Add a sample ACL

[openldap] / servers / slapd / sasl.c

diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index 06063451336e76582b03fe74affc2d22fc63f177..e41c28d2bf33da106443d37c76e141f8d188518c 100644 (file)
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -9,12 +9,11 @@
 #include <ac/stdlib.h>
 #include <stdio.h>
 
-#include "slap.h"
-#include "proto-slap.h"
-
 #include <lber.h>
 #include <ldap_log.h>
 
+#include "slap.h"
+
 #ifdef HAVE_CYRUS_SASL
 #include <limits.h>
 #include <sasl.h>
@@ -25,8 +24,8 @@
 #include <lutil.h>
 #endif
 
-static sasl_security_properties_t sasl_secprops;
 
+static sasl_security_properties_t sasl_secprops;
 
 static int
 slap_sasl_log(
@@ -83,7 +82,7 @@ slap_sasl_log(
 
 int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags )
 {
-       char *c, *c1, *dn=NULL;
+       char *c=NULL, *c1, *dn=NULL;
        int rc, len;
        sasl_conn_t *ctx;
 
@@ -107,21 +106,43 @@ int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags )
                return( LDAP_SUCCESS );
        }
        ctx = conn->c_sasl_context;
-       dn = ch_strdup( id );
        len = strlen( id );
 
-       /* An authcID will need to be prefixed with u: */
+       /* An authcID needs to be converted to authzID form */
        if( flags & FLAG_GETDN_AUTHCID ) {
-               dn = ch_realloc( dn, len+3 );
-               memmove( dn+2, dn, len+1 );
-               dn[0] = 'u';
-               dn[1] = ':';
-               len += 2;
+               if( sasl_external_x509dn_convert && conn->c_sasl_bind_mech
+                       && ( strcasecmp( "EXTERNAL", conn->c_sasl_bind_mech ) == 0 ) 
+                       && len && id[0] == '/' /* && id[len-1]== '/' */)
+               {
+                       /* check SASL external for X.509 style DN and */
+                       /* convert to dn:<dn> form */
+                       char *tmpdn = ldap_dcedn2dn( id );
+                       len = strlen( tmpdn );
+
+                       dn = ch_malloc( len+4 );
+                       dn[0] = 'd';
+                       dn[1] = 'n';
+                       dn[2] = ':';
+                       memmove( &dn[3], tmpdn, len+1 );
+                       len += 3;
+
+               } else {
+                       /* convert to u:<username> form */
+                       dn = ch_malloc( len+3 );
+                       dn[0] = 'u';
+                       dn[1] = ':';
+                       memmove( &dn[2], id, len+1 );
+                       len += 2;
+               }
+       } else {
+               dn = ch_strdup( id );
        }
 
        /* An authzID must be properly prefixed */
-       if( flags & FLAG_GETDN_AUTHZID && strncasecmp( dn, "u:", 2 ) &&
-         strncasecmp( dn, "dn:", 3 ) ) {
+       if( flags & FLAG_GETDN_AUTHZID
+               && strncasecmp( dn, "u:", 2 )
+               && strncasecmp( dn, "dn:", 3 ) )
+       {
                ch_free( dn );
                *dnptr = NULL;
                return( LDAP_INAPPROPRIATE_AUTH );
@@ -203,7 +224,7 @@ int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags )
        }
 
        if( ( flags & FLAG_GETDN_FINAL ) == 0 )  {
-               dn_normalize( dn );
+               dn_normalize( dn+3 );
        }
 
        *dnptr = dn;
@@ -290,7 +311,7 @@ slap_sasl_authorize(
 #ifdef NEW_LOGGING
        LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
                   "slap_sasl_authorize: conn %d authorization allowed\n",
-                  (long)(conn ? conn->c_connid : -1 ) );
+                  (long)(conn ? conn->c_connid : -1 ) ));
 #else
        Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
                " authorization allowed\n",
@@ -590,7 +611,7 @@ int slap_sasl_bind(
 #ifdef HAVE_CYRUS_SASL
        sasl_conn_t *ctx = conn->c_sasl_context;
        struct berval response;
-       unsigned reslen;
+       unsigned reslen = 0;
        const char *errstr;
        int sc;
 
@@ -617,7 +638,8 @@ int slap_sasl_bind(
        if ( !conn->c_sasl_bind_in_progress ) {
                sc = sasl_server_start( ctx,
                        conn->c_sasl_bind_mech,
-                       cred->bv_val, cred->bv_len,
+                       cred->bv_len ? cred->bv_val : "",
+                       cred->bv_len,
                        (char **)&response.bv_val, &reslen, &errstr );
 
        } else {