diff options
| author | jim-p <jimp@pfsense.org> | 2016-04-07 10:58:38 -0400 |
|---|---|---|
| committer | jim-p <jimp@pfsense.org> | 2016-04-07 10:59:21 -0400 |
| commit | 1dd070515b0ebf1857ce03bfe6a228360b73c273 (patch) | |
| tree | a0da5ab5168b5815ead06bd0b97769fdb6f05c23 /src/etc/inc/auth.inc | |
| parent | 100d0f77fedc6fab2dc6a16eaab45e6f5c7708ce (diff) | |
| download | pfsense-1dd070515b0ebf1857ce03bfe6a228360b73c273.zip pfsense-1dd070515b0ebf1857ce03bfe6a228360b73c273.tar.gz | |
Respect all Class attributes returned by the RADIUS server, not only the last one received. Fixes #6086
Diffstat (limited to 'src/etc/inc/auth.inc')
| -rw-r--r-- | src/etc/inc/auth.inc | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/src/etc/inc/auth.inc b/src/etc/inc/auth.inc index d8dd709..10509a4 100644 --- a/src/etc/inc/auth.inc +++ b/src/etc/inc/auth.inc @@ -1441,8 +1441,15 @@ function radius_backed($username, $passwd, $authcfg, &$attributes = array()) { */ function radius_get_groups($attributes) { $groups = array(); - if (!empty($attributes) && is_array($attributes) && !empty($attributes['class'])) { - $groups = explode(";", $attributes['class']); + if (!empty($attributes) && is_array($attributes) && (!empty($attributes['class']) || !empty($attributes['class_int']))) { + /* Some RADIUS servers return multiple class attributes, so check them all. */ + $groups = array(); + if (!empty($attributes['class']) && is_array($attributes['class'])) { + foreach ($attributes['class'] as $class) { + $groups = array_unique(array_merge($groups, explode(";", $class))); + } + } + foreach ($groups as & $grp) { $grp = trim($grp); if (strtolower(substr($grp, 0, 3)) == "ou=") { |
