Ensure that global plugins are called after backend-specific plugins

[openldap] / servers / slapd / sasl.c

diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index c97c144321a76faea1c861e18cf10d7d85a213c2..4514f3ceff67ebd6e20745e74fe8fb9c4b565d9a 100644 (file)
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -1,6 +1,6 @@
 /* $OpenLDAP$ */
 /*
- * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
  */
 
@@ -610,13 +610,13 @@ slap_sasl_canonicalize(
        LDAP_LOG( TRANSPORT, ENTRY, 
                "slap_sasl_canonicalize: conn %d %s=\"%s\"\n",
                conn ? conn->c_connid : -1,
-               (flags & SASL_CU_AUTHID) ? "authcid" : "authzid", in ? in : "<empty>");
+               (flags & SASL_CU_AUTHID) ? "authcid" : "authzid",
+               in ? in : "<empty>");
 #else
-       Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: "
-               "%s=\"%s\"\n",
-                       conn ? conn->c_connid : -1,
-                       (flags & SASL_CU_AUTHID) ? "authcid" : "authzid",
-                       in ? in : "<empty>" );
+       Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: %s=\"%s\"\n",
+               conn ? conn->c_connid : -1,
+               (flags & SASL_CU_AUTHID) ? "authcid" : "authzid",
+               in ? in : "<empty>");
 #endif
 
        /* If name is too big, just truncate. We don't care, we're
@@ -656,8 +656,12 @@ slap_sasl_canonicalize(
         * the authcID temporarily in conn->c_sasl_dn. We necessarily
         * finish Canonicalizing before Authorizing, so there is no
         * conflict with slap_sasl_authorize's use of this temp var.
+        *
+        * The SASL EXTERNAL mech is backwards from all the other mechs,
+        * it does authzID before the authcID. If we see that authzID
+        * has already been done, don't do anything special with authcID.
         */
-       if ( flags == SASL_CU_AUTHID ) {
+       if ( flags == SASL_CU_AUTHID && !auxvals[PROP_AUTHZ].values ) {
                conn->c_sasl_dn.bv_val = (char *) in;
        } else if ( flags == SASL_CU_AUTHZID && conn->c_sasl_dn.bv_val ) {
                rc = strcmp( in, conn->c_sasl_dn.bv_val );
@@ -681,14 +685,16 @@ slap_sasl_canonicalize(
 #ifdef NEW_LOGGING
        LDAP_LOG( TRANSPORT, ENTRY, 
                "slap_sasl_canonicalize: conn %d %s=\"%s\"\n",
-               conn ? conn->c_connid : -1, names[0]+1, dn.bv_val );
+               conn ? conn->c_connid : -1, names[0]+1,
+               dn.bv_val ? dn.bv_val : "<EMPTY>" );
 #else
-       Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: "
-               "%s=\"%s\"\n",
-                       conn ? conn->c_connid : -1,
-                       names[0]+1, dn.bv_val );
+       Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: %s=\"%s\"\n",
+               conn ? conn->c_connid : -1, names[0]+1,
+               dn.bv_val ? dn.bv_val : "<EMPTY>" );
 #endif
-done:  AC_MEMCPY( out, in, inlen );
+
+done:
+       AC_MEMCPY( out, in, inlen );
        out[inlen] = '\0';
 
        *out_len = inlen;
@@ -736,7 +742,7 @@ slap_sasl_authorize(
        /* Nothing to do if no authzID was given */
        if ( !auxvals[1].name || !auxvals[1].values ) {
                conn->c_sasl_dn = authcDN;
-               return SASL_OK;
+               goto ok;
        }
        
        AC_MEMCPY( &authzDN, auxvals[1].values[0], sizeof(authzDN) );
@@ -760,6 +766,13 @@ slap_sasl_authorize(
        }
 
        conn->c_sasl_dn = authzDN;
+ok:
+       if (conn->c_sasl_bindop) {
+               Statslog( LDAP_DEBUG_STATS,
+                       "conn=%lu op=%lu BIND authcid=\"%s\"\n",
+                       conn->c_connid, conn->c_sasl_bindop->o_opid, 
+                       auth_identity, 0, 0);
+       }
 
 #ifdef NEW_LOGGING
        LDAP_LOG( TRANSPORT, ENTRY, 
@@ -839,8 +852,7 @@ slap_sasl_authorize(
 #endif
 
                conn->c_sasl_dn = authcDN;
-               *errstr = NULL;
-               return SASL_OK;
+               goto ok;
        }
        rc = slap_sasl_getdn( conn, (char *)authzid, 0, realm,
                &authzDN, SLAP_GETDN_AUTHZID );
@@ -867,7 +879,9 @@ slap_sasl_authorize(
                ch_free( authzDN.bv_val );
                return SASL_NOAUTHZ;
        }
+       conn->c_sasl_dn = authzDN;
 
+ok:
 #ifdef NEW_LOGGING
        LDAP_LOG( TRANSPORT, RESULTS, 
                "slap_sasl_authorize: conn %d authorization allowed\n",
@@ -878,7 +892,13 @@ slap_sasl_authorize(
                (long) (conn ? conn->c_connid : -1), 0, 0 );
 #endif
 
-       conn->c_sasl_dn = authzDN;
+       if (conn->c_sasl_bindop) {
+               Statslog( LDAP_DEBUG_STATS,
+                       "conn=%lu op=%lu BIND authcid=\"%s\"\n",
+                       conn->c_connid, conn->c_sasl_bindop->o_opid, 
+                       authcid, 0, 0);
+       }
+
        *errstr = NULL;
        return SASL_OK;
 }
@@ -1550,19 +1570,15 @@ int slap_sasl_getdn( Connection *conn, char *id, int len,
         * is already normalized, so copy it and skip normalization.
         */
        if( flags & SLAP_GETDN_AUTHCID ) {
-#ifdef HAVE_TLS
-               if( conn->c_is_tls &&
-                       conn->c_sasl_bind_mech.bv_len == ext_bv.bv_len &&
+               if( conn->c_sasl_bind_mech.bv_len == ext_bv.bv_len &&
                        strcasecmp( ext_bv.bv_val, conn->c_sasl_bind_mech.bv_val ) == 0 )
                {
-                       /* X.509 DN is already normalized */
+                       /* EXTERNAL DNs are already normalized */
                        do_norm = 0;
                        is_dn = SET_DN;
                        ber_str2bv( id, len, 1, dn );
 
-               } else
-#endif
-               {
+               } else {
                        /* convert to u:<username> form */
                        is_dn = SET_U;
                        dn->bv_val = id;