The default authtok type in the LDAP provider (unlike the new IPA and AD providers) is "password". This oddity dates back to when password was the only supported authtok type in the SSSD, so configuration specifying only the password and bind DN was valid.
>From 3b0f4a03e9f1bb7b19d3403d2d2397a2ab45578f Mon Sep 17 00:00:00 2001 From: Jakub Hrozek <jhro...@redhat.com> Date: Fri, 8 Feb 2013 16:51:18 +0100 Subject: [PATCH] LDAP: Check for authtok validity
The default authtok type in the LDAP provider (unlike the new IPA and AD providers) is "password". This oddity dates back to when password was the only supported authtok type in the SSSD, so configuration specifying only the password and bind DN was valid. We need to check the authtok validity as well before attempting to use it. --- src/providers/ldap/sdap_async_connection.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c index 20f282e3d8c9125ac196c7b6b72fdef3ddaa487b..b673daf6efdaa32bc23448c05db4e5461e9b9749 100644 --- a/src/providers/ldap/sdap_async_connection.c +++ b/src/providers/ldap/sdap_async_connection.c @@ -1628,15 +1628,17 @@ static void sdap_cli_auth_step(struct tevent_req *req) tevent_req_error(req, EINVAL); return; } + authtok_blob = dp_opt_get_blob(state->opts->basic, SDAP_DEFAULT_AUTHTOK); - - ret = sss_authtok_set_password(state, &authtok, - (const char *)authtok_blob.data, - authtok_blob.length); - if (ret) { - tevent_req_error(req, ret); - return; + if (authtok_blob.data) { + ret = sss_authtok_set_password(state, &authtok, + (const char *)authtok_blob.data, + authtok_blob.length); + if (ret) { + tevent_req_error(req, ret); + return; + } } } -- 1.8.1
_______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel