diff options
| -rw-r--r-- | src/providers/ldap/ldap_common.c | 41 | ||||
| -rw-r--r-- | src/providers/ldap/sdap_async_connection.c | 14 |
2 files changed, 41 insertions, 14 deletions
diff --git a/src/providers/ldap/ldap_common.c b/src/providers/ldap/ldap_common.c index f0db53f22..c98dd4ff3 100644 --- a/src/providers/ldap/ldap_common.c +++ b/src/providers/ldap/ldap_common.c @@ -28,6 +28,7 @@ #include "providers/krb5/krb5_common.h" #include "util/sss_krb5.h" +#include "util/crypto/sss_crypto.h" /* a fd the child process would log into */ int ldap_child_debug_fd = -1; @@ -203,6 +204,9 @@ int ldap_get_options(TALLOC_CTX *memctx, const char *ldap_deref; int ldap_deref_val; int o; + const char *authtok_type; + struct dp_opt_blob authtok_blob; + char *cleartext; const int search_base_options[] = { SDAP_USER_SEARCH_BASE, SDAP_GROUP_SEARCH_BASE, SDAP_NETGROUP_SEARCH_BASE, @@ -391,6 +395,43 @@ int ldap_get_options(TALLOC_CTX *memctx, goto done; } + authtok_type = dp_opt_get_string(opts->basic, SDAP_DEFAULT_AUTHTOK_TYPE); + if (authtok_type != NULL && + strcasecmp(authtok_type,"obfuscated_password") == 0) { + DEBUG(9, ("Found obfuscated password, " + "trying to convert to cleartext.\n")); + + authtok_blob = dp_opt_get_blob(opts->basic, SDAP_DEFAULT_AUTHTOK); + if (authtok_blob.data == NULL || authtok_blob.length == 0) { + DEBUG(1, ("Missing obfuscated password string.\n")); + return EINVAL; + } + + ret = sss_password_decrypt(memctx, (char *) authtok_blob.data, + &cleartext); + if (ret != EOK) { + DEBUG(1, ("Cannot convert the obfuscated " + "password back to cleartext\n")); + return ret; + } + + authtok_blob.data = (uint8_t *) cleartext; + authtok_blob.length = strlen(cleartext); + ret = dp_opt_set_blob(opts->basic, SDAP_DEFAULT_AUTHTOK, authtok_blob); + talloc_free(cleartext); + if (ret != EOK) { + DEBUG(1, ("dp_opt_set_string failed.\n")); + return ret; + } + + ret = dp_opt_set_string(opts->basic, SDAP_DEFAULT_AUTHTOK_TYPE, + "password"); + if (ret != EOK) { + DEBUG(1, ("dp_opt_set_string failed.\n")); + return ret; + } + } + ret = EOK; *_opts = opts; diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c index 986a56c98..ff8fb0d81 100644 --- a/src/providers/ldap/sdap_async_connection.c +++ b/src/providers/ldap/sdap_async_connection.c @@ -24,7 +24,6 @@ #include "util/util.h" #include "util/sss_krb5.h" #include "providers/ldap/sdap_async_private.h" -#include "util/crypto/sss_crypto.h" #define LDAP_X_SSSD_PASSWORD_EXPIRED 0x555D @@ -970,25 +969,12 @@ static int sdap_auth_get_authtok(TALLOC_CTX *mem_ctx, struct dp_opt_blob authtok, struct berval *pw) { - char *cleartext; - int ret; - if (!authtok_type) return EOK; if (!pw) return EINVAL; if (strcasecmp(authtok_type,"password") == 0) { pw->bv_len = authtok.length; pw->bv_val = (char *) authtok.data; - } else if (strcasecmp(authtok_type,"obfuscated_password") == 0) { - ret = sss_password_decrypt(mem_ctx, (char *) authtok.data, &cleartext); - if (ret != EOK) { - DEBUG(1, ("Cannot convert the obfuscated " - "password back to cleartext\n")); - return ret; - } - - pw->bv_len = strlen(cleartext); - pw->bv_val = (char *) cleartext; } else { DEBUG(1, ("Authentication token type [%s] is not supported\n", authtok_type)); |