-#ifdef LDAP_REFERRALS
- ri->ri_ldp->ld_options &= ~LDAP_OPT_REFERRALS;
-#endif /* LDAP_REFERRALS */
- ri->ri_ldp->ld_options |= LDAP_OPT_RESTART;
-
- switch ( ri->ri_bind_method ) {
- case AUTH_KERBEROS:
-#ifndef KERBEROS
- Debug( LDAP_DEBUG_ANY,
- "Error: Kerberos bind for %s:%d, but not compiled w/kerberos\n",
- ri->ri_hostname, ri->ri_port, 0 );
- return( BIND_ERR_KERBEROS_FAILED );
-#else /* KERBEROS */
- /*
- * Bind using kerberos.
- * If "bindprincipal" was given in the config file, then attempt
- * to get a TGT for that principal (via the srvtab file). If only
- * a binddn was given, then we need to read that entry to get
- * the kerberosName attributes, and try to get a TGT for one
- * of them. All are tried. The first one which succeeds is
- * returned. XXX It might be a good idea to just require a
- * bindprincipal. Reading the entry every time might be a significant
- * amount of overhead, if the connection is closed between most
- * updates.
- */
-
- if ( ri->ri_principal != NULL ) {
- skrbnames[ 0 ] = ri->ri_principal;
- skrbnames[ 1 ] = NULL;
- krbnames = skrbnames;
- } else {
- krbnames = read_krbnames( ri );
- }
-
- if (( krbnames == NULL ) || ( krbnames[ 0 ] == NULL )) {
- Debug( LDAP_DEBUG_ANY,
- "Error: Can't find krbname for binddn \"%s\"\n",
- ri->ri_bind_dn, 0, 0 );
- retval = BIND_ERR_KERBEROS_FAILED;
- goto kexit;
- }
- /*
- * Now we've got one or more kerberos principals. See if any
- * of them are in the srvtab file.
- */
- got_tgt = 0;
- for ( kni = 0; krbnames[ kni ] != NULL; kni++ ) {
- rc = kname_parse( name, instance, realm, krbnames[ kni ]);
- if ( rc != KSUCCESS ) {
- continue;
- }
- upcase( realm );
- rc = krb_get_svc_in_tkt( name, instance, realm, "krbtgt", realm,
- 1, ri->ri_srvtab );
- if ( rc != KSUCCESS) {
- Debug( LDAP_DEBUG_ANY, "Error: Can't get TGT for %s: %s\n",
- krbnames[ kni ], krb_err_txt[ rc ], 0 );
- } else {
- got_tgt = 1;
- break;
- }
- }
- if (!got_tgt) {
- Debug( LDAP_DEBUG_ANY,
- "Error: Could not obtain TGT for DN \"%s\"\n",
- ri->ri_bind_dn, 0, 0 );
- retval = BIND_ERR_KERBEROS_FAILED;
- goto kexit;
- }
- /*
- * We've got a TGT. Do a kerberos bind.
- */
- Debug( LDAP_DEBUG_ARGS, "bind to %s:%d as %s (kerberos)\n",
- ri->ri_hostname, ri->ri_port, ri->ri_bind_dn );
- ldrc = ldap_kerberos_bind_s( ri->ri_ldp, ri->ri_bind_dn );
- ri->ri_principal = strdup( krbnames[ kni ] );
- if ( ldrc != LDAP_SUCCESS ) {
- Debug( LDAP_DEBUG_ANY, "Error: kerberos bind for %s:%dfailed: %s\n",
- ri->ri_hostname, ri->ri_port, ldap_err2string( ldrc ));
- *lderr = ldrc;
- retval = BIND_ERR_KERBEROS_FAILED;
- goto kexit;