| 85 | } |
| 86 | |
| 87 | bool LdapSearchBind::LdapCheckPass(const char* user, const char* pass, unsigned passlen) { |
| 88 | // Bind with the bind user for the ldap search |
| 89 | LDAP* bind_user_ld; |
| 90 | VLOG(2) << "Trying LDAP bind with bind user for user search"; |
| 91 | bool success = Bind( |
| 92 | FLAGS_ldap_bind_dn, bind_password_.c_str(), bind_password_.size(), &bind_user_ld); |
| 93 | if (!success) return false; |
| 94 | VLOG(2) << "LDAP bind successful"; |
| 95 | |
| 96 | // Escape special characters and replace the USER_SEARCH_LOGIN_NAME_PATTERN. |
| 97 | string filter = string(user_filter_); |
| 98 | string escaped_user = EscapeFilterProperty(user); |
| 99 | replace_all(filter, USER_SEARCH_LOGIN_NAME_PATTERN, escaped_user); |
| 100 | |
| 101 | // Execute the LDAP search and try to retrieve the user dn |
| 102 | VLOG(1) << "Trying LDAP user search for: " << user; |
| 103 | vector<string> user_dns = LdapSearchObject( |
| 104 | bind_user_ld, FLAGS_ldap_user_search_basedn.c_str(), filter.c_str()); |
| 105 | ldap_unbind_ext(bind_user_ld, nullptr, nullptr); |
| 106 | if (user_dns.size() != 1) { |
| 107 | LOG(WARNING) << "LDAP search failed with base DN=" << FLAGS_ldap_user_search_basedn |
| 108 | << " and filter:" << filter << ". " << user_dns.size() << " entries " |
| 109 | << "have been found, expected a unique result."; |
| 110 | return false; |
| 111 | } |
| 112 | |
| 113 | VLOG(2) << "LDAP search successful"; |
| 114 | |
| 115 | // Bind with the found user and provided pass |
| 116 | LDAP* user_ld; |
| 117 | VLOG(2) << "Trying LDAP bind with: " << user_dns[0]; |
| 118 | success = Bind(user_dns[0], pass, passlen, &user_ld); |
| 119 | if (success) { |
| 120 | ldap_unbind_ext(user_ld, nullptr, nullptr); |
| 121 | VLOG(2) << "LDAP bind successful"; |
| 122 | } |
| 123 | |
| 124 | return success; |
| 125 | } |
| 126 | |
| 127 | bool LdapSearchBind::LdapCheckFilters(string username) { |
| 128 | if (FLAGS_ldap_group_search_basedn.empty()) return true; |
no test coverage detected