make referrals chasing optional (default is to chase them)

[openldap] / servers / slapd / back-ldap / config.c

diff --git a/servers/slapd/back-ldap/config.c b/servers/slapd/back-ldap/config.c
index f80d7d0d2518ca80f2f93ef57905a8a671df4db0..afd8f712041c8a4b2f86764607f3ed35516be5a8 100644 (file)
--- a/servers/slapd/back-ldap/config.c
+++ b/servers/slapd/back-ldap/config.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2003-2004 The OpenLDAP Foundation.
+ * Copyright 2003-2005 The OpenLDAP Foundation.
  * Portions Copyright 1999-2003 Howard Chu.
  * Portions Copyright 2000-2003 Pierangelo Masarati.
  * All rights reserved.
@@ -213,45 +213,108 @@ ldap_back_db_config(
                li->url = ch_strdup( argv[ 1 ] );
 #endif
 
+       /* start tls */
+       } else if ( strcasecmp( argv[0], "start-tls" ) == 0 ) {
+               if ( argc != 1 ) {
+                       fprintf( stderr,
+       "%s: line %d: start-tls takes no arguments\n",
+                                       fname, lineno );
+                       return( 1 );
+               }
+               li->flags |= LDAP_BACK_F_TLS_CRITICAL;
+       
+       /* try start tls */
+       } else if ( strcasecmp( argv[0], "try-start-tls" ) == 0 ) {
+               if ( argc != 1 ) {
+                       fprintf( stderr,
+       "%s: line %d: try-start-tls takes no arguments\n",
+                                       fname, lineno );
+                       return( 1 );
+               }
+               li->flags &= ~LDAP_BACK_F_TLS_CRITICAL;
+               li->flags |= LDAP_BACK_F_USE_TLS;
+       
        /* name to use for ldap_back_group */
        } else if ( strcasecmp( argv[0], "acl-authcdn" ) == 0
-                       || strcasecmp( argv[0], "binddn" ) == 0 ) {
+                       || strcasecmp( argv[0], "binddn" ) == 0 )
+       {
                if ( argc != 2 ) {
                        fprintf( stderr,
        "%s: line %d: missing name in \"%s <name>\" line\n",
                                        fname, lineno, argv[0] );
                        return( 1 );
                }
+
+               if ( strcasecmp( argv[0], "binddn" ) == 0 ) {
+                       fprintf( stderr, "%s: line %d: "
+                               "\"binddn\" statement is deprecated; "
+                               "use \"acl-authcDN\" instead\n",
+                               fname, lineno );
+                       /* FIXME: some day we'll need to throw an error */
+               }
+
                ber_str2bv( argv[1], 0, 1, &li->acl_authcDN );
 
        /* password to use for ldap_back_group */
        } else if ( strcasecmp( argv[0], "acl-passwd" ) == 0
-                       || strcasecmp( argv[0], "bindpw" ) == 0 ) {
+                       || strcasecmp( argv[0], "bindpw" ) == 0 )
+       {
                if ( argc != 2 ) {
                        fprintf( stderr,
        "%s: line %d: missing password in \"%s <password>\" line\n",
                                        fname, lineno, argv[0] );
                        return( 1 );
                }
+
+               if ( strcasecmp( argv[0], "bindpw" ) == 0 ) {
+                       fprintf( stderr, "%s: line %d: "
+                               "\"bindpw\" statement is deprecated; "
+                               "use \"acl-passwd\" instead\n",
+                               fname, lineno );
+                       /* FIXME: some day we'll need to throw an error */
+               }
+
                ber_str2bv( argv[1], 0, 1, &li->acl_passwd );
 
-#ifdef LDAP_BACK_PROXY_AUTHZ
        /* identity assertion stuff... */
        } else if ( strncasecmp( argv[0], "idassert-", STRLENOF( "idassert-" ) ) == 0
-                       || strncasecmp( argv[0], "proxyauthz", STRLENOF( "proxyauthz" ) ) == 0 ) {
+                       || strncasecmp( argv[0], "proxyauthz", STRLENOF( "proxyauthz" ) ) == 0 )
+       {
+               /* NOTE: "proxyauthz{DN,pw}" was initially used; it's now
+                * deprected and undocumented, it can be dropped at some
+                * point, since nobody should be really using it */
                return parse_idassert( be, fname, lineno, argc, argv );
-#endif /* LDAP_BACK_PROXY_AUTHZ */
 
        /* save bind creds for referral rebinds? */
        } else if ( strcasecmp( argv[0], "rebind-as-user" ) == 0 ) {
                if ( argc != 1 ) {
                        fprintf( stderr,
-       "%s: line %d: rebind-as-user takes no arguments\n",
+       "%s: line %d: \"rebind-as-user\" takes no arguments\n",
                                        fname, lineno );
                        return( 1 );
                }
-               li->savecred = 1;
-       
+               li->flags |= LDAP_BACK_F_SAVECRED;
+
+       } else if ( strcasecmp( argv[0], "chase-referrals" ) == 0 ) {
+               if ( argc != 1 ) {
+                       fprintf( stderr,
+       "%s: line %d: \"chase-referrals\" takes no arguments\n",
+                                       fname, lineno );
+                       return( 1 );
+               }
+
+               li->flags |= LDAP_BACK_F_CHASE_REFERRALS;
+
+       } else if ( strcasecmp( argv[0], "dont-chase-referrals" ) == 0 ) {
+               if ( argc != 1 ) {
+                       fprintf( stderr,
+       "%s: line %d: \"dont-chase-referrals\" takes no arguments\n",
+                                       fname, lineno );
+                       return( 1 );
+               }
+
+               li->flags &= ~LDAP_BACK_F_CHASE_REFERRALS;
+
        /* intercept exop_who_am_i? */
        } else if ( strcasecmp( argv[0], "proxy-whoami" ) == 0 ) {
                if ( argc != 1 ) {
@@ -338,8 +401,8 @@ ldap_back_exop_whoami(
 
                ctrls[0] = &c;
                op2.o_ndn = op->o_conn->c_ndn;
-               lc = ldap_back_getconn(&op2, rs);
-               if (!lc || !ldap_back_dobind( lc, op, rs )) {
+               lc = ldap_back_getconn(&op2, rs, LDAP_BACK_SENDERR);
+               if (!lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR )) {
                        return -1;
                }
                c.ldctl_oid = LDAP_CONTROL_PROXY_AUTHZ;
@@ -357,7 +420,7 @@ retry:
                                        &rs->sr_err);
                                if ( rs->sr_err == LDAP_SERVER_DOWN && do_retry ) {
                                        do_retry = 0;
-                                       if ( ldap_back_retry( lc, op, rs ) )
+                                       if ( ldap_back_retry( lc, op, rs, LDAP_BACK_SENDERR ) )
                                                goto retry;
                                }
                                ldap_back_freeconn( op, lc );
@@ -393,7 +456,6 @@ retry:
 }
 
 
-#ifdef LDAP_BACK_PROXY_AUTHZ
 static int
 parse_idassert(
     BackendDB  *be,
@@ -557,7 +619,7 @@ parse_idassert(
                }
 
                if ( strcasecmp( argv[1], "none" ) == 0 ) {
-                       /* FIXME: is this useful? */
+                       /* FIXME: is this at all useful? */
                        li->idassert_authmethod = LDAP_AUTH_NONE;
 
                        if ( argc != 2 ) {
@@ -697,4 +759,3 @@ parse_idassert(
 
        return 0;
 }
-#endif /* LDAP_BACK_PROXY_AUTHZ */