Hello, I found a problem in the function which checks for presence of access attribute (src/modules/rlm_ldap/ldap.c, rlm_ldap_check_access). The culprit is the following code: vals = ldap_get_values(conn->handle, entry, inst->userobj_access_attr); if (vals) { if (inst->access_positive && (strncmp(vals[0], "false", 5) == 0)) { RDEBUG("\"%s\" attribute exists but is set to 'false' - user locked out"); rcode = RLM_MODULE_USERLOCK; } else { RDEBUG("\"%s\" attribute exists - user locked out", inst->userobj_access_attr); rcode = RLM_MODULE_USERLOCK; } ldap_value_free(vals); } when access_positive is true and a user has the access attribute set to true the server gives "attribute exists - user locked out" It should be changed to something like this: if (vals) { if (inst->access_positive) { if (strncmp(vals[0], "false", 5) == 0) { RDEBUG("\"%s\" attribute exists but is set to 'false' - user locked out"); rcode = RLM_MODULE_USERLOCK; } } else { RDEBUG("\"%s\" attribute exists - user locked out", inst->userobj_access_attr); rcode = RLM_MODULE_USERLOCK; } ldap_value_free(vals); } Greetings, Maja -- Maja Gorecka-Wolniewicz mgw@umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
Hi, Thanks for reporting that. Fix is in HEAD. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
W dniu 06.08.2013 13:28, Arran Cudbard-Bell pisze:
Hi,
Thanks for reporting that. Fix is in HEAD. I forgot to add that there is a mistake in raddb/mods-available/ldap Should be: # access_positive = yes instead of # positive_access = yes
Maja
-Arran
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html
-- Maja Gorecka-Wolniewicz mgw@umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574
On 6 Aug 2013, at 13:34, Maja Wolniewicz <mgw@umk.pl> wrote:
W dniu 06.08.2013 13:28, Arran Cudbard-Bell pisze:
Hi,
Thanks for reporting that. Fix is in HEAD. I forgot to add that there is a mistake in raddb/mods-available/ldap Should be: # access_positive = yes instead of # positive_access = yes
Fixed too. Thanks. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On Tue, Aug 06, 2013 at 04:36:47PM +0100, A.L.M.Buxey@lboro.ac.uk wrote:
I forgot to add that there is a mistake in raddb/mods-available/ldap Should be: # access_positive = yes instead of # positive_access = yes
does the server fail to start if you have the wrong variable name or does it run and silently ignore?
Run and silently ignore. You can use it to define and access your own config variables. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On 6 Aug 2013, at 16:36, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
I forgot to add that there is a mistake in raddb/mods-available/ldap Should be: # access_positive = yes instead of # positive_access = yes
does the server fail to start if you have the wrong variable name or does it run and silently ignore?
Silently ignore. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
On 6 Aug 2013, at 17:27, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 6 Aug 2013, at 16:36, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
I forgot to add that there is a mistake in raddb/mods-available/ldap Should be: # access_positive = yes instead of # positive_access = yes
does the server fail to start if you have the wrong variable name or does it run and silently ignore?
Silently ignore.
Unless it was a deprecated config item. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Arran Cudbard-Bell -
Maja Wolniewicz -
Matthew Newton