ITS#2919 move OpenLDAPtime to OpenLDAPperson

[openldap] / servers / slapd / passwd.c

diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index d848e7a6cc2e4f7491bea1daf914d253899cc744..b44408b4a85c4eb7f70aae1bbc147a324646b418 100644 (file)
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Copyright 1998-2005 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,6 +27,7 @@
 
 #include <lber_pvt.h>
 #include <lutil.h>
+#include <lutil_sha1.h>
 
 static const char *defhash[] = {
 #ifdef LUTIL_SHA1_BYTES
@@ -81,7 +82,7 @@ int passwd_extop(
                        rc = rs->sr_err;
                        goto error_return;
                }
-               op->o_bd = select_backend( &op->o_req_ndn, 0, 0 );
+               op->o_bd = select_backend( &op->o_req_ndn, 0, 1 );
 
        } else {
                ber_dupbv_x( &op->o_req_dn, &op->o_dn, op->o_tmpmemctx );
@@ -113,6 +114,11 @@ int passwd_extop(
                goto error_return;
        }
 
+       /* check for referrals */
+       if ( backend_check_referrals( op, rs ) != LDAP_SUCCESS ) {
+               rc = rs->sr_err;
+               goto error_return;
+       }
 
 #ifndef SLAPD_MULTIMASTER
        /* This does not apply to multi-master case */
@@ -384,25 +390,37 @@ struct berval * slap_passwd_return(
        return bv;
 }
 
+/*
+ * if "e" is provided, access to each value of the password is checked first
+ */
 int
 slap_passwd_check(
-       Connection *conn,
-       Attribute *a,
-       struct berval *cred,
-       const char **text )
+       Operation       *op,
+       Entry           *e,
+       Attribute       *a,
+       struct berval   *cred,
+       const char      **text )
 {
-       int result = 1;
-       struct berval *bv;
+       int                     result = 1;
+       struct berval           *bv;
+       AccessControlState      acl_state = ACL_STATE_INIT;
 
 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
        ldap_pvt_thread_mutex_lock( &passwd_mutex );
 #ifdef SLAPD_SPASSWD
-       lutil_passwd_sasl_conn = conn->c_sasl_authctx;
+       lutil_passwd_sasl_conn = op->o_conn->c_sasl_authctx;
 #endif
 #endif
 
        for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
-               if( !lutil_passwd( bv, cred, NULL, text ) ) {
+               /* if e is provided, check access */
+               if ( e && access_allowed( op, e, a->a_desc, bv,
+                                       ACL_AUTH, &acl_state ) == 0 )
+               {
+                       continue;
+               }
+               
+               if ( !lutil_passwd( bv, cred, NULL, text ) ) {
                        result = 0;
                        break;
                }