diff options
| -rw-r--r-- | main.go | 38 |
1 files changed, 26 insertions, 12 deletions
@@ -294,7 +294,6 @@ func (server *Server) handleBind(s ldap.UserState, w ldap.ResponseWriter, m *lda } func (server *Server) handleBindInternal(state *State, r *message.BindRequest) (int, error) { - passwd, err := server.getAttribute(string(r.Name()), "userpassword") if err != nil { return ldap.LDAPResultOperationsError, err @@ -328,7 +327,6 @@ func (server *Server) handleSearch(s ldap.UserState, w ldap.ResponseWriter, m *l } func (server *Server) handleSearchInternal(state *State, w ldap.ResponseWriter, r *message.SearchRequest) (int, error) { - log.Printf("-- SEARCH REQUEST: --") log.Printf("Request BaseDn=%s", r.BaseObject()) log.Printf("Request Filter=%s", r.Filter()) @@ -481,19 +479,23 @@ func (server *Server) handleAddInternal(state *State, r *message.AddRequest) (in } // TODO check permissions + var members []string = nil entry := Entry{} for _, attribute := range r.Attributes() { key := string(attribute.Type_()) - if strings.EqualFold(key, "memberOf") { - return ldap.LDAPResultObjectClassViolation, fmt.Errorf( - "memberOf cannot be defined directly, membership must be specified in the group itself") - } vals_str := []string{} for _, val := range attribute.Vals() { vals_str = append(vals_str, string(val)) } + + // Fail if they are trying to write memberOf, we manage this ourselves + if strings.EqualFold(key, "memberOf") { + return ldap.LDAPResultObjectClassViolation, fmt.Errorf( + "memberOf cannot be defined directly, membership must be specified in the group itself") + } + // If they are writing a member key, we have to check they are adding valid members if strings.EqualFold(key, "member") { members = vals_str for _, member := range members { @@ -530,12 +532,24 @@ func (server *Server) handleAddInternal(state *State, r *message.AddRequest) (in memberGroups = []string{} } - memberGroups = append(memberGroups, dn) - err = server.addElements(member, Entry{ - "memberOf": memberGroups, - }) - if err != nil { - return ldap.LDAPResultOperationsError, err + alreadyMember := false + for _, mb := range memberGroups { + if mb == dn { + alreadyMember = true + log.Printf("Warning: inconsistency detected, %s was memberOf %s at a time when it didn't exist!", + member, dn) + break + } + } + + if !alreadyMember { + memberGroups = append(memberGroups, dn) + err = server.addElements(member, Entry{ + "memberOf": memberGroups, + }) + if err != nil { + return ldap.LDAPResultOperationsError, err + } } } } |