Add a sample ACL

[openldap] / servers / slapd / aclparse.c

diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index ea8f6b9eedee98bec83263dda809dc09062e6937..a7df30bd8e71c844aa9e9e27501ced2d6d536221 100644 (file)
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -136,9 +136,9 @@ parse_acl(
                                split( argv[i], '=', &left, &right );
                                split( left, '.', &left, &style );
 
-                               if ( right == NULL || *right == '\0' ) {
+                               if ( right == NULL ) {
                                        fprintf( stderr,
-       "%s: line %d: missing \"=\" in (or value after) \"%s\" in to clause\n",
+       "%s: line %d: missing \"=\" in \"%s\" in to clause\n",
                                            fname, lineno, left );
                                        acl_usage();
                                }
@@ -393,7 +393,9 @@ parse_acl(
 
 
                                        if( !is_at_syntax( b->a_dn_at->ad_type,
-                                               SLAPD_DN_SYNTAX ) )
+                                               SLAPD_DN_SYNTAX ) &&
+                                               !is_at_syntax( b->a_dn_at->ad_type,
+                                               SLAPD_NAMEUID_SYNTAX ))
                                        {
                                                fprintf( stderr,
                                                        "%s: line %d: dnattr \"%s\": "
@@ -508,7 +510,9 @@ parse_acl(
                                        }
 
                                        if( !is_at_syntax( b->a_group_at->ad_type,
-                                               SLAPD_DN_SYNTAX ) )
+                                               SLAPD_DN_SYNTAX ) &&
+                                           !is_at_syntax( b->a_group_at->ad_type,
+                                               SLAPD_NAMEUID_SYNTAX ) )
                                        {
                                                fprintf( stderr,
                                                        "%s: line %d: group \"%s\": inappropriate syntax: %s\n",
@@ -672,6 +676,110 @@ parse_acl(
                                }
 #endif /* SLAPD_ACI_ENABLED */
 
+                               if ( strcasecmp( left, "ssf" ) == 0 ) {
+                                       if( b->a_authz.sai_ssf ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: ssf attribute already specified.\n",
+                                                       fname, lineno );
+                                               acl_usage();
+                                       }
+
+                                       if ( right == NULL || *right == '\0' ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: no ssf is defined\n",
+                                                       fname, lineno );
+                                               acl_usage();
+                                       }
+
+                                       b->a_authz.sai_ssf = atoi( right );
+
+                                       if( !b->a_authz.sai_ssf ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: invalid ssf value (%s)\n",
+                                                       fname, lineno, right );
+                                               acl_usage();
+                                       }
+                                       continue;
+                               }
+
+                               if ( strcasecmp( left, "transport_ssf" ) == 0 ) {
+                                       if( b->a_authz.sai_transport_ssf ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: transport_ssf attribute already specified.\n",
+                                                       fname, lineno );
+                                               acl_usage();
+                                       }
+
+                                       if ( right == NULL || *right == '\0' ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: no transport_ssf is defined\n",
+                                                       fname, lineno );
+                                               acl_usage();
+                                       }
+
+                                       b->a_authz.sai_transport_ssf = atoi( right );
+
+                                       if( !b->a_authz.sai_transport_ssf ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: invalid transport_ssf value (%s)\n",
+                                                       fname, lineno, right );
+                                               acl_usage();
+                                       }
+                                       continue;
+                               }
+
+                               if ( strcasecmp( left, "tls_ssf" ) == 0 ) {
+                                       if( b->a_authz.sai_tls_ssf ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: tls_ssf attribute already specified.\n",
+                                                       fname, lineno );
+                                               acl_usage();
+                                       }
+
+                                       if ( right == NULL || *right == '\0' ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: no tls_ssf is defined\n",
+                                                       fname, lineno );
+                                               acl_usage();
+                                       }
+
+                                       b->a_authz.sai_tls_ssf = atoi( right );
+
+                                       if( !b->a_authz.sai_tls_ssf ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: invalid tls_ssf value (%s)\n",
+                                                       fname, lineno, right );
+                                               acl_usage();
+                                       }
+                                       continue;
+                               }
+
+                               if ( strcasecmp( left, "sasl_ssf" ) == 0 ) {
+                                       if( b->a_authz.sai_sasl_ssf ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: sasl_ssf attribute already specified.\n",
+                                                       fname, lineno );
+                                               acl_usage();
+                                       }
+
+                                       if ( right == NULL || *right == '\0' ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: no sasl_ssf is defined\n",
+                                                       fname, lineno );
+                                               acl_usage();
+                                       }
+
+                                       b->a_authz.sai_sasl_ssf = atoi( right );
+
+                                       if( !b->a_authz.sai_sasl_ssf ) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: invalid sasl_ssf value (%s)\n",
+                                                       fname, lineno, right );
+                                               acl_usage();
+                                       }
+                                       continue;
+                               }
+
                                if( right != NULL ) {
                                        /* unsplit */
                                        right[-1] = '=';
@@ -969,6 +1077,7 @@ acl_usage( void )
 #ifdef SLAPD_ACI_ENABLED
                        "\t[aci=<attrname>]\n"
 #endif
+                       "\t[ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>]\n"
                "<access> ::= [self]{<level>|<priv>}\n"
                "<level> ::= none | auth | compare | search | read | write\n"
                "<priv> ::= {=|+|-}{w|r|s|c|x}+\n"
@@ -1129,6 +1238,24 @@ print_access( Access *b )
        }
 #endif
 
+       /* Security Strength Factors */
+       if ( b->a_authz.sai_ssf ) {
+               fprintf( stderr, " ssf=%u",
+                       b->a_authz.sai_ssf );
+       }
+       if ( b->a_authz.sai_transport_ssf ) {
+               fprintf( stderr, " transport_ssf=%u",
+                       b->a_authz.sai_transport_ssf );
+       }
+       if ( b->a_authz.sai_tls_ssf ) {
+               fprintf( stderr, " tls_ssf=%u",
+                       b->a_authz.sai_tls_ssf );
+       }
+       if ( b->a_authz.sai_sasl_ssf ) {
+               fprintf( stderr, " sasl_ssf=%u",
+                       b->a_authz.sai_sasl_ssf );
+       }
+
        fprintf( stderr, " %s%s",
                b->a_dn_self ? "self" : "",
                accessmask2str( b->a_access_mask, maskbuf ) );