2 * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
3 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
5 * Copyright 2001, Pierangelo Masarati, All rights reserved. <ando@sys-net.it>
7 * This work has been developed to fulfill the requirements
8 * of SysNet s.n.c. <http:www.sys-net.it> and it has been donated
9 * to the OpenLDAP Foundation in the hope that it may be useful
10 * to the Open Source community, but WITHOUT ANY WARRANTY.
12 * Permission is granted to anyone to use this software for any purpose
13 * on any computer system, and to alter it and redistribute it, subject
14 * to the following restrictions:
16 * 1. The author and SysNet s.n.c. are not responsible for the consequences
17 * of use of this software, no matter how awful, even if they arise from
20 * 2. The origin of this software must not be misrepresented, either by
21 * explicit claim or by omission. Since few users ever read sources,
22 * credits should appear in the documentation.
24 * 3. Altered versions must be plainly marked as such, and must not be
25 * misrepresented as being the original software. Since few users
26 * ever read sources, credits should appear in the documentation.
27 * SysNet s.n.c. cannot be responsible for the consequences of the
30 * 4. This notice may not be removed or altered.
33 * This software is based on the backend back-ldap, implemented
34 * by Howard Chu <hyc@highlandsun.com>, and modified by Mark Valence
35 * <kurash@sassafras.com>, Pierangelo Masarati <ando@sys-net.it> and other
36 * contributors. The contribution of the original software to the present
37 * implementation is acknowledged in this copyright statement.
39 * A special acknowledgement goes to Howard for the overall architecture
40 * (and for borrowing large pieces of code), and to Mark, who implemented
41 * from scratch the attribute/objectclass mapping.
43 * The original copyright statement follows.
45 * Copyright 1999, Howard Chu, All rights reserved. <hyc@highlandsun.com>
47 * Permission is granted to anyone to use this software for any purpose
48 * on any computer system, and to alter it and redistribute it, subject
49 * to the following restrictions:
51 * 1. The author is not responsible for the consequences of use of this
52 * software, no matter how awful, even if they arise from flaws in it.
54 * 2. The origin of this software must not be misrepresented, either by
55 * explicit claim or by omission. Since few users ever read sources,
56 * credits should appear in the documentation.
58 * 3. Altered versions must be plainly marked as such, and must not be
59 * misrepresented as being the original software. Since few users
60 * ever read sources, credits should appear in the
63 * 4. This notice may not be removed or altered.
71 #include <ac/socket.h>
72 #include <ac/string.h>
75 #include "../back-ldap/back-ldap.h"
76 #include "back-meta.h"
79 /* return 0 IFF op_dn is a value in group_at (member) attribute
80 * of entry with gr_dn AND that entry has an objectClass
81 * value of group_oc (groupOfNames)
89 struct berval *gr_ndn,
90 struct berval *op_ndn,
91 ObjectClass *group_oc,
92 AttributeDescription *group_at
95 struct metainfo *li = ( struct metainfo * )be->be_private;
96 int rc = 1, candidate;
98 AttributeDescription *ad_objectClass = slap_schema.si_ad_objectClass;
101 char *filter = NULL, *ptr;
103 struct berval mop_ndn = { 0, NULL }, mgr_ndn = { 0, NULL };
105 struct berval group_oc_name = { 0, NULL };
106 struct berval group_at_name = group_at->ad_cname;
108 if ( group_oc->soc_names && group_oc->soc_names[ 0 ] ) {
109 group_oc_name.bv_val = group_oc->soc_names[ 0 ];
111 group_oc_name.bv_val = group_oc->soc_oid;
114 if ( group_oc_name.bv_val ) {
115 group_oc_name.bv_len = strlen( group_oc_name.bv_val );
118 if ( target != NULL && dn_match( &target->e_nname, gr_ndn ) ) {
119 /* we already have a copy of the entry */
120 /* attribute and objectclass mapping has already been done */
123 * first we need to check if the objectClass attribute
124 * has been retrieved; otherwise we need to repeat the search
126 attr = attr_find( target->e_attrs, ad_objectClass );
127 if ( attr != NULL ) {
130 * Now we can check for the group objectClass value
132 if ( !is_entry_objectclass( target, group_oc, 0 ) ) {
137 * This part has been reworked: the group attr compare
138 * fails only if the attribute is PRESENT but the value
139 * is NOT PRESENT; if the attribute is NOT PRESENT, the
140 * search must be repeated as well.
141 * This may happen if a search for an entry has already
142 * been performed (target is not null) but the group
143 * attribute has not been required
145 attr = attr_find( target->e_attrs, group_at );
146 if ( attr != NULL ) {
147 rc = value_find( group_at, attr->a_vals,
149 if ( rc != LDAP_SUCCESS ) {
153 } /* else: repeat the search */
154 } /* else: repeat the search */
155 } /* else: do the search */
157 candidate = meta_back_select_unique_candidate( li, gr_ndn );
158 if ( candidate == -1 ) {
163 * Rewrite the op ndn if needed
165 switch ( rewrite_session( li->targets[ candidate ]->rwinfo, "bindDn",
166 op_ndn->bv_val, conn, &mop_ndn.bv_val ) ) {
167 case REWRITE_REGEXEC_OK:
168 if ( mop_ndn.bv_val != NULL && mop_ndn.bv_val[ 0 ] != '\0' ) {
169 mop_ndn.bv_len = strlen( mop_ndn.bv_val );
174 LDAP_LOG( BACK_META, DETAIL1,
175 "[rw] bindDn (op ndn in group): \"%s\" -> \"%s\"\n",
176 op_ndn->bv_val, mop_ndn.bv_val, 0 );
177 #else /* !NEW_LOGGING */
178 Debug( LDAP_DEBUG_ARGS,
179 "rw> bindDn (op ndn in group):"
180 " \"%s\" -> \"%s\"\n%s",
181 op_ndn->bv_val, mop_ndn.bv_val, "" );
182 #endif /* !NEW_LOGGING */
185 case REWRITE_REGEXEC_UNWILLING:
186 /* continues to next case */
188 case REWRITE_REGEXEC_ERR:
193 * Rewrite the gr ndn if needed
195 switch ( rewrite_session( li->targets[ candidate ]->rwinfo,
197 gr_ndn->bv_val, conn, &mgr_ndn.bv_val ) ) {
198 case REWRITE_REGEXEC_OK:
199 if ( mgr_ndn.bv_val != NULL && mgr_ndn.bv_val[ 0 ] != '\0' ) {
200 mgr_ndn.bv_len = strlen( mgr_ndn.bv_val );
205 LDAP_LOG( BACK_META, DETAIL1,
206 "[rw] searchBase (gr ndn in group): \"%s\" -> \"%s\"\n",
207 gr_ndn->bv_val, mgr_ndn.bv_val, 0 );
208 #else /* !NEW_LOGGING */
209 Debug( LDAP_DEBUG_ARGS,
210 "rw> searchBase (gr ndn in group):"
211 " \"%s\" -> \"%s\"\n%s",
212 gr_ndn->bv_val, mgr_ndn.bv_val, "" );
213 #endif /* !NEW_LOGGING */
216 case REWRITE_REGEXEC_UNWILLING:
217 /* continues to next case */
219 case REWRITE_REGEXEC_ERR:
223 ldap_back_map( &li->targets[ candidate ]->oc_map,
224 &group_oc_name, &group_oc_name, 0 );
225 if ( group_oc_name.bv_val == NULL ) {
228 ldap_back_map( &li->targets[ candidate ]->at_map,
229 &group_at_name, &group_at_name, 0 );
230 if ( group_at_name.bv_val == NULL ) {
234 filter = ch_malloc( sizeof( "(&(objectclass=)(=))" )
235 + group_oc_name.bv_len
236 + group_at_name.bv_len
237 + mop_ndn.bv_len + 1 );
238 if ( filter == NULL ) {
242 rc = ldap_initialize( &ld, li->targets[ candidate ]->uri );
243 if ( rc != LDAP_SUCCESS ) {
247 rc = ldap_bind_s( ld, li->targets[ candidate ]->binddn.bv_val,
248 li->targets[ candidate ]->bindpw.bv_val,
250 if ( rc != LDAP_SUCCESS ) {
254 ptr = lutil_strcopy( filter, "(&(objectclass=" );
255 ptr = lutil_strcopy( ptr , group_oc_name.bv_val );
256 ptr = lutil_strcopy( ptr , ")(" );
257 ptr = lutil_strcopy( ptr , group_at_name.bv_val );
258 ptr = lutil_strcopy( ptr , "=" );
259 ptr = lutil_strcopy( ptr , mop_ndn.bv_val );
260 strcpy( ptr , "))" );
262 gattr[ 0 ] = "objectclass";
265 if ( ldap_search_ext_s( ld, mgr_ndn.bv_val, LDAP_SCOPE_BASE, filter,
266 gattr, 0, NULL, NULL, LDAP_NO_LIMIT,
267 LDAP_NO_LIMIT, &result ) == LDAP_SUCCESS ) {
268 if ( ldap_first_entry( ld, result ) != NULL ) {
271 ldap_msgfree( result );
278 if ( filter != NULL ) {
281 if ( mop_ndn.bv_val != op_ndn->bv_val ) {
282 free( mop_ndn.bv_val );
284 if ( mgr_ndn.bv_val != gr_ndn->bv_val ) {
285 free( mgr_ndn.bv_val );