provisions for configuring a desired chaining policy via the chaining behavior control

[openldap] / servers / slapd / back-ldap / config.c

diff --git a/servers/slapd/back-ldap/config.c b/servers/slapd/back-ldap/config.c
index fd85eecea310a91fbd53191a9395e69b0b602591..436c713c573671045a21fc92d0b10032adbce3bb 100644 (file)
--- a/servers/slapd/back-ldap/config.c
+++ b/servers/slapd/back-ldap/config.c
@@ -213,6 +213,51 @@ ldap_back_db_config(
                li->url = ch_strdup( argv[ 1 ] );
 #endif
 
+       } else if ( strncasecmp( argv[0], "tls-", STRLENOF( "tls-" ) ) == 0 ) {
+
+               /* start tls */
+               if ( strcasecmp( argv[0], "tls-start" ) == 0 ) {
+                       if ( argc != 1 ) {
+                               fprintf( stderr,
+               "%s: line %d: tls-start takes no arguments\n",
+                                               fname, lineno );
+                               return( 1 );
+                       }
+                       li->flags |= ( LDAP_BACK_F_USE_TLS | LDAP_BACK_F_TLS_CRITICAL );
+       
+               /* try start tls */
+               } else if ( strcasecmp( argv[0], "tls-try-start" ) == 0 ) {
+                       if ( argc != 1 ) {
+                               fprintf( stderr,
+               "%s: line %d: tls-try-start takes no arguments\n",
+                                               fname, lineno );
+                               return( 1 );
+                       }
+                       li->flags &= ~LDAP_BACK_F_TLS_CRITICAL;
+                       li->flags |= LDAP_BACK_F_USE_TLS;
+       
+               /* propagate start tls */
+               } else if ( strcasecmp( argv[0], "tls-propagate" ) == 0 ) {
+                       if ( argc != 1 ) {
+                               fprintf( stderr,
+               "%s: line %d: tls-propagate takes no arguments\n",
+                                               fname, lineno );
+                               return( 1 );
+                       }
+                       li->flags |= ( LDAP_BACK_F_PROPAGATE_TLS | LDAP_BACK_F_TLS_CRITICAL );
+               
+               /* try start tls */
+               } else if ( strcasecmp( argv[0], "tls-try-propagate" ) == 0 ) {
+                       if ( argc != 1 ) {
+                               fprintf( stderr,
+               "%s: line %d: tls-try-propagate takes no arguments\n",
+                                               fname, lineno );
+                               return( 1 );
+                       }
+                       li->flags &= ~LDAP_BACK_F_TLS_CRITICAL;
+                       li->flags |= LDAP_BACK_F_PROPAGATE_TLS;
+               }
+       
        /* name to use for ldap_back_group */
        } else if ( strcasecmp( argv[0], "acl-authcdn" ) == 0
                        || strcasecmp( argv[0], "binddn" ) == 0 )
@@ -268,12 +313,32 @@ ldap_back_db_config(
        } else if ( strcasecmp( argv[0], "rebind-as-user" ) == 0 ) {
                if ( argc != 1 ) {
                        fprintf( stderr,
-       "%s: line %d: rebind-as-user takes no arguments\n",
+       "%s: line %d: \"rebind-as-user\" takes no arguments\n",
                                        fname, lineno );
                        return( 1 );
                }
-               li->savecred = 1;
-       
+               li->flags |= LDAP_BACK_F_SAVECRED;
+
+       } else if ( strcasecmp( argv[0], "chase-referrals" ) == 0 ) {
+               if ( argc != 1 ) {
+                       fprintf( stderr,
+       "%s: line %d: \"chase-referrals\" takes no arguments\n",
+                                       fname, lineno );
+                       return( 1 );
+               }
+
+               li->flags |= LDAP_BACK_F_CHASE_REFERRALS;
+
+       } else if ( strcasecmp( argv[0], "dont-chase-referrals" ) == 0 ) {
+               if ( argc != 1 ) {
+                       fprintf( stderr,
+       "%s: line %d: \"dont-chase-referrals\" takes no arguments\n",
+                                       fname, lineno );
+                       return( 1 );
+               }
+
+               li->flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
+
        /* intercept exop_who_am_i? */
        } else if ( strcasecmp( argv[0], "proxy-whoami" ) == 0 ) {
                if ( argc != 1 ) {
@@ -360,8 +425,8 @@ ldap_back_exop_whoami(
 
                ctrls[0] = &c;
                op2.o_ndn = op->o_conn->c_ndn;
-               lc = ldap_back_getconn(&op2, rs);
-               if (!lc || !ldap_back_dobind( lc, op, rs )) {
+               lc = ldap_back_getconn(&op2, rs, LDAP_BACK_SENDERR);
+               if (!lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR )) {
                        return -1;
                }
                c.ldctl_oid = LDAP_CONTROL_PROXY_AUTHZ;
@@ -379,7 +444,7 @@ retry:
                                        &rs->sr_err);
                                if ( rs->sr_err == LDAP_SERVER_DOWN && do_retry ) {
                                        do_retry = 0;
-                                       if ( ldap_back_retry( lc, op, rs ) )
+                                       if ( ldap_back_retry( lc, op, rs, LDAP_BACK_SENDERR ) )
                                                goto retry;
                                }
                                ldap_back_freeconn( op, lc );
@@ -682,7 +747,7 @@ parse_idassert(
                                                li->idassert_flags |= LDAP_BACK_AUTH_NATIVE_AUTHZ;
 
                                        } else {
-                                               fprintf( stderr, "%s: line %s: "
+                                               fprintf( stderr, "%s: line %d: "
                                                        "unknown authz mode \"%s\"\n",
                                                        fname, lineno, val );
                                                return 1;