diff options
| author | Simon Rettberg | 2018-06-27 13:20:15 +0200 |
|---|---|---|
| committer | Your Name | 2018-06-27 13:20:15 +0200 |
| commit | b7c1937d5a9070ee29e2f988d22c7433037af568 (patch) | |
| tree | f8267bda291a9796f703f17ab17e9f4e7acf7212 /core/modules/pam-slx-plug/data/opt/openslx/pam/auth-source.d/99-slx-ldap | |
| parent | [run-virt] Increase timeout for dnbd3-fuse mount (diff) | |
| download | mltk-b7c1937d5a9070ee29e2f988d22c7433037af568.tar.gz mltk-b7c1937d5a9070ee29e2f988d22c7433037af568.tar.xz mltk-b7c1937d5a9070ee29e2f988d22c7433037af568.zip | |
[pam-slx-plug] Write user's LDAP attributes to .openslx/ldap
Also qury transitive group memberships of AD servers
by setting the search base to the user's DN and then limiting
the search scope to "base"
Diffstat (limited to 'core/modules/pam-slx-plug/data/opt/openslx/pam/auth-source.d/99-slx-ldap')
| -rw-r--r-- | core/modules/pam-slx-plug/data/opt/openslx/pam/auth-source.d/99-slx-ldap | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/core/modules/pam-slx-plug/data/opt/openslx/pam/auth-source.d/99-slx-ldap b/core/modules/pam-slx-plug/data/opt/openslx/pam/auth-source.d/99-slx-ldap index e4f2704e..3e20d8ed 100644 --- a/core/modules/pam-slx-plug/data/opt/openslx/pam/auth-source.d/99-slx-ldap +++ b/core/modules/pam-slx-plug/data/opt/openslx/pam/auth-source.d/99-slx-ldap @@ -102,9 +102,9 @@ run_auth() { echo -n "${USER_PASSWORD}" > "${PW}" ) & # unquoted LDAP_ATTR_* - ldapsearch -x -LLL -l 5 -o nettimeout=5 -o ldif-wrap=no \ - -H "$LDAP_URI" -b "$LDAP_BASE" uid="${PAM_USER}" -y "${PW}" -D "$BINDDN" uid="${PAM_USER}" \ - homeMount homeDirectory realAccount uid uidNumber gidNumber ${LDAP_ATTR_MOUNT_OPTS} &> "${SEARCH_USER}" + # Use "-s base" and BINDDN as search base so Active Directory will return transitive group memberships + ldapsearch -s base -x -LLL -l 5 -o nettimeout=5 -o ldif-wrap=no \ + -H "$LDAP_URI" -b "$BINDDN" -y "${PW}" -D "$BINDDN" uid="${PAM_USER}" msds-memberOfTransitive "*" &> "${SEARCH_USER}" RET=$? rm -f -- "${PW}" case "$RET" in @@ -154,11 +154,14 @@ run_auth() { cn &> "${SEARCH_ANON}" USER_GROUP=$(extract_field "cn" "$SEARCH_ANON") fi + USER_INFO_FILE=$(mktemp) + cp "$SEARCH_USER" "$USER_INFO_FILE" return 0 } TEMPFILES_LDAP= SLX_LDAP_FILE= +USER_INFO_FILE= for s_file in /opt/openslx/pam/slx-ldap.d/*; do unset_ldap_vars |