Update backend "restrictions"

[openldap] / servers / slapd / bind.c

diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index ade43afd81078033f4886139309bef65c3b41e1f..b7c4315ed1599d8da92cd579f4a08a009430fed9 100644 (file)
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -203,6 +203,14 @@ do_bind(
                        goto cleanup;
                }
 
+               /* check restrictions */
+               rc = backend_check_restrictions( NULL, conn, op, mech, &text );
+               if( rc != LDAP_SUCCESS ) {
+                       send_ldap_result( conn, op, rc,
+                               NULL, text, NULL, NULL );
+                       goto cleanup;
+               }
+
                ldap_pvt_thread_mutex_lock( &conn->c_mutex );
 
                if ( conn->c_sasl_bind_mech != NULL ) {
@@ -290,6 +298,9 @@ do_bind(
                                /* disallow */
                                rc = LDAP_INAPPROPRIATE_AUTH;
                                text = "anonymous bind disallowed";
+
+                       } else {
+                               rc = backend_check_restrictions( NULL, conn, op, mech, &text );
                        }
 
                        /*
@@ -331,7 +342,7 @@ do_bind(
 #endif
 
        } else {
-               rc = LDAP_AUTH_UNKNOWN;
+               rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
                text = "unknown authentication method";
 
                send_ldap_result( conn, op, rc,
@@ -348,7 +359,7 @@ do_bind(
         * if we don't hold it.
         */
 
-       if ( (be = select_backend( ndn )) == NULL ) {
+       if ( (be = select_backend( ndn, 0 )) == NULL ) {
                if ( default_referral ) {
                        send_ldap_result( conn, op, rc = LDAP_REFERRAL,
                                NULL, NULL, default_referral, NULL );
@@ -363,7 +374,7 @@ do_bind(
        }
 
        /* check restrictions */
-       rc = backend_check_restrictions( be, conn, op, NULL, &text ) ;
+       rc = backend_check_restrictions( be, conn, op, NULL, &text );
        if( rc != LDAP_SUCCESS ) {
                send_ldap_result( conn, op, rc,
                        NULL, text, NULL, NULL );