git.sur5r.net Git - openldap/blob - servers/slapd/back-ldap/group.c

   1 /* group.c - ldap backend acl group routine */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/socket.h>
  13 #include <ac/string.h>
  14
  15 #include "slap.h"
  16 #include "back-ldap.h"
  17
  18
  19 /* return 0 IFF op_dn is a value in group_at (member) attribute
  20  * of entry with gr_dn AND that entry has an objectClass
  21  * value of group_oc (groupOfNames)
  22  */
  23 int
  24 ldap_back_group(
  25         Backend         *be,
  26         Connection      *conn,
  27         Operation       *op,
  28         Entry           *target,
  29         struct berval   *gr_ndn,
  30         struct berval   *op_ndn,
  31         ObjectClass     *group_oc,
  32         AttributeDescription* group_at
  33 )
  34 {
  35         struct ldapinfo *li = (struct ldapinfo *) be->be_private;
  36         int rc = 1;
  37         Attribute   *attr;
  38
  39         LDAPMessage     *result;
  40         char *gattr[2];
  41         char *filter = NULL;
  42         LDAP *ld;
  43         char *mop_ndn, *mgr_ndn;
  44
  45         AttributeDescription *ad_objectClass = slap_schema.si_ad_objectClass;
  46         char *group_oc_name = NULL;
  47         char *group_at_name = group_at->ad_cname.bv_val;
  48
  49         if( group_oc->soc_names && group_oc->soc_names[0] ) {
  50                 group_oc_name = group_oc->soc_names[0];
  51         } else {
  52                 group_oc_name = group_oc->soc_oid;
  53         }
  54
  55         if (target != NULL && strcmp(target->e_ndn, gr_ndn->bv_val) == 0) {
  56                 /* we already have a copy of the entry */
  57                 /* attribute and objectclass mapping has already been done */
  58
  59                 /*
  60                  * first we need to check if the objectClass attribute
  61                  * has been retieved; otherwise we need to repeat the search
  62                  */
  63                 attr = attr_find( target->e_attrs, ad_objectClass );
  64                 if ( attr != NULL ) {
  65
  66                         /*
  67                          * Now we can check for the group objectClass value
  68                          */
  69                         if( !is_entry_objectclass( target, group_oc ) ) {
  70                                 return(1);
  71                         }
  72
  73                         /*
  74                          * This part has been reworked: the group attr compare
  75                          * fails only if the attribute is PRESENT but the value
  76                          * is NOT PRESENT; if the attribute is NOT PRESENT, the
  77                          * search must be repeated as well.
  78                          * This may happen if a search for an entry has already
  79                          * been performed (target is not null) but the group
  80                          * attribute has not been required
  81                          */
  82                         if ((attr = attr_find(target->e_attrs, group_at)) != NULL) {
  83                                 if( value_find( group_at, attr->a_vals, op_ndn ) != LDAP_SUCCESS  )
  84                                         return(1);
  85                                 return(0);
  86                         } /* else: repeat the search */
  87                 } /* else: repeat the search */
  88         } /* else: do the search */
  89
  90         /*
  91          * Rewrite the op ndn if needed
  92          */
  93 #ifdef ENABLE_REWRITE
  94         switch ( rewrite_session( li->rwinfo, "bindDn",
  95                                 op_ndn->bv_val, conn, &mop_ndn ) ) {
  96         case REWRITE_REGEXEC_OK:
  97                 if ( mop_ndn == NULL ) {
  98                         mop_ndn = ( char * )op_ndn->bv_val;
  99                 }
 100 #ifdef NEW_LOGGING
 101                 LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 102                                 "[rw] bindDn (op ndn in group):"
 103                                 " \"%s\" -> \"%s\"\n", op_ndn->bv_val, mop_ndn ));
 104 #else /* !NEW_LOGGING */
 105                 Debug( LDAP_DEBUG_ARGS,
 106                         "rw> bindDn (op ndn in group): \"%s\" -> \"%s\"\n%s",
 107                         op_ndn->bv_val, mop_ndn, "" );
 108 #endif /* !NEW_LOGGING */
 109                 break;
 110
 111         case REWRITE_REGEXEC_UNWILLING:
 112
 113         case REWRITE_REGEXEC_ERR:
 114                 goto cleanup;
 115         }
 116
 117         /*
 118          * Rewrite the gr ndn if needed
 119          */
 120         switch ( rewrite_session( li->rwinfo, "searchBase",
 121                                 gr_ndn->bv_val, conn, &mgr_ndn ) ) {
 122         case REWRITE_REGEXEC_OK:
 123                 if ( mgr_ndn == NULL ) {
 124                         mgr_ndn = ( char * )gr_ndn->bv_val;
 125                 }
 126 #ifdef NEW_LOGGING
 127                 LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
 128                                 "[rw] searchBase (gr ndn in group):"
 129                                 " \"%s\" -> \"%s\"\n%s", gr_ndn->bv_val, mgr_ndn ));
 130 #else /* !NEW_LOGGING */
 131                 Debug( LDAP_DEBUG_ARGS,
 132                         "rw> searchBase (gr ndn in group):"
 133                         " \"%s\" -> \"%s\"\n%s",
 134                         gr_ndn->bv_val, mgr_ndn, "" );
 135 #endif /* !NEW_LOGGING */
 136                 break;
 137
 138         case REWRITE_REGEXEC_UNWILLING:
 139
 140         case REWRITE_REGEXEC_ERR:
 141                 goto cleanup;
 142         }
 143 #else /* !ENABLE_REWRITE */
 144         mop_ndn = ldap_back_dn_massage( li, ch_strdup( op_ndn ), 1 );
 145         if ( mop_ndn == NULL ) {
 146                 goto cleanup;
 147         }
 148         mgr_ndn = ldap_back_dn_massage( li, ch_strdup( gr_ndn ), 1 );
 149         if ( mgr_ndn == NULL ) {
 150                 goto cleanup;
 151         }
 152 #endif /* !ENABLE_REWRITE */
 153
 154         group_oc_name = ldap_back_map(&li->oc_map, group_oc_name, 0);
 155         if (group_oc_name == NULL)
 156                 goto cleanup;
 157         group_at_name = ldap_back_map(&li->at_map, group_at_name, 0);
 158         if (group_at_name == NULL)
 159                 goto cleanup;
 160
 161         filter = ch_malloc(sizeof("(&(objectclass=)(=))")
 162                                                 + strlen(group_oc_name)
 163                                                 + strlen(group_at_name)
 164                                                 + strlen(mop_ndn) + 1);
 165         if (filter == NULL)
 166                 goto cleanup;
 167
 168         if (ldap_initialize(&ld, li->url) != LDAP_SUCCESS) {
 169                 goto cleanup;
 170         }
 171
 172         if (ldap_bind_s(ld, li->binddn, li->bindpw, LDAP_AUTH_SIMPLE)
 173                         != LDAP_SUCCESS) {
 174                 goto cleanup;
 175         }
 176
 177         strcpy(filter, "(&(objectclass=");
 178         strcat(filter, group_oc_name);
 179         strcat(filter, ")(");
 180         strcat(filter, group_at_name);
 181         strcat(filter, "=");
 182         strcat(filter, mop_ndn);
 183         strcat(filter, "))");
 184
 185         gattr[0] = "objectclass";
 186         gattr[1] = NULL;
 187         if (ldap_search_ext_s(ld, mgr_ndn, LDAP_SCOPE_BASE, filter,
 188                 gattr, 0, NULL, NULL, LDAP_NO_LIMIT,
 189                 LDAP_NO_LIMIT, &result) == LDAP_SUCCESS) {
 190                 if (ldap_first_entry(ld, result) != NULL)
 191                         rc = 0;
 192                 ldap_msgfree(result);
 193         }
 194
 195 cleanup:;
 196         if ( ld != NULL ) {
 197                 ldap_unbind(ld);
 198         }
 199         ch_free(filter);
 200 #ifdef ENABLE_REWRITE
 201         if ( mop_ndn != op_ndn->bv_val ) {
 202 #endif /* ENABLE_REWRITE */
 203                 free( mop_ndn );
 204 #ifdef ENABLE_REWRITE
 205         }
 206         if ( mgr_ndn != gr_ndn->bv_val ) {
 207 #endif /* ENABLE_REWRITE */
 208                 free( mgr_ndn );
 209 #ifdef ENABLE_REWRITE
 210         }
 211 #endif /* ENABLE_REWRITE */
 212         return(rc);
 213 }
 214