Problem with expansion of %{Ldap-UserDn} containing UTF-8 (cf. Bug #411)
Enrik Berkhan
enrik#freeradius at planb.de
Tue Aug 28 13:18:35 CEST 2007
Alan DeKok schrieb:
> Yup. I've deleted "done", and committed the final code.
Fine, thanks.
Now, I've tried it in 1.1.7 with the original ldap problem ... of
course, the UTF-8 part works now, but one problem with LDAP DNs remains:
The DNs may contain backslashes! Now these suffer from similar problems
being doubled during the Ldap-UserDn expansion.
Example:
LDAP-Server returns DN:
CN=Berkhan\, Enrik, ...
where the first comma is part of the CN attribute and thus escaped in
the LDAP answer. Search filter expansion containing Ldap-UserDn will
change this to
CN=Berkhan\\, Enrik, ...
and, with LDAP-escaping applied, to
CN\3dBerkhan\5c\5c\2c Enrik\2c ...
which will fail matching the original DN like in the UTF-8 case before.
Currently, I have no idea of how to fix this in a universal robust way
besides doing variable expansion completely transparently ...
Enrik
More information about the Freeradius-Devel
mailing list