git.sur5r.net Git - openldap/blob - clients/tools/ldapcompare.c

   1 /*
   2  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   3  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   4  */
   5
   6 #include "portable.h"
   7
   8 #include <stdio.h>
   9
  10 #include <ac/stdlib.h>
  11
  12 #include <ac/ctype.h>
  13 #include <ac/signal.h>
  14 #include <ac/string.h>
  15 #include <ac/unistd.h>
  16 #include <ac/errno.h>
  17 #include <sys/stat.h>
  18
  19 #ifdef HAVE_FCNTL_H
  20 #include <fcntl.h>
  21 #endif
  22 #ifdef HAVE_SYS_TYPES_H
  23 #include <sys/types.h>
  24 #endif
  25 #ifdef HAVE_IO_H
  26 #include <io.h>
  27 #endif
  28
  29 #include <ldap.h>
  30
  31 #include "ldif.h"
  32 #include "lutil.h"
  33 #include "lutil_ldap.h"
  34 #include "ldap_defaults.h"
  35
  36 static void
  37 usage( const char *s )
  38 {
  39         fprintf( stderr,
  40 "usage: %s [options] DN <attr:value|attr::b64value>\n"
  41 "where:\n"
  42 "  DN\tDistinguished Name\n"
  43 "  attr\tassertion attribute\n"
  44 "  value\tassertion value\n"
  45 "  b64value\tbase64 encoding of assertion value\n"
  46
  47 "Common options:\n"
  48 "  -d level   set LDAP debugging level to `level'\n"
  49 "  -D binddn  bind DN\n"
  50 "  -h host    LDAP server\n"
  51 "  -H URI     LDAP Uniform Resource Indentifier(s)\n"
  52 "  -I         use SASL Interactive mode\n"
  53 "  -k         use Kerberos authentication\n"
  54 "  -K         like -k, but do only step 1 of the Kerberos bind\n"
  55 "  -M         enable Manage DSA IT control (-MM to make critical)\n"
  56 "  -n         show what would be done but don't actually compare\n"
  57 "  -O props   SASL security properties\n"
  58 "  -p port    port on LDAP server\n"
  59 "  -P version procotol version (default: 3)\n"
  60 "  -z         Quiet mode, don't print anything, use return values\n"
  61 "  -Q         use SASL Quiet mode\n"
  62 "  -R realm   SASL realm\n"
  63 "  -U authcid SASL authentication identity\n"
  64 "  -v         run in verbose mode (diagnostics to standard output)\n"
  65 "  -w passwd  bind passwd (for simple authentication)\n"
  66 "  -W         prompt for bind passwd\n"
  67 "  -x         Simple authentication\n"
  68 "  -X authzid SASL authorization identity (\"dn:<dn>\" or \"u:<user>\")\n"
  69 "  -y file    Read passwd from file\n"
  70 "  -Y mech    SASL mechanism\n"
  71 "  -Z         Start TLS request (-ZZ to require successful response)\n"
  72 , s );
  73
  74         exit( EXIT_FAILURE );
  75 }
  76
  77 static int docompare LDAP_P((
  78         LDAP *ld,
  79         char *dn,
  80         char *attr,
  81         struct berval *bvalue,
  82         int quiet,
  83         LDAPControl **sctrls,
  84         LDAPControl **cctrls));
  85
  86 static char *prog = NULL;
  87 static char     *binddn = NULL;
  88 static struct berval passwd = { 0, NULL };
  89 static char     *ldaphost = NULL;
  90 static char *ldapuri = NULL;
  91 static int      ldapport = 0;
  92 #ifdef HAVE_CYRUS_SASL
  93 static unsigned sasl_flags = LDAP_SASL_AUTOMATIC;
  94 static char     *sasl_realm = NULL;
  95 static char     *sasl_authc_id = NULL;
  96 static char     *sasl_authz_id = NULL;
  97 static char     *sasl_mech = NULL;
  98 static char     *sasl_secprops = NULL;
  99 #endif
 100 static int      use_tls = 0;
 101 static int      verbose, not;
 102
 103 int
 104 main( int argc, char **argv )
 105 {
 106         char    *compdn = NULL, *attrs = NULL;
 107         char    *sep;
 108         int             rc, i, manageDSAit, quiet;
 109         int             referrals, debug;
 110         int             authmethod, version, want_bindpw;
 111         LDAP    *ld = NULL;
 112         struct berval bvalue = { 0, NULL };
 113         char    *pw_file = NULL;
 114
 115         debug = verbose = not = referrals =
 116                 manageDSAit = want_bindpw = quiet = 0;
 117
 118         version = -1;
 119
 120         authmethod = -1;
 121
 122         prog = lutil_progname( "ldapcompare", argc, argv );
 123
 124         while (( i = getopt( argc, argv,
 125                 "Cd:D:h:H:IkKMnO:p:P:qQR:U:vw:WxX:y:Y:zZ")) != EOF )
 126         {
 127                 switch( i ) {
 128
 129                 /* Common Options */
 130                 case 'C':
 131                         referrals++;
 132                         break;
 133                 case 'd':
 134                         debug |= atoi( optarg );
 135                         break;
 136                 case 'D':       /* bind DN */
 137                         if( binddn != NULL ) {
 138                                 fprintf( stderr, "%s: -D previously specified\n", prog );
 139                                 return EXIT_FAILURE;
 140                         }
 141                         binddn = strdup( optarg );
 142                         break;
 143                 case 'h':       /* ldap host */
 144                         if( ldapuri != NULL ) {
 145                                 fprintf( stderr, "%s: -h incompatible with -H\n", prog );
 146                                 return EXIT_FAILURE;
 147                         }
 148                         if( ldaphost != NULL ) {
 149                                 fprintf( stderr, "%s: -h previously specified\n", prog );
 150                                 return EXIT_FAILURE;
 151                         }
 152                         ldaphost = strdup( optarg );
 153                         break;
 154                 case 'H':       /* ldap URI */
 155                         if( ldaphost != NULL ) {
 156                                 fprintf( stderr, "%s: -H incompatible with -h\n", prog );
 157                                 return EXIT_FAILURE;
 158                         }
 159                         if( ldapport ) {
 160                                 fprintf( stderr, "%s: -H incompatible with -p\n", prog );
 161                                 return EXIT_FAILURE;
 162                         }
 163                         if( ldapuri != NULL ) {
 164                                 fprintf( stderr, "%s: -H previously specified\n", prog );
 165                                 return EXIT_FAILURE;
 166                         }
 167                         ldapuri = strdup( optarg );
 168                         break;
 169                 case 'I':
 170 #ifdef HAVE_CYRUS_SASL
 171                         if( version == LDAP_VERSION2 ) {
 172                                 fprintf( stderr, "%s: -I incompatible with version %d\n",
 173                                         prog, version );
 174                                 return EXIT_FAILURE;
 175                         }
 176                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 177                                 fprintf( stderr, "%s: incompatible previous "
 178                                         "authentication choice\n",
 179                                         prog );
 180                                 return EXIT_FAILURE;
 181                         }
 182                         authmethod = LDAP_AUTH_SASL;
 183                         version = LDAP_VERSION3;
 184                         sasl_flags = LDAP_SASL_INTERACTIVE;
 185                         break;
 186 #else
 187                         fprintf( stderr, "%s: was not compiled with SASL support\n",
 188                                 prog );
 189                         return( EXIT_FAILURE );
 190 #endif
 191                 case 'k':       /* kerberos bind */
 192 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 193                         if( version > LDAP_VERSION2 ) {
 194                                 fprintf( stderr, "%s: -k incompatible with LDAPv%d\n",
 195                                         prog, version );
 196                                 return EXIT_FAILURE;
 197                         }
 198
 199                         if( authmethod != -1 ) {
 200                                 fprintf( stderr, "%s: -k incompatible with previous "
 201                                         "authentication choice\n", prog );
 202                                 return EXIT_FAILURE;
 203                         }
 204
 205                         authmethod = LDAP_AUTH_KRBV4;
 206 #else
 207                         fprintf( stderr, "%s: not compiled with Kerberos support\n", prog );
 208                         return EXIT_FAILURE;
 209 #endif
 210                         break;
 211                 case 'K':       /* kerberos bind, part one only */
 212 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 213                         if( version > LDAP_VERSION2 ) {
 214                                 fprintf( stderr, "%s: -k incompatible with LDAPv%d\n",
 215                                         prog, version );
 216                                 return EXIT_FAILURE;
 217                         }
 218                         if( authmethod != -1 ) {
 219                                 fprintf( stderr, "%s: incompatible with previous "
 220                                         "authentication choice\n", prog );
 221                                 return EXIT_FAILURE;
 222                         }
 223
 224                         authmethod = LDAP_AUTH_KRBV41;
 225 #else
 226                         fprintf( stderr, "%s: not compiled with Kerberos support\n", prog );
 227                         return( EXIT_FAILURE );
 228 #endif
 229                         break;
 230                 case 'M':
 231                         /* enable Manage DSA IT */
 232                         if( version == LDAP_VERSION2 ) {
 233                                 fprintf( stderr, "%s: -M incompatible with LDAPv%d\n",
 234                                         prog, version );
 235                                 return EXIT_FAILURE;
 236                         }
 237                         manageDSAit++;
 238                         version = LDAP_VERSION3;
 239                         break;
 240                 case 'n':       /* print compares, don't actually do them */
 241                         ++not;
 242                         break;
 243                 case 'O':
 244 #ifdef HAVE_CYRUS_SASL
 245                         if( sasl_secprops != NULL ) {
 246                                 fprintf( stderr, "%s: -O previously specified\n", prog );
 247                                 return EXIT_FAILURE;
 248                         }
 249                         if( version == LDAP_VERSION2 ) {
 250                                 fprintf( stderr, "%s: -O incompatible with LDAPv%d\n",
 251                                         prog, version );
 252                                 return EXIT_FAILURE;
 253                         }
 254                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 255                                 fprintf( stderr, "%s: incompatible previous "
 256                                         "authentication choice\n", prog );
 257                                 return EXIT_FAILURE;
 258                         }
 259                         authmethod = LDAP_AUTH_SASL;
 260                         version = LDAP_VERSION3;
 261                         sasl_secprops = strdup( optarg );
 262 #else
 263                         fprintf( stderr, "%s: not compiled with SASL support\n",
 264                                 prog );
 265                         return( EXIT_FAILURE );
 266 #endif
 267                         break;
 268                 case 'p':
 269                         if( ldapport ) {
 270                                 fprintf( stderr, "%s: -p previously specified\n", prog );
 271                                 return EXIT_FAILURE;
 272                         }
 273                         ldapport = atoi( optarg );
 274                         break;
 275                 case 'P':
 276                         switch( atoi(optarg) ) {
 277                         case 2:
 278                                 if( version == LDAP_VERSION3 ) {
 279                                         fprintf( stderr, "%s: -P 2 incompatible with version %d\n",
 280                                                 prog, version );
 281                                         return EXIT_FAILURE;
 282                                 }
 283                                 version = LDAP_VERSION2;
 284                                 break;
 285                         case 3:
 286                                 if( version == LDAP_VERSION2 ) {
 287                                         fprintf( stderr, "%s: -P 2 incompatible with version %d\n",
 288                                                 prog, version );
 289                                         return EXIT_FAILURE;
 290                                 }
 291                                 version = LDAP_VERSION3;
 292                                 break;
 293                         default:
 294                                 fprintf( stderr, "%s: protocol version should be 2 or 3\n",
 295                                         prog );
 296                                 usage( prog );
 297                                 return( EXIT_FAILURE );
 298                         } break;
 299                 case 'Q':
 300 #ifdef HAVE_CYRUS_SASL
 301                         if( version == LDAP_VERSION2 ) {
 302                                 fprintf( stderr, "%s: -Q incompatible with version %d\n",
 303                                         prog, version );
 304                                 return EXIT_FAILURE;
 305                         }
 306                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 307                                 fprintf( stderr, "%s: incompatible previous "
 308                                         "authentication choice\n",
 309                                         prog );
 310                                 return EXIT_FAILURE;
 311                         }
 312                         authmethod = LDAP_AUTH_SASL;
 313                         version = LDAP_VERSION3;
 314                         sasl_flags = LDAP_SASL_QUIET;
 315                         break;
 316 #else
 317                         fprintf( stderr, "%s: not compiled with SASL support\n",
 318                                 prog );
 319                         return( EXIT_FAILURE );
 320 #endif
 321                 case 'R':
 322 #ifdef HAVE_CYRUS_SASL
 323                         if( sasl_realm != NULL ) {
 324                                 fprintf( stderr, "%s: -R previously specified\n", prog );
 325                                 return EXIT_FAILURE;
 326                         }
 327                         if( version == LDAP_VERSION2 ) {
 328                                 fprintf( stderr, "%s: -R incompatible with version %d\n",
 329                                         prog, version );
 330                                 return EXIT_FAILURE;
 331                         }
 332                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 333                                 fprintf( stderr, "%s: incompatible previous "
 334                                         "authentication choice\n",
 335                                         prog );
 336                                 return EXIT_FAILURE;
 337                         }
 338                         authmethod = LDAP_AUTH_SASL;
 339                         version = LDAP_VERSION3;
 340                         sasl_realm = strdup( optarg );
 341 #else
 342                         fprintf( stderr, "%s: not compiled with SASL support\n",
 343                                 prog );
 344                         return( EXIT_FAILURE );
 345 #endif
 346                         break;
 347         case 'U':
 348 #ifdef HAVE_CYRUS_SASL
 349                         if( sasl_authc_id != NULL ) {
 350                                 fprintf( stderr, "%s: -U previously specified\n", prog );
 351                                 return EXIT_FAILURE;
 352                         }
 353                         if( version == LDAP_VERSION2 ) {
 354                                 fprintf( stderr, "%s: -U incompatible with version %d\n",
 355                                         prog, version );
 356                                 return EXIT_FAILURE;
 357                         }
 358                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 359                                 fprintf( stderr, "%s: incompatible previous "
 360                                         "authentication choice\n",
 361                                         prog );
 362                                 return EXIT_FAILURE;
 363                         }
 364                         authmethod = LDAP_AUTH_SASL;
 365                         version = LDAP_VERSION3;
 366                         sasl_authc_id = strdup( optarg );
 367 #else
 368                         fprintf( stderr, "%s: not compiled with SASL support\n",
 369                                 prog );
 370                         return( EXIT_FAILURE );
 371 #endif
 372                         break;
 373                 case 'v':       /* verbose mode */
 374                         verbose++;
 375                         break;
 376                 case 'w':       /* password */
 377                         passwd.bv_val = strdup( optarg );
 378                         {
 379                                 char* p;
 380
 381                                 for( p = optarg; *p != '\0'; p++ ) {
 382                                         *p = '\0';
 383                                 }
 384                         }
 385                         passwd.bv_len = strlen( passwd.bv_val );
 386                         break;
 387                 case 'W':
 388                         want_bindpw++;
 389                         break;
 390                 case 'y':
 391                         pw_file = optarg;
 392                         break;
 393                 case 'Y':
 394 #ifdef HAVE_CYRUS_SASL
 395                         if( sasl_mech != NULL ) {
 396                                 fprintf( stderr, "%s: -Y previously specified\n", prog );
 397                                 return EXIT_FAILURE;
 398                         }
 399                         if( version == LDAP_VERSION2 ) {
 400                                 fprintf( stderr, "%s: -Y incompatible with version %d\n",
 401                                         prog, version );
 402                                 return EXIT_FAILURE;
 403                         }
 404                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 405                                 fprintf( stderr, "%s: incompatible with authentication choice\n", prog );
 406                                 return EXIT_FAILURE;
 407                         }
 408                         authmethod = LDAP_AUTH_SASL;
 409                         version = LDAP_VERSION3;
 410                         sasl_mech = strdup( optarg );
 411 #else
 412                         fprintf( stderr, "%s: not compiled with SASL support\n",
 413                                 prog );
 414                         return( EXIT_FAILURE );
 415 #endif
 416                         break;
 417                 case 'x':
 418                         if( authmethod != -1 && authmethod != LDAP_AUTH_SIMPLE ) {
 419                                 fprintf( stderr, "%s: incompatible with previous "
 420                                         "authentication choice\n", prog );
 421                                 return EXIT_FAILURE;
 422                         }
 423                         authmethod = LDAP_AUTH_SIMPLE;
 424                         break;
 425                 case 'X':
 426 #ifdef HAVE_CYRUS_SASL
 427                         if( sasl_authz_id != NULL ) {
 428                                 fprintf( stderr, "%s: -X previously specified\n", prog );
 429                                 return EXIT_FAILURE;
 430                         }
 431                         if( version == LDAP_VERSION2 ) {
 432                                 fprintf( stderr, "%s: -X incompatible with LDAPv%d\n",
 433                                         prog, version );
 434                                 return EXIT_FAILURE;
 435                         }
 436                         if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) {
 437                                 fprintf( stderr, "%s: -X incompatible with "
 438                                         "authentication choice\n", prog );
 439                                 return EXIT_FAILURE;
 440                         }
 441                         authmethod = LDAP_AUTH_SASL;
 442                         version = LDAP_VERSION3;
 443                         sasl_authz_id = strdup( optarg );
 444 #else
 445                         fprintf( stderr, "%s: not compiled with SASL support\n",
 446                                 prog );
 447                         return( EXIT_FAILURE );
 448 #endif
 449                         break;
 450                 case 'z':
 451                         quiet++;
 452                         break;
 453                 case 'Z':
 454 #ifdef HAVE_TLS
 455                         if( version == LDAP_VERSION2 ) {
 456                                 fprintf( stderr, "%s: -Z incompatible with version %d\n",
 457                                         prog, version );
 458                                 return EXIT_FAILURE;
 459                         }
 460                         version = LDAP_VERSION3;
 461                         use_tls++;
 462 #else
 463                         fprintf( stderr, "%s: not compiled with TLS support\n",
 464                                 prog );
 465                         return( EXIT_FAILURE );
 466 #endif
 467                         break;
 468                 default:
 469                         fprintf( stderr, "%s: unrecognized option -%c\n",
 470                                 prog, optopt );
 471                         usage( argv[0] );
 472                 }
 473         }
 474
 475         if (version == -1) {
 476                 version = LDAP_VERSION3;
 477         }
 478         if (authmethod == -1 && version > LDAP_VERSION2) {
 479 #ifdef HAVE_CYRUS_SASL
 480                 authmethod = LDAP_AUTH_SASL;
 481 #else
 482                 authmethod = LDAP_AUTH_SIMPLE;
 483 #endif
 484         }
 485
 486         if ( argc - optind != 2 ) {
 487                 usage( argv[ 0 ] );
 488         }
 489
 490         compdn = argv[optind++];
 491         attrs = argv[optind++];
 492
 493         /* user passed in only 2 args, the last one better be in
 494          * the form attr:value or attr::b64value
 495          */
 496         sep = strchr(attrs, ':');
 497         if (!sep) {
 498                 usage( argv[ 0 ] );
 499         }
 500
 501         *sep++='\0';
 502         if ( *sep != ':' ) {
 503                 bvalue.bv_val = strdup( sep );
 504                 bvalue.bv_len = strlen( bvalue.bv_val );
 505
 506         } else {
 507                 /* it's base64 encoded. */
 508                 bvalue.bv_val = malloc( strlen( &sep[1] ));
 509                 bvalue.bv_len = lutil_b64_pton( &sep[1],
 510                         bvalue.bv_val, strlen( &sep[1] ));
 511
 512                 if (bvalue.bv_len == -1) {
 513                         fprintf(stderr, "base64 decode error\n");
 514                         exit(-1);
 515                 }
 516         }
 517
 518         if ( debug ) {
 519                 if( ber_set_option( NULL, LBER_OPT_DEBUG_LEVEL, &debug )
 520                         != LBER_OPT_SUCCESS )
 521                 {
 522                         fprintf( stderr,
 523                                 "Could not set LBER_OPT_DEBUG_LEVEL %d\n", debug );
 524                 }
 525                 if( ldap_set_option( NULL, LDAP_OPT_DEBUG_LEVEL, &debug )
 526                         != LDAP_OPT_SUCCESS )
 527                 {
 528                         fprintf( stderr,
 529                                 "Could not set LDAP_OPT_DEBUG_LEVEL %d\n", debug );
 530                 }
 531                 ldif_debug = debug;
 532         }
 533
 534 #ifdef SIGPIPE
 535         (void) SIGNAL( SIGPIPE, SIG_IGN );
 536 #endif
 537
 538         if( ( ldaphost != NULL || ldapport ) && ( ldapuri == NULL ) ) {
 539                 if ( verbose ) {
 540                         fprintf( stderr, "ldap_init( %s, %d )\n",
 541                                 ldaphost != NULL ? ldaphost : "<DEFAULT>",
 542                                 ldapport );
 543                 }
 544
 545                 ld = ldap_init( ldaphost, ldapport );
 546                 if( ld == NULL ) {
 547                         perror("ldapcompare: ldap_init");
 548                         return EXIT_FAILURE;
 549                 }
 550
 551         } else {
 552                 if ( verbose ) {
 553                         fprintf( stderr, "ldap_initialize( %s )\n",
 554                                 ldapuri != NULL ? ldapuri : "<DEFAULT>" );
 555                 }
 556
 557                 rc = ldap_initialize( &ld, ldapuri );
 558                 if( rc != LDAP_SUCCESS ) {
 559                         fprintf( stderr,
 560                                 "Could not create LDAP session handle (%d): %s\n",
 561                                 rc, ldap_err2string(rc) );
 562                         return EXIT_FAILURE;
 563                 }
 564         }
 565
 566
 567         /* referrals */
 568         if (ldap_set_option( ld, LDAP_OPT_REFERRALS,
 569                 referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
 570         {
 571                 fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
 572                         referrals ? "on" : "off" );
 573                 return EXIT_FAILURE;
 574         }
 575
 576         if (version == -1 ) {
 577                 version = LDAP_VERSION3;
 578         }
 579
 580         if( ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version )
 581                 != LDAP_OPT_SUCCESS )
 582         {
 583                 fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n",
 584                         version );
 585                 return EXIT_FAILURE;
 586         }
 587
 588         if ( use_tls && ( ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS )) {
 589                 ldap_perror( ld, "ldap_start_tls" );
 590                 if ( use_tls > 1 ) {
 591                         return EXIT_FAILURE;
 592                 }
 593         }
 594
 595         if ( pw_file || want_bindpw ) {
 596                 if ( pw_file ) {
 597                         rc = lutil_get_filed_password( pw_file, &passwd );
 598                         if( rc ) return EXIT_FAILURE;
 599                 } else {
 600                         passwd.bv_val = getpassphrase( "Enter LDAP Password: " );
 601                         passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
 602                 }
 603         }
 604
 605         if ( authmethod == LDAP_AUTH_SASL ) {
 606 #ifdef HAVE_CYRUS_SASL
 607                 void *defaults;
 608
 609                 if( sasl_secprops != NULL ) {
 610                         rc = ldap_set_option( ld, LDAP_OPT_X_SASL_SECPROPS,
 611                                 (void *) sasl_secprops );
 612
 613                         if( rc != LDAP_OPT_SUCCESS ) {
 614                                 fprintf( stderr,
 615                                         "Could not set LDAP_OPT_X_SASL_SECPROPS: %s\n",
 616                                         sasl_secprops );
 617                                 return EXIT_FAILURE;
 618                         }
 619                 }
 620
 621                 defaults = lutil_sasl_defaults( ld,
 622                         sasl_mech,
 623                         sasl_realm,
 624                         sasl_authc_id,
 625                         passwd.bv_val,
 626                         sasl_authz_id );
 627
 628                 rc = ldap_sasl_interactive_bind_s( ld, binddn,
 629                         sasl_mech, NULL, NULL,
 630                         sasl_flags, lutil_sasl_interact, defaults );
 631
 632                 if( rc != LDAP_SUCCESS ) {
 633                         ldap_perror( ld, "ldap_sasl_interactive_bind_s" );
 634                         return EXIT_FAILURE;
 635                 }
 636 #else
 637                 fprintf( stderr, "%s: not compiled with SASL support\n",
 638                         prog, argv[0] );
 639                 return EXIT_FAILURE;
 640 #endif
 641         } else {
 642                 if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod )
 643                                 != LDAP_SUCCESS ) {
 644                         ldap_perror( ld, "ldap_bind" );
 645                         return EXIT_FAILURE;
 646                 }
 647         }
 648
 649         if ( manageDSAit ) {
 650                 int err;
 651                 LDAPControl c;
 652                 LDAPControl *ctrls[2];
 653                 ctrls[0] = &c;
 654                 ctrls[1] = NULL;
 655
 656                 c.ldctl_oid = LDAP_CONTROL_MANAGEDSAIT;
 657                 c.ldctl_value.bv_val = NULL;
 658                 c.ldctl_value.bv_len = 0;
 659                 c.ldctl_iscritical = manageDSAit > 1;
 660
 661                 err = ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, ctrls );
 662
 663                 if( err != LDAP_OPT_SUCCESS ) {
 664                         fprintf( stderr, "Could not set ManageDSAit %scontrol\n",
 665                                 c.ldctl_iscritical ? "critical " : "" );
 666                         if( c.ldctl_iscritical ) {
 667                                 return EXIT_FAILURE;
 668                         }
 669                 }
 670         }
 671
 672         if ( verbose ) {
 673                 fprintf( stderr, "DN:%s, attr:%s, value:%s\n",
 674                         compdn, attrs, sep );
 675         }
 676
 677         rc = docompare( ld, compdn, attrs, &bvalue, quiet, NULL, NULL );
 678
 679         free( bvalue.bv_val );
 680
 681         ldap_unbind( ld );
 682
 683         return rc;
 684 }
 685
 686
 687 static int docompare(
 688         LDAP *ld,
 689         char *dn,
 690         char *attr,
 691         struct berval *bvalue,
 692         int quiet,
 693         LDAPControl **sctrls,
 694         LDAPControl **cctrls )
 695 {
 696         int                     rc;
 697
 698         if ( not ) {
 699                 return LDAP_SUCCESS;
 700         }
 701
 702         rc = ldap_compare_ext_s( ld, dn, attr, bvalue,
 703                 sctrls, cctrls );
 704
 705         if ( rc == -1 ) {
 706                 ldap_perror( ld, "ldap_result" );
 707                 return( rc );
 708         }
 709
 710         /* if we were told to be quiet, use the return value. */
 711         if ( !quiet ) {
 712                 if ( rc == LDAP_COMPARE_TRUE ) {
 713                         rc = 0;
 714                         printf("TRUE\n");
 715                 } else if ( rc == LDAP_COMPARE_FALSE ) {
 716                         rc = 0;
 717                         printf("FALSE\n");
 718                 } else {
 719                         ldap_perror( ld, "ldap_compare" );
 720                 }
 721         }
 722
 723         return( rc );
 724 }
 725