * url

◆ rlm_ldap_boot_t

struct rlm_ldap_boot_t

Definition at line 53 of file rlm_ldap.c.

+ Collaboration diagram for rlm_ldap_boot_t:
Data Fields
fr_dict_attr_t const * cache_da
fr_dict_attr_t const * group_da

Macro Definition Documentation

◆ CHECK_EXPANDED_SPACE

#define CHECK_EXPANDED_SPACE (   _expanded)    fr_assert((size_t)_expanded->count < (NUM_ELEMENTS(_expanded->attrs) - 1));

◆ LDAP_URI_SAFE_FOR

This is the common function that actually ends up doing all the URI escaping.

Definition at line 406 of file rlm_ldap.c.

◆ REPEAT_LDAP_MEMBEROF_XLAT_RESULTS

#define REPEAT_LDAP_MEMBEROF_XLAT_RESULTS
Value:
} while (0)
#define unlang_function_repeat_set(_request, _repeat)
Set a new repeat function for an existing function frame.
Definition function.h:108
#define RETURN_UNLANG_FAIL
Definition rcode.h:57
static unlang_action_t ldap_group_xlat_results(unlang_result_t *p_result, request_t *request, void *uctx)
Run the state machine for the LDAP membership xlat.
Definition rlm_ldap.c:974

Definition at line 963 of file rlm_ldap.c.

◆ REPEAT_MOD_AUTHORIZE_RESUME

#define REPEAT_MOD_AUTHORIZE_RESUME
Value:
if (unlang_module_yield(request, mod_authorize_resume, NULL, 0, autz_ctx) == UNLANG_ACTION_FAIL) do { \
p_result->rcode = RLM_MODULE_FAIL; \
goto finish; \
} while (0)
@ UNLANG_ACTION_FAIL
Encountered an unexpected error.
Definition action.h:36
@ RLM_MODULE_FAIL
Module failed, don't reply.
Definition rcode.h:42
static unlang_action_t mod_authorize_resume(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
Resume function called after each potential yield in LDAP authorization.
Definition rlm_ldap.c:1634
unlang_action_t unlang_module_yield(request_t *request, module_method_t resume, unlang_module_signal_t signal, fr_signal_t sigmask, void *rctx)
Yield a request back to the interpreter from within a module.
Definition module.c:434

Definition at line 1616 of file rlm_ldap.c.

◆ SSS_CONTROL_BUILD

#define SSS_CONTROL_BUILD (   _obj)
Value:
if (inst->_obj.obj_sort_by) { \
LDAPSortKey **keys; \
int ret; \
ret = ldap_create_sort_keylist(&keys, UNCONST(char *, inst->_obj.obj_sort_by)); \
if (ret != LDAP_SUCCESS) { \
cf_log_err(conf, "Invalid " STRINGIFY(_obj) ".sort_by value \"%s\": %s", \
inst->_obj.obj_sort_by, ldap_err2string(ret)); \
goto error; \
} \
/* \
* Always set the control as critical, if it's not needed \
* the user can comment it out... \
*/ \
ret = ldap_create_sort_control(ldap_global_handle, keys, 1, &inst->_obj.obj_sort_ctrl); \
ldap_free_sort_keylist(keys); \
if (ret != LDAP_SUCCESS) { \
ERROR("Failed creating server sort control: %s", ldap_err2string(ret)); \
goto error; \
} \
}
#define UNCONST(_type, _ptr)
Remove const qualification from a pointer.
Definition build.h:167
#define STRINGIFY(x)
Definition build.h:197
LDAP * ldap_global_handle
Hack for OpenLDAP libldap global initialisation.
Definition base.c:41
static rs_t * conf
Definition radsniff.c:53
eap_aka_sim_process_conf_t * inst

◆ USER_CALL_ENV_COMMON

#define USER_CALL_ENV_COMMON (   _struct)
Value:
{ FR_CALL_ENV_OFFSET("base_dn", FR_TYPE_STRING, CALL_ENV_FLAG_REQUIRED | CALL_ENV_FLAG_CONCAT, _struct, user_base), .pair.dflt = "", .pair.dflt_quote = T_SINGLE_QUOTED_STRING }, \
{ FR_CALL_ENV_OFFSET("filter", FR_TYPE_STRING, CALL_ENV_FLAG_NULLABLE | CALL_ENV_FLAG_CONCAT, _struct, user_filter), .pair.dflt = "(&)", .pair.dflt_quote = T_SINGLE_QUOTED_STRING }
@ CALL_ENV_FLAG_CONCAT
If the tmpl produced multiple boxes they should be concatenated.
Definition call_env.h:76
@ CALL_ENV_FLAG_REQUIRED
Associated conf pair or section is required.
Definition call_env.h:75
@ CALL_ENV_FLAG_NULLABLE
Tmpl expansions are allowed to produce no output.
Definition call_env.h:80
#define FR_CALL_ENV_OFFSET(_name, _cast_type, _flags, _struct, _field)
Specify a call_env_parser_t which writes out runtime results to the specified field.
Definition call_env.h:340
@ FR_TYPE_STRING
String of printable characters.
@ T_SINGLE_QUOTED_STRING
Definition token.h:122

Definition at line 187 of file rlm_ldap.c.

◆ USERMOD_ENV

#define USERMOD_ENV (   _section)
Value:
static const call_env_method_t _section ## _usermod_method_env = { \
FR_CALL_ENV_METHOD_OUT(ldap_usermod_call_env_t), \
})) }, \
} \
}
#define CALL_ENV_TERMINATOR
Definition call_env.h:236
call_env_parser_t const * env
Parsing rules for call method env.
Definition call_env.h:247
#define FR_CALL_ENV_SUBSECTION(_name, _name2, _flags, _subcs)
Specify a call_env_parser_t which defines a nested subsection.
Definition call_env.h:402
@ CALL_ENV_FLAG_SUBSECTION
This is a subsection.
Definition call_env.h:87
@ CALL_ENV_FLAG_PARSE_MISSING
If this subsection is missing, still parse it.
Definition call_env.h:88
#define FR_CALL_ENV_SUBSECTION_FUNC(_name, _name2, _flags, _func)
Specify a call_env_parser_t which parses a subsection using a callback function.
Definition call_env.h:412
Per method call config.
Definition call_env.h:180
#define CF_IDENT_ANY
Definition cf_util.h:78
static int ldap_mod_section_parse(TALLOC_CTX *ctx, call_env_parsed_head_t *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, call_env_parser_t const *rule)

Definition at line 255 of file rlm_ldap.c.

Enumeration Type Documentation

◆ ldap_schemes_t

Enumerator
LDAP_SCHEME_UNIX 
LDAP_SCHEME_TCP 
LDAP_SCHEME_TCP_SSL 

Definition at line 391 of file rlm_ldap.c.

Function Documentation

◆ autz_ctx_free()

static int autz_ctx_free ( ldap_autz_ctx_t autz_ctx)
static

Ensure authorization context is properly cleared up.

Definition at line 1925 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ host_uri_canonify()

static char * host_uri_canonify ( request_t request,
LDAPURLDesc *  url_parsed,
fr_value_box_t url_in 
)
inlinestatic

Produce canonical LDAP host URI for finding trunks.

Definition at line 750 of file rlm_ldap.c.

+ Here is the caller graph for this function:

◆ ldap_group_filter_parse() [1/2]

static int ldap_group_filter_parse ( TALLOC_CTX *  ctx,
void *  out,
tmpl_rules_t const *  t_rules,
CONF_ITEM ci,
call_env_ctx_t const *  cec,
UNUSED call_env_parser_t const *  rule 
)
static

◆ ldap_group_filter_parse() [2/2]

static int ldap_group_filter_parse ( TALLOC_CTX *  ctx,
void *  out,
tmpl_rules_t const *  t_rules,
UNUSED CONF_ITEM ci,
call_env_ctx_t const *  cec,
UNUSED call_env_parser_t const *  rule 
)
static

Definition at line 2482 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ ldap_group_xlat_cancel()

static void ldap_group_xlat_cancel ( UNUSED request_t request,
UNUSED fr_signal_t  action,
void *  uctx 
)
static

Cancel an in-progress query for the LDAP group membership xlat.

Definition at line 954 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ ldap_group_xlat_results()

static unlang_action_t ldap_group_xlat_results ( unlang_result_t p_result,
request_t request,
void *  uctx 
)
static

Run the state machine for the LDAP membership xlat.

This is called after each async lookup is completed

Will stop early, and set p_result to unlang_result

Definition at line 974 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ ldap_group_xlat_resume()

static xlat_action_t ldap_group_xlat_resume ( TALLOC_CTX *  ctx,
fr_dcursor_t out,
xlat_ctx_t const *  xctx,
UNUSED request_t request,
UNUSED fr_value_box_list_t *  in 
)
static

Process the results of evaluating LDAP group membership.

Definition at line 1025 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ ldap_group_xlat_user_find()

static unlang_action_t ldap_group_xlat_user_find ( UNUSED unlang_result_t p_result,
request_t request,
void *  uctx 
)
static

User object lookup as part of group membership xlat.

Called if the ldap membership xlat is used and the user DN is not already known

Definition at line 936 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ ldap_map_verify()

static int ldap_map_verify ( CONF_SECTION cs,
UNUSED void const *  mod_inst,
UNUSED void *  proc_inst,
tmpl_t const *  src,
UNUSED map_list_t const *  maps 
)
static

Definition at line 1307 of file rlm_ldap.c.

+ Here is the caller graph for this function:

◆ ldap_mod_section_parse() [1/2]

static int ldap_mod_section_parse ( TALLOC_CTX *  ctx,
call_env_parsed_head_t *  out,
tmpl_rules_t const *  t_rules,
CONF_ITEM ci,
call_env_ctx_t const *  cec,
call_env_parser_t const *  rule 
)
static

◆ ldap_mod_section_parse() [2/2]

static int ldap_mod_section_parse ( TALLOC_CTX *  ctx,
call_env_parsed_head_t *  out,
tmpl_rules_t const *  t_rules,
CONF_ITEM ci,
call_env_ctx_t const *  cec,
UNUSED call_env_parser_t const *  rule 
)
static

Definition at line 2385 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ ldap_profile_xlat_resume()

static xlat_action_t ldap_profile_xlat_resume ( TALLOC_CTX *  ctx,
fr_dcursor_t out,
xlat_ctx_t const *  xctx,
UNUSED request_t request,
UNUSED fr_value_box_list_t *  in 
)
static

Return whether evaluating the profile was successful.

Definition at line 1150 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ ldap_query_timeout()

static void ldap_query_timeout ( UNUSED fr_timer_list_t tl,
UNUSED fr_time_t  now,
void *  uctx 
)
static

Callback when LDAP query times out.

Definition at line 543 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ ldap_update_section_parse() [1/2]

static int ldap_update_section_parse ( TALLOC_CTX *  ctx,
call_env_parsed_head_t *  out,
tmpl_rules_t const *  t_rules,
CONF_ITEM ci,
call_env_ctx_t const *  cec,
call_env_parser_t const *  rule 
)
static

◆ ldap_update_section_parse() [2/2]

static int ldap_update_section_parse ( TALLOC_CTX *  ctx,
call_env_parsed_head_t *  out,
tmpl_rules_t const *  t_rules,
CONF_ITEM ci,
UNUSED call_env_ctx_t const *  cec,
call_env_parser_t const *  rule 
)
static

Definition at line 2306 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ ldap_uri_part_escape()

static int ldap_uri_part_escape ( fr_value_box_t vb,
UNUSED void *  uctx 
)
static

Escape function for a part of an LDAP URI.

Definition at line 514 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ ldap_xlat_profile_ctx_free()

static int ldap_xlat_profile_ctx_free ( ldap_xlat_profile_ctx_t to_free)
static

Definition at line 1163 of file rlm_ldap.c.

+ Here is the caller graph for this function:

◆ ldap_xlat_resume()

static xlat_action_t ldap_xlat_resume ( TALLOC_CTX *  ctx,
fr_dcursor_t out,
xlat_ctx_t const *  xctx,
request_t request,
UNUSED fr_value_box_list_t *  in 
)
static

Callback when resuming after async ldap query is completed.

Definition at line 659 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ ldap_xlat_signal()

static void ldap_xlat_signal ( xlat_ctx_t const *  xctx,
request_t request,
UNUSED fr_signal_t  action 
)
static

Callback for signalling async ldap query.

Definition at line 706 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ ldap_xlat_uri_parse()

static int ldap_xlat_uri_parse ( LDAPURLDesc **  uri_parsed,
char **  host_out,
bool free_host_out,
request_t request,
char *  host_default,
fr_value_box_t uri_in 
)
static

Utility function for parsing LDAP URLs.

All LDAP xlat functions that work with LDAP URLs should call this function to parse the URL.

Parameters
[out]uri_parsedLDAP URL parsed. Must be freed with ldap_url_desc_free.
[out]host_outhost name to use for the query. Must be freed with ldap_mem_free if free_host_out is true.
[out]free_host_outTrue if host_out should be freed.
[in]requestRequest being processed.
[in]host_defaultDefault host to use if the URL does not specify a host.
[in]uri_inURI to parse.
Returns
  • 0 on success.
  • -1 on failure.

Definition at line 781 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ map_ctx_free()

static int map_ctx_free ( ldap_map_ctx_t map_ctx)
static

Ensure map context is properly cleared up.

Definition at line 1428 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ mod_authenticate()

static unlang_action_t mod_authenticate ( unlang_result_t p_result,
module_ctx_t const *  mctx,
request_t request 
)
static

Definition at line 1541 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ mod_authorize()

static unlang_action_t mod_authorize ( unlang_result_t p_result,
module_ctx_t const *  mctx,
request_t request 
)
static

Definition at line 1932 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ mod_authorize_cancel()

static void mod_authorize_cancel ( module_ctx_t const *  mctx,
UNUSED request_t request,
UNUSED fr_signal_t  action 
)
static

Clear up when cancelling a mod_authorize call.

Definition at line 1915 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ mod_authorize_resume()

static unlang_action_t mod_authorize_resume ( unlang_result_t p_result,
module_ctx_t const *  mctx,
request_t request 
)
static

Resume function called after each potential yield in LDAP authorization.

Some operations may or may not yield. E.g. if group membership is read from an attribute returned with the user object and is already in the correct form, that will not yield. Hence, each state may fall through to the next.

Parameters
p_resultResult of current authorization.
mctxModule context.
requestCurrent request.
Returns
An rcode.

Definition at line 1634 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ mod_bootstrap()

static int mod_bootstrap ( module_inst_ctx_t const *  mctx)
static

Bootstrap the module.

Define attributes.

Parameters
[in]mctxconfiguration data.
Returns
  • 0 on success.
  • < 0 on failure.

Definition at line 2776 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ mod_detach()

static int mod_detach ( module_detach_ctx_t const *  mctx)
static

Detach from the LDAP server and cleanup internal state.

Definition at line 2296 of file rlm_ldap.c.

◆ mod_instantiate()

static int mod_instantiate ( module_inst_ctx_t const *  mctx)
static

Instantiate the module.

Creates a new instance of the module reading parameters from a configuration section.

Parameters
[in]mctxconfiguration data.
Returns
  • 0 on success.
  • < 0 on failure.

Definition at line 2561 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ mod_load()

static int mod_load ( void  )
static

Definition at line 2845 of file rlm_ldap.c.

◆ mod_map_proc()

static unlang_action_t mod_map_proc ( unlang_result_t p_result,
map_ctx_t const *  mpctx,
request_t request,
fr_value_box_list_t *  url,
map_list_t const *  maps 
)
static

Perform a search and map the result of the search to server attributes.

Unlike LDAP xlat, this can be used to process attributes from multiple entries.

Todo:
For xlat expansions we need to parse the raw URL first, and then apply different escape functions to the different parts.
Parameters
[out]p_resultResult of map expansion:
[in]mpctxmodule map ctx.
[in,out]requestThe current request.
[in]urlLDAP url specifying base DN and filter.
[in]mapsHead of the map list.
Returns
UNLANG_ACTION_CALCULATE_RESULT

Definition at line 1457 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ mod_map_resume()

static unlang_action_t mod_map_resume ( unlang_result_t p_result,
map_ctx_t const *  mpctx,
request_t request,
UNUSED fr_value_box_list_t *  url,
UNUSED map_list_t const *  maps 
)
static

Process the results of an LDAP map query.

Parameters
[out]p_resultResult of map expansion:
[in]mpctxmodule map ctx.
[in,out]requestThe current request.
[in]urlLDAP url specifying base DN and filter.
[in]mapsHead of the map list.
Returns
One of UNLANG_ACTION_*

Definition at line 1331 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ mod_modify()

static unlang_action_t mod_modify ( unlang_result_t p_result,
module_ctx_t const *  mctx,
request_t request 
)
static

Modify user's object in LDAP.

Process a modification map to update a user object in the LDAP directory.

The module method called in "accouting" and "send" sections.

Definition at line 2228 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ mod_thread_detach()

static int mod_thread_detach ( module_thread_inst_ctx_t const *  mctx)
static

Clean up thread specific data structure.

Definition at line 2498 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ mod_thread_instantiate()

static int mod_thread_instantiate ( module_thread_inst_ctx_t const *  mctx)
static

Initialise thread specific data structure.

Definition at line 2516 of file rlm_ldap.c.

+ Here is the call graph for this function:

◆ mod_unload()

static void mod_unload ( void  )
static

Definition at line 2870 of file rlm_ldap.c.

◆ user_modify_cancel()

static void user_modify_cancel ( module_ctx_t const *  mctx,
UNUSED request_t request,
UNUSED fr_signal_t  action 
)
static

Cancel an in progress user modification.

Definition at line 2009 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ user_modify_final()

static unlang_action_t user_modify_final ( unlang_result_t p_result,
module_ctx_t const *  mctx,
request_t request 
)
static

Handle results of user modification.

Definition at line 2021 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ user_modify_mod_build_resume()

static unlang_action_t user_modify_mod_build_resume ( unlang_result_t p_result,
module_ctx_t const *  mctx,
request_t request 
)
static

Definition at line 2050 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ user_modify_resume()

static unlang_action_t user_modify_resume ( unlang_result_t p_result,
module_ctx_t const *  mctx,
request_t request 
)
static

Take the retrieved user DN and launch the async tmpl expansion of mod_values.

Definition at line 2191 of file rlm_ldap.c.

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

◆ USERMOD_ENV() [1/2]

USERMOD_ENV ( accounting  )

◆ USERMOD_ENV() [2/2]

USERMOD_ENV ( send  )

Variable Documentation

◆ attr_cleartext_password

fr_dict_attr_t const* attr_cleartext_password

Definition at line 326 of file rlm_ldap.c.

◆ attr_crypt_password

fr_dict_attr_t const* attr_crypt_password

Definition at line 327 of file rlm_ldap.c.

◆ attr_expr_bool_enum

fr_dict_attr_t const* attr_expr_bool_enum
static

Definition at line 331 of file rlm_ldap.c.

◆ attr_ldap_userdn

fr_dict_attr_t const* attr_ldap_userdn

Definition at line 328 of file rlm_ldap.c.

◆ attr_nt_password

fr_dict_attr_t const* attr_nt_password

Definition at line 329 of file rlm_ldap.c.

◆ attr_password

fr_dict_attr_t const* attr_password

Definition at line 325 of file rlm_ldap.c.

◆ attr_password_with_header

fr_dict_attr_t const* attr_password_with_header

Definition at line 330 of file rlm_ldap.c.

◆ authenticate_method_env

const call_env_method_t authenticate_method_env
static
Initial value:
= {
.env = (call_env_parser_t[]) {
{ FR_CALL_ENV_PARSE_OFFSET("password_attribute", FR_TYPE_STRING,
ldap_auth_call_env_t, password, password_tmpl),
.pair.dflt = "User-Password", .pair.dflt_quote = T_BARE_WORD },
})) },
}
}
#define FR_CALL_ENV_PARSE_OFFSET(_name, _cast_type, _flags, _struct, _field, _parse_field)
Specify a call_env_parser_t which writes out runtime results and the result of the parsing phase to t...
Definition call_env.h:365
#define FR_CALL_ENV_METHOD_OUT(_inst)
Helper macro for populating the size/type fields of a call_env_method_t from the output structure typ...
Definition call_env.h:240
@ CALL_ENV_FLAG_ATTRIBUTE
Tmpl MUST contain an attribute reference.
Definition call_env.h:86
@ CALL_ENV_FLAG_NONE
Definition call_env.h:74
@ CALL_ENV_FLAG_BARE_WORD_ATTRIBUTE
bare words are treated as an attribute, but strings may be xlats.
Definition call_env.h:92
static const call_env_parser_t sasl_call_env[]
Definition rlm_ldap.c:90
@ T_BARE_WORD
Definition token.h:120

Definition at line 191 of file rlm_ldap.c.

◆ authorize_method_env

const call_env_method_t authorize_method_env
static

Definition at line 214 of file rlm_ldap.c.

◆ dict_freeradius

fr_dict_t const* dict_freeradius
static

Definition at line 317 of file rlm_ldap.c.

◆ group_config

conf_parser_t group_config[]
static
Initial value:
= {
{ FR_CONF_OFFSET("filter", rlm_ldap_t, group.obj_filter) },
{ FR_CONF_OFFSET("scope", rlm_ldap_t, group.obj_scope), .dflt = "sub",
.func = cf_table_parse_int, .uctx = &(cf_table_parse_ctx_t){ .table = fr_ldap_scope, .len = &fr_ldap_scope_len } },
{ FR_CONF_OFFSET("name_attribute", rlm_ldap_t, group.obj_name_attr), .dflt = "cn" },
{ FR_CONF_OFFSET("membership_attribute", rlm_ldap_t, group.userobj_membership_attr) },
{ FR_CONF_OFFSET_FLAGS("membership_filter", CONF_FLAG_XLAT, rlm_ldap_t, group.obj_membership_filter) },
{ FR_CONF_OFFSET("cacheable_name", rlm_ldap_t, group.cacheable_name), .dflt = "no" },
{ FR_CONF_OFFSET("cacheable_dn", rlm_ldap_t, group.cacheable_dn), .dflt = "no" },
{ FR_CONF_OFFSET("cache_attribute", rlm_ldap_t, group.cache_attribute) },
{ FR_CONF_OFFSET("group_attribute", rlm_ldap_t, group.attribute) },
{ FR_CONF_OFFSET("allow_dangling_group_ref", rlm_ldap_t, group.allow_dangling_refs), .dflt = "no" },
{ FR_CONF_OFFSET("skip_on_suspend", rlm_ldap_t, group.skip_on_suspend), .dflt = "yes"},
}
int cf_table_parse_int(UNUSED TALLOC_CTX *ctx, void *out, UNUSED void *parent, CONF_ITEM *ci, conf_parser_t const *rule)
Generic function for parsing conf pair values as int.
Definition cf_parse.c:1592
#define CONF_PARSER_TERMINATOR
Definition cf_parse.h:658
#define FR_CONF_OFFSET(_name, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition cf_parse.h:284
#define FR_CONF_OFFSET_FLAGS(_name, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition cf_parse.h:272
@ CONF_FLAG_XLAT
string will be dynamically expanded.
Definition cf_parse.h:445
size_t fr_ldap_scope_len
Definition base.c:77
fr_table_num_sorted_t const fr_ldap_scope[]
Definition base.c:71

Definition at line 129 of file rlm_ldap.c.

◆ ldap_dn_parts

fr_uri_part_t const ldap_dn_parts[]
static
Initial value:
= {
{ .name = "dn", .safe_for = LDAP_URI_SAFE_FOR , .func = ldap_uri_part_escape },
}
static int ldap_uri_part_escape(fr_value_box_t *vb, UNUSED void *uctx)
Escape function for a part of an LDAP URI.
Definition rlm_ldap.c:514
#define LDAP_URI_SAFE_FOR
This is the common function that actually ends up doing all the URI escaping.
Definition rlm_ldap.c:406
#define XLAT_URI_PART_TERMINATOR
Definition uri.h:66

Definition at line 736 of file rlm_ldap.c.

◆ ldap_group_xlat_arg

xlat_arg_parser_t const ldap_group_xlat_arg[]
static
Initial value:
= {
{ .required = true, .concat = true, .type = FR_TYPE_STRING, .safe_for = LDAP_URI_SAFE_FOR },
}
#define XLAT_ARG_PARSER_TERMINATOR
Definition xlat.h:170

Definition at line 1038 of file rlm_ldap.c.

◆ ldap_safe_xlat_arg

xlat_arg_parser_t const ldap_safe_xlat_arg[]
static
Initial value:
= {
{ .required = true, .concat = true, .type = FR_TYPE_STRING },
}

Definition at line 413 of file rlm_ldap.c.

◆ ldap_uri_attr_option_xlat_arg

xlat_arg_parser_t const ldap_uri_attr_option_xlat_arg[]
static
Initial value:
= {
{ .required = true, .concat = true, .type = FR_TYPE_STRING },
{ .required = true, .concat = true, .type = FR_TYPE_STRING },
}

Definition at line 566 of file rlm_ldap.c.

◆ ldap_uri_escape_xlat_arg

xlat_arg_parser_t const ldap_uri_escape_xlat_arg[]
static
Initial value:
= {
{ .required = true, .concat = true, .type = FR_TYPE_STRING },
}

Definition at line 408 of file rlm_ldap.c.

◆ ldap_uri_parts

fr_uri_part_t const ldap_uri_parts[]
static
Initial value:
= {
{ .name = "scheme", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L(":")), .part_adv = { [':'] = 1 }, .extra_skip = 2 },
{ .name = "host", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L(":"), L("/")), .part_adv = { [':'] = 1, ['/'] = 2 } },
{ .name = "port", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("/")), .part_adv = { ['/'] = 1 } },
{ .name = "dn", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1 }, .func = ldap_uri_part_escape },
{ .name = "attrs", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1 }},
{ .name = "scope", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1 }, .func = ldap_uri_part_escape },
{ .name = "filter", .safe_for = LDAP_URI_SAFE_FOR, .terminals = &FR_SBUFF_TERMS(L("?")), .part_adv = { ['?'] = 1}, .func = ldap_uri_part_escape },
{ .name = "exts", .safe_for = LDAP_URI_SAFE_FOR, .func = ldap_uri_part_escape },
}
#define L(_str)
Helper for initialising arrays of string literals.
Definition build.h:209
#define FR_SBUFF_TERMS(...)
Initialise a terminal structure with a list of sorted strings.
Definition sbuff.h:192

Definition at line 724 of file rlm_ldap.c.

◆ ldap_uri_scheme_table

fr_table_num_sorted_t const ldap_uri_scheme_table[]
static
Initial value:
= {
{ L("ldap://"), LDAP_SCHEME_UNIX },
{ L("ldapi://"), LDAP_SCHEME_TCP },
{ L("ldaps://"), LDAP_SCHEME_TCP_SSL },
}
@ LDAP_SCHEME_UNIX
Definition rlm_ldap.c:392
@ LDAP_SCHEME_TCP_SSL
Definition rlm_ldap.c:394
@ LDAP_SCHEME_TCP
Definition rlm_ldap.c:393

Definition at line 397 of file rlm_ldap.c.

◆ ldap_uri_scheme_table_len

size_t ldap_uri_scheme_table_len = NUM_ELEMENTS(ldap_uri_scheme_table)
static

Definition at line 402 of file rlm_ldap.c.

◆ ldap_uri_unescape_xlat_arg

xlat_arg_parser_t const ldap_uri_unescape_xlat_arg[]
static
Initial value:
= {
{ .required = true, .concat = true, .type = FR_TYPE_STRING },
}

Definition at line 468 of file rlm_ldap.c.

◆ ldap_xlat_arg

xlat_arg_parser_t const ldap_xlat_arg[]
static
Initial value:
= {
{ .required = true, .type = FR_TYPE_STRING, .safe_for = LDAP_URI_SAFE_FOR, .will_escape = true, },
}

Definition at line 741 of file rlm_ldap.c.

◆ module_config

const conf_parser_t module_config[]
static

Definition at line 146 of file rlm_ldap.c.

◆ profile_config

conf_parser_t profile_config[]
static
Initial value:
= {
{ FR_CONF_OFFSET("scope", rlm_ldap_t, profile.obj_scope), .dflt = "base",
.func = cf_table_parse_int, .uctx = &(cf_table_parse_ctx_t){ .table = fr_ldap_scope, .len = &fr_ldap_scope_len } },
{ FR_CONF_OFFSET("attribute", rlm_ldap_t, profile.attr) },
{ FR_CONF_OFFSET("attribute_suspend", rlm_ldap_t, profile.attr_suspend) },
{ FR_CONF_OFFSET("check_attribute", rlm_ldap_t, profile.check_attr) },
{ FR_CONF_OFFSET("sort_by", rlm_ldap_t, profile.obj_sort_by) },
{ FR_CONF_OFFSET("fallthrough_attribute", rlm_ldap_t, profile.fallthrough_attr) },
{ FR_CONF_OFFSET("fallthrough_default", rlm_ldap_t, profile.fallthrough_def), .dflt = "yes" },
}

Definition at line 98 of file rlm_ldap.c.

◆ rlm_ldap

module_rlm_t rlm_ldap
Initial value:
= {
.common = {
.name = "ldap",
.flags = 0,
.config = module_config,
.onload = mod_load,
.unload = mod_unload,
.bootstrap = mod_bootstrap,
.instantiate = mod_instantiate,
.detach = mod_detach,
.thread_instantiate = mod_thread_instantiate,
.thread_detach = mod_thread_detach,
},
.method_group = {
.bindings = (module_method_binding_t[]){
{ .section = SECTION_NAME("accounting", CF_IDENT_ANY), .method = mod_modify, .method_env = &accounting_usermod_method_env },
{ .section = SECTION_NAME("authenticate", CF_IDENT_ANY), .method = mod_authenticate, .method_env = &authenticate_method_env },
{ .section = SECTION_NAME("authorize", CF_IDENT_ANY), .method = mod_authorize, .method_env = &authorize_method_env },
{ .section = SECTION_NAME("recv", CF_IDENT_ANY), .method = mod_authorize, .method_env = &authorize_method_env },
{ .section = SECTION_NAME("send", CF_IDENT_ANY), .method = mod_modify, .method_env = &send_usermod_method_env },
}
}
}
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition dl_module.h:63
Thread specific structure to manage LDAP trunk connections.
Definition base.h:381
static int mod_detach(module_detach_ctx_t const *mctx)
Detach from the LDAP server and cleanup internal state.
Definition rlm_ldap.c:2296
static int mod_load(void)
Definition rlm_ldap.c:2845
static const call_env_method_t authenticate_method_env
Definition rlm_ldap.c:191
static const call_env_method_t authorize_method_env
Definition rlm_ldap.c:214
static unlang_action_t mod_modify(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
Modify user's object in LDAP.
Definition rlm_ldap.c:2228
static int mod_bootstrap(module_inst_ctx_t const *mctx)
Bootstrap the module.
Definition rlm_ldap.c:2776
static unlang_action_t mod_authorize(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition rlm_ldap.c:1932
static void mod_unload(void)
Definition rlm_ldap.c:2870
static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
Initialise thread specific data structure.
Definition rlm_ldap.c:2516
static unlang_action_t mod_authenticate(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition rlm_ldap.c:1541
static const conf_parser_t module_config[]
Definition rlm_ldap.c:146
static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
Clean up thread specific data structure.
Definition rlm_ldap.c:2498
static int mod_instantiate(module_inst_ctx_t const *mctx)
Instantiate the module.
Definition rlm_ldap.c:2561
#define SECTION_NAME(_name1, _name2)
Define a section name consisting of a verb and a noun.
Definition section.h:40
#define MODULE_THREAD_INST(_ctype)
Definition module.h:256
#define MODULE_BOOT(_ctype)
Definition module.h:254
#define MODULE_BINDING_TERMINATOR
Terminate a module binding list.
Definition module.h:152
#define MODULE_INST(_ctype)
Definition module.h:255
Named methods exported by a module.
Definition module.h:174

Definition at line 2879 of file rlm_ldap.c.

◆ rlm_ldap_dict

fr_dict_autoload_t rlm_ldap_dict
Initial value:
= {
{ .out = &dict_freeradius, .proto = "freeradius" },
{ NULL }
}
static fr_dict_t const * dict_freeradius
Definition rlm_ldap.c:317

Definition at line 320 of file rlm_ldap.c.

◆ rlm_ldap_dict_attr

fr_dict_attr_autoload_t rlm_ldap_dict_attr
Initial value:
= {
{ .out = &attr_password, .name = "Password", .type = FR_TYPE_TLV, .dict = &dict_freeradius },
{ .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_crypt_password, .name = "Password.Crypt", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_ldap_userdn, .name = "LDAP-UserDN", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_nt_password, .name = "Password.NT", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
{ .out = &attr_password_with_header, .name = "Password.With-Header", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_expr_bool_enum, .name = "Expr-Bool-Enum", .type = FR_TYPE_BOOL, .dict = &dict_freeradius },
{ NULL }
}
@ FR_TYPE_TLV
Contains nested attributes.
@ FR_TYPE_BOOL
A truth value.
@ FR_TYPE_OCTETS
Raw octets.
fr_dict_attr_t const * attr_nt_password
Definition rlm_ldap.c:329
fr_dict_attr_t const * attr_ldap_userdn
Definition rlm_ldap.c:328
fr_dict_attr_t const * attr_crypt_password
Definition rlm_ldap.c:327
static fr_dict_attr_t const * attr_expr_bool_enum
Definition rlm_ldap.c:331
fr_dict_attr_t const * attr_password
Definition rlm_ldap.c:325
fr_dict_attr_t const * attr_password_with_header
Definition rlm_ldap.c:330
fr_dict_attr_t const * attr_cleartext_password
Definition rlm_ldap.c:326

Definition at line 334 of file rlm_ldap.c.

◆ rlm_ldap_lib

global_lib_autoinst_t const * rlm_ldap_lib
Initial value:
= {
}
#define GLOBAL_LIB_TERMINATOR
Definition global_lib.h:51
global_lib_autoinst_t fr_libldap_global_config
Definition base.c:136

Definition at line 347 of file rlm_ldap.c.

◆ sasl_call_env

const call_env_parser_t sasl_call_env[]
static

◆ user_config

conf_parser_t user_config[]
static
Initial value:
= {
{ FR_CONF_OFFSET("scope", rlm_ldap_t, user.obj_scope), .dflt = "sub",
.func = cf_table_parse_int, .uctx = &(cf_table_parse_ctx_t){ .table = fr_ldap_scope, .len = &fr_ldap_scope_len } },
{ FR_CONF_OFFSET("sort_by", rlm_ldap_t, user.obj_sort_by) },
{ FR_CONF_OFFSET("access_attribute", rlm_ldap_t, user.obj_access_attr) },
{ FR_CONF_OFFSET("access_positive", rlm_ldap_t, user.access_positive), .dflt = "yes" },
{ FR_CONF_OFFSET("access_value_negate", rlm_ldap_t, user.access_value_negate), .dflt = "false" },
{ FR_CONF_OFFSET("access_value_suspend", rlm_ldap_t, user.access_value_suspend), .dflt = "suspended" },
{ FR_CONF_OFFSET_IS_SET("expect_password", FR_TYPE_BOOL, 0, rlm_ldap_t, user.expect_password) },
}
#define FR_CONF_OFFSET_IS_SET(_name, _type, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct,...
Definition cf_parse.h:298

Definition at line 113 of file rlm_ldap.c.

◆ xlat_memberof_method_env

const call_env_method_t xlat_memberof_method_env
static
Initial value:
= {
.env = (call_env_parser_t[]) {
})) },
.pair.escape = {
.box_escape = {
.always_escape = false,
},
},
.pair.literals_safe_for = (fr_value_box_safe_for_t)fr_ldap_box_escape,
},
})) },
}
}
#define FR_CALL_ENV_PARSE_ONLY_OFFSET(_name, _cast_type, _flags, _struct, _parse_field)
Specify a call_env_parser_t which writes out the result of the parsing phase to the field specified.
Definition call_env.h:389
int fr_ldap_box_escape(fr_value_box_t *vb, UNUSED void *uctx)
Definition util.c:112
static int ldap_group_filter_parse(TALLOC_CTX *ctx, void *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, UNUSED call_env_parser_t const *rule)
#define USER_CALL_ENV_COMMON(_struct)
Definition rlm_ldap.c:187
Call environment used in group membership xlat.
Definition rlm_ldap.h:155
@ TMPL_ESCAPE_PRE_CONCAT
Pre-concatenation escaping is useful for DSLs where elements of the expansion are static,...
Definition tmpl_escape.h:61
uintptr_t fr_value_box_safe_for_t
Escaping that's been applied to a value box.
Definition value.h:160

Definition at line 270 of file rlm_ldap.c.

◆ xlat_profile_method_env

const call_env_method_t xlat_profile_method_env
static
Initial value:
= {
.env = (call_env_parser_t[]) {
.uctx = &(ldap_update_rules_t){
.map_offset = offsetof(ldap_xlat_profile_call_env_t, profile_map),
.expect_password_offset = -1
} },
.pair.dflt = "(&)", .pair.dflt_quote = T_SINGLE_QUOTED_STRING },
})) },
}
}
static int ldap_update_section_parse(TALLOC_CTX *ctx, call_env_parsed_head_t *out, tmpl_rules_t const *t_rules, CONF_ITEM *ci, call_env_ctx_t const *cec, call_env_parser_t const *rule)
Parameters to allow ldap_update_section_parse to be reused.
Definition rlm_ldap.c:209
Call environment used in the profile xlat.
Definition rlm_ldap.c:80

Definition at line 299 of file rlm_ldap.c.