From dbbf162dc9be0aef47f2d1f1fcddb7ae4e074d47 Mon Sep 17 00:00:00 2001 From: Stef Walter Date: Wed, 28 Apr 2004 20:59:48 +0000 Subject: Tons of fixes, debugging, changes, added apache module --- daemon/ldap.c | 219 +++++++++++++++++++++++++++++++++------------------------- 1 file changed, 123 insertions(+), 96 deletions(-) (limited to 'daemon/ldap.c') diff --git a/daemon/ldap.c b/daemon/ldap.c index 9a79d43..a5abd97 100644 --- a/daemon/ldap.c +++ b/daemon/ldap.c @@ -69,24 +69,17 @@ typedef struct ldap_context int port; /* Port to connect to LDAP server on */ int scope; /* Scope for filter */ - const char* realm; /* The realm to use in authentication */ - const char* domains; /* Domains for which digest auth is valid */ - int dobind; /* Bind to do simple authentication */ - int cache_max; /* Maximum number of connections at once */ - int cache_timeout; int ldap_max; /* Number of open connections allowed */ int ldap_timeout; /* Maximum amount of time to dedicate to an ldap query */ + ha_options_t* opts; /* Options from httpauthd.c */ + /* Context ----------------------------------------------------------- */ hash_t* cache; /* Some cached records or basic */ LDAP** pool; /* Pool of available connections */ int pool_mark; /* Amount of connections allocated */ - -#ifdef _DEBUG - const char* debug_nonce; -#endif } ldap_context_t; @@ -104,19 +97,12 @@ static const ldap_context_t ldap_defaults = NULL, /* dnmap */ 389, /* port */ LDAP_SCOPE_SUBTREE, /* scope */ - "", /* realm */ - NULL, /* domains */ 1, /* dobind */ - 1000, /* cache_max */ - 30, /* cache_timeout */ 10, /* ldap_max */ 30, /* ldap_timeout */ NULL, /* cache */ NULL, /* pool */ 0 /* pool_mark */ -#ifdef _DEBUG - , NULL /* debug_nonce */ -#endif }; @@ -134,17 +120,17 @@ static int report_ldap(const char* msg, int code) { ASSERT(code != LDAP_SUCCESS); - if(!msg) - msg = "ldap error"; - - ha_messagex(LOG_ERR, "%s: %s", msg, ldap_err2string(code)); - switch(code) { case LDAP_NO_MEMORY: + ha_messagex(LOG_CRIT, "out of memory"); return HA_CRITERROR; default: + if(!msg) + msg = "error"; + + ha_messagex(LOG_ERR, "ldap: %s: %s", msg, ldap_err2string(code)); return HA_FAILED; }; } @@ -155,7 +141,7 @@ static digest_record_t* get_cached_digest(ldap_context_t* ctx, unsigned char* no ASSERT(ctx && nonce); - if(ctx->cache_max == 0) + if(ctx->opts->cache_max == 0) return NULL; ha_lock(NULL); @@ -193,7 +179,7 @@ static int save_cached_digest(ldap_context_t* ctx, digest_record_t* rec) ASSERT(ctx && rec); - if(ctx->cache_max == 0) + if(ctx->opts->cache_max == 0) { free_hash_object(NULL, rec); return HA_FALSE; @@ -201,7 +187,7 @@ static int save_cached_digest(ldap_context_t* ctx, digest_record_t* rec) ha_lock(NULL); - while(hash_count(ctx->cache) >= ctx->cache_max) + while(hash_count(ctx->cache) >= ctx->opts->cache_max) hash_bump(ctx->cache); r = hash_set(ctx->cache, rec->nonce, rec); @@ -223,12 +209,12 @@ static int add_cached_basic(ldap_context_t* ctx, unsigned char* key) ASSERT(ctx && key); - if(ctx->cache_max == 0) + if(ctx->opts->cache_max == 0) return HA_FALSE; ha_lock(NULL); - while(hash_count(ctx->cache) >= ctx->cache_max) + while(hash_count(ctx->cache) >= ctx->opts->cache_max) hash_bump(ctx->cache); r = hash_set(ctx->cache, key, BASIC_ESTABLISHED); @@ -279,7 +265,7 @@ static const char* substitute_params(ldap_context_t* ctx, ha_buffer_t* buf, case 'r': ha_bufjoin(buf); - ha_bufcpy(buf, ctx->realm); + ha_bufcpy(buf, ctx->opts->realm); t++; break; @@ -388,6 +374,7 @@ static int parse_ldap_ha1(ha_buffer_t* buf, struct berval* bv, unsigned char* ha /* Raw binary */ if(bv->bv_len == MD5_LEN) { + ha_messagex(LOG_DEBUG, "ldap: found ha1 in raw binary format"); memcpy(ha1, bv->bv_val, MD5_LEN); return HA_OK; } @@ -400,6 +387,7 @@ static int parse_ldap_ha1(ha_buffer_t* buf, struct berval* bv, unsigned char* ha if(d && len == MD5_LEN) { + ha_messagex(LOG_DEBUG, "ldap: found ha1 in hex encoded format"); memcpy(ha1, d, MD5_LEN); return HA_OK; } @@ -413,6 +401,7 @@ static int parse_ldap_ha1(ha_buffer_t* buf, struct berval* bv, unsigned char* ha if(d && len == MD5_LEN) { + ha_messagex(LOG_DEBUG, "ldap: found ha1 in b64 encoded format"); memcpy(ha1, ha_bufdata(buf), MD5_LEN); return HA_OK; } @@ -483,6 +472,7 @@ static int validate_ldap_password(ldap_context_t* ctx, LDAP* ld, LDAPMessage* en if(strcmp(pw, p) == 0) { + ha_messagex(LOG_DEBUG, "ldap: successful validate against password"); res = HA_OK; break; } @@ -492,7 +482,7 @@ static int validate_ldap_password(ldap_context_t* ctx, LDAP* ld, LDAPMessage* en } if(res == HA_FALSE && unknown) - ha_messagex(LOG_ERR, "LDAP does not contain any compatible passwords for user: %s", user); + ha_messagex(LOG_ERR, "ldap: server does not contain any compatible passwords for user: %s", user); return res; } @@ -516,7 +506,7 @@ static int validate_ldap_ha1(ldap_context_t* ctx, LDAP* ld, LDAPMessage* entry, if(ha1s) { - digest_makeha1(key, user, ctx->realm, clearpw); + digest_makeha1(key, user, ctx->opts->realm, clearpw); for(b = ha1s ; *b; b++) { @@ -530,7 +520,7 @@ static int validate_ldap_ha1(ldap_context_t* ctx, LDAP* ld, LDAPMessage* entry, if(r == HA_FALSE) { if(first) - ha_messagex(LOG_ERR, "LDAP contains invalid HA1 digest hash for user: %s", user); + ha_messagex(LOG_ERR, "ldap: server contains invalid HA1 digest hash for user: %s", user); first = 0; continue; @@ -538,6 +528,7 @@ static int validate_ldap_ha1(ldap_context_t* ctx, LDAP* ld, LDAPMessage* entry, if(memcmp(key, k, MD5_LEN) == 0) { + ha_messagex(LOG_DEBUG, "ldap: successful validate against ha1"); res = HA_OK; break; } @@ -561,6 +552,7 @@ static LDAP* get_ldap_connection(ldap_context_t* ctx) /* An open connection in the pool */ if(ctx->pool[i]) { + ha_messagex(LOG_DEBUG, "ldap: using cached connection"); ld = ctx->pool[i]; ctx->pool[i] = NULL; return ld; @@ -569,14 +561,14 @@ static LDAP* get_ldap_connection(ldap_context_t* ctx) if(ctx->pool_mark >= ctx->ldap_max) { - ha_messagex(LOG_ERR, "too many open connections to LDAP"); + ha_messagex(LOG_ERR, "ldap: too many open connections"); return NULL; } ld = ldap_init(ctx->servers, ctx->port); if(!ld) { - ha_message(LOG_ERR, "couldn't initialize ldap connection"); + ha_message(LOG_ERR, "ldap: couldn't initialize connection"); return NULL; } @@ -586,13 +578,14 @@ static LDAP* get_ldap_connection(ldap_context_t* ctx) ctx->password ? ctx->password : ""); if(r != LDAP_SUCCESS) { - report_ldap("couldn't bind to LDAP server", r); + report_ldap("ldap: couldn't bind to LDAP server", r); ldap_unbind_s(ld); return NULL; } } ctx->pool_mark++; + ha_messagex(LOG_DEBUG, "ldap: opened new connection (total %d)", ctx->pool_mark); return ld; } @@ -621,6 +614,7 @@ static void save_ldap_connection(ldap_context_t* ctx, LDAP* ld) /* An open connection in the pool */ if(!ctx->pool[i]) { + ha_messagex(LOG_DEBUG, "ldap: caching connection for later use"); ctx->pool[i] = ld; ld = NULL; break; @@ -634,6 +628,7 @@ static void save_ldap_connection(ldap_context_t* ctx, LDAP* ld) { ldap_unbind_s(ld); ctx->pool_mark--; + ha_messagex(LOG_DEBUG, "ldap: discarding connection (total %d)", ctx->pool_mark); } } @@ -644,6 +639,8 @@ static int retrieve_user_entry(ldap_context_t* ctx, ha_buffer_t* buf, LDAP* ld, struct timeval tv; const char* filter; const char* attrs[3]; + const char* base; + int scope; int r; ASSERT(ctx && buf && ld && user && dn && entry && result); @@ -667,15 +664,19 @@ static int retrieve_user_entry(ldap_context_t* ctx, ha_buffer_t* buf, LDAP* ld, tv.tv_sec = ctx->ldap_timeout; tv.tv_usec = 0; - r = ldap_search_st(ld, *dn ? *dn : ctx->base, - *dn ? LDAP_SCOPE_BASE : ctx->scope, - filter, (char**)attrs, 0, &tv, result); + base = *dn ? *dn : ctx->base; + scope = *dn ? LDAP_SCOPE_BASE : ctx->scope; + + ha_messagex(LOG_DEBUG, "ldap: performing search: [ base: %s / scope: %d / filter: %s ]", + base, scope, filter); + + r = ldap_search_st(ld, base, scope, filter, (char**)attrs, 0, &tv, result); if(r != LDAP_SUCCESS) { if(r == LDAP_NO_SUCH_OBJECT) { - ha_messagex(LOG_WARNING, "user not found in LDAP: %s", user); + ha_messagex(LOG_WARNING, "ldap: user not found in LDAP: %s", user); return HA_FALSE; } @@ -689,15 +690,18 @@ static int retrieve_user_entry(ldap_context_t* ctx, ha_buffer_t* buf, LDAP* ld, case 1: *entry = ldap_first_entry(ld, *result); if(!(*dn)) + { *dn = ldap_get_dn(ld, *entry); + ha_messagex(LOG_DEBUG, "ldap: found entry for user: %s", *dn); + } return HA_OK; case 0: - ha_messagex(LOG_WARNING, "user not found in LDAP: %s", user); + ha_messagex(LOG_WARNING, "ldap: user not found in LDAP: %s", user); break; default: - ha_messagex(LOG_WARNING, "more than one user found for filter: %s", filter); + ha_messagex(LOG_WARNING, "ldap: more than one user found for filter: %s", filter); break; }; @@ -739,6 +743,8 @@ static int complete_digest_ha1(ldap_context_t* ctx, digest_record_t* rec, ret = HA_CRITERROR; goto finally; } + + ha_messagex(LOG_INFO, "ldap: mapped %s to %s", user, dn); } /* Okay now we contact the LDAP server. */ @@ -761,10 +767,11 @@ static int complete_digest_ha1(ldap_context_t* ctx, digest_record_t* rec, if(ret != HA_OK) { if(ret == HA_FALSE) - ha_messagex(LOG_ERR, "LDAP contains invalid HA1 digest hash for user: %s", user); + ha_messagex(LOG_ERR, "ldap: server contains invalid HA1 for user: %s", user); } } + ha_messagex(LOG_DEBUG, "ldap: using HA1 from ldap"); ldap_value_free_len(ha1s); goto finally; } @@ -779,17 +786,20 @@ static int complete_digest_ha1(ldap_context_t* ctx, digest_record_t* rec, if(t) { - digest_makeha1(rec->ha1, user, ctx->realm, t); + digest_makeha1(rec->ha1, user, ctx->opts->realm, t); ret = HA_OK; } ldap_value_free(pws); if(ret == HA_OK) + { + ha_messagex(LOG_DEBUG, "ldap: using clear password from ldap"); goto finally; + } } - ha_messagex(LOG_ERR, "LDAP contains no cleartext password for user: %s", user); + ha_messagex(LOG_ERR, "ldap: server contains no clear password or HA1 for user: %s", user); finally: @@ -824,6 +834,8 @@ static int basic_ldap_response(ldap_context_t* ctx, const char* header, /* Check and see if this connection is in the cache */ if(have_cached_basic(ctx, basic.key)) { + ha_messagex(LOG_NOTICE, "ldap: validated basic user against cache: %s", + basic.user); found = 1; ret = HA_OK; goto finally; @@ -832,7 +844,10 @@ static int basic_ldap_response(ldap_context_t* ctx, const char* header, /* If we have a user name and password */ if(!basic.user || !basic.user[0] || !basic.password || !basic.password[0]) + { + ha_messagex(LOG_NOTICE, "ldap: no valid basic auth info"); goto finally; + } ld = get_ldap_connection(ctx); @@ -857,6 +872,8 @@ static int basic_ldap_response(ldap_context_t* ctx, const char* header, ret = HA_CRITERROR; goto finally; } + + ha_messagex(LOG_INFO, "ldap: mapped %s to %s", basic.user, dn); } @@ -895,7 +912,9 @@ static int basic_ldap_response(ldap_context_t* ctx, const char* header, if(r != LDAP_SUCCESS) { if(r == LDAP_INVALID_CREDENTIALS) - ha_messagex(LOG_WARNING, "invalid login for: %s", basic.user); + ha_messagex(LOG_WARNING, "ldap: basic authentication (via bind) failed for user: %s", + basic.user); + else report_ldap("couldn't bind to LDAP server", r); @@ -903,6 +922,7 @@ static int basic_ldap_response(ldap_context_t* ctx, const char* header, } /* It worked! */ + ha_messagex(LOG_NOTICE, "ldap: validated basic user using bind: %s", basic.user); found = 1; } @@ -915,10 +935,15 @@ static int basic_ldap_response(ldap_context_t* ctx, const char* header, ret = validate_ldap_ha1(ctx, ld, entry, buf, basic.user, basic.password); if(ret == HA_OK) + { + ha_messagex(LOG_NOTICE, "ldap: validated basic user password/ha1: %s", basic.user); found = 1; + } else - ha_messagex(LOG_WARNING, "invalid, unreadable or unrecognized password for user: %s", basic.user); + { + ha_messagex(LOG_WARNING, "ldap: invalid, unreadable or unrecognized password for user: %s", basic.user); + } } @@ -952,10 +977,10 @@ static int digest_ldap_challenge(ldap_context_t* ctx, ha_response_t* resp, ASSERT(ctx && resp && buf); #ifdef _DEBUG - if(ctx->debug_nonce) + if(ctx->opts->digest_debugnonce) { - nonce_str = ctx->debug_nonce; - ha_messagex(LOG_WARNING, "using debug nonce. security non-existant."); + nonce_str = ctx->opts->digest_debugnonce; + ha_messagex(LOG_WARNING, "simple: using debug nonce. security non-existant."); } else #endif @@ -969,7 +994,8 @@ static int digest_ldap_challenge(ldap_context_t* ctx, ha_response_t* resp, } /* Now generate a message to send */ - header = digest_challenge(buf, nonce_str, ctx->realm, ctx->domains, stale); + header = digest_challenge(buf, nonce_str, ctx->opts->realm, + ctx->opts->digest_domains, stale); if(!header) return HA_CRITERROR; @@ -978,6 +1004,7 @@ static int digest_ldap_challenge(ldap_context_t* ctx, ha_response_t* resp, resp->code = HA_SERVER_DECLINE; ha_addheader(resp, "WWW-Authenticate", header); + ha_messagex(LOG_DEBUG, "ldap: created digest challenge with nonce: %s", nonce_str); return HA_OK; } @@ -1003,18 +1030,18 @@ static int digest_ldap_response(ldap_context_t* ctx, const char* header, return r; #ifdef _DEBUG - if(ctx->debug_nonce) + if(ctx->opts->digest_debugnonce) { - if(dg.nonce && strcmp(dg.nonce, ctx->debug_nonce) != 0) + if(dg.nonce && strcmp(dg.nonce, ctx->opts->digest_debugnonce) != 0) { ret = HA_FALSE; resp->code = HA_SERVER_BADREQ; - ha_messagex(LOG_WARNING, "digest response contains invalid nonce"); + ha_messagex(LOG_WARNING, "ldap: digest response contains invalid nonce"); goto finally; } /* Do a rough hash into the real nonce, for use as a key */ - md5_string(nonce, ctx->debug_nonce); + md5_string(nonce, ctx->opts->digest_debugnonce); /* Debug nonce's never expire */ expiry = time(NULL); @@ -1028,25 +1055,29 @@ static int digest_ldap_response(ldap_context_t* ctx, const char* header, if(r == HA_FALSE) { resp->code = HA_SERVER_BADREQ; - ha_messagex(LOG_WARNING, "digest response contains invalid nonce"); + ha_messagex(LOG_WARNING, "ldap: digest response contains invalid nonce"); } goto finally; } } - rec = get_cached_digest(ctx, nonce); /* Check to see if we're stale */ - if((expiry + ctx->cache_timeout) <= time(NULL)) + if((expiry + ctx->opts->cache_timeout) <= time(NULL)) { + ha_messagex(LOG_INFO, "ldap: nonce expired, sending stale challenge: %s", + dg.username); + stale = 1; goto finally; } if(!rec) { + ha_messagex(LOG_INFO, "ldap: no record in cache, creating one: %s", dg.username); + /* * If we're valid but don't have a record in the * cache then complete the record properly. @@ -1070,7 +1101,8 @@ static int digest_ldap_response(ldap_context_t* ctx, const char* header, /* Increment our nonce count */ rec->nc++; - ret = digest_check(ctx->realm, method, uri, buf, &dg, rec); + ret = digest_check(ctx->opts->realm, method, + ctx->opts->digest_ignoreuri ? NULL : uri, buf, &dg, rec); if(ret == HA_BADREQ) { @@ -1084,8 +1116,12 @@ static int digest_ldap_response(ldap_context_t* ctx, const char* header, resp->detail = dg.username; /* Figure out if we need a new nonce */ - if((expiry + (ctx->cache_timeout - (ctx->cache_timeout / 8))) < time(NULL)) + if((expiry + (ctx->opts->cache_timeout - + (ctx->opts->cache_timeout / 8))) < time(NULL)) { + ha_messagex(LOG_INFO, "ldap: nonce almost expired, creating new one: %s", + dg.username); + digest_makenonce(nonce, g_ldap_secret, NULL); stale = 1; } @@ -1100,6 +1136,8 @@ static int digest_ldap_response(ldap_context_t* ctx, const char* header, if(t[0]) ha_addheader(resp, "Authentication-Info", t); + ha_messagex(LOG_NOTICE, "ldap: validated digest user: %s", dg.username); + /* Put the connection into the cache */ if((r = save_cached_digest(ctx, rec)) < 0) ret = r; @@ -1179,18 +1217,6 @@ int ldap_config(ha_context_t* context, const char* name, const char* value) return HA_OK; } - else if(strcmp(name, "realm") == 0) - { - ctx->realm = value; - return HA_OK; - } - - else if(strcmp(name, "digestdomains") == 0) - { - ctx->domains = value; - return HA_OK; - } - else if(strcmp(name, "ldapscope") == 0) { if(strcmp(value, "sub") == 0 || strcmp(value, "subtree") == 0) @@ -1224,14 +1250,6 @@ int ldap_config(ha_context_t* context, const char* name, const char* value) return ha_confint(name, value, 0, 86400, &(ctx->ldap_timeout)); } -#ifdef _DEBUG - else if(strcmp(name, "digestdebugnonce") == 0) - { - ctx->debug_nonce = value; - return HA_OK; - } -#endif - return HA_FALSE; } @@ -1240,6 +1258,7 @@ int ldap_inithand(ha_context_t* context) /* Global initialization */ if(!context) { + ha_messagex(LOG_DEBUG, "ldap: generating secret"); return ha_genrandom(g_ldap_secret, DIGEST_SECRET_LEN); } @@ -1252,9 +1271,9 @@ int ldap_inithand(ha_context_t* context) ASSERT(ctx); /* Make sure there are some types of authentication we can do */ - if(!(context->types & (HA_TYPE_BASIC | HA_TYPE_DIGEST))) + if(!(context->opts.types & (HA_TYPE_BASIC | HA_TYPE_DIGEST))) { - ha_messagex(LOG_ERR, "LDAP module configured, but does not implement any " + ha_messagex(LOG_ERR, "ldap: module configured, but does not implement any " "configured authentication type."); return HA_FAILED; } @@ -1262,14 +1281,14 @@ int ldap_inithand(ha_context_t* context) /* Check for mandatory configuration */ if(!ctx->servers) { - ha_messagex(LOG_ERR, "LDAP configuration incomplete. " + ha_messagex(LOG_ERR, "ldap: configuration incomplete. " "Must have LDAPServers."); return HA_FAILED; } if(!ctx->dnmap && (!ctx->filter || !ctx->base)) { - ha_messagex(LOG_ERR, "LDAP configuration incomplete. " + ha_messagex(LOG_ERR, "ldap: configuration incomplete. " "When not using LDAPDNMap must specify LDAPBase and LDAPFilter."); return HA_FAILED; } @@ -1299,8 +1318,9 @@ int ldap_inithand(ha_context_t* context) memset(ctx->pool, 0, sizeof(LDAP*) * ctx->ldap_max); /* Copy some settings over for easy access */ - ctx->cache_max = context->cache_max; - ctx->cache_timeout = context->cache_timeout; + ctx->opts = &(context->opts); + + ha_messagex(LOG_INFO, "ldap: initialized handler"); } return HA_OK; @@ -1333,6 +1353,8 @@ void ldap_destroy(ha_context_t* context) /* And free the connection pool */ free(ctx->pool); } + + ha_messagex(LOG_INFO, "ldap: uninitialized handler"); } int ldap_process(ha_context_t* context, ha_request_t* req, @@ -1341,7 +1363,7 @@ int ldap_process(ha_context_t* context, ha_request_t* req, ldap_context_t* ctx = (ldap_context_t*)context->data; time_t t = time(NULL); const char* header = NULL; - int ret; + int ret, r; ASSERT(req && resp && buf); ASSERT(req->args[AUTH_ARG_METHOD]); @@ -1350,21 +1372,24 @@ int ldap_process(ha_context_t* context, ha_request_t* req, ha_lock(NULL); /* Purge out stale connection stuff. */ - hash_purge(ctx->cache, t - ctx->cache_timeout); + r = hash_purge(ctx->cache, t - ctx->opts->cache_timeout); ha_unlock(NULL); + if(r > 0) + ha_messagex(LOG_DEBUG, "ldap: purged cache records: %d", r); /* We use this below to detect whether to send a default response */ resp->code = -1; /* Check the headers and see if we got a response thingy */ - if(context->types & HA_TYPE_DIGEST) + if(context->opts.types & HA_TYPE_DIGEST) { header = ha_getheader(req, "Authorization", HA_PREFIX_DIGEST); if(header) { + ha_messagex(LOG_DEBUG, "ldap: processing basic auth header"); ret = digest_ldap_response(ctx, header, req->args[AUTH_ARG_METHOD], req->args[AUTH_ARG_URI], resp, buf); if(ret < 0) @@ -1373,11 +1398,12 @@ int ldap_process(ha_context_t* context, ha_request_t* req, } /* Or a basic authentication */ - if(!header && context->types & HA_TYPE_BASIC) + if(!header && context->opts.types & HA_TYPE_BASIC) { header = ha_getheader(req, "Authorization", HA_PREFIX_BASIC); if(header) { + ha_messagex(LOG_DEBUG, "ldap: processing digest auth header"); ret = basic_ldap_response(ctx, header, resp, buf); if(ret < 0) return ret; @@ -1390,21 +1416,22 @@ int ldap_process(ha_context_t* context, ha_request_t* req, { resp->code = HA_SERVER_DECLINE; - if(context->types & HA_TYPE_DIGEST) - { - ret = digest_ldap_challenge(ctx, resp, buf, 0); - if(ret < 0) - return ret; - } - - if(context->types & HA_TYPE_BASIC) + if(context->opts.types & HA_TYPE_BASIC) { - ha_bufmcat(buf, "BASIC realm=\"", ctx->realm , "\"", NULL); + ha_bufmcat(buf, "BASIC realm=\"", ctx->opts->realm , "\"", NULL); if(ha_buferr(buf)) return HA_CRITERROR; ha_addheader(resp, "WWW-Authenticate", ha_bufdata(buf)); + ha_messagex(LOG_DEBUG, "ldap: sent basic auth request"); + } + + if(context->opts.types & HA_TYPE_DIGEST) + { + ret = digest_ldap_challenge(ctx, resp, buf, 0); + if(ret < 0) + return ret; } } -- cgit v1.2.3