Mercurial > prosody-hg

comparison plugins/mod_auth_ldap.lua @ 12674:72f431b4dc2c

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Merge role-auth->trunk
author Matthew Wild <mwild1@gmail.com>
date Mon, 22 Aug 2022 13:53:35 +0100
parents 9061f9621330
children 74b9e05af71e
comparison
equal deleted inserted replaced
12639:6d9ee0a3eb4b 12674:72f431b4dc2c
1 -- mod_auth_ldap 1 -- mod_auth_ldap
2 2
3 local jid_split = require "util.jid".split;
4 local new_sasl = require "util.sasl".new; 3 local new_sasl = require "util.sasl".new;
5 local lualdap = require "lualdap"; 4 local lualdap = require "lualdap";
6 5
7 local function ldap_filter_escape(s) 6 local function ldap_filter_escape(s)
8 return (s:gsub("[*()\\%z]", function(c) return ("\\%02x"):format(c:byte()) end)); 7 return (s:gsub("[*()\\%z]", function(c) return ("\\%02x"):format(c:byte()) end));
18 local ldap_base = assert(module:get_option_string("ldap_base"), "ldap_base is a required option for ldap"); 17 local ldap_base = assert(module:get_option_string("ldap_base"), "ldap_base is a required option for ldap");
19 local ldap_mode = module:get_option_string("ldap_mode", "bind"); 18 local ldap_mode = module:get_option_string("ldap_mode", "bind");
20 local ldap_admins = module:get_option_string("ldap_admin_filter", 19 local ldap_admins = module:get_option_string("ldap_admin_filter",
21 module:get_option_string("ldap_admins")); -- COMPAT with mistake in documentation 20 module:get_option_string("ldap_admins")); -- COMPAT with mistake in documentation
22 local host = ldap_filter_escape(module:get_option_string("realm", module.host)); 21 local host = ldap_filter_escape(module:get_option_string("realm", module.host));
22
23 if ldap_admins then
24 module:log("error", "The 'ldap_admin_filter' option has been deprecated, "..
25 "and will be ignored. Equivalent functionality may be added in "..
26 "the future if there is demand."
27 );
28 end
23 29
24 -- Initiate connection 30 -- Initiate connection
25 local ld = nil; 31 local ld = nil;
26 module.unload = function() if ld then pcall(ld, ld.close); end end 32 module.unload = function() if ld then pcall(ld, ld.close); end end
27 33
131 end 137 end
132 else 138 else
133 module:log("error", "Unsupported ldap_mode %s", tostring(ldap_mode)); 139 module:log("error", "Unsupported ldap_mode %s", tostring(ldap_mode));
134 end 140 end
135 141
136 if ldap_admins then
137 function provider.is_admin(jid)
138 local username, user_host = jid_split(jid);
139 if user_host ~= module.host then
140 return false;
141 end
142 return ldap_do("search", 2, {
143 base = ldap_base;
144 scope = ldap_scope;
145 sizelimit = 1;
146 filter = ldap_admins:gsub("%$(%a+)", {
147 user = ldap_filter_escape(username);
148 host = host;
149 });
150 });
151 end
152 end
153
154 module:provides("auth", provider); 142 module:provides("auth", provider);