Commit 7b89057c authored by Stefan Fritsch's avatar Stefan Fritsch
Browse files

Some LDAP servers (wrongly) return LDAP_CONSTRAINT_VIOLATION if a user is 

locked due to too many password retries. This should not cause an internal
server error but be treated as "auth denied".


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1125646 13f79535-47bb-0310-9956-ffa450edef68
parent 14cda2ec

CHANGES

+3 −0
Changes for CHANGES: 3 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -2,6 +2,9 @@ 


Changes with Apache 2.3.13



  *) mod_authnz_ldap: If the LDAP server returns constraint violation,

     don't treat this as an error but as "auth denied". [Stefan Fritsch]



  *) mod_proxy_fcgi|scgi: Add support for "best guess" of PATH_INFO

     for SCGI/FCGI. PR 50880, 50851. [Mark Montague <mark catseye.org>,

     Jim Jagielski]

modules/aaa/mod_authnz_ldap.c

+6 −0
Changes for modules/aaa/mod_authnz_ldap.c: 6 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -567,6 +567,12 @@ start_over: 
#ifdef LDAP_INSUFFICIENT_RIGHTS

                 : (LDAP_INSUFFICIENT_RIGHTS == result) ? AUTH_DENIED

#endif

#endif

#ifdef LDAP_CONSTRAINT_VIOLATION

    /* At least Sun Directory Server sends this if a user is

     * locked. This is not covered by LDAP_SECURITY_ERROR.

     */

                 : (LDAP_CONSTRAINT_VIOLATION == result) ? AUTH_DENIED

#endif

                 : AUTH_GENERAL_ERROR;

    }