[SSSD] [PATCH] LDAP: Check for authtok validity

Jakub Hrozek jhrozek at redhat.com
Fri Feb 8 16:04:14 UTC 2013


The default authtok type in the LDAP provider (unlike the new IPA and AD
providers) is "password". This oddity dates back to when password was
the only supported authtok type in the SSSD, so configuration specifying
only the password and bind DN was valid.
-------------- next part --------------
>From 3b0f4a03e9f1bb7b19d3403d2d2397a2ab45578f Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Fri, 8 Feb 2013 16:51:18 +0100
Subject: [PATCH] LDAP: Check for authtok validity

The default authtok type in the LDAP provider (unlike the new IPA and AD
providers) is "password". This oddity dates back to when password was
the only supported authtok type in the SSSD, so configuration specifying
only the password and bind DN was valid.

We need to check the authtok validity as well before attempting to use
it.
---
 src/providers/ldap/sdap_async_connection.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c
index 20f282e3d8c9125ac196c7b6b72fdef3ddaa487b..b673daf6efdaa32bc23448c05db4e5461e9b9749 100644
--- a/src/providers/ldap/sdap_async_connection.c
+++ b/src/providers/ldap/sdap_async_connection.c
@@ -1628,15 +1628,17 @@ static void sdap_cli_auth_step(struct tevent_req *req)
             tevent_req_error(req, EINVAL);
             return;
         }
+
         authtok_blob = dp_opt_get_blob(state->opts->basic,
                                        SDAP_DEFAULT_AUTHTOK);
-
-        ret = sss_authtok_set_password(state, &authtok,
-                                       (const char *)authtok_blob.data,
-                                       authtok_blob.length);
-        if (ret) {
-            tevent_req_error(req, ret);
-            return;
+        if (authtok_blob.data) {
+            ret = sss_authtok_set_password(state, &authtok,
+                                        (const char *)authtok_blob.data,
+                                        authtok_blob.length);
+            if (ret) {
+                tevent_req_error(req, ret);
+                return;
+            }
         }
     }
 
-- 
1.8.1



More information about the sssd-devel mailing list