/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 1998-2006 The OpenLDAP Foundation.
+ * Copyright 1998-2010 The OpenLDAP Foundation.
* Portions Copyright 2000 Mark Adamson, Carnegie Mellon.
* All rights reserved.
*
return( rc );
}
-#if 0
-int
-authzMatch(
- int *matchp,
- slap_mask_t flags,
- Syntax *syntax,
- MatchingRule *mr,
- struct berval *value,
- void *assertedValue )
-{
- return octetStringMatch( matchp, flags, syntax, mr, value, assertedValue );
-}
-#endif
-
static int
authzPrettyNormal(
struct berval *val,
} else {
BER_BVSTR( &group_oc, SLAPD_GROUP_CLASS );
+ BER_BVSTR( &member_at, SLAPD_GROUP_ATTR );
}
group_dn.bv_val++;
group_dn.bv_len = uri->bv_len - ( group_dn.bv_val - uri->bv_val );
done:
if( rc != LDAP_SUCCESS ) {
- if( *filter ) filter_free_x( op, *filter );
+ if( *filter ) filter_free_x( op, *filter, 1 );
BER_BVZERO( base );
BER_BVZERO( fstr );
} else {
Debug( LDAP_DEBUG_TRACE,
"%s: slap_sc_sasl2dn: search DN returned more than 1 entry\n",
op->o_log_prefix, 0, 0 );
- return LDAP_OTHER;
+ return LDAP_UNAVAILABLE; /* short-circuit the search */
}
ber_dupbv_x( ndn, &rs->sr_entry->e_nname, op->o_tmpmemctx );
if (dn_match(sm->dn, &rs->sr_entry->e_nname)) {
sm->match = 1;
- return -1; /* short-circuit the search */
+ return LDAP_UNAVAILABLE; /* short-circuit the search */
}
- return 1;
+ return 0;
}
int
Debug( LDAP_DEBUG_TRACE,
"===>slap_sasl_match: comparing DN %s to rule %s\n",
- assertDN->bv_val, rule->bv_val, 0 );
+ assertDN->bv_len ? assertDN->bv_val : "(null)", rule->bv_val, 0 );
/* NOTE: don't normalize rule if authz syntax is enabled */
rc = slap_parseURI( opx, rule, &base, &op.o_req_ndn,
/* leave room for at least one char of attributeType,
* one for '=' and one for ',' */
- if ( d < STRLENOF( "x=,") ) {
+ if ( d < (int) STRLENOF( "x=,") ) {
goto CONCLUDED;
}
"slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
op.o_req_ndn.bv_val, op.ors_scope, 0 );
- op.o_bd = select_backend( &op.o_req_ndn, 0, 1 );
+ op.o_bd = select_backend( &op.o_req_ndn, 1 );
if(( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL)) {
rc = LDAP_INAPPROPRIATE_AUTH;
goto CONCLUDED;
CONCLUDED:
if( !BER_BVISNULL( &op.o_req_dn ) ) slap_sl_free( op.o_req_dn.bv_val, opx->o_tmpmemctx );
if( !BER_BVISNULL( &op.o_req_ndn ) ) slap_sl_free( op.o_req_ndn.bv_val, opx->o_tmpmemctx );
- if( op.ors_filter ) filter_free_x( opx, op.ors_filter );
+ if( op.ors_filter ) filter_free_x( opx, op.ors_filter, 1 );
if( !BER_BVISNULL( &op.ors_filterstr ) ) ch_free( op.ors_filterstr.bv_val );
Debug( LDAP_DEBUG_TRACE,
AttributeDescription *ad,
struct berval *authc )
{
- int rc;
- BerVarray vals = NULL;
+ int rc,
+ do_not_cache = op->o_do_not_cache;
+ BerVarray vals = NULL;
Debug( LDAP_DEBUG_TRACE,
"==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
+ /* ITS#4760: don't cache group access */
+ op->o_do_not_cache = 1;
rc = backend_attribute( op, NULL, searchDN, ad, &vals, ACL_AUTH );
+ op->o_do_not_cache = do_not_cache;
if( rc != LDAP_SUCCESS ) goto COMPLETE;
/* Check if the *assertDN matches any *vals */
}
/* Must do an internal search */
- op.o_bd = select_backend( &op.o_req_ndn, 0, 1 );
+ op.o_bd = select_backend( &op.o_req_ndn, 1 );
switch ( op.ors_scope ) {
case LDAP_X_SCOPE_EXACT:
slap_sl_free( op.o_req_ndn.bv_val, opx->o_tmpmemctx );
}
if( op.ors_filter ) {
- filter_free_x( opx, op.ors_filter );
+ filter_free_x( opx, op.ors_filter, 1 );
}
if( !BER_BVISNULL( &op.ors_filterstr ) ) {
ch_free( op.ors_filterstr.bv_val );
int rc = LDAP_INAPPROPRIATE_AUTH;
/* User binding as anonymous */
- if ( authzDN == NULL ) {
+ if ( !authzDN || !authzDN->bv_len || !authzDN->bv_val ) {
rc = LDAP_SUCCESS;
goto DONE;
}
+ /* User is anonymous */
+ if ( !authcDN || !authcDN->bv_len || !authcDN->bv_val ) {
+ goto DONE;
+ }
+
Debug( LDAP_DEBUG_TRACE,
"==>slap_sasl_authorized: can %s become %s?\n",
authcDN->bv_len ? authcDN->bv_val : "(null)",