2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
4 * Copyright 1999-2005 The OpenLDAP Foundation.
5 * Portions Copyright 2001-2003 Pierangelo Masarati.
6 * Portions Copyright 1999-2003 Howard Chu.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by the Howard Chu for inclusion
19 * in OpenLDAP Software and subsequently enhanced by Pierangelo
27 #include <ac/socket.h>
28 #include <ac/string.h>
33 #include "../back-ldap/back-ldap.h"
34 #include "back-meta.h"
36 static LDAP_REBIND_PROC meta_back_rebind;
39 meta_back_do_single_bind(
47 meta_back_bind( Operation *op, SlapReply *rs )
49 struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
52 int rc = -1, i, gotit = 0, ndnlen, isroot = 0;
53 int op_type = META_OP_ALLOW_MULTIPLE;
55 rs->sr_err = LDAP_SUCCESS;
58 LDAP_LOG( BACK_META, ENTRY, "meta_back_bind: dn: %s.\n",
59 op->o_req_dn.bv_val, 0, 0 );
60 #else /* !NEW_LOGGING */
61 Debug( LDAP_DEBUG_ARGS, "meta_back_bind: dn: %s.\n%s%s",
62 op->o_req_dn.bv_val, "", "" );
63 #endif /* !NEW_LOGGING */
65 if ( op->oq_bind.rb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op ) ) {
67 ber_dupbv( &op->oq_bind.rb_edn, be_root_dn( op->o_bd ) );
68 op_type = META_OP_REQUIRE_ALL;
70 lc = meta_back_getconn( op, rs, op_type,
71 &op->o_req_ndn, NULL );
74 LDAP_LOG( BACK_META, NOTICE,
75 "meta_back_bind: no target for dn %s.\n",
76 op->o_req_dn.bv_val, 0, 0 );
77 #else /* !NEW_LOGGING */
78 Debug( LDAP_DEBUG_ANY,
79 "meta_back_bind: no target for dn %s.\n%s%s",
80 op->o_req_dn.bv_val, "", "");
81 #endif /* !NEW_LOGGING */
83 send_ldap_result( op, rs );
88 * Each target is scanned ...
90 lc->bound_target = META_BOUND_NONE;
91 ndnlen = op->o_req_ndn.bv_len;
92 for ( i = 0; i < li->ntargets; i++ ) {
94 struct berval orig_dn = op->o_req_dn;
95 struct berval orig_ndn = op->o_req_ndn;
96 struct berval orig_cred = op->oq_bind.rb_cred;
97 int orig_method = op->oq_bind.rb_method;
101 * Skip non-candidates
103 if ( lc->conns[ i ].candidate != META_CANDIDATE ) {
111 * A bind operation is expected to have
112 * ONE CANDIDATE ONLY!
115 LDAP_LOG( BACK_META, WARNING,
116 "==>meta_back_bind: more than one"
117 " candidate is attempting to bind"
118 " ...\n" , 0, 0, 0 );
119 #else /* !NEW_LOGGING */
120 Debug( LDAP_DEBUG_ANY,
121 "==>meta_back_bind: more than one"
122 " candidate is attempting to bind"
125 #endif /* !NEW_LOGGING */
128 if ( isroot && li->targets[ i ]->pseudorootdn.bv_val != NULL ) {
129 op->o_req_dn = li->targets[ i ]->pseudorootdn;
130 op->o_req_ndn = li->targets[ i ]->pseudorootdn;
131 op->oq_bind.rb_cred = li->targets[ i ]->pseudorootpw;
132 op->oq_bind.rb_method = LDAP_AUTH_SIMPLE;
135 lerr = meta_back_do_single_bind( lc, op, rs, i );
136 if ( lerr != LDAP_SUCCESS ) {
138 ( void )meta_clear_one_candidate( &lc->conns[ i ], 1 );
143 op->o_req_dn = orig_dn;
144 op->o_req_ndn = orig_ndn;
145 op->oq_bind.rb_cred = orig_cred;
146 op->oq_bind.rb_method = orig_method;
150 lc->bound_target = META_BOUND_ALL;
154 * rc is LDAP_SUCCESS if at least one bind succeeded,
155 * err is the last error that occurred during a bind;
156 * if at least (and at most?) one bind succeedes, fine.
158 if ( rc != LDAP_SUCCESS /* && rs->sr_err != LDAP_SUCCESS */ ) {
161 * deal with bind failure ...
165 * no target was found within the naming context,
166 * so bind must fail with invalid credentials
168 if ( rs->sr_err == LDAP_SUCCESS && gotit == 0 ) {
169 rs->sr_err = LDAP_INVALID_CREDENTIALS;
172 rs->sr_err = slap_map_api2result( rs );
173 send_ldap_result( op, rs );
181 * meta_back_do_single_bind
183 * attempts to perform a bind with creds
186 meta_back_do_single_bind(
193 struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
194 struct berval mdn = BER_BVNULL;
197 struct metasingleconn *lsc = &lc->conns[ candidate ];
200 * Rewrite the bind dn if needed
202 dc.rwmap = &li->targets[ candidate ]->rwmap;
203 dc.conn = op->o_conn;
207 if ( ldap_back_dn_massage( &dc, &op->o_req_dn, &mdn ) ) {
208 send_ldap_result( op, rs );
213 rs->sr_err = ldap_set_option( lsc->ld,
214 LDAP_OPT_SERVER_CONTROLS, op->o_ctrls );
215 if ( rs->sr_err != LDAP_SUCCESS ) {
216 rs->sr_err = slap_map_api2result( rs );
221 /* FIXME: this fixes the bind problem right now; we need
222 * to use the asynchronous version to get the "matched"
223 * and more in case of failure ... */
224 rs->sr_err = ldap_sasl_bind( lsc->ld, mdn.bv_val,
225 LDAP_SASL_SIMPLE, &op->oq_bind.rb_cred,
226 op->o_ctrls, NULL, &msgid );
227 if ( rs->sr_err == LDAP_SUCCESS ) {
229 struct timeval tv = { 0, 0 };
233 switch ( ldap_result( lsc->ld, msgid, 0, &tv, &res ) ) {
236 tv.tv_usec = 1000; /* 0.001 s */
237 ldap_pvt_thread_yield();
241 ldap_get_option( lsc->ld, LDAP_OPT_ERROR_NUMBER,
246 rc = ldap_parse_result( lsc->ld, res, &rs->sr_err,
247 NULL, NULL, NULL, NULL, 1 );
248 if ( rc != LDAP_SUCCESS ) {
255 if ( rs->sr_err != LDAP_SUCCESS ) {
256 rs->sr_err = slap_map_api2result( rs );
261 * FIXME: handle response!!!
263 if ( lsc->bound_dn.bv_val != NULL ) {
264 ber_memfree( lsc->bound_dn.bv_val );
266 ber_dupbv( &lsc->bound_dn, &op->o_req_dn );
267 lsc->bound = META_BOUND;
268 lc->bound_target = candidate;
270 if ( li->savecred ) {
271 if ( lsc->cred.bv_val ) {
272 memset( lsc->cred.bv_val, 0, lsc->cred.bv_len );
273 ber_memfree( lsc->cred.bv_val );
275 ber_dupbv( &lsc->cred, &op->oq_bind.rb_cred );
276 ldap_set_rebind_proc( lsc->ld, meta_back_rebind, lsc );
279 if ( li->cache.ttl != META_DNCACHE_DISABLED
280 && op->o_req_ndn.bv_len != 0 ) {
281 ( void )meta_dncache_update_entry( &li->cache,
282 &op->o_req_ndn, candidate );
287 if ( mdn.bv_val != op->o_req_dn.bv_val ) {
298 meta_back_dobind( struct metaconn *lc, Operation *op )
300 struct metasingleconn *lsc;
304 * all the targets are bound as pseudoroot
306 if ( lc->bound_target == META_BOUND_ALL ) {
310 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
312 struct berval cred = BER_BVC("");
316 * Not a candidate or something wrong with this target ...
318 if ( lsc->ld == NULL ) {
323 * If required, set controls
326 if ( ldap_set_option( lsc->ld, LDAP_OPT_SERVER_CONTROLS,
327 op->o_ctrls ) != LDAP_SUCCESS ) {
328 ( void )meta_clear_one_candidate( lsc, 1 );
334 * If the target is already bound it is skipped
336 if ( lsc->bound == META_BOUND && lc->bound_target == i ) {
342 * Otherwise an anonymous bind is performed
343 * (note: if the target was already bound, the anonymous
344 * bind clears the previous bind).
346 if ( lsc->bound_dn.bv_val ) {
347 ber_memfree( lsc->bound_dn.bv_val );
348 lsc->bound_dn.bv_val = NULL;
349 lsc->bound_dn.bv_len = 0;
352 if ( /* FIXME: need li ... li->savecred && */
354 memset( lsc->cred.bv_val, 0, lsc->cred.bv_len );
355 ber_memfree( lsc->cred.bv_val );
356 lsc->cred.bv_val = NULL;
357 lsc->cred.bv_len = 0;
360 rc = ldap_sasl_bind( lsc->ld, "", LDAP_SASL_SIMPLE, &cred,
361 NULL, NULL, &msgid );
362 if ( rc == LDAP_SUCCESS ) {
364 struct timeval tv = { 0, 0 };
368 switch ( ldap_result( lsc->ld, msgid, 0, &tv, &res ) ) {
371 tv.tv_usec = 1000; /* 0.001 s */
372 ldap_pvt_thread_yield();
376 ldap_get_option( lsc->ld, LDAP_OPT_ERROR_NUMBER,
381 rc = ldap_parse_result( lsc->ld, res, &err,
382 NULL, NULL, NULL, NULL, 1 );
383 if ( rc == LDAP_SUCCESS ) {
390 if ( rc != LDAP_SUCCESS ) {
392 LDAP_LOG( BACK_META, WARNING,
393 "meta_back_dobind: (anonymous)"
395 " with error %d (%s)\n",
396 rc, ldap_err2string( rc ), 0 );
397 #else /* !NEW_LOGGING */
398 Debug( LDAP_DEBUG_ANY,
399 "==>meta_back_dobind: (anonymous)"
401 " with error %d (%s)\n",
402 rc, ldap_err2string( rc ), 0 );
403 #endif /* !NEW_LOGGING */
406 * null cred bind should always succeed
407 * as anonymous, so a failure means
408 * the target is no longer candidate possibly
409 * due to technical reasons (remote host down?)
410 * so better clear the handle
412 ( void )meta_clear_one_candidate( lsc, 1 );
416 lsc->bound = META_ANONYMOUS;
427 meta_back_is_valid( struct metaconn *lc, int candidate )
429 struct metasingleconn *lsc;
434 if ( candidate < 0 ) {
438 for ( i = 0, lsc = lc->conns; !META_LAST(lsc) && i < candidate;
441 if ( !META_LAST(lsc) ) {
442 return( lsc->ld != NULL );
451 * This is a callback used for chasing referrals using the same
452 * credentials as the original user on this session.
455 meta_back_rebind( LDAP *ld, LDAP_CONST char *url, ber_tag_t request,
456 ber_int_t msgid, void *params )
458 struct metasingleconn *lc = params;
460 return ldap_bind_s( ld, lc->bound_dn.bv_val, lc->cred.bv_val,
465 * FIXME: error return must be handled in a cleaner way ...
468 meta_back_op_result( struct metaconn *lc, Operation *op, SlapReply *rs )
470 int i, rerr = LDAP_SUCCESS;
471 struct metasingleconn *lsc;
474 int free_rmsg = 0, free_rmatch = 0;
476 for ( i = 0, lsc = lc->conns; !META_LAST(lsc); ++i, ++lsc ) {
480 rs->sr_err = LDAP_SUCCESS;
482 ldap_get_option( lsc->ld, LDAP_OPT_ERROR_NUMBER, &rs->sr_err );
483 if ( rs->sr_err != LDAP_SUCCESS ) {
485 * better check the type of error. In some cases
486 * (search ?) it might be better to return a
487 * success if at least one of the targets gave
488 * positive result ...
490 ldap_get_option( lsc->ld,
491 LDAP_OPT_ERROR_STRING, &msg );
492 ldap_get_option( lsc->ld,
493 LDAP_OPT_MATCHED_DN, &match );
494 rs->sr_err = slap_map_api2result( rs );
497 LDAP_LOG( BACK_META, RESULTS,
498 "meta_back_op_result: target"
499 " <%d> sending msg \"%s\""
500 " (matched \"%s\")\n",
501 i, ( msg ? msg : "" ),
502 ( match ? match : "" ) );
503 #else /* !NEW_LOGGING */
504 Debug(LDAP_DEBUG_ANY,
505 "==> meta_back_op_result: target"
506 " <%d> sending msg \"%s\""
507 " (matched \"%s\")\n",
508 i, ( msg ? msg : "" ),
509 ( match ? match : "" ) );
510 #endif /* !NEW_LOGGING */
513 * FIXME: need to rewrite "match" (need rwinfo)
515 switch ( rs->sr_err ) {
525 ber_memfree( rmatch );
533 /* better test the pointers before freeing? */
545 rs->sr_matched = rmatch;
546 send_ldap_result( op, rs );
551 ber_memfree( rmatch );
554 rs->sr_matched = NULL;
556 return ( ( rerr == LDAP_SUCCESS ) ? 0 : -1 );