+static int
+slap_sasl_authorize(
+ sasl_conn_t *sconn,
+ void *context,
+ const char *requested_user,
+ unsigned rlen,
+ const char *auth_identity,
+ unsigned alen,
+ const char *def_realm,
+ unsigned urlen,
+ struct propctx *propctx)
+{
+ Connection *conn = (Connection *)context;
+ struct berval authcDN, authzDN;
+ int rc;
+
+ authcDN.bv_val = (char *)auth_identity;
+ authcDN.bv_len = alen;
+
+ authzDN.bv_val = (char *)requested_user;
+ authzDN.bv_len = rlen;
+
+#ifdef NEW_LOGGING
+ LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
+ "slap_sasl_authorize: conn %d authcDN=\"%s\" authzDN=\"%s\"\n",
+ conn ? conn->c_connid : -1, authcDN.bv_val, authzDN.bv_val));
+#else
+ Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
+ "authcDN=\"%s\" authzDN=\"%s\"\n",
+ conn ? conn->c_connid : -1, authcDN.bv_val, authzDN.bv_val );
+#endif
+
+ rc = slap_sasl_authorized( &authcDN, &authzDN );
+ if ( rc != LDAP_SUCCESS ) {
+#ifdef NEW_LOGGING
+ LDAP_LOG(( "sasl", LDAP_LEVEL_INFO,
+ "slap_sasl_authorize: conn %ld authorization disallowed (%d)\n",
+ (long)(conn ? conn->c_connid : -1), rc ));
+#else
+ Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
+ " authorization disallowed (%d)\n",
+ (long) (conn ? conn->c_connid : -1), rc, 0 );
+#endif
+
+ sasl_seterror( sconn, 0, "not authorized" );
+ return SASL_NOAUTHZ;
+ }
+
+#ifdef NEW_LOGGING
+ LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
+ "slap_sasl_authorize: conn %d authorization allowed\n",
+ (long)(conn ? conn->c_connid : -1 ) ));
+#else
+ Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
+ " authorization allowed\n",
+ (long) (conn ? conn->c_connid : -1), 0, 0 );
+#endif
+
+ return SASL_OK;
+}
+#else