add logs; fix bug in group/dn selection logic

[openldap] / servers / slapd / passwd.c

diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index 3364b90acd7dceacdcdd52eb79e3412702b080a3..25d541d8957470d76f017ee8c2970d9885fe6b26 100644 (file)
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -47,10 +47,11 @@ int passwd_extop(
        Operation op2;
        slap_callback cb = { NULL, slap_null_cb, NULL, NULL };
        slap_callback cb2 = { NULL, slap_replog_cb, NULL, NULL };
-       cb2.sc_next = &cb;
        int i, nhash;
        char **hashes;
 
+       cb2.sc_next = &cb;
+
        assert( ber_bvcmp( &slap_EXOP_MODIFY_PASSWD, &op->ore_reqoid ) == 0 );
 
        if( op->o_dn.bv_len == 0 ) {
@@ -109,22 +110,25 @@ int passwd_extop(
 
 #ifndef SLAPD_MULTIMASTER
        /* This does not apply to multi-master case */
-       if( op->o_bd->be_update_ndn.bv_len ) {
+       if(!( !SLAP_SHADOW( op->o_bd ) || be_isupdate( op ))) {
                /* we SHOULD return a referral in this case */
-               BerVarray defref = NULL;
-               if ( !LDAP_STAILQ_EMPTY( &op->o_bd->be_syncinfo )) {
-                       syncinfo_t *si;
-                       LDAP_STAILQ_FOREACH( si, &op->o_bd->be_syncinfo, si_next ) {
-                               struct berval tmpbv;
-                               ber_dupbv( &tmpbv, &si->si_provideruri_bv[0] );
-                               ber_bvarray_add( &defref, &tmpbv );
-                       }
-               } else {
-                       defref = referral_rewrite( op->o_bd->be_update_refs,
+               BerVarray defref = op->o_bd->be_update_refs
+                       ? op->o_bd->be_update_refs : default_referral; 
+
+               if( defref != NULL ) {
+                       rs->sr_ref = referral_rewrite( op->o_bd->be_update_refs,
                                NULL, NULL, LDAP_SCOPE_DEFAULT );
+                       if(rs->sr_ref) {
+                               rs->sr_flags |= REP_REF_MUSTBEFREED;
+                       } else {
+                               rs->sr_ref = defref;
+                       }
+                       return LDAP_REFERRAL;
+
                }
-               rs->sr_ref = defref;
-               return LDAP_REFERRAL;
+
+               rs->sr_text = "shadow context; no update referral";
+               return LDAP_UNWILLING_TO_PERFORM;
        }
 #endif /* !SLAPD_MULTIMASTER */
 
@@ -167,7 +171,7 @@ int passwd_extop(
        }
        ml->sml_values = ch_malloc( (nhash+1)*sizeof(struct berval) );
        for ( i=0; hashes[i]; i++ ) {
-               slap_passwd_hash( hashes[i], &qpw->rs_new, &hash, &rs->sr_text );
+               slap_passwd_hash_type( &qpw->rs_new, &hash, hashes[i], &rs->sr_text );
                if ( hash.bv_len == 0 ) {
                        if ( !rs->sr_text ) {
                                rs->sr_text = "password hash failed";
@@ -182,9 +186,7 @@ int passwd_extop(
        ml->sml_op = LDAP_MOD_REPLACE;
        ml->sml_next = qpw->rs_mods;
        qpw->rs_mods = ml;
-       if ( rsp ) {
-               free( qpw->rs_new.bv_val );
-       }
+
        if ( hashes[i] ) {
                rs->sr_err = LDAP_OTHER;
        } else {
@@ -193,6 +195,8 @@ int passwd_extop(
                op2.o_tag = LDAP_REQ_MODIFY;
                op2.o_callback = &cb2;
                op2.orm_modlist = qpw->rs_mods;
+               cb2.sc_private = qpw;   /* let Modify know this was pwdMod,
+                                        * if it cares... */
 
                rs->sr_err = slap_mods_opattrs( &op2, ml, qpw->rs_modtail, &rs->sr_text,
                        NULL, 0 );
@@ -207,6 +211,9 @@ int passwd_extop(
                }
        }
        slap_mods_free( qpw->rs_mods );
+       if ( rsp ) {
+               free( qpw->rs_new.bv_val );
+       }
 
        return rs->sr_err;
 }
@@ -451,15 +458,17 @@ slap_passwd_generate( struct berval *pass )
 }
 
 void
-slap_passwd_hash(
-       char *hash,
+slap_passwd_hash_type(
        struct berval * cred,
        struct berval * new,
+       char *hash,
        const char **text )
 {
        new->bv_len = 0;
        new->bv_val = NULL;
 
+       assert( hash );
+
 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
        ldap_pvt_thread_mutex_lock( &passwd_mutex );
 #endif
@@ -471,3 +480,19 @@ slap_passwd_hash(
 #endif
 
 }
+void
+slap_passwd_hash(
+       struct berval * cred,
+       struct berval * new,
+       const char **text )
+{
+       char *hash = NULL;
+       if ( default_passwd_hash ) {
+               hash = default_passwd_hash[0];
+       }
+       if ( !hash ) {
+               hash = (char *)defhash[0];
+       }
+
+       slap_passwd_hash_type( cred, new, hash, text );
+}