2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
4 * Copyright 1999-2005 The OpenLDAP Foundation.
5 * Portions Copyright 2001-2003 Pierangelo Masarati.
6 * Portions Copyright 1999-2003 Howard Chu.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
18 * This work was initially developed by the Howard Chu for inclusion
19 * in OpenLDAP Software and subsequently enhanced by Pierangelo
27 #include <ac/socket.h>
28 #include <ac/string.h>
33 #include "../back-ldap/back-ldap.h"
34 #include "back-meta.h"
36 static LDAP_REBIND_PROC meta_back_rebind;
39 meta_back_do_single_bind(
47 meta_back_bind( Operation *op, SlapReply *rs )
49 struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
53 i, gotit = 0, ndnlen, isroot = 0;
55 char *candidates = meta_back_candidates_get( op );
57 rs->sr_err = LDAP_SUCCESS;
59 Debug( LDAP_DEBUG_ARGS, "meta_back_bind: dn: %s.\n%s%s",
60 op->o_req_dn.bv_val, "", "" );
62 if ( op->orb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op ) ) {
64 ber_dupbv( &op->orb_edn, be_root_dn( op->o_bd ) );
67 /* we need meta_back_getconn() not send result even on error,
68 * because we want to intercept the error and make it
69 * invalidCredentials */
70 lc = meta_back_getconn( op, rs, NULL, LDAP_BACK_DONTSEND );
72 Debug( LDAP_DEBUG_ANY,
73 "meta_back_bind: no target "
74 "for dn \"%s\" (%d: %s).\n",
75 op->o_req_dn.bv_val, rs->sr_err,
76 rs->sr_text ? rs->sr_text : "" );
77 /* FIXME: there might be cases where we don't want
78 * to map the error onto invalidCredentials */
79 switch ( rs->sr_err ) {
80 case LDAP_NO_SUCH_OBJECT:
81 case LDAP_UNWILLING_TO_PERFORM:
82 rs->sr_err = LDAP_INVALID_CREDENTIALS;
86 send_ldap_result( op, rs );
91 * Each target is scanned ...
93 lc->mc_bound_target = META_BOUND_NONE;
94 ndnlen = op->o_req_ndn.bv_len;
95 for ( i = 0; i < li->mi_ntargets; i++ ) {
97 struct berval orig_dn = op->o_req_dn;
98 struct berval orig_ndn = op->o_req_ndn;
99 struct berval orig_cred = op->orb_cred;
100 int orig_method = op->orb_method;
104 * Skip non-candidates
106 if ( candidates[ i ] != META_CANDIDATE ) {
113 } else if ( isroot == 0 ) {
115 * A bind operation is expected to have
116 * ONE CANDIDATE ONLY!
118 Debug( LDAP_DEBUG_ANY,
119 "==>meta_back_bind: more than one"
120 " candidate is trying to bind...\n",
124 if ( isroot && !BER_BVISNULL( &li->mi_targets[ i ]->mt_pseudorootdn ) )
126 op->o_req_dn = li->mi_targets[ i ]->mt_pseudorootdn;
127 op->o_req_ndn = li->mi_targets[ i ]->mt_pseudorootdn;
128 op->orb_cred = li->mi_targets[ i ]->mt_pseudorootpw;
129 op->orb_method = LDAP_AUTH_SIMPLE;
132 lerr = meta_back_do_single_bind( lc, op, rs, i );
133 if ( lerr != LDAP_SUCCESS ) {
135 candidates[ i ] = META_NOT_CANDIDATE;
137 ( void )meta_clear_one_candidate( &lc->mc_conns[ i ] );
144 op->o_req_dn = orig_dn;
145 op->o_req_ndn = orig_ndn;
146 op->orb_cred = orig_cred;
147 op->orb_method = orig_method;
151 lc->mc_bound_target = META_BOUND_ALL;
155 * rc is LDAP_SUCCESS if at least one bind succeeded,
156 * err is the last error that occurred during a bind;
157 * if at least (and at most?) one bind succeedes, fine.
159 if ( rc != LDAP_SUCCESS ) {
162 * deal with bind failure ...
166 * no target was found within the naming context,
167 * so bind must fail with invalid credentials
169 if ( rs->sr_err == LDAP_SUCCESS && gotit == 0 ) {
170 rs->sr_err = LDAP_INVALID_CREDENTIALS;
173 rs->sr_err = slap_map_api2result( rs );
174 send_ldap_result( op, rs );
182 * meta_back_do_single_bind
184 * attempts to perform a bind with creds
187 meta_back_do_single_bind(
194 struct metainfo *li = ( struct metainfo * )op->o_bd->be_private;
195 struct berval mdn = BER_BVNULL;
197 struct metasingleconn *lsc = &lc->mc_conns[ candidate ];
201 * Rewrite the bind dn if needed
203 dc.rwmap = &li->mi_targets[ candidate ]->mt_rwmap;
204 dc.conn = op->o_conn;
208 if ( ldap_back_dn_massage( &dc, &op->o_req_dn, &mdn ) ) {
209 send_ldap_result( op, rs );
213 /* FIXME: this fixes the bind problem right now; we need
214 * to use the asynchronous version to get the "matched"
215 * and more in case of failure ... */
216 /* FIXME: should be check if at least some of the op->o_ctrls
217 * can/should be passed? */
218 rs->sr_err = ldap_sasl_bind( lsc->msc_ld, mdn.bv_val,
219 LDAP_SASL_SIMPLE, &op->orb_cred,
220 op->o_ctrls, NULL, &msgid );
221 if ( rs->sr_err == LDAP_SUCCESS ) {
223 struct timeval tv = { 0, 0 };
231 switch ( ldap_result( lsc->msc_ld, msgid, 0, &tv, &res ) ) {
233 if ( ++nretries <= META_BIND_NRETRIES ) {
234 ldap_pvt_thread_yield();
236 tv.tv_usec = META_BIND_TIMEOUT;
239 rs->sr_err = LDAP_BUSY;
243 ldap_get_option( lsc->msc_ld, LDAP_OPT_ERROR_NUMBER,
248 rc = ldap_parse_result( lsc->msc_ld, res, &rs->sr_err,
249 NULL, NULL, NULL, NULL, 1 );
250 if ( rc != LDAP_SUCCESS ) {
257 if ( rs->sr_err != LDAP_SUCCESS ) {
258 rs->sr_err = slap_map_api2result( rs );
262 if ( !BER_BVISNULL( &lsc->msc_bound_ndn ) ) {
263 ber_memfree( lsc->msc_bound_ndn.bv_val );
265 ber_dupbv( &lsc->msc_bound_ndn, &op->o_req_dn );
266 lsc->msc_bound = META_BOUND;
267 lc->mc_bound_target = candidate;
269 if ( LDAP_BACK_SAVECRED( li ) ) {
270 if ( !BER_BVISNULL( &lsc->msc_cred ) ) {
271 /* destroy sensitive data */
272 memset( lsc->msc_cred.bv_val, 0, lsc->msc_cred.bv_len );
273 ber_memfree( lsc->msc_cred.bv_val );
275 ber_dupbv( &lsc->msc_cred, &op->orb_cred );
276 ldap_set_rebind_proc( lsc->msc_ld, meta_back_rebind, lsc );
279 if ( li->mi_cache.ttl != META_DNCACHE_DISABLED
280 && op->o_req_ndn.bv_len != 0 ) {
281 ( void )meta_dncache_update_entry( &li->mi_cache,
282 &op->o_req_ndn, candidate );
287 if ( mdn.bv_val != op->o_req_dn.bv_val ) {
298 meta_back_dobind( struct metaconn *lc, Operation *op, ldap_back_send_t sendok )
300 struct metasingleconn *lsc;
303 char *candidates = meta_back_candidates_get( op );
306 * all the targets are bound as pseudoroot
308 if ( lc->mc_bound_target == META_BOUND_ALL ) {
312 for ( i = 0, lsc = &lc->mc_conns[ 0 ]; !META_LAST( lsc ); ++i, ++lsc ) {
314 struct berval cred = BER_BVC("");
318 * Not a candidate or something wrong with this target ...
320 if ( lsc->msc_ld == NULL ) {
325 * If the target is already bound it is skipped
327 if ( lsc->msc_bound == META_BOUND && lc->mc_bound_target == i ) {
333 * Otherwise an anonymous bind is performed
334 * (note: if the target was already bound, the anonymous
335 * bind clears the previous bind).
337 if ( !BER_BVISNULL( &lsc->msc_bound_ndn ) ) {
338 ber_memfree( lsc->msc_bound_ndn.bv_val );
339 BER_BVZERO( &lsc->msc_bound_ndn );
342 if ( /* FIXME: need li ... li->savecred && */
343 !BER_BVISNULL( &lsc->msc_cred ) )
345 /* destroy sensitive data */
346 memset( lsc->msc_cred.bv_val, 0, lsc->msc_cred.bv_len );
347 ber_memfree( lsc->msc_cred.bv_val );
348 BER_BVZERO( &lsc->msc_cred );
351 /* FIXME: should we check if at least some of the op->o_ctrls
352 * can/should be passed? */
353 rc = ldap_sasl_bind( lsc->msc_ld, "", LDAP_SASL_SIMPLE, &cred,
354 NULL, NULL, &msgid );
355 if ( rc == LDAP_SUCCESS ) {
357 struct timeval tv = { 0, 0 };
365 switch ( ldap_result( lsc->msc_ld, msgid, 0, &tv, &res ) ) {
367 if ( ++nretries <= META_BIND_NRETRIES ) {
368 ldap_pvt_thread_yield();
370 tv.tv_usec = META_BIND_TIMEOUT;
378 ldap_get_option( lsc->msc_ld, LDAP_OPT_ERROR_NUMBER,
383 rc = ldap_parse_result( lsc->msc_ld, res, &err,
384 NULL, NULL, NULL, NULL, 1 );
385 if ( rc == LDAP_SUCCESS ) {
392 if ( rc != LDAP_SUCCESS ) {
393 Debug( LDAP_DEBUG_ANY,
394 "==>meta_back_dobind: (anonymous)"
396 " with error %d (%s)\n",
397 rc, ldap_err2string( rc ), 0 );
400 * null cred bind should always succeed
401 * as anonymous, so a failure means
402 * the target is no longer candidate possibly
403 * due to technical reasons (remote host down?)
404 * so better clear the handle
406 candidates[ i ] = META_NOT_CANDIDATE;
408 ( void )meta_clear_one_candidate( lsc );
413 lsc->msc_bound = META_ANONYMOUS;
424 meta_back_is_valid( struct metaconn *lc, int candidate )
426 struct metasingleconn *lsc;
431 if ( candidate < 0 ) {
435 for ( i = 0, lsc = &lc->mc_conns[ 0 ]; !META_LAST( lsc ) && i < candidate;
438 if ( !META_LAST( lsc ) ) {
439 return ( lsc->msc_ld != NULL );
448 * This is a callback used for chasing referrals using the same
449 * credentials as the original user on this session.
452 meta_back_rebind( LDAP *ld, LDAP_CONST char *url, ber_tag_t request,
453 ber_int_t msgid, void *params )
455 struct metasingleconn *lsc = params;
457 return ldap_sasl_bind_s( ld, lsc->msc_bound_ndn.bv_val,
458 LDAP_SASL_SIMPLE, &lsc->msc_cred,
463 * FIXME: error return must be handled in a cleaner way ...
474 struct metasingleconn *lsc;
480 if ( candidate != META_TARGET_NONE ) {
481 lsc = &lc->mc_conns[ candidate ];
483 rs->sr_err = LDAP_SUCCESS;
485 ldap_get_option( lsc->msc_ld, LDAP_OPT_ERROR_NUMBER, &rs->sr_err );
486 if ( rs->sr_err != LDAP_SUCCESS ) {
488 * better check the type of error. In some cases
489 * (search ?) it might be better to return a
490 * success if at least one of the targets gave
491 * positive result ...
493 ldap_get_option( lsc->msc_ld,
494 LDAP_OPT_ERROR_STRING, &rmsg );
495 ldap_get_option( lsc->msc_ld,
496 LDAP_OPT_MATCHED_DN, &rmatch );
497 rerr = rs->sr_err = slap_map_api2result( rs );
506 Debug(LDAP_DEBUG_ANY,
507 "==> meta_back_op_result: target"
508 " <%d> sending msg \"%s\""
509 " (matched \"%s\")\n",
510 candidate, ( rmsg ? rmsg : "" ),
511 ( rmatch ? rmatch : "" ) );
515 for ( i = 0, lsc = &lc->mc_conns[ 0 ]; !META_LAST( lsc ); ++i, ++lsc ) {
519 rs->sr_err = LDAP_SUCCESS;
521 ldap_get_option( lsc->msc_ld, LDAP_OPT_ERROR_NUMBER, &rs->sr_err );
522 if ( rs->sr_err != LDAP_SUCCESS ) {
524 * better check the type of error. In some cases
525 * (search ?) it might be better to return a
526 * success if at least one of the targets gave
527 * positive result ...
529 ldap_get_option( lsc->msc_ld,
530 LDAP_OPT_ERROR_STRING, &msg );
531 ldap_get_option( lsc->msc_ld,
532 LDAP_OPT_MATCHED_DN, &match );
533 rs->sr_err = slap_map_api2result( rs );
535 Debug(LDAP_DEBUG_ANY,
536 "==> meta_back_op_result: target"
537 " <%d> sending msg \"%s\""
538 " (matched \"%s\")\n",
539 i, ( msg ? msg : "" ),
540 ( match ? match : "" ) );
543 * FIXME: need to rewrite "match" (need rwinfo)
545 switch ( rs->sr_err ) {
555 ber_memfree( rmatch );
563 /* better test the pointers before freeing? */
576 rs->sr_matched = rmatch;
577 send_ldap_result( op, rs );
582 ber_memfree( rmatch );
585 rs->sr_matched = NULL;
587 return ( ( rerr == LDAP_SUCCESS ) ? 0 : -1 );