|
Lines 126-132
Link Here
|
| 126 |
# first, LDAP authentication |
126 |
# first, LDAP authentication |
| 127 |
if ( $ldap->{auth_by_bind} ) { |
127 |
if ( $ldap->{auth_by_bind} ) { |
| 128 |
my $principal_name; |
128 |
my $principal_name; |
| 129 |
if ( $config{anonymous} ) { |
129 |
|
|
|
130 |
# If anon bind, bind and search |
| 131 |
|
| 132 |
if ( $config{anonymous} ) { |
| 130 |
|
133 |
|
| 131 |
# Perform an anonymous bind |
134 |
# Perform an anonymous bind |
| 132 |
my $res = $db->bind; |
135 |
my $res = $db->bind; |
|
Lines 134-147
Link Here
|
| 134 |
warn "Anonymous LDAP bind failed: " . description($res); |
137 |
warn "Anonymous LDAP bind failed: " . description($res); |
| 135 |
return 0; |
138 |
return 0; |
| 136 |
} |
139 |
} |
| 137 |
|
140 |
|
| 138 |
# Perform a LDAP search for the given username |
141 |
# Perform a LDAP search for the given username |
| 139 |
my $search = search_method( $db, $userid ) |
142 |
my $search = search_method( $db, $userid ) |
| 140 |
or return 0; # warnings are in the sub |
143 |
or return 0; # warnings are in the sub |
|
|
144 |
$userldapentry = $search->shift_entry; |
| 145 |
$principal_name = $userldapentry->dn; |
| 146 |
} |
| 147 |
# if not anon bind, but we have a service account, search wtih that. |
| 148 |
# $ldapname is the service account, if that is defined we assume |
| 149 |
# we search wtih that. |
| 150 |
|
| 151 |
elsif ($ldapname) { |
| 152 |
|
| 153 |
# Perform an authenticated bind with the service account |
| 154 |
my $res = $db->bind($ldapname, password => $ldappassword); |
| 155 |
if ( $res->code ) { |
| 156 |
warn "Authenticated LDAP bind failed: " . description($res); |
| 157 |
return 0; |
| 158 |
} |
| 159 |
|
| 160 |
# Perform a LDAP search for the given username |
| 161 |
my $search = search_method( $db, $userid ) |
| 162 |
or return 0; # warnings are in the sub |
| 141 |
$userldapentry = $search->shift_entry; |
163 |
$userldapentry = $search->shift_entry; |
| 142 |
$principal_name = $userldapentry->dn; |
164 |
$principal_name = $userldapentry->dn; |
| 143 |
} |
165 |
} |
| 144 |
else { |
166 |
|
|
|
167 |
# And if we don't have a service account, we use principal_name to |
| 168 |
# figoure out our base DN. Hope all our users are in the same OU. |
| 169 |
|
| 170 |
else { |
| 171 |
|
| 145 |
$principal_name = $ldap->{principal_name}; |
172 |
$principal_name = $ldap->{principal_name}; |
| 146 |
if ( $principal_name and $principal_name =~ /\%/ ) { |
173 |
if ( $principal_name and $principal_name =~ /\%/ ) { |
| 147 |
$principal_name = sprintf( $principal_name, $userid ); |
174 |
$principal_name = sprintf( $principal_name, $userid ); |