From 3934dd704f33c20955b152b6bee1a330d10335b4 Mon Sep 17 00:00:00 2001
From: Graham Leggett <minfrin@apache.org>
Date: Fri, 21 May 2004 03:14:06 +0000
Subject: [PATCH] Quotes cannot be used around require group and require dn
 directives, update the documentation to reflect this. Also add quotes around
 the dn and group within debug messages, to make it more obvious why
 authentication is failing if quotes are used in error. PR: 19304 Obtained
 from: Submitted by: Reviewed by:

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@103711 13f79535-47bb-0310-9956-ffa450edef68
---
 CHANGES                              |  6 ++++++
 docs/manual/mod/mod_auth_ldap.xml    | 24 +++++++++++++-----------
 modules/experimental/mod_auth_ldap.c | 10 +++++-----
 3 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/CHANGES b/CHANGES
index c2f844a4bd..4fda184dca 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,12 @@ Changes with Apache 2.1.0-dev
 
   [Remove entries to the current 2.0 section below, when backported]
 
+  *) Quotes cannot be used around require group and require dn
+     directives, update the documentation to reflect this. Also add
+     quotes around the dn and group within debug messages, to make it
+     more obvious why authentication is failing if quotes are used in
+     error. PR 19304 [Graham Leggett]
+
   *) The Microsoft LDAP SDK escapes filters for us, stop util_ldap
      from escaping filters twice when the backslash character is used.
      PR 24437 [Jess Holle <jessh@ptc.com>]
diff --git a/docs/manual/mod/mod_auth_ldap.xml b/docs/manual/mod/mod_auth_ldap.xml
index 92418c1b98..d7959ba0d1 100644
--- a/docs/manual/mod/mod_auth_ldap.xml
+++ b/docs/manual/mod/mod_auth_ldap.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <!DOCTYPE modulesynopsis SYSTEM "../style/modulesynopsis.dtd">
 <?xml-stylesheet type="text/xsl" href="../style/manual.en.xsl"?>
-<!-- $Revision: 1.17 $ -->
+<!-- $Revision: 1.18 $ -->
 
 <!--
  Copyright 2002-2004 The Apache Software Foundation
@@ -297,7 +297,8 @@ require user "Joe Manager"<br />
 
     <p>This directive specifies an LDAP group whose members are
     allowed access. It takes the distinguished name of the LDAP
-    group. For example, assume that the following entry existed in
+    group. Note: Do not surround the group name with quotes.
+    For example, assume that the following entry existed in
     the LDAP directory:</p>
 <example>
 dn: cn=Administrators, o=Airius<br />
@@ -308,7 +309,7 @@ uniqueMember: cn=Fred User, o=Airius<br />
 
     <p>The following directive would grant access to both Fred and
     Barbara:</p>
-<example>require group "cn=Administrators, o=Airius"</example>
+<example>require group cn=Administrators, o=Airius</example>
 
     <p>Behavior of this directive is modified by the <directive
     module="mod_auth_ldap">AuthLDAPGroupAttribute</directive> and
@@ -324,11 +325,12 @@ uniqueMember: cn=Fred User, o=Airius<br />
     that must match for access to be granted. If the distinguished
     name that was retrieved from the directory server matches the
     distinguished name in the <code>require dn</code>, then
-    authorization is granted.</p>
+    authorization is granted. Note: do not surround the distinguished
+    name with quotes.</p>
 
     <p>The following directive would grant access to a specific
     DN:</p>
-<example>require dn "cn=Barbara Jenson, o=Airius"</example>
+<example>require dn cn=Barbara Jenson, o=Airius</example>
 
     <p>Behavior of this directive is modified by the <directive
     module="mod_auth_ldap">AuthLDAPCompareDNOnServer</directive>
@@ -343,7 +345,7 @@ uniqueMember: cn=Fred User, o=Airius<br />
         Grant access to anyone who exists in the LDAP directory,
         using their UID for searches. 
 <example>
-AuthLDAPURL "ldap://ldap1.airius.com:389/ou=People, o=Airius?uid?sub?(objectClass=*)"<br />
+AuthLDAPURL ldap://ldap1.airius.com:389/ou=People, o=Airius?uid?sub?(objectClass=*)<br />
 require valid-user
 </example>
       </li>
@@ -352,7 +354,7 @@ require valid-user
         The next example is the same as above; but with the fields
         that have useful defaults omitted. Also, note the use of a
         redundant LDAP server. 
-<example>AuthLDAPURL "ldap://ldap1.airius.com ldap2.airius.com/ou=People, o=Airius"<br />
+<example>AuthLDAPURL ldap://ldap1.airius.com ldap2.airius.com/ou=People, o=Airius<br />
 require valid-user
 </example>
       </li>
@@ -367,7 +369,7 @@ require valid-user
         choose an attribute that is guaranteed unique in your
         directory, such as <code>uid</code>. 
 <example>
-AuthLDAPURL "ldap://ldap.airius.com/ou=People, o=Airius?cn"<br />
+AuthLDAPURL ldap://ldap.airius.com/ou=People, o=Airius?cn<br />
 require valid-user
 </example>
       </li>
@@ -376,7 +378,7 @@ require valid-user
         Grant access to anybody in the Administrators group. The
         users must authenticate using their UID. 
 <example>
-AuthLDAPURL "ldap://ldap.airius.com/o=Airius?uid"<br />
+AuthLDAPURL ldap://ldap.airius.com/o=Airius?uid<br />
 require group cn=Administrators, o=Airius
 </example>
       </li>
@@ -388,7 +390,7 @@ require group cn=Administrators, o=Airius
         only to people (authenticated via their UID) who have
         alphanumeric pagers: 
 <example>
-AuthLDAPURL "ldap://ldap.airius.com/o=Airius?uid??(qpagePagerID=*)"<br />
+AuthLDAPURL ldap://ldap.airius.com/o=Airius?uid??(qpagePagerID=*)<br />
 require valid-user
 </example>
       </li>
@@ -404,7 +406,7 @@ require valid-user
         have a pager, but does need to access the same
         resource:</p>
 <example>
-AuthLDAPURL "ldap://ldap.airius.com/o=Airius?uid??(|(qpagePagerID=*)(uid=jmanager))"<br />
+AuthLDAPURL ldap://ldap.airius.com/o=Airius?uid??(|(qpagePagerID=*)(uid=jmanager))<br />
 require valid-user
 </example>
 
diff --git a/modules/experimental/mod_auth_ldap.c b/modules/experimental/mod_auth_ldap.c
index d6a6489c9a..dc5cc929b4 100644
--- a/modules/experimental/mod_auth_ldap.c
+++ b/modules/experimental/mod_auth_ldap.c
@@ -573,8 +573,8 @@ int mod_auth_ldap_auth_checker(request_rec *r)
                 default: {
                     ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r, 
                                   "[%d] auth_ldap authorise: "
-                                  "require dn: LDAP error [%s][%s]",
-                                  getpid(), ldc->reason, ldap_err2string(result));
+                                  "require dn \"%s\": LDAP error [%s][%s]",
+                                  getpid(), t, ldc->reason, ldap_err2string(result));
                 }
             }
         }
@@ -599,7 +599,7 @@ int mod_auth_ldap_auth_checker(request_rec *r)
             }
 
             ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r, 
-                          "[%d] auth_ldap authorise: require group: testing for group membership in `%s'", 
+                          "[%d] auth_ldap authorise: require group: testing for group membership in \"%s\"", 
 		          getpid(), t);
 
             for (i = 0; i < sec->groupattr->nelts; i++) {
@@ -619,9 +619,9 @@ int mod_auth_ldap_auth_checker(request_rec *r)
                     }
                     default: {
                         ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r, 
-                                      "[%d] auth_ldap authorise: require group: "
+                                      "[%d] auth_ldap authorise: require group \"%s\": "
                                       "authorisation failed [%s][%s]",
-                                      getpid(), ldc->reason, ldap_err2string(result));
+                                      getpid(), t, ldc->reason, ldap_err2string(result));
                     }
                 }
             }
-- 
2.50.1