mirror of
https://github.com/processone/ejabberd.git
synced 2024-11-26 16:26:24 +01:00
New option support: ldap_deref_aliases (EJAB-639)
Conflicts: src/ejabberd_auth_ldap.erl
This commit is contained in:
Evgeniy Khramtsov
parent
8b45ee5208
commit
f3f80ea0ea
@ -2355,6 +2355,7 @@ the value previously stored in the database will be used instead of the default
|
||||
is~\term{""} which means `anonymous connection'.
|
||||
\titem{\{ldap\_password, Password\}} \ind{options!ldap\_password}Bind password. The default
|
||||
value is \term{""}.
|
||||
\titem{\{ldap\_deref\_aliases, never|always|finding|searching\}} \ind{options!ldap\_deref\_aliases} Whether or not to dereference aliases. The default is \term{never}.
|
||||
\end{description}
|
||||
|
||||
Example:
|
||||
@ -4783,8 +4784,9 @@ The \modvcardldap{} module has
|
||||
its own optional parameters. The first group of parameters has the same
|
||||
meaning as the top-level LDAP parameters to set the authentication method:
|
||||
\option{ldap\_servers}, \option{ldap\_port}, \option{ldap\_rootdn},
|
||||
\option{ldap\_password}, \option{ldap\_base}, \option{ldap\_uids}, and
|
||||
\option{ldap\_filter}. See section~\ref{ldapauth} for detailed information
|
||||
\option{ldap\_password}, \option{ldap\_base}, \option{ldap\_uids},
|
||||
\option{ldap\_deref\_aliases} and \option{ldap\_filter}.
|
||||
See section~\ref{ldapauth} for detailed information
|
||||
about these options. If one of these options is not set, \ejabberd{} will look
|
||||
for the top-level option with the same name.
|
||||
|
||||
|
||||
@ -74,6 +74,7 @@
|
||||
uids,
|
||||
ufilter,
|
||||
lfilter, %% Local filter (performed by ejabberd, not LDAP)
|
||||
deref_aliases,
|
||||
dn_filter,
|
||||
dn_filter_attrs
|
||||
}).
|
||||
@ -352,10 +353,12 @@ get_vh_registered_users_ldap(Server) ->
|
||||
ResAttrs = result_attrs(State),
|
||||
case eldap_filter:parse(SearchFilter) of
|
||||
{ok, EldapFilter} ->
|
||||
case eldap_pool:search(Eldap_ID, [{base, State#state.base},
|
||||
{filter, EldapFilter},
|
||||
{timeout, ?LDAP_SEARCH_TIMEOUT},
|
||||
{attributes, ResAttrs}]) of
|
||||
case eldap_pool:search(Eldap_ID,
|
||||
[{base, State#state.base},
|
||||
{filter, EldapFilter},
|
||||
{timeout, ?LDAP_SEARCH_TIMEOUT},
|
||||
{deref_aliases, State#state.deref_aliases},
|
||||
{attributes, ResAttrs}]) of
|
||||
#eldap_search_result{entries = Entries} ->
|
||||
lists:flatmap(
|
||||
fun(#eldap_entry{attributes = Attrs,
|
||||
@ -411,9 +414,11 @@ find_user_dn(User, Server, State) ->
|
||||
UserFilter = build_ufilter(State, Server),
|
||||
case eldap_filter:parse(UserFilter, [{"%u", User}]) of
|
||||
{ok, Filter} ->
|
||||
case eldap_pool:search(State#state.eldap_id, [{base, State#state.base},
|
||||
{filter, Filter},
|
||||
{attributes, ResAttrs}]) of
|
||||
case eldap_pool:search(State#state.eldap_id,
|
||||
[{base, State#state.base},
|
||||
{filter, Filter},
|
||||
{deref_aliases, State#state.deref_aliases},
|
||||
{attributes, ResAttrs}]) of
|
||||
#eldap_search_result{entries = [#eldap_entry{attributes = Attrs,
|
||||
object_name = DN} | _]} ->
|
||||
dn_filter(DN, Server, Attrs, State);
|
||||
@ -453,6 +458,7 @@ is_valid_dn(DN, Server, Attrs, State) ->
|
||||
case eldap_pool:search(State#state.eldap_id,
|
||||
[{base, State#state.base},
|
||||
{filter, EldapFilter},
|
||||
{deref_aliases, State#state.deref_aliases},
|
||||
{attributes, ["dn"]}]) of
|
||||
#eldap_search_result{entries = [_|_]} ->
|
||||
DN;
|
||||
@ -564,6 +570,11 @@ parse_options(Host) ->
|
||||
end,
|
||||
eldap_utils:check_filter(DNFilter),
|
||||
LocalFilter = ejabberd_config:get_local_option({ldap_local_filter, Host}),
|
||||
DerefAliases = case ejabberd_config:get_local_option(
|
||||
{ldap_deref_aliases, Host}) of
|
||||
undefined -> never;
|
||||
Val -> Val
|
||||
end,
|
||||
#state{host = Host,
|
||||
eldap_id = Eldap_ID,
|
||||
bind_eldap_id = Bind_Eldap_ID,
|
||||
@ -580,6 +591,7 @@ parse_options(Host) ->
|
||||
uids = UIDs,
|
||||
ufilter = UserFilter,
|
||||
lfilter = LocalFilter,
|
||||
deref_aliases = DerefAliases,
|
||||
dn_filter = DNFilter,
|
||||
dn_filter_attrs = DNFilterAttrs
|
||||
}.
|
||||
|
||||
@ -322,6 +322,14 @@ parse_search_args([{timeout, Timeout}|T],A) when is_integer(Timeout) ->
|
||||
parse_search_args(T,A#eldap_search{timeout = Timeout});
|
||||
parse_search_args([{limit, Limit}|T],A) when is_integer(Limit) ->
|
||||
parse_search_args(T,A#eldap_search{limit = Limit});
|
||||
parse_search_args([{deref_aliases, never}|T],A) ->
|
||||
parse_search_args(T,A#eldap_search{deref_aliases = neverDerefAliases});
|
||||
parse_search_args([{deref_aliases, searching}|T],A) ->
|
||||
parse_search_args(T,A#eldap_search{deref_aliases = derefInSearching});
|
||||
parse_search_args([{deref_aliases, finding}|T],A) ->
|
||||
parse_search_args(T,A#eldap_search{deref_aliases = derefFindingBaseObj});
|
||||
parse_search_args([{deref_aliases, always}|T],A) ->
|
||||
parse_search_args(T,A#eldap_search{deref_aliases = derefAlways});
|
||||
parse_search_args([H|_],_) ->
|
||||
throw({error,{unknown_arg, H}});
|
||||
parse_search_args([],A) ->
|
||||
@ -699,7 +707,7 @@ gen_req({search, A}) ->
|
||||
{searchRequest,
|
||||
#'SearchRequest'{baseObject = A#eldap_search.base,
|
||||
scope = v_scope(A#eldap_search.scope),
|
||||
derefAliases = neverDerefAliases,
|
||||
derefAliases = A#eldap_search.deref_aliases,
|
||||
sizeLimit = A#eldap_search.limit,
|
||||
timeLimit = v_timeout(A#eldap_search.timeout),
|
||||
typesOnly = v_bool(A#eldap_search.types_only),
|
||||
|
||||
@ -28,6 +28,7 @@
|
||||
limit = 0,
|
||||
attributes = [],
|
||||
types_only = false,
|
||||
deref_aliases = neverDerefAliases,
|
||||
timeout = 0}).
|
||||
|
||||
|
||||
|
||||
@ -63,6 +63,7 @@
|
||||
base,
|
||||
password,
|
||||
uid,
|
||||
deref_aliases,
|
||||
group_attr,
|
||||
group_desc,
|
||||
user_desc,
|
||||
@ -330,6 +331,7 @@ eldap_search(State, FilterParseArgs, AttributesList) ->
|
||||
[{base, State#state.base},
|
||||
{filter, EldapFilter},
|
||||
{timeout, ?LDAP_SEARCH_TIMEOUT},
|
||||
{deref_aliases, State#state.deref_aliases},
|
||||
{attributes, AttributesList}]) of
|
||||
#eldap_search_result{entries = Es} ->
|
||||
%% A result with entries. Return their list.
|
||||
@ -671,6 +673,15 @@ parse_options(Host, Opts) ->
|
||||
"" -> GroupSubFilter;
|
||||
_ -> "(&" ++ GroupSubFilter ++ ConfigFilter ++ ")"
|
||||
end,
|
||||
DerefAliases = case gen_mod:get_opt(deref_aliases, Opts, undefined) of
|
||||
undefined ->
|
||||
case ejabberd_config:get_local_option(
|
||||
{deref_aliases, Host}) of
|
||||
undefined -> never;
|
||||
D -> D
|
||||
end;
|
||||
D -> D
|
||||
end,
|
||||
#state{host = Host,
|
||||
eldap_id = Eldap_ID,
|
||||
servers = LDAPServers,
|
||||
@ -684,6 +695,7 @@ parse_options(Host, Opts) ->
|
||||
base = LDAPBase,
|
||||
password = Password,
|
||||
uid = UIDAttr,
|
||||
deref_aliases = DerefAliases,
|
||||
group_attr = GroupAttr,
|
||||
group_desc = GroupDesc,
|
||||
user_desc = UserDesc,
|
||||
|
||||
@ -75,6 +75,7 @@
|
||||
search_fields,
|
||||
search_reported,
|
||||
search_reported_attrs,
|
||||
deref_aliases,
|
||||
matches
|
||||
}).
|
||||
|
||||
@ -285,9 +286,11 @@ find_ldap_user(User, State) ->
|
||||
VCardAttrs = State#state.vcard_map_attrs,
|
||||
case eldap_filter:parse(RFC2254_Filter, [{"%u", User}]) of
|
||||
{ok, EldapFilter} ->
|
||||
case eldap_pool:search(Eldap_ID, [{base, Base},
|
||||
{filter, EldapFilter},
|
||||
{attributes, VCardAttrs}]) of
|
||||
case eldap_pool:search(Eldap_ID,
|
||||
[{base, Base},
|
||||
{filter, EldapFilter},
|
||||
{deref_aliases, State#state.deref_aliases},
|
||||
{attributes, VCardAttrs}]) of
|
||||
#eldap_search_result{entries = [E | _]} ->
|
||||
E;
|
||||
_ ->
|
||||
@ -557,10 +560,12 @@ search(State, Data) ->
|
||||
Limit = State#state.matches,
|
||||
ReportedAttrs = State#state.search_reported_attrs,
|
||||
Filter = eldap:'and'([SearchFilter, eldap_utils:make_filter(Data, UIDs)]),
|
||||
case eldap_pool:search(Eldap_ID, [{base, Base},
|
||||
{filter, Filter},
|
||||
{limit, Limit},
|
||||
{attributes, ReportedAttrs}]) of
|
||||
case eldap_pool:search(Eldap_ID,
|
||||
[{base, Base},
|
||||
{filter, Filter},
|
||||
{limit, Limit},
|
||||
{deref_aliases, State#state.deref_aliases},
|
||||
{attributes, ReportedAttrs}]) of
|
||||
#eldap_search_result{entries = E} ->
|
||||
search_items(E, State);
|
||||
_ ->
|
||||
@ -760,6 +765,15 @@ parse_options(Host, Opts) ->
|
||||
_ -> []
|
||||
end
|
||||
end, SearchReported) ++ UIDAttrs),
|
||||
DerefAliases = case gen_mod:get_opt(deref_aliases, Opts, undefined) of
|
||||
undefined ->
|
||||
case ejabberd_config:get_local_option(
|
||||
{deref_aliases, Host}) of
|
||||
undefined -> never;
|
||||
D -> D
|
||||
end;
|
||||
D -> D
|
||||
end,
|
||||
#state{serverhost = Host,
|
||||
myhost = MyHost,
|
||||
eldap_id = Eldap_ID,
|
||||
@ -782,5 +796,6 @@ parse_options(Host, Opts) ->
|
||||
search_fields = SearchFields,
|
||||
search_reported = SearchReported,
|
||||
search_reported_attrs = SearchReportedAttrs,
|
||||
deref_aliases = DerefAliases,
|
||||
matches = Matches
|
||||
}.
|
||||
|
||||
Loading…
Reference in New Issue
Block a user