git.sur5r.net Git - openldap/blob - servers/slapd/back-ldap/config.c

   1 /* config.c - ldap backend configuration file routine */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 2003-2005 The OpenLDAP Foundation.
   6  * Portions Copyright 1999-2003 Howard Chu.
   7  * Portions Copyright 2000-2003 Pierangelo Masarati.
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted only as authorized by the OpenLDAP
  12  * Public License.
  13  *
  14  * A copy of this license is available in the file LICENSE in the
  15  * top-level directory of the distribution or, alternatively, at
  16  * <http://www.OpenLDAP.org/license.html>.
  17  */
  18 /* ACKNOWLEDGEMENTS:
  19  * This work was initially developed by the Howard Chu for inclusion
  20  * in OpenLDAP Software and subsequently enhanced by Pierangelo
  21  * Masarati.
  22  */
  23
  24 #include "portable.h"
  25
  26 #include <stdio.h>
  27
  28 #include <ac/string.h>
  29 #include <ac/ctype.h>
  30 #include <ac/socket.h>
  31
  32 #include "slap.h"
  33 #include "config.h"
  34 #include "back-ldap.h"
  35 #include "lutil.h"
  36 #include "ldif.h"
  37 #undef ldap_debug
  38 /* for advanced URL parsing */
  39 #include "../../../libraries/libldap/ldap-int.h"
  40
  41 static SLAP_EXTOP_MAIN_FN ldap_back_exop_whoami;
  42
  43 static ConfigDriver ldap_back_cf_gen;
  44
  45 enum {
  46         LDAP_BACK_CFG_URI = 1,
  47         LDAP_BACK_CFG_TLS,
  48         LDAP_BACK_CFG_ACL_AUTHCDN,
  49         LDAP_BACK_CFG_ACL_PASSWD,
  50         LDAP_BACK_CFG_ACL_METHOD,
  51         LDAP_BACK_CFG_ACL_BIND,
  52         LDAP_BACK_CFG_IDASSERT_MODE,
  53         LDAP_BACK_CFG_IDASSERT_AUTHCDN,
  54         LDAP_BACK_CFG_IDASSERT_PASSWD,
  55         LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
  56         LDAP_BACK_CFG_IDASSERT_METHOD,
  57         LDAP_BACK_CFG_IDASSERT_BIND,
  58         LDAP_BACK_CFG_REBIND,
  59         LDAP_BACK_CFG_CHASE,
  60         LDAP_BACK_CFG_T_F,
  61         LDAP_BACK_CFG_WHOAMI,
  62         LDAP_BACK_CFG_REWRITE
  63 };
  64
  65 static ConfigTable ldapcfg[] = {
  66         { "uri", "uri", 2, 2, 0,
  67                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_URI,
  68                 ldap_back_cf_gen, "( OLcfgDbAt:0.14 "
  69                         "NAME 'olcDbURI' "
  70                         "DESC 'URI (list) for remote DSA' "
  71                         "SYNTAX OMsDirectoryString "
  72                         "SINGLE-VALUE )",
  73                 NULL, NULL },
  74         { "tls", "what", 2, 2, 0,
  75                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_TLS,
  76                 ldap_back_cf_gen, "( OLcfgDbAt:3.1 "
  77                         "NAME 'olcDbStartTLS' "
  78                         "DESC 'StartTLS' "
  79                         "SYNTAX OMsDirectoryString "
  80                         "SINGLE-VALUE )",
  81                 NULL, NULL },
  82         { "acl-authcDN", "DN", 2, 2, 0,
  83                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
  84                 ldap_back_cf_gen, "( OLcfgDbAt:3.2 "
  85                         "NAME 'olcDbACLAuthcDn' "
  86                         "DESC 'Remote ACL administrative identity' "
  87                         "OBSOLETE "
  88                         "SYNTAX OMsDN "
  89                         "SINGLE-VALUE )",
  90                 NULL, NULL },
  91         /* deprecated; aliases "acl-authcDN" */
  92         { "binddn", "DN", 2, 2, 0,
  93                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
  94                 ldap_back_cf_gen, NULL, NULL, NULL },
  95         { "acl-passwd", "cred", 2, 2, 0,
  96                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
  97                 ldap_back_cf_gen, "( OLcfgDbAt:3.3 "
  98                         "NAME 'olcDbACLPasswd' "
  99                         "DESC 'Remote ACL administrative identity credentials' "
 100                         "OBSOLETE "
 101                         "SYNTAX OMsDirectoryString "
 102                         "SINGLE-VALUE )",
 103                 NULL, NULL },
 104         /* deprecated; aliases "acl-passwd" */
 105         { "bindpw", "cred", 2, 2, 0,
 106                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
 107                 ldap_back_cf_gen, NULL, NULL, NULL },
 108         { "acl-bind", "args", 2, 0, 0,
 109                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_ACL_BIND,
 110                 ldap_back_cf_gen, "( OLcfgDbAt:3.4 "
 111                         "NAME 'olcDbACLBind' "
 112                         "DESC 'Remote ACL administrative identity auth bind configuration' "
 113                         "SYNTAX OMsDirectoryString "
 114                         "SINGLE-VALUE )",
 115                 NULL, NULL },
 116         /* deprecated; aliases "acl-bind" */
 117         { "acl-method", "args", 2, 0, 0,
 118                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_ACL_BIND,
 119                 ldap_back_cf_gen, NULL, NULL, NULL },
 120         { "idassert-authcDN", "DN", 2, 2, 0,
 121                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHCDN,
 122                 ldap_back_cf_gen, "( OLcfgDbAt:3.5 "
 123                         "NAME 'olcDbIDAssertAuthcDn' "
 124                         "DESC 'Remote Identity Assertion administrative identity' "
 125                         "OBSOLETE "
 126                         "SYNTAX OMsDN "
 127                         "SINGLE-VALUE )",
 128                 NULL, NULL },
 129         /* deprecated; partially aliases "idassert-authcDN" */
 130         { "proxyauthzdn", "DN", 2, 2, 0,
 131                 ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHCDN,
 132                 ldap_back_cf_gen, NULL, NULL, NULL },
 133         { "idassert-passwd", "cred", 2, 2, 0,
 134                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_PASSWD,
 135                 ldap_back_cf_gen, "( OLcfgDbAt:3.6 "
 136                         "NAME 'olcDbIDAssertPasswd' "
 137                         "DESC 'Remote Identity Assertion administrative identity credentials' "
 138                         "OBSOLETE "
 139                         "SYNTAX OMsDirectoryString "
 140                         "SINGLE-VALUE )",
 141                 NULL, NULL },
 142         /* deprecated; partially aliases "idassert-passwd" */
 143         { "proxyauthzpw", "cred", 2, 2, 0,
 144                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_PASSWD,
 145                 ldap_back_cf_gen, NULL, NULL, NULL },
 146         { "idassert-bind", "args", 2, 0, 0,
 147                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
 148                 ldap_back_cf_gen, "( OLcfgDbAt:3.7 "
 149                         "NAME 'olcDbIDAssertBind' "
 150                         "DESC 'Remote Identity Assertion administrative identity auth bind configuration' "
 151                         "SYNTAX OMsDirectoryString "
 152                         "SINGLE-VALUE )",
 153                 NULL, NULL },
 154         { "idassert-method", "args", 2, 0, 0,
 155                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
 156                 ldap_back_cf_gen, NULL, NULL, NULL },
 157         { "idassert-mode", "mode>|u:<user>|[dn:]<DN", 2, 0, 0,
 158                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_MODE,
 159                 ldap_back_cf_gen, "( OLcfgDbAt:3.8 "
 160                         "NAME 'olcDbIDAssertMode' "
 161                         "DESC 'Remote Identity Assertion mode' "
 162                         "OBSOLETE "
 163                         "SYNTAX OMsDirectoryString "
 164                         "SINGLE-VALUE)",
 165                 NULL, NULL },
 166         { "idassert-authzFrom", "authzRule", 2, 2, 0,
 167                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
 168                 ldap_back_cf_gen, "( OLcfgDbAt:3.9 "
 169                         "NAME 'olcDbIDAssertAuthzFrom' "
 170                         "DESC 'Remote Identity Assertion authz rules' "
 171                         "SYNTAX OMsDirectoryString "
 172                         "X-ORDERED 'VALUES' )",
 173                 NULL, NULL },
 174         { "rebind-as-user", "NO|yes", 1, 2, 0,
 175                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_REBIND,
 176                 ldap_back_cf_gen, "( OLcfgDbAt:3.10 "
 177                         "NAME 'olcDbRebindAsUser' "
 178                         "DESC 'Rebind as user' "
 179                         "SYNTAX OMsDirectoryString "
 180                         "SINGLE-VALUE )",
 181                 NULL, NULL },
 182         { "chase-referrals", "YES|no", 2, 2, 0,
 183                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_CHASE,
 184                 ldap_back_cf_gen, "( OLcfgDbAt:3.11 "
 185                         "NAME 'olcDbChaseReferrals' "
 186                         "DESC 'Chase referrals' "
 187                         "SYNTAX OMsDirectoryString "
 188                         "SINGLE-VALUE )",
 189                 NULL, NULL },
 190         { "t-f-support", "NO|yes|discover", 2, 2, 0,
 191                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_T_F,
 192                 ldap_back_cf_gen, "( OLcfgDbAt:3.12 "
 193                         "NAME 'olcDbTFSupport' "
 194                         "DESC 'Absolute filters support' "
 195                         "SYNTAX OMsDirectoryString "
 196                         "SINGLE-VALUE )",
 197                 NULL, NULL },
 198         { "proxy-whoami", "NO|yes", 1, 2, 0,
 199                 ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_WHOAMI,
 200                 ldap_back_cf_gen, "( OLcfgDbAt:3.13 "
 201                         "NAME 'olcDbProxyWhoAmI' "
 202                         "DESC 'Proxy whoAmI exop' "
 203                         "SYNTAX OMsDirectoryString "
 204                         "SINGLE-VALUE )",
 205                 NULL, NULL },
 206         { "suffixmassage", "[virtual]> <real", 2, 3, 0,
 207                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
 208                 ldap_back_cf_gen, NULL, NULL, NULL },
 209         { "map", "attribute|objectClass> [*|<local>] *|<remote", 3, 4, 0,
 210                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
 211                 ldap_back_cf_gen, NULL, NULL, NULL },
 212         { "rewrite", "<arglist>", 2, 4, STRLENOF( "rewrite" ),
 213                 ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
 214                 ldap_back_cf_gen, NULL, NULL, NULL },
 215         { NULL, NULL, 0, 0, 0, ARG_IGNORED,
 216                 NULL, NULL, NULL, NULL }
 217 };
 218
 219 static ConfigOCs ldapocs[] = {
 220         { "( OLcfgDbOc:3.1 "
 221                 "NAME 'olcLDAPConfig' "
 222                 "DESC 'LDAP backend configuration' "
 223                 "SUP olcDatabaseConfig "
 224                 "MUST olcDbURI "
 225                 "MAY ( olcDbStartTLS "
 226                         "$ olcDbACLAuthcDn "
 227                         "$ olcDbACLPasswd "
 228                         "$ olcDbACLBind "
 229                         "$ olcDbIDAssertAuthcDn "
 230                         "$ olcDbIDAssertPasswd "
 231                         "$ olcDbIDAssertBind "
 232                         "$ olcDbIDAssertMode "
 233                         "$ olcDbIDAssertAuthzFrom "
 234                         "$ olcDbRebindAsUser "
 235                         "$ olcDbChaseReferrals "
 236                         "$ olcDbTFSupport "
 237                         "$ olcDbProxyWhoAmI "
 238                 ") )",
 239                         Cft_Database, ldapcfg},
 240         { NULL, 0, NULL }
 241 };
 242
 243 #define LDAP_BACK_C_NO                  (0x0U)
 244 #define LDAP_BACK_C_YES                 (0x1U)
 245 static slap_verbmasks yn_mode[] = {
 246         { BER_BVC( "yes" ),             LDAP_BACK_C_YES},
 247         { BER_BVC( "no" ),              LDAP_BACK_C_NO },
 248         { BER_BVNULL,                   0 }
 249 };
 250
 251 static slap_verbmasks idassert_mode[] = {
 252         { BER_BVC("self"),              LDAP_BACK_IDASSERT_SELF },
 253         { BER_BVC("anonymous"),         LDAP_BACK_IDASSERT_ANONYMOUS },
 254         { BER_BVC("none"),              LDAP_BACK_IDASSERT_NOASSERT },
 255         { BER_BVC("legacy"),            LDAP_BACK_IDASSERT_LEGACY },
 256         { BER_BVNULL,                   0 }
 257 };
 258
 259 static slap_verbmasks tls_mode[] = {
 260         { BER_BVC( "propagate" ),       LDAP_BACK_F_TLS_PROPAGATE_MASK },
 261         { BER_BVC( "try-propagate" ),   LDAP_BACK_F_PROPAGATE_TLS },
 262         { BER_BVC( "start" ),           LDAP_BACK_F_TLS_USE_MASK },
 263         { BER_BVC( "try-start" ),       LDAP_BACK_F_USE_TLS },
 264         { BER_BVC( "none" ),            LDAP_BACK_C_NO },
 265         { BER_BVNULL,                   0 }
 266 };
 267
 268 static slap_verbmasks t_f_mode[] = {
 269         { BER_BVC( "yes" ),             LDAP_BACK_F_SUPPORT_T_F },
 270         { BER_BVC( "discover" ),        LDAP_BACK_F_SUPPORT_T_F_DISCOVER },
 271         { BER_BVC( "no" ),              LDAP_BACK_C_NO },
 272         { BER_BVNULL,                   0 }
 273 };
 274
 275 static int
 276 ldap_back_cf_gen( ConfigArgs *c )
 277 {
 278         struct ldapinfo *li = ( struct ldapinfo * )c->be->be_private;
 279         int             rc;
 280         int             i;
 281
 282         if ( c->op == SLAP_CONFIG_EMIT ) {
 283                 struct berval   bv = BER_BVNULL;
 284                 rc = 0;
 285
 286                 switch( c->type ) {
 287                 case LDAP_BACK_CFG_URI:
 288                         if ( li->url != NULL ) {
 289                                 c->value_string = ch_strdup( li->url );
 290
 291                         } else {
 292                                 rc = 1;
 293                         }
 294                         break;
 295
 296                 case LDAP_BACK_CFG_TLS:
 297                         enum_to_verb( tls_mode, ( li->flags & LDAP_BACK_F_TLS_MASK ), &bv );
 298                         if ( BER_BVISNULL( &bv ) ) {
 299                                 /* there's something wrong... */
 300                                 assert( 0 );
 301                                 rc = 1;
 302
 303                         } else {
 304                                 ber_dupbv( &c->value_bv, &bv );
 305                         }
 306                         break;
 307
 308                 case LDAP_BACK_CFG_ACL_AUTHCDN:
 309                 case LDAP_BACK_CFG_ACL_PASSWD:
 310                 case LDAP_BACK_CFG_ACL_METHOD:
 311                         /* handled by LDAP_BACK_CFG_ACL_BIND */
 312                         rc = 1;
 313                         break;
 314
 315                 case LDAP_BACK_CFG_ACL_BIND: {
 316                         int     i;
 317
 318                         bindconf_unparse( &li->acl_sb, &c->value_bv );
 319
 320                         for ( i = 0; isspace( c->value_bv.bv_val[ i ] ); i++ )
 321                                 /* count spaces */ ;
 322
 323                         if ( i ) {
 324                                 c->value_bv.bv_len -= i;
 325                                 AC_MEMCPY( c->value_bv.bv_val, &c->value_bv.bv_val[ i ],
 326                                                 c->value_bv.bv_len + 1 );
 327                         }
 328
 329                         break;
 330                 }
 331
 332                 case LDAP_BACK_CFG_IDASSERT_MODE:
 333                 case LDAP_BACK_CFG_IDASSERT_AUTHCDN:
 334                 case LDAP_BACK_CFG_IDASSERT_PASSWD:
 335                 case LDAP_BACK_CFG_IDASSERT_METHOD:
 336                         /* handled by LDAP_BACK_CFG_IDASSERT_BIND */
 337                         rc = 1;
 338                         break;
 339
 340                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM: {
 341                         int             i;
 342
 343                         if ( li->idassert_authz == NULL ) {
 344                                 rc = 1;
 345                                 break;
 346                         }
 347
 348                         for ( i = 0; !BER_BVISNULL( &li->idassert_authz[ i ] ); i++ )
 349                         {
 350                                 struct berval   bv;
 351
 352                                 ber_dupbv( &bv, &li->idassert_authz[ i ] );
 353                                 ber_bvarray_add( &c->rvalue_vals, &bv );
 354                         }
 355                         break;
 356                 }
 357
 358                 case LDAP_BACK_CFG_IDASSERT_BIND: {
 359                         int             i;
 360                         struct berval   bv = BER_BVNULL,
 361                                         bc = BER_BVNULL;
 362                         char            *ptr;
 363
 364                         if ( li->idassert_authmethod != LDAP_AUTH_NONE ) {
 365                                 switch ( li->idassert_mode ) {
 366                                 case LDAP_BACK_IDASSERT_OTHERID:
 367                                 case LDAP_BACK_IDASSERT_OTHERDN:
 368                                         break;
 369
 370                                 default: {
 371                                         struct berval   mode = BER_BVNULL;
 372
 373                                         enum_to_verb( idassert_mode, li->idassert_mode, &mode );
 374                                         if ( BER_BVISNULL( &mode ) ) {
 375                                                 /* there's something wrong... */
 376                                                 assert( 0 );
 377                                                 rc = 1;
 378
 379                                         } else {
 380                                                 bv.bv_len = STRLENOF( "mode=" ) + mode.bv_len;
 381                                                 bv.bv_val = ch_malloc( bv.bv_len + 1 );
 382
 383                                                 ptr = lutil_strcopy( bv.bv_val, "mode=" );
 384                                                 ptr = lutil_strcopy( ptr, mode.bv_val );
 385                                         }
 386                                         break;
 387                                 }
 388                                 }
 389
 390                                 if ( li->idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) {
 391                                         ber_len_t       len = bv.bv_len + STRLENOF( "authz=native" );
 392
 393                                         if ( !BER_BVISEMPTY( &bv ) ) {
 394                                                 len += STRLENOF( " " );
 395                                         }
 396
 397                                         bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
 398
 399                                         ptr = bv.bv_val + bv.bv_len;
 400
 401                                         if ( !BER_BVISEMPTY( &bv ) ) {
 402                                                 ptr = lutil_strcopy( ptr, " " );
 403                                         }
 404
 405                                         (void)lutil_strcopy( ptr, "authz=native" );
 406                                 }
 407
 408                                 if ( li->idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
 409                                         ber_len_t       len = bv.bv_len + STRLENOF( "flags=override" );
 410
 411                                         if ( !BER_BVISEMPTY( &bv ) ) {
 412                                                 len += STRLENOF( " " );
 413                                         }
 414
 415                                         bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
 416
 417                                         ptr = bv.bv_val + bv.bv_len;
 418
 419                                         if ( !BER_BVISEMPTY( &bv ) ) {
 420                                                 ptr = lutil_strcopy( ptr, " " );
 421                                         }
 422
 423                                         (void)lutil_strcopy( ptr, "flags=override" );
 424                                 }
 425                         }
 426
 427
 428
 429                         bindconf_unparse( &li->idassert_sb, &bc );
 430
 431                         if ( !BER_BVISNULL( &bv ) ) {
 432                                 char    *ptr;
 433
 434                                 c->value_bv.bv_len = bv.bv_len + bc.bv_len;
 435                                 c->value_bv.bv_val = ch_realloc( bv.bv_val, c->value_bv.bv_len + 1 );
 436
 437                                 assert( bc.bv_val[ 0 ] == ' ' );
 438
 439                                 ptr = lutil_strcopy( c->value_bv.bv_val, bv.bv_val );
 440                                 (void)lutil_strcopy( ptr, bc.bv_val );
 441
 442                                 free( bc.bv_val );
 443
 444                         } else {
 445                                 for ( i = 0; isspace( bc.bv_val[ i ] ); i++ )
 446                                         /* count spaces */ ;
 447
 448                                 if ( i ) {
 449                                         bc.bv_len -= i;
 450                                         AC_MEMCPY( bc.bv_val, &bc.bv_val[ i ], bc.bv_len + 1 );
 451                                 }
 452
 453                                 c->value_bv = bv;
 454                         }
 455
 456                         break;
 457                 }
 458
 459                 case LDAP_BACK_CFG_REBIND:
 460                         enum_to_verb( yn_mode, ( ( li->flags & LDAP_BACK_F_SAVECRED ) == LDAP_BACK_F_SAVECRED ), &bv );
 461                         if ( BER_BVISNULL( &bv ) ) {
 462                                 /* there's something wrong... */
 463                                 assert( 0 );
 464                                 rc = 1;
 465
 466                         } else {
 467                                 ber_dupbv( &c->value_bv, &bv );
 468                         }
 469                         break;
 470
 471                 case LDAP_BACK_CFG_CHASE:
 472                         enum_to_verb( yn_mode, ( ( li->flags & LDAP_BACK_F_CHASE_REFERRALS ) == LDAP_BACK_F_CHASE_REFERRALS ), &bv );
 473                         if ( BER_BVISNULL( &bv ) ) {
 474                                 /* there's something wrong... */
 475                                 assert( 0 );
 476                                 rc = 1;
 477
 478                         } else {
 479                                 ber_dupbv( &c->value_bv, &bv );
 480                         }
 481                         break;
 482
 483                 case LDAP_BACK_CFG_T_F:
 484                         enum_to_verb( t_f_mode, ( ( li->flags & LDAP_BACK_F_SUPPORT_T_F_MASK ) == LDAP_BACK_F_SUPPORT_T_F_MASK ), &bv );
 485                         if ( BER_BVISNULL( &bv ) ) {
 486                                 /* there's something wrong... */
 487                                 assert( 0 );
 488                                 rc = 1;
 489
 490                         } else {
 491                                 ber_dupbv( &c->value_bv, &bv );
 492                         }
 493                         break;
 494
 495                 case LDAP_BACK_CFG_WHOAMI:
 496                         enum_to_verb( yn_mode, ( ( li->flags & LDAP_BACK_F_PROXY_WHOAMI ) == LDAP_BACK_F_PROXY_WHOAMI ), &bv );
 497                         if ( BER_BVISNULL( &bv ) ) {
 498                                 /* there's something wrong... */
 499                                 assert( 0 );
 500                                 rc = 1;
 501
 502                         } else {
 503                                 ber_dupbv( &c->value_bv, &bv );
 504                         }
 505                         break;
 506
 507                 default:
 508                         /* we need to handle all... */
 509                         assert( 0 );
 510                         break;
 511                 }
 512                 return rc;
 513
 514         } else if ( c->op == LDAP_MOD_DELETE ) {
 515                 rc = 0;
 516                 switch( c->type ) {
 517                 case LDAP_BACK_CFG_URI:
 518                         if ( li->url != NULL ) {
 519                                 ch_free( li->url );
 520                                 li->url = NULL;
 521                         }
 522
 523                         if ( li->lud != NULL ) {
 524                                 ldap_free_urllist( li->lud );
 525                                 li->lud = NULL;
 526                         }
 527                         break;
 528
 529                 case LDAP_BACK_CFG_TLS:
 530                 case LDAP_BACK_CFG_ACL_AUTHCDN:
 531                 case LDAP_BACK_CFG_ACL_PASSWD:
 532                 case LDAP_BACK_CFG_ACL_METHOD:
 533                         /* handled by LDAP_BACK_CFG_ACL_BIND */
 534                         rc = 1;
 535                         break;
 536
 537                 case LDAP_BACK_CFG_ACL_BIND:
 538                         bindconf_free( &li->acl_sb );
 539                         break;
 540
 541                 case LDAP_BACK_CFG_IDASSERT_MODE:
 542                 case LDAP_BACK_CFG_IDASSERT_AUTHCDN:
 543                 case LDAP_BACK_CFG_IDASSERT_PASSWD:
 544                 case LDAP_BACK_CFG_IDASSERT_METHOD:
 545                         /* handled by LDAP_BACK_CFG_IDASSERT_BIND */
 546                         rc = 1;
 547                         break;
 548
 549                 case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
 550                         if ( li->idassert_authz != NULL ) {
 551                                 ber_bvarray_free( li->idassert_authz );
 552                                 li->idassert_authz = NULL;
 553                         }
 554                         break;
 555
 556                 case LDAP_BACK_CFG_IDASSERT_BIND:
 557                         bindconf_free( &li->idassert_sb );
 558                         break;
 559
 560                 case LDAP_BACK_CFG_REBIND:
 561                 case LDAP_BACK_CFG_CHASE:
 562                 case LDAP_BACK_CFG_T_F:
 563                 case LDAP_BACK_CFG_WHOAMI:
 564                         rc = 1;
 565                         break;
 566
 567                 default:
 568                         /* we need to handle all... */
 569                         assert( 0 );
 570                         break;
 571                 }
 572                 return rc;
 573
 574         }
 575
 576         switch( c->type ) {
 577         case LDAP_BACK_CFG_URI: {
 578                 LDAPURLDesc     *tmpludp;
 579                 char            **urllist;
 580                 int             urlrc, i;
 581
 582                 if ( c->argc != 2 ) {
 583                         fprintf( stderr, "%s: line %d: "
 584                                         "missing uri "
 585                                         "in \"uri <uri>\" line\n",
 586                                         c->fname, c->lineno );
 587                         return 1;
 588                 }
 589
 590                 if ( li->url != NULL ) {
 591                         ch_free( li->url );
 592                 }
 593
 594                 if ( li->lud != NULL ) {
 595                         ldap_free_urllist( li->lud );
 596                 }
 597
 598 #if 0
 599                 /* PARANOID: DN and more are not required nor allowed */
 600                 urlrc = ldap_url_parselist_ext( &li->lud, c->value_string, "\t" );
 601 #else
 602                 urlrc = ldap_url_parselist( &li->lud, c->value_string );
 603 #endif
 604                 if ( urlrc != LDAP_URL_SUCCESS ) {
 605                         char    *why;
 606
 607                         switch ( urlrc ) {
 608                         case LDAP_URL_ERR_MEM:
 609                                 why = "no memory";
 610                                 break;
 611                         case LDAP_URL_ERR_PARAM:
 612                                 why = "parameter is bad";
 613                                 break;
 614                         case LDAP_URL_ERR_BADSCHEME:
 615                                 why = "URL doesn't begin with \"[c]ldap[si]://\"";
 616                                 break;
 617                         case LDAP_URL_ERR_BADENCLOSURE:
 618                                 why = "URL is missing trailing \">\"";
 619                                 break;
 620                         case LDAP_URL_ERR_BADURL:
 621                                 why = "URL is bad";
 622                         case LDAP_URL_ERR_BADHOST:
 623                                 why = "host/port is bad";
 624                                 break;
 625                         case LDAP_URL_ERR_BADATTRS:
 626                                 why = "bad (or missing) attributes";
 627                                 break;
 628                         case LDAP_URL_ERR_BADSCOPE:
 629                                 why = "scope string is invalid (or missing)";
 630                                 break;
 631                         case LDAP_URL_ERR_BADFILTER:
 632                                 why = "bad or missing filter";
 633                                 break;
 634                         case LDAP_URL_ERR_BADEXTS:
 635                                 why = "bad or missing extensions";
 636                                 break;
 637                         default:
 638                                 why = "unknown reason";
 639                                 break;
 640                         }
 641                         fprintf( stderr, "%s: line %d: "
 642                                         "unable to parse uri \"%s\" "
 643                                         "in \"uri <uri>\" line: %s\n",
 644                                         c->fname, c->lineno, c->value_string, why );
 645                         return 1;
 646                 }
 647
 648                 for ( i = 0, tmpludp = li->lud;
 649                                 tmpludp;
 650                                 i++, tmpludp = tmpludp->lud_next )
 651                 {
 652                         if ( ( tmpludp->lud_dn != NULL
 653                                                 && tmpludp->lud_dn[0] != '\0' )
 654                                         || tmpludp->lud_attrs != NULL
 655                                         /* || tmpludp->lud_scope != LDAP_SCOPE_DEFAULT */
 656                                         || tmpludp->lud_filter != NULL
 657                                         || tmpludp->lud_exts != NULL )
 658                         {
 659                                 fprintf( stderr, "%s: line %d: "
 660                                                 "warning, only protocol, "
 661                                                 "host and port allowed "
 662                                                 "in \"uri <uri>\" statement "
 663                                                 "for uri #%d of \"%s\"\n",
 664                                                 c->fname, c->lineno, i, c->value_string );
 665                         }
 666                 }
 667
 668 #if 0
 669                 for ( i = 0, tmpludp = li->lud;
 670                                 tmpludp;
 671                                 i++, tmpludp = tmpludp->lud_next )
 672                         /* just count */
 673
 674                 urllist = ch_calloc( sizeof( char * ), i + 1 );
 675
 676                 for ( i = 0, tmpludp = li->lud;
 677                                 tmpludp;
 678                                 i++, tmpludp = tmpludp->lud_next )
 679                 {
 680                         LDAPURLDesc     tmplud;
 681                         ber_len_t       oldlen = 0, len;
 682
 683                         tmplud = *tmpludp;
 684                         tmplud.lud_dn = "";
 685                         tmplud.lud_attrs = NULL;
 686                         tmplud.lud_filter = NULL;
 687                         if ( !ldap_is_ldapi_url( tmplud.lud_scheme ) ) {
 688                                 tmplud.lud_exts = NULL;
 689                                 tmplud.lud_crit_exts = 0;
 690                         }
 691
 692                         urllist[ i ]  = ldap_url_desc2str( &tmplud );
 693
 694                         if ( urllist[ i ] == NULL ) {
 695                                 fprintf( stderr, "%s: line %d: "
 696                                         "unable to rebuild uri "
 697                                         "in \"uri <uri>\" statement "
 698                                         "for \"%s\"\n",
 699                                         c->fname, c->lineno, argv[ 1 ] );
 700                                 return 1;
 701                         }
 702                 }
 703
 704                 li->url = ldap_charray2str( urllist, " " );
 705                 ldap_charray_free( urllist );
 706 #else
 707                 li->url = ch_strdup( c->value_string );
 708 #endif
 709                 break;
 710         }
 711
 712         case LDAP_BACK_CFG_TLS:
 713                 i = verb_to_mask( c->argv[1], tls_mode );
 714                 if ( BER_BVISNULL( &tls_mode[i].word ) ) {
 715                         return 1;
 716                 }
 717                 li->flags &= ~LDAP_BACK_F_TLS_MASK;
 718                 li->flags |= tls_mode[i].mask;
 719                 break;
 720
 721         case LDAP_BACK_CFG_ACL_AUTHCDN:
 722                 switch ( li->acl_authmethod ) {
 723                 case LDAP_AUTH_NONE:
 724                         li->acl_authmethod = LDAP_AUTH_SIMPLE;
 725                         break;
 726
 727                 case LDAP_AUTH_SIMPLE:
 728                         break;
 729
 730                 default:
 731                         fprintf( stderr, "%s: line %d: "
 732                                 "\"acl-authcDN <DN>\" incompatible "
 733                                 "with auth method %d.",
 734                                 c->fname, c->lineno, li->acl_authmethod );
 735                         return 1;
 736                 }
 737                 if ( !BER_BVISNULL( &li->acl_authcDN ) ) {
 738                         free( li->acl_authcDN.bv_val );
 739                 }
 740                 li->acl_authcDN = c->value_ndn;
 741                 break;
 742
 743         case LDAP_BACK_CFG_ACL_PASSWD:
 744                 switch ( li->acl_authmethod ) {
 745                 case LDAP_AUTH_NONE:
 746                         li->acl_authmethod = LDAP_AUTH_SIMPLE;
 747                         break;
 748
 749                 case LDAP_AUTH_SIMPLE:
 750                         break;
 751
 752                 default:
 753                         fprintf( stderr, "%s: line %d: "
 754                                 "\"acl-passwd <cred>\" incompatible "
 755                                 "with auth method %d.",
 756                                 c->fname, c->lineno, li->acl_authmethod );
 757                         return 1;
 758                 }
 759                 if ( !BER_BVISNULL( &li->acl_passwd ) ) {
 760                         free( li->acl_passwd.bv_val );
 761                 }
 762                 li->acl_passwd = c->value_bv;
 763                 break;
 764
 765         case LDAP_BACK_CFG_ACL_METHOD:
 766         case LDAP_BACK_CFG_ACL_BIND:
 767                 for ( i = 1; i < c->argc; i++ ) {
 768                         if ( bindconf_parse( c->argv[ i ], &li->acl_sb ) ) {
 769                                 return 1;
 770                         }
 771                 }
 772                 break;
 773
 774         case LDAP_BACK_CFG_IDASSERT_MODE:
 775                 i = verb_to_mask( c->argv[1], idassert_mode );
 776                 if ( BER_BVISNULL( &idassert_mode[i].word ) ) {
 777                         if ( strncasecmp( c->argv[1], "u:", STRLENOF( "u:" ) ) == 0 ) {
 778                                 li->idassert_mode = LDAP_BACK_IDASSERT_OTHERID;
 779                                 ber_str2bv( c->argv[1], 0, 1, &li->idassert_authzID );
 780                                 li->idassert_authzID.bv_val[ 0 ] = 'u';
 781
 782                         } else {
 783                                 struct berval   id, ndn;
 784
 785                                 ber_str2bv( c->argv[1], 0, 0, &id );
 786
 787                                 if ( strncasecmp( c->argv[1], "dn:", STRLENOF( "dn:" ) ) == 0 ) {
 788                                         id.bv_val += STRLENOF( "dn:" );
 789                                         id.bv_len -= STRLENOF( "dn:" );
 790                                 }
 791
 792                                 rc = dnNormalize( 0, NULL, NULL, &id, &ndn, NULL );
 793                                 if ( rc != LDAP_SUCCESS ) {
 794                                         Debug( LDAP_DEBUG_ANY,
 795                                                 "%s: line %d: idassert ID \"%s\" is not a valid DN\n",
 796                                                 c->fname, c->lineno, c->argv[1] );
 797                                         return 1;
 798                                 }
 799
 800                                 li->idassert_authzID.bv_len = STRLENOF( "dn:" ) + ndn.bv_len;
 801                                 li->idassert_authzID.bv_val = ch_malloc( li->idassert_authzID.bv_len + 1 );
 802                                 AC_MEMCPY( li->idassert_authzID.bv_val, "dn:", STRLENOF( "dn:" ) );
 803                                 AC_MEMCPY( &li->idassert_authzID.bv_val[ STRLENOF( "dn:" ) ], ndn.bv_val, ndn.bv_len + 1 );
 804                                 ch_free( ndn.bv_val );
 805
 806                                 li->idassert_mode = LDAP_BACK_IDASSERT_OTHERDN;
 807                         }
 808
 809                 } else {
 810                         li->idassert_mode = idassert_mode[i].mask;
 811                 }
 812
 813                 if ( c->argc > 2 ) {
 814                         int     i;
 815
 816                         for ( i = 2; i < c->argc; i++ ) {
 817                                 if ( strcasecmp( c->argv[ i ], "override" ) == 0 ) {
 818                                         li->idassert_flags |= LDAP_BACK_AUTH_OVERRIDE;
 819
 820                                 } else {
 821                                         Debug( LDAP_DEBUG_ANY,
 822                                                 "%s: line %d: unknown flag #%d "
 823                                                 "in \"idassert-mode <args> "
 824                                                 "[<flags>]\" line.\n",
 825                                                 c->fname, c->lineno, i - 2 );
 826                                         return 1;
 827                                 }
 828                         }
 829                 }
 830                 break;
 831
 832         case LDAP_BACK_CFG_IDASSERT_AUTHCDN:
 833                 switch ( li->idassert_authmethod ) {
 834                 case LDAP_AUTH_NONE:
 835                         li->idassert_authmethod = LDAP_AUTH_SIMPLE;
 836                         break;
 837
 838                 case LDAP_AUTH_SIMPLE:
 839                         break;
 840
 841                 default:
 842                         fprintf( stderr, "%s: line %d: "
 843                                 "\"idassert-authcDN <DN>\" incompatible "
 844                                 "with auth method %d.",
 845                                 c->fname, c->lineno, li->idassert_authmethod );
 846                         return 1;
 847                 }
 848                 if ( !BER_BVISNULL( &li->idassert_authcDN ) ) {
 849                         free( li->idassert_authcDN.bv_val );
 850                 }
 851                 li->idassert_authcDN = c->value_ndn;
 852                 break;
 853
 854         case LDAP_BACK_CFG_IDASSERT_PASSWD:
 855                 switch ( li->idassert_authmethod ) {
 856                 case LDAP_AUTH_NONE:
 857                         li->idassert_authmethod = LDAP_AUTH_SIMPLE;
 858                         break;
 859
 860                 case LDAP_AUTH_SIMPLE:
 861                         break;
 862
 863                 default:
 864                         fprintf( stderr, "%s: line %d: "
 865                                 "\"idassert-passwd <cred>\" incompatible "
 866                                 "with auth method %d.",
 867                                 c->fname, c->lineno, li->idassert_authmethod );
 868                         return 1;
 869                 }
 870                 if ( !BER_BVISNULL( &li->idassert_passwd ) ) {
 871                         free( li->idassert_passwd.bv_val );
 872                 }
 873                 li->idassert_passwd = c->value_bv;
 874                 break;
 875
 876         case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
 877                 ber_bvarray_add( &li->idassert_authz, &c->value_bv );
 878                 break;
 879
 880         case LDAP_BACK_CFG_IDASSERT_METHOD:
 881                 /* no longer supported */
 882                 fprintf( stderr, "%s: %d: "
 883                         "\"idassert-method <args>\": "
 884                         "no longer supported; use \"idassert-bind\".\n",
 885                         c->fname, c->lineno );
 886                 return 1;
 887
 888         case LDAP_BACK_CFG_IDASSERT_BIND:
 889                 for ( i = 1; i < c->argc; i++ ) {
 890                         if ( strncasecmp( c->argv[ i ], "mode=", STRLENOF( "mode=" ) ) == 0 ) {
 891                                 char    *argvi = c->argv[ i ] + STRLENOF( "mode=" );
 892                                 int     j;
 893
 894                                 j = verb_to_mask( argvi, idassert_mode );
 895                                 if ( BER_BVISNULL( &idassert_mode[ j ].word ) ) {
 896                                         fprintf( stderr, "%s: %d: "
 897                                                 "\"idassert-bind <args>\": "
 898                                                 "unknown mode \"%s\".\n",
 899                                                 c->fname, c->lineno, argvi );
 900                                         return 1;
 901                                 }
 902
 903                                 li->idassert_mode = idassert_mode[ j ].mask;
 904
 905                         } else if ( strncasecmp( c->argv[ i ], "authz=", STRLENOF( "authz=" ) ) == 0 ) {
 906                                 char    *argvi = c->argv[ i ] + STRLENOF( "authz=" );
 907
 908                                 if ( strcasecmp( argvi, "native" ) == 0 ) {
 909                                         if ( li->idassert_authmethod != LDAP_AUTH_SASL ) {
 910                                                 fprintf( stderr, "%s: %d: "
 911                                                         "\"idassert-bind <args>\": "
 912                                                         "authz=\"native\" incompatible "
 913                                                         "with auth method.\n",
 914                                                         c->fname, c->lineno );
 915                                                 return 1;
 916                                         }
 917                                         li->idassert_flags |= LDAP_BACK_AUTH_NATIVE_AUTHZ;
 918
 919                                 } else if ( strcasecmp( argvi, "proxyAuthz" ) == 0 ) {
 920                                         li->idassert_flags &= ~LDAP_BACK_AUTH_NATIVE_AUTHZ;
 921
 922                                 } else {
 923                                         fprintf( stderr, "%s: %d: "
 924                                                 "\"idassert-bind <args>\": "
 925                                                 "unknown authz \"%s\".\n",
 926                                                 c->fname, c->lineno, argvi );
 927                                         return 1;
 928                                 }
 929
 930                         } else if ( strncasecmp( c->argv[ i ], "flags=", STRLENOF( "flags=" ) ) == 0 ) {
 931                                 char    *argvi = c->argv[ i ] + STRLENOF( "flags=" );
 932                                 char    **flags = ldap_str2charray( argvi, "," );
 933                                 int     j;
 934
 935                                 if ( flags == NULL ) {
 936                                         fprintf( stderr, "%s: %d: "
 937                                                 "\"idassert-bind <args>\": "
 938                                                 "unable to parse flags \"%s\".\n",
 939                                                 c->fname, c->lineno, argvi );
 940                                         return 1;
 941                                 }
 942
 943                                 for ( j = 0; flags[ j ] != NULL; j++ ) {
 944                                         if ( strcasecmp( flags[ j ], "override" ) == 0 ) {
 945                                                 li->idassert_flags |= LDAP_BACK_AUTH_OVERRIDE;
 946
 947                                         } else {
 948                                                 fprintf( stderr, "%s: %d: "
 949                                                         "\"idassert-bind <args>\": "
 950                                                         "unknown flag \"%s\".\n",
 951                                                         c->fname, c->lineno, flags[ j ] );
 952                                                 return 1;
 953                                         }
 954                                 }
 955
 956                                 ldap_charray_free( flags );
 957
 958                         } else if ( bindconf_parse( c->argv[ i ], &li->idassert_sb ) ) {
 959                                 return 1;
 960                         }
 961                 }
 962                 break;
 963
 964         case LDAP_BACK_CFG_REBIND: {
 965                 int     dorebind = 0;
 966
 967                 if ( c->argc == 1 ) {
 968                         /* legacy */
 969                         dorebind = 1;
 970
 971                 } else {
 972                         i = verb_to_mask( c->argv[1], yn_mode );
 973                         if ( BER_BVISNULL( &yn_mode[i].word ) ) {
 974                                 return 1;
 975                         }
 976                         if ( yn_mode[i].mask & LDAP_BACK_C_YES ) {
 977                                 dorebind = 1;
 978                         }
 979                 }
 980
 981                 if ( dorebind ) {
 982                         li->flags |= LDAP_BACK_F_SAVECRED;
 983
 984                 } else {
 985                         li->flags &= ~LDAP_BACK_F_SAVECRED;
 986                 }
 987                 break;
 988         }
 989
 990         case LDAP_BACK_CFG_CHASE: {
 991                 int     dochase = 0;
 992
 993                 if ( c->argc == 1 ) {
 994                         /* legacy */
 995                         dochase = 1;
 996
 997                 } else {
 998                         i = verb_to_mask( c->argv[1], yn_mode );
 999                         if ( BER_BVISNULL( &yn_mode[i].word ) ) {
1000                                 return 1;
1001                         }
1002                         if ( yn_mode[i].mask & LDAP_BACK_C_YES ) {
1003                                 dochase = 1;
1004                         }
1005                 }
1006
1007                 if ( dochase ) {
1008                         li->flags |= LDAP_BACK_F_CHASE_REFERRALS;
1009
1010                 } else {
1011                         li->flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
1012                 }
1013                 break;
1014         }
1015
1016         case LDAP_BACK_CFG_T_F:
1017                 i = verb_to_mask( c->argv[1], t_f_mode );
1018                 if ( BER_BVISNULL( &t_f_mode[i].word ) ) {
1019                         return 1;
1020                 }
1021                 li->flags &= ~LDAP_BACK_F_SUPPORT_T_F_MASK;
1022                 li->flags |= t_f_mode[i].mask;
1023                 break;
1024
1025         case LDAP_BACK_CFG_WHOAMI: {
1026                 int     dowhoami = 0;
1027
1028                 if ( c->argc == 1 ) {
1029                         /* legacy */
1030                         dowhoami = 1;
1031
1032                 } else {
1033                         i = verb_to_mask( c->argv[1], yn_mode );
1034                         if ( BER_BVISNULL( &yn_mode[i].word ) ) {
1035                                 return 1;
1036                         }
1037                         if ( yn_mode[i].mask & LDAP_BACK_C_YES ) {
1038                                 dowhoami = 1;
1039                         }
1040                 }
1041
1042                 if ( dowhoami ) {
1043                         li->flags |= LDAP_BACK_F_PROXY_WHOAMI;
1044
1045                         load_extop( (struct berval *)&slap_EXOP_WHOAMI,
1046                                         0, ldap_back_exop_whoami );
1047
1048                 } else {
1049                         li->flags &= ~LDAP_BACK_F_PROXY_WHOAMI;
1050                 }
1051                 break;
1052         }
1053
1054         case LDAP_BACK_CFG_REWRITE:
1055                 fprintf( stderr, "%s: line %d: "
1056                         "rewrite/remap capabilities have been moved "
1057                         "to the \"rwm\" overlay; see slapo-rwm(5) "
1058                         "for details (hint: add \"overlay rwm\" "
1059                         "and prefix all directives with \"rwm-\").\n",
1060                         c->fname, c->lineno );
1061                 return 1;
1062
1063         default:
1064                 assert( 0 );
1065         }
1066
1067         return 0;
1068 }
1069
1070 int
1071 ldap_back_init_cf( BackendInfo *bi )
1072 {
1073         int                     rc;
1074         AttributeDescription    *ad = NULL;
1075         const char              *text;
1076
1077         bi->bi_cf_ocs = ldapocs;
1078
1079         rc = config_register_schema( ldapcfg, ldapocs );
1080         if ( rc ) {
1081                 return rc;
1082         }
1083
1084         /* setup olcDbAclPasswd and olcDbIDAssertPasswd
1085          * to be base64-encoded when written in LDIF form;
1086          * basically, we don't care if it fails */
1087         rc = slap_str2ad( "olcDbACLPasswd", &ad, &text );
1088         if ( rc ) {
1089                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
1090                         "warning, unable to get \"olcDbACLPasswd\" "
1091                         "attribute description: %d: %s\n",
1092                         rc, text, 0 );
1093         } else {
1094                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
1095                         ad->ad_type->sat_oid );
1096         }
1097
1098         ad = NULL;
1099         rc = slap_str2ad( "olcDbIDAssertPasswd", &ad, &text );
1100         if ( rc ) {
1101                 Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
1102                         "warning, unable to get \"olcDbIDAssertPasswd\" "
1103                         "attribute description: %d: %s\n",
1104                         rc, text, 0 );
1105         } else {
1106                 (void)ldif_must_b64_encode_register( ad->ad_cname.bv_val,
1107                         ad->ad_type->sat_oid );
1108         }
1109
1110         return 0;
1111 }
1112
1113
1114 static int
1115 parse_idassert( BackendDB *be, const char *fname, int lineno,
1116                 int argc, char **argv );
1117
1118 static int
1119 parse_acl_auth( BackendDB *be, const char *fname, int lineno,
1120                 int argc, char **argv );
1121
1122 int
1123 ldap_back_db_config(
1124                 BackendDB       *be,
1125                 const char      *fname,
1126                 int             lineno,
1127                 int             argc,
1128                 char            **argv )
1129 {
1130         struct ldapinfo *li = (struct ldapinfo *) be->be_private;
1131
1132         if ( li == NULL ) {
1133                 fprintf( stderr, "%s: line %d: ldap backend info is null!\n",
1134                                 fname, lineno );
1135                 return 1;
1136         }
1137
1138         /* server address to query (no longer supported, use "uri" directive) */
1139         if ( strcasecmp( argv[0], "server" ) == 0 ) {
1140                 fprintf( stderr,
1141         "%s: line %d: \"server <address>\" directive is no longer supported.\n",
1142                                         fname, lineno );
1143                 return 1;
1144
1145         /* URI of server to query (obsoletes "server" directive) */
1146         } else if ( strcasecmp( argv[0], "uri" ) == 0 ) {
1147                 LDAPURLDesc     *tmpludp;
1148                 char            **urllist;
1149                 int             urlrc, i;
1150
1151                 if ( argc != 2 ) {
1152                         fprintf( stderr, "%s: line %d: "
1153                                         "missing uri "
1154                                         "in \"uri <uri>\" line\n",
1155                                         fname, lineno );
1156                         return 1;
1157                 }
1158                 if ( li->url != NULL ) {
1159                         ch_free( li->url );
1160                 }
1161                 if ( li->lud != NULL ) {
1162                         ldap_free_urllist( li->lud );
1163                 }
1164
1165 #if 0
1166                 /* PARANOID: DN and more are not required nor allowed */
1167                 urlrc = ldap_url_parselist_ext( &li->lud, argv[ 1 ], "\t" );
1168 #else
1169                 urlrc = ldap_url_parselist( &li->lud, argv[ 1 ] );
1170 #endif
1171                 if ( urlrc != LDAP_URL_SUCCESS ) {
1172                         char    *why;
1173
1174                         switch ( urlrc ) {
1175                         case LDAP_URL_ERR_MEM:
1176                                 why = "no memory";
1177                                 break;
1178                         case LDAP_URL_ERR_PARAM:
1179                                 why = "parameter is bad";
1180                                 break;
1181                         case LDAP_URL_ERR_BADSCHEME:
1182                                 why = "URL doesn't begin with \"[c]ldap[si]://\"";
1183                                 break;
1184                         case LDAP_URL_ERR_BADENCLOSURE:
1185                                 why = "URL is missing trailing \">\"";
1186                                 break;
1187                         case LDAP_URL_ERR_BADURL:
1188                                 why = "URL is bad";
1189                         case LDAP_URL_ERR_BADHOST:
1190                                 why = "host/port is bad";
1191                                 break;
1192                         case LDAP_URL_ERR_BADATTRS:
1193                                 why = "bad (or missing) attributes";
1194                                 break;
1195                         case LDAP_URL_ERR_BADSCOPE:
1196                                 why = "scope string is invalid (or missing)";
1197                                 break;
1198                         case LDAP_URL_ERR_BADFILTER:
1199                                 why = "bad or missing filter";
1200                                 break;
1201                         case LDAP_URL_ERR_BADEXTS:
1202                                 why = "bad or missing extensions";
1203                                 break;
1204                         default:
1205                                 why = "unknown reason";
1206                                 break;
1207                         }
1208                         fprintf( stderr, "%s: line %d: "
1209                                         "unable to parse uri \"%s\" "
1210                                         "in \"uri <uri>\" line: %s\n",
1211                                         fname, lineno, argv[ 1 ], why );
1212                         return 1;
1213                 }
1214
1215                 for ( i = 0, tmpludp = li->lud;
1216                                 tmpludp;
1217                                 i++, tmpludp = tmpludp->lud_next )
1218                 {
1219                         if ( ( tmpludp->lud_dn != NULL
1220                                                 && tmpludp->lud_dn[0] != '\0' )
1221                                         || tmpludp->lud_attrs != NULL
1222                                         /* || tmpludp->lud_scope != LDAP_SCOPE_DEFAULT */
1223                                         || tmpludp->lud_filter != NULL
1224                                         || tmpludp->lud_exts != NULL )
1225                         {
1226                                 fprintf( stderr, "%s: line %d: "
1227                                                 "warning, only protocol, "
1228                                                 "host and port allowed "
1229                                                 "in \"uri <uri>\" statement "
1230                                                 "for uri #%d of \"%s\"\n",
1231                                                 fname, lineno, i, argv[1] );
1232                         }
1233                 }
1234
1235 #if 0
1236                 for ( i = 0, tmpludp = li->lud;
1237                                 tmpludp;
1238                                 i++, tmpludp = tmpludp->lud_next )
1239                         /* just count */
1240
1241                 urllist = ch_calloc( sizeof( char * ), i + 1 );
1242
1243                 for ( i = 0, tmpludp = li->lud;
1244                                 tmpludp;
1245                                 i++, tmpludp = tmpludp->lud_next )
1246                 {
1247                         LDAPURLDesc     tmplud;
1248                         ber_len_t       oldlen = 0, len;
1249
1250                         tmplud = *tmpludp;
1251                         tmplud.lud_dn = "";
1252                         tmplud.lud_attrs = NULL;
1253                         tmplud.lud_filter = NULL;
1254                         if ( !ldap_is_ldapi_url( tmplud.lud_scheme ) ) {
1255                                 tmplud.lud_exts = NULL;
1256                                 tmplud.lud_crit_exts = 0;
1257                         }
1258
1259                         urllist[ i ]  = ldap_url_desc2str( &tmplud );
1260
1261                         if ( urllist[ i ] == NULL ) {
1262                                 fprintf( stderr, "%s: line %d: "
1263                                         "unable to rebuild uri "
1264                                         "in \"uri <uri>\" statement "
1265                                         "for \"%s\"\n",
1266                                         fname, lineno, argv[ 1 ] );
1267                                 return 1;
1268                         }
1269                 }
1270
1271                 li->url = ldap_charray2str( urllist, " " );
1272                 ldap_charray_free( urllist );
1273 #else
1274                 li->url = ch_strdup( argv[ 1 ] );
1275 #endif
1276
1277         } else if ( strcasecmp( argv[0], "tls" ) == 0 ) {
1278                 if ( argc != 2 ) {
1279                         fprintf( stderr,
1280                 "%s: line %d: \"tls <what>\" needs 1 argument.\n",
1281                                         fname, lineno );
1282                         return( 1 );
1283                 }
1284
1285                 /* none */
1286                 if ( strcasecmp( argv[1], "none" ) == 0 ) {
1287                         li->flags &= ~LDAP_BACK_F_TLS_MASK;
1288
1289                 /* try start tls */
1290                 } else if ( strcasecmp( argv[1], "start" ) == 0 ) {
1291                         li->flags |= LDAP_BACK_F_TLS_USE_MASK;
1292
1293                 /* try start tls */
1294                 } else if ( strcasecmp( argv[1], "try-start" ) == 0 ) {
1295                         li->flags &= ~LDAP_BACK_F_TLS_CRITICAL;
1296                         li->flags |= LDAP_BACK_F_USE_TLS;
1297
1298                 /* propagate start tls */
1299                 } else if ( strcasecmp( argv[1], "propagate" ) == 0 ) {
1300                         li->flags |= LDAP_BACK_F_TLS_PROPAGATE_MASK;
1301
1302                 /* try start tls */
1303                 } else if ( strcasecmp( argv[1], "try-propagate" ) == 0 ) {
1304                         li->flags &= ~LDAP_BACK_F_TLS_CRITICAL;
1305                         li->flags |= LDAP_BACK_F_PROPAGATE_TLS;
1306
1307                 } else {
1308                         fprintf( stderr,
1309                 "%s: line %d: \"tls <what>\": unknown argument \"%s\".\n",
1310                                         fname, lineno, argv[1] );
1311                         return( 1 );
1312                 }
1313
1314         /* remote ACL stuff... */
1315         } else if ( strncasecmp( argv[0], "acl-", STRLENOF( "acl-" ) ) == 0
1316                         || strncasecmp( argv[0], "bind", STRLENOF( "bind" ) ) == 0 )
1317         {
1318                 /* NOTE: "bind{DN,pw}" was initially used; it's now
1319                  * deprected and undocumented, it can be dropped at some
1320                  * point, since nobody should be really using it */
1321                 return parse_acl_auth( be, fname, lineno, argc, argv );
1322
1323         /* identity assertion stuff... */
1324         } else if ( strncasecmp( argv[0], "idassert-", STRLENOF( "idassert-" ) ) == 0
1325                         || strncasecmp( argv[0], "proxyauthz", STRLENOF( "proxyauthz" ) ) == 0 )
1326         {
1327                 /* NOTE: "proxyauthz{DN,pw}" was initially used; it's now
1328                  * deprected and undocumented, it can be dropped at some
1329                  * point, since nobody should be really using it */
1330                 return parse_idassert( be, fname, lineno, argc, argv );
1331
1332         /* save bind creds for referral rebinds? */
1333         } else if ( strcasecmp( argv[0], "rebind-as-user" ) == 0 ) {
1334                 switch ( argc ) {
1335                 case 1:
1336                         fprintf( stderr,
1337         "%s: line %d: \"rebind-as-user {NO|yes}\": use without args is deprecated.\n",
1338                                 fname, lineno );
1339
1340                         li->flags |= LDAP_BACK_F_SAVECRED;
1341                         break;
1342
1343                 case 2:
1344                         if ( strcasecmp( argv[ 1 ], "yes" ) == 0 ) {
1345                                 li->flags |= LDAP_BACK_F_SAVECRED;
1346
1347                         } else if ( strcasecmp( argv[ 1 ], "no" ) == 0 ) {
1348                                 li->flags &= ~LDAP_BACK_F_SAVECRED;
1349
1350                         } else {
1351                                 fprintf( stderr,
1352         "%s: line %d: \"rebind-as-user {NO|yes}\": unknown argument \"%s\".\n",
1353                                         fname, lineno, argv[ 1 ] );
1354                                 return( 1 );
1355                         }
1356                         break;
1357
1358                 default:
1359                         fprintf( stderr,
1360         "%s: line %d: \"rebind-as-user {NO|yes}\" needs 1 argument.\n",
1361                                         fname, lineno );
1362                         return( 1 );
1363                 }
1364
1365         } else if ( strcasecmp( argv[0], "chase-referrals" ) == 0 ) {
1366                 if ( argc != 2 ) {
1367                         fprintf( stderr,
1368         "%s: line %d: \"chase-referrals {YES|no}\" needs 1 argument.\n",
1369                                         fname, lineno );
1370                         return( 1 );
1371                 }
1372
1373                 /* this is the default; we add it because the default might change... */
1374                 if ( strcasecmp( argv[1], "yes" ) == 0 ) {
1375                         li->flags |= LDAP_BACK_F_CHASE_REFERRALS;
1376
1377                 } else if ( strcasecmp( argv[1], "no" ) == 0 ) {
1378                         li->flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
1379
1380                 } else {
1381                         fprintf( stderr,
1382                 "%s: line %d: \"chase-referrals {YES|no}\": unknown argument \"%s\".\n",
1383                                         fname, lineno, argv[1] );
1384                         return( 1 );
1385                 }
1386
1387         } else if ( strcasecmp( argv[ 0 ], "t-f-support" ) == 0 ) {
1388                 if ( argc != 2 ) {
1389                         fprintf( stderr,
1390                 "%s: line %d: \"t-f-support {NO|yes|discover}\" needs 1 argument.\n",
1391                                         fname, lineno );
1392                         return( 1 );
1393                 }
1394
1395                 if ( strcasecmp( argv[ 1 ], "no" ) == 0 ) {
1396                         li->flags &= ~(LDAP_BACK_F_SUPPORT_T_F|LDAP_BACK_F_SUPPORT_T_F_DISCOVER);
1397
1398                 } else if ( strcasecmp( argv[ 1 ], "yes" ) == 0 ) {
1399                         li->flags |= LDAP_BACK_F_SUPPORT_T_F;
1400
1401                 } else if ( strcasecmp( argv[ 1 ], "discover" ) == 0 ) {
1402                         li->flags |= LDAP_BACK_F_SUPPORT_T_F_DISCOVER;
1403
1404                 } else {
1405                         fprintf( stderr,
1406         "%s: line %d: \"t-f-support {NO|yes|discover}\": unknown argument \"%s\".\n",
1407                                 fname, lineno, argv[ 1 ] );
1408                         return 1;
1409                 }
1410
1411         /* intercept exop_who_am_i? */
1412         } else if ( strcasecmp( argv[0], "proxy-whoami" ) == 0 ) {
1413                 int     doload_extop = 0;
1414
1415                 switch ( argc ) {
1416                 case 1:
1417                         fprintf( stderr,
1418         "%s: line %d: \"proxy-whoami {NO|yes}\": use without args is deprecated.\n",
1419                                 fname, lineno );
1420
1421                         doload_extop = 1;
1422                         break;
1423
1424                 case 2:
1425                         if ( strcasecmp( argv[ 1 ], "yes" ) == 0 ) {
1426                                 doload_extop = 1;
1427
1428                         } else if ( strcasecmp( argv[ 1 ], "no" ) != 0 ) {
1429                                 fprintf( stderr,
1430         "%s: line %d: \"proxy-whoami {NO|yes}\": unknown argument \"%s\".\n",
1431                                         fname, lineno, argv[ 1 ] );
1432                                 return( 1 );
1433                         }
1434                         break;
1435
1436                 default:
1437                         fprintf( stderr,
1438         "%s: line %d: \"proxy-whoami {NO|yes}\" needs 1 argument.\n",
1439                                         fname, lineno );
1440                         return( 1 );
1441                 }
1442
1443                 if ( doload_extop ) {
1444                         li->flags |= LDAP_BACK_F_PROXY_WHOAMI;
1445
1446                         load_extop( (struct berval *)&slap_EXOP_WHOAMI,
1447                                         0, ldap_back_exop_whoami );
1448                 }
1449
1450         /* FIXME: legacy: intercept old rewrite/remap directives
1451          * and try to start the rwm overlay */
1452         } else if ( strcasecmp( argv[0], "suffixmassage" ) == 0
1453                         || strcasecmp( argv[0], "map" ) == 0
1454                         || strncasecmp( argv[0], "rewrite", STRLENOF( "rewrite" ) ) == 0 )
1455         {
1456 #if 0
1457                 fprintf( stderr, "%s: line %d: "
1458                         "rewrite/remap capabilities have been moved "
1459                         "to the \"rwm\" overlay; see slapo-rwm(5) "
1460                         "for details.  I'm trying to do my best "
1461                         "to preserve backwards compatibility...\n",
1462                         fname, lineno );
1463
1464                 if ( li->rwm_started == 0 ) {
1465                         if ( overlay_config( be, "rwm" ) ) {
1466                                 fprintf( stderr, "%s: line %d: "
1467                                         "unable to configure the \"rwm\" "
1468                                         "overlay, required by directive "
1469                                         "\"%s\".\n",
1470                                         fname, lineno, argv[0] );
1471 #if SLAPD_OVER_RWM == SLAPD_MOD_DYNAMIC
1472                                 fprintf( stderr, "\thint: try loading the \"rwm.la\" dynamic module.\n" );
1473 #endif /* SLAPD_OVER_RWM == SLAPD_MOD_DYNAMIC */
1474                                 return( 1 );
1475                         }
1476
1477                         fprintf( stderr, "%s: line %d: back-ldap: "
1478                                 "automatically starting \"rwm\" overlay, "
1479                                 "triggered by \"%s\" directive.\n",
1480                                 fname, lineno, argv[ 0 ] );
1481
1482                 /* this is the default; we add it because the default might change... */
1483                         li->rwm_started = 1;
1484
1485                         return ( *be->bd_info->bi_db_config )( be, fname, lineno, argc, argv );
1486                 }
1487 #else
1488                 fprintf( stderr, "%s: line %d: "
1489                         "rewrite/remap capabilities have been moved "
1490                         "to the \"rwm\" overlay; see slapo-rwm(5) "
1491                         "for details (hint: add \"overlay rwm\" "
1492                         "and prefix all directives with \"rwm-\").\n",
1493                         fname, lineno );
1494 #endif
1495
1496                 return 1;
1497
1498         /* anything else */
1499         } else {
1500                 return SLAP_CONF_UNKNOWN;
1501         }
1502
1503         return 0;
1504 }
1505
1506 static int
1507 ldap_back_exop_whoami(
1508                 Operation       *op,
1509                 SlapReply       *rs )
1510 {
1511         struct berval *bv = NULL;
1512
1513         if ( op->oq_extended.rs_reqdata != NULL ) {
1514                 /* no request data should be provided */
1515                 rs->sr_text = "no request data expected";
1516                 return rs->sr_err = LDAP_PROTOCOL_ERROR;
1517         }
1518
1519         rs->sr_err = backend_check_restrictions( op, rs,
1520                         (struct berval *)&slap_EXOP_WHOAMI );
1521         if( rs->sr_err != LDAP_SUCCESS ) return rs->sr_err;
1522
1523         /* if auth'd by back-ldap and request is proxied, forward it */
1524         if ( op->o_conn->c_authz_backend && !strcmp(op->o_conn->c_authz_backend->be_type, "ldap" ) && !dn_match(&op->o_ndn, &op->o_conn->c_ndn)) {
1525                 struct ldapconn *lc;
1526
1527                 LDAPControl c, *ctrls[2] = {NULL, NULL};
1528                 LDAPMessage *res;
1529                 Operation op2 = *op;
1530                 ber_int_t msgid;
1531                 int doretry = 1;
1532
1533                 ctrls[0] = &c;
1534                 op2.o_ndn = op->o_conn->c_ndn;
1535                 lc = ldap_back_getconn(&op2, rs, LDAP_BACK_SENDERR);
1536                 if (!lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR )) {
1537                         return -1;
1538                 }
1539                 c.ldctl_oid = LDAP_CONTROL_PROXY_AUTHZ;
1540                 c.ldctl_iscritical = 1;
1541                 c.ldctl_value.bv_val = ch_malloc(op->o_ndn.bv_len+4);
1542                 c.ldctl_value.bv_len = op->o_ndn.bv_len + 3;
1543                 strcpy(c.ldctl_value.bv_val, "dn:");
1544                 strcpy(c.ldctl_value.bv_val+3, op->o_ndn.bv_val);
1545
1546 retry:
1547                 rs->sr_err = ldap_whoami(lc->lc_ld, ctrls, NULL, &msgid);
1548                 if (rs->sr_err == LDAP_SUCCESS) {
1549                         if (ldap_result(lc->lc_ld, msgid, 1, NULL, &res) == -1) {
1550                                 ldap_get_option(lc->lc_ld, LDAP_OPT_ERROR_NUMBER,
1551                                         &rs->sr_err);
1552                                 if ( rs->sr_err == LDAP_SERVER_DOWN && doretry ) {
1553                                         doretry = 0;
1554                                         if ( ldap_back_retry( lc, op, rs, LDAP_BACK_SENDERR ) )
1555                                                 goto retry;
1556                                 }
1557                                 ldap_back_freeconn( op, lc );
1558                                 lc = NULL;
1559
1560                         } else {
1561                                 rs->sr_err = ldap_parse_whoami(lc->lc_ld, res, &bv);
1562                                 ldap_msgfree(res);
1563                         }
1564                 }
1565                 ch_free(c.ldctl_value.bv_val);
1566                 if (rs->sr_err != LDAP_SUCCESS) {
1567                         rs->sr_err = slap_map_api2result( rs );
1568                 }
1569         } else {
1570         /* else just do the same as before */
1571                 bv = (struct berval *) ch_malloc( sizeof(struct berval) );
1572                 if ( !BER_BVISEMPTY( &op->o_dn ) ) {
1573                         bv->bv_len = op->o_dn.bv_len + sizeof("dn:") - 1;
1574                         bv->bv_val = ch_malloc( bv->bv_len + 1 );
1575                         AC_MEMCPY( bv->bv_val, "dn:", sizeof("dn:") - 1 );
1576                         AC_MEMCPY( &bv->bv_val[sizeof("dn:") - 1], op->o_dn.bv_val,
1577                                 op->o_dn.bv_len );
1578                         bv->bv_val[bv->bv_len] = '\0';
1579                 } else {
1580                         bv->bv_len = 0;
1581                         bv->bv_val = NULL;
1582                 }
1583         }
1584
1585         rs->sr_rspdata = bv;
1586         return rs->sr_err;
1587 }
1588
1589
1590 static int
1591 parse_idassert(
1592     BackendDB   *be,
1593     const char  *fname,
1594     int         lineno,
1595     int         argc,
1596     char        **argv
1597 )
1598 {
1599         struct ldapinfo *li = (struct ldapinfo *) be->be_private;
1600
1601         /* identity assertion mode */
1602         if ( strcasecmp( argv[0], "idassert-mode" ) == 0 ) {
1603                 if ( argc < 2 ) {
1604                         Debug( LDAP_DEBUG_ANY,
1605                                 "%s: line %d: illegal args number %d in \"idassert-mode <args> [<flag> [...]]\" line.\n",
1606                                 fname, lineno, argc );
1607                         return 1;
1608                 }
1609
1610                 if ( strcasecmp( argv[1], "legacy" ) == 0 ) {
1611                         /* will proxyAuthz as client's identity only if bound */
1612                         li->idassert_mode = LDAP_BACK_IDASSERT_LEGACY;
1613
1614                 } else if ( strcasecmp( argv[1], "self" ) == 0 ) {
1615                         /* will proxyAuthz as client's identity */
1616                         li->idassert_mode = LDAP_BACK_IDASSERT_SELF;
1617
1618                 } else if ( strcasecmp( argv[1], "anonymous" ) == 0 ) {
1619                         /* will proxyAuthz as anonymous */
1620                         li->idassert_mode = LDAP_BACK_IDASSERT_ANONYMOUS;
1621
1622                 } else if ( strcasecmp( argv[1], "none" ) == 0 ) {
1623                         /* will not proxyAuthz */
1624                         li->idassert_mode = LDAP_BACK_IDASSERT_NOASSERT;
1625
1626                 } else {
1627                         struct berval   id;
1628                         int             rc;
1629
1630                         /* will proxyAuthz as argv[1] */
1631                         ber_str2bv( argv[1], 0, 0, &id );
1632
1633                         if ( strncasecmp( id.bv_val, "u:", STRLENOF( "u:" ) ) == 0 ) {
1634                                 /* force lowercase... */
1635                                 id.bv_val[0] = 'u';
1636                                 li->idassert_mode = LDAP_BACK_IDASSERT_OTHERID;
1637                                 ber_dupbv( &li->idassert_authzID, &id );
1638
1639                         } else {
1640                                 struct berval   dn;
1641
1642                                 /* default is DN? */
1643                                 if ( strncasecmp( id.bv_val, "dn:", STRLENOF( "dn:" ) ) == 0 ) {
1644                                         id.bv_val += STRLENOF( "dn:" );
1645                                         id.bv_len -= STRLENOF( "dn:" );
1646                                 }
1647
1648                                 rc = dnNormalize( 0, NULL, NULL, &id, &dn, NULL );
1649                                 if ( rc != LDAP_SUCCESS ) {
1650                                         Debug( LDAP_DEBUG_ANY,
1651                                                 "%s: line %d: idassert ID \"%s\" is not a valid DN\n",
1652                                                 fname, lineno, argv[1] );
1653                                         return 1;
1654                                 }
1655
1656                                 li->idassert_authzID.bv_len = STRLENOF( "dn:" ) + dn.bv_len;
1657                                 li->idassert_authzID.bv_val = ch_malloc( li->idassert_authzID.bv_len + 1 );
1658                                 AC_MEMCPY( li->idassert_authzID.bv_val, "dn:", STRLENOF( "dn:" ) );
1659                                 AC_MEMCPY( &li->idassert_authzID.bv_val[ STRLENOF( "dn:" ) ], dn.bv_val, dn.bv_len + 1 );
1660                                 ch_free( dn.bv_val );
1661
1662                                 li->idassert_mode = LDAP_BACK_IDASSERT_OTHERDN;
1663                         }
1664                 }
1665
1666                 for ( argc -= 2, argv += 2; argc--; argv++ ) {
1667                         if ( strcasecmp( argv[0], "override" ) == 0 ) {
1668                                 li->idassert_flags |= LDAP_BACK_AUTH_OVERRIDE;
1669
1670                         } else {
1671                                 Debug( LDAP_DEBUG_ANY,
1672                                         "%s: line %d: unknown flag \"%s\" "
1673                                         "in \"idassert-mode <args> "
1674                                         "[<flags>]\" line.\n",
1675                                         fname, lineno, argv[0] );
1676                                 return 1;
1677                         }
1678                 }
1679
1680         /* name to use for proxyAuthz propagation */
1681         } else if ( strcasecmp( argv[0], "idassert-authcdn" ) == 0
1682                         || strcasecmp( argv[0], "proxyauthzdn" ) == 0 )
1683         {
1684                 struct berval   dn;
1685                 int             rc;
1686
1687                 /* FIXME: "proxyauthzdn" is no longer documented, and
1688                  * temporarily supported for backwards compatibility */
1689
1690                 if ( argc != 2 ) {
1691                         fprintf( stderr,
1692         "%s: line %d: missing name in \"%s <name>\" line\n",
1693                             fname, lineno, argv[0] );
1694                         return( 1 );
1695                 }
1696
1697                 if ( !BER_BVISNULL( &li->idassert_authcDN ) ) {
1698                         fprintf( stderr, "%s: line %d: "
1699                                         "authcDN already defined; replacing...\n",
1700                                         fname, lineno );
1701                         ch_free( li->idassert_authcDN.bv_val );
1702                 }
1703
1704                 ber_str2bv( argv[1], 0, 0, &dn );
1705                 rc = dnNormalize( 0, NULL, NULL, &dn, &li->idassert_authcDN, NULL );
1706                 if ( rc != LDAP_SUCCESS ) {
1707                         Debug( LDAP_DEBUG_ANY,
1708                                 "%s: line %d: idassert ID \"%s\" is not a valid DN\n",
1709                                 fname, lineno, argv[1] );
1710                         return 1;
1711                 }
1712
1713         /* password to use for proxyAuthz propagation */
1714         } else if ( strcasecmp( argv[0], "idassert-passwd" ) == 0
1715                         || strcasecmp( argv[0], "proxyauthzpw" ) == 0 )
1716         {
1717                 /* FIXME: "proxyauthzpw" is no longer documented, and
1718                  * temporarily supported for backwards compatibility */
1719
1720                 if ( argc != 2 ) {
1721                         fprintf( stderr,
1722         "%s: line %d: missing password in \"%s <password>\" line\n",
1723                             fname, lineno, argv[0] );
1724                         return( 1 );
1725                 }
1726
1727                 if ( !BER_BVISNULL( &li->idassert_passwd ) ) {
1728                         fprintf( stderr, "%s: line %d: "
1729                                         "passwd already defined; replacing...\n",
1730                                         fname, lineno );
1731                         ch_free( li->idassert_passwd.bv_val );
1732                 }
1733
1734                 ber_str2bv( argv[1], 0, 1, &li->idassert_passwd );
1735
1736         /* rules to accept identity assertion... */
1737         } else if ( strcasecmp( argv[0], "idassert-authzFrom" ) == 0 ) {
1738                 struct berval   rule;
1739
1740                 ber_str2bv( argv[1], 0, 1, &rule );
1741
1742                 ber_bvarray_add( &li->idassert_authz, &rule );
1743
1744         } else if ( strcasecmp( argv[0], "idassert-method" ) == 0 ) {
1745                 char    *argv1;
1746
1747                 if ( argc < 2 ) {
1748                         fprintf( stderr,
1749         "%s: line %d: missing method in \"%s <method>\" line\n",
1750                             fname, lineno, argv[0] );
1751                         return( 1 );
1752                 }
1753
1754                 argv1 = argv[1];
1755                 if ( strncasecmp( argv1, "bindmethod=", STRLENOF( "bindmethod=" ) ) == 0 ) {
1756                         argv1 += STRLENOF( "bindmethod=" );
1757                 }
1758
1759                 if ( strcasecmp( argv1, "none" ) == 0 ) {
1760                         /* FIXME: is this at all useful? */
1761                         li->idassert_authmethod = LDAP_AUTH_NONE;
1762
1763                         if ( argc != 2 ) {
1764                                 fprintf( stderr,
1765         "%s: line %d: trailing args in \"%s %s ...\" line ignored\"\n",
1766                                         fname, lineno, argv[0], argv[1] );
1767                         }
1768
1769                 } else if ( strcasecmp( argv1, "simple" ) == 0 ) {
1770                         int     arg;
1771
1772                         for ( arg = 2; arg < argc; arg++ ) {
1773                                 if ( strncasecmp( argv[arg], "authcdn=", STRLENOF( "authcdn=" ) ) == 0 ) {
1774                                         char            *val = argv[arg] + STRLENOF( "authcdn=" );
1775                                         struct berval   dn;
1776                                         int             rc;
1777
1778                                         if ( !BER_BVISNULL( &li->idassert_authcDN ) ) {
1779                                                 fprintf( stderr, "%s: line %d: "
1780                                                                 "SASL authcDN already defined; replacing...\n",
1781                                                                 fname, lineno );
1782                                                 ch_free( li->idassert_authcDN.bv_val );
1783                                         }
1784                                         if ( strncasecmp( argv[arg], "dn:", STRLENOF( "dn:" ) ) == 0 ) {
1785                                                 val += STRLENOF( "dn:" );
1786                                         }
1787
1788                                         ber_str2bv( val, 0, 0, &dn );
1789                                         rc = dnNormalize( 0, NULL, NULL, &dn, &li->idassert_authcDN, NULL );
1790                                         if ( rc != LDAP_SUCCESS ) {
1791                                                 Debug( LDAP_DEBUG_ANY,
1792                                                         "%s: line %d: SASL authcdn \"%s\" is not a valid DN\n",
1793                                                         fname, lineno, val );
1794                                                 return 1;
1795                                         }
1796
1797                                 } else if ( strncasecmp( argv[arg], "cred=", STRLENOF( "cred=" ) ) == 0 ) {
1798                                         char    *val = argv[arg] + STRLENOF( "cred=" );
1799
1800                                         if ( !BER_BVISNULL( &li->idassert_passwd ) ) {
1801                                                 fprintf( stderr, "%s: line %d: "
1802                                                                 "SASL cred already defined; replacing...\n",
1803                                                                 fname, lineno );
1804                                                 ch_free( li->idassert_passwd.bv_val );
1805                                         }
1806                                         ber_str2bv( val, 0, 1, &li->idassert_passwd );
1807
1808                                 } else {
1809                                         fprintf( stderr, "%s: line %d: "
1810                                                         "unknown parameter %s\n",
1811                                                         fname, lineno, argv[arg] );
1812                                         return 1;
1813                                 }
1814                         }
1815
1816                         li->idassert_authmethod = LDAP_AUTH_SIMPLE;
1817
1818                 } else if ( strcasecmp( argv1, "sasl" ) == 0 ) {
1819 #ifdef HAVE_CYRUS_SASL
1820                         int     arg;
1821
1822                         for ( arg = 2; arg < argc; arg++ ) {
1823                                 if ( strncasecmp( argv[arg], "mech=", STRLENOF( "mech=" ) ) == 0 ) {
1824                                         char    *val = argv[arg] + STRLENOF( "mech=" );
1825
1826                                         if ( !BER_BVISNULL( &li->idassert_sasl_mech ) ) {
1827                                                 fprintf( stderr, "%s: line %d: "
1828                                                                 "SASL mech already defined; replacing...\n",
1829                                                                 fname, lineno );
1830                                                 ch_free( li->idassert_sasl_mech.bv_val );
1831                                         }
1832                                         ber_str2bv( val, 0, 1, &li->idassert_sasl_mech );
1833
1834                                 } else if ( strncasecmp( argv[arg], "realm=", STRLENOF( "realm=" ) ) == 0 ) {
1835                                         char    *val = argv[arg] + STRLENOF( "realm=" );
1836
1837                                         if ( !BER_BVISNULL( &li->idassert_sasl_realm ) ) {
1838                                                 fprintf( stderr, "%s: line %d: "
1839                                                                 "SASL realm already defined; replacing...\n",
1840                                                                 fname, lineno );
1841                                                 ch_free( li->idassert_sasl_realm.bv_val );
1842                                         }
1843                                         ber_str2bv( val, 0, 1, &li->idassert_sasl_realm );
1844
1845                                 } else if ( strncasecmp( argv[arg], "authcdn=", STRLENOF( "authcdn=" ) ) == 0 ) {
1846                                         char            *val = argv[arg] + STRLENOF( "authcdn=" );
1847                                         struct berval   dn;
1848                                         int             rc;
1849
1850                                         if ( !BER_BVISNULL( &li->idassert_authcDN ) ) {
1851                                                 fprintf( stderr, "%s: line %d: "
1852                                                                 "SASL authcDN already defined; replacing...\n",
1853                                                                 fname, lineno );
1854                                                 ch_free( li->idassert_authcDN.bv_val );
1855                                         }
1856                                         if ( strncasecmp( argv[arg], "dn:", STRLENOF( "dn:" ) ) == 0 ) {
1857                                                 val += STRLENOF( "dn:" );
1858                                         }
1859
1860                                         ber_str2bv( val, 0, 0, &dn );
1861                                         rc = dnNormalize( 0, NULL, NULL, &dn, &li->idassert_authcDN, NULL );
1862                                         if ( rc != LDAP_SUCCESS ) {
1863                                                 Debug( LDAP_DEBUG_ANY,
1864                                                         "%s: line %d: SASL authcdn \"%s\" is not a valid DN\n",
1865                                                         fname, lineno, val );
1866                                                 return 1;
1867                                         }
1868
1869                                 } else if ( strncasecmp( argv[arg], "authcid=", STRLENOF( "authcid=" ) ) == 0 ) {
1870                                         char    *val = argv[arg] + STRLENOF( "authcid=" );
1871
1872                                         if ( !BER_BVISNULL( &li->idassert_authcID ) ) {
1873                                                 fprintf( stderr, "%s: line %d: "
1874                                                                 "SASL authcID already defined; replacing...\n",
1875                                                                 fname, lineno );
1876                                                 ch_free( li->idassert_authcID.bv_val );
1877                                         }
1878                                         if ( strncasecmp( argv[arg], "u:", STRLENOF( "u:" ) ) == 0 ) {
1879                                                 val += STRLENOF( "u:" );
1880                                         }
1881                                         ber_str2bv( val, 0, 1, &li->idassert_authcID );
1882
1883                                 } else if ( strncasecmp( argv[arg], "cred=", STRLENOF( "cred=" ) ) == 0 ) {
1884                                         char    *val = argv[arg] + STRLENOF( "cred=" );
1885
1886                                         if ( !BER_BVISNULL( &li->idassert_passwd ) ) {
1887                                                 fprintf( stderr, "%s: line %d: "
1888                                                                 "SASL cred already defined; replacing...\n",
1889                                                                 fname, lineno );
1890                                                 ch_free( li->idassert_passwd.bv_val );
1891                                         }
1892                                         ber_str2bv( val, 0, 1, &li->idassert_passwd );
1893
1894                                 } else if ( strncasecmp( argv[arg], "authz=", STRLENOF( "authz=" ) ) == 0 ) {
1895                                         char    *val = argv[arg] + STRLENOF( "authz=" );
1896
1897                                         if ( strcasecmp( val, "proxyauthz" ) == 0 ) {
1898                                                 li->idassert_flags &= ~LDAP_BACK_AUTH_NATIVE_AUTHZ;
1899
1900                                         } else if ( strcasecmp( val, "native" ) == 0 ) {
1901                                                 li->idassert_flags |= LDAP_BACK_AUTH_NATIVE_AUTHZ;
1902
1903                                         } else {
1904                                                 fprintf( stderr, "%s: line %d: "
1905                                                         "unknown authz mode \"%s\"\n",
1906                                                         fname, lineno, val );
1907                                                 return 1;
1908                                         }
1909
1910                                 } else {
1911                                         fprintf( stderr, "%s: line %d: "
1912                                                         "unknown SASL parameter %s\n",
1913                                                         fname, lineno, argv[arg] );
1914                                         return 1;
1915                                 }
1916                         }
1917
1918                         li->idassert_authmethod = LDAP_AUTH_SASL;
1919
1920 #else /* !HAVE_CYRUS_SASL */
1921                         fprintf( stderr, "%s: line %d: "
1922                                         "compile --with-cyrus-sasl to enable SASL auth\n",
1923                                         fname, lineno );
1924                         return 1;
1925 #endif /* !HAVE_CYRUS_SASL */
1926
1927                 } else {
1928                         fprintf( stderr, "%s: line %d: "
1929                                         "unhandled idassert-method method %s\n",
1930                                         fname, lineno, argv[1] );
1931                         return 1;
1932                 }
1933
1934         } else {
1935                 return SLAP_CONF_UNKNOWN;
1936         }
1937
1938         return 0;
1939 }
1940
1941 static int
1942 parse_acl_auth(
1943     BackendDB   *be,
1944     const char  *fname,
1945     int         lineno,
1946     int         argc,
1947     char        **argv
1948 )
1949 {
1950         struct ldapinfo *li = (struct ldapinfo *) be->be_private;
1951
1952         /* name to use for remote ACL access */
1953         if ( strcasecmp( argv[0], "acl-authcdn" ) == 0
1954                         || strcasecmp( argv[0], "binddn" ) == 0 )
1955         {
1956                 struct berval   dn;
1957                 int             rc;
1958
1959                 /* FIXME: "binddn" is no longer documented, and
1960                  * temporarily supported for backwards compatibility */
1961
1962                 if ( argc != 2 ) {
1963                         fprintf( stderr,
1964         "%s: line %d: missing name in \"%s <name>\" line\n",
1965                             fname, lineno, argv[0] );
1966                         return( 1 );
1967                 }
1968
1969                 if ( !BER_BVISNULL( &li->acl_authcDN ) ) {
1970                         fprintf( stderr, "%s: line %d: "
1971                                         "authcDN already defined; replacing...\n",
1972                                         fname, lineno );
1973                         ch_free( li->acl_authcDN.bv_val );
1974                 }
1975
1976                 ber_str2bv( argv[1], 0, 0, &dn );
1977                 rc = dnNormalize( 0, NULL, NULL, &dn, &li->acl_authcDN, NULL );
1978                 if ( rc != LDAP_SUCCESS ) {
1979                         Debug( LDAP_DEBUG_ANY,
1980                                 "%s: line %d: acl ID \"%s\" is not a valid DN\n",
1981                                 fname, lineno, argv[1] );
1982                         return 1;
1983                 }
1984
1985         /* password to use for remote ACL access */
1986         } else if ( strcasecmp( argv[0], "acl-passwd" ) == 0
1987                         || strcasecmp( argv[0], "bindpw" ) == 0 )
1988         {
1989                 /* FIXME: "bindpw" is no longer documented, and
1990                  * temporarily supported for backwards compatibility */
1991
1992                 if ( argc != 2 ) {
1993                         fprintf( stderr,
1994         "%s: line %d: missing password in \"%s <password>\" line\n",
1995                             fname, lineno, argv[0] );
1996                         return( 1 );
1997                 }
1998
1999                 if ( !BER_BVISNULL( &li->acl_passwd ) ) {
2000                         fprintf( stderr, "%s: line %d: "
2001                                         "passwd already defined; replacing...\n",
2002                                         fname, lineno );
2003                         ch_free( li->acl_passwd.bv_val );
2004                 }
2005
2006                 ber_str2bv( argv[1], 0, 1, &li->acl_passwd );
2007
2008         } else if ( strcasecmp( argv[0], "acl-method" ) == 0 ) {
2009                 char    *argv1;
2010
2011                 if ( argc < 2 ) {
2012                         fprintf( stderr,
2013         "%s: line %d: missing method in \"%s <method>\" line\n",
2014                             fname, lineno, argv[0] );
2015                         return( 1 );
2016                 }
2017
2018                 argv1 = argv[1];
2019                 if ( strncasecmp( argv1, "bindmethod=", STRLENOF( "bindmethod=" ) ) == 0 ) {
2020                         argv1 += STRLENOF( "bindmethod=" );
2021                 }
2022
2023                 if ( strcasecmp( argv1, "none" ) == 0 ) {
2024                         /* FIXME: is this at all useful? */
2025                         li->acl_authmethod = LDAP_AUTH_NONE;
2026
2027                         if ( argc != 2 ) {
2028                                 fprintf( stderr,
2029         "%s: line %d: trailing args in \"%s %s ...\" line ignored\"\n",
2030                                         fname, lineno, argv[0], argv[1] );
2031                         }
2032
2033                 } else if ( strcasecmp( argv1, "simple" ) == 0 ) {
2034                         li->acl_authmethod = LDAP_AUTH_SIMPLE;
2035
2036                         if ( argc != 2 ) {
2037                                 fprintf( stderr,
2038         "%s: line %d: trailing args in \"%s %s ...\" line ignored\"\n",
2039                                         fname, lineno, argv[0], argv[1] );
2040                         }
2041
2042                 } else if ( strcasecmp( argv1, "sasl" ) == 0 ) {
2043 #ifdef HAVE_CYRUS_SASL
2044                         int     arg;
2045
2046                         for ( arg = 2; arg < argc; arg++ ) {
2047                                 if ( strncasecmp( argv[arg], "mech=", STRLENOF( "mech=" ) ) == 0 ) {
2048                                         char    *val = argv[arg] + STRLENOF( "mech=" );
2049
2050                                         if ( !BER_BVISNULL( &li->acl_sasl_mech ) ) {
2051                                                 fprintf( stderr, "%s: line %d: "
2052                                                                 "SASL mech already defined; replacing...\n",
2053                                                                 fname, lineno );
2054                                                 ch_free( li->acl_sasl_mech.bv_val );
2055                                         }
2056                                         ber_str2bv( val, 0, 1, &li->acl_sasl_mech );
2057
2058                                 } else if ( strncasecmp( argv[arg], "realm=", STRLENOF( "realm=" ) ) == 0 ) {
2059                                         char    *val = argv[arg] + STRLENOF( "realm=" );
2060
2061                                         if ( !BER_BVISNULL( &li->acl_sasl_realm ) ) {
2062                                                 fprintf( stderr, "%s: line %d: "
2063                                                                 "SASL realm already defined; replacing...\n",
2064                                                                 fname, lineno );
2065                                                 ch_free( li->acl_sasl_realm.bv_val );
2066                                         }
2067                                         ber_str2bv( val, 0, 1, &li->acl_sasl_realm );
2068
2069                                 } else if ( strncasecmp( argv[arg], "authcdn=", STRLENOF( "authcdn=" ) ) == 0 ) {
2070                                         char            *val = argv[arg] + STRLENOF( "authcdn=" );
2071                                         struct berval   dn;
2072                                         int             rc;
2073
2074                                         if ( !BER_BVISNULL( &li->acl_authcDN ) ) {
2075                                                 fprintf( stderr, "%s: line %d: "
2076                                                                 "SASL authcDN already defined; replacing...\n",
2077                                                                 fname, lineno );
2078                                                 ch_free( li->acl_authcDN.bv_val );
2079                                         }
2080                                         if ( strncasecmp( argv[arg], "dn:", STRLENOF( "dn:" ) ) == 0 ) {
2081                                                 val += STRLENOF( "dn:" );
2082                                         }
2083
2084                                         ber_str2bv( val, 0, 0, &dn );
2085                                         rc = dnNormalize( 0, NULL, NULL, &dn, &li->acl_authcDN, NULL );
2086                                         if ( rc != LDAP_SUCCESS ) {
2087                                                 Debug( LDAP_DEBUG_ANY,
2088                                                         "%s: line %d: SASL authcdn \"%s\" is not a valid DN\n",
2089                                                         fname, lineno, val );
2090                                                 return 1;
2091                                         }
2092
2093                                 } else if ( strncasecmp( argv[arg], "authcid=", STRLENOF( "authcid=" ) ) == 0 ) {
2094                                         char    *val = argv[arg] + STRLENOF( "authcid=" );
2095
2096                                         if ( !BER_BVISNULL( &li->acl_authcID ) ) {
2097                                                 fprintf( stderr, "%s: line %d: "
2098                                                                 "SASL authcID already defined; replacing...\n",
2099                                                                 fname, lineno );
2100                                                 ch_free( li->acl_authcID.bv_val );
2101                                         }
2102                                         if ( strncasecmp( argv[arg], "u:", STRLENOF( "u:" ) ) == 0 ) {
2103                                                 val += STRLENOF( "u:" );
2104                                         }
2105                                         ber_str2bv( val, 0, 1, &li->acl_authcID );
2106
2107                                 } else if ( strncasecmp( argv[arg], "cred=", STRLENOF( "cred=" ) ) == 0 ) {
2108                                         char    *val = argv[arg] + STRLENOF( "cred=" );
2109
2110                                         if ( !BER_BVISNULL( &li->acl_passwd ) ) {
2111                                                 fprintf( stderr, "%s: line %d: "
2112                                                                 "SASL cred already defined; replacing...\n",
2113                                                                 fname, lineno );
2114                                                 ch_free( li->acl_passwd.bv_val );
2115                                         }
2116                                         ber_str2bv( val, 0, 1, &li->acl_passwd );
2117
2118                                 } else {
2119                                         fprintf( stderr, "%s: line %d: "
2120                                                         "unknown SASL parameter %s\n",
2121                                                         fname, lineno, argv[arg] );
2122                                         return 1;
2123                                 }
2124                         }
2125
2126                         li->acl_authmethod = LDAP_AUTH_SASL;
2127
2128 #else /* !HAVE_CYRUS_SASL */
2129                         fprintf( stderr, "%s: line %d: "
2130                                         "compile --with-cyrus-sasl to enable SASL auth\n",
2131                                         fname, lineno );
2132                         return 1;
2133 #endif /* !HAVE_CYRUS_SASL */
2134
2135                 } else {
2136                         fprintf( stderr, "%s: line %d: "
2137                                         "unhandled acl-method method %s\n",
2138                                         fname, lineno, argv[1] );
2139                         return 1;
2140                 }
2141
2142         } else {
2143                 return SLAP_CONF_UNKNOWN;
2144         }
2145
2146         return 0;
2147 }
2148