X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fbind.c;h=1129fa6f43793cff77935abd925be92935440582;hb=69343add5ac17c2300e256c85acf3279298a0fbe;hp=81898e3ea083dd5c6bf159d522581e6e789db920;hpb=a073e28510b40911c23ad78a481bad37fbbe768a;p=openldap

diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index 81898e3ea0..1129fa6f43 100644
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -45,7 +45,7 @@ do_bind(
 	int	rc = LDAP_SUCCESS;
 	const char *text;
 	struct berval cred = { 0, NULL };
-	Backend *be;
+	Backend *be = NULL;
 
 #ifdef NEW_LOGGING
 	LDAP_LOG( OPERATION, ENTRY, "do_bind: conn %d\n", conn->c_connid, 0, 0 );
@@ -231,6 +231,9 @@ do_bind(
 		goto cleanup;
 	}
 
+	/* Set the bindop for the benefit of in-directory SASL lookups */
+	conn->c_sasl_bindop = op;
+
 	if ( method == LDAP_AUTH_SASL ) {
 		slap_ssf_t ssf = 0;
 
@@ -274,7 +277,7 @@ do_bind(
 
 		ldap_pvt_thread_mutex_lock( &conn->c_mutex );
 		if ( conn->c_sasl_bind_in_progress ) {
-			if((ber_bvcmp(&conn->c_sasl_bind_mech, &mech) != 0)) {
+			if( !bvmatch( &conn->c_sasl_bind_mech, &mech ) ) {
 				/* mechanism changed between bind steps */
 				slap_sasl_reset(conn);
 			}
@@ -307,11 +310,21 @@ do_bind(
 			}
 
 			if( conn->c_dn.bv_len != 0 ) {
-				ber_len_t max = sockbuf_max_incoming;
+				ber_len_t max = sockbuf_max_incoming_auth;
 				ber_sockbuf_ctrl( conn->c_sb,
 					LBER_SB_OPT_SET_MAX_INCOMING, &max );
 			}
 
+#ifdef NEW_LOGGING
+			LDAP_LOG( OPERATION, DETAIL1, 
+				"do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n",
+				conn->c_authmech.bv_val, conn->c_dn.bv_val, ssf );
+#else
+			Debug( LDAP_DEBUG_TRACE,
+				"do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n",
+				conn->c_authmech.bv_val, conn->c_dn.bv_val, ssf );
+#endif
+
 		} else if ( rc == LDAP_SASL_BIND_IN_PROGRESS ) {
 			conn->c_sasl_bind_in_progress = 1;
 
@@ -406,7 +419,7 @@ do_bind(
 			goto cleanup;
 
 		} else if (( global_disallows & SLAP_DISALLOW_BIND_SIMPLE_UNPROTECTED )
-			&& ( op->o_ssf < global_ssf_set.sss_ssf ))
+			&& ( op->o_ssf <= 1 ))
 		{
 			rc = LDAP_CONFIDENTIALITY_REQUIRED;
 			text = "unwilling to perform simple authentication "
@@ -528,7 +541,7 @@ do_bind(
 			ndn.bv_len = 0;
 
 			if( conn->c_dn.bv_len != 0 ) {
-				ber_len_t max = sockbuf_max_incoming;
+				ber_len_t max = sockbuf_max_incoming_auth;
 				ber_sockbuf_ctrl( conn->c_sb,
 					LBER_SB_OPT_SET_MAX_INCOMING, &max );
 			}
@@ -560,6 +573,8 @@ do_bind(
 	}
 
 cleanup:
+	conn->c_sasl_bindop = NULL;
+
 	if( pdn.bv_val != NULL ) {
 		free( pdn.bv_val );
 	}