don't keep searching referrals...

[openldap] / libraries / librewrite / ldapmap.c

diff --git a/libraries/librewrite/ldapmap.c b/libraries/librewrite/ldapmap.c
index 30020b0c4151e0ce1c0bcab945310f14a7ea0372..c1fae58aa6354898a1ddb33ba3a28036a05c755c 100644 (file)
--- a/libraries/librewrite/ldapmap.c
+++ b/libraries/librewrite/ldapmap.c
@@ -23,6 +23,13 @@
 #include "rewrite-int.h"
 #include "rewrite-map.h"
 
+typedef enum {
+       MAP_LDAP_UNKNOWN,
+       MAP_LDAP_EVERYTIME,
+       MAP_LDAP_NOW,
+       MAP_LDAP_LATER
+} bindwhen_t;
+
 /*
  * LDAP map data structure
  */
@@ -31,12 +38,9 @@ struct ldap_map_data {
        LDAPURLDesc                    *lm_lud;
        int                             lm_version;
        char                           *lm_binddn;
-       char                           *lm_bindpw;
+       struct berval                   lm_cred;
 
-#define MAP_LDAP_EVERYTIME             0x00
-#define MAP_LDAP_NOW                   0x01
-#define MAP_LDAP_LATER                 0x02
-       int                             lm_when;
+       bindwhen_t                      lm_when;
 
        LDAP                           *lm_ld;
 
@@ -67,12 +71,15 @@ map_ldap_free(
                free( data->lm_binddn );
        }
 
-       if ( data->lm_bindpw != NULL ) {
-               free( data->lm_bindpw );
+       if ( data->lm_cred.bv_val != NULL ) {
+               memset( data->lm_cred.bv_val, 0, data->lm_cred.bv_len );
+               free( data->lm_cred.bv_val );
+               data->lm_cred.bv_val = NULL;
+               data->lm_cred.bv_len = 0;
        }
 
        if ( data->lm_when != MAP_LDAP_EVERYTIME && data->lm_ld != NULL ) {
-               ldap_unbind_s( data->lm_ld );
+               ldap_unbind_ext( data->lm_ld, NULL, NULL );
        }
 
        free( data );
@@ -88,7 +95,7 @@ map_ldap_parse(
 )
 {
        struct ldap_map_data *data;
-       char *p;
+       char *p, *uri;
 
        assert( info != NULL );
        assert( fname != NULL );
@@ -107,13 +114,18 @@ map_ldap_parse(
                return NULL;
        }
 
-       data->lm_url = strdup( argv[ 0 ] );
+       uri = argv[ 0 ];
+       if ( strncasecmp( uri, "uri=", STRLENOF( "uri=" ) ) == 0 ) {
+               uri += STRLENOF( "uri=" );
+       }
+
+       data->lm_url = strdup( uri );
        if ( data->lm_url == NULL ) {
                map_ldap_free( data );
                return NULL;
        }
        
-       if ( ldap_url_parse( argv[ 0 ], &data->lm_lud ) != REWRITE_SUCCESS ) {
+       if ( ldap_url_parse( uri, &data->lm_lud ) != REWRITE_SUCCESS ) {
                Debug( LDAP_DEBUG_ANY,
                                "[%s:%d] illegal URI '%s'\n",
                                fname, lineno, argv[ 0 ] );
@@ -121,6 +133,7 @@ map_ldap_parse(
                return NULL;
        }
 
+       /* trim everything after [host][:port] */
        p = strchr( data->lm_url, '/' );
        assert( p[ 1 ] == '/' );
        if ( ( p = strchr( p + 2, '/' ) ) != NULL ) {
@@ -186,9 +199,17 @@ map_ldap_parse(
                                data->lm_binddn[ l ] = '\0';
                        }
 
+                       /* deprecated */
                } else if ( strncasecmp( argv[ 0 ], "bindpw=", STRLENOF( "bindpw=" ) ) == 0 ) {
-                       data->lm_bindpw = strdup( argv[ 0 ] + STRLENOF( "bindpw=" ) );
-                       if ( data->lm_bindpw == NULL ) {
+                       ber_str2bv( argv[ 0 ] + STRLENOF( "bindpw=" ), 0, 1, &data->lm_cred );
+                       if ( data->lm_cred.bv_val == NULL ) {
+                               map_ldap_free( data );
+                               return NULL;
+                       }
+
+               } else if ( strncasecmp( argv[ 0 ], "credentials=", STRLENOF( "credentials=" ) ) == 0 ) {
+                       ber_str2bv( argv[ 0 ] + STRLENOF( "credentials=" ), 0, 1, &data->lm_cred );
+                       if ( data->lm_cred.bv_val == NULL ) {
                                map_ldap_free( data );
                                return NULL;
                        }
@@ -257,6 +278,10 @@ map_ldap_parse(
                }
        }
 
+       if ( data->lm_when == MAP_LDAP_UNKNOWN ) {
+               data->lm_when = MAP_LDAP_EVERYTIME;
+       }
+
        return ( void * )data;
 }
 
@@ -270,7 +295,6 @@ map_ldap_apply(
 {
        LDAP *ld;
        LDAPMessage *res = NULL, *entry;
-       char **values;
        int rc;
        struct ldap_map_data *data = ( struct ldap_map_data * )map->lb_private;
        LDAPURLDesc *lud = data->lm_lud;
@@ -318,7 +342,9 @@ do_bind:;
        }
 
        if ( data->lm_binddn != NULL ) {
-               rc = ldap_simple_bind_s( ld, data->lm_binddn, data->lm_bindpw );
+               rc = ldap_sasl_bind_s( ld, data->lm_binddn,
+                       LDAP_SASL_SIMPLE, &data->lm_cred,
+                       NULL, NULL, NULL );
                if ( rc == LDAP_SERVER_DOWN && first_try ) {
                        first_try = 0;
                        if ( ldap_initialize( &ld, data->lm_url ) != LDAP_SUCCESS ) {
@@ -334,8 +360,8 @@ do_bind:;
                }
        }
 
-       rc = ldap_search_s( ld, lud->lud_dn, lud->lud_scope, ( char * )filter,
-                       data->lm_attrs, 0, &res );
+       rc = ldap_search_ext_s( ld, lud->lud_dn, lud->lud_scope, ( char * )filter,
+                       data->lm_attrs, 0, NULL, NULL, NULL, 1, &res );
        if ( rc == LDAP_SERVER_DOWN && first_try ) {
                first_try = 0;
                 if ( ldap_initialize( &ld, data->lm_url ) != LDAP_SUCCESS ) {
@@ -345,7 +371,7 @@ do_bind:;
                set_version = 1;
                goto do_bind;
 
-       } else if ( rc != REWRITE_SUCCESS ) {
+       } else if ( rc != LDAP_SUCCESS ) {
                rc = REWRITE_ERR;
                goto rc_return;
        }
@@ -364,19 +390,26 @@ do_bind:;
                 * dn is newly allocated, so there's no need to strdup it
                 */
                val->bv_val = ldap_get_dn( ld, entry );
+               val->bv_len = strlen( val->bv_val );
 
        } else {
-               values = ldap_get_values( ld, entry, data->lm_attrs[ 0 ] );
-               if ( values == NULL || values[ 0 ] == NULL ) {
-                       if ( values != NULL ) {
-                               ldap_value_free( values );
+               struct berval **values;
+
+               values = ldap_get_values_len( ld, entry, data->lm_attrs[ 0 ] );
+               if ( values != NULL ) {
+                       if ( values[ 0 ] != NULL && values[ 0 ]->bv_val != NULL ) {
+#if 0
+                               /* NOTE: in principle, multiple values
+                                * should not be acceptable according
+                                * to the current API; ignore by now */
+                               if ( values[ 1 ] != NULL ) {
+                                       /* error */                             
+                               }
+#endif
+                               ber_dupbv( val, values[ 0 ] );
                        }
-                       ldap_msgfree( res );
-                       rc = REWRITE_ERR;
-                       goto rc_return;
+                       ldap_value_free_len( values );
                }
-               val->bv_val = strdup( values[ 0 ] );
-               ldap_value_free( values );
        }
        
        ldap_msgfree( res );
@@ -385,12 +418,11 @@ do_bind:;
                rc = REWRITE_ERR;
                goto rc_return;
        }
-       val->bv_len = strlen( val->bv_val );
 
 rc_return:;
        if ( data->lm_when == MAP_LDAP_EVERYTIME ) {
                if ( ld != NULL ) {
-                       ldap_unbind_s( ld );
+                       ldap_unbind_ext( ld, NULL, NULL );
                }
 
        } else {
@@ -415,33 +447,8 @@ map_ldap_destroy(
        
        data = ( struct ldap_map_data * )(*pmap)->lb_private;
 
-       if ( data->lm_when != MAP_LDAP_EVERYTIME && data->lm_ld != NULL ) {
-               ldap_unbind_s( data->lm_ld );
-               data->lm_ld = NULL;
-       }
-
-       if ( data->lm_lud ) {
-               ldap_free_urldesc( data->lm_lud );
-               data->lm_lud = NULL;
-       }
-
-       if ( data->lm_url ) {
-               free( data->lm_url );
-               data->lm_url = NULL;
-       }
+       map_ldap_free( data );
 
-       if ( data->lm_binddn ) {
-               free( data->lm_binddn );
-               data->lm_binddn = NULL;
-       }
-
-       if (data->lm_bindpw ) {
-               memset( data->lm_bindpw, 0, strlen( data->lm_bindpw ) );
-               free( data->lm_bindpw );
-               data->lm_bindpw = NULL;
-       }
-       
-       free( data );
        (*pmap)->lb_private = NULL;
 
        return 0;