add logs; fix bug in group/dn selection logic

[openldap] / servers / slapd / passwd.c

diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index 5b9fcf61b730fff80cff3c15381da5e1e847accb..25d541d8957470d76f017ee8c2970d9885fe6b26 100644 (file)
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -110,22 +110,25 @@ int passwd_extop(
 
 #ifndef SLAPD_MULTIMASTER
        /* This does not apply to multi-master case */
-       if( op->o_bd->be_update_ndn.bv_len ) {
+       if(!( !SLAP_SHADOW( op->o_bd ) || be_isupdate( op ))) {
                /* we SHOULD return a referral in this case */
-               BerVarray defref = NULL;
-               if ( !LDAP_STAILQ_EMPTY( &op->o_bd->be_syncinfo )) {
-                       syncinfo_t *si;
-                       LDAP_STAILQ_FOREACH( si, &op->o_bd->be_syncinfo, si_next ) {
-                               struct berval tmpbv;
-                               ber_dupbv( &tmpbv, &si->si_provideruri_bv[0] );
-                               ber_bvarray_add( &defref, &tmpbv );
-                       }
-               } else {
-                       defref = referral_rewrite( op->o_bd->be_update_refs,
+               BerVarray defref = op->o_bd->be_update_refs
+                       ? op->o_bd->be_update_refs : default_referral; 
+
+               if( defref != NULL ) {
+                       rs->sr_ref = referral_rewrite( op->o_bd->be_update_refs,
                                NULL, NULL, LDAP_SCOPE_DEFAULT );
+                       if(rs->sr_ref) {
+                               rs->sr_flags |= REP_REF_MUSTBEFREED;
+                       } else {
+                               rs->sr_ref = defref;
+                       }
+                       return LDAP_REFERRAL;
+
                }
-               rs->sr_ref = defref;
-               return LDAP_REFERRAL;
+
+               rs->sr_text = "shadow context; no update referral";
+               return LDAP_UNWILLING_TO_PERFORM;
        }
 #endif /* !SLAPD_MULTIMASTER */
 
@@ -168,7 +171,7 @@ int passwd_extop(
        }
        ml->sml_values = ch_malloc( (nhash+1)*sizeof(struct berval) );
        for ( i=0; hashes[i]; i++ ) {
-               slap_passwd_hash( hashes[i], &qpw->rs_new, &hash, &rs->sr_text );
+               slap_passwd_hash_type( &qpw->rs_new, &hash, hashes[i], &rs->sr_text );
                if ( hash.bv_len == 0 ) {
                        if ( !rs->sr_text ) {
                                rs->sr_text = "password hash failed";
@@ -180,28 +183,10 @@ int passwd_extop(
        ml->sml_values[i].bv_val = NULL;
        ml->sml_nvalues = NULL;
        ml->sml_desc = slap_schema.si_ad_userPassword;
-       ml->sml_op = qpw->rs_old.bv_val ? LDAP_MOD_ADD : LDAP_MOD_REPLACE;
+       ml->sml_op = LDAP_MOD_REPLACE;
        ml->sml_next = qpw->rs_mods;
        qpw->rs_mods = ml;
-       if ( qpw->rs_old.bv_val ) {
-               ml = ch_malloc( sizeof(Modifications) );
-               ml->sml_values = ch_malloc( (nhash+1)*sizeof(struct berval) );
-               for ( i=0; hashes[i]; i++ ) {
-                       slap_passwd_hash( hashes[i], &qpw->rs_old, &hash, &rs->sr_text );
-                       if ( hash.bv_len == 0 ) {
-                               if ( !rs->sr_text ) {
-                                       rs->sr_text = "password hash failed";
-                               }
-                               break;
-                       }
-                       ml->sml_values[i] = hash;
-               }
-               ml->sml_values[i].bv_val = NULL;
-               ml->sml_desc = slap_schema.si_ad_userPassword;
-               ml->sml_op = LDAP_MOD_DELETE;
-               ml->sml_next = qpw->rs_mods;
-               qpw->rs_mods = ml;
-       }
+
        if ( hashes[i] ) {
                rs->sr_err = LDAP_OTHER;
        } else {
@@ -473,23 +458,16 @@ slap_passwd_generate( struct berval *pass )
 }
 
 void
-slap_passwd_hash(
-       char *hash,
+slap_passwd_hash_type(
        struct berval * cred,
        struct berval * new,
+       char *hash,
        const char **text )
 {
        new->bv_len = 0;
        new->bv_val = NULL;
 
-       if ( !hash ) {
-               if ( default_passwd_hash ) {
-                       hash = default_passwd_hash[0];
-               }
-               if ( !hash ) {
-                       hash = (char *)defhash[0];
-               }
-       }
+       assert( hash );
 
 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
        ldap_pvt_thread_mutex_lock( &passwd_mutex );
@@ -502,3 +480,19 @@ slap_passwd_hash(
 #endif
 
 }
+void
+slap_passwd_hash(
+       struct berval * cred,
+       struct berval * new,
+       const char **text )
+{
+       char *hash = NULL;
+       if ( default_passwd_hash ) {
+               hash = default_passwd_hash[0];
+       }
+       if ( !hash ) {
+               hash = (char *)defhash[0];
+       }
+
+       slap_passwd_hash_type( cred, new, hash, text );
+}