/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 2004-2005 The OpenLDAP Foundation.
+ * Copyright 2004-2006 The OpenLDAP Foundation.
* Portions Copyright 2004-2005 Howard Chu, Symas Corporation.
* Portions Copyright 2004 Hewlett-Packard Company.
* All rights reserved.
pp->ad = slap_schema.si_ad_userPassword;
#endif
- if ((a = attr_find( pe->e_attrs, ad_pwdMinAge )))
- pp->pwdMinAge = atoi(a->a_vals[0].bv_val );
- if ((a = attr_find( pe->e_attrs, ad_pwdMaxAge )))
- pp->pwdMaxAge = atoi(a->a_vals[0].bv_val );
- if ((a = attr_find( pe->e_attrs, ad_pwdInHistory )))
- pp->pwdInHistory = atoi(a->a_vals[0].bv_val );
- if ((a = attr_find( pe->e_attrs, ad_pwdCheckQuality )))
- pp->pwdCheckQuality = atoi(a->a_vals[0].bv_val );
- if ((a = attr_find( pe->e_attrs, ad_pwdMinLength )))
- pp->pwdMinLength = atoi(a->a_vals[0].bv_val );
- if ((a = attr_find( pe->e_attrs, ad_pwdMaxFailure )))
- pp->pwdMaxFailure = atoi(a->a_vals[0].bv_val );
- if ((a = attr_find( pe->e_attrs, ad_pwdGraceAuthNLimit )))
- pp->pwdGraceAuthNLimit = atoi(a->a_vals[0].bv_val );
- if ((a = attr_find( pe->e_attrs, ad_pwdExpireWarning )))
- pp->pwdExpireWarning = atoi(a->a_vals[0].bv_val );
- if ((a = attr_find( pe->e_attrs, ad_pwdFailureCountInterval )))
- pp->pwdFailureCountInterval = atoi(a->a_vals[0].bv_val );
- if ((a = attr_find( pe->e_attrs, ad_pwdLockoutDuration )))
- pp->pwdLockoutDuration = atoi(a->a_vals[0].bv_val );
-
- if ((a = attr_find( pe->e_attrs, ad_pwdCheckModule ))) {
- strncpy(pp->pwdCheckModule, a->a_vals[0].bv_val,
- sizeof(pp->pwdCheckModule));
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdMinAge ) )
+ && lutil_atoi( &pp->pwdMinAge, a->a_vals[0].bv_val ) != 0 )
+ goto defaultpol;
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdMaxAge ) )
+ && lutil_atoi( &pp->pwdMaxAge, a->a_vals[0].bv_val ) != 0 )
+ goto defaultpol;
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdInHistory ) )
+ && lutil_atoi( &pp->pwdInHistory, a->a_vals[0].bv_val ) != 0 )
+ goto defaultpol;
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdCheckQuality ) )
+ && lutil_atoi( &pp->pwdCheckQuality, a->a_vals[0].bv_val ) != 0 )
+ goto defaultpol;
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdMinLength ) )
+ && lutil_atoi( &pp->pwdMinLength, a->a_vals[0].bv_val ) != 0 )
+ goto defaultpol;
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdMaxFailure ) )
+ && lutil_atoi( &pp->pwdMaxFailure, a->a_vals[0].bv_val ) != 0 )
+ goto defaultpol;
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdGraceAuthNLimit ) )
+ && lutil_atoi( &pp->pwdGraceAuthNLimit, a->a_vals[0].bv_val ) != 0 )
+ goto defaultpol;
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdExpireWarning ) )
+ && lutil_atoi( &pp->pwdExpireWarning, a->a_vals[0].bv_val ) != 0 )
+ goto defaultpol;
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdFailureCountInterval ) )
+ && lutil_atoi( &pp->pwdFailureCountInterval, a->a_vals[0].bv_val ) != 0 )
+ goto defaultpol;
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdLockoutDuration ) )
+ && lutil_atoi( &pp->pwdLockoutDuration, a->a_vals[0].bv_val ) != 0 )
+ goto defaultpol;
+
+ if ( ( a = attr_find( pe->e_attrs, ad_pwdCheckModule ) ) ) {
+ strncpy( pp->pwdCheckModule, a->a_vals[0].bv_val,
+ sizeof(pp->pwdCheckModule) );
pp->pwdCheckModule[sizeof(pp->pwdCheckModule)-1] = '\0';
}
send_ldap_error( op, rs, rc, "Password fails quality checking policy" );
return rs->sr_err;
}
- /*
- * A controversial bit. We hash cleartext
- * passwords provided via add and modify operations
- * You're not really supposed to do this, since
- * the X.500 model says "store attributes" as they
- * get provided. By default, this is what we do
- *
- * But if the hash_passwords flag is set, we hash
- * any cleartext password attribute values via the
- * default password hashing scheme.
- */
- if ((pi->hash_passwords) &&
- (password_scheme( &(pa->a_vals[0]), NULL ) != LDAP_SUCCESS)) {
- struct berval hpw;
-
- slap_passwd_hash( &(pa->a_vals[0]), &hpw, &txt );
- if (hpw.bv_val == NULL) {
- /*
- * hashing didn't work. Emit an error.
- */
- rs->sr_err = LDAP_OTHER;
- rs->sr_text = txt;
- send_ldap_error( op, rs, LDAP_OTHER, "Password hashing failed" );
- return rs->sr_err;
- }
+ }
+ /*
+ * A controversial bit. We hash cleartext
+ * passwords provided via add and modify operations
+ * You're not really supposed to do this, since
+ * the X.500 model says "store attributes" as they
+ * get provided. By default, this is what we do
+ *
+ * But if the hash_passwords flag is set, we hash
+ * any cleartext password attribute values via the
+ * default password hashing scheme.
+ */
+ if ((pi->hash_passwords) &&
+ (password_scheme( &(pa->a_vals[0]), NULL ) != LDAP_SUCCESS)) {
+ struct berval hpw;
- memset( pa->a_vals[0].bv_val, 0, pa->a_vals[0].bv_len);
- ber_memfree( pa->a_vals[0].bv_val );
- pa->a_vals[0].bv_val = hpw.bv_val;
- pa->a_vals[0].bv_len = hpw.bv_len;
+ slap_passwd_hash( &(pa->a_vals[0]), &hpw, &txt );
+ if (hpw.bv_val == NULL) {
+ /*
+ * hashing didn't work. Emit an error.
+ */
+ rs->sr_err = LDAP_OTHER;
+ rs->sr_text = txt;
+ send_ldap_error( op, rs, LDAP_OTHER, "Password hashing failed" );
+ return rs->sr_err;
}
+
+ memset( pa->a_vals[0].bv_val, 0, pa->a_vals[0].bv_len);
+ ber_memfree( pa->a_vals[0].bv_val );
+ pa->a_vals[0].bv_val = hpw.bv_val;
+ pa->a_vals[0].bv_len = hpw.bv_len;
}
+
/* If password aging is in effect, set the pwdChangedTime */
if ( pp.pwdMaxAge || pp.pwdMinAge ) {
struct berval timestamp;
{
slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
pp_info *pi = on->on_bi.bi_private;
- int i, rc, mod_pw_only, pwmod, pwmop, deladd,
+ int i, rc, mod_pw_only, pwmod, pwmop = -1, deladd,
hsize = 0;
PassPolicy pp;
- Modifications *mods = NULL, *modtail, *ml, *delmod, *addmod;
+ Modifications *mods = NULL, *modtail = NULL,
+ *ml, *delmod, *addmod;
Attribute *pa, *ha, at;
const char *txt;
pw_hist *tl = NULL, *p;
ppolicy_get( op, e, &pp );
- for(ml = op->oq_modify.rs_modlist,
+ for ( ml = op->oq_modify.rs_modlist,
pwmod = 0, mod_pw_only = 1,
deladd = 0, delmod = NULL,
addmod = NULL,
zapReset = 1;
- ml != NULL; modtail = ml, ml = ml->sml_next ) {
+ ml != NULL; modtail = ml, ml = ml->sml_next )
+ {
if ( ml->sml_desc == pp.ad ) {
pwmod = 1;
pwmop = ml->sml_op;
static slap_overinst ppolicy;
-int ppolicy_init()
+int ppolicy_initialize()
{
LDAPAttributeType *at;
const char *err;
#if SLAPD_OVER_PPOLICY == SLAPD_MOD_DYNAMIC
int init_module(int argc, char *argv[]) {
- return ppolicy_init();
+ return ppolicy_initialize();
}
#endif
projects / openldap / blobdiff