X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fback-bdb%2Fbind.c;h=ef72666535b75a47de487bdc30968a08d836bee9;hb=0af1940f3fb59fe57b2281ef253fe1341c505c2c;hp=3e8fd537b5a4a201be7674387ac2c93d7751fff2;hpb=e8c58b4e7f21caa6c0b6006e3528cbad9b8aed45;p=openldap

diff --git a/servers/slapd/back-bdb/bind.c b/servers/slapd/back-bdb/bind.c
index 3e8fd537b5..ef72666535 100644
--- a/servers/slapd/back-bdb/bind.c
+++ b/servers/slapd/back-bdb/bind.c
@@ -1,8 +1,17 @@
 /* bind.c - bdb backend bind routine */
 /* $OpenLDAP$ */
-/*
- * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
- * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 2000-2006 The OpenLDAP Foundation.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
  */
 
 #include "portable.h"
@@ -13,7 +22,6 @@
 #include <ac/unistd.h>
 
 #include "back-bdb.h"
-#include "external.h"
 
 int
 bdb_bind( Operation *op, SlapReply *rs )
@@ -21,7 +29,7 @@ bdb_bind( Operation *op, SlapReply *rs )
 	struct bdb_info *bdb = (struct bdb_info *) op->o_bd->be_private;
 	Entry		*e;
 	Attribute	*a;
-	Entry		*matched;
+	EntryInfo	*ei;
 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 	char		krbname[MAX_K_NAME_SZ + 1];
 	AttributeDescription *krbattr = slap_schema.si_ad_krbName;
@@ -34,11 +42,9 @@ bdb_bind( Operation *op, SlapReply *rs )
 	u_int32_t	locker;
 	DB_LOCK		lock;
 
-#ifdef NEW_LOGGING
-	LDAP_LOG ( OPERATION, ARGS, "==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0 );
-#else
-	Debug( LDAP_DEBUG_ARGS, "==> bdb_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0);
-#endif
+	Debug( LDAP_DEBUG_ARGS,
+		"==> " LDAP_XSTRING(bdb_bind) ": dn: %s\n",
+		op->o_req_dn.bv_val, 0, 0);
 
 	/* allow noauth binds */
 	if ( op->oq_bind.rb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op )) {
@@ -59,7 +65,8 @@ bdb_bind( Operation *op, SlapReply *rs )
 
 dn2entry_retry:
 	/* get entry with reader lock */
-	rs->sr_err = bdb_dn2entry_r( op->o_bd, NULL, &op->o_req_ndn, &e, &matched, 0, locker, &lock );
+	rs->sr_err = bdb_dn2entry( op, NULL, &op->o_req_ndn, &ei, 1,
+		locker, &lock );
 
 	switch(rs->sr_err) {
 	case DB_NOTFOUND:
@@ -78,33 +85,16 @@ dn2entry_retry:
 		return rs->sr_err;
 	}
 
-	if ( e == NULL ) {
-		if( matched != NULL ) {
-			rs->sr_ref = is_entry_referral( matched )
-				? get_entry_referrals( op, matched )
-				: NULL;
-			if (rs->sr_ref)
-				rs->sr_matched = ch_strdup( matched->e_name.bv_val );
-
-			bdb_cache_return_entry_r( bdb->bi_dbenv, &bdb->bi_cache, matched, &lock );
-			matched = NULL;
-
-		} else {
-			rs->sr_ref = referral_rewrite( default_referral,
-				NULL, &op->o_req_dn, LDAP_SCOPE_DEFAULT );
+	e = ei->bei_e;
+	if ( rs->sr_err == DB_NOTFOUND ) {
+		if( e != NULL ) {
+			bdb_cache_return_entry_r( bdb->bi_dbenv,
+				&bdb->bi_cache, e, &lock );
+			e = NULL;
 		}
 
-		if ( rs->sr_ref != NULL ) {
-			rs->sr_err = LDAP_REFERRAL;
-			send_ldap_result( op, rs );
-			free( (char *)rs->sr_matched );
-			ber_bvarray_free( rs->sr_ref );
-			rs->sr_ref = NULL;
-			rs->sr_matched = NULL;
-		} else {
-			rs->sr_err = LDAP_INVALID_CREDENTIALS;
-			send_ldap_result( op, rs );
-		}
+		rs->sr_err = LDAP_INVALID_CREDENTIALS;
+		send_ldap_result( op, rs );
 
 		LOCK_ID_FREE(bdb->bi_dbenv, locker);
 
@@ -114,97 +104,53 @@ dn2entry_retry:
 	ber_dupbv( &op->oq_bind.rb_edn, &e->e_name );
 
 	/* check for deleted */
-#ifdef BDB_SUBENTRIES
 	if ( is_entry_subentry( e ) ) {
 		/* entry is an subentry, don't allow bind */
-#ifdef NEW_LOGGING
-		LDAP_LOG ( OPERATION, DETAIL1, 
-			"bdb_bind: entry is subentry\n", 0, 0, 0 );
-#else
 		Debug( LDAP_DEBUG_TRACE, "entry is subentry\n", 0,
 			0, 0 );
-#endif
-
 		rs->sr_err = LDAP_INVALID_CREDENTIALS;
-		send_ldap_result( op );
-
 		goto done;
 	}
-#endif
 
-#ifdef BDB_ALIASES
 	if ( is_entry_alias( e ) ) {
 		/* entry is an alias, don't allow bind */
-#ifdef NEW_LOGGING
-		LDAP_LOG ( OPERATION, DETAIL1, "bdb_bind: entry is alias\n", 0, 0, 0 );
-#else
-		Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0,
-			0, 0 );
-#endif
-
-		send_ldap_error( op, LDAP_ALIAS_PROBLEM, "entry is alias");
-
+		Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0, 0, 0 );
+		rs->sr_err = LDAP_INVALID_CREDENTIALS;
 		goto done;
 	}
-#endif
 
 	if ( is_entry_referral( e ) ) {
-		/* entry is a referral, don't allow bind */
-		rs->sr_ref = get_entry_referrals( op, e );
-
-#ifdef NEW_LOGGING
-		LDAP_LOG ( OPERATION, DETAIL1, 
-			"bdb_bind: entry is referral\n", 0, 0, 0 );
-#else
 		Debug( LDAP_DEBUG_TRACE, "entry is referral\n", 0,
 			0, 0 );
-#endif
-
-		if( rs->sr_ref != NULL ) {
-			rs->sr_err = LDAP_REFERRAL;
-			rs->sr_matched = e->e_name.bv_val;
-			send_ldap_result( op, rs );
-			ber_bvarray_free( rs->sr_ref );
-			rs->sr_ref = NULL;
-			rs->sr_matched = NULL;
-		} else {
-			rs->sr_err = LDAP_INVALID_CREDENTIALS;
-			send_ldap_result( op, rs );
-		}
-
+		rs->sr_err = LDAP_INVALID_CREDENTIALS;
 		goto done;
 	}
 
 	switch ( op->oq_bind.rb_method ) {
 	case LDAP_AUTH_SIMPLE:
-		rs->sr_err = access_allowed( op, e,
-			password, NULL, ACL_AUTH, NULL );
-		if ( ! rs->sr_err ) {
-			rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
-			send_ldap_result( op, rs );
-			goto done;
-		}
-
-		if ( (a = attr_find( e->e_attrs, password )) == NULL ) {
-			rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
-			send_ldap_result( op, rs );
+		a = attr_find( e->e_attrs, password );
+		if ( a == NULL ) {
+			rs->sr_err = LDAP_INVALID_CREDENTIALS;
 			goto done;
 		}
 
-		if ( slap_passwd_check( op->o_conn, a, &op->oq_bind.rb_cred ) != 0 ) {
+		if ( slap_passwd_check( op, e, a, &op->oq_bind.rb_cred,
+					&rs->sr_text ) != 0 )
+		{
+			/* failure; stop front end from sending result */
 			rs->sr_err = LDAP_INVALID_CREDENTIALS;
-			send_ldap_result( op, rs );
 			goto done;
 		}
-
+			
 		rs->sr_err = 0;
 		break;
 
 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 	case LDAP_AUTH_KRBV41:
-		if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad ) != LDAP_SUCCESS ) {
+		if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad )
+			!= LDAP_SUCCESS )
+		{
 			rs->sr_err = LDAP_INVALID_CREDENTIALS,
-			send_ldap_result( op );
 			goto done;
 		}
 
@@ -212,12 +158,11 @@ dn2entry_retry:
 			krbattr, NULL, ACL_AUTH, NULL );
 		if ( ! rs->sr_err ) {
 			rs->sr_err = LDAP_INSUFFICIENT_ACCESS,
-			send_ldap_result( op );
 			goto done;
 		}
 
-		krbval.bv_len = sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "."
-			: "", ad.pinst, ad.prealm );
+		krbval.bv_len = sprintf( krbname, "%s%s%s@%s", ad.pname,
+			*ad.pinst ? "." : "", ad.pinst, ad.prealm );
 
 		if ( (a = attr_find( e->e_attrs, krbattr )) == NULL ) {
 			/*
@@ -228,7 +173,6 @@ dn2entry_retry:
 				break;
 			}
 			rs->sr_err = LDAP_INAPPROPRIATE_AUTH,
-			send_ldap_result( op );
 			goto done;
 
 		} else {	/* look for krbname match */
@@ -236,23 +180,17 @@ dn2entry_retry:
 
 			if ( value_find( a->a_desc, a->a_vals, &krbval ) != 0 ) {
 				rs->sr_err = LDAP_INVALID_CREDENTIALS;
-				send_ldap_result( op );
 				goto done;
 			}
 		}
 		rs->sr_err = 0;
 		break;
-
-	case LDAP_AUTH_KRBV42:
-		send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
-			"Kerberos bind step 2 not supported" );
-		goto done;
 #endif
 
 	default:
-		send_ldap_error( op, rs, LDAP_STRONG_AUTH_NOT_SUPPORTED,
-			"authentication method not supported" );
-		goto done;
+		assert( 0 ); /* should not be unreachable */
+		rs->sr_err = LDAP_STRONG_AUTH_NOT_SUPPORTED;
+		rs->sr_text = "authentication method not supported";
 	}
 
 done:
@@ -263,6 +201,13 @@ done:
 
 	LOCK_ID_FREE(bdb->bi_dbenv, locker);
 
+	if ( rs->sr_err ) {
+		send_ldap_result( op, rs );
+		if ( rs->sr_ref ) {
+			ber_bvarray_free( rs->sr_ref );
+			rs->sr_ref = NULL;
+		}
+	}
 	/* front end will send result on success (rs->sr_err==0) */
 	return rs->sr_err;
 }