BUG#366: only request attributes actually used

2 files changed, 17 insertions, 1 deletions

diff --git a/ChangeLog b/ChangeLog
index 6de8d28..49cd63b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,8 @@ $Id$
 	* fix for BUG#232: LDAP write on userPassword fails
 	  when chasing referral and cached policy error is
 	  POLICY_ERROR_PASSWORD_EXPIRED
+	* fix for BUG#366: only request attributes that are
+	  actually used
 
 184	Luke Howard <lukeh@padl.com>
 
diff --git a/pam_ldap.c b/pam_ldap.c
index 6abb19a..9a08e6e 100644
--- a/pam_ldap.c
+++ b/pam_ldap.c
@@ -2670,6 +2670,20 @@ _escape_string (const char *str, char *buf, size_t buflen)
   return ret;
 }
 
+static char *_pam_ldap_attrs[] = {
+  "host",
+  "authorizedService",
+  "shadowExpire",
+  "shadowFlag",
+  "shadowInactive",
+  "shadowLastChange",
+  "shadowMax",
+  "shadowMin",
+  "shadowWarning",
+  "uidNumber",
+  NULL 
+};
+
 static int
 _get_user_info (pam_ldap_session_t * session, const char *user)
 {
@@ -2728,7 +2742,7 @@ nxt:
     }
 
   rc = ldap_search_s (session->ld, ssd->base, ssd->scope,
-		      filter, NULL, 0, &res);
+		      filter, _pam_ldap_attrs, 0, &res);
 
   if (rc != LDAP_SUCCESS &&
       rc != LDAP_TIMELIMIT_EXCEEDED && rc != LDAP_SIZELIMIT_EXCEEDED)