1 /* group.c - ldap backend acl group routine */
4 * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
5 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
12 #include <ac/socket.h>
13 #include <ac/string.h>
16 #include "back-ldap.h"
19 /* return 0 IFF op_dn is a value in group_at (member) attribute
20 * of entry with gr_dn AND that entry has an objectClass
21 * value of group_oc (groupOfNames)
29 struct berval *gr_ndn,
30 struct berval *op_ndn,
31 ObjectClass *group_oc,
32 AttributeDescription* group_at
35 struct ldapinfo *li = (struct ldapinfo *) be->be_private;
41 char *filter = NULL, *ptr;
43 struct berval mop_ndn = { 0, NULL }, mgr_ndn = { 0, NULL };
45 AttributeDescription *ad_objectClass = slap_schema.si_ad_objectClass;
46 struct berval group_oc_name = {0, NULL};
47 struct berval group_at_name = group_at->ad_cname;
49 if( group_oc->soc_names && group_oc->soc_names[0] ) {
50 group_oc_name.bv_val = group_oc->soc_names[0];
52 group_oc_name.bv_val = group_oc->soc_oid;
54 if (group_oc_name.bv_val)
55 group_oc_name.bv_len = strlen(group_oc_name.bv_val);
57 if (target != NULL && dn_match( &target->e_nname, gr_ndn ) ) {
58 /* we already have a copy of the entry */
59 /* attribute and objectclass mapping has already been done */
62 * first we need to check if the objectClass attribute
63 * has been retieved; otherwise we need to repeat the search
65 attr = attr_find( target->e_attrs, ad_objectClass );
69 * Now we can check for the group objectClass value
71 if( !is_entry_objectclass( target, group_oc, 0 ) ) {
76 * This part has been reworked: the group attr compare
77 * fails only if the attribute is PRESENT but the value
78 * is NOT PRESENT; if the attribute is NOT PRESENT, the
79 * search must be repeated as well.
80 * This may happen if a search for an entry has already
81 * been performed (target is not null) but the group
82 * attribute has not been required
84 if ((attr = attr_find(target->e_attrs, group_at)) != NULL) {
85 if( value_find_ex( group_at, SLAP_MR_VALUE_NORMALIZED_MATCH,
86 attr->a_vals, op_ndn ) != LDAP_SUCCESS )
89 } /* else: repeat the search */
90 } /* else: repeat the search */
91 } /* else: do the search */
94 * Rewrite the op ndn if needed
97 switch ( rewrite_session( li->rwinfo, "bindDn",
98 op_ndn->bv_val, conn, &mop_ndn.bv_val ) ) {
99 case REWRITE_REGEXEC_OK:
100 if ( mop_ndn.bv_val == NULL ) {
104 LDAP_LOG( BACK_LDAP, DETAIL1,
105 "[rw] bindDn (op ndn in group): \"%s\" -> \"%s\"\n",
106 op_ndn->bv_val, mop_ndn.bv_val, 0 );
107 #else /* !NEW_LOGGING */
108 Debug( LDAP_DEBUG_ARGS,
109 "rw> bindDn (op ndn in group): \"%s\" -> \"%s\"\n%s",
110 op_ndn->bv_val, mop_ndn.bv_val, "" );
111 #endif /* !NEW_LOGGING */
114 case REWRITE_REGEXEC_UNWILLING:
116 case REWRITE_REGEXEC_ERR:
121 * Rewrite the gr ndn if needed
123 switch ( rewrite_session( li->rwinfo, "searchBase",
124 gr_ndn->bv_val, conn, &mgr_ndn.bv_val ) ) {
125 case REWRITE_REGEXEC_OK:
126 if ( mgr_ndn.bv_val == NULL ) {
130 LDAP_LOG( BACK_LDAP, DETAIL1,
131 "[rw] searchBase (gr ndn in group): \"%s\" -> \"%s\"\n%s",
132 gr_ndn->bv_val, mgr_ndn.bv_val, "" );
133 #else /* !NEW_LOGGING */
134 Debug( LDAP_DEBUG_ARGS,
135 "rw> searchBase (gr ndn in group):"
136 " \"%s\" -> \"%s\"\n%s",
137 gr_ndn->bv_val, mgr_ndn.bv_val, "" );
138 #endif /* !NEW_LOGGING */
141 case REWRITE_REGEXEC_UNWILLING:
143 case REWRITE_REGEXEC_ERR:
146 #else /* !ENABLE_REWRITE */
147 ldap_back_dn_massage( li, op_ndn, &mop_ndn, 1, 1 );
148 if ( mop_ndn.bv_val == NULL ) {
151 ldap_back_dn_massage( li, gr_ndn, &mgr_ndn, 1, 1 );
152 if ( mgr_ndn.bv_val == NULL ) {
155 #endif /* !ENABLE_REWRITE */
157 ldap_back_map(&li->oc_map, &group_oc_name, &group_oc_name,
159 if (group_oc_name.bv_val == NULL || group_oc_name.bv_val[0] == '\0')
161 ldap_back_map(&li->at_map, &group_at_name, &group_at_name,
163 if (group_at_name.bv_val == NULL || group_at_name.bv_val[0] == '\0')
166 filter = ch_malloc(sizeof("(&(objectclass=)(=))")
167 + group_oc_name.bv_len
168 + group_at_name.bv_len
169 + mop_ndn.bv_len + 1);
173 if (ldap_initialize(&ld, li->url) != LDAP_SUCCESS) {
177 if (ldap_bind_s(ld, li->binddn, li->bindpw, LDAP_AUTH_SIMPLE)
182 ptr = lutil_strcopy(filter, "(&(objectclass=");
183 ptr = lutil_strcopy(ptr, group_oc_name.bv_val);
184 ptr = lutil_strcopy(ptr, ")(");
185 ptr = lutil_strcopy(ptr, group_at_name.bv_val);
186 ptr = lutil_strcopy(ptr, "=");
187 ptr = lutil_strcopy(ptr, mop_ndn.bv_val);
190 gattr[0] = "objectclass";
192 if (ldap_search_ext_s(ld, mgr_ndn.bv_val, LDAP_SCOPE_BASE, filter,
193 gattr, 0, NULL, NULL, LDAP_NO_LIMIT,
194 LDAP_NO_LIMIT, &result) == LDAP_SUCCESS) {
195 if (ldap_first_entry(ld, result) != NULL)
197 ldap_msgfree(result);
205 if ( mop_ndn.bv_val != op_ndn->bv_val ) {
206 free( mop_ndn.bv_val );
208 if ( mgr_ndn.bv_val != gr_ndn->bv_val ) {
209 free( mgr_ndn.bv_val );