On Sep 10, 2023, at 7:59 PM, 平林 哲 <Satoshi.Hirabayashi@soliton.co.jp> wrote:
When using DOUBLE_QUOTED_STRING, passwords with '\"' may not work.
They should work everywhere. They're just double quoted strings, and the rules are the same pretty much everywhere.
Register a user in ActiveDirectory with the password "pass\"word@2022", the following LDAP settings.
=== # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\"word@2022"
That works when I test it.
We also tried several patterns and summarised the results.
Password | Configration | Result -------------------|-----------------------|------- pass"word@2022 | "pass\"word@2022" | OK
Yes, the rules for double quoted strings are the same everywhere. If you want a double quote inside of a double quoted string, you have to escape it with a backslash: \"
pass\"word@2022 | "pass\\"word@2022" | Syntax error
Yes, that doesn't work. It's not supposed work, and it shouldn't work. That string is parsed as: "pass\\" and then word@2022" This is how escaping works with backslashes in all languages which support double quoted strings.
pass\\"word@2022 | "pass\\\"word@2022" | OK
Yes, the two backslashes are un-escaped to one backslash. And then the \" is converted to " This is how all double-quoted strings work.
pass\\\"word@2022 | "pass\\\\"word@2022" | Syntax error
As mentioned above, a Syntax Error occurs when '\' is an even number in the configuration.
Yes. Because if you have an even number of backslashes, every double-backslash is un-escaped to one backslash. And then if the parser sees a double quote after that, the double quote is interpreted as the end of the double quoted string.
Is this the right approach?
No.
Any advice would be appreciated.
See the rules for escaping in double quoted strings. This is the same for all languages, including the shell. Try passing those string to the shell: $ echo "pass\"word@2022" pass"word@2022 $ echo pass\\"word@2022" pass\word@2022 $ echo "pass\\\"word@2022" pass\"word@2022 $ echo "pass\\\\"word@2022" And that one doesn't output anything, because she shell is waiting for final quote. That final string is parsed as: " --> start double quoted string pass --> 4 characters \\ --> one \ \\ --> another \ " --> end of the double quoted string word@2022 --> more text " --> start of new double quoted string. Alan DeKok.