Update LDAP default config

diff --git a/raddb/mods-available/ldap b/raddb/mods-available/ldap
index a8b73f1..f40c530 100644 (file)
--- a/raddb/mods-available/ldap
+++ b/raddb/mods-available/ldap
@@ -45,26 +45,30 @@ ldap {
        # 
        #  Request and list qualifiers may also be placed after the section
        #  name to set defaults for unqualified RADIUS attributes.
+       #
+       #  Note: LDAP attribute names should be single quoted unless you want
+       #  the name value to be derived from an xlat expansion, or an
+       #  attribute ref.
+       #
        update reply {
-#              control:NT-Password     := ntPassword
-#              Reply-Message           := radiusReplyMessage
-#              Tunnel-Type             := radiusTunnelType
-#              Tunnel-Medium-Type      := radiusTunnelMediumType
-#              Tunnel-Private-Group-ID := radiusTunnelPrivategroupId
+#              control:NT-Password     := 'ntPassword'
+#              Reply-Message           := 'radiusReplyMessage'
+#              Tunnel-Type             := 'radiusTunnelType'
+#              Tunnel-Medium-Type      := 'radiusTunnelMediumType'
+#              Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId'
        }
 
-       # Set to "no" to disable the "no \"known good\" password" warning,
+       # Set to "no" to disable the 'no "known good" password' warning,
        # if you're not using LDAP to retrieve password values.
 #      expect_password = "yes" 
 
        # Set to yes if you have eDirectory and want to use the universal
-       # password mechanism. Add ldap in post-auth to perform account
-       # policy checking
+       # password mechanism.
 #      edir = "no"
 
        # Set to yes if you want to bind as the user after retrieving the
-       # Cleartext-Password to consume the login grace, and verify user
-       # authorization.
+       # Cleartext-Password. This will consume the login grace, and
+       # verify user authorization.
 #      edir_autz = "no"
 
        #
@@ -131,9 +135,9 @@ ldap {
        #                       Note: '=' is *not* supported.
        #       <value>:        The value to add modify or delete.
        #
-       #  WARNING: If using the ':=' operator with a multivalued attribute
-       #  all instances of the attribute will be removed and replaced with
-       #  a single attribute.
+       #  WARNING: If using the ':=' operator with a multivalued LDAP 
+       #  attribute, all instances of the attribute will be removed and
+       #  replaced with a single attribute.
        # 
        accounting {
                reference = "%{tolower:type.%{Acct-Status-Type}}"

diff --git a/src/modules/rlm_cache/rlm_cache.c b/src/modules/rlm_cache/rlm_cache.c
index 4b7b0cb..e049b08 100644 (file)
--- a/src/modules/rlm_cache/rlm_cache.c
+++ b/src/modules/rlm_cache/rlm_cache.c
@@ -419,7 +419,7 @@ static rlm_cache_entry_t *cache_add(rlm_cache_t *inst, REQUEST *request,
                        if (!found) continue;
                        
                        for (vp = found; vp != NULL; vp = vp->next) {
-                               RDEBUG("\t%s%s %s %s%s", map->dst->name,
+                               RDEBUG("\t%s:%s %s %s:%s", map->dst->name,
                                       vp->name,
                                       fr_int2str(fr_tokens, map->op, "¿unknown?"),
                                       map->src->name,
@@ -532,7 +532,6 @@ static int cache_verify(rlm_cache_t *inst, value_pair_map_t **head)
        }
 
        for (map = *head; map != NULL; map = map->next) {
-
                if ((map->dst->type != VPT_TYPE_ATTR) &&
                    (map->dst->type != VPT_TYPE_LIST)) {
                        cf_log_err(map->ci, "Left operand must be an attribute "

diff --git a/src/modules/rlm_ldap/rlm_ldap.c b/src/modules/rlm_ldap/rlm_ldap.c
index 99953d3..7631a5c 100644 (file)
--- a/src/modules/rlm_ldap/rlm_ldap.c
+++ b/src/modules/rlm_ldap/rlm_ldap.c
@@ -1386,7 +1386,7 @@ static int ldap_map_verify(ldap_instance *inst, value_pair_map_t **head)
        }
        /*
         *      Attrmap only performs some basic validation checks, we need
-        *      to do rlm_cache specific checks here.
+        *      to do rlm_ldap specific checks here.
         */
        for (map = *head; map != NULL; map = map->next) {
                if (map->dst->type != VPT_TYPE_ATTR) {