diff options
| author | Andrew Dunstan <andrew@dunslane.net> | 2023-03-15 16:37:28 -0400 |
|---|---|---|
| committer | Andrew Dunstan <andrew@dunslane.net> | 2023-03-15 16:37:28 -0400 |
| commit | 419a8dd8142afef790dafd91ba39afac2ca48aaf (patch) | |
| tree | aa4e854f657f52a0a02ac1092c63533f33db659c /src/backend/libpq/auth.c | |
| parent | e3ac85014eb280ee2e82b36dc3be1b62c838b3e4 (diff) | |
| download | postgresql-419a8dd8142afef790dafd91ba39afac2ca48aaf.tar.gz postgresql-419a8dd8142afef790dafd91ba39afac2ca48aaf.zip | |
Add a hook for modifying the ldapbind password
The hook can be installed by a shared_preload library.
A similar mechanism could be used for radius paswords, for example, and
the type name auth_password_hook_typ has been shosen with that in mind.
John Naylor and Andrew Dunstan
Discussion: https://postgr.es/m/469b06ed-69de-ba59-c13a-91d2372e52a9@dunslane.net
Diffstat (limited to 'src/backend/libpq/auth.c')
| -rw-r--r-- | src/backend/libpq/auth.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index 25b3a781cdc..bc0cf26b122 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -144,6 +144,10 @@ static int CheckLDAPAuth(Port *port); #define LDAP_OPT_DIAGNOSTIC_MESSAGE LDAP_OPT_ERROR_STRING #endif +/* Default LDAP password mutator hook, can be overridden by a shared library */ +static char *dummy_ldap_password_mutator(char *input); +auth_password_hook_typ ldap_password_hook = dummy_ldap_password_mutator; + #endif /* USE_LDAP */ /*---------------------------------------------------------------- @@ -2370,6 +2374,12 @@ InitializeLDAPConnection(Port *port, LDAP **ldap) #define LDAPS_PORT 636 #endif +static char * +dummy_ldap_password_mutator(char *input) +{ + return input; +} + /* * Return a newly allocated C string copied from "pattern" with all * occurrences of the placeholder "$username" replaced with "user_name". @@ -2498,7 +2508,7 @@ CheckLDAPAuth(Port *port) */ r = ldap_simple_bind_s(ldap, port->hba->ldapbinddn ? port->hba->ldapbinddn : "", - port->hba->ldapbindpasswd ? port->hba->ldapbindpasswd : ""); + port->hba->ldapbindpasswd ? ldap_password_hook(port->hba->ldapbindpasswd) : ""); if (r != LDAP_SUCCESS) { ereport(LOG, |