Read config tree from back-ldif

[openldap] / servers / slapd / passwd.c

diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index 51b42411711abf833bbd44501d51ee76520e1717..a262a9911aa74009a485b084d9ad4139f9e2d982 100644 (file)
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Copyright 1998-2005 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,6 +27,7 @@
 
 #include <lber_pvt.h>
 #include <lutil.h>
+#include <lutil_sha1.h>
 
 static const char *defhash[] = {
 #ifdef LUTIL_SHA1_BYTES
@@ -43,13 +44,14 @@ int passwd_extop(
 {
        struct berval id = {0, NULL}, hash, *rsp = NULL;
        req_pwdexop_s *qpw = &op->oq_pwdexop;
+       req_extended_s qext = op->oq_extended;
        Modifications *ml;
-       Operation op2;
        slap_callback cb = { NULL, slap_null_cb, NULL, NULL };
        slap_callback cb2 = { NULL, slap_replog_cb, NULL, NULL };
        int i, nhash;
        char **hashes;
        int     rc;
+       BackendDB *op_be;
 
        cb2.sc_next = &cb;
 
@@ -107,12 +109,23 @@ int passwd_extop(
                goto error_return;
        }
 
+       /* If we've got a glued backend, check the real backend */
+       op_be = op->o_bd;
+       if ( SLAP_GLUE_INSTANCE( op->o_bd )) {
+               op->o_bd = select_backend( &op->o_req_ndn, 0, 0 );
+       }
+
        if (backend_check_restrictions( op, rs,
                        (struct berval *)&slap_EXOP_MODIFY_PASSWD ) != LDAP_SUCCESS) {
                rc = rs->sr_err;
                goto error_return;
        }
 
+       /* check for referrals */
+       if ( backend_check_referrals( op, rs ) != LDAP_SUCCESS ) {
+               rc = rs->sr_err;
+               goto error_return;
+       }
 
 #ifndef SLAPD_MULTIMASTER
        /* This does not apply to multi-master case */
@@ -153,6 +166,8 @@ int passwd_extop(
                goto error_return;
        }
 
+       op->o_bd = op_be;
+
        /* Give the backend a chance to handle this itself */
        if ( op->o_bd->be_extended ) {
                rs->sr_err = op->o_bd->be_extended( op, rs );
@@ -202,27 +217,27 @@ int passwd_extop(
                rs->sr_err = LDAP_OTHER;
 
        } else {
-               op2 = *op;
-               op2.o_tag = LDAP_REQ_MODIFY;
-               op2.o_callback = &cb2;
-               op2.orm_modlist = qpw->rs_mods;
+               slap_callback *sc = op->o_callback;
+
+               op->o_tag = LDAP_REQ_MODIFY;
+               op->o_callback = &cb2;
+               op->orm_modlist = qpw->rs_mods;
                cb2.sc_private = qpw;   /* let Modify know this was pwdMod,
                                         * if it cares... */
 
-               rs->sr_err = slap_mods_opattrs( &op2, ml, qpw->rs_modtail, &rs->sr_text,
+               rs->sr_err = slap_mods_opattrs( op, ml, qpw->rs_modtail, &rs->sr_text,
                        NULL, 0, 1 );
                
                if ( rs->sr_err == LDAP_SUCCESS ) {
-                       rs->sr_err = op2.o_bd->be_modify( &op2, rs );
-                       /* FIXME: in case it got rewritten... */
-                       op->o_req_dn = op2.o_req_dn;
-                       op->o_req_ndn = op2.o_req_ndn;
+                       rs->sr_err = op->o_bd->be_modify( op, rs );
                }
                if ( rs->sr_err == LDAP_SUCCESS ) {
                        rs->sr_rspdata = rsp;
                } else if ( rsp ) {
                        ber_bvfree( rsp );
                }
+               op->o_tag = LDAP_REQ_EXTENDED;
+               op->o_callback = sc;
        }
        slap_mods_free( qpw->rs_mods );
        if ( rsp ) {
@@ -230,6 +245,7 @@ int passwd_extop(
        }
 
        rc = rs->sr_err;
+       op->oq_extended = qext;
 
 error_return:;
        if ( !BER_BVISNULL( &op->o_req_dn ) ) {
@@ -384,25 +400,37 @@ struct berval * slap_passwd_return(
        return bv;
 }
 
+/*
+ * if "e" is provided, access to each value of the password is checked first
+ */
 int
 slap_passwd_check(
-       Connection *conn,
-       Attribute *a,
-       struct berval *cred,
-       const char **text )
+       Operation       *op,
+       Entry           *e,
+       Attribute       *a,
+       struct berval   *cred,
+       const char      **text )
 {
-       int result = 1;
-       struct berval *bv;
+       int                     result = 1;
+       struct berval           *bv;
+       AccessControlState      acl_state = ACL_STATE_INIT;
 
 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
        ldap_pvt_thread_mutex_lock( &passwd_mutex );
 #ifdef SLAPD_SPASSWD
-       lutil_passwd_sasl_conn = conn->c_sasl_authctx;
+       lutil_passwd_sasl_conn = op->o_conn->c_sasl_authctx;
 #endif
 #endif
 
        for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
-               if( !lutil_passwd( bv, cred, NULL, text ) ) {
+               /* if e is provided, check access */
+               if ( e && access_allowed( op, e, a->a_desc, bv,
+                                       ACL_AUTH, &acl_state ) == 0 )
+               {
+                       continue;
+               }
+               
+               if ( !lutil_passwd( bv, cred, NULL, text ) ) {
                        result = 0;
                        break;
                }