LDAP authorization and authentication module headers. More...

#include <freeradius-devel/server/base.h>
#include <freeradius-devel/server/module_rlm.h>
#include <freeradius-devel/ldap/base.h>

Include dependency graph for rlm_ldap.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures
struct	ldap_autz_call_env_t
	Call environment used in LDAP authorization. More...

struct	ldap_autz_ctx_t
	Holds state of in progress async authorization. More...

struct	ldap_group_xlat_ctx_t
	Holds state of in progress group membership check xlat. More...

struct	ldap_xlat_memberof_call_env_t
	Call environment used in group membership xlat. More...

struct	rlm_ldap_t

struct	rlm_ldap_t.group

struct	rlm_ldap_t.profile

struct	rlm_ldap_t.user

Enumerations
enum	ldap_access_state_t { LDAP_ACCESS_ALLOWED = 0 , LDAP_ACCESS_DISALLOWED , LDAP_ACCESS_SUSPENDED }
	User's access state. More...

enum	ldap_autz_status_t { LDAP_AUTZ_FIND = 0 , LDAP_AUTZ_GROUP , LDAP_AUTZ_GROUP_PROFILES , LDAP_AUTZ_POST_GROUP , LDAP_AUTZ_MAP , LDAP_AUTZ_PROFILES , LDAP_AUTZ_POST_PROFILES }
	State list for resumption of authorization. More...

enum	ldap_group_xlat_status_t { GROUP_XLAT_FIND_USER = 0 , GROUP_XLAT_MEMB_FILTER , GROUP_XLAT_MEMB_ATTR }
	State list for xlat evaluation of LDAP group membership. More...

enum	ldap_profile_search_mode_t { LDAP_PROFILE_SEARCH_MODE_AUTO = 0 , LDAP_PROFILE_SEARCH_MODE_SEQ , LDAP_PROFILE_SEARCH_MODE_BULK }
	How profile objects are retrieved from the directory. More...

Functions
static char const *	rlm_find_user_dn_cached (rlm_ldap_t const inst, request_t request)

unlang_action_t	rlm_ldap_cacheable_groupobj (unlang_result_t p_result, request_t request, ldap_autz_ctx_t *autz_ctx)
	Convert group membership information into attributes.

unlang_action_t	rlm_ldap_cacheable_userobj (unlang_result_t p_result, request_t request, ldap_autz_ctx_t autz_ctx, char const attr)
	Convert group membership information into attributes.

ldap_access_state_t	rlm_ldap_check_access (rlm_ldap_t const inst, request_t request, LDAPMessage *entry)
	Check for presence of access attribute in result.

unlang_action_t	rlm_ldap_check_cached (unlang_result_t p_result, rlm_ldap_t const inst, request_t request, fr_value_box_t const check)
	Check group membership attributes to see if a user is a member.

unlang_action_t	rlm_ldap_check_groupobj_dynamic (unlang_result_t p_result, request_t request, ldap_group_xlat_ctx_t *xlat_ctx)
	Initiate an LDAP search to determine group membership, querying group objects.

void	rlm_ldap_check_reply (request_t request, rlm_ldap_t const inst, char const inst_name, bool expect_password, fr_ldap_thread_trunk_t const ttrunk)
	Verify we got a password from the search.

unlang_action_t	rlm_ldap_check_userobj_dynamic (unlang_result_t p_result, request_t request, ldap_group_xlat_ctx_t *xlat_ctx)
	Query the LDAP directory to check if a user object is a member of a group.

unlang_action_t	rlm_ldap_find_user_async (TALLOC_CTX ctx, unlang_result_t p_result, rlm_ldap_t const inst, request_t request, fr_value_box_t base, fr_value_box_t filter_box, fr_ldap_thread_trunk_t ttrunk, char const attrs[], fr_ldap_query_t **query_out)
	Initiate asynchronous retrieval of the DN of a user object.

unlang_action_t	rlm_ldap_group_profiles (unlang_result_t p_result, request_t request, ldap_autz_ctx_t *autz_ctx)
	Search for profile DNs in the group objects the user is a member of.

unlang_action_t	rlm_ldap_map_profile (fr_ldap_result_code_t ret, int applied, rlm_ldap_t const inst, request_t request, fr_ldap_thread_trunk_t ttrunk, char const dn, int scope, char const filter, fr_ldap_map_exp_t const expanded)
	Search for and apply an LDAP profile.

unlang_action_t	rlm_ldap_map_profiles (fr_ldap_result_code_t ret, int applied, rlm_ldap_t const inst, request_t request, fr_ldap_thread_trunk_t ttrunk, char const const dn_list, char const filter, fr_ldap_map_exp_t const *expanded)
	Search for and apply a set of LDAP profiles.

static char const *	rlm_ldap_profile_attr_select (char const attr, char const attr_suspend, ldap_access_state_t access_state)
	Return the profile attribute matching the user's access state.

Variables
HIDDEN fr_dict_attr_t const *	attr_cleartext_password

HIDDEN fr_dict_attr_t const *	attr_crypt_password

HIDDEN fr_dict_attr_t const *	attr_nt_password

HIDDEN fr_dict_attr_t const *	attr_password

HIDDEN fr_dict_attr_t const *	attr_password_with_header

HIDDEN fr_dict_attr_t const *	attr_user_name

HIDDEN fr_dict_attr_t const *	attr_user_password

Detailed Description

LDAP authorization and authentication module headers.

Id: 6ee41c9cdade115ad4178ebcadf0aaf18aba78ff

Note: Do not rename to ldap.h. This causes configure checks to break in stupid ways, where the configure script will use the local ldap.h file, instead of the one from libldap.

Author: Arran Cudbard-Bell (a.cud.nosp@m.bard.nosp@m.b@fre.nosp@m.erad.nosp@m.ius.o.nosp@m.rg)

Copyright: 2015 Arran Cudbard-Bell (a.cud.nosp@m.bard.nosp@m.b@fre.nosp@m.erad.nosp@m.ius.o.nosp@m.rg); 2013 Network RADIUS SAS (legal.nosp@m.@net.nosp@m.workr.nosp@m.adiu.nosp@m.s.com); 2013-2015 The FreeRADIUS Server Project.

Definition in file rlm_ldap.h.

Data Structure Documentation

◆ ldap_autz_call_env_t

struct ldap_autz_call_env_t

Call environment used in LDAP authorization.

Definition at line 167 of file rlm_ldap.h.

Collaboration diagram for ldap_autz_call_env_t:

Data Fields
fr_value_box_t	default_profile	If this is set, we will search for a profile object with this name, and map any attributes it contains. No value should be set if profiles are not being used as there is an associated performance penalty.
fr_value_box_t const *	expect_password	True if the user_map included a mapping between an LDAP attribute and one of our password reference attributes.
fr_value_box_t	group_base	Base DN in which to search for groups.
tmpl_t *	group_filter	tmpl to expand as group membership filter.
fr_value_box_t	profile_child_rdn	RDN of a child object to evaluate below each profile.
fr_value_box_t	profile_filter	Filter to use when searching for profiles.
fr_value_box_t	user_base	Base DN in which to search for users.
fr_value_box_t	user_filter	Filter to use when searching for users.
map_list_t *	user_map	Attribute map applied to users and profiles.

◆ ldap_autz_ctx_t

struct ldap_autz_ctx_t

Holds state of in progress async authorization.

Definition at line 224 of file rlm_ldap.h.

Collaboration diagram for ldap_autz_ctx_t:

Data Fields
ldap_access_state_t	access_state	What state a user's account is in.
ldap_autz_call_env_t *	call_env
module_instance_t const *	dlinst
char const *	dn
LDAPMessage *	entry
fr_ldap_map_exp_t	expanded
talloc_str_list_t *	group_dn_list	DNs of the group objects the user is a member of.
talloc_str_list_t *	group_profile_dn_list	Profile DNs found in the user's group objects.
rlm_ldap_t const *	inst
char const **	profile_dn_list	List of profile DNs to apply, default profile first, then group profiles, then profiles from the user object. NULL terminated.
int	profiles_applied	Number of profile maps applied.
fr_ldap_query_t *	query
rlm_rcode_t	rcode	What rcode we'll finally respond with.
ldap_autz_status_t	status
fr_ldap_thread_trunk_t *	ttrunk

◆ ldap_group_xlat_ctx_t

struct ldap_group_xlat_ctx_t

Holds state of in progress group membership check xlat.

Definition at line 277 of file rlm_ldap.h.

Collaboration diagram for ldap_group_xlat_ctx_t:

Data Fields
char const *	attrs[2]
fr_value_box_t *	basedn
char const *	dn
ldap_xlat_memberof_call_env_t *	env_data
fr_value_box_t *	filter
bool	found
fr_value_box_t *	group
bool	group_is_dn
rlm_ldap_t const *	inst
fr_ldap_query_t *	query
unlang_result_t	result
ldap_group_xlat_status_t	status
fr_ldap_thread_trunk_t *	ttrunk

◆ ldap_xlat_memberof_call_env_t

struct ldap_xlat_memberof_call_env_t

Call environment used in group membership xlat.

Definition at line 188 of file rlm_ldap.h.

Collaboration diagram for ldap_xlat_memberof_call_env_t:

Data Fields
fr_value_box_t	group_base	Base DN in which to search for groups.
tmpl_t *	group_filter	tmpl to expand as group membership filter.
fr_value_box_t	user_base	Base DN in which to search for users.
fr_value_box_t	user_filter	Filter to use when searching for users.

◆ rlm_ldap_t

struct rlm_ldap_t

Definition at line 32 of file rlm_ldap.h.

Collaboration diagram for rlm_ldap_t:

Data Fields
fr_pair_list_t *	bind_trigger_args	Pairs passed to trigger request for bind trunk.
trunk_conf_t	bind_trunk_conf	Trunk configuration for trunk used for bind auths.
char const *	dn_attr	Attribute to match an entry's DN in a search filter. If unset, the value detected for the directory (fr_ldap_directory_t dn_attr) is used.
struct rlm_ldap_t.group	group
fr_ldap_config_t	handle_config	Connection configuration instance.
module_instance_t const *	mi	Module instance data for thread lookups.
struct rlm_ldap_t.profile	profile
fr_pair_list_t *	trigger_args	Pairs passed to trigger request for standard trunk.
trunk_conf_t	trunk_conf	Trunk configuration.
struct rlm_ldap_t.user	user
char const *	valuepair_attr	Generic dynamic mapping attribute, contains a RADIUS attribute and value.

◆ rlm_ldap_t.group

struct rlm_ldap_t.group

Definition at line 78 of file rlm_ldap.h.

Data Fields
bool	allow_dangling_refs	Don't error if we fail to resolve a group DN referenced from a user object.
char const *	attribute	Sets the attribute we use when comparing group group memberships.
char const *	cache_attr_str	Sets the attribute we use when creating and retrieving cached group memberships.
fr_dict_attr_t const *	cache_da	The DA associated with this specific instance of the rlm_ldap module.
bool	cacheable_dn	If true the server will determine complete set of group memberships for the current user object, and perform any resolution necessary to determine the DNs of those groups, then right them to the control list (LDAP-GroupDN).
bool	cacheable_name	If true the server will determine complete set of group memberships for the current user object, and perform any resolution necessary to determine the names of those groups, then right them to the control list (LDAP-Group).
fr_dict_attr_t const *	da	The DA associated with this specific instance of the rlm_ldap module.
char const *	obj_filter	Filter to retrieve only group objects.
char const *	obj_membership_filter	Filter to only retrieve groups which contain the user as a member.
char const *	obj_name_attr	The name of the group.
int	obj_scope	Search scope.
char const *	profile_attr	Attribute in group objects naming profiles to apply.
char const *	profile_attr_suspend	Attribute in group objects naming profiles to apply when the user's account is suspended.
bool	skip_on_suspend	Don't process groups if the user is suspended.
char const *	userobj_membership_attr	Attribute that describes groups the user is a member of.

◆ rlm_ldap_t.profile

struct rlm_ldap_t.profile

Definition at line 130 of file rlm_ldap.h.

Data Fields
char const *	check_attr	LDAP attribute containing check conditions to determine if the profile should be applied.
char const *	fallthrough_attr	LDAP attribute containing conditions to determine if processing should continue to the next profile when more than one is returned.
bool	fallthrough_def	Should profile processing fall through by default.
int	obj_scope	Search scope.
char const *	obj_sort_by	List of attributes to sort profiles by.
LDAPControl *	obj_sort_ctrl	Server side sort control.
ldap_profile_search_mode_t	search_mode	Whether profiles are retrieved one at a time or with a single search.

◆ rlm_ldap_t.user

struct rlm_ldap_t.user

Definition at line 41 of file rlm_ldap.h.

Data Fields
bool	access_positive	If true the presence of the attribute will allow access, else it will deny access.
char const *	access_value_negate	If the value of the access_attr matches this, the result will be negated.
char const *	access_value_suspend	Value that indicates suspension. Is not affected by access_positive and will always allow access, but will apply a different profile.
fr_dict_attr_t const *	da	The DA associated with this specific instance of the rlm_ldap module for caching user DNs between autz and auth phases.
char const *	dn_attr_str	Sets the attribute we use when creating and retrieving cached group memberships.
bool	expect_password	Allow the user to forcefully decide if a password should be expected. Controls whether warnings are issued.
bool	expect_password_is_set	Whether an expect password value was provided.
char const *	obj_access_attr	Attribute to check to see if the user should be locked out.
int	obj_scope	Search scope.
char const *	obj_sort_by	List of attributes to sort by.
LDAPControl *	obj_sort_ctrl	Server side sort control.
char const *	profile_attr	Attribute in the user object naming profiles to apply.
char const *	profile_attr_suspend	Attribute in the user object naming profiles to apply when the user's account is suspended.

Enumeration Type Documentation

◆ ldap_access_state_t

enum ldap_access_state_t

User's access state.

Enumerator
LDAP_ACCESS_ALLOWED	User is allowed to login.
LDAP_ACCESS_DISALLOWED	User it not allow to login (disabled)
LDAP_ACCESS_SUSPENDED	User account has been suspended.

Definition at line 215 of file rlm_ldap.h.

◆ ldap_autz_status_t

enum ldap_autz_status_t

State list for resumption of authorization.

Enumerator
LDAP_AUTZ_FIND
LDAP_AUTZ_GROUP
LDAP_AUTZ_GROUP_PROFILES
LDAP_AUTZ_POST_GROUP
LDAP_AUTZ_MAP
LDAP_AUTZ_PROFILES
LDAP_AUTZ_POST_PROFILES

Definition at line 198 of file rlm_ldap.h.

◆ ldap_group_xlat_status_t

enum ldap_group_xlat_status_t

State list for xlat evaluation of LDAP group membership.

Enumerator
GROUP_XLAT_FIND_USER
GROUP_XLAT_MEMB_FILTER
GROUP_XLAT_MEMB_ATTR

Definition at line 268 of file rlm_ldap.h.

◆ ldap_profile_search_mode_t

enum ldap_profile_search_mode_t

How profile objects are retrieved from the directory.

Enumerator

LDAP_PROFILE_SEARCH_MODE_AUTO

Resolved at instantiation, LDAP_PROFILE_SEARCH_MODE_BULK when server side sorting is configured and the search scope is base, otherwise LDAP_PROFILE_SEARCH_MODE_SEQ.

LDAP_PROFILE_SEARCH_MODE_SEQ

One search per profile DN, applied in list order.

LDAP_PROFILE_SEARCH_MODE_BULK

A single search retrieving every profile object, applied in result order.

Requires base scope.

Definition at line 23 of file rlm_ldap.h.

Function Documentation

◆ rlm_find_user_dn_cached()

static char const * rlm_find_user_dn_cached	(	rlm_ldap_t const *	inst,
		request_t *	request
	)

inlinestatic

Definition at line 305 of file rlm_ldap.h.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_cacheable_groupobj()

unlang_action_t rlm_ldap_cacheable_groupobj	(	unlang_result_t *	p_result,
		request_t *	request,
		ldap_autz_ctx_t *	autz_ctx
	)

Convert group membership information into attributes.

Parameters

[out]	p_result	The result of trying to resolve a dn to a group name.
[in]	request	Current request.
[in]	autz_ctx	Authentication context being processed.

Returns: One of the RLM_MODULE_* values.

Definition at line 748 of file groups.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_cacheable_userobj()

unlang_action_t rlm_ldap_cacheable_userobj	(	unlang_result_t *	p_result,
		request_t *	request,
		ldap_autz_ctx_t *	autz_ctx,
		char const *	attr
	)

Convert group membership information into attributes.

This may just be able to parse attribute values in the user object or it may need to yield to other LDAP searches depending on what was returned and what is set to be cached.

Parameters

[out]	p_result	The result of trying to resolve a dn to a group name.
[in]	request	Current request.
[in]	autz_ctx	LDAP authorization context being processed.
[in]	attr	membership attribute to look for in the entry.

Returns: One of the RLM_MODULE_* values.

Definition at line 438 of file groups.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_check_access()

ldap_access_state_t rlm_ldap_check_access	(	rlm_ldap_t const *	inst,
		request_t *	request,
		LDAPMessage *	entry
	)

Check for presence of access attribute in result.

Parameters

[in]	inst	rlm_ldap configuration.
[in]	request	Current request.
[in]	entry	retrieved by rlm_ldap_find_user or fr_ldap_search.

Returns

RLM_MODULE_DISALLOW if the user was denied access.
RLM_MODULE_OK otherwise.

Definition at line 212 of file user.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_check_cached()

unlang_action_t rlm_ldap_check_cached	(	unlang_result_t *	p_result,
		rlm_ldap_t const *	inst,
		request_t *	request,
		fr_value_box_t const *	check
	)

Check group membership attributes to see if a user is a member.

Parameters

[out]	p_result	Result of calling the module.
[in]	inst	rlm_ldap configuration.
[in]	request	Current request.
[in]	check	vb containing the group value (name or dn).

Definition at line 1343 of file groups.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_check_groupobj_dynamic()

unlang_action_t rlm_ldap_check_groupobj_dynamic	(	unlang_result_t *	p_result,
		request_t *	request,
		ldap_group_xlat_ctx_t *	xlat_ctx
	)

Initiate an LDAP search to determine group membership, querying group objects.

Used by LDAP group membership xlat

Parameters

p_result	Current module result code.
request	Current request.
xlat_ctx	xlat context being processed.

Definition at line 950 of file groups.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_check_reply()

void rlm_ldap_check_reply	(	request_t *	request,
		rlm_ldap_t const *	inst,
		char const *	inst_name,
		bool	expect_password,
		fr_ldap_thread_trunk_t const *	ttrunk
	)

Verify we got a password from the search.

Checks to see if after the LDAP to RADIUS mapping has been completed that a reference password.

Parameters

[in]	request	Current request.
[in]	inst	Current LDAP instance.
[in]	inst_name	Name of LDAP module instance for debug messages.
[in]	expect_password	Whether we should be expecting a password.
[in]	ttrunk	the connection thread trunk.

Definition at line 258 of file user.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_check_userobj_dynamic()

unlang_action_t rlm_ldap_check_userobj_dynamic	(	unlang_result_t *	p_result,
		request_t *	request,
		ldap_group_xlat_ctx_t *	xlat_ctx
	)

Query the LDAP directory to check if a user object is a member of a group.

Parameters

[out]	p_result	Result of calling the module.
[in]	request	Current request.
[in]	xlat_ctx	Context of the xlat being evaluated.

Definition at line 1300 of file groups.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_find_user_async()

unlang_action_t rlm_ldap_find_user_async	(	TALLOC_CTX *	ctx,
		unlang_result_t *	p_result,
		rlm_ldap_t const *	inst,
		request_t *	request,
		fr_value_box_t *	base,
		fr_value_box_t *	filter,
		fr_ldap_thread_trunk_t *	ttrunk,
		char const *	attrs[],
		fr_ldap_query_t **	query_out
	)

Initiate asynchronous retrieval of the DN of a user object.

Retrieves the DN of a user and adds it to the control list as LDAP-UserDN. Will also retrieve any attributes passed.

This potentially allows for all authorization and authentication checks to be performed in one ldap search operation, which is a big bonus given the number of crappy, slow cough*AD*cough LDAP directory servers out there.

Parameters

[in]	ctx	in which to allocate the query.
[in]	p_result	Where rcode from running the query will be written.
[in]	inst	rlm_ldap configuration.
[in]	request	Current request.
[in]	base	DN to search in.
[in]	filter	to use in LDAP search.
[in]	ttrunk	LDAP thread trunk to use.
[in]	attrs	Additional attributes to retrieve, may be NULL.
[in]	query_out	Where to put a pointer to the LDAP query structure - for extracting extra returned attributes, may be NULL.

Returns

UNLANG_ACTION_PUSHED_CHILD on success.
UNLANG_ACTION_FAIL on failure.

Definition at line 166 of file user.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_group_profiles()

unlang_action_t rlm_ldap_group_profiles	(	unlang_result_t *	p_result,
		request_t *	request,
		ldap_autz_ctx_t *	autz_ctx
	)

Search for profile DNs in the group objects the user is a member of.

Retrieves only the groups which carry the profile attribute, using a single search matching the collected group DNs, with the profile attribute presence asserted in the filter.

Parameters

[out]	p_result	Result of submitting the search.
[in]	request	Current request.
[in]	autz_ctx	Authorization context, provides the group DNs and receives the profile DNs.

Returns: One of the RLM_MODULE_* values.

Definition at line 852 of file groups.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_map_profile()

unlang_action_t rlm_ldap_map_profile	(	fr_ldap_result_code_t *	ret,
		int *	applied,
		rlm_ldap_t const *	inst,
		request_t *	request,
		fr_ldap_thread_trunk_t *	ttrunk,
		char const *	dn,
		int	scope,
		char const *	filter,
		fr_ldap_map_exp_t const *	expanded
	)

Search for and apply an LDAP profile.

LDAP profiles are mapped using the same attribute map as user objects, they're used to add common sets of attributes to the request.

Parameters

[out]	ret	Where to write the result of the query.
[out]	applied	Where to write the number of profiles applied.
[in]	inst	LDAP module instance.
[in]	request	Current request.
[in]	ttrunk	Trunk connection on which to run LDAP queries.
[in]	dn	of profile object to apply.
[in]	scope	to apply when looking up profiles.
[in]	filter	to apply when looking up profiles.
[in]	expanded	Structure containing a list of xlat expanded attribute names and mapping information.

Returns: One of the RLM_MODULE_* values.

Definition at line 269 of file profile.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_map_profiles()

unlang_action_t rlm_ldap_map_profiles	(	fr_ldap_result_code_t *	ret,
		int *	applied,
		rlm_ldap_t const *	inst,
		request_t *	request,
		fr_ldap_thread_trunk_t *	ttrunk,
		char const const	dn_list,
		char const *	filter,
		fr_ldap_map_exp_t const *	expanded
	)

Search for and apply a set of LDAP profiles.

With search_mode = bulk, a single search retrieves every profile object, matching entries by DN using the attribute configured (or detected) for the directory, and profiles are applied in result order. With search_mode = seq, one search is run per profile DN, applied in list order.

Parameters

[out]	ret	Where to write the result of the last query.
[out]	applied	Incremented by the number of profile maps applied.
[in]	inst	LDAP module instance.
[in]	request	Current request.
[in]	ttrunk	Trunk connection on which to run LDAP queries.
[in]	dn_list	NULL terminated list of profile object DNs to apply, in application order (default profile first). Must contain at least one DN, and no empty strings.
[in]	filter	to apply when looking up profiles.
[in]	expanded	Structure containing a list of xlat expanded attribute names and mapping information.

Returns: An unlang_action_t.

Definition at line 311 of file profile.c.

Here is the call graph for this function:

Here is the caller graph for this function:

◆ rlm_ldap_profile_attr_select()

static char const * rlm_ldap_profile_attr_select	(	char const *	attr,
		char const *	attr_suspend,
		ldap_access_state_t	access_state
	)

inlinestatic

Return the profile attribute matching the user's access state.

User and group objects have their own profile attribute pairs, the caller passes the pair for the object type being processed.

Definition at line 249 of file rlm_ldap.h.

Here is the caller graph for this function:

Variable Documentation

◆ attr_cleartext_password

HIDDEN fr_dict_attr_t const* attr_cleartext_password

extern

Definition at line 356 of file rlm_ldap.c.

◆ attr_crypt_password

HIDDEN fr_dict_attr_t const* attr_crypt_password

extern

Definition at line 357 of file rlm_ldap.c.

◆ attr_nt_password

HIDDEN fr_dict_attr_t const* attr_nt_password

extern

Definition at line 358 of file rlm_ldap.c.

◆ attr_password

HIDDEN fr_dict_attr_t const* attr_password

extern

Definition at line 355 of file rlm_ldap.c.

◆ attr_password_with_header

HIDDEN fr_dict_attr_t const* attr_password_with_header

extern

Definition at line 359 of file rlm_ldap.c.

◆ attr_user_name

HIDDEN fr_dict_attr_t const* attr_user_name

extern

Definition at line 101 of file base.c.

◆ attr_user_password

HIDDEN fr_dict_attr_t const* attr_user_password

extern

Definition at line 63 of file rlm_yubikey.c.

Data Structures

Enumerations

Functions

Variables

Detailed Description

Data Structure Documentation

◆ ldap_autz_call_env_t

◆ ldap_autz_ctx_t

◆ ldap_group_xlat_ctx_t

◆ ldap_xlat_memberof_call_env_t

◆ rlm_ldap_t

◆ rlm_ldap_t.group

◆ rlm_ldap_t.profile

◆ rlm_ldap_t.user

Enumeration Type Documentation

◆ ldap_access_state_t

◆ ldap_autz_status_t

◆ ldap_group_xlat_status_t

◆ ldap_profile_search_mode_t

Function Documentation

◆ rlm_find_user_dn_cached()

◆ rlm_ldap_cacheable_groupobj()

◆ rlm_ldap_cacheable_userobj()

◆ rlm_ldap_check_access()

◆ rlm_ldap_check_cached()

◆ rlm_ldap_check_groupobj_dynamic()

◆ rlm_ldap_check_reply()

◆ rlm_ldap_check_userobj_dynamic()

◆ rlm_ldap_find_user_async()

◆ rlm_ldap_group_profiles()

◆ rlm_ldap_map_profile()

◆ rlm_ldap_map_profiles()

◆ rlm_ldap_profile_attr_select()

Variable Documentation

◆ attr_cleartext_password

◆ attr_crypt_password

◆ attr_nt_password

◆ attr_password

◆ attr_password_with_header

◆ attr_user_name

◆ attr_user_password