1 /* group.c - ldap backend acl group routine */
4 * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved.
5 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
12 #include <ac/socket.h>
13 #include <ac/string.h>
16 #include "back-ldap.h"
19 /* return 0 IFF op_dn is a value in group_at (member) attribute
20 * of entry with gr_dn AND that entry has an objectClass
21 * value of group_oc (groupOfNames)
29 struct berval *gr_ndn,
30 struct berval *op_ndn,
31 ObjectClass *group_oc,
32 AttributeDescription* group_at
35 struct ldapinfo *li = (struct ldapinfo *) be->be_private;
43 char *mop_ndn, *mgr_ndn;
45 AttributeDescription *ad_objectClass = slap_schema.si_ad_objectClass;
46 char *group_oc_name = NULL;
47 char *group_at_name = group_at->ad_cname.bv_val;
49 if( group_oc->soc_names && group_oc->soc_names[0] ) {
50 group_oc_name = group_oc->soc_names[0];
52 group_oc_name = group_oc->soc_oid;
55 if (target != NULL && strcmp(target->e_ndn, gr_ndn->bv_val) == 0) {
56 /* we already have a copy of the entry */
57 /* attribute and objectclass mapping has already been done */
60 * first we need to check if the objectClass attribute
61 * has been retieved; otherwise we need to repeat the search
63 attr = attr_find( target->e_attrs, ad_objectClass );
67 * Now we can check for the group objectClass value
69 if( !is_entry_objectclass( target, group_oc ) ) {
74 * This part has been reworked: the group attr compare
75 * fails only if the attribute is PRESENT but the value
76 * is NOT PRESENT; if the attribute is NOT PRESENT, the
77 * search must be repeated as well.
78 * This may happen if a search for an entry has already
79 * been performed (target is not null) but the group
80 * attribute has not been required
82 if ((attr = attr_find(target->e_attrs, group_at)) != NULL) {
83 if( value_find( group_at, attr->a_vals, op_ndn ) != LDAP_SUCCESS )
86 } /* else: repeat the search */
87 } /* else: repeat the search */
88 } /* else: do the search */
91 * Rewrite the op ndn if needed
94 switch ( rewrite_session( li->rwinfo, "bindDn",
95 op_ndn->bv_val, conn, &mop_ndn ) ) {
96 case REWRITE_REGEXEC_OK:
97 if ( mop_ndn == NULL ) {
98 mop_ndn = ( char * )op_ndn->bv_val;
101 LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
102 "[rw] bindDn (op ndn in group):"
103 " \"%s\" -> \"%s\"\n", op_ndn->bv_val, mop_ndn ));
104 #else /* !NEW_LOGGING */
105 Debug( LDAP_DEBUG_ARGS,
106 "rw> bindDn (op ndn in group): \"%s\" -> \"%s\"\n%s",
107 op_ndn->bv_val, mop_ndn, "" );
108 #endif /* !NEW_LOGGING */
111 case REWRITE_REGEXEC_UNWILLING:
113 case REWRITE_REGEXEC_ERR:
118 * Rewrite the gr ndn if needed
120 switch ( rewrite_session( li->rwinfo, "searchBase",
121 gr_ndn->bv_val, conn, &mgr_ndn ) ) {
122 case REWRITE_REGEXEC_OK:
123 if ( mgr_ndn == NULL ) {
124 mgr_ndn = ( char * )gr_ndn->bv_val;
127 LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
128 "[rw] searchBase (gr ndn in group):"
129 " \"%s\" -> \"%s\"\n%s", gr_ndn->bv_val, mgr_ndn ));
130 #else /* !NEW_LOGGING */
131 Debug( LDAP_DEBUG_ARGS,
132 "rw> searchBase (gr ndn in group):"
133 " \"%s\" -> \"%s\"\n%s",
134 gr_ndn->bv_val, mgr_ndn, "" );
135 #endif /* !NEW_LOGGING */
138 case REWRITE_REGEXEC_UNWILLING:
140 case REWRITE_REGEXEC_ERR:
143 #else /* !ENABLE_REWRITE */
144 mop_ndn = ldap_back_dn_massage( li, ch_strdup( op_ndn ), 1 );
145 if ( mop_ndn == NULL ) {
148 mgr_ndn = ldap_back_dn_massage( li, ch_strdup( gr_ndn ), 1 );
149 if ( mgr_ndn == NULL ) {
152 #endif /* !ENABLE_REWRITE */
154 group_oc_name = ldap_back_map(&li->oc_map, group_oc_name, 0);
155 if (group_oc_name == NULL)
157 group_at_name = ldap_back_map(&li->at_map, group_at_name, 0);
158 if (group_at_name == NULL)
161 filter = ch_malloc(sizeof("(&(objectclass=)(=))")
162 + strlen(group_oc_name)
163 + strlen(group_at_name)
164 + strlen(mop_ndn) + 1);
168 if (ldap_initialize(&ld, li->url) != LDAP_SUCCESS) {
172 if (ldap_bind_s(ld, li->binddn, li->bindpw, LDAP_AUTH_SIMPLE)
177 strcpy(filter, "(&(objectclass=");
178 strcat(filter, group_oc_name);
179 strcat(filter, ")(");
180 strcat(filter, group_at_name);
182 strcat(filter, mop_ndn);
183 strcat(filter, "))");
185 gattr[0] = "objectclass";
187 if (ldap_search_ext_s(ld, mgr_ndn, LDAP_SCOPE_BASE, filter,
188 gattr, 0, NULL, NULL, LDAP_NO_LIMIT,
189 LDAP_NO_LIMIT, &result) == LDAP_SUCCESS) {
190 if (ldap_first_entry(ld, result) != NULL)
192 ldap_msgfree(result);
200 #ifdef ENABLE_REWRITE
201 if ( mop_ndn != op_ndn->bv_val ) {
202 #endif /* ENABLE_REWRITE */
204 #ifdef ENABLE_REWRITE
206 if ( mgr_ndn != gr_ndn->bv_val ) {
207 #endif /* ENABLE_REWRITE */
209 #ifdef ENABLE_REWRITE
211 #endif /* ENABLE_REWRITE */