From 419a8dd8142afef790dafd91ba39afac2ca48aaf Mon Sep 17 00:00:00 2001 From: Andrew Dunstan Date: Wed, 15 Mar 2023 16:37:28 -0400 Subject: Add a hook for modifying the ldapbind password The hook can be installed by a shared_preload library. A similar mechanism could be used for radius paswords, for example, and the type name auth_password_hook_typ has been shosen with that in mind. John Naylor and Andrew Dunstan Discussion: https://postgr.es/m/469b06ed-69de-ba59-c13a-91d2372e52a9@dunslane.net --- src/backend/libpq/auth.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'src/backend/libpq/auth.c') diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index 25b3a781cdc..bc0cf26b122 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -144,6 +144,10 @@ static int CheckLDAPAuth(Port *port); #define LDAP_OPT_DIAGNOSTIC_MESSAGE LDAP_OPT_ERROR_STRING #endif +/* Default LDAP password mutator hook, can be overridden by a shared library */ +static char *dummy_ldap_password_mutator(char *input); +auth_password_hook_typ ldap_password_hook = dummy_ldap_password_mutator; + #endif /* USE_LDAP */ /*---------------------------------------------------------------- @@ -2370,6 +2374,12 @@ InitializeLDAPConnection(Port *port, LDAP **ldap) #define LDAPS_PORT 636 #endif +static char * +dummy_ldap_password_mutator(char *input) +{ + return input; +} + /* * Return a newly allocated C string copied from "pattern" with all * occurrences of the placeholder "$username" replaced with "user_name". @@ -2498,7 +2508,7 @@ CheckLDAPAuth(Port *port) */ r = ldap_simple_bind_s(ldap, port->hba->ldapbinddn ? port->hba->ldapbinddn : "", - port->hba->ldapbindpasswd ? port->hba->ldapbindpasswd : ""); + port->hba->ldapbindpasswd ? ldap_password_hook(port->hba->ldapbindpasswd) : ""); if (r != LDAP_SUCCESS) { ereport(LOG, -- cgit v1.2.3