On Mar 26, 2024, at 1:48 AM, Andrei Katsuk <steep8@gmail.com> wrote:
When realm is defined as realm EXAMPLE it grants access for EXAMPLE\bob and bob@EXAMPLE.
Yes, I know...
Currently we do not support the last format that is why I want to reject bob@EXAMPLE.
i.e. "it doesn't do anything wrong, but we don't want people using it". So just *don't tell people* that it works? Document what works, and it should be fine. For that matter, why support EXAMPLE/user *and* user@example.com? There is few good reasons to allow multiple formats for the same user. Why not simplify things, and just pick one of them? 99% of sites use either a bare name "user", or an email address "user@example.com".
Perhaps the "realm" module could be updated to mark if the realm is suffix or prefix. As always, patches are welcome.
What should the modified "realm" module update ? Should it return some extra values or fill in some new attributes ?
The "realm" data structure can be modified to support a "format" string like the "realms" module. See src/modules/rlm_realm/rlm_realm.c for the handling of data structures + parsing for "format = suffix". See src/include/realms.h for the "realm" data structure. See src/main/realms.c for parsing of the data structure. Once all of that is fixed, the rlm_realms.c file can be modified to check that "realm->format == inst->format", and therefore ignore mismatched realms. Alan DeKok.