Remove lint

[openldap] / servers / slapd / sasl.c

diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index 95faa8f29afda7b045b68dd9e0f86b8e81fe8152..29a83f5adab5134da34332cf57fc6e306f1be80a 100644 (file)
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -27,7 +27,6 @@
 
 static sasl_security_properties_t sasl_secprops;
 
-
 static int
 slap_sasl_log(
        void *context,
@@ -61,9 +60,9 @@ slap_sasl_log(
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
-                  "SASL [conn=%d] %s: %s\n",
-                  conn ? conn->c_connid : -1,
-                  label, message ));
+               "SASL [conn=%d] %s: %s\n",
+               conn ? conn->c_connid : -1,
+               label, message ));
 #else
        Debug( level, "SASL [conn=%d] %s: %s\n",
                conn ? conn->c_connid: -1,
@@ -83,16 +82,16 @@ slap_sasl_log(
 
 int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags )
 {
-       char *c, *c1, *dn=NULL;
-       int rc, len, len1;
+       char *c=NULL, *c1, *dn=NULL;
+       int rc, len;
        sasl_conn_t *ctx;
 
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
-                  "slap_sasl_getdn: conn %d id=%s\n",
-                  conn ? conn->c_connid : -1,
-                  id ? (*id ? id : "<empty>") : "NULL" ));
+               "slap_sasl_getdn: conn %d id=%s\n",
+               conn ? conn->c_connid : -1,
+               id ? (*id ? id : "<empty>") : "NULL" ));
 #else
        Debug( LDAP_DEBUG_ARGS, "slap_sasl_getdn: id=%s\n", 
       id?(*id?id:"<empty>"):"NULL",0,0 );
@@ -107,37 +106,59 @@ int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags )
                return( LDAP_SUCCESS );
        }
        ctx = conn->c_sasl_context;
-       dn = ch_strdup( id );
        len = strlen( id );
 
-       /* An authcID will need to be prefixed with u: */
+       /* An authcID needs to be converted to authzID form */
        if( flags & FLAG_GETDN_AUTHCID ) {
-               dn = ch_realloc( dn, len+3 );
-               memmove( dn+2, dn, len+1 );
-               dn[0] = 'u';
-               dn[1] = ':';
-               len += 2;
+               if( sasl_external_x509dn_convert && conn->c_sasl_bind_mech
+                       && ( strcasecmp( "EXTERNAL", conn->c_sasl_bind_mech ) == 0 ) 
+                       && len && dn[0] == '/' && dn[len-1]== '/' )
+               {
+                       /* check SASL external for X.509 style DN and */
+                       /* convert to dn:<dn> form */
+                       char *tmpdn = ldap_dcedn2dn( id );
+                       len = strlen( tmpdn );
+
+                       dn = ch_malloc( len+4 );
+                       dn[0] = 'd';
+                       dn[1] = 'n';
+                       dn[2] = ':';
+                       memmove( &dn[3], tmpdn, len+1 );
+                       len += 3;
+
+               } else {
+                       /* convert to u:<username> form */
+                       dn = ch_malloc( len+3 );
+                       dn[0] = 'u';
+                       dn[1] = ':';
+                       memmove( &dn[2], id, len+1 );
+                       len += 2;
+               }
+       } else {
+               dn = ch_strdup( id );
        }
 
        /* An authzID must be properly prefixed */
-       if( flags & FLAG_GETDN_AUTHZID && strncasecmp( dn, "u:", 2 ) &&
-         strncasecmp( dn, "dn:", 3 ) ) {
+       if( flags & FLAG_GETDN_AUTHZID
+               && strncasecmp( dn, "u:", 2 )
+               && strncasecmp( dn, "dn:", 3 ) )
+       {
                ch_free( dn );
                *dnptr = NULL;
                return( LDAP_INAPPROPRIATE_AUTH );
        }
 
        /* Username strings */
-       len1  = strlen( ",cn=auth" );
        if( !strncasecmp( dn, "u:", 2 ) ) {
+               int len1  = strlen( ",cn=auth" );
                len += strlen( "dn:uid=" ) + len1;
 
                /* Figure out how much data we have for the dn */
                rc = sasl_getprop( ctx, SASL_REALM, (void **)&c );
-               if( rc != SASL_OK ) {
+               if( rc != SASL_OK && rc != SASL_NOTDONE ) {
 #ifdef NEW_LOGGING
                        LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
-                                  "slap_sasl_getdn: getprop(REALM) failed.\n" ));
+                               "slap_sasl_getdn: getprop(REALM) failed.\n" ));
 #else
                        Debug(LDAP_DEBUG_TRACE,
                                "getdn: getprop(REALM) failed!\n", 0,0,0);
@@ -147,11 +168,13 @@ int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags )
                        *dnptr = NULL;
                        return( LDAP_OPERATIONS_ERROR );
                }
-               if( c ) {
+
+               if( c && *c ) {
                        len += strlen( c ) + strlen(",cn=" );
                }
+
                if( conn->c_sasl_bind_mech ) {
-                       len += strlen( conn->c_sasl_bind_mech ) + strlen( ",cn=mech" );
+                       len += strlen( conn->c_sasl_bind_mech ) + strlen( ",cn=" );
                }
 
                /* Build the new dn */
@@ -168,13 +191,13 @@ int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags )
                }
                strcpy( dn+len, ",cn=auth" );
                len += len1;
+
 #ifdef NEW_LOGGING
                LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
-                          "getdn: u:id converted to %s.\n", dn ));
+                       "slap_sasl_getdn: u:id converted to %s.\n", dn ));
 #else
                Debug( LDAP_DEBUG_TRACE, "getdn: u:id converted to %s\n", dn,0,0 );
 #endif
-
        }
 
        /* DN strings that are a cn=auth identity to run through regexp */
@@ -190,18 +213,18 @@ int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags )
                                sprintf( dn, "dn:%s", c1 );
                                ch_free( c1 );
                        }
+
 #ifdef NEW_LOGGING
                        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
                                   "slap_sasl_getdn: dn:id converted to %s.\n", dn ));
 #else
                        Debug( LDAP_DEBUG_TRACE, "getdn: dn:id converted to %s\n", dn,0,0 );
 #endif
-
                }
        }
 
        if( ( flags & FLAG_GETDN_FINAL ) == 0 )  {
-               dn_normalize( dn );
+               dn_normalize( dn+3 );
        }
 
        *dnptr = dn;
@@ -288,7 +311,7 @@ slap_sasl_authorize(
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
                   "slap_sasl_authorize: conn %d authorization allowed\n",
-                  (long)(conn ? conn->c_connid : -1 ) );
+                  (long)(conn ? conn->c_connid : -1 ) ));
 #else
        Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
                " authorization allowed\n",