selfhoster1312/llldap
Watch
1
0
Fork
You've already forked llldap
 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

feat: Support case-insensitive LDAP attributes in search

Browse source
This commit is contained in:
selfhoster selfhoster 2026-09-21 15:10:43 +02:00
commit 586faccc7c
3 changed files with 97 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

44
src/ldap/op/search.rs
View file

@ -4,9 +4,11 @@ use ldap3_proto::proto::{
};
use ldap3_proto::{LdapMsg, LdapResultCode};
use std::str::FromStr;
use crate::db::error::BoxedError;
use crate::db::{Database, DatabaseInterface, User};
use crate::ldap::{Dn, LdapReturnError, LdapStream, LdapStreamError, MalformedDn};
use crate::ldap::{Dn, LdapAttribute, LdapReturnError, LdapStream, LdapStreamError, MalformedDn};
#[derive(Debug)]
pub struct InvalidSearchDn {
@ -252,24 +254,36 @@ pub fn user_matches_filter(user: &User, filter: &LdapFilter) -> bool {
false
}
LdapFilter::Not(sub_filter) => !user_matches_filter(user, sub_filter),
LdapFilter::Equality(attr, value) => match attr.as_ref() {
"uid" => user.username == *value,
// TODO: should CN be different than the mail?
"cn" | "mail" | "mailAlias" => user.mail == *value,
// TODO: group membership
"memberof" => false,
"objectClass" => matches!(
value.as_ref(),
"inetOrgPerson" | "posixAccount" | "mailAccount" | "person"
),
_ => {
tracing::warn!("Unknown user attribute filter, considering no match: {attr}");
LdapFilter::Equality(attr, value) => LdapAttribute::from_str(attr).map_or_else(
|e| {
tracing::warn!("Unrecognized attribute, considering no match: {e}");
false
}
},
},
|attr| user_matches_attribute(user, &attr, value),
),
_ => {
tracing::warn!("Unimplemented search filter, considering no match: {filter:?}");
false
}
}
}
// TODO: we want to support group relations here as argument soon
pub fn user_matches_attribute(user: &User, attribute: &LdapAttribute, value: &str) -> bool {
match attribute {
// TODO: should we lowercase the value here?
LdapAttribute::Uid => user.username == *value,
// TODO: should CN be different than the mail?
// TODO: should we lowercase the value here?
LdapAttribute::CommonName | LdapAttribute::Mail | LdapAttribute::MailAlias => {
user.mail == *value
}
// TODO: group membership
LdapAttribute::MemberOf => false,
LdapAttribute::ObjectClass => matches!(
// We lowercase the value here because there's no ambiguity
value.to_lowercase().as_ref(),
"inetorgperson" | "posixaccount" | "mailaccount" | "person"
),
}
}