ITS#2919 move OpenLDAPtime to OpenLDAPperson

[openldap] / servers / slapd / passwd.c

diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index f0e97b6b9bd5e008812bc90bb39437fe6e20458c..b44408b4a85c4eb7f70aae1bbc147a324646b418 100644 (file)
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Copyright 1998-2005 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,6 +27,7 @@
 
 #include <lber_pvt.h>
 #include <lutil.h>
+#include <lutil_sha1.h>
 
 static const char *defhash[] = {
 #ifdef LUTIL_SHA1_BYTES
@@ -81,7 +82,7 @@ int passwd_extop(
                        rc = rs->sr_err;
                        goto error_return;
                }
-               op->o_bd = select_backend( &op->o_req_ndn, 0, 0 );
+               op->o_bd = select_backend( &op->o_req_ndn, 0, 1 );
 
        } else {
                ber_dupbv_x( &op->o_req_dn, &op->o_dn, op->o_tmpmemctx );
@@ -113,6 +114,11 @@ int passwd_extop(
                goto error_return;
        }
 
+       /* check for referrals */
+       if ( backend_check_referrals( op, rs ) != LDAP_SUCCESS ) {
+               rc = rs->sr_err;
+               goto error_return;
+       }
 
 #ifndef SLAPD_MULTIMASTER
        /* This does not apply to multi-master case */
@@ -210,7 +216,7 @@ int passwd_extop(
                                         * if it cares... */
 
                rs->sr_err = slap_mods_opattrs( &op2, ml, qpw->rs_modtail, &rs->sr_text,
-                       NULL, 0 );
+                       NULL, 0, 1 );
                
                if ( rs->sr_err == LDAP_SUCCESS ) {
                        rs->sr_err = op2.o_bd->be_modify( &op2, rs );
@@ -269,13 +275,8 @@ int slap_passwd_parse( struct berval *reqdata,
        tag = ber_scanf( ber, "{" /*}*/ );
 
        if( tag == LBER_ERROR ) {
-#ifdef NEW_LOGGING
-               LDAP_LOG( OPERATION, ERR, 
-                       "slap_passwd_parse: decoding error\n", 0, 0, 0 );
-#else
                Debug( LDAP_DEBUG_TRACE,
                        "slap_passwd_parse: decoding error\n", 0, 0, 0 );
-#endif
                rc = LDAP_PROTOCOL_ERROR;
                goto done;
        }
@@ -283,13 +284,8 @@ int slap_passwd_parse( struct berval *reqdata,
        tag = ber_peek_tag( ber, &len );
        if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_ID ) {
                if( id == NULL ) {
-#ifdef NEW_LOGGING
-                       LDAP_LOG( OPERATION, ERR,
-                          "slap_passwd_parse: ID not allowed.\n", 0, 0, 0 );
-#else
                        Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID not allowed.\n",
                                0, 0, 0 );
-#endif
 
                        *text = "user must change own password";
                        rc = LDAP_UNWILLING_TO_PERFORM;
@@ -299,13 +295,8 @@ int slap_passwd_parse( struct berval *reqdata,
                tag = ber_scanf( ber, "m", id );
 
                if( tag == LBER_ERROR ) {
-#ifdef NEW_LOGGING
-                       LDAP_LOG( OPERATION, ERR,
-                          "slap_passwd_parse:  ID parse failed.\n", 0, 0, 0 );
-#else
                        Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
                                0, 0, 0 );
-#endif
 
                        goto decoding_error;
                }
@@ -315,13 +306,8 @@ int slap_passwd_parse( struct berval *reqdata,
 
        if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_OLD ) {
                if( oldpass == NULL ) {
-#ifdef NEW_LOGGING
-                       LDAP_LOG( OPERATION, ERR,
-                          "slap_passwd_parse: OLD not allowed.\n" , 0, 0, 0 );
-#else
                        Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD not allowed.\n",
                                0, 0, 0 );
-#endif
 
                        *text = "use bind to verify old password";
                        rc = LDAP_UNWILLING_TO_PERFORM;
@@ -331,13 +317,8 @@ int slap_passwd_parse( struct berval *reqdata,
                tag = ber_scanf( ber, "m", oldpass );
 
                if( tag == LBER_ERROR ) {
-#ifdef NEW_LOGGING
-                       LDAP_LOG( OPERATION, ERR,
-                          "slap_passwd_parse:  ID parse failed.\n" , 0, 0, 0 );
-#else
-                       Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
+                       Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD parse failed.\n",
                                0, 0, 0 );
-#endif
 
                        goto decoding_error;
                }
@@ -347,13 +328,8 @@ int slap_passwd_parse( struct berval *reqdata,
 
        if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ) {
                if( newpass == NULL ) {
-#ifdef NEW_LOGGING
-                       LDAP_LOG( OPERATION, ERR,
-                          "slap_passwd_parse:  NEW not allowed.\n", 0, 0, 0 );
-#else
                        Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: NEW not allowed.\n",
                                0, 0, 0 );
-#endif
 
                        *text = "user specified passwords disallowed";
                        rc = LDAP_UNWILLING_TO_PERFORM;
@@ -363,13 +339,8 @@ int slap_passwd_parse( struct berval *reqdata,
                tag = ber_scanf( ber, "m", newpass );
 
                if( tag == LBER_ERROR ) {
-#ifdef NEW_LOGGING
-                       LDAP_LOG( OPERATION, ERR,
-                          "slap_passwd_parse:  OLD parse failed.\n", 0, 0, 0 );
-#else
-                       Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD parse failed.\n",
+                       Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: NEW parse failed.\n",
                                0, 0, 0 );
-#endif
 
                        goto decoding_error;
                }
@@ -379,14 +350,9 @@ int slap_passwd_parse( struct berval *reqdata,
 
        if( len != 0 ) {
 decoding_error:
-#ifdef NEW_LOGGING
-               LDAP_LOG( OPERATION, ERR, 
-                       "slap_passwd_parse: decoding error, len=%ld\n", (long)len, 0, 0 );
-#else
                Debug( LDAP_DEBUG_TRACE,
                        "slap_passwd_parse: decoding error, len=%ld\n",
                        (long) len, 0, 0 );
-#endif
 
                *text = "data decoding error";
                rc = LDAP_PROTOCOL_ERROR;
@@ -407,13 +373,8 @@ struct berval * slap_passwd_return(
 
        assert( cred != NULL );
 
-#ifdef NEW_LOGGING
-       LDAP_LOG( OPERATION, ENTRY, 
-               "slap_passwd_return: %ld\n",(long)cred->bv_len, 0, 0 );
-#else
        Debug( LDAP_DEBUG_TRACE, "slap_passwd_return: %ld\n",
                (long) cred->bv_len, 0, 0 );
-#endif
        
        ber_init_w_nullc( ber, LBER_USE_DER );
 
@@ -429,25 +390,37 @@ struct berval * slap_passwd_return(
        return bv;
 }
 
+/*
+ * if "e" is provided, access to each value of the password is checked first
+ */
 int
 slap_passwd_check(
-       Connection *conn,
-       Attribute *a,
-       struct berval *cred,
-       const char **text )
+       Operation       *op,
+       Entry           *e,
+       Attribute       *a,
+       struct berval   *cred,
+       const char      **text )
 {
-       int result = 1;
-       struct berval *bv;
+       int                     result = 1;
+       struct berval           *bv;
+       AccessControlState      acl_state = ACL_STATE_INIT;
 
 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
        ldap_pvt_thread_mutex_lock( &passwd_mutex );
 #ifdef SLAPD_SPASSWD
-       lutil_passwd_sasl_conn = conn->c_sasl_authctx;
+       lutil_passwd_sasl_conn = op->o_conn->c_sasl_authctx;
 #endif
 #endif
 
        for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
-               if( !lutil_passwd( bv, cred, NULL, text ) ) {
+               /* if e is provided, check access */
+               if ( e && access_allowed( op, e, a->a_desc, bv,
+                                       ACL_AUTH, &acl_state ) == 0 )
+               {
+                       continue;
+               }
+               
+               if ( !lutil_passwd( bv, cred, NULL, text ) ) {
                        result = 0;
                        break;
                }
@@ -466,11 +439,7 @@ slap_passwd_check(
 void
 slap_passwd_generate( struct berval *pass )
 {
-#ifdef NEW_LOGGING
-       LDAP_LOG( OPERATION, ENTRY, "slap_passwd_generate: begin\n", 0, 0, 0 );
-#else
        Debug( LDAP_DEBUG_TRACE, "slap_passwd_generate\n", 0, 0, 0 );
-#endif
        pass->bv_val = NULL;
        pass->bv_len = 0;