--- Begin Message ---
Package: openvpn-auth-ldap
Version: 2.0.3-5.1
Severity: normal
Tags: upstream patch
Dear Maintainer,
I stumbled accross this issue while setting up ldap authentication for
openvpn:
https://code.google.com/p/openvpn-auth-ldap/issues/detail?id=7
I have included a patch that fixes this issue for me.
Using the patch + setting RFC2307bis parameter to false in the
openvpn-auth-ldap configuration file fixes it for me.
Thanks for considering inclusion in debian.
Cheers,
Frederic
-- System Information:
Debian Release: 7.4
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages openvpn-auth-ldap depends on:
ii libc6 2.13-38+deb7u1
ii libldap-2.4-2 2.4.31-1+nmu2
ii libobjc3 4.6.3-14
ii openvpn 2.2.1-8+deb7u2
openvpn-auth-ldap recommends no packages.
openvpn-auth-ldap suggests no packages.
-- no debconf information
Index: openvpn-auth-ldap-2.0.3/auth-ldap.conf
===================================================================
--- openvpn-auth-ldap-2.0.3.orig/auth-ldap.conf 2007-01-22 19:50:42.000000000 +0100
+++ openvpn-auth-ldap-2.0.3/auth-ldap.conf 2014-04-30 14:08:47.862382000 +0200
@@ -47,6 +47,9 @@
#PFTable ips_vpn_users
<Group>
+ # Match full user DN if true, uid only if false
+ RFC2307bis true
+
BaseDN "ou=Groups,dc=example,dc=com"
SearchFilter "(|(cn=developers)(cn=artists))"
MemberAttribute uniqueMember
Index: openvpn-auth-ldap-2.0.3/src/auth-ldap.m
===================================================================
--- openvpn-auth-ldap-2.0.3.orig/src/auth-ldap.m 2014-04-30 14:06:28.000000000 +0200
+++ openvpn-auth-ldap-2.0.3/src/auth-ldap.m 2014-04-30 14:09:11.778381467 +0200
@@ -409,6 +409,7 @@
TREnumerator *entryIter;
TRLDAPEntry *entry;
TRLDAPGroupConfig *result = nil;
+ int userNameLength;
/*
* Groups are loaded into the array in the order that they are listed
@@ -426,15 +427,27 @@
/* Error occured, all stop */
if (!ldapEntries)
break;
-
- /* Iterate over the returned entries */
- entryIter = [ldapEntries objectEnumerator];
- while ((entry = [entryIter nextObject]) != nil) {
- if ([ldap compareDN: [entry dn] withAttribute: [groupConfig memberAttribute] value: [ldapUser dn]]) {
- /* Group match! */
- result = groupConfig;
+ if ([groupConfig memberRFC2307BIS]) {
+ /* Iterate over the returned entries */
+ entryIter = [ldapEntries objectEnumerator];
+
+ while ((entry = [entryIter nextObject]) != nil) {
+ if ([ldap compareDN: [entry dn] withAttribute: [groupConfig memberAttribute] value: [ldapUser dn]]) {
+ /* Group match! */
+ result = groupConfig;
+ }
+ }
+ } else {
+ /* Iterate over the returned entries */
+ entryIter = [ldapEntries objectEnumerator];
+ while ((entry = [entryIter nextObject]) != nil) {
+ if ([ldap compare: [entry dn] withAttribute: [groupConfig memberAttribute] value: [ldapUser rdn]]) {
+ /* Group match! */
+ result = groupConfig;
+ }
}
}
+
[entryIter release];
[ldapEntries release];
if (result)
@@ -554,6 +567,7 @@
int ret = OPENVPN_PLUGIN_FUNC_ERROR;
username = get_env("username", envp);
+ LFString *userName=[[LFString alloc]initWithCString: username];
password = get_env("password", envp);
remoteAddress = get_env("ifconfig_pool_remote_ip", envp);
@@ -571,6 +585,7 @@
/* Find the user record */
ldapUser = find_ldap_user(ldap, ctx->config, username);
+ [ldapUser setRDN: userName];
if (!ldapUser) {
/* No such user. */
[TRLog warning: "LDAP user \"%s\" was not found.", username];
Index: openvpn-auth-ldap-2.0.3/src/LFAuthLDAPConfig.m
===================================================================
--- openvpn-auth-ldap-2.0.3.orig/src/LFAuthLDAPConfig.m 2007-01-22 19:50:42.000000000 +0100
+++ openvpn-auth-ldap-2.0.3/src/LFAuthLDAPConfig.m 2014-04-30 14:08:47.878382001 +0200
@@ -79,6 +79,7 @@
/* Group Section Variables */
LF_GROUP_MEMBER_ATTRIBUTE, /* Group Membership Attribute */
+ LF_GROUP_MEMBER_RFC2307BIS, /* Look for full DN for user in attribute */
/* Misc Shared */
LF_UNKNOWN_OPCODE, /* Unknown Opcode */
@@ -146,6 +147,7 @@
static OpcodeTable GroupSectionVariables[] = {
/* name opcode multi required */
{ "MemberAttribute", LF_GROUP_MEMBER_ATTRIBUTE, NO, NO },
+ { "RFC2307bis", LF_GROUP_MEMBER_RFC2307BIS, NO, NO },
{ NULL, 0 }
};
@@ -696,12 +698,22 @@
switch(opcodeEntry->opcode) {
TRLDAPGroupConfig *config;
+ BOOL memberRFC2307BIS;
case LF_GROUP_MEMBER_ATTRIBUTE:
config = [self currentSectionContext];
[config setMemberAttribute: [value string]];
break;
+ case LF_GROUP_MEMBER_RFC2307BIS:
+ config = [self currentSectionContext];
+ if (![value boolValue: &memberRFC2307BIS]) {
+ [self errorBoolValue: value];
+ return;
+ }
+ [config setMemberRFC2307BIS: memberRFC2307BIS];
+ break;
+
case LF_LDAP_BASEDN:
config = [self currentSectionContext];
[config setBaseDN: [value string]];
Index: openvpn-auth-ldap-2.0.3/src/LFLDAPConnection.h
===================================================================
--- openvpn-auth-ldap-2.0.3.orig/src/LFLDAPConnection.h 2007-01-22 19:50:42.000000000 +0100
+++ openvpn-auth-ldap-2.0.3/src/LFLDAPConnection.h 2014-04-30 14:08:47.882382001 +0200
@@ -56,6 +56,7 @@
baseDN: (LFString *) base
attributes: (TRArray *) attributes;
- (BOOL) compareDN: (LFString *) dn withAttribute: (LFString *) attribute value: (LFString *) value;
+- (BOOL) compare: (LFString *) dn withAttribute: (LFString *) attribute value: (LFString *) value;
- (BOOL) setReferralEnabled: (BOOL) enabled;
- (BOOL) setTLSCACertFile: (LFString *) fileName;
Index: openvpn-auth-ldap-2.0.3/src/LFLDAPConnection.m
===================================================================
--- openvpn-auth-ldap-2.0.3.orig/src/LFLDAPConnection.m 2007-03-22 21:09:51.000000000 +0100
+++ openvpn-auth-ldap-2.0.3/src/LFLDAPConnection.m 2014-04-30 14:08:47.886382001 +0200
@@ -405,6 +405,50 @@
return NO;
}
+- (BOOL) compare: (LFString *) dn withAttribute: (LFString *) attribute value: (LFString *) value {
+ struct timeval timeout;
+ LDAPMessage *res;
+ struct berval bval;
+ int err;
+ int msgid;
+
+ /* Set up the ber structure for our value */
+ bval.bv_val = (char *) [value cString];
+ bval.bv_len = [value length] - 1; /* Length includes NULL terminator */
+
+ /* Set up the timeout */
+ timeout.tv_sec = _timeout;
+ timeout.tv_usec = 0;
+
+ /* Perform the compare */
+ if ((err = ldap_compare_ext(ldapConn, [dn cString], [attribute cString], &bval, NULL, NULL, &msgid)) != LDAP_SUCCESS) {
+ [TRLog debug: "LDAP compare failed: %d: %s", err, ldap_err2string(err)];
+ return NO;
+ }
+
+ /* Wait for the result */
+ if (ldap_result(ldapConn, msgid, 1, &timeout, &res) == -1) {
+ err = ldap_get_errno(ldapConn);
+ if (err == LDAP_TIMEOUT)
+ ldap_abandon_ext(ldapConn, msgid, NULL, NULL);
+
+ [TRLog debug: "ldap_compare_ext failed: %s", ldap_err2string(err)];
+ return NO;
+ }
+
+ /* Check the result */
+ if (ldap_parse_result(ldapConn, res, &err, NULL, NULL, NULL, NULL, 1) != LDAP_SUCCESS) {
+ /* Parsing failed */
+ return NO;
+ }
+ if (err == LDAP_COMPARE_TRUE)
+ return YES;
+ else
+ return NO;
+
+ return NO;
+}
+
- (BOOL) _setLDAPOption: (int) opt value: (const char *) value connection: (LDAP *) ldapConn {
int err;
Index: openvpn-auth-ldap-2.0.3/src/TRLDAPEntry.h
===================================================================
--- openvpn-auth-ldap-2.0.3.orig/src/TRLDAPEntry.h 2006-07-26 01:55:47.000000000 +0200
+++ openvpn-auth-ldap-2.0.3/src/TRLDAPEntry.h 2014-04-30 14:08:47.890382001 +0200
@@ -40,11 +40,14 @@
@interface TRLDAPEntry : TRObject {
LFString *_dn;
+ LFString *_rdn;
TRHash *_attributes;
}
- (id) initWithDN: (LFString *) dn attributes: (TRHash *) attributes;
- (LFString *) dn;
+- (LFString *) rdn;
+- (void) setRDN: (LFString *) rdn;
- (TRHash *) attributes;
@end
Index: openvpn-auth-ldap-2.0.3/src/TRLDAPEntry.m
===================================================================
--- openvpn-auth-ldap-2.0.3.orig/src/TRLDAPEntry.m 2006-07-26 01:55:47.000000000 +0200
+++ openvpn-auth-ldap-2.0.3/src/TRLDAPEntry.m 2014-04-30 14:08:47.898381999 +0200
@@ -42,6 +42,7 @@
return self;
_dn = [dn retain];
+ _rdn = nil;
_attributes = [attributes retain];
return self;
@@ -49,6 +50,7 @@
- (void) dealloc {
[_dn release];
+ [_rdn release];
[_attributes release];
[super dealloc];
}
@@ -57,6 +59,14 @@
return _dn;
}
+- (LFString *) rdn {
+ return _rdn;
+}
+
+- (void) setRDN: (LFString *) rdn {
+ _rdn=rdn;
+}
+
- (TRHash *) attributes {
return _attributes;
}
Index: openvpn-auth-ldap-2.0.3/src/TRLDAPGroupConfig.h
===================================================================
--- openvpn-auth-ldap-2.0.3.orig/src/TRLDAPGroupConfig.h 2006-07-30 22:19:54.000000000 +0200
+++ openvpn-auth-ldap-2.0.3/src/TRLDAPGroupConfig.h 2014-04-30 14:08:47.902381999 +0200
@@ -42,6 +42,7 @@
LFString *_baseDN;
LFString *_searchFilter;
LFString *_memberAttribute;
+ BOOL _memberRFC2307BIS;
LFString *_pfTable;
}
@@ -54,6 +55,9 @@
- (LFString *) memberAttribute;
- (void) setMemberAttribute: (LFString *) memberAttribute;
+- (BOOL) memberRFC2307BIS;
+- (void) setMemberRFC2307BIS: (BOOL) memberRFC2307BIS;
+
- (LFString *) pfTable;
- (void) setPFTable: (LFString *) tableName;
Index: openvpn-auth-ldap-2.0.3/src/TRLDAPGroupConfig.m
===================================================================
--- openvpn-auth-ldap-2.0.3.orig/src/TRLDAPGroupConfig.m 2006-07-30 22:19:54.000000000 +0200
+++ openvpn-auth-ldap-2.0.3/src/TRLDAPGroupConfig.m 2014-04-30 14:08:47.906382000 +0200
@@ -81,6 +81,14 @@
_memberAttribute = [memberAttribute retain];
}
+- (BOOL) memberRFC2307BIS {
+ return (_memberRFC2307BIS);
+}
+
+- (void) setMemberRFC2307BIS: (BOOL) memberRFC2307BIS {
+ _memberRFC2307BIS = memberRFC2307BIS;
+}
+
- (void) setPFTable: (LFString *) tableName {
if (_pfTable)
[_pfTable release];
--- End Message ---
