Full_Name: Guilhem Moulin Version: 2.4.44 OS: Debian GNU/Linux (Stretch) URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (109.225.112.70) =20 =20 slapd.conf(5) manpage (in both 2.4.44 and in current =E2=80=94 0f320b3 =

mentions that authz-policy's "all" flag requires both source and destin=

authorizations rules to succeed. However if the source rule (the authe=

identity's "authzTo" attribute) fails but the destination rule (the authorization identity's "authzFrom" attribute) succeeds, then the auth=

is granted, violating the intended semantics and possibly yielding unau=

access. See the following log excerpt:

=20 SASL proxy authorize [conn=3D1019]: authcid=3D"authcid" authzid=3D"dn:uid=3Dauthzid,dc=3Dexample,dc=3Dnet" =3D=3D>slap_sasl_authorized: can uid=3Dauthcid,dc=3Dexample,dc=3Dnet be=

uid=3Dauthzid,dc=3Dexample,dc=3Dnet? =3D=3D>slap_sasl_check_authz: does uid=3Dauthzid,dc=3Dexample,dc=3Dnet =

in uid=3Dauthcid,dc=3Dexample,dc=3Dnet? <=3D=3Dslap_sasl_check_authz: authzTo check returning 50 =3D=3D>slap_sasl_check_authz: does uid=3Dauthcid,dc=3Dexample,dc=3Dnet =

rule in uid=3Dauthzid,dc=3Dexample,dc=3Dnet? <=3D=3D=3Dslap_sasl_match: comparison returned 0 <=3D=3Dslap_sasl_check_authz: authzFrom check returning 0 <=3D=3D slap_sasl_authorized: return 0 conn=3D1019 op=3D1 BIND authcid=3D"authcid" authzid=3D"dn:uid=3Dauthzid,dc=3Dexample,dc=3Dnet" SASL Authorize [conn=3D1019]: proxy authorization allowed authzDN=3D"uid=3Dauthzid,dc=3Dexample,dc=3Dnet" =20 AFAICT the problem is in servers/slapd/saslauthz.c:slap_sasl_authorized=

is also present in master. Here is a naive patch that fails the author=

if the source rules doesn't verify and SASL_AUTHZ_AND is set in authz_p=

=20 --- a/servers/slapd/saslauthz.c +++ b/servers/slapd/saslauthz.c @@ -2077,6 +2077,10 @@ int slap_sasl_authorized( Operation *op, if( rc =3D=3D LDAP_SUCCESS && !(authz_policy & SASL_AUTHZ_AND)=

goto DONE; } + else if( rc !=3D LDAP_SUCCESS && (authz_policy & SASL_AUTHZ_AN=

+ rc =3D LDAP_INAPPROPRIATE_AUTH; + goto DONE; + } } =20 /* Check destination rules */ =20 =20