Hello list,
i have an problem, which has to do with the change
https://bugs.exim.org/show_bug.cgi?id=660
My plan is to reduce LDAP queries and enable an admin password for mail
accounts.
The userPassword and adminPassword fields in ldap are base64 encoded sha512
crypt, which can include ","
Problem is, that they get doubled by the patch above, although i have tried an
other seperator like : LDAP_LOOKUP_USER_PLAIN = <\n ${lookup ldap.
but the doubling of , is hardcoded into the source.
Debug Log shows this:
exim[13496]: 13506 LDAP value loop
userPassword:{crypt}$6$,7_X.clF$OHzHUqADeV9ijFJn9EsB0LMp7iL7PYVNdjUtLblOvch9lGkv7G9jnvU.jUqWL61tg1352IMSVHtdJ0FUA1akT1
exim[13496]: 13506 lookup yielded: id="4029359" objectClass="qmailUser,person"
[...]
userPassword="{crypt}$6$,,7_X.clF$OHzHUqADeV9ijFJn9EsB0LMp7iL7PYVNdjUtLblOvch9lGkv7G9jnvU.jUqWL61tg1352IMSVHtdJ0FUA1akT1"
Here you can see the doubling of the ,, in the lookup. Therefore
authentification with crypteq{} will fail.
It would be nice, when i can change the separator for ldap lookups, so that i
must noch manually patch the src/lookups/ldap.c
My config looks like this:
LDAP_LOOKUP_USER_PLAIN = ${lookup ldap {\
nettime=3 time=5 user=LDAP_USER pass=LDAP_PASS
referrals=nofollow \
ldapi:///LDAP_BASEDN??sub?(&(!(accountstatus=inactive))(|(uid=${quote_ldap:$auth2})(mail=${quote_ldap:$auth2})))\
}}
LDAP_LOOKUP_USER_LOGIN = ${lookup ldap {\
nettime=3 time=5 user=LDAP_USER pass=LDAP_PASS
referrals=nofollow \
ldapi:///LDAP_BASEDN??sub?(&(!(accountstatus=inactive))(|(uid=${quote_ldap:$auth1})(mail=${quote_ldap:$auth1})))\
}}
plain:
driver = plaintext
public_name = PLAIN
server_prompts = :
server_condition = ${if or {\
{crypteq{$auth3}{${extract{userPassword}{LDAP_LOOKUP_USER_PLAIN}}}}\
{crypteq{$auth3}{${extract{adminPassword}{LDAP_LOOKUP_USER_PLAIN}}}}\
}{yes}{no}}
server_set_id = $auth2
login:
driver = plaintext
public_name = LOGIN
server_prompts = Username:: : Password::
server_condition = ${if or {\
{crypteq{$auth2}{${extract{userPassword}{LDAP_LOOKUP_USER_LOGIN}}}}\
{crypteq{$auth2}{${extract{adminPassword}{LDAP_LOOKUP_USER_LOGIN}}}}\
}{yes}{no}}
server_set_id = $auth1
Freundliche Grüße,
Daniel Betz
System Design Engineer / Senior Systemadministration
___________________________________
domainfactory GmbH
Oskar-Messter-Str. 33
85737 Ismaning
Germany
Telefon: +49 (0)89 / 55266-364
Telefax: +49 (0)89 / 55266-222
E-Mail: [email protected]
Internet: www.df.eu
Registergericht: Amtsgericht München
HRB-Nummer 150294, Geschäftsführer:
Tobias Mohr, Stephan Wolfram
--
## List details at https://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
