From: Howard Chu <hyc@openldap.org>
Date: Wed, 19 Jun 2019 11:29:02 +0000 (+0100)
Subject: [PATCH] ITS#9038 restrict rootDN proxyauthz to its own DBs.
X-Git-Tag: archive/raspbian/2.4.47+dfsg-3+rpi1+deb10u3^2~8
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=20c3e77648d6e6d32159dee537a8fe460144933a;p=openldap.git

[PATCH] ITS#9038 restrict rootDN proxyauthz to its own DBs.

Treat as normal user for any other DB.

Gbp-Pq: Name ITS-9038-restrict-rootDN-proxyauthz-to-its-own-DBs.patch
---

diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index d80370ff..06c1e21c 100644
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -2062,12 +2062,13 @@ int slap_sasl_authorized( Operation *op,
 		goto DONE;
 	}
 
-	/* Allow the manager to authorize as any DN. */
-	if( op->o_conn->c_authz_backend &&
-		be_isroot_dn( op->o_conn->c_authz_backend, authcDN ))
+	/* Allow the manager to authorize as any DN in its own DBs. */
 	{
-		rc = LDAP_SUCCESS;
-		goto DONE;
+		Backend *zbe = select_backend( authzDN, 1 );
+		if ( zbe && be_isroot_dn( zbe, authcDN )) {
+			rc = LDAP_SUCCESS;
+			goto DONE;
+		}
 	}
 
 	/* Check source rules */