/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 2004-2006 The OpenLDAP Foundation.
+ * Copyright 2004-2007 The OpenLDAP Foundation.
* Portions Copyright 2004-2005 Howard Chu, Symas Corporation.
* Portions Copyright 2004 Hewlett-Packard Company.
* All rights reserved.
ldap_pvt_thread_mutex_lock( &chk_syntax_mutex );
ok = prog( cred->bv_val, &txt, e );
ldap_pvt_thread_mutex_unlock( &chk_syntax_mutex );
- if (txt) {
+ if (ok != LDAP_SUCCESS) {
Debug(LDAP_DEBUG_ANY,
"check_password_quality: module error: (%s) %s.[%d]\n",
- pp->pwdCheckModule, txt, ok );
+ pp->pwdCheckModule, txt ? txt : "", ok );
free(txt);
- } else
- ok = LDAP_SUCCESS;
+ }
}
lt_dlclose( mod );
assert( rs->sr_ctrls[0] != NULL );
for ( n = 0; rs->sr_ctrls[n]; n++ ) {
- if ( rs->sr_ctrls[n]->ldctl_oid == LDAP_CONTROL_PASSWORDPOLICYRESPONSE ) {
+ if ( !strcmp( rs->sr_ctrls[n]->ldctl_oid, LDAP_CONTROL_PASSWORDPOLICYRESPONSE) ) {
ch_free( rs->sr_ctrls[n]->ldctl_value.bv_val );
ch_free( rs->sr_ctrls[n] );
rs->sr_ctrls[n] = (LDAPControl *)(-1);
* we now check whether the password has expired.
*
* We can skip this bit if passwords don't age in
- * the policy.
+ * the policy. Also, if there was no pwdChangedTime
+ * attribute in the entry, the password never expires.
*/
if (ppb->pp.pwdMaxAge == 0) goto grace;
- if (pwtime == (time_t)-1) {
- /*
- * Hmm. No password changed time on the
- * entry. This is odd - it should have
- * been provided when the attribute was added.
- *
- * However, it's possible that it could be
- * missing if the DIT was established via
- * an import process.
- */
- Debug( LDAP_DEBUG_ANY,
- "ppolicy_bind: Entry %s does not have valid pwdChangedTime attribute - assuming password expired\n",
- e->e_name.bv_val, 0, 0);
-
- pwExpired = 1;
- } else {
+ if (pwtime != (time_t)-1) {
/*
* Check: was the last change time of
* the password older than the maximum age
if ((pa = attr_find( op->oq_add.rs_e->e_attrs,
slap_schema.si_ad_userPassword )))
{
- assert( pa->a_vals );
+ assert( pa->a_vals != NULL );
assert( !BER_BVISNULL( &pa->a_vals[ 0 ] ) );
if ( !BER_BVISNULL( &pa->a_vals[ 1 ] ) ) {
slap_callback *sc;
for ( sc = op->o_callback; sc; sc=sc->sc_next ) {
- if ( sc->sc_response == slap_replog_cb &&
+ if ( sc->sc_response == slap_null_cb &&
sc->sc_private ) {
req_pwdexop_s *qpw = sc->sc_private;
newpw = qpw->rs_new;
SlapReply *rs,
LDAPControl *ctrl )
{
- if ( ctrl->ldctl_value.bv_len ) {
- rs->sr_text = "passwordPolicyRequest control value not empty";
+ if ( !BER_BVISNULL( &ctrl->ldctl_value ) ) {
+ rs->sr_text = "passwordPolicyRequest control value not absent";
return LDAP_PROTOCOL_ERROR;
}
op->o_ctrlflag[ppolicy_cid] = ctrl->ldctl_iscritical
int ppolicy_initialize()
{
- LDAPAttributeType *at;
- const char *err;
int i, code;
for (i=0; pwd_OpSchema[i].def; i++) {
- at = ldap_str2attributetype( pwd_OpSchema[i].def, &code, &err,
- LDAP_SCHEMA_ALLOW_ALL );
- if ( !at ) {
- fprintf( stderr, "AttributeType Load failed %s %s\n",
- ldap_scherr2str(code), err );
- return code;
- }
- code = at_add( at, 0, NULL, &err );
- if ( !code ) {
- slap_str2ad( at->at_names[0], pwd_OpSchema[i].ad, &err );
- }
- ldap_memfree( at );
+ code = register_at( pwd_OpSchema[i].def, pwd_OpSchema[i].ad, 0 );
if ( code ) {
- fprintf( stderr, "AttributeType Load failed %s %s\n",
- scherr2str(code), err );
+ Debug( LDAP_DEBUG_ANY,
+ "ppolicy_initialize: register_at failed\n", 0, 0, 0 );
return code;
}
/* Allow Manager to set these as needed */