2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
4 * Copyright 1999-2005 The OpenLDAP Foundation.
5 * Portions Copyright 2001-2003 Pierangelo Masarati.
6 * Portions Copyright 1999-2003 Howard Chu.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by the Howard Chu for inclusion
19 * in OpenLDAP Software and subsequently enhanced by Pierangelo
27 #include <ac/socket.h>
28 #include <ac/string.h>
33 #include "../back-ldap/back-ldap.h"
34 #include "back-meta.h"
36 static LDAP_REBIND_PROC meta_back_rebind;
39 meta_back_do_single_bind(
47 meta_back_bind( Operation *op, SlapReply *rs )
49 struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
52 int rc = -1, i, gotit = 0, ndnlen, isroot = 0;
53 int op_type = META_OP_ALLOW_MULTIPLE;
55 rs->sr_err = LDAP_SUCCESS;
57 Debug( LDAP_DEBUG_ARGS, "meta_back_bind: dn: %s.\n%s%s",
58 op->o_req_dn.bv_val, "", "" );
60 if ( op->orb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op ) ) {
62 ber_dupbv( &op->orb_edn, be_root_dn( op->o_bd ) );
63 op_type = META_OP_REQUIRE_ALL;
65 lc = meta_back_getconn( op, rs, op_type,
66 &op->o_req_ndn, NULL );
68 Debug( LDAP_DEBUG_ANY,
69 "meta_back_bind: no target for dn %s.\n%s%s",
70 op->o_req_dn.bv_val, "", "");
72 send_ldap_result( op, rs );
77 * Each target is scanned ...
79 lc->mc_bound_target = META_BOUND_NONE;
80 ndnlen = op->o_req_ndn.bv_len;
81 for ( i = 0; i < li->ntargets; i++ ) {
83 struct berval orig_dn = op->o_req_dn;
84 struct berval orig_ndn = op->o_req_ndn;
85 struct berval orig_cred = op->orb_cred;
86 int orig_method = op->orb_method;
92 if ( lc->mc_conns[ i ].msc_candidate != META_CANDIDATE ) {
100 * A bind operation is expected to have
101 * ONE CANDIDATE ONLY!
103 Debug( LDAP_DEBUG_ANY,
104 "==>meta_back_bind: more than one"
105 " candidate is attempting to bind"
110 if ( isroot && li->targets[ i ]->mt_pseudorootdn.bv_val != NULL ) {
111 op->o_req_dn = li->targets[ i ]->mt_pseudorootdn;
112 op->o_req_ndn = li->targets[ i ]->mt_pseudorootdn;
113 op->orb_cred = li->targets[ i ]->mt_pseudorootpw;
114 op->orb_method = LDAP_AUTH_SIMPLE;
117 lerr = meta_back_do_single_bind( lc, op, rs, i );
118 if ( lerr != LDAP_SUCCESS ) {
120 ( void )meta_clear_one_candidate( &lc->mc_conns[ i ], 1 );
126 op->o_req_dn = orig_dn;
127 op->o_req_ndn = orig_ndn;
128 op->orb_cred = orig_cred;
129 op->orb_method = orig_method;
133 lc->mc_bound_target = META_BOUND_ALL;
137 * rc is LDAP_SUCCESS if at least one bind succeeded,
138 * err is the last error that occurred during a bind;
139 * if at least (and at most?) one bind succeedes, fine.
141 if ( rc != LDAP_SUCCESS /* && rs->sr_err != LDAP_SUCCESS */ ) {
144 * deal with bind failure ...
148 * no target was found within the naming context,
149 * so bind must fail with invalid credentials
151 if ( rs->sr_err == LDAP_SUCCESS && gotit == 0 ) {
152 rs->sr_err = LDAP_INVALID_CREDENTIALS;
155 rs->sr_err = slap_map_api2result( rs );
156 send_ldap_result( op, rs );
164 * meta_back_do_single_bind
166 * attempts to perform a bind with creds
169 meta_back_do_single_bind(
176 struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
177 struct berval mdn = BER_BVNULL;
179 struct metasingleconn *lsc = &lc->mc_conns[ candidate ];
183 * Rewrite the bind dn if needed
185 dc.rwmap = &li->targets[ candidate ]->mt_rwmap;
186 dc.conn = op->o_conn;
190 if ( ldap_back_dn_massage( &dc, &op->o_req_dn, &mdn ) ) {
191 send_ldap_result( op, rs );
196 rs->sr_err = ldap_set_option( lsc->msc_ld,
197 LDAP_OPT_SERVER_CONTROLS, op->o_ctrls );
198 if ( rs->sr_err != LDAP_SUCCESS ) {
199 rs->sr_err = slap_map_api2result( rs );
204 /* FIXME: this fixes the bind problem right now; we need
205 * to use the asynchronous version to get the "matched"
206 * and more in case of failure ... */
207 rs->sr_err = ldap_sasl_bind( lsc->msc_ld, mdn.bv_val,
208 LDAP_SASL_SIMPLE, &op->orb_cred,
209 op->o_ctrls, NULL, &msgid );
210 if ( rs->sr_err == LDAP_SUCCESS ) {
212 struct timeval tv = { 0, 0 };
220 switch ( ldap_result( lsc->msc_ld, msgid, 0, &tv, &res ) ) {
222 if ( ++nretries <= META_BIND_NRETRIES ) {
223 ldap_pvt_thread_yield();
225 tv.tv_usec = META_BIND_TIMEOUT;
228 rs->sr_err = LDAP_BUSY;
232 ldap_get_option( lsc->msc_ld, LDAP_OPT_ERROR_NUMBER,
237 rc = ldap_parse_result( lsc->msc_ld, res, &rs->sr_err,
238 NULL, NULL, NULL, NULL, 1 );
239 if ( rc != LDAP_SUCCESS ) {
246 if ( rs->sr_err != LDAP_SUCCESS ) {
247 rs->sr_err = slap_map_api2result( rs );
251 if ( !BER_BVISNULL( &lsc->msc_bound_ndn ) ) {
252 ber_memfree( lsc->msc_bound_ndn.bv_val );
254 ber_dupbv( &lsc->msc_bound_ndn, &op->o_req_dn );
255 lsc->msc_bound = META_BOUND;
256 lc->mc_bound_target = candidate;
258 if ( li->savecred ) {
259 if ( !BER_BVISNULL( &lsc->msc_cred ) ) {
260 /* destroy sensitive data */
261 memset( lsc->msc_cred.bv_val, 0, lsc->msc_cred.bv_len );
262 ber_memfree( lsc->msc_cred.bv_val );
264 ber_dupbv( &lsc->msc_cred, &op->orb_cred );
265 ldap_set_rebind_proc( lsc->msc_ld, meta_back_rebind, lsc );
268 if ( li->cache.ttl != META_DNCACHE_DISABLED
269 && op->o_req_ndn.bv_len != 0 ) {
270 ( void )meta_dncache_update_entry( &li->cache,
271 &op->o_req_ndn, candidate );
276 if ( mdn.bv_val != op->o_req_dn.bv_val ) {
287 meta_back_dobind( struct metaconn *lc, Operation *op )
289 struct metasingleconn *lsc;
293 * all the targets are bound as pseudoroot
295 if ( lc->mc_bound_target == META_BOUND_ALL ) {
299 for ( i = 0, lsc = lc->mc_conns; !META_LAST( lsc ); ++i, ++lsc ) {
301 struct berval cred = BER_BVC("");
305 * Not a candidate or something wrong with this target ...
307 if ( lsc->msc_ld == NULL ) {
312 * If required, set controls
315 if ( ldap_set_option( lsc->msc_ld, LDAP_OPT_SERVER_CONTROLS,
316 op->o_ctrls ) != LDAP_SUCCESS ) {
317 ( void )meta_clear_one_candidate( lsc, 1 );
323 * If the target is already bound it is skipped
325 if ( lsc->msc_bound == META_BOUND && lc->mc_bound_target == i ) {
331 * Otherwise an anonymous bind is performed
332 * (note: if the target was already bound, the anonymous
333 * bind clears the previous bind).
335 if ( !BER_BVISNULL( &lsc->msc_bound_ndn ) ) {
336 ber_memfree( lsc->msc_bound_ndn.bv_val );
337 BER_BVZERO( &lsc->msc_bound_ndn );
340 if ( /* FIXME: need li ... li->savecred && */
341 !BER_BVISNULL( &lsc->msc_cred ) )
343 /* destroy sensitive data */
344 memset( lsc->msc_cred.bv_val, 0, lsc->msc_cred.bv_len );
345 ber_memfree( lsc->msc_cred.bv_val );
346 BER_BVZERO( &lsc->msc_cred );
349 rc = ldap_sasl_bind( lsc->msc_ld, "", LDAP_SASL_SIMPLE, &cred,
350 op->o_ctrls, NULL, &msgid );
351 if ( rc == LDAP_SUCCESS ) {
353 struct timeval tv = { 0, 0 };
361 switch ( ldap_result( lsc->msc_ld, msgid, 0, &tv, &res ) ) {
363 if ( ++nretries <= META_BIND_NRETRIES ) {
364 ldap_pvt_thread_yield();
366 tv.tv_usec = META_BIND_TIMEOUT;
374 ldap_get_option( lsc->msc_ld, LDAP_OPT_ERROR_NUMBER,
379 rc = ldap_parse_result( lsc->msc_ld, res, &err,
380 NULL, NULL, NULL, NULL, 1 );
381 if ( rc == LDAP_SUCCESS ) {
388 if ( rc != LDAP_SUCCESS ) {
389 Debug( LDAP_DEBUG_ANY,
390 "==>meta_back_dobind: (anonymous)"
392 " with error %d (%s)\n",
393 rc, ldap_err2string( rc ), 0 );
396 * null cred bind should always succeed
397 * as anonymous, so a failure means
398 * the target is no longer candidate possibly
399 * due to technical reasons (remote host down?)
400 * so better clear the handle
402 ( void )meta_clear_one_candidate( lsc, 1 );
406 lsc->msc_bound = META_ANONYMOUS;
417 meta_back_is_valid( struct metaconn *lc, int candidate )
419 struct metasingleconn *lsc;
424 if ( candidate < 0 ) {
428 for ( i = 0, lsc = lc->mc_conns; !META_LAST( lsc ) && i < candidate;
431 if ( !META_LAST( lsc ) ) {
432 return ( lsc->msc_ld != NULL );
441 * This is a callback used for chasing referrals using the same
442 * credentials as the original user on this session.
445 meta_back_rebind( LDAP *ld, LDAP_CONST char *url, ber_tag_t request,
446 ber_int_t msgid, void *params )
448 struct metasingleconn *lsc = params;
450 return ldap_sasl_bind_s( ld, lsc->msc_bound_ndn.bv_val,
451 LDAP_SASL_SIMPLE, &lsc->msc_cred,
456 * FIXME: error return must be handled in a cleaner way ...
459 meta_back_op_result( struct metaconn *lc, Operation *op, SlapReply *rs )
463 struct metasingleconn *lsc;
469 for ( i = 0, lsc = lc->mc_conns; !META_LAST( lsc ); ++i, ++lsc ) {
473 rs->sr_err = LDAP_SUCCESS;
475 ldap_get_option( lsc->msc_ld, LDAP_OPT_ERROR_NUMBER, &rs->sr_err );
476 if ( rs->sr_err != LDAP_SUCCESS ) {
478 * better check the type of error. In some cases
479 * (search ?) it might be better to return a
480 * success if at least one of the targets gave
481 * positive result ...
483 ldap_get_option( lsc->msc_ld,
484 LDAP_OPT_ERROR_STRING, &msg );
485 ldap_get_option( lsc->msc_ld,
486 LDAP_OPT_MATCHED_DN, &match );
487 rs->sr_err = slap_map_api2result( rs );
489 Debug(LDAP_DEBUG_ANY,
490 "==> meta_back_op_result: target"
491 " <%d> sending msg \"%s\""
492 " (matched \"%s\")\n",
493 i, ( msg ? msg : "" ),
494 ( match ? match : "" ) );
497 * FIXME: need to rewrite "match" (need rwinfo)
499 switch ( rs->sr_err ) {
509 ber_memfree( rmatch );
517 /* better test the pointers before freeing? */
529 rs->sr_matched = rmatch;
530 send_ldap_result( op, rs );
535 ber_memfree( rmatch );
538 rs->sr_matched = NULL;
540 return ( ( rerr == LDAP_SUCCESS ) ? 0 : -1 );