|
 |
ac7d03 |
From 1288763da61ba9e0c9bd345487a3e645c58284df Mon Sep 17 00:00:00 2001
|
|
|
ac7d03 |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
ac7d03 |
Date: Wed, 22 Mar 2017 13:00:22 +0200
|
|
|
ac7d03 |
Subject: [PATCH] ldap2: use LDAP whoami operation to retrieve bind DN for
|
|
|
ac7d03 |
current connection
|
|
|
ac7d03 |
|
|
|
ac7d03 |
For external users which are mapped to some DN in LDAP server, we
|
|
|
ac7d03 |
wouldn't neccesary be able to find a kerberos data in their LDAP entry.
|
|
|
ac7d03 |
Instead of searching for Kerberos principal use actual DN we are bound
|
|
|
ac7d03 |
to because for get_effective_rights LDAP control we only need the DN
|
|
|
ac7d03 |
itself.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Fixes https://pagure.io/freeipa/issue/6797
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
|
|
|
ac7d03 |
Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
|
|
|
ac7d03 |
---
|
|
|
ac7d03 |
ipaserver/plugins/ldap2.py | 7 +++----
|
|
|
ac7d03 |
1 file changed, 3 insertions(+), 4 deletions(-)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
diff --git a/ipaserver/plugins/ldap2.py b/ipaserver/plugins/ldap2.py
|
|
|
ac7d03 |
index def124530cc863e6924c7b6f1f48c236323019a9..3b1e4da57a8e16e3d9b27eea24025de2caa53216 100644
|
|
|
ac7d03 |
--- a/ipaserver/plugins/ldap2.py
|
|
|
ac7d03 |
+++ b/ipaserver/plugins/ldap2.py
|
|
|
ac7d03 |
@@ -286,12 +286,11 @@ class ldap2(CrudBackend, LDAPClient):
|
|
|
ac7d03 |
|
|
|
ac7d03 |
assert isinstance(dn, DN)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
- principal = getattr(context, 'principal')
|
|
|
ac7d03 |
- entry = self.find_entry_by_attr("krbprincipalname", principal,
|
|
|
ac7d03 |
- "krbPrincipalAux", base_dn=self.api.env.basedn)
|
|
|
ac7d03 |
+ bind_dn = self.conn.whoami_s()[4:]
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
sctrl = [
|
|
|
ac7d03 |
GetEffectiveRightsControl(
|
|
|
ac7d03 |
- True, "dn: {0}".format(entry.dn).encode('utf-8'))
|
|
|
ac7d03 |
+ True, "dn: {0}".format(bind_dn).encode('utf-8'))
|
|
|
ac7d03 |
]
|
|
|
ac7d03 |
self.conn.set_option(_ldap.OPT_SERVER_CONTROLS, sctrl)
|
|
|
ac7d03 |
try:
|
|
|
ac7d03 |
--
|
|
|
ac7d03 |
2.12.1
|
|
|
ac7d03 |
|