{
fprintf(stderr,
"Change password of an LDAP user\n\n"
-"usage: %s [options] user\n"
-" user: the identity of the user, normally a DN\n"
+"usage: %s [options] [user]\n"
+" user: the autentication identity, commonly a DN\n"
"Password change options:\n"
-" -a secret\told password\n"
-" -A\t\tprompt for old password\n"
-" -s secret\tnew password\n"
-" -S\t\tprompt for new password\n"
+" -a secret old password\n"
+" -A prompt for old password\n"
+" -s secret new password\n"
+" -S prompt for new password\n"
"Common options:\n"
-" -d level\tdebugging level\n"
-" -C\t\tchase referrals\n"
-" -D binddn\tbind DN\n"
-" -h host\t\tLDAP server (default: localhost)\n"
-" -I\t\tuse SASL Interactive mode\n"
-" -n\t\tmake no modifications\n"
-" -O secprops\tSASL security properties\n"
-" -p port\t\tport on LDAP server\n"
-" -Q\t\tuse SASL Quiet mode\n"
-" -R realm\tSASL realm\n"
-" -U user\t\tSASL authentication identity (username)\n"
-" -v\t\tverbose mode\n"
-" -w passwd\tbind password (for simple authentication)\n"
-" -W\t\tprompt for bind password\n"
-" -x\t\tSimple authentication\n"
-" -X id\t\tSASL authorization identity (\"dn:<dn>\" or \"u:<user>\")\n"
-" -Y mech\t\tSASL mechanism\n"
-" -Z\t\tissue Start TLS request (-ZZ to require successful response)\n"
+" -d level set LDAP debugging level to `level'\n"
+" -D binddn bind DN\n"
+" -f file read operations from `file'\n"
+" -h host LDAP server(s)\n"
+" -H URI LDAP Uniform Resource Indentifier(s)\n"
+" -I use SASL Interactive mode\n"
+" -n show what would be done but don't actually search\n"
+" -O props SASL security properties\n"
+" -p port port on LDAP server\n"
+" -Q use SASL Quiet mode\n"
+" -R realm SASL realm\n"
+" -U authcid SASL authentication identity\n"
+" -v run in verbose mode (diagnostics to standard output)\n"
+" -w passwd bind passwd (for simple authentication)\n"
+" -W prompt for bind passwd\n"
+" -x Simple authentication\n"
+" -X authzid SASL authorization identity (\"dn:<dn>\" or \"u:<user>\")\n"
+" -Y mech SASL mechanism\n"
+" -Z Start TLS request (-ZZ to require successful response)\n"
, s );
exit( EXIT_FAILURE );
int rc;
char *prog = NULL;
char *ldaphost = NULL;
+ char *ldapuri = NULL;
- char *dn = NULL;
+ char *user = NULL;
char *binddn = NULL;
struct berval passwd = { 0, NULL };
#endif
int use_tls = 0;
int referrals = 0;
- LDAP *ld;
+ LDAP *ld = NULL;
struct berval *bv = NULL;
int id, code;
char *retoid = NULL;
struct berval *retdata = NULL;
- prog = (prog = strrchr(argv[0], *LDAP_DIRSEP)) == NULL ? argv[0] : ++prog;
+ prog = (prog = strrchr(argv[0], *LDAP_DIRSEP)) == NULL ? argv[0] : prog + 1;
- if (argc == 1)
- usage (argv[0]);
-
- while( (i = getopt( argc, argv,
- "Aa:Ss:" "Cd:D:h:InO:p:QRU:vw:WxX:Y:Z" )) != EOF )
+ while( (i = getopt( argc, argv, "Aa:Ss:"
+ "Cd:D:h:H:InO:p:QR:U:vw:WxX:Y:Z" )) != EOF )
{
switch (i) {
/* Password Options */
{
char* p;
- for( p = optarg; *p == '\0'; p++ ) {
+ for( p = optarg; *p != '\0'; p++ ) {
*p = '\0';
}
}
{
char* p;
- for( p = optarg; *p == '\0'; p++ ) {
+ for( p = optarg; *p != '\0'; p++ ) {
*p = '\0';
}
}
break;
case 'D': /* bind DN */
if( binddn != NULL ) {
- fprintf( stderr, "%s: -D previously specified\n" );
+ fprintf( stderr, "%s: -D previously specified\n", prog );
return EXIT_FAILURE;
}
binddn = strdup( optarg );
break;
case 'h': /* ldap host */
+ if( ldapuri != NULL ) {
+ fprintf( stderr, "%s: -h incompatible with -H\n", prog );
+ return EXIT_FAILURE;
+ }
if( ldaphost != NULL ) {
- fprintf( stderr, "%s: -h previously specified\n" );
+ fprintf( stderr, "%s: -h previously specified\n", prog );
return EXIT_FAILURE;
}
ldaphost = strdup( optarg );
break;
+ case 'H': /* ldap URI */
+ if( ldaphost != NULL ) {
+ fprintf( stderr, "%s: -H incompatible with -h\n", prog );
+ return EXIT_FAILURE;
+ }
+ if( ldapport ) {
+ fprintf( stderr, "%s: -H incompatible with -p\n", prog );
+ return EXIT_FAILURE;
+ }
+ if( ldapuri != NULL ) {
+ fprintf( stderr, "%s: -H previously specified\n", prog );
+ return EXIT_FAILURE;
+ }
+ ldapuri = strdup( optarg );
+ break;
case 'I':
#ifdef HAVE_CYRUS_SASL
if( version == LDAP_VERSION2 ) {
case 'O':
#ifdef HAVE_CYRUS_SASL
if( sasl_secprops != NULL ) {
- fprintf( stderr, "%s: -O previously specified\n" );
+ fprintf( stderr, "%s: -O previously specified\n", prog );
return EXIT_FAILURE;
}
if( version == LDAP_VERSION2 ) {
break;
case 'p':
if( ldapport ) {
- fprintf( stderr, "%s: -p previously specified\n" );
+ fprintf( stderr, "%s: -p previously specified\n", prog );
return EXIT_FAILURE;
}
ldapport = atoi( optarg );
sasl_flags = LDAP_SASL_QUIET;
break;
#else
- fprintf( stderr, "%s: was not compiled with SASL support\n",
+ fprintf( stderr, "%s: not compiled with SASL support\n",
prog );
return( EXIT_FAILURE );
#endif
case 'R':
#ifdef HAVE_CYRUS_SASL
if( sasl_realm != NULL ) {
- fprintf( stderr, "%s: -R previously specified\n" );
+ fprintf( stderr, "%s: -R previously specified\n", prog );
return EXIT_FAILURE;
}
if( version == LDAP_VERSION2 ) {
version = LDAP_VERSION3;
sasl_realm = strdup( optarg );
#else
- fprintf( stderr, "%s: was not compiled with SASL support\n",
+ fprintf( stderr, "%s: not compiled with SASL support\n",
prog );
return( EXIT_FAILURE );
#endif
case 'U':
#ifdef HAVE_CYRUS_SASL
if( sasl_authc_id != NULL ) {
- fprintf( stderr, "%s: -U previously specified\n" );
+ fprintf( stderr, "%s: -U previously specified\n", prog );
return EXIT_FAILURE;
}
if( version == LDAP_VERSION2 ) {
version = LDAP_VERSION3;
sasl_authc_id = strdup( optarg );
#else
- fprintf( stderr, "%s: was not compiled with SASL support\n",
+ fprintf( stderr, "%s: not compiled with SASL support\n",
prog );
return( EXIT_FAILURE );
#endif
{
char* p;
- for( p = optarg; *p == '\0'; p++ ) {
+ for( p = optarg; *p != '\0'; p++ ) {
*p = '\0';
}
}
case 'Y':
#ifdef HAVE_CYRUS_SASL
if( sasl_mech != NULL ) {
- fprintf( stderr, "%s: -Y previously specified\n" );
+ fprintf( stderr, "%s: -Y previously specified\n", prog );
return EXIT_FAILURE;
}
if( version == LDAP_VERSION2 ) {
version = LDAP_VERSION3;
sasl_mech = strdup( optarg );
#else
- fprintf( stderr, "%s: was not compiled with SASL support\n",
+ fprintf( stderr, "%s: not compiled with SASL support\n",
prog );
return( EXIT_FAILURE );
#endif
case 'X':
#ifdef HAVE_CYRUS_SASL
if( sasl_authz_id != NULL ) {
- fprintf( stderr, "%s: -X previously specified\n" );
+ fprintf( stderr, "%s: -X previously specified\n", prog );
return EXIT_FAILURE;
}
if( version == LDAP_VERSION2 ) {
case 'Z':
#ifdef HAVE_TLS
if( version == LDAP_VERSION2 ) {
- fprintf( stderr, "%s -Z incompatible with version %d\n",
+ fprintf( stderr, "%s: -Z incompatible with version %d\n",
prog, version );
return EXIT_FAILURE;
}
default:
- fprintf( stderr, "%s: unrecongized option -%c\n",
+ fprintf( stderr, "%s: unrecognized option -%c\n",
prog, optopt );
usage (argv[0]);
}
}
- if( argc - optind != 1 ) {
- usage( argv[0] );
- }
-
if (authmethod == -1) {
#ifdef HAVE_CYRUS_SASL
authmethod = LDAP_AUTH_SASL;
#endif
}
- dn = strdup( argv[optind] );
+ if( argc - optind > 1 ) {
+ usage( argv[0] );
+ } else if ( argc - optind == 1 ) {
+ user = strdup( argv[optind] );
+ } else {
+ user = NULL;
+ }
if( want_oldpw && oldpw == NULL ) {
/* prompt for old password */
char *ckoldpw;
- newpw = strdup(getpassphrase("Old password: "));
+ oldpw = strdup(getpassphrase("Old password: "));
ckoldpw = getpassphrase("Re-enter old password: ");
- if( newpw== NULL || ckoldpw == NULL ||
+ if( oldpw== NULL || ckoldpw == NULL ||
strncmp( oldpw, ckoldpw, strlen(oldpw) ))
{
fprintf( stderr, "passwords do not match\n" );
}
}
- if( binddn == NULL && dn != NULL ) {
- binddn = dn;
- dn = NULL;
-
- if( passwd.bv_val == NULL ) {
- passwd.bv_val = oldpw;
- passwd.bv_len = oldpw == NULL ? 0 : strlen( oldpw );
- }
- }
-
if (want_bindpw && passwd.bv_val == NULL ) {
/* handle bind password */
- fprintf( stderr, "Bind DN: %s\n", binddn );
passwd.bv_val = strdup( getpassphrase("Enter bind password: "));
passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
}
#endif
/* connect to server */
- if ((ld = ldap_init( ldaphost, ldapport )) == NULL) {
- perror("ldap_init");
- return EXIT_FAILURE;
+ if( ( ldaphost != NULL || ldapport ) && ( ldapuri == NULL ) ) {
+ if ( verbose ) {
+ fprintf( stderr, "ldap_init( %s, %d )\n",
+ ldaphost != NULL ? ldaphost : "<DEFAULT>",
+ ldapport );
+ }
+
+ ld = ldap_init( ldaphost, ldapport );
+ if( ld == NULL ) {
+ perror("ldapsearch: ldap_init");
+ return EXIT_FAILURE;
+ }
+
+ } else {
+ if ( verbose ) {
+ fprintf( stderr, "ldap_initialize( %s )\n",
+ ldapuri != NULL ? ldapuri : "<DEFAULT>" );
+ }
+
+ rc = ldap_initialize( &ld, ldapuri );
+ if( rc != LDAP_SUCCESS ) {
+ fprintf( stderr, "Could not create LDAP session handle (%d): %s\n",
+ rc, ldap_err2string(rc) );
+ return EXIT_FAILURE;
+ }
}
/* referrals */
}
/* LDAPv3 only */
- version = 3;
+ version = LDAP_VERSION3;
rc = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version );
if(rc != LDAP_OPT_SUCCESS ) {
}
if ( use_tls && ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS ) {
+ ldap_perror( ld, "ldap_start_tls" );
if ( use_tls > 1 ) {
- ldap_perror( ld, "ldap_start_tls" );
return( EXIT_FAILURE );
}
- fprintf( stderr, "WARNING: could not start TLS\n" );
}
if ( authmethod == LDAP_AUTH_SASL ) {
return( EXIT_FAILURE );
}
#else
- fprintf( stderr, "%s was not compiled with SASL support\n",
+ fprintf( stderr, "%s: not compiled with SASL support\n",
argv[0] );
return( EXIT_FAILURE );
#endif
}
}
- if( dn != NULL || oldpw != NULL || newpw != NULL ) {
+ if( user != NULL || oldpw != NULL || newpw != NULL ) {
/* build change password control */
BerElement *ber = ber_alloc_t( LBER_USE_DER );
ber_printf( ber, "{" /*}*/ );
- if( dn != NULL ) {
+ if( user != NULL ) {
ber_printf( ber, "ts",
- LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, dn );
- free(dn);
+ LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, user );
+ free(user);
}
if( oldpw != NULL ) {
ber_printf( ber, "ts",
- LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW, oldpw );
+ LDAP_TAG_EXOP_X_MODIFY_PASSWD_OLD, oldpw );
free(oldpw);
}
projects / openldap / blobdiff