Skip to content

Commit c64c632

Browse files
alandekokalandekok
committed
remove '&' from ldap
1 parent 083d338 commit c64c632

File tree

3 files changed

+72
-49
lines changed

3 files changed

+72
-49
lines changed

‎doc/antora/modules/reference/pages/raddb/mods-available/ldap.adoc‎

Lines changed: 47 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
2+
3+
4+
15
= LDAP (Lightweight Directory Access Protocol) Module
26

37
The `ldap` module allows LDAP directory entries to be retrieved, modified,
@@ -196,8 +200,8 @@ e.g:
196200
[source, unlang]
197201
----
198202
ldap
199-
if ((ok || updated) && &User-Password) {
200-
&control.Auth-Type := ::ldap
203+
if ((ok || updated) && User-Password) {
204+
control.Auth-Type := ::ldap
201205
}
202206
----
203207
====
@@ -462,8 +466,8 @@ specified by 'default' or in the user or group objects.
462466

463467
default:: The default profile. This may be a DN or an attribute reference.
464468

465-
NOTE: To get old v2.2.x style behaviour, or to use the `&User-Profile` attribute
466-
to specify the default profile, set this to `&control.User-Profile`.
469+
NOTE: To get old v2.2.x style behaviour, or to use the `User-Profile` attribute
470+
to specify the default profile, set this to `control.User-Profile`.
467471

468472

469473

@@ -500,6 +504,22 @@ or the attributes do not have an ORDERING rule, the search will fail.
500504

501505

502506

507+
check_attribute:: The LDAP attribute containing conditions which
508+
will be evaluated to determine whether a profile should be applied.
509+
510+
511+
512+
fallthrough_attribute:: The LDAP attribute containing a condition
513+
which will be evaluated to determine whether more profiles should
514+
be applied after this one.
515+
516+
517+
518+
fallthrough_def:: If the attribute referenced in fallthrough_attribute
519+
is not in the reply, what should be the default behaviour
520+
521+
522+
503523
### Modify user object on receiving Accounting-Request
504524

505525
Useful for recording things like the last time the user logged
@@ -792,8 +812,8 @@ in LDAP URIs and DNs, and will not be escaped or modified.
792812

793813
[source,unlang]
794814
----
795-
&my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
796-
&reply.Reply-Message := "The LDAP url is %ldap.uri.escape(%{my-string}}"
815+
my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
816+
reply.Reply-Message := "The LDAP url is %ldap.uri.escape(%{my-string}}"
797817
----
798818

799819
.Output
@@ -814,7 +834,7 @@ usually prohibited.
814834

815835
[source,unlang]
816836
----
817-
&my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
837+
my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
818838
----
819839

820840
### %ldap.uri.unescape(...)
@@ -827,8 +847,8 @@ Unescape a string for use in an LDAP filter or DN.
827847

828848
[source,unlang]
829849
----
830-
&my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?\28objectClass=radiusprofile\29"
831-
&reply.Reply-Message := "The LDAP url is %ldap.uri.unescape(%{my-string})"
850+
my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?\28objectClass=radiusprofile\29"
851+
reply.Reply-Message := "The LDAP url is %ldap.uri.unescape(%{my-string})"
832852
----
833853

834854
.Output
@@ -877,29 +897,29 @@ ldap {
877897
}
878898
# valuepair_attribute = 'radiusAttribute'
879899
update {
880-
&control.Password.With-Header += 'userPassword'
881-
# &control.Password.NT := 'ntPassword'
882-
# &reply.Reply-Message := 'radiusReplyMessage'
883-
# &reply.Tunnel-Type := 'radiusTunnelType'
884-
# &reply.Tunnel-Medium-Type := 'radiusTunnelMediumType'
885-
# &reply.Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId'
886-
&control += 'radiusControlAttribute'
887-
&request += 'radiusRequestAttribute'
888-
&reply += 'radiusReplyAttribute'
900+
control.Password.With-Header += 'userPassword'
901+
# control.Password.NT := 'ntPassword'
902+
# reply.Reply-Message := 'radiusReplyMessage'
903+
# reply.Tunnel-Type := 'radiusTunnelType'
904+
# reply.Tunnel-Medium-Type := 'radiusTunnelMediumType'
905+
# reply.Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId'
906+
control += 'radiusControlAttribute'
907+
request += 'radiusRequestAttribute'
908+
reply += 'radiusReplyAttribute'
889909
}
890910
# edir = no
891911
# edir_autz = no
892912
user {
893913
base_dn = "${..base_dn}"
894-
filter = "(uid=%{&Stripped-User-Name || &User-Name})"
895-
# filter = "(&(objectClass=user)(sAMAccountName=%{&Stripped-User-Name || &User-Name})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
914+
filter = "(uid=%{&Stripped-User-Name || User-Name})"
915+
# filter = "(&(objectClass=user)(sAMAccountName=%{Stripped-User-Name || User-Name})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
896916
sasl {
897917
# mech = 'PLAIN'
898-
# authname = &User-Name
899-
# proxy = &User-Name
918+
# authname = User-Name
919+
# proxy = User-Name
900920
# realm = 'example.org'
901921
}
902-
# password_attribute = &User-Password
922+
# password_attribute = User-Password
903923
# scope = 'sub'
904924
# sort_by = '-uid'
905925
# access_attribute = 'dialupAccess'
@@ -913,7 +933,7 @@ ldap {
913933
filter = '(objectClass=posixGroup)'
914934
# scope = 'sub'
915935
# name_attribute = cn
916-
# membership_filter = "(|(member=%{control.Ldap-UserDn})(memberUid=%{&Stripped-User-Name || &User-Name}))"
936+
# membership_filter = "(|(member=%{control.Ldap-UserDn})(memberUid=%{Stripped-User-Name || User-Name}))"
917937
membership_attribute = 'memberOf'
918938
# cacheable_name = 'no'
919939
# cacheable_dn = 'no'
@@ -929,6 +949,9 @@ ldap {
929949
# attribute = 'radiusProfileDn'
930950
# attribute_suspend = 'radiusProfileDn'
931951
# sort_by = 'radiusProfilePriority'
952+
# check_attribute = 'radiusProfileCondition'
953+
# fallthrough_attribute = 'radiusProfileFallthrough'
954+
# fallthrough_default = yes
932955
}
933956
accounting {
934957
start {

‎raddb/mods-available/ldap‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -191,19 +191,19 @@ ldap {
191191
# update { ... }::
192192
#
193193
update {
194-
&control.Password.With-Header += 'userPassword'
195-
# &control.Password.NT := 'ntPassword'
196-
# &reply.Reply-Message := 'radiusReplyMessage'
197-
# &reply.Tunnel-Type := 'radiusTunnelType'
198-
# &reply.Tunnel-Medium-Type := 'radiusTunnelMediumType'
199-
# &reply.Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId'
194+
control.Password.With-Header += 'userPassword'
195+
# control.Password.NT := 'ntPassword'
196+
# reply.Reply-Message := 'radiusReplyMessage'
197+
# reply.Tunnel-Type := 'radiusTunnelType'
198+
# reply.Tunnel-Medium-Type := 'radiusTunnelMediumType'
199+
# reply.Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId'
200200

201201
# NOTE: Where only a list is specified as the RADIUS attribute,
202202
# the value of the LDAP attribute is parsed as a valuepair
203203
# in the same format as the 'valuepair_attribute' (above).
204-
&control += 'radiusControlAttribute'
205-
&request += 'radiusRequestAttribute'
206-
&reply += 'radiusReplyAttribute'
204+
control += 'radiusControlAttribute'
205+
request += 'radiusRequestAttribute'
206+
reply += 'radiusReplyAttribute'
207207
}
208208

209209
#
@@ -230,8 +230,8 @@ ldap {
230230
# [source, unlang]
231231
# ----
232232
# ldap
233-
# if ((ok || updated) && &User-Password) {
234-
# &control.Auth-Type := ::ldap
233+
# if ((ok || updated) && User-Password) {
234+
# control.Auth-Type := ::ldap
235235
# }
236236
# ----
237237
# ====
@@ -250,7 +250,7 @@ ldap {
250250
# filter:: Filter for user objects, should be specific enough
251251
# to identify a single user object.
252252
#
253-
filter = "(uid=%{&Stripped-User-Name || &User-Name})"
253+
filter = "(uid=%{&Stripped-User-Name || User-Name})"
254254

255255
# For Active Directory nested group, you should comment out the previous 'filter = ...'
256256
# and use the below. Where 'group' is the group you are querying for.
@@ -263,7 +263,7 @@ ldap {
263263
#
264264
# See: https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx
265265
#
266-
# filter = "(&(objectClass=user)(sAMAccountName=%{&Stripped-User-Name || &User-Name})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
266+
# filter = "(&(objectClass=user)(sAMAccountName=%{Stripped-User-Name || User-Name})(memberOf:1.2.840.113556.1.4.1941:=cn=group,${..base_dn}))"
267267

268268
#
269269
# sasl { ... }:: SASL parameters to use for user binds
@@ -285,12 +285,12 @@ ldap {
285285
# authname:: SASL authentication name. Mechanism specific value
286286
# to use when prompted for the client authentication name.
287287
#
288-
# authname = &User-Name
288+
# authname = User-Name
289289

290290
#
291291
# proxy:: SASL authorisation identity to proxy.
292292
#
293-
# proxy = &User-Name
293+
# proxy = User-Name
294294

295295
#
296296
# realm:: SASL realm. Used for kerberos.
@@ -309,7 +309,7 @@ ldap {
309309
# Service, CN=Windows NT, CN=Services, CN=Configuration` object. Modify the
310310
# `msDS-Other-Settings` attribute, and add a new entry for `DenyUnauthenticatedBind=1`.
311311
#
312-
# password_attribute = &User-Password
312+
# password_attribute = User-Password
313313

314314
#
315315
# scope:: Search scope, may be `base`, `one`, `sub' or `children`.
@@ -426,7 +426,7 @@ ldap {
426426
# That is, group objects with attributes that identify
427427
# members (the inverse of `membership_attribute`).
428428
#
429-
# membership_filter = "(|(member=%{control.Ldap-UserDn})(memberUid=%{&Stripped-User-Name || &User-Name}))"
429+
# membership_filter = "(|(member=%{control.Ldap-UserDn})(memberUid=%{Stripped-User-Name || User-Name}))"
430430

431431
#
432432
# membership_attribute:: The attribute, in user objects, which contain
@@ -532,8 +532,8 @@ ldap {
532532
#
533533
# default:: The default profile. This may be a DN or an attribute reference.
534534
#
535-
# NOTE: To get old v2.2.x style behaviour, or to use the `&User-Profile` attribute
536-
# to specify the default profile, set this to `&control.User-Profile`.
535+
# NOTE: To get old v2.2.x style behaviour, or to use the `User-Profile` attribute
536+
# to specify the default profile, set this to `control.User-Profile`.
537537
#
538538
# default = 'cn=radprofile,dc=example,dc=org'
539539

@@ -957,8 +957,8 @@ ldap {
957957
#
958958
# [source,unlang]
959959
# ----
960-
# &my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
961-
# &reply.Reply-Message := "The LDAP url is %ldap.uri.escape(%{my-string}}"
960+
# my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
961+
# reply.Reply-Message := "The LDAP url is %ldap.uri.escape(%{my-string}}"
962962
# ----
963963
#
964964
# .Output
@@ -979,7 +979,7 @@ ldap {
979979
#
980980
# [source,unlang]
981981
# ----
982-
# &my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
982+
# my-int := "%ldap.profile(ldap://%ldap.uri.safe(%{LDAP-Host}):%ldap.uri.safe(%{LDAP-Port})/ou=profiles,dc=example,dc=com??sub?(objectClass=radiusprofile)"
983983
# ----
984984
#
985985
# ### %ldap.uri.unescape(...)
@@ -992,8 +992,8 @@ ldap {
992992
#
993993
# [source,unlang]
994994
# ----
995-
# &my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?\28objectClass=radiusprofile\29"
996-
# &reply.Reply-Message := "The LDAP url is %ldap.uri.unescape(%{my-string})"
995+
# my-string := "ldap:///ou=profiles,dc=example,dc=com??sub?\28objectClass=radiusprofile\29"
996+
# reply.Reply-Message := "The LDAP url is %ldap.uri.unescape(%{my-string})"
997997
# ----
998998
#
999999
# .Output

‎src/tests/modules/ldap/xlat_profile.unlang‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ reply := {}
8585

8686
# Re-run the above with a different user name - the profile with "Guten Tag"
8787
# as the reply message has a condition of User-Name == bob
88-
&User-Name := 'john'
88+
User-Name := 'john'
8989
if (!%ldap.profile('cn=nested,ou=profiles,dc=example,dc=com')) {
9090
test_fail
9191
}

0 commit comments

Comments
 (0)