If Kerberos and LDAP authentications are enabled and enable_group_filter_check_for_authenticated_kerberos_user flag is set, then this callback checks if the authenticated user passes LDAP group filters. conn: Sasl connection - Ignored context: Ignored, always NULL requested_user: The identity/username to authorize rlen: Length of above auth_identity: "The identity associated with the secret" alen
| 591 | // propctx: Auxiliary properties - Ignored |
| 592 | // Return: SASL_OK |
| 593 | static int SaslKerberosAuthorizeExternal(sasl_conn_t* conn, void* context, |
| 594 | const char* requested_user, unsigned rlen, |
| 595 | const char* auth_identity, unsigned alen, |
| 596 | const char* def_realm, unsigned urlen, |
| 597 | struct propctx* propctx) { |
| 598 | if (FLAGS_enable_ldap_auth && |
| 599 | FLAGS_enable_group_filter_check_for_authenticated_kerberos_user) { |
| 600 | DCHECK(IsKerberosEnabled()); |
| 601 | |
| 602 | string username = string(requested_user, rlen); |
| 603 | string short_user = |
| 604 | GetShortUsernameFromKerberosPrincipal(username); |
| 605 | |
| 606 | LOG(INFO) << "Checking LDAP group filters for " |
| 607 | << "username \"" << short_user << "\" " |
| 608 | << "parsed from user principal \"" |
| 609 | << username << "\"."; |
| 610 | |
| 611 | bool success = DoLdapCheckFilters(short_user.c_str()); |
| 612 | if (!success) { |
| 613 | LOG(WARNING) << "Got authenticated principal but the " |
| 614 | << "user \"" << short_user << "\" " |
| 615 | << "didn't pass the group filters."; |
| 616 | return SASL_BADAUTH; |
| 617 | } |
| 618 | } |
| 619 | |
| 620 | LOG(INFO) << "Successfully authenticated client user \"" |
| 621 | << string(requested_user, rlen) << "\""; |
| 622 | return SASL_OK; |
| 623 | } |
| 624 | |
| 625 | // This callback could be used to authorize or restrict access to certain |
| 626 | // users when authenticating with LDAP. |
nothing calls this directly
no test coverage detected