+ } else if ( strcasecmp( argv[1], "sasl" ) == 0 ) {
+#ifdef HAVE_CYRUS_SASL
+ int arg;
+
+ for ( arg = 2; arg < argc; arg++ ) {
+ if ( strncasecmp( argv[arg], "mech=", STRLENOF( "mech=" ) ) == 0 ) {
+ char *val = argv[arg] + STRLENOF( "mech=" );
+
+ if ( !BER_BVISNULL( &li->idassert_sasl_mech ) ) {
+ fprintf( stderr, "%s: line %d: "
+ "SASL mech already defined; replacing...\n",
+ fname, lineno );
+ ch_free( li->idassert_sasl_mech.bv_val );
+ }
+ ber_str2bv( val, 0, 1, &li->idassert_sasl_mech );
+
+ } else if ( strncasecmp( argv[arg], "realm=", STRLENOF( "realm=" ) ) == 0 ) {
+ char *val = argv[arg] + STRLENOF( "realm=" );
+
+ if ( !BER_BVISNULL( &li->idassert_sasl_realm ) ) {
+ fprintf( stderr, "%s: line %d: "
+ "SASL realm already defined; replacing...\n",
+ fname, lineno );
+ ch_free( li->idassert_sasl_realm.bv_val );
+ }
+ ber_str2bv( val, 0, 1, &li->idassert_sasl_realm );
+
+ } else if ( strncasecmp( argv[arg], "authcdn=", STRLENOF( "authcdn=" ) ) == 0 ) {
+ char *val = argv[arg] + STRLENOF( "authcdn=" );
+ struct berval dn;
+ int rc;
+
+ if ( !BER_BVISNULL( &li->idassert_authcDN ) ) {
+ fprintf( stderr, "%s: line %d: "
+ "SASL authcDN already defined; replacing...\n",
+ fname, lineno );
+ ch_free( li->idassert_authcDN.bv_val );
+ }
+ if ( strncasecmp( argv[arg], "dn:", STRLENOF( "dn:" ) ) == 0 ) {
+ val += STRLENOF( "dn:" );
+ }
+
+ ber_str2bv( val, 0, 0, &dn );
+ rc = dnNormalize( 0, NULL, NULL, &dn, &li->idassert_authcDN, NULL );
+ if ( rc != LDAP_SUCCESS ) {
+ Debug( LDAP_DEBUG_ANY,
+ "%s: line %d: SASL authcdn \"%s\" is not a valid DN\n",
+ fname, lineno, val );
+ return 1;
+ }
+
+ } else if ( strncasecmp( argv[arg], "authcid=", STRLENOF( "authcid=" ) ) == 0 ) {
+ char *val = argv[arg] + STRLENOF( "authcid=" );
+
+ if ( !BER_BVISNULL( &li->idassert_authcID ) ) {
+ fprintf( stderr, "%s: line %d: "
+ "SASL authcID already defined; replacing...\n",
+ fname, lineno );
+ ch_free( li->idassert_authcID.bv_val );
+ }
+ if ( strncasecmp( argv[arg], "u:", STRLENOF( "u:" ) ) == 0 ) {
+ val += STRLENOF( "u:" );
+ }
+ ber_str2bv( val, 0, 1, &li->idassert_authcID );
+
+ } else if ( strncasecmp( argv[arg], "cred=", STRLENOF( "cred=" ) ) == 0 ) {
+ char *val = argv[arg] + STRLENOF( "cred=" );
+
+ if ( !BER_BVISNULL( &li->idassert_passwd ) ) {
+ fprintf( stderr, "%s: line %d: "
+ "SASL cred already defined; replacing...\n",
+ fname, lineno );
+ ch_free( li->idassert_passwd.bv_val );
+ }
+ ber_str2bv( val, 0, 1, &li->idassert_passwd );
+
+ } else if ( strncasecmp( argv[arg], "authz=", STRLENOF( "authz=" ) ) == 0 ) {
+ char *val = argv[arg] + STRLENOF( "authz=" );
+
+ if ( strcasecmp( val, "proxyauthz" ) == 0 ) {
+ li->idassert_flags &= ~LDAP_BACK_AUTH_NATIVE_AUTHZ;
+
+ } else if ( strcasecmp( val, "native" ) == 0 ) {
+ li->idassert_flags |= LDAP_BACK_AUTH_NATIVE_AUTHZ;
+
+ } else {
+ fprintf( stderr, "%s: line %s: "
+ "unknown authz mode \"%s\"\n",
+ fname, lineno, val );
+ return 1;
+ }
+
+ } else {
+ fprintf( stderr, "%s: line %d: "
+ "unknown SASL parameter %s\n",
+ fname, lineno, argv[arg] );
+ return 1;
+ }
+ }