#ifdef HAVE_CYRUS_SASL
#include <limits.h>
+
+#ifdef HAVE_SASL_SASL_H
+#include <sasl/sasl.h>
+#else
#include <sasl.h>
-#include <ldap_pvt.h>
#endif
+#include <ldap_pvt.h>
+
/* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
-static int slap_parseURI( char *uri,
- struct berval *searchbase, int *scope, Filter **filter )
+static int slap_parseURI( struct berval *uri,
+ struct berval *searchbase, int *scope, Filter **filter,
+ struct berval *fstr )
{
- char *start, *end;
struct berval bv;
int rc;
+ LDAPURLDesc *ludp;
-
- assert( uri != NULL );
+ assert( uri != NULL && uri->bv_val != NULL );
searchbase->bv_val = NULL;
searchbase->bv_len = 0;
*scope = -1;
*filter = NULL;
+ if ( fstr ) {
+ fstr->bv_val = NULL;
+ fstr->bv_len = 0;
+ }
+
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_parseURI: parsing %s\n", uri ));
+ "slap_parseURI: parsing %s\n", uri->bv_val ));
#else
- Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri, 0, 0 );
+ Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
#endif
/* If it does not look like a URI, assume it is a DN */
- if( !strncasecmp( uri, "dn:", sizeof("dn:")-1 ) ) {
- uri += sizeof("dn:")-1;
- uri += strspn( uri, " " );
- bv.bv_val = uri;
- /* FIXME: if dnNormalize actually uses input bv_len we
- * will have to make this right.
- */
-is_dn: bv.bv_len = 1;
+ if( !strncasecmp( uri->bv_val, "dn:", sizeof("dn:")-1 ) ) {
+ bv.bv_val = uri->bv_val + sizeof("dn:")-1;
+ bv.bv_val += strspn( bv.bv_val, " " );
+
+is_dn: bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val);
rc = dnNormalize2( NULL, &bv, searchbase );
if (rc == LDAP_SUCCESS) {
*scope = LDAP_SCOPE_BASE;
return( rc );
}
- /* FIXME: should use ldap_url_parse() */
- if( strncasecmp( uri, "ldap://", sizeof("ldap://")-1 ) ) {
- bv.bv_val = uri;
+ rc = ldap_url_parse( uri->bv_val, &ludp );
+ if ( rc == LDAP_URL_ERR_BADSCHEME ) {
+ bv.bv_val = uri->bv_val;
goto is_dn;
}
- end = strchr( uri + (sizeof("ldap://")-1), '/' );
- if ( end == NULL )
+ if ( rc != LDAP_URL_SUCCESS ) {
return( LDAP_PROTOCOL_ERROR );
+ }
/* could check the hostname here */
- /* Grab the searchbase */
- start = end+1;
- end = strchr( start, '?' );
- bv.bv_val = start;
- if( end == NULL ) {
- bv.bv_len = 1;
- return dnNormalize2( NULL, &bv, searchbase );
- }
- *end = '\0';
- bv.bv_len = end - start;
- rc = dnNormalize2( NULL, &bv, searchbase );
- *end = '?';
- if (rc != LDAP_SUCCESS)
- return( rc );
+ /* Grab the scope */
+ *scope = ludp->lud_scope;
- /* Skip the attrs */
- start = end+1;
- end = strchr( start, '?' );
- if( end == NULL ) {
- return( LDAP_SUCCESS );
+ /* Grab the filter */
+ if ( ludp->lud_filter ) {
+ *filter = str2filter( ludp->lud_filter );
+ if ( *filter == NULL )
+ rc = LDAP_PROTOCOL_ERROR;
+ else if ( fstr )
+ ber_str2bv( ludp->lud_filter, 0, 1, fstr );
}
- /* Grab the scope */
- start = end+1;
- if( !strncasecmp( start, "base?", sizeof("base?")-1 )) {
- *scope = LDAP_SCOPE_BASE;
- start += sizeof("base?")-1;
- }
- else if( !strncasecmp( start, "one?", sizeof("one?")-1 )) {
- *scope = LDAP_SCOPE_ONELEVEL;
- start += sizeof("one?")-1;
- }
- else if( !strncasecmp( start, "sub?", sizeof("sub?")-1 )) {
- *scope = LDAP_SCOPE_SUBTREE;
- start += sizeof("sub?")-1;
- }
- else {
- free( searchbase->bv_val );
- searchbase->bv_val = NULL;
- return( LDAP_PROTOCOL_ERROR );
+ /* Grab the searchbase */
+ if ( rc == LDAP_URL_SUCCESS ) {
+ bv.bv_val = ludp->lud_dn;
+ bv.bv_len = strlen( bv.bv_val );
+ rc = dnNormalize2( NULL, &bv, searchbase );
}
- /* Grab the filter */
- *filter = str2filter( start );
+ ldap_free_urldesc( ludp );
- return( LDAP_SUCCESS );
+ return( rc );
}
+static int slap_sasl_rx_off(char *rep, int *off)
+{
+ const char *c;
+ int n;
+
+ /* Precompile replace pattern. Find the $<n> placeholders */
+ off[0] = -2;
+ n = 1;
+ for ( c = rep; *c; c++ ) {
+ if ( *c == '\\' && c[1] ) {
+ c++;
+ continue;
+ }
+ if ( *c == '$' ) {
+ if ( n == SASLREGEX_REPLACE ) {
+#ifdef NEW_LOGGING
+ LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
+ "slap_sasl_regexp_config: \"%s\" has too many $n "
+ "placeholders (max %d)\n",
+ rep, SASLREGEX_REPLACE ));
+#else
+ Debug( LDAP_DEBUG_ANY,
+ "SASL replace pattern %s has too many $n "
+ "placeholders (max %d)\n",
+ rep, SASLREGEX_REPLACE, 0 );
+#endif
+
+ return( LDAP_OPERATIONS_ERROR );
+ }
+ off[n] = c - rep;
+ n++;
+ }
+ }
+
+ /* Final placeholder, after the last $n */
+ off[n] = c - rep;
+ n++;
+ off[n] = -1;
+ return( LDAP_SUCCESS );
+}
+#endif /* HAVE_CYRUS_SASL */
int slap_sasl_regexp_config( const char *match, const char *replace )
{
const char *c;
int rc, n;
SaslRegexp_t *reg;
+ struct berval bv, nbv;
+ Filter *filter;
SaslRegexp = (SaslRegexp_t *) ch_realloc( (char *) SaslRegexp,
(nSaslRegexp + 1) * sizeof(SaslRegexp_t) );
reg = &( SaslRegexp[nSaslRegexp] );
- reg->match = ch_strdup( match );
- reg->replace = ch_strdup( replace );
- dn_normalize( reg->match );
- dn_normalize( reg->replace );
+ ber_str2bv( match, 0, 0, &bv );
+ rc = dnNormalize2( NULL, &bv, &nbv );
+ if ( rc ) {
+#ifdef NEW_LOGGING
+ LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
+ "slap_sasl_regexp_config: \"%s\" could not be normalized.\n",
+ match ));
+#else
+ Debug( LDAP_DEBUG_ANY,
+ "SASL match pattern %s could not be normalized.\n",
+ match, 0, 0 );
+#endif
+ return( rc );
+ }
+ reg->sr_match = nbv.bv_val;
+
+ ber_str2bv( replace, 0, 0, &bv );
+ rc = slap_parseURI( &bv, ®->sr_replace.dn, ®->sr_replace.scope,
+ &filter, ®->sr_replace.filter );
+ if ( filter ) filter_free( filter );
+ if ( rc ) {
+#ifdef NEW_LOGGING
+ LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
+ "slap_sasl_regexp_config: \"%s\" could not be parsed.\n",
+ replace ));
+#else
+ Debug( LDAP_DEBUG_ANY,
+ "SASL replace pattern %s could not be parsed.\n",
+ replace, 0, 0 );
+#endif
+ return( rc );
+ }
/* Precompile matching pattern */
- rc = regcomp( ®->workspace, reg->match, REG_EXTENDED|REG_ICASE );
+ rc = regcomp( ®->sr_workspace, reg->sr_match, REG_EXTENDED|REG_ICASE );
if ( rc ) {
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
"slap_sasl_regexp_config: \"%s\" could not be compiled.\n",
- reg->match ));
+ reg->sr_match ));
#else
Debug( LDAP_DEBUG_ANY,
"SASL match pattern %s could not be compiled by regexp engine\n",
- reg->match, 0, 0 );
+ reg->sr_match, 0, 0 );
#endif
return( LDAP_OPERATIONS_ERROR );
}
- /* Precompile replace pattern. Find the $<n> placeholders */
- reg->offset[0] = -2;
- n = 1;
- for ( c = reg->replace; *c; c++ ) {
- if ( *c == '\\' ) {
- c++;
- continue;
- }
- if ( *c == '$' ) {
- if ( n == SASLREGEX_REPLACE ) {
-#ifdef NEW_LOGGING
- LDAP_LOG(( "sasl", LDAP_LEVEL_ERR,
- "slap_sasl_regexp_config: \"%s\" has too many $n placeholders (max %d)\n",
- reg->replace, SASLREGEX_REPLACE ));
-#else
- Debug( LDAP_DEBUG_ANY,
- "SASL replace pattern %s has too many $n placeholders (max %d)\n",
- reg->replace, SASLREGEX_REPLACE, 0 );
-#endif
+ rc = slap_sasl_rx_off( reg->sr_replace.dn.bv_val, reg->sr_dn_offset );
+ if ( rc != LDAP_SUCCESS ) return rc;
- return( LDAP_OPERATIONS_ERROR );
- }
- reg->offset[n] = c - reg->replace;
- n++;
- }
+ if (reg->sr_replace.filter.bv_val ) {
+ rc = slap_sasl_rx_off( reg->sr_replace.filter.bv_val, reg->sr_fi_offset );
+ if ( rc != LDAP_SUCCESS ) return rc;
}
- /* Final placeholder, after the last $n */
- reg->offset[n] = c - reg->replace;
- n++;
- reg->offset[n] = -1;
-
nSaslRegexp++;
#endif
return( LDAP_SUCCESS );
#ifdef HAVE_CYRUS_SASL
+/* Perform replacement on regexp matches */
+static void slap_sasl_rx_exp( char *rep, int *off, regmatch_t *str,
+ char *saslname, struct berval *out )
+{
+ int i, n, len, insert;
+
+ /* Get the total length of the final URI */
+
+ n=1;
+ len = 0;
+ while( off[n] >= 0 ) {
+ /* Len of next section from replacement string (x,y,z above) */
+ len += off[n] - off[n-1] - 2;
+ if( off[n+1] < 0)
+ break;
+
+ /* Len of string from saslname that matched next $i (b,d above) */
+ i = rep[ off[n] + 1 ] - '0';
+ len += str[i].rm_eo - str[i].rm_so;
+ n++;
+ }
+ out->bv_val = ch_malloc( len + 1 );
+ out->bv_len = len;
+
+ /* Fill in URI with replace string, replacing $i as we go */
+ n=1;
+ insert = 0;
+ while( off[n] >= 0) {
+ /* Paste in next section from replacement string (x,y,z above) */
+ len = off[n] - off[n-1] - 2;
+ strncpy( out->bv_val+insert, rep + off[n-1] + 2, len);
+ insert += len;
+ if( off[n+1] < 0)
+ break;
+
+ /* Paste in string from saslname that matched next $i (b,d above) */
+ i = rep[ off[n] + 1 ] - '0';
+ len = str[i].rm_eo - str[i].rm_so;
+ strncpy( out->bv_val+insert, saslname + str[i].rm_so, len );
+ insert += len;
+
+ n++;
+ }
+
+ out->bv_val[insert] = '\0';
+}
+
/* Take the passed in SASL name and attempt to convert it into an
LDAP URI to find the matching LDAP entry, using the pattern matching
strings given in the saslregexp config file directive(s) */
-static
-char *slap_sasl_regexp( char *saslname )
+
+static int slap_sasl_regexp( struct berval *in, SaslUri_t *out )
{
- char *uri=NULL;
- int i, n, len, insert;
+ char *saslname = in->bv_val;
+ char *scope[] = { "base", "one", "sub" };
SaslRegexp_t *reg;
+ int i;
+
+ memset( out, 0, sizeof( *out ) );
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
#endif
if (( saslname == NULL ) || ( nSaslRegexp == 0 ))
- return( NULL );
+ return( 0 );
/* Match the normalized SASL name to the saslregexp patterns */
for( reg = SaslRegexp,i=0; i<nSaslRegexp; i++,reg++ ) {
- if ( regexec( ®->workspace, saslname, SASLREGEX_REPLACE,
- reg->strings, 0) == 0 )
+ if ( regexec( ®->sr_workspace, saslname, SASLREGEX_REPLACE,
+ reg->sr_strings, 0) == 0 )
break;
}
if( i >= nSaslRegexp )
- return( NULL );
+ return( 0 );
/*
* The match pattern may have been of the form "a(b.*)c(d.*)e" and the
* replace pattern of the form "x$1y$2z". The returned string needs
* to replace the $1,$2 with the strings that matched (b.*) and (d.*)
*/
+ slap_sasl_rx_exp( reg->sr_replace.dn.bv_val, reg->sr_dn_offset,
+ reg->sr_strings, saslname, &out->dn );
+ if ( reg->sr_replace.filter.bv_val )
+ slap_sasl_rx_exp( reg->sr_replace.filter.bv_val,
+ reg->sr_fi_offset, reg->sr_strings, saslname, &out->filter );
+
+ out->scope = reg->sr_replace.scope;
- /* Get the total length of the final URI */
-
- n=1;
- len = 0;
- while( reg->offset[n] >= 0 ) {
- /* Len of next section from replacement string (x,y,z above) */
- len += reg->offset[n] - reg->offset[n-1] - 2;
- if( reg->offset[n+1] < 0)
- break;
-
- /* Len of string from saslname that matched next $i (b,d above) */
- i = reg->replace[ reg->offset[n] + 1 ] - '0';
- len += reg->strings[i].rm_eo - reg->strings[i].rm_so;
- n++;
- }
- uri = ch_malloc( len + 1 );
-
- /* Fill in URI with replace string, replacing $i as we go */
- n=1;
- insert = 0;
- while( reg->offset[n] >= 0) {
- /* Paste in next section from replacement string (x,y,z above) */
- len = reg->offset[n] - reg->offset[n-1] - 2;
- strncpy( uri+insert, reg->replace + reg->offset[n-1] + 2, len);
- insert += len;
- if( reg->offset[n+1] < 0)
- break;
-
- /* Paste in string from saslname that matched next $i (b,d above) */
- i = reg->replace[ reg->offset[n] + 1 ] - '0';
- len = reg->strings[i].rm_eo - reg->strings[i].rm_so;
- strncpy( uri+insert, saslname + reg->strings[i].rm_so, len );
- insert += len;
-
- n++;
- }
-
- uri[insert] = '\0';
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_regexp: converted SASL name to %s\n", uri ));
+ "slap_sasl_regexp: converted SASL name to ldap:///%s??%s?%s\n",
+ out->dn.bv_val, scope[out->scope], out->filter.bv_val ?
+ out->filter.bv_val : "" ));
#else
Debug( LDAP_DEBUG_TRACE,
- "slap_sasl_regexp: converted SASL name to %s\n", uri, 0, 0 );
+ "slap_sasl_regexp: converted SASL name to ldap:///%s??%s?%s\n",
+ out->dn.bv_val, scope[out->scope], out->filter.bv_val ?
+ out->filter.bv_val : "" );
#endif
- return( uri );
+ return( 1 );
}
/* Two empty callback functions to avoid sending results */
static void sasl_sc_r( Connection *conn, Operation *o, ber_tag_t tag,
ber_int_t msgid, ber_int_t err, const char *matched,
- const char *text, BVarray ref, const char *resoid,
+ const char *text, BerVarray ref, const char *resoid,
struct berval *resdata, struct berval *sasldata, LDAPControl **c)
{
}
static void sasl_sc_s( Connection *conn, Operation *o, ber_int_t err,
- const char *matched, const char *text, BVarray refs, LDAPControl **c,
+ const char *matched, const char *text, BerVarray refs, LDAPControl **c,
int nentries)
{
}
* entry, return the DN of that one entry.
*/
-char *slap_sasl2dn( char *saslname )
+void slap_sasl2dn( Connection *conn, struct berval *saslname, struct berval *dn )
{
- char *uri=NULL;
- struct berval searchbase = {0, NULL};
- struct berval dn = {0, NULL};
- int rc, scope;
+ int rc;
Backend *be;
Filter *filter=NULL;
- slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_sasl2dn, &dn};
+ slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_sasl2dn, NULL};
Operation op = {0};
+ SaslUri_t uri;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl2dn: converting SASL name %s to DN.\n", saslname ));
+ "slap_sasl2dn: converting SASL name %s to DN.\n", saslname->bv_val ));
#else
Debug( LDAP_DEBUG_TRACE,
- "==>slap_sasl2dn: Converting SASL name %s to a DN\n", saslname, 0,0 );
+ "==>slap_sasl2dn: Converting SASL name %s to a DN\n", saslname->bv_val, 0,0 );
#endif
+ dn->bv_val = NULL;
+ dn->bv_len = 0;
+ cb.sc_private = dn;
- /* Convert the SASL name into an LDAP URI */
- uri = slap_sasl_regexp( saslname );
- if( uri == NULL )
+ /* Convert the SASL name into a minimal URI */
+ if( !slap_sasl_regexp( saslname, &uri ) )
goto FINISHED;
- rc = slap_parseURI( uri, &searchbase, &scope, &filter );
- if( rc ) {
- goto FINISHED;
- }
+ if ( uri.filter.bv_val )
+ filter = str2filter( uri.filter.bv_val );
+
+ /* Must do an internal search */
+
+ be = select_backend( &uri.dn, 0, 1 );
+
+ conn->c_authz_backend = be;
/* Massive shortcut: search scope == base */
- if( scope == LDAP_SCOPE_BASE ) {
- dn = searchbase;
- searchbase.bv_len = 0;
- searchbase.bv_val = NULL;
+ if( uri.scope == LDAP_SCOPE_BASE ) {
+ *dn = uri.dn;
+ uri.dn.bv_len = 0;
+ uri.dn.bv_val = NULL;
goto FINISHED;
}
- /* Must do an internal search */
-
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1,
"slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
- searchbase.bv_val, scope ));
+ uri.dn.bv_val, uri.scope ));
#else
Debug( LDAP_DEBUG_TRACE,
"slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
- searchbase.bv_val, scope, 0 );
+ uri.dn.bv_val, uri.scope, 0 );
#endif
- be = select_backend( &searchbase, 0, 1 );
if(( be == NULL ) || ( be->be_search == NULL))
goto FINISHED;
- suffix_alias( be, &searchbase );
+ suffix_alias( be, &uri.dn );
- ldap_pvt_thread_mutex_init( &op.o_abandonmutex );
op.o_tag = LDAP_REQ_SEARCH;
op.o_protocol = LDAP_VERSION3;
- op.o_ndn.bv_val = saslname;
- op.o_ndn.bv_len = strlen(saslname);
+ op.o_ndn = *saslname;
op.o_callback = &cb;
op.o_time = slap_get_time();
- (*be->be_search)( be, /*conn*/NULL, &op, /*base*/NULL, &searchbase,
- scope, /*deref=*/1, /*sizelimit=*/1, /*time=*/0, filter, /*fstr=*/NULL,
+ (*be->be_search)( be, /*conn*/NULL, &op, /*base*/NULL, &uri.dn,
+ uri.scope, /*deref=*/1, /*sizelimit=*/1, /*time=*/0, filter, /*fstr=*/NULL,
/*attrs=*/NULL, /*attrsonly=*/0 );
- ldap_pvt_thread_mutex_destroy( &op.o_abandonmutex );
-
FINISHED:
- if( searchbase.bv_len ) ch_free( searchbase.bv_val );
+ if( uri.dn.bv_len ) ch_free( uri.dn.bv_val );
+ if( uri.filter.bv_len ) ch_free( uri.filter.bv_val );
if( filter ) filter_free( filter );
- if( uri ) ch_free( uri );
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
"slap_sasl2dn: Converted SASL name to %s\n",
- dn.bv_len ? dn.bv_val : "<nothing>" ));
+ dn->bv_len ? dn->bv_val : "<nothing>" ));
#else
Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n",
- dn.bv_len ? dn.bv_val : "<nothing>", 0, 0 );
+ dn->bv_len ? dn->bv_val : "<nothing>", 0, 0 );
#endif
- return( dn.bv_val );
+ return;
}
typedef struct smatch_info {
*/
static
-int slap_sasl_match( char *rule, struct berval *assertDN, char *authc )
+int slap_sasl_match( struct berval *rule, struct berval *assertDN, struct berval *authc )
{
struct berval searchbase = {0, NULL};
int rc, scope;
Filter *filter=NULL;
regex_t reg;
smatch_info sm;
- slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_smatch, &sm};
+ slap_callback cb = { sasl_sc_r, sasl_sc_s, sasl_sc_smatch, NULL };
Operation op = {0};
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule ));
+ "slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val ));
#else
Debug( LDAP_DEBUG_TRACE,
- "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule, 0 );
+ "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val, 0 );
#endif
- rc = slap_parseURI( rule, &searchbase, &scope, &filter );
+ rc = slap_parseURI( rule, &searchbase, &scope, &filter, NULL );
if( rc != LDAP_SUCCESS )
goto CONCLUDED;
sm.dn = assertDN;
sm.match = 0;
+ cb.sc_private = &sm;
- ldap_pvt_thread_mutex_init( &op.o_abandonmutex );
op.o_tag = LDAP_REQ_SEARCH;
op.o_protocol = LDAP_VERSION3;
- op.o_ndn.bv_val = authc;
- op.o_ndn.bv_len = strlen(authc);
+ op.o_ndn = *authc;
op.o_callback = &cb;
op.o_time = slap_get_time();
scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL,
/*attrs=*/NULL, /*attrsonly=*/0 );
- ldap_pvt_thread_mutex_destroy( &op.o_abandonmutex );
-
if (sm.match)
rc = LDAP_SUCCESS;
else
* attribute named by *attr. If any of those rules map to the *assertDN, the
* authorization is approved.
*
- * DN's passed in should have a dn: prefix
+ * The DNs should not have the dn: prefix
*/
static int
-slap_sasl_check_authz(char *searchDN, char *assertDN, struct berval *attr, char *authc)
+slap_sasl_check_authz(struct berval *searchDN, struct berval *assertDN, struct berval *attr, struct berval *authc)
{
const char *errmsg;
int i, rc;
- BVarray vals=NULL;
+ BerVarray vals=NULL;
AttributeDescription *ad=NULL;
- struct berval bv;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
"slap_sasl_check_authz: does %s match %s rule in %s?\n",
- assertDN, attr, searchDN ));
+ assertDN->bv_val, attr->bv_val, searchDN->bv_val ));
#else
Debug( LDAP_DEBUG_TRACE,
"==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
- assertDN, attr, searchDN);
+ assertDN->bv_val, attr->bv_val, searchDN->bv_val);
#endif
rc = slap_bv2ad( attr, &ad, &errmsg );
if( rc != LDAP_SUCCESS )
goto COMPLETE;
- bv.bv_val = searchDN+3;
- bv.bv_len = strlen(bv.bv_val);
- rc = backend_attribute( NULL, NULL, NULL, NULL, &bv, ad, &vals );
+ rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN, ad, &vals );
if( rc != LDAP_SUCCESS )
goto COMPLETE;
- bv.bv_val = assertDN+3;
- bv.bv_len = strlen(bv.bv_val);
/* Check if the *assertDN matches any **vals */
for( i=0; vals[i].bv_val != NULL; i++ ) {
- rc = slap_sasl_match( vals[i].bv_val, &bv, authc );
+ rc = slap_sasl_match( &vals[i], assertDN, authc );
if ( rc == LDAP_SUCCESS )
goto COMPLETE;
}
rc = LDAP_INAPPROPRIATE_AUTH;
COMPLETE:
- if( vals ) bvarray_free( vals );
+ if( vals ) ber_bvarray_free( vals );
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_check_authz: %s check returning %s\n", attr, rc ));
+ "slap_sasl_check_authz: %s check returning %s\n", attr->bv_val, rc ));
#else
Debug( LDAP_DEBUG_TRACE,
- "<==slap_sasl_check_authz: %s check returning %d\n", attr, rc, 0);
+ "<==slap_sasl_check_authz: %s check returning %d\n", attr->bv_val, rc, 0);
#endif
return( rc );
/* Check if a bind can SASL authorize to another identity.
- Accepts authorization DN's with "dn:" prefix */
+ * The DNs should not have the dn: prefix
+ */
static struct berval sasl_authz_src = {
sizeof(SASL_AUTHZ_SOURCE_ATTR)-1, SASL_AUTHZ_SOURCE_ATTR };
static struct berval sasl_authz_dst = {
sizeof(SASL_AUTHZ_DEST_ATTR)-1, SASL_AUTHZ_DEST_ATTR };
-int slap_sasl_authorized( char *authcDN, char *authzDN )
+int slap_sasl_authorized( struct berval *authcDN, struct berval *authzDN )
{
int rc = LDAP_INAPPROPRIATE_AUTH;
#ifdef NEW_LOGGING
LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY,
- "slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN ));
+ "slap_sasl_authorized: can %s become %s?\n", authcDN->bv_val, authzDN->bv_val ));
#else
Debug( LDAP_DEBUG_TRACE,
- "==>slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN, 0 );
+ "==>slap_sasl_authorized: can %s become %s?\n", authcDN->bv_val, authzDN->bv_val, 0 );
#endif
/* If person is authorizing to self, succeed */
- if ( !strcmp( authcDN, authzDN ) ) {
+ if ( dn_match( authcDN, authzDN ) ) {
rc = LDAP_SUCCESS;
goto DONE;
}
projects / openldap / blobdiff