+ /* generate a new password if none was provided */
+ if ( qpw->rs_new.bv_len == 0 ) {
+ slap_passwd_generate( &qpw->rs_new );
+ if ( qpw->rs_new.bv_len ) {
+ rsp = slap_passwd_return( &qpw->rs_new );
+ freenewpw = 1;
+ }
+ }
+ if ( qpw->rs_new.bv_len == 0 ) {
+ rs->sr_text = "password generation failed";
+ rc = LDAP_OTHER;
+ goto error_return;
+ }
+
+ op->o_bd = op_be;
+
+ /* Give the backend a chance to handle this itself */
+ if ( op->o_bd->be_extended ) {
+ rs->sr_err = op->o_bd->be_extended( op, rs );
+ if ( rs->sr_err != LDAP_UNWILLING_TO_PERFORM &&
+ rs->sr_err != SLAP_CB_CONTINUE )
+ {
+ rc = rs->sr_err;
+ if ( rsp ) {
+ rs->sr_rspdata = rsp;
+ rsp = NULL;
+ }
+ goto error_return;
+ }
+ }
+
+ /* The backend didn't handle it, so try it here */
+ if( op->o_bd && !op->o_bd->be_modify ) {
+ rs->sr_text = "operation not supported for current user";
+ rc = LDAP_UNWILLING_TO_PERFORM;
+ goto error_return;
+ }
+
+ if ( qpw->rs_old.bv_val != NULL ) {
+ Entry *e = NULL;
+
+ rc = be_entry_get_rw( op, &op->o_req_ndn, NULL,
+ slap_schema.si_ad_userPassword, 0, &e );
+ if ( rc == LDAP_SUCCESS && e ) {
+ Attribute *a = attr_find( e->e_attrs,
+ slap_schema.si_ad_userPassword );
+ if ( a )
+ rc = slap_passwd_check( op, e, a, &qpw->rs_old, &rs->sr_text );
+ else
+ rc = 1;
+ be_entry_release_r( op, e );
+ if ( rc == LDAP_SUCCESS )
+ goto old_good;
+ }
+ rs->sr_text = "unwilling to verify old password";
+ rc = LDAP_UNWILLING_TO_PERFORM;
+ goto error_return;
+ }
+
+old_good:
+ ml = ch_malloc( sizeof(Modifications) );
+ if ( !qpw->rs_modtail ) qpw->rs_modtail = &ml->sml_next;
+
+ if ( default_passwd_hash ) {
+ for ( nhash = 0; default_passwd_hash[nhash]; nhash++ );
+ hashes = default_passwd_hash;