improved filter mapping/rewrite; improved result rewriting; improved attribute/object...

[openldap] / servers / slapd / back-ldap / group.c

diff --git a/servers/slapd/back-ldap/group.c b/servers/slapd/back-ldap/group.c
index c519da293e8771c22ab84b4db84b6a29b86f67c8..199ead103aa31add76f8c66389e677ade1ca0667 100644 (file)
--- a/servers/slapd/back-ldap/group.c
+++ b/servers/slapd/back-ldap/group.c
@@ -1,7 +1,7 @@
 /* group.c - ldap backend acl group routine */
 /* $OpenLDAP$ */
 /*
- * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 
@@ -14,7 +14,7 @@
 
 #include "slap.h"
 #include "back-ldap.h"
-
+#include "lutil.h"
 
 /* return 0 IFF op_dn is a value in group_at (member) attribute
  * of entry with gr_dn AND that entry has an objectClass
@@ -33,13 +33,13 @@ ldap_back_group(
 )
 {
        struct ldapinfo *li = (struct ldapinfo *) be->be_private;    
-       int rc = 1;
+       struct ldapconn *lc;
+       int rc = 1, oc;
        Attribute   *attr;
 
        LDAPMessage     *result;
        char *gattr[2];
        char *filter = NULL, *ptr;
-       LDAP *ld;
        struct berval mop_ndn = { 0, NULL }, mgr_ndn = { 0, NULL };
 
        AttributeDescription *ad_objectClass = slap_schema.si_ad_objectClass;
@@ -54,8 +54,7 @@ ldap_back_group(
        if (group_oc_name.bv_val)
                group_oc_name.bv_len = strlen(group_oc_name.bv_val);
 
-       if (target != NULL && target->e_nname.bv_len == gr_ndn->bv_len &&
-               strcmp(target->e_nname.bv_val, gr_ndn->bv_val) == 0) {
+       if (target != NULL && dn_match( &target->e_nname, gr_ndn ) ) {
                /* we already have a copy of the entry */
                /* attribute and objectclass mapping has already been done */
 
@@ -69,7 +68,7 @@ ldap_back_group(
                        /*
                         * Now we can check for the group objectClass value
                         */
-                       if( !is_entry_objectclass( target, group_oc ) ) {
+                       if( !is_entry_objectclass( target, group_oc, 0 ) ) {
                                return(1);
                        }
 
@@ -83,7 +82,8 @@ ldap_back_group(
                         * attribute has not been required
                         */
                        if ((attr = attr_find(target->e_attrs, group_at)) != NULL) {
-                               if( value_find( group_at, attr->a_vals, op_ndn ) != LDAP_SUCCESS  )
+                               if( value_find_ex( group_at, SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
+                                       attr->a_vals, op_ndn ) != LDAP_SUCCESS )
                                        return(1);
                                return(0);
                        } /* else: repeat the search */
@@ -101,9 +101,9 @@ ldap_back_group(
                        mop_ndn = *op_ndn;
                }
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
-                               "[rw] bindDn (op ndn in group):"
-                               " \"%s\" -> \"%s\"\n", op_ndn->bv_val, mop_ndn.bv_val ));
+               LDAP_LOG( BACK_LDAP, DETAIL1, 
+                       "[rw] bindDn (op ndn in group): \"%s\" -> \"%s\"\n", 
+                       op_ndn->bv_val, mop_ndn.bv_val, 0 );
 #else /* !NEW_LOGGING */
                Debug( LDAP_DEBUG_ARGS,
                        "rw> bindDn (op ndn in group): \"%s\" -> \"%s\"\n%s",
@@ -127,9 +127,9 @@ ldap_back_group(
                        mgr_ndn = *gr_ndn;
                }
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
-                               "[rw] searchBase (gr ndn in group):"
-                               " \"%s\" -> \"%s\"\n%s", gr_ndn->bv_val, mgr_ndn.bv_val ));
+               LDAP_LOG( BACK_LDAP, DETAIL1, 
+                       "[rw] searchBase (gr ndn in group): \"%s\" -> \"%s\"\n%s", 
+                       gr_ndn->bv_val, mgr_ndn.bv_val, "" );
 #else /* !NEW_LOGGING */
                Debug( LDAP_DEBUG_ARGS,
                        "rw> searchBase (gr ndn in group):"
@@ -154,11 +154,13 @@ ldap_back_group(
        }
 #endif /* !ENABLE_REWRITE */
 
-       ldap_back_map(&li->oc_map, &group_oc_name, &group_oc_name, 0);
-       if (group_oc_name.bv_val == NULL)
+       ldap_back_map(&li->oc_map, &group_oc_name, &group_oc_name,
+                       BACKLDAP_MAP);
+       if (group_oc_name.bv_val == NULL || group_oc_name.bv_val[0] == '\0')
                goto cleanup;
-       ldap_back_map(&li->at_map, &group_at_name, &group_at_name, 0);
-       if (group_at_name.bv_val == NULL)
+       ldap_back_map(&li->at_map, &group_at_name, &group_at_name,
+                       BACKLDAP_MAP);
+       if (group_at_name.bv_val == NULL || group_at_name.bv_val[0] == '\0')
                goto cleanup;
 
        filter = ch_malloc(sizeof("(&(objectclass=)(=))")
@@ -168,37 +170,35 @@ ldap_back_group(
        if (filter == NULL)
                goto cleanup;
 
-       if (ldap_initialize(&ld, li->url) != LDAP_SUCCESS) {
+       /* Tell getconn this is a privileged op */
+       oc = op->o_do_not_cache;
+       op->o_do_not_cache = 1;
+       lc = ldap_back_getconn(li, conn, op);
+       if ( !lc || !ldap_back_dobind( li, lc, NULL, op ) ) {
+               op->o_do_not_cache = oc;
                goto cleanup;
        }
-
-       if (ldap_bind_s(ld, li->binddn, li->bindpw, LDAP_AUTH_SIMPLE)
-                       != LDAP_SUCCESS) {
-               goto cleanup;
-       }
-
-       ptr = slap_strcopy(filter, "(&(objectclass=");
-       ptr = slap_strcopy(ptr, group_oc_name.bv_val);
-       ptr = slap_strcopy(ptr, ")(");
-       ptr = slap_strcopy(ptr, group_at_name.bv_val);
-       ptr = slap_strcopy(ptr, "=");
-       ptr = slap_strcopy(ptr, mop_ndn.bv_val);
+       op->o_do_not_cache = oc;
+
+       ptr = lutil_strcopy(filter, "(&(objectclass=");
+       ptr = lutil_strcopy(ptr, group_oc_name.bv_val);
+       ptr = lutil_strcopy(ptr, ")(");
+       ptr = lutil_strcopy(ptr, group_at_name.bv_val);
+       ptr = lutil_strcopy(ptr, "=");
+       ptr = lutil_strcopy(ptr, mop_ndn.bv_val);
        strcpy(ptr, "))");
 
        gattr[0] = "objectclass";
        gattr[1] = NULL;
-       if (ldap_search_ext_s(ld, mgr_ndn.bv_val, LDAP_SCOPE_BASE, filter,
+       if (ldap_search_ext_s(lc->ld, mgr_ndn.bv_val, LDAP_SCOPE_BASE, filter,
                gattr, 0, NULL, NULL, LDAP_NO_LIMIT,
                LDAP_NO_LIMIT, &result) == LDAP_SUCCESS) {
-               if (ldap_first_entry(ld, result) != NULL)
+               if (ldap_first_entry(lc->ld, result) != NULL)
                        rc = 0;
                ldap_msgfree(result);
        }
 
 cleanup:;
-       if ( ld != NULL ) {
-               ldap_unbind(ld);
-       }
        ch_free(filter);
        if ( mop_ndn.bv_val != op_ndn->bv_val ) {
                free( mop_ndn.bv_val );