diff options
Diffstat (limited to 'util/sasl_cyrus.lua')
| -rw-r--r-- | util/sasl_cyrus.lua | 36 |
1 files changed, 23 insertions, 13 deletions
diff --git a/util/sasl_cyrus.lua b/util/sasl_cyrus.lua index 57c6ba3c..b5f505eb 100644 --- a/util/sasl_cyrus.lua +++ b/util/sasl_cyrus.lua @@ -39,24 +39,37 @@ local function init(service_name) if st then initialized = true; else - log("error", "Failed to initialize CyrusSASL: %s", errmsg); + log("error", "Failed to initialize Cyrus SASL: %s", errmsg); end end end -- create a new SASL object which can be used to authenticate clients -function new(realm, service_name) +function new(realm, service_name, app_name) local sasl_i = {}; - init(service_name); + init(app_name or service_name); sasl_i.realm = realm; sasl_i.service_name = service_name; - sasl_i.cyrus = cyrussasl.server_new(service_name, nil, nil, nil, nil) - if sasl_i.cyrus == 0 then - log("error", "got NULL return value from server_new") + + local st, ret = pcall(cyrussasl.server_new, service_name, nil, realm, nil, nil) + if st then + sasl_i.cyrus = ret; + else + log("error", "Creating SASL server connection failed: %s", ret); return nil; end + + if cyrussasl.set_canon_cb then + local c14n_cb = function (user) + local node = s_match(user, "^([^@]+)"); + log("debug", "Canonicalizing username %s to %s", user, node) + return node + end + cyrussasl.set_canon_cb(sasl_i.cyrus, c14n_cb); + end + cyrussasl.setssf(sasl_i.cyrus, 0, 0xffffffff) local s = setmetatable(sasl_i, method); return s; @@ -69,7 +82,7 @@ end -- set the forbidden mechanisms function method:forbidden( restrict ) - log("debug", "Called method:forbidden. NOT IMPLEMENTED.") + log("warn", "Called method:forbidden. NOT IMPLEMENTED.") return {} end @@ -87,6 +100,7 @@ end -- select a mechanism to use function method:select(mechanism) self.mechanism = mechanism; + if not self.mechs then self:mechanisms(); end return self.mechs[mechanism]; end @@ -109,16 +123,12 @@ function method:process(message) return "challenge", data elseif (err == -4) then -- SASL_NOMECH log("debug", "SASL mechanism not available from remote end") - return "failure", - "undefined-condition", - "SASL mechanism not available" + return "failure", "invalid-mechanism", "SASL mechanism not available" elseif (err == -13) then -- SASL_BADAUTH return "failure", "not-authorized", cyrussasl.get_message( self.cyrus ) else log("debug", "Got SASL error condition %d", err) - return "failure", - "undefined-condition", - cyrussasl.get_message( self.cyrus ) + return "failure", "undefined-condition", cyrussasl.get_message( self.cyrus ) end end |