#include <stdio.h>
#include <ac/string.h>
+#include <ac/ctype.h>
#include <ac/socket.h>
#include "slap.h"
LDAP_BACK_CFG_ACL_AUTHCDN,
LDAP_BACK_CFG_ACL_PASSWD,
LDAP_BACK_CFG_ACL_METHOD,
+ LDAP_BACK_CFG_ACL_BIND,
LDAP_BACK_CFG_IDASSERT_MODE,
LDAP_BACK_CFG_IDASSERT_AUTHCDN,
LDAP_BACK_CFG_IDASSERT_PASSWD,
LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
LDAP_BACK_CFG_IDASSERT_METHOD,
+ LDAP_BACK_CFG_IDASSERT_BIND,
LDAP_BACK_CFG_REBIND,
LDAP_BACK_CFG_CHASE,
LDAP_BACK_CFG_T_F,
static ConfigTable ldapcfg[] = {
{ "uri", "uri", 2, 2, 0,
ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_URI,
- ldap_back_cf_gen, "( OLcfgDbAt:0.14 NAME 'olcDbURI' "
+ ldap_back_cf_gen, "( OLcfgDbAt:0.14 "
+ "NAME 'olcDbURI' "
"DESC 'URI (list) for remote DSA' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE )",
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE )",
NULL, NULL },
{ "tls", "what", 2, 2, 0,
- ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_TLS,
- ldap_back_cf_gen, "( OLcfgDbAt:3.1 NAME 'olcDbStartTLS' "
+ ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_TLS,
+ ldap_back_cf_gen, "( OLcfgDbAt:3.1 "
+ "NAME 'olcDbStartTLS' "
"DESC 'StartTLS' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE )",
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE )",
NULL, NULL },
{ "acl-authcDN", "DN", 2, 2, 0,
ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_ACL_AUTHCDN,
- ldap_back_cf_gen, "( OLcfgDbAt:3.2 NAME 'olcDbAclAuthcDn' "
+ ldap_back_cf_gen, "( OLcfgDbAt:3.2 "
+ "NAME 'olcDbACLAuthcDn' "
"DESC 'Remote ACL administrative identity' "
- "SYNTAX OMsDN SINGLE-VALUE )",
+ "OBSOLETE "
+ "SYNTAX OMsDN "
+ "SINGLE-VALUE )",
NULL, NULL },
/* deprecated; aliases "acl-authcDN" */
{ "binddn", "DN", 2, 2, 0,
ldap_back_cf_gen, NULL, NULL, NULL },
{ "acl-passwd", "cred", 2, 2, 0,
ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
- ldap_back_cf_gen, "( OLcfgDbAt:3.3 NAME 'olcDbAclPasswd' "
+ ldap_back_cf_gen, "( OLcfgDbAt:3.3 "
+ "NAME 'olcDbACLPasswd' "
"DESC 'Remote ACL administrative identity credentials' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE )",
+ "OBSOLETE "
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE )",
NULL, NULL },
/* deprecated; aliases "acl-passwd" */
{ "bindpw", "cred", 2, 2, 0,
ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_ACL_PASSWD,
ldap_back_cf_gen, NULL, NULL, NULL },
- { "acl-method", "method", 2, 0, 0,
- ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_ACL_METHOD,
- ldap_back_cf_gen, "( OLcfgDbAt:3.4 NAME 'olcDbAclMethod' "
- "DESC 'Remote ACL administrative identity auth method' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE )",
+ { "acl-bind", "args", 2, 0, 0,
+ ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_ACL_BIND,
+ ldap_back_cf_gen, "( OLcfgDbAt:3.4 "
+ "NAME 'olcDbACLBind' "
+ "DESC 'Remote ACL administrative identity auth bind configuration' "
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE )",
NULL, NULL },
+ /* deprecated; aliases "acl-bind" */
+ { "acl-method", "args", 2, 0, 0,
+ ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_ACL_BIND,
+ ldap_back_cf_gen, NULL, NULL, NULL },
{ "idassert-authcDN", "DN", 2, 2, 0,
ARG_DN|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHCDN,
- ldap_back_cf_gen, "( OLcfgDbAt:3.5 NAME 'olcDbIDAssertAuthcDn' "
+ ldap_back_cf_gen, "( OLcfgDbAt:3.5 "
+ "NAME 'olcDbIDAssertAuthcDn' "
"DESC 'Remote Identity Assertion administrative identity' "
- "SYNTAX OMsDN SINGLE-VALUE )",
+ "OBSOLETE "
+ "SYNTAX OMsDN "
+ "SINGLE-VALUE )",
NULL, NULL },
/* deprecated; partially aliases "idassert-authcDN" */
{ "proxyauthzdn", "DN", 2, 2, 0,
ldap_back_cf_gen, NULL, NULL, NULL },
{ "idassert-passwd", "cred", 2, 2, 0,
ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_PASSWD,
- ldap_back_cf_gen, "( OLcfgDbAt:3.6 NAME 'olcDbIDAssertPasswd' "
+ ldap_back_cf_gen, "( OLcfgDbAt:3.6 "
+ "NAME 'olcDbIDAssertPasswd' "
"DESC 'Remote Identity Assertion administrative identity credentials' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE )",
+ "OBSOLETE "
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE )",
NULL, NULL },
/* deprecated; partially aliases "idassert-passwd" */
{ "proxyauthzpw", "cred", 2, 2, 0,
ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_PASSWD,
ldap_back_cf_gen, NULL, NULL, NULL },
- { "idassert-method", "method", 2, 0, 0,
- ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_METHOD,
- ldap_back_cf_gen, "( OLcfgDbAt:3.7 NAME 'olcDbIDAssertMethod' "
- "DESC 'Remote Identity Assertion administrative identity auth method' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE )",
+ { "idassert-bind", "args", 2, 0, 0,
+ ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
+ ldap_back_cf_gen, "( OLcfgDbAt:3.7 "
+ "NAME 'olcDbIDAssertBind' "
+ "DESC 'Remote Identity Assertion administrative identity auth bind configuration' "
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE )",
NULL, NULL },
+ { "idassert-method", "args", 2, 0, 0,
+ ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_BIND,
+ ldap_back_cf_gen, NULL, NULL, NULL },
{ "idassert-mode", "mode>|u:<user>|[dn:]<DN", 2, 0, 0,
ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_MODE,
- ldap_back_cf_gen, "( OLcfgDbAt:3.8 NAME 'olcDbIDAssertMode' "
+ ldap_back_cf_gen, "( OLcfgDbAt:3.8 "
+ "NAME 'olcDbIDAssertMode' "
"DESC 'Remote Identity Assertion mode' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE)",
+ "OBSOLETE "
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE)",
NULL, NULL },
{ "idassert-authzFrom", "authzRule", 2, 2, 0,
ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_IDASSERT_AUTHZFROM,
- ldap_back_cf_gen, "( OLcfgDbAt:3.9 NAME 'olcDbIDAssertAuthzFrom' "
+ ldap_back_cf_gen, "( OLcfgDbAt:3.9 "
+ "NAME 'olcDbIDAssertAuthzFrom' "
"DESC 'Remote Identity Assertion authz rules' "
- "SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )",
+ "SYNTAX OMsDirectoryString "
+ "X-ORDERED 'VALUES' )",
NULL, NULL },
{ "rebind-as-user", "NO|yes", 1, 2, 0,
- ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_REBIND,
- ldap_back_cf_gen, "( OLcfgDbAt:3.10 NAME 'olcDbRebindAsUser' "
+ ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_REBIND,
+ ldap_back_cf_gen, "( OLcfgDbAt:3.10 "
+ "NAME 'olcDbRebindAsUser' "
"DESC 'Rebind as user' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE )",
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE )",
NULL, NULL },
{ "chase-referrals", "YES|no", 2, 2, 0,
- ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_CHASE,
- ldap_back_cf_gen, "( OLcfgDbAt:3.11 NAME 'olcDbChaseReferrals' "
+ ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_CHASE,
+ ldap_back_cf_gen, "( OLcfgDbAt:3.11 "
+ "NAME 'olcDbChaseReferrals' "
"DESC 'Chase referrals' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE )",
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE )",
NULL, NULL },
{ "t-f-support", "NO|yes|discover", 2, 2, 0,
- ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_T_F,
- ldap_back_cf_gen, "( OLcfgDbAt:3.12 NAME 'olcDbTFSupport' "
+ ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_T_F,
+ ldap_back_cf_gen, "( OLcfgDbAt:3.12 "
+ "NAME 'olcDbTFSupport' "
"DESC 'Absolute filters support' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE )",
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE )",
NULL, NULL },
{ "proxy-whoami", "NO|yes", 1, 2, 0,
- ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_WHOAMI,
- ldap_back_cf_gen, "( OLcfgDbAt:3.13 NAME 'olcDbProxyWhoAmI' "
+ ARG_BERVAL|ARG_MAGIC|LDAP_BACK_CFG_WHOAMI,
+ ldap_back_cf_gen, "( OLcfgDbAt:3.13 "
+ "NAME 'olcDbProxyWhoAmI' "
"DESC 'Proxy whoAmI exop' "
- "SYNTAX OMsDirectoryString SINGLE-VALUE )",
+ "SYNTAX OMsDirectoryString "
+ "SINGLE-VALUE )",
NULL, NULL },
{ "suffixmassage", "[virtual]> <real", 2, 3, 0,
ARG_STRING|ARG_MAGIC|LDAP_BACK_CFG_REWRITE,
"SUP olcDatabaseConfig "
"MUST olcDbURI "
"MAY ( olcDbStartTLS "
- "$ olcDbAclAuthcDn "
- "$ olcDbAclPasswd "
- "$ olcDbAclMethod "
+ "$ olcDbACLAuthcDn "
+ "$ olcDbACLPasswd "
+ "$ olcDbACLBind "
"$ olcDbIDAssertAuthcDn "
"$ olcDbIDAssertPasswd "
- "$ olcDbIDAssertMethod "
+ "$ olcDbIDAssertBind "
"$ olcDbIDAssertMode "
"$ olcDbIDAssertAuthzFrom "
"$ olcDbRebindAsUser "
{ NULL, 0, NULL }
};
-#define LDAP_BACK_C_MASK 0x80000000U
-#define LDAP_BACK_C_NO (0x0U|LDAP_BACK_C_MASK)
-#define LDAP_BACK_C_YES (0x1U|LDAP_BACK_C_MASK)
+#define LDAP_BACK_C_NO (0x0U)
+#define LDAP_BACK_C_YES (0x1U)
static slap_verbmasks yn_mode[] = {
{ BER_BVC( "yes" ), LDAP_BACK_C_YES},
{ BER_BVC( "no" ), LDAP_BACK_C_NO },
};
static slap_verbmasks idassert_mode[] = {
- { BER_BVC("legacy"), LDAP_BACK_IDASSERT_LEGACY },
{ BER_BVC("self"), LDAP_BACK_IDASSERT_SELF },
{ BER_BVC("anonymous"), LDAP_BACK_IDASSERT_ANONYMOUS },
{ BER_BVC("none"), LDAP_BACK_IDASSERT_NOASSERT },
+ { BER_BVC("legacy"), LDAP_BACK_IDASSERT_LEGACY },
{ BER_BVNULL, 0 }
};
static slap_verbmasks tls_mode[] = {
- { BER_BVC( "propagate" ), (LDAP_BACK_C_MASK|LDAP_BACK_F_TLS_PROPAGATE_MASK) },
- { BER_BVC( "try-propagate" ), (LDAP_BACK_C_MASK|LDAP_BACK_F_PROPAGATE_TLS) },
- { BER_BVC( "start" ), (LDAP_BACK_C_MASK|LDAP_BACK_F_TLS_USE_MASK) },
- { BER_BVC( "try-start" ), (LDAP_BACK_C_MASK|LDAP_BACK_F_USE_TLS) },
+ { BER_BVC( "propagate" ), LDAP_BACK_F_TLS_PROPAGATE_MASK },
+ { BER_BVC( "try-propagate" ), LDAP_BACK_F_PROPAGATE_TLS },
+ { BER_BVC( "start" ), LDAP_BACK_F_TLS_USE_MASK },
+ { BER_BVC( "try-start" ), LDAP_BACK_F_USE_TLS },
{ BER_BVC( "none" ), LDAP_BACK_C_NO },
{ BER_BVNULL, 0 }
};
static slap_verbmasks t_f_mode[] = {
- { BER_BVC( "yes" ), (LDAP_BACK_C_MASK|LDAP_BACK_F_SUPPORT_T_F) },
- { BER_BVC( "discover" ), (LDAP_BACK_C_MASK|LDAP_BACK_F_SUPPORT_T_F_DISCOVER) },
+ { BER_BVC( "yes" ), LDAP_BACK_F_SUPPORT_T_F },
+ { BER_BVC( "discover" ), LDAP_BACK_F_SUPPORT_T_F_DISCOVER },
{ BER_BVC( "no" ), LDAP_BACK_C_NO },
{ BER_BVNULL, 0 }
};
struct ldapinfo *li = ( struct ldapinfo * )c->be->be_private;
int rc;
int i;
- struct berval bv = BER_BVNULL;
if ( c->op == SLAP_CONFIG_EMIT ) {
+ struct berval bv = BER_BVNULL;
rc = 0;
+
switch( c->type ) {
case LDAP_BACK_CFG_URI:
if ( li->url != NULL ) {
}
break;
- case LDAP_BACK_CFG_TLS: {
- BerVarray bva = NULL;
-
- mask_to_verbs( tls_mode, ( ( li->flags & LDAP_BACK_F_TLS_MASK ) | LDAP_BACK_C_MASK ), &bva );
- if ( bva == NULL ) {
+ case LDAP_BACK_CFG_TLS:
+ enum_to_verb( tls_mode, ( li->flags & LDAP_BACK_F_TLS_MASK ), &bv );
+ if ( BER_BVISNULL( &bv ) ) {
/* there's something wrong... */
assert( 0 );
rc = 1;
} else {
- c->value_string = bva[ 0 ].bv_val;
- free( bva );
+ ber_dupbv( &c->value_bv, &bv );
}
break;
- }
case LDAP_BACK_CFG_ACL_AUTHCDN:
case LDAP_BACK_CFG_ACL_PASSWD:
- /* for simple and SASL bind they're handled
- * by LDAP_BACK_CFG_ACL_METHOD */
+ case LDAP_BACK_CFG_ACL_METHOD:
+ /* handled by LDAP_BACK_CFG_ACL_BIND */
rc = 1;
break;
- case LDAP_BACK_CFG_ACL_METHOD: {
+ case LDAP_BACK_CFG_ACL_BIND: {
int i;
bindconf_unparse( &li->acl_sb, &c->value_bv );
}
case LDAP_BACK_CFG_IDASSERT_MODE:
- switch ( li->idassert_mode ) {
- case LDAP_BACK_IDASSERT_OTHERID:
- case LDAP_BACK_IDASSERT_OTHERDN:
- c->value_string = ch_strdup( li->idassert_authzID.bv_val );
- break;
-
- default: {
- BerVarray bva = NULL;
- mask_to_verbs( idassert_mode, li->idassert_mode, &bva );
- if ( bva == NULL ) {
- /* there's something wrong... */
- assert( 0 );
- rc = 1;
-
- } else {
- c->value_string = bva[ 0 ].bv_val;
- free( bva );
- }
- break;
- }
- }
- break;
-
case LDAP_BACK_CFG_IDASSERT_AUTHCDN:
case LDAP_BACK_CFG_IDASSERT_PASSWD:
- /* for simple and SASL bind they're handled
- * by LDAP_BACK_CFG_IDASSERT_METHOD */
+ case LDAP_BACK_CFG_IDASSERT_METHOD:
+ /* handled by LDAP_BACK_CFG_IDASSERT_BIND */
rc = 1;
break;
break;
}
- case LDAP_BACK_CFG_IDASSERT_METHOD: {
- int i;
+ case LDAP_BACK_CFG_IDASSERT_BIND: {
+ int i;
+ struct berval bv = BER_BVNULL,
+ bc = BER_BVNULL;
+ char *ptr;
+
+ if ( li->idassert_authmethod != LDAP_AUTH_NONE ) {
+ ber_len_t len = bv.bv_len
+ + STRLENOF( "flags=override,non-prescriptive" );
+
+ switch ( li->idassert_mode ) {
+ case LDAP_BACK_IDASSERT_OTHERID:
+ case LDAP_BACK_IDASSERT_OTHERDN:
+ break;
+
+ default: {
+ struct berval mode = BER_BVNULL;
+
+ enum_to_verb( idassert_mode, li->idassert_mode, &mode );
+ if ( BER_BVISNULL( &mode ) ) {
+ /* there's something wrong... */
+ assert( 0 );
+ rc = 1;
+
+ } else {
+ bv.bv_len = STRLENOF( "mode=" ) + mode.bv_len;
+ bv.bv_val = ch_malloc( bv.bv_len + 1 );
- bindconf_unparse( &li->idassert_sb, &c->value_bv );
+ ptr = lutil_strcopy( bv.bv_val, "mode=" );
+ ptr = lutil_strcopy( ptr, mode.bv_val );
+ }
+ break;
+ }
+ }
- for ( i = 0; isspace( c->value_bv.bv_val[ i ] ); i++ )
- /* count spaces */ ;
+ if ( li->idassert_flags & LDAP_BACK_AUTH_NATIVE_AUTHZ ) {
+ ber_len_t len = bv.bv_len + STRLENOF( "authz=native" );
- if ( i ) {
- c->value_bv.bv_len -= i;
- AC_MEMCPY( c->value_bv.bv_val, &c->value_bv.bv_val[ i ],
- c->value_bv.bv_len + 1 );
+ if ( !BER_BVISEMPTY( &bv ) ) {
+ len += STRLENOF( " " );
+ }
+
+ bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
+
+ ptr = bv.bv_val + bv.bv_len;
+
+ if ( !BER_BVISEMPTY( &bv ) ) {
+ ptr = lutil_strcopy( ptr, " " );
+ }
+
+ (void)lutil_strcopy( ptr, "authz=native" );
+ }
+
+ /* flags */
+ if ( !BER_BVISEMPTY( &bv ) ) {
+ len += STRLENOF( " " );
+ }
+
+ bv.bv_val = ch_realloc( bv.bv_val, len + 1 );
+
+ ptr = &bv.bv_val[ bv.bv_len ];
+
+ if ( !BER_BVISEMPTY( &bv ) ) {
+ ptr = lutil_strcopy( ptr, " " );
+ }
+
+ ptr = lutil_strcopy( ptr, "flags=" );
+
+ if ( li->idassert_flags & LDAP_BACK_AUTH_PRESCRIPTIVE ) {
+ ptr = lutil_strcopy( ptr, "prescriptive" );
+ } else {
+ ptr = lutil_strcopy( ptr, "non-prescriptive" );
+ }
+
+ if ( li->idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) {
+ ptr = lutil_strcopy( ptr, ",override" );
+ }
+
+ bv.bv_len = ( ptr - bv.bv_val );
+ /* end-of-flags */
+ }
+
+ bindconf_unparse( &li->idassert_sb, &bc );
+
+ if ( !BER_BVISNULL( &bv ) ) {
+ char *ptr;
+
+ c->value_bv.bv_len = bv.bv_len + bc.bv_len;
+ c->value_bv.bv_val = ch_realloc( bv.bv_val, c->value_bv.bv_len + 1 );
+
+ assert( bc.bv_val[ 0 ] == ' ' );
+
+ ptr = lutil_strcopy( c->value_bv.bv_val, bv.bv_val );
+ (void)lutil_strcopy( ptr, bc.bv_val );
+
+ free( bc.bv_val );
+
+ } else {
+ for ( i = 0; isspace( bc.bv_val[ i ] ); i++ )
+ /* count spaces */ ;
+
+ if ( i ) {
+ bc.bv_len -= i;
+ AC_MEMCPY( bc.bv_val, &bc.bv_val[ i ], bc.bv_len + 1 );
+ }
+
+ c->value_bv = bv;
}
break;
}
- case LDAP_BACK_CFG_REBIND: {
- BerVarray bva = NULL;
-
- mask_to_verbs( yn_mode, ( ( li->flags & LDAP_BACK_F_SAVECRED ) | LDAP_BACK_C_MASK ), &bva );
- if ( bva == NULL ) {
+ case LDAP_BACK_CFG_REBIND:
+ enum_to_verb( yn_mode, ( ( li->flags & LDAP_BACK_F_SAVECRED ) == LDAP_BACK_F_SAVECRED ), &bv );
+ if ( BER_BVISNULL( &bv ) ) {
/* there's something wrong... */
assert( 0 );
rc = 1;
} else {
- c->value_string = bva[ 0 ].bv_val;
- free( bva );
+ ber_dupbv( &c->value_bv, &bv );
}
break;
- }
-
- case LDAP_BACK_CFG_CHASE: {
- BerVarray bva = NULL;
- mask_to_verbs( yn_mode, ( ( li->flags & LDAP_BACK_F_CHASE_REFERRALS ) | LDAP_BACK_C_MASK ), &bva );
- if ( bva == NULL ) {
+ case LDAP_BACK_CFG_CHASE:
+ enum_to_verb( yn_mode, ( ( li->flags & LDAP_BACK_F_CHASE_REFERRALS ) == LDAP_BACK_F_CHASE_REFERRALS ), &bv );
+ if ( BER_BVISNULL( &bv ) ) {
/* there's something wrong... */
assert( 0 );
rc = 1;
} else {
- c->value_string = bva[ 0 ].bv_val;
- free( bva );
+ ber_dupbv( &c->value_bv, &bv );
}
break;
- }
-
- case LDAP_BACK_CFG_T_F: {
- BerVarray bva = NULL;
- mask_to_verbs( t_f_mode, ( ( li->flags & LDAP_BACK_F_SUPPORT_T_F_MASK ) | LDAP_BACK_C_MASK ), &bva );
- if ( bva == NULL ) {
+ case LDAP_BACK_CFG_T_F:
+ enum_to_verb( t_f_mode, ( ( li->flags & LDAP_BACK_F_SUPPORT_T_F_MASK ) == LDAP_BACK_F_SUPPORT_T_F_MASK ), &bv );
+ if ( BER_BVISNULL( &bv ) ) {
/* there's something wrong... */
assert( 0 );
rc = 1;
} else {
- c->value_string = bva[ 0 ].bv_val;
- free( bva );
+ ber_dupbv( &c->value_bv, &bv );
}
break;
- }
- case LDAP_BACK_CFG_WHOAMI: {
- BerVarray bva = NULL;
-
- mask_to_verbs( yn_mode, ( ( li->flags & LDAP_BACK_F_PROXY_WHOAMI ) | LDAP_BACK_C_MASK ), &bva );
- if ( bva == NULL ) {
+ case LDAP_BACK_CFG_WHOAMI:
+ enum_to_verb( yn_mode, ( ( li->flags & LDAP_BACK_F_PROXY_WHOAMI ) == LDAP_BACK_F_PROXY_WHOAMI ), &bv );
+ if ( BER_BVISNULL( &bv ) ) {
/* there's something wrong... */
assert( 0 );
rc = 1;
} else {
- c->value_string = bva[ 0 ].bv_val;
- free( bva );
+ ber_dupbv( &c->value_bv, &bv );
}
break;
+
+ default:
+ /* we need to handle all... */
+ assert( 0 );
+ break;
}
+ return rc;
+
+ } else if ( c->op == LDAP_MOD_DELETE ) {
+ rc = 0;
+ switch( c->type ) {
+ case LDAP_BACK_CFG_URI:
+ if ( li->url != NULL ) {
+ ch_free( li->url );
+ li->url = NULL;
+ }
+
+ if ( li->lud != NULL ) {
+ ldap_free_urllist( li->lud );
+ li->lud = NULL;
+ }
+
+ /* better cleanup the cached connections... */
+ /* NOTE: don't worry about locking: if we got here,
+ * other threads are suspended. */
+ avl_free( li->conntree, ldap_back_conn_free );
+ li->conntree = NULL;
+
+ break;
+
+ case LDAP_BACK_CFG_TLS:
+ case LDAP_BACK_CFG_ACL_AUTHCDN:
+ case LDAP_BACK_CFG_ACL_PASSWD:
+ case LDAP_BACK_CFG_ACL_METHOD:
+ /* handled by LDAP_BACK_CFG_ACL_BIND */
+ rc = 1;
+ break;
+
+ case LDAP_BACK_CFG_ACL_BIND:
+ bindconf_free( &li->acl_sb );
+ break;
+
+ case LDAP_BACK_CFG_IDASSERT_MODE:
+ case LDAP_BACK_CFG_IDASSERT_AUTHCDN:
+ case LDAP_BACK_CFG_IDASSERT_PASSWD:
+ case LDAP_BACK_CFG_IDASSERT_METHOD:
+ /* handled by LDAP_BACK_CFG_IDASSERT_BIND */
+ rc = 1;
+ break;
+
+ case LDAP_BACK_CFG_IDASSERT_AUTHZFROM:
+ if ( li->idassert_authz != NULL ) {
+ ber_bvarray_free( li->idassert_authz );
+ li->idassert_authz = NULL;
+ }
+ break;
+
+ case LDAP_BACK_CFG_IDASSERT_BIND:
+ bindconf_free( &li->idassert_sb );
+ break;
+
+ case LDAP_BACK_CFG_REBIND:
+ case LDAP_BACK_CFG_CHASE:
+ case LDAP_BACK_CFG_T_F:
+ case LDAP_BACK_CFG_WHOAMI:
+ rc = 1;
+ break;
default:
/* we need to handle all... */
break;
}
return rc;
+
}
switch( c->type ) {
- case LDAP_BACK_CFG_URI:
+ case LDAP_BACK_CFG_URI: {
+ LDAPURLDesc *tmpludp;
+ char **urllist;
+ int urlrc, i;
+
+ if ( c->argc != 2 ) {
+ fprintf( stderr, "%s: line %d: "
+ "missing uri "
+ "in \"uri <uri>\" line\n",
+ c->fname, c->lineno );
+ return 1;
+ }
+
+ if ( li->url != NULL ) {
+ ch_free( li->url );
+ }
+
+ if ( li->lud != NULL ) {
+ ldap_free_urllist( li->lud );
+ }
+
+#if 0
+ /* PARANOID: DN and more are not required nor allowed */
+ urlrc = ldap_url_parselist_ext( &li->lud, c->value_string, "\t" );
+#else
+ urlrc = ldap_url_parselist( &li->lud, c->value_string );
+#endif
+ if ( urlrc != LDAP_URL_SUCCESS ) {
+ char *why;
+
+ switch ( urlrc ) {
+ case LDAP_URL_ERR_MEM:
+ why = "no memory";
+ break;
+ case LDAP_URL_ERR_PARAM:
+ why = "parameter is bad";
+ break;
+ case LDAP_URL_ERR_BADSCHEME:
+ why = "URL doesn't begin with \"[c]ldap[si]://\"";
+ break;
+ case LDAP_URL_ERR_BADENCLOSURE:
+ why = "URL is missing trailing \">\"";
+ break;
+ case LDAP_URL_ERR_BADURL:
+ why = "URL is bad";
+ case LDAP_URL_ERR_BADHOST:
+ why = "host/port is bad";
+ break;
+ case LDAP_URL_ERR_BADATTRS:
+ why = "bad (or missing) attributes";
+ break;
+ case LDAP_URL_ERR_BADSCOPE:
+ why = "scope string is invalid (or missing)";
+ break;
+ case LDAP_URL_ERR_BADFILTER:
+ why = "bad or missing filter";
+ break;
+ case LDAP_URL_ERR_BADEXTS:
+ why = "bad or missing extensions";
+ break;
+ default:
+ why = "unknown reason";
+ break;
+ }
+ fprintf( stderr, "%s: line %d: "
+ "unable to parse uri \"%s\" "
+ "in \"uri <uri>\" line: %s\n",
+ c->fname, c->lineno, c->value_string, why );
+ return 1;
+ }
+
+ for ( i = 0, tmpludp = li->lud;
+ tmpludp;
+ i++, tmpludp = tmpludp->lud_next )
+ {
+ if ( ( tmpludp->lud_dn != NULL
+ && tmpludp->lud_dn[0] != '\0' )
+ || tmpludp->lud_attrs != NULL
+ /* || tmpludp->lud_scope != LDAP_SCOPE_DEFAULT */
+ || tmpludp->lud_filter != NULL
+ || tmpludp->lud_exts != NULL )
+ {
+ fprintf( stderr, "%s: line %d: "
+ "warning, only protocol, "
+ "host and port allowed "
+ "in \"uri <uri>\" statement "
+ "for uri #%d of \"%s\"\n",
+ c->fname, c->lineno, i, c->value_string );
+ }
+ }
+
+#if 0
+ for ( i = 0, tmpludp = li->lud;
+ tmpludp;
+ i++, tmpludp = tmpludp->lud_next )
+ /* just count */
+
+ urllist = ch_calloc( sizeof( char * ), i + 1 );
+
+ for ( i = 0, tmpludp = li->lud;
+ tmpludp;
+ i++, tmpludp = tmpludp->lud_next )
+ {
+ LDAPURLDesc tmplud;
+ ber_len_t oldlen = 0, len;
+
+ tmplud = *tmpludp;
+ tmplud.lud_dn = "";
+ tmplud.lud_attrs = NULL;
+ tmplud.lud_filter = NULL;
+ if ( !ldap_is_ldapi_url( tmplud.lud_scheme ) ) {
+ tmplud.lud_exts = NULL;
+ tmplud.lud_crit_exts = 0;
+ }
+
+ urllist[ i ] = ldap_url_desc2str( &tmplud );
+
+ if ( urllist[ i ] == NULL ) {
+ fprintf( stderr, "%s: line %d: "
+ "unable to rebuild uri "
+ "in \"uri <uri>\" statement "
+ "for \"%s\"\n",
+ c->fname, c->lineno, argv[ 1 ] );
+ return 1;
+ }
+ }
+
+ li->url = ldap_charray2str( urllist, " " );
+ ldap_charray_free( urllist );
+#else
li->url = ch_strdup( c->value_string );
+#endif
break;
+ }
case LDAP_BACK_CFG_TLS:
i = verb_to_mask( c->argv[1], tls_mode );
return 1;
}
li->flags &= ~LDAP_BACK_F_TLS_MASK;
- li->flags |= ( tls_mode[i].mask & ~LDAP_BACK_C_MASK );
+ li->flags |= tls_mode[i].mask;
break;
case LDAP_BACK_CFG_ACL_AUTHCDN:
+ switch ( li->acl_authmethod ) {
+ case LDAP_AUTH_NONE:
+ li->acl_authmethod = LDAP_AUTH_SIMPLE;
+ break;
+
+ case LDAP_AUTH_SIMPLE:
+ break;
+
+ default:
+ fprintf( stderr, "%s: line %d: "
+ "\"acl-authcDN <DN>\" incompatible "
+ "with auth method %d.",
+ c->fname, c->lineno, li->acl_authmethod );
+ return 1;
+ }
if ( !BER_BVISNULL( &li->acl_authcDN ) ) {
free( li->acl_authcDN.bv_val );
}
break;
case LDAP_BACK_CFG_ACL_PASSWD:
+ switch ( li->acl_authmethod ) {
+ case LDAP_AUTH_NONE:
+ li->acl_authmethod = LDAP_AUTH_SIMPLE;
+ break;
+
+ case LDAP_AUTH_SIMPLE:
+ break;
+
+ default:
+ fprintf( stderr, "%s: line %d: "
+ "\"acl-passwd <cred>\" incompatible "
+ "with auth method %d.",
+ c->fname, c->lineno, li->acl_authmethod );
+ return 1;
+ }
if ( !BER_BVISNULL( &li->acl_passwd ) ) {
free( li->acl_passwd.bv_val );
}
break;
case LDAP_BACK_CFG_ACL_METHOD:
+ case LDAP_BACK_CFG_ACL_BIND:
for ( i = 1; i < c->argc; i++ ) {
if ( bindconf_parse( c->argv[ i ], &li->acl_sb ) ) {
return 1;
}
} else {
- li->idassert_mode |= ( idassert_mode[i].mask & ~LDAP_BACK_C_MASK );
+ li->idassert_mode = idassert_mode[i].mask;
}
if ( c->argc > 2 ) {
if ( strcasecmp( c->argv[ i ], "override" ) == 0 ) {
li->idassert_flags |= LDAP_BACK_AUTH_OVERRIDE;
+ } else if ( strcasecmp( c->argv[ i ], "prescriptive" ) == 0 ) {
+ li->idassert_flags |= LDAP_BACK_AUTH_PRESCRIPTIVE;
+
+ } else if ( strcasecmp( c->argv[ i ], "non-prescriptive" ) == 0 ) {
+ li->idassert_flags &= ( ~LDAP_BACK_AUTH_PRESCRIPTIVE );
+
} else {
Debug( LDAP_DEBUG_ANY,
"%s: line %d: unknown flag #%d "
break;
case LDAP_BACK_CFG_IDASSERT_AUTHCDN:
+ switch ( li->idassert_authmethod ) {
+ case LDAP_AUTH_NONE:
+ li->idassert_authmethod = LDAP_AUTH_SIMPLE;
+ break;
+
+ case LDAP_AUTH_SIMPLE:
+ break;
+
+ default:
+ fprintf( stderr, "%s: line %d: "
+ "\"idassert-authcDN <DN>\" incompatible "
+ "with auth method %d.",
+ c->fname, c->lineno, li->idassert_authmethod );
+ return 1;
+ }
if ( !BER_BVISNULL( &li->idassert_authcDN ) ) {
free( li->idassert_authcDN.bv_val );
}
break;
case LDAP_BACK_CFG_IDASSERT_PASSWD:
+ switch ( li->idassert_authmethod ) {
+ case LDAP_AUTH_NONE:
+ li->idassert_authmethod = LDAP_AUTH_SIMPLE;
+ break;
+
+ case LDAP_AUTH_SIMPLE:
+ break;
+
+ default:
+ fprintf( stderr, "%s: line %d: "
+ "\"idassert-passwd <cred>\" incompatible "
+ "with auth method %d.",
+ c->fname, c->lineno, li->idassert_authmethod );
+ return 1;
+ }
if ( !BER_BVISNULL( &li->idassert_passwd ) ) {
free( li->idassert_passwd.bv_val );
}
break;
case LDAP_BACK_CFG_IDASSERT_METHOD:
+ /* no longer supported */
+ fprintf( stderr, "%s: %d: "
+ "\"idassert-method <args>\": "
+ "no longer supported; use \"idassert-bind\".\n",
+ c->fname, c->lineno );
+ return 1;
+
+ case LDAP_BACK_CFG_IDASSERT_BIND:
for ( i = 1; i < c->argc; i++ ) {
- if ( bindconf_parse( c->argv[ i ], &li->idassert_sb ) ) {
+ if ( strncasecmp( c->argv[ i ], "mode=", STRLENOF( "mode=" ) ) == 0 ) {
+ char *argvi = c->argv[ i ] + STRLENOF( "mode=" );
+ int j;
+
+ j = verb_to_mask( argvi, idassert_mode );
+ if ( BER_BVISNULL( &idassert_mode[ j ].word ) ) {
+ fprintf( stderr, "%s: %d: "
+ "\"idassert-bind <args>\": "
+ "unknown mode \"%s\".\n",
+ c->fname, c->lineno, argvi );
+ return 1;
+ }
+
+ li->idassert_mode = idassert_mode[ j ].mask;
+
+ } else if ( strncasecmp( c->argv[ i ], "authz=", STRLENOF( "authz=" ) ) == 0 ) {
+ char *argvi = c->argv[ i ] + STRLENOF( "authz=" );
+
+ if ( strcasecmp( argvi, "native" ) == 0 ) {
+ if ( li->idassert_authmethod != LDAP_AUTH_SASL ) {
+ fprintf( stderr, "%s: %d: "
+ "\"idassert-bind <args>\": "
+ "authz=\"native\" incompatible "
+ "with auth method.\n",
+ c->fname, c->lineno );
+ return 1;
+ }
+ li->idassert_flags |= LDAP_BACK_AUTH_NATIVE_AUTHZ;
+
+ } else if ( strcasecmp( argvi, "proxyAuthz" ) == 0 ) {
+ li->idassert_flags &= ~LDAP_BACK_AUTH_NATIVE_AUTHZ;
+
+ } else {
+ fprintf( stderr, "%s: %d: "
+ "\"idassert-bind <args>\": "
+ "unknown authz \"%s\".\n",
+ c->fname, c->lineno, argvi );
+ return 1;
+ }
+
+ } else if ( strncasecmp( c->argv[ i ], "flags=", STRLENOF( "flags=" ) ) == 0 ) {
+ char *argvi = c->argv[ i ] + STRLENOF( "flags=" );
+ char **flags = ldap_str2charray( argvi, "," );
+ int j;
+
+ if ( flags == NULL ) {
+ fprintf( stderr, "%s: %d: "
+ "\"idassert-bind <args>\": "
+ "unable to parse flags \"%s\".\n",
+ c->fname, c->lineno, argvi );
+ return 1;
+ }
+
+ for ( j = 0; flags[ j ] != NULL; j++ ) {
+ if ( strcasecmp( flags[ j ], "override" ) == 0 ) {
+ li->idassert_flags |= LDAP_BACK_AUTH_OVERRIDE;
+
+ } else if ( strcasecmp( flags[ j ], "prescriptive" ) == 0 ) {
+ li->idassert_flags |= LDAP_BACK_AUTH_PRESCRIPTIVE;
+
+ } else if ( strcasecmp( flags[ j ], "non-prescriptive" ) == 0 ) {
+ li->idassert_flags &= ( ~LDAP_BACK_AUTH_PRESCRIPTIVE );
+
+ } else {
+ fprintf( stderr, "%s: %d: "
+ "\"idassert-bind <args>\": "
+ "unknown flag \"%s\".\n",
+ c->fname, c->lineno, flags[ j ] );
+ return 1;
+ }
+ }
+
+ ldap_charray_free( flags );
+
+ } else if ( bindconf_parse( c->argv[ i ], &li->idassert_sb ) ) {
return 1;
}
}
return 1;
}
li->flags &= ~LDAP_BACK_F_SUPPORT_T_F_MASK;
- li->flags |= ( t_f_mode[i].mask & ~LDAP_BACK_C_MASK );
+ li->flags |= t_f_mode[i].mask;
break;
case LDAP_BACK_CFG_WHOAMI: {
break;
}
- break;
-
+ case LDAP_BACK_CFG_REWRITE:
+ fprintf( stderr, "%s: line %d: "
+ "rewrite/remap capabilities have been moved "
+ "to the \"rwm\" overlay; see slapo-rwm(5) "
+ "for details (hint: add \"overlay rwm\" "
+ "and prefix all directives with \"rwm-\").\n",
+ c->fname, c->lineno );
+ return 1;
+
+ default:
+ assert( 0 );
}
return 0;
/* setup olcDbAclPasswd and olcDbIDAssertPasswd
* to be base64-encoded when written in LDIF form;
* basically, we don't care if it fails */
- rc = slap_str2ad( "olcDbAclPasswd", &ad, &text );
+ rc = slap_str2ad( "olcDbACLPasswd", &ad, &text );
if ( rc ) {
Debug( LDAP_DEBUG_ANY, "config_back_initialize: "
- "warning, unable to get \"olcDbAclPasswd\" "
+ "warning, unable to get \"olcDbACLPasswd\" "
"attribute description: %d: %s\n",
rc, text, 0 );
} else {
|| strcasecmp( argv[0], "map" ) == 0
|| strncasecmp( argv[0], "rewrite", STRLENOF( "rewrite" ) ) == 0 )
{
+#if 0
fprintf( stderr, "%s: line %d: "
"rewrite/remap capabilities have been moved "
"to the \"rwm\" overlay; see slapo-rwm(5) "
return ( *be->bd_info->bi_db_config )( be, fname, lineno, argc, argv );
}
+#else
+ fprintf( stderr, "%s: line %d: "
+ "rewrite/remap capabilities have been moved "
+ "to the \"rwm\" overlay; see slapo-rwm(5) "
+ "for details (hint: add \"overlay rwm\" "
+ "and prefix all directives with \"rwm-\").\n",
+ fname, lineno );
+#endif
- return SLAP_CONF_UNKNOWN;
+ return 1;
/* anything else */
} else {
if (rs->sr_err != LDAP_SUCCESS) {
rs->sr_err = slap_map_api2result( rs );
}
+
+ if ( lc != NULL ) {
+ ldap_back_release_conn( &op2, rs, lc );
+ }
+
} else {
/* else just do the same as before */
bv = (struct berval *) ch_malloc( sizeof(struct berval) );
projects / openldap / blobdiff