X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fsasl.c;h=fcc5e2c953561e57caa9e3d924611e984611a3f2;hb=e1a5177baca44d6ff5dceea3f6f91da329d43b85;hp=7b43c706d435fb7fb5f4957c7211de9d5199d931;hpb=93fbb87545fd670f93a758f1baf1a67f3c4803ea;p=openldap

diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index 7b43c706d4..fcc5e2c953 100644
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -1,7 +1,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2007 The OpenLDAP Foundation.
+ * Copyright 1998-2011 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -35,20 +35,13 @@
 #ifdef HAVE_CYRUS_SASL
 # ifdef HAVE_SASL_SASL_H
 #  include <sasl/sasl.h>
-# else
-#  include <sasl.h>
-# endif
-
-# if SASL_VERSION_MAJOR >= 2
-# ifdef HAVE_SASL_SASL_H
 #  include <sasl/saslplug.h>
 # else
+#  include <sasl.h>
 #  include <saslplug.h>
 # endif
-#  define	SASL_CONST const
-# else
-#  define	SASL_CONST
-# endif
+
+# define	SASL_CONST const
 
 #define SASL_VERSION_FULL	((SASL_VERSION_MAJOR << 16) |\
 	(SASL_VERSION_MINOR << 8) | SASL_VERSION_STEP)
@@ -70,8 +63,29 @@ typedef struct sasl_ctx {
 
 static struct berval ext_bv = BER_BVC( "EXTERNAL" );
 
+char *slap_sasl_auxprops;
+
 #ifdef HAVE_CYRUS_SASL
 
+/* Just use our internal auxprop by default */
+static int
+slap_sasl_getopt(
+	void *context,
+	const char *plugin_name,
+	const char *option,
+	const char **result,
+	unsigned *len)
+{
+	if ( strcmp( option, "auxprop_plugin" )) {
+		return SASL_FAIL;
+	}
+	if ( slap_sasl_auxprops )
+		*result = slap_sasl_auxprops;
+	else
+		*result = "slapd";
+	return SASL_OK;
+}
+
 int
 slap_sasl_log(
 	void *context,
@@ -87,7 +101,6 @@ slap_sasl_log(
 	}
 
 	switch (priority) {
-#if SASL_VERSION_MAJOR >= 2
 	case SASL_LOG_NONE:
 		level = LDAP_DEBUG_NONE;
 		label = "None";
@@ -120,44 +133,36 @@ slap_sasl_log(
 		level = LDAP_DEBUG_TRACE;
 		label = "Password Trace";
 		break;
-#else
-	case SASL_LOG_ERR:
-		level = LDAP_DEBUG_ANY;
-		label = "Error";
-		break;
-	case SASL_LOG_WARNING:
-		level = LDAP_DEBUG_TRACE;
-		label = "Warning";
-		break;
-	case SASL_LOG_INFO:
-		level = LDAP_DEBUG_TRACE;
-		label = "Info";
-		break;
-#endif
 	default:
 		return SASL_BADPARAM;
 	}
 
 	Debug( level, "SASL [conn=%ld] %s: %s\n",
-		conn ? conn->c_connid: -1,
+		conn ? (long) conn->c_connid: -1L,
 		label, message );
 
 
 	return SASL_OK;
 }
 
-
-#if SASL_VERSION_MAJOR >= 2
 static const char *slap_propnames[] = {
-	"*slapConn", "*slapAuthcDN", "*slapAuthzDN", NULL };
+	"*slapConn", "*slapAuthcDNlen", "*slapAuthcDN",
+	"*slapAuthzDNlen", "*slapAuthzDN", NULL };
+
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+int slap_dontUseCopy_ignore;
+BerVarray slap_dontUseCopy_propnames;
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
 
 static Filter generic_filter = { LDAP_FILTER_PRESENT, { 0 }, NULL };
 static struct berval generic_filterstr = BER_BVC("(objectclass=*)");
 
 #define	SLAP_SASL_PROP_CONN	0
-#define	SLAP_SASL_PROP_AUTHC	1
-#define	SLAP_SASL_PROP_AUTHZ	2
-#define	SLAP_SASL_PROP_COUNT	3	/* Number of properties we used */
+#define	SLAP_SASL_PROP_AUTHCLEN	1
+#define	SLAP_SASL_PROP_AUTHC	2
+#define	SLAP_SASL_PROP_AUTHZLEN	3
+#define	SLAP_SASL_PROP_AUTHZ	4
+#define	SLAP_SASL_PROP_COUNT	5	/* Number of properties we used */
 
 typedef struct lookup_info {
 	int flags;
@@ -179,7 +184,10 @@ sasl_ap_lookup( Operation *op, SlapReply *rs )
 	int rc, i;
 	lookup_info *sl = (lookup_info *)op->o_callback->sc_private;
 
-	if (rs->sr_type != REP_SEARCH) return 0;
+	/* return the actual error code,
+	 * to allow caller to handle specific errors
+	 */
+	if (rs->sr_type != REP_SEARCH) return rs->sr_err;
 
 	for( i = 0; sl->list[i].name; i++ ) {
 		const char *name = sl->list[i].name;
@@ -237,7 +245,8 @@ sasl_ap_lookup( Operation *op, SlapReply *rs )
 					 * past the scheme name, skip this value.
 					 */
 #ifdef SLAPD_CLEARTEXT
-					if ( !ber_bvstrcasecmp( bv, &sc_cleartext ) ) {
+					if ( !strncasecmp( bv->bv_val, sc_cleartext.bv_val,
+						sc_cleartext.bv_len )) {
 						struct berval cbv;
 						cbv.bv_len = bv->bv_len - sc_cleartext.bv_len;
 						if ( cbv.bv_len > 0 ) {
@@ -257,7 +266,11 @@ sasl_ap_lookup( Operation *op, SlapReply *rs )
 	return LDAP_SUCCESS;
 }
 
+#if SASL_VERSION_FULL >= 0x020118
+static int
+#else
 static void
+#endif
 slap_auxprop_lookup(
 	void *glob_context,
 	sasl_server_params_t *sparams,
@@ -265,10 +278,16 @@ slap_auxprop_lookup(
 	const char *user,
 	unsigned ulen)
 {
-	Operation op = {0};
+	OperationBuffer opbuf = {{ NULL }};
+	Operation *op = (Operation *)&opbuf;
 	int i, doit = 0;
 	Connection *conn = NULL;
 	lookup_info sl;
+	int rc = LDAP_SUCCESS;
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+	int dontUseCopy = 0;
+	BackendDB *dontUseCopy_bd = NULL;
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
 
 	sl.list = sparams->utils->prop_get( sparams->propctx );
 	sl.sparams = sparams;
@@ -282,20 +301,42 @@ slap_auxprop_lookup(
 					AC_MEMCPY( &conn, sl.list[i].values[0], sizeof( conn ) );
 				continue;
 			}
-			if ( (flags & SASL_AUXPROP_AUTHZID) &&
-				!strcmp( sl.list[i].name, slap_propnames[SLAP_SASL_PROP_AUTHZ] ) ) {
+			if ( flags & SASL_AUXPROP_AUTHZID ) {
+				if ( !strcmp( sl.list[i].name, slap_propnames[SLAP_SASL_PROP_AUTHZLEN] )) {
+					if ( sl.list[i].values && sl.list[i].values[0] )
+						AC_MEMCPY( &op->o_req_ndn.bv_len, sl.list[i].values[0],
+							sizeof( op->o_req_ndn.bv_len ) );
+				} else if ( !strcmp( sl.list[i].name, slap_propnames[SLAP_SASL_PROP_AUTHZ] )) {
+					if ( sl.list[i].values )
+						op->o_req_ndn.bv_val = (char *)sl.list[i].values[0];
+					break;
+				}
+			}
 
+			if ( !strcmp( sl.list[i].name, slap_propnames[SLAP_SASL_PROP_AUTHCLEN] )) {
 				if ( sl.list[i].values && sl.list[i].values[0] )
-					AC_MEMCPY( &op.o_req_ndn, sl.list[i].values[0], sizeof( struct berval ) );
-				break;
-			}
-			if ( !strcmp( sl.list[i].name, slap_propnames[SLAP_SASL_PROP_AUTHC] ) ) {
-				if ( sl.list[i].values && sl.list[i].values[0] ) {
-					AC_MEMCPY( &op.o_req_ndn, sl.list[i].values[0], sizeof( struct berval ) );
+					AC_MEMCPY( &op->o_req_ndn.bv_len, sl.list[i].values[0],
+						sizeof( op->o_req_ndn.bv_len ) );
+			} else if ( !strcmp( sl.list[i].name, slap_propnames[SLAP_SASL_PROP_AUTHC] ) ) {
+				if ( sl.list[i].values ) {
+					op->o_req_ndn.bv_val = (char *)sl.list[i].values[0];
 					if ( !(flags & SASL_AUXPROP_AUTHZID) )
 						break;
 				}
 			}
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+			if ( slap_dontUseCopy_propnames != NULL ) {
+				int j;
+				struct berval bv;
+				ber_str2bv( &sl.list[i].name[1], 0, 1, &bv );
+				for ( j = 0; !BER_BVISNULL( &slap_dontUseCopy_propnames[ j ]); j++ ) {
+					if ( bvmatch( &bv, &slap_dontUseCopy_propnames[ j ] ) ) {
+						dontUseCopy = 1;
+						break;
+					}
+				}
+			}
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
 		}
 	}
 
@@ -326,30 +367,30 @@ slap_auxprop_lookup(
 
 		cb.sc_private = &sl;
 
-		op.o_bd = select_backend( &op.o_req_ndn, 0, 1 );
+		op->o_bd = select_backend( &op->o_req_ndn, 1 );
 
-		if ( op.o_bd ) {
+		if ( op->o_bd ) {
 			/* For rootdn, see if we can use the rootpw */
-			if ( be_isroot_dn( op.o_bd, &op.o_req_ndn ) &&
-				!BER_BVISEMPTY( &op.o_bd->be_rootpw )) {
+			if ( be_isroot_dn( op->o_bd, &op->o_req_ndn ) &&
+				!BER_BVISEMPTY( &op->o_bd->be_rootpw )) {
 				struct berval cbv = BER_BVNULL;
 
 				/* If there's a recognized scheme, see if it's CLEARTEXT */
-				if ( lutil_passwd_scheme( op.o_bd->be_rootpw.bv_val )) {
-					if ( !strncasecmp( op.o_bd->be_rootpw.bv_val,
+				if ( lutil_passwd_scheme( op->o_bd->be_rootpw.bv_val )) {
+					if ( !strncasecmp( op->o_bd->be_rootpw.bv_val,
 						sc_cleartext.bv_val, sc_cleartext.bv_len )) {
 
 						/* If it's CLEARTEXT, skip past scheme spec */
-						cbv.bv_len = op.o_bd->be_rootpw.bv_len -
+						cbv.bv_len = op->o_bd->be_rootpw.bv_len -
 							sc_cleartext.bv_len;
 						if ( cbv.bv_len ) {
-							cbv.bv_val = op.o_bd->be_rootpw.bv_val +
+							cbv.bv_val = op->o_bd->be_rootpw.bv_val +
 								sc_cleartext.bv_len;
 						}
 					}
 				/* No scheme, use the whole value */
 				} else {
-					cbv = op.o_bd->be_rootpw;
+					cbv = op->o_bd->be_rootpw;
 				}
 				if ( !BER_BVISEMPTY( &cbv )) {
 					for( i = 0; sl.list[i].name; i++ ) {
@@ -370,30 +411,91 @@ slap_auxprop_lookup(
 				}
 			}
 
-			if ( op.o_bd->be_search ) {
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+			if ( SLAP_SHADOW( op->o_bd ) && dontUseCopy ) {
+				dontUseCopy_bd = op->o_bd;
+				op->o_bd = frontendDB;
+			}
+
+retry_dontUseCopy:;
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
+
+			if ( op->o_bd->be_search ) {
 				SlapReply rs = {REP_RESULT};
-				op.o_hdr = conn->c_sasl_bindop->o_hdr;
-				op.o_tag = LDAP_REQ_SEARCH;
-				op.o_dn = conn->c_ndn;
-				op.o_ndn = conn->c_ndn;
-				op.o_callback = &cb;
-				slap_op_time( &op.o_time, &op.o_tincr );
-				op.o_do_not_cache = 1;
-				op.o_is_auth_check = 1;
-				op.o_req_dn = op.o_req_ndn;
-				op.ors_scope = LDAP_SCOPE_BASE;
-				op.ors_deref = LDAP_DEREF_NEVER;
-				op.ors_tlimit = SLAP_NO_LIMIT;
-				op.ors_slimit = 1;
-				op.ors_filter = &generic_filter;
-				op.ors_filterstr = generic_filterstr;
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+				LDAPControl **save_ctrls = NULL, c;
+				int save_dontUseCopy;
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
+
+				op->o_hdr = conn->c_sasl_bindop->o_hdr;
+				op->o_controls = opbuf.ob_controls;
+				op->o_tag = LDAP_REQ_SEARCH;
+				op->o_dn = conn->c_ndn;
+				op->o_ndn = conn->c_ndn;
+				op->o_callback = &cb;
+				slap_op_time( &op->o_time, &op->o_tincr );
+				op->o_do_not_cache = 1;
+				op->o_is_auth_check = 1;
+				op->o_req_dn = op->o_req_ndn;
+				op->ors_scope = LDAP_SCOPE_BASE;
+				op->ors_deref = LDAP_DEREF_NEVER;
+				op->ors_tlimit = SLAP_NO_LIMIT;
+				op->ors_slimit = 1;
+				op->ors_filter = &generic_filter;
+				op->ors_filterstr = generic_filterstr;
+				op->o_authz = conn->c_authz;
 				/* FIXME: we want all attributes, right? */
-				op.ors_attrs = NULL;
+				op->ors_attrs = NULL;
+
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+				if ( dontUseCopy ) {
+					save_dontUseCopy = op->o_dontUseCopy;
+					if ( !op->o_dontUseCopy ) {
+						int cnt = 0;
+						save_ctrls = op->o_ctrls;
+						if ( op->o_ctrls ) {
+							for ( ; op->o_ctrls[ cnt ]; cnt++ )
+								;
+						}
+						op->o_ctrls = op->o_tmpcalloc( sizeof(LDAPControl *), cnt + 2, op->o_tmpmemctx );
+						if ( cnt ) {
+							for ( cnt = 0; save_ctrls[ cnt ]; cnt++ ) {
+								op->o_ctrls[ cnt ] = save_ctrls[ cnt ];
+							}
+						}
+						c.ldctl_oid = LDAP_CONTROL_DONTUSECOPY;
+						c.ldctl_iscritical = 1;
+						BER_BVZERO( &c.ldctl_value );
+						op->o_ctrls[ cnt ] = &c;
+					}
+					op->o_dontUseCopy = SLAP_CONTROL_CRITICAL;
+				}
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
+
+				rc = op->o_bd->be_search( op, &rs );
 
-				op.o_bd->be_search( &op, &rs );
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+				if ( dontUseCopy ) {
+					if ( save_ctrls != op->o_ctrls ) {
+						op->o_tmpfree( op->o_ctrls, op->o_tmpmemctx );
+						op->o_ctrls = save_ctrls;
+						op->o_dontUseCopy = save_dontUseCopy;
+					}
+
+					if ( rs.sr_err == LDAP_UNAVAILABLE && slap_dontUseCopy_ignore )
+					{
+						op->o_bd = dontUseCopy_bd;
+						dontUseCopy = 0;
+						goto retry_dontUseCopy;
+					}
+				}
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
 			}
 		}
 	}
+#if SASL_VERSION_FULL >= 0x020118
+	return rc != LDAP_SUCCESS ? SASL_FAIL : SASL_OK;
+#endif
 }
 
 #if SASL_VERSION_FULL >= 0x020110
@@ -406,8 +508,9 @@ slap_auxprop_store(
 	unsigned ulen)
 {
 	Operation op = {0};
-	SlapReply rs = {REP_RESULT};
-	int rc, i, j;
+	Opheader oph;
+	int rc, i;
+	unsigned j;
 	Connection *conn = NULL;
 	const struct propval *pr;
 	Modifications *modlist = NULL, **modtail = &modlist, *mod;
@@ -415,6 +518,10 @@ slap_auxprop_store(
 	char textbuf[SLAP_TEXT_BUFLEN];
 	const char *text;
 	size_t textlen = sizeof(textbuf);
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+	int dontUseCopy = 0;
+	BackendDB *dontUseCopy_bd = NULL;
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
 
 	/* just checking if we are enabled */
 	if (!prctx) return SASL_OK;
@@ -431,19 +538,42 @@ slap_auxprop_store(
 					AC_MEMCPY( &conn, pr[i].values[0], sizeof( conn ) );
 				continue;
 			}
-			if ( !strcmp( pr[i].name, slap_propnames[SLAP_SASL_PROP_AUTHC] ) ) {
-				if ( pr[i].values && pr[i].values[0] ) {
-					AC_MEMCPY( &op.o_req_ndn, pr[i].values[0], sizeof( struct berval ) );
+			if ( !strcmp( pr[i].name, slap_propnames[SLAP_SASL_PROP_AUTHCLEN] )) {
+				if ( pr[i].values && pr[i].values[0] )
+					AC_MEMCPY( &op.o_req_ndn.bv_len, pr[i].values[0],
+						sizeof( op.o_req_ndn.bv_len ) );
+			} else if ( !strcmp( pr[i].name, slap_propnames[SLAP_SASL_PROP_AUTHC] ) ) {
+				if ( pr[i].values )
+					op.o_req_ndn.bv_val = (char *)pr[i].values[0];
+			}
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+			if ( slap_dontUseCopy_propnames != NULL ) {
+				struct berval bv;
+				ber_str2bv( &pr[i].name[1], 0, 1, &bv );
+				for ( j = 0; !BER_BVISNULL( &slap_dontUseCopy_propnames[ j ] ); j++ ) {
+					if ( bvmatch( &bv, &slap_dontUseCopy_propnames[ j ] ) ) {
+						dontUseCopy = 1;
+						break;
+					}
 				}
 			}
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
 		}
 	}
 	if (!conn || !op.o_req_ndn.bv_val) return SASL_BADPARAM;
 
-	op.o_bd = select_backend( &op.o_req_ndn, 0, 1 );
+	op.o_bd = select_backend( &op.o_req_ndn, 1 );
 
 	if ( !op.o_bd || !op.o_bd->be_modify ) return SASL_FAIL;
-		
+
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+	if ( SLAP_SHADOW( op.o_bd ) && dontUseCopy ) {
+		dontUseCopy_bd = op.o_bd;
+		op.o_bd = frontendDB;
+		op.o_dontUseCopy = SLAP_CONTROL_CRITICAL;
+	}
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
+
 	pr = sparams->utils->prop_get( prctx );
 	if (!pr) return SASL_BADPARAM;
 
@@ -455,6 +585,7 @@ slap_auxprop_store(
 		mod->sml_op = LDAP_MOD_REPLACE;
 		mod->sml_flags = 0;
 		ber_str2bv( pr[i].name, 0, 0, &mod->sml_type );
+		mod->sml_numvals = pr[i].nvalues;
 		mod->sml_values = (struct berval *)ch_malloc( (pr[i].nvalues + 1) *
 			sizeof(struct berval));
 		for (j=0; j<pr[i].nvalues; j++) {
@@ -475,7 +606,13 @@ slap_auxprop_store(
 			&text, textbuf, textlen );
 
 		if ( rc == LDAP_SUCCESS ) {
-			op.o_hdr = conn->c_sasl_bindop->o_hdr;
+			if ( conn->c_sasl_bindop ) {
+				op.o_hdr = conn->c_sasl_bindop->o_hdr;
+			} else {
+				op.o_hdr = &oph;
+				memset( &oph, 0, sizeof(oph) );
+				operation_fake_init( conn, &op, ldap_pvt_thread_pool_context(), 0 );
+			}
 			op.o_tag = LDAP_REQ_MODIFY;
 			op.o_ndn = op.o_req_ndn;
 			op.o_callback = &cb;
@@ -485,7 +622,23 @@ slap_auxprop_store(
 			op.o_req_dn = op.o_req_ndn;
 			op.orm_modlist = modlist;
 
-			rc = op.o_bd->be_modify( &op, &rs );
+			for (;;) {
+				SlapReply rs = {REP_RESULT};
+				rc = op.o_bd->be_modify( &op, &rs );
+
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+				if ( dontUseCopy &&
+					rs.sr_err == LDAP_UNAVAILABLE &&
+					slap_dontUseCopy_ignore )
+				{
+					op.o_bd = dontUseCopy_bd;
+					op.o_dontUseCopy = SLAP_CONTROL_NONE;
+					dontUseCopy = 0;
+					continue;
+				}
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
+				break;
+			}
 		}
 	}
 	slap_mods_free( modlist, 1 );
@@ -554,7 +707,7 @@ slap_sasl_canonicalize(
 	*out_len = 0;
 
 	Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: %s=\"%s\"\n",
-		conn ? conn->c_connid : -1,
+		conn ? (long) conn->c_connid : -1L,
 		(flags & SASL_CU_AUTHID) ? "authcid" : "authzid",
 		in ? in : "<empty>");
 
@@ -578,9 +731,9 @@ slap_sasl_canonicalize(
 		prop_request( props, slap_propnames );
 
 	if ( flags & SASL_CU_AUTHID )
-		which = SLAP_SASL_PROP_AUTHC;
+		which = SLAP_SASL_PROP_AUTHCLEN;
 	else
-		which = SLAP_SASL_PROP_AUTHZ;
+		which = SLAP_SASL_PROP_AUTHZLEN;
 
 	/* Need to store the Connection for auxprop_lookup */
 	if ( !auxvals[SLAP_SASL_PROP_CONN].values ) {
@@ -629,13 +782,20 @@ slap_sasl_canonicalize(
 
 	names[0] = slap_propnames[which];
 	names[1] = NULL;
+	prop_set( props, names[0], (char *)&dn.bv_len, sizeof( dn.bv_len ) );
 
-	prop_set( props, names[0], (char *)&dn, sizeof( dn ) );
+	which++;
+	names[0] = slap_propnames[which];
+	prop_set( props, names[0], dn.bv_val, dn.bv_len );
 
 	Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: %s=\"%s\"\n",
-		conn ? conn->c_connid : -1, names[0]+1,
+		conn ? (long) conn->c_connid : -1L, names[0]+1,
 		dn.bv_val ? dn.bv_val : "<EMPTY>" );
 
+	/* Not needed any more, SASL has copied it */
+	if ( conn && conn->c_sasl_bindop )
+		conn->c_sasl_bindop->o_tmpfree( dn.bv_val, conn->c_sasl_bindop->o_tmpmemctx );
+
 done:
 	AC_MEMCPY( out, in, inlen );
 	out[inlen] = '\0';
@@ -672,9 +832,8 @@ slap_sasl_authorize(
 
 	Debug( LDAP_DEBUG_ARGS, "SASL proxy authorize [conn=%ld]: "
 		"authcid=\"%s\" authzid=\"%s\"\n",
-		conn ? conn->c_connid : -1, auth_identity, requested_user );
+		conn ? (long) conn->c_connid : -1L, auth_identity, requested_user );
 	if ( conn->c_sasl_dn.bv_val ) {
-		ch_free( conn->c_sasl_dn.bv_val );
 		BER_BVZERO( &conn->c_sasl_dn );
 	}
 
@@ -687,154 +846,46 @@ slap_sasl_authorize(
 		return SASL_NOAUTHZ;
 	}
 
-	AC_MEMCPY( &authcDN, auxvals[0].values[0], sizeof(authcDN) );
+	AC_MEMCPY( &authcDN.bv_len, auxvals[0].values[0], sizeof(authcDN.bv_len) );
+	authcDN.bv_val = auxvals[1].values ? (char *)auxvals[1].values[0] : NULL;
 	conn->c_sasl_dn = authcDN;
 
 	/* Nothing to do if no authzID was given */
-	if ( !auxvals[1].name || !auxvals[1].values ) {
+	if ( !auxvals[2].name || !auxvals[2].values ) {
 		goto ok;
 	}
 	
-	AC_MEMCPY( &authzDN, auxvals[1].values[0], sizeof(authzDN) );
+	AC_MEMCPY( &authzDN.bv_len, auxvals[2].values[0], sizeof(authzDN.bv_len) );
+	authzDN.bv_val = auxvals[3].values ? (char *)auxvals[3].values[0] : NULL;
 
 	rc = slap_sasl_authorized( conn->c_sasl_bindop, &authcDN, &authzDN );
 	if ( rc != LDAP_SUCCESS ) {
 		Debug( LDAP_DEBUG_TRACE, "SASL Proxy Authorize [conn=%ld]: "
 			"proxy authorization disallowed (%d)\n",
-			(long) (conn ? conn->c_connid : -1), rc, 0 );
+			conn ? (long) conn->c_connid : -1L, rc, 0 );
 
 		sasl_seterror( sconn, 0, "not authorized" );
-		ch_free( authzDN.bv_val );
 		return SASL_NOAUTHZ;
 	}
 
 	/* FIXME: we need yet another dup because slap_sasl_getdn()
 	 * is using the bind operation slab */
-	if ( conn->c_sasl_bindop ) {
-		ber_dupbv( &conn->c_sasl_authz_dn, &authzDN );
-		slap_sl_free( authzDN.bv_val,
-				conn->c_sasl_bindop->o_tmpmemctx );
-
-	} else {
-		conn->c_sasl_authz_dn = authzDN;
-	}
+	ber_dupbv( &conn->c_sasl_authz_dn, &authzDN );
 
 ok:
 	if (conn->c_sasl_bindop) {
 		Statslog( LDAP_DEBUG_STATS,
-			"conn=%lu op=%lu BIND authcid=\"%s\" authzid=\"%s\"\n",
-			conn->c_connid, conn->c_sasl_bindop->o_opid, 
-			auth_identity, requested_user, 0);
+			"%s BIND authcid=\"%s\" authzid=\"%s\"\n",
+			conn->c_sasl_bindop->o_log_prefix, 
+			auth_identity, requested_user, 0, 0 );
 	}
 
 	Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 		" proxy authorization allowed authzDN=\"%s\"\n",
-		(long) (conn ? conn->c_connid : -1), 
+		conn ? (long) conn->c_connid : -1L, 
 		authzDN.bv_val ? authzDN.bv_val : "", 0 );
 	return SASL_OK;
 } 
-#else
-static int
-slap_sasl_authorize(
-	void *context,
-	char *authcid,
-	char *authzid,
-	const char **user,
-	const char **errstr)
-{
-	struct berval authcDN, authzDN = BER_BVNULL;
-	int rc;
-	Connection *conn = context;
-	char *realm;
-	struct berval	bvauthcid, bvauthzid;
-
-	*user = NULL;
-	if ( conn->c_sasl_dn.bv_val ) {
-		ch_free( conn->c_sasl_dn.bv_val );
-		BER_BVZERO( &conn->c_sasl_dn );
-	}
-
-	Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
-		"authcid=\"%s\" authzid=\"%s\"\n",
-		(long) (conn ? conn->c_connid : -1),
-		authcid ? authcid : "<empty>",
-		authzid ? authzid : "<empty>" );
-
-	/* Figure out how much data we have for the dn */
-	rc = sasl_getprop( conn->c_sasl_authctx, SASL_REALM, (void **)&realm );
-	if( rc != SASL_OK && rc != SASL_NOTDONE ) {
-		Debug(LDAP_DEBUG_TRACE,
-			"authorize: getprop(REALM) failed!\n", 0,0,0);
-		*errstr = "Could not extract realm";
-		return SASL_NOAUTHZ;
-	}
-
-	/* Convert the identities to DN's. If no authzid was given, client will
-	   be bound as the DN matching their username */
-	bvauthcid.bv_val = authcid;
-	bvauthcid.bv_len = authcid ? strlen( authcid ) : 0;
-	rc = slap_sasl_getdn( conn, NULL, &bvauthcid, realm,
-		&authcDN, SLAP_GETDN_AUTHCID );
-	if( rc != LDAP_SUCCESS ) {
-		*errstr = ldap_err2string( rc );
-		return SASL_NOAUTHZ;
-	}
-	conn->c_sasl_dn = authcDN;
-	if( ( authzid == NULL ) || !strcmp( authcid, authzid ) ) {
-		Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
-		 "Using authcDN=%s\n", (long) (conn ? conn->c_connid : -1), authcDN.bv_val,0 );
-
-		goto ok;
-	}
-
-	bvauthzid.bv_val = authzid;
-	bvauthzid.bv_len = authzid ? strlen( authzid ) : 0;
-	rc = slap_sasl_getdn( conn, NULL, &bvauthzid, realm,
-		&authzDN, SLAP_GETDN_AUTHZID );
-	if( rc != LDAP_SUCCESS ) {
-		*errstr = ldap_err2string( rc );
-		return SASL_NOAUTHZ;
-	}
-
-	rc = slap_sasl_authorized( conn->c_sasl_bindop, &authcDN, &authzDN );
-	if( rc ) {
-		Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
-			"proxy authorization disallowed (%d)\n",
-			(long) (conn ? conn->c_connid : -1), rc, 0 );
-
-		*errstr = "not authorized";
-		ch_free( authzDN.bv_val );
-		return SASL_NOAUTHZ;
-	}
-
-	/* FIXME: we need yet another dup because slap_sasl_getdn()
-	 * is using the bind operation slab */
-	if ( conn->c_sasl_bindop ) {
-		ber_dupbv( &conn->c_sasl_authz_dn, &authzDN );
-		slap_sl_free( authzDN.bv_val,
-				conn->c_sasl_bindop->o_tmpmemctx );
-
-	} else {
-		conn->c_sasl_authz_dn = authzDN;
-	}
-
-ok:
-	Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
-		" authorization allowed authzDN=\"%s\"\n",
-		(long) (conn ? conn->c_connid : -1),
-		authzDN.bv_val ? authzDN.bv_val : "", 0 );
-
-	if ( conn->c_sasl_bindop ) {
-		Statslog( LDAP_DEBUG_STATS,
-			"conn=%lu op=%lu BIND authcid=\"%s\" authzid=\"%s\"\n",
-			conn->c_connid, conn->c_sasl_bindop->o_opid, 
-			authcid, authzid ? authzid : "", 0);
-	}
-
-	*errstr = NULL;
-	return SASL_OK;
-}
-#endif /* SASL_VERSION_MAJOR >= 2 */
 
 static int
 slap_sasl_err2ldap( int saslerr )
@@ -932,20 +983,13 @@ static int chk_sasl(
 	rtn = LUTIL_PASSWD_ERR;
 
 	ctx = ldap_pvt_thread_pool_context();
-	ldap_pvt_thread_pool_getkey( ctx, slap_sasl_bind, &sconn, NULL );
+	ldap_pvt_thread_pool_getkey( ctx, (void *)slap_sasl_bind, &sconn, NULL );
 
 	if( sconn != NULL ) {
 		int sc;
-# if SASL_VERSION_MAJOR < 2
-		sc = sasl_checkpass( sconn,
-			passwd->bv_val, passwd->bv_len,
-			cred->bv_val, cred->bv_len,
-			text );
-# else
 		sc = sasl_checkpass( sconn,
 			passwd->bv_val, passwd->bv_len,
 			cred->bv_val, cred->bv_len );
-# endif
 		rtn = ( sc != SASL_OK ) ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
 	}
 
@@ -1098,7 +1142,7 @@ slapd_rw_apply( void *private, const char *filter, struct berval *val )
 
 	op->o_tag = LDAP_REQ_SEARCH;
 	op->o_req_dn = op->o_req_ndn = sl->base;
-	op->o_bd = select_backend( &op->o_req_ndn, 0, 1 );
+	op->o_bd = select_backend( &op->o_req_ndn, 1 );
 	if ( !op->o_bd ) {
 		return REWRITE_ERR;
 	}
@@ -1153,7 +1197,7 @@ slapd_rw_apply( void *private, const char *filter, struct berval *val )
 		}
 		rc = REWRITE_ERR;
 	}
-	filter_free_x( op, op->ors_filter );
+	filter_free_x( op, op->ors_filter, 1 );
 	op->o_tmpfree( op->ors_filterstr.bv_val, op->o_tmpmemctx );
 	return rc;
 }
@@ -1186,6 +1230,7 @@ int slap_sasl_init( void )
 	int rc;
 	static sasl_callback_t server_callbacks[] = {
 		{ SASL_CB_LOG, &slap_sasl_log, NULL },
+		{ SASL_CB_GETOPT, &slap_sasl_getopt, NULL },
 		{ SASL_CB_LIST_END, NULL, NULL }
 	};
 #endif
@@ -1216,22 +1261,12 @@ int slap_sasl_init( void )
 	}
 #endif
 
-	/* SASL 2 does its own memory management internally */
-#if SASL_VERSION_MAJOR < 2
-	sasl_set_alloc(
-		ber_memalloc,
-		ber_memcalloc,
-		ber_memrealloc,
-		ber_memfree ); 
-#endif
-
 	sasl_set_mutex(
 		ldap_pvt_sasl_mutex_new,
 		ldap_pvt_sasl_mutex_lock,
 		ldap_pvt_sasl_mutex_unlock,
 		ldap_pvt_sasl_mutex_dispose );
 
-#if SASL_VERSION_MAJOR >= 2
 	generic_filter.f_desc = slap_schema.si_ad_objectClass;
 
 	rc = sasl_auxprop_add_plugin( "slapd", slap_auxprop_init );
@@ -1240,7 +1275,7 @@ int slap_sasl_init( void )
 			0, 0, 0 );
 		return -1;
 	}
-#endif
+
 	/* should provide callbacks for logging */
 	/* server name should be configurable */
 	rc = sasl_server_init( server_callbacks, "slapd" );
@@ -1248,10 +1283,6 @@ int slap_sasl_init( void )
 	if( rc != SASL_OK ) {
 		Debug( LDAP_DEBUG_ANY, "slap_sasl_init: server init failed\n",
 			0, 0, 0 );
-#if SASL_VERSION_MAJOR < 2
-		/* A no-op used to make sure we linked with Cyrus 1.5 */
-		sasl_client_auth( NULL, NULL, NULL, 0, NULL, NULL );
-#endif
 
 		return -1;
 	}
@@ -1277,14 +1308,20 @@ int slap_sasl_destroy( void )
 {
 #ifdef HAVE_CYRUS_SASL
 	sasl_done();
+
+#ifdef SLAP_AUXPROP_DONTUSECOPY
+	if ( slap_dontUseCopy_propnames ) {
+		ber_bvarray_free( slap_dontUseCopy_propnames );
+		slap_dontUseCopy_propnames = NULL;
+	}
+#endif /* SLAP_AUXPROP_DONTUSECOPY */
 #endif
-	free( global_host );
-	global_host = NULL;
+	free( sasl_host );
+	sasl_host = NULL;
 
 	return 0;
 }
 
-#if SASL_VERSION_MAJOR >= 2
 static char *
 slap_sasl_peer2ipport( struct berval *peer )
 {
@@ -1318,7 +1355,6 @@ slap_sasl_peer2ipport( struct berval *peer )
 
 	return ipport;
 }
-#endif
 
 int slap_sasl_open( Connection *conn, int reopen )
 {
@@ -1328,10 +1364,7 @@ int slap_sasl_open( Connection *conn, int reopen )
 
 	sasl_conn_t *ctx = NULL;
 	sasl_callback_t *session_callbacks;
-
-#if SASL_VERSION_MAJOR >= 2
 	char *ipremoteport = NULL, *iplocalport = NULL;
-#endif
 
 	assert( conn->c_sasl_authctx == NULL );
 
@@ -1339,11 +1372,7 @@ int slap_sasl_open( Connection *conn, int reopen )
 		assert( conn->c_sasl_extra == NULL );
 
 		session_callbacks =
-#if SASL_VERSION_MAJOR >= 2
 			SLAP_CALLOC( 5, sizeof(sasl_callback_t));
-#else
-			SLAP_CALLOC( 3, sizeof(sasl_callback_t));
-#endif
 		if( session_callbacks == NULL ) {
 			Debug( LDAP_DEBUG_ANY, 
 				"slap_sasl_open: SLAP_MALLOC failed", 0, 0, 0 );
@@ -1359,11 +1388,9 @@ int slap_sasl_open( Connection *conn, int reopen )
 		session_callbacks[cb].proc = &slap_sasl_authorize;
 		session_callbacks[cb++].context = conn;
 
-#if SASL_VERSION_MAJOR >= 2
 		session_callbacks[cb].id = SASL_CB_CANON_USER;
 		session_callbacks[cb].proc = &slap_sasl_canonicalize;
 		session_callbacks[cb++].context = conn;
-#endif
 
 		session_callbacks[cb].id = SASL_CB_LIST_END;
 		session_callbacks[cb].proc = NULL;
@@ -1375,7 +1402,6 @@ int slap_sasl_open( Connection *conn, int reopen )
 	conn->c_sasl_layers = 0;
 
 	/* create new SASL context */
-#if SASL_VERSION_MAJOR >= 2
 	if ( conn->c_sock_name.bv_len != 0 &&
 		strncmp( conn->c_sock_name.bv_val, "IP=", STRLENOF( "IP=" ) ) == 0 )
 	{
@@ -1388,7 +1414,7 @@ int slap_sasl_open( Connection *conn, int reopen )
 		ipremoteport = slap_sasl_peer2ipport( &conn->c_peer_name );
 	}
 
-	sc = sasl_server_new( "ldap", global_host, global_realm,
+	sc = sasl_server_new( "ldap", sasl_host, global_realm,
 		iplocalport, ipremoteport, session_callbacks, SASL_SUCCESS_DATA, &ctx );
 	if ( iplocalport != NULL ) {
 		ch_free( iplocalport );
@@ -1396,10 +1422,6 @@ int slap_sasl_open( Connection *conn, int reopen )
 	if ( ipremoteport != NULL ) {
 		ch_free( ipremoteport );
 	}
-#else
-	sc = sasl_server_new( "ldap", global_host, global_realm,
-		session_callbacks, SASL_SECURITY_LAYER, &ctx );
-#endif
 
 	if( sc != SASL_OK ) {
 		Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
@@ -1444,15 +1466,16 @@ int slap_sasl_external(
 	slap_ssf_t ssf,
 	struct berval *auth_id )
 {
-#if SASL_VERSION_MAJOR >= 2
+#ifdef HAVE_CYRUS_SASL
 	int sc;
 	sasl_conn_t *ctx = conn->c_sasl_authctx;
+	sasl_ssf_t sasl_ssf = ssf;
 
 	if ( ctx == NULL ) {
 		return LDAP_UNAVAILABLE;
 	}
 
-	sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL, &ssf );
+	sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL, &sasl_ssf );
 
 	if ( sc != SASL_OK ) {
 		return LDAP_OTHER;
@@ -1464,26 +1487,6 @@ int slap_sasl_external(
 	if ( sc != SASL_OK ) {
 		return LDAP_OTHER;
 	}
-
-#elif defined(HAVE_CYRUS_SASL)
-	int sc;
-	sasl_conn_t *ctx = conn->c_sasl_authctx;
-	sasl_external_properties_t extprops;
-
-	if ( ctx == NULL ) {
-		return LDAP_UNAVAILABLE;
-	}
-
-	memset( &extprops, '\0', sizeof(extprops) );
-	extprops.ssf = ssf;
-	extprops.auth_id = auth_id ? auth_id->bv_val : NULL;
-
-	sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
-		(void *) &extprops );
-
-	if ( sc != SASL_OK ) {
-		return LDAP_OTHER;
-	}
 #elif defined(SLAP_BUILTIN_SASL)
 	/* built-in SASL implementation */
 	SASL_CTX *ctx = conn->c_sasl_authctx;
@@ -1531,10 +1534,6 @@ char ** slap_sasl_mechs( Connection *conn )
 		}
 
 		mechs = ldap_str2charray( mechstr, "," );
-
-#if SASL_VERSION_MAJOR < 2
-		ch_free( mechstr );
-#endif
 	}
 #elif defined(SLAP_BUILTIN_SASL)
 	/* builtin SASL implementation */
@@ -1606,28 +1605,19 @@ int slap_sasl_bind( Operation *op, SlapReply *rs )
 		return rs->sr_err;
 	}
 
-#if SASL_VERSION_MAJOR >= 2
 #define	START( ctx, mech, cred, clen, resp, rlen, err ) \
 	sasl_server_start( ctx, mech, cred, clen, resp, rlen )
 #define	STEP( ctx, cred, clen, resp, rlen, err ) \
 	sasl_server_step( ctx, cred, clen, resp, rlen )
-#else
-#define	START( ctx, mech, cred, clen, resp, rlen, err ) \
-	sasl_server_start( ctx, mech, cred, clen, resp, rlen, err )
-#define	STEP( ctx, cred, clen, resp, rlen, err ) \
-	sasl_server_step( ctx, cred, clen, resp, rlen, err )
-#endif
 
 	if ( !op->o_conn->c_sasl_bind_in_progress ) {
 		/* If we already authenticated once, must use a new context */
 		if ( op->o_conn->c_sasl_done ) {
-			slap_ssf_t ssf = 0;
+			sasl_ssf_t ssf = 0;
 			const char *authid = NULL;
-#if SASL_VERSION_MAJOR >= 2
 			sasl_getprop( ctx, SASL_SSF_EXTERNAL, (void *)&ssf );
 			sasl_getprop( ctx, SASL_AUTH_EXTERNAL, (void *)&authid );
 			if ( authid ) authid = ch_strdup( authid );
-#endif
 			if ( ctx != op->o_conn->c_sasl_sockctx ) {
 				sasl_dispose( &ctx );
 			}
@@ -1635,13 +1625,11 @@ int slap_sasl_bind( Operation *op, SlapReply *rs )
 				
 			slap_sasl_open( op->o_conn, 1 );
 			ctx = op->o_conn->c_sasl_authctx;
-#if SASL_VERSION_MAJOR >= 2
 			if ( authid ) {
 				sasl_setprop( ctx, SASL_SSF_EXTERNAL, &ssf );
 				sasl_setprop( ctx, SASL_AUTH_EXTERNAL, authid );
 				ch_free( (char *)authid );
 			}
-#endif
 		}
 		sc = START( ctx,
 			op->o_conn->c_sasl_bind_mech.bv_val,
@@ -1659,7 +1647,7 @@ int slap_sasl_bind( Operation *op, SlapReply *rs )
 	if ( sc == SASL_OK ) {
 		sasl_ssf_t *ssf = NULL;
 
-		op->orb_edn = op->o_conn->c_sasl_dn;
+		ber_dupbv_x( &op->orb_edn, &op->o_conn->c_sasl_dn, op->o_tmpmemctx );
 		BER_BVZERO( &op->o_conn->c_sasl_dn );
 		op->o_conn->c_sasl_done = 1;
 
@@ -1690,7 +1678,7 @@ int slap_sasl_bind( Operation *op, SlapReply *rs )
 		}
 
 		/* Must send response using old security layer */
-		if (response.bv_len) rs->sr_sasldata = &response;
+		rs->sr_sasldata = (response.bv_len ? &response : NULL);
 		send_ldap_sasl( op, rs );
 		
 		/* Now dispose of the old security layer.
@@ -1704,27 +1692,17 @@ int slap_sasl_bind( Operation *op, SlapReply *rs )
 		}
 	} else if ( sc == SASL_CONTINUE ) {
 		rs->sr_err = LDAP_SASL_BIND_IN_PROGRESS,
-#if SASL_VERSION_MAJOR >= 2
 		rs->sr_text = sasl_errdetail( ctx );
-#endif
 		rs->sr_sasldata = &response;
 		send_ldap_sasl( op, rs );
 
 	} else {
-		if ( op->o_conn->c_sasl_dn.bv_len )
-			ch_free( op->o_conn->c_sasl_dn.bv_val );
 		BER_BVZERO( &op->o_conn->c_sasl_dn );
-#if SASL_VERSION_MAJOR >= 2
 		rs->sr_text = sasl_errdetail( ctx );
-#endif
 		rs->sr_err = slap_sasl_err2ldap( sc ),
 		send_ldap_result( op, rs );
 	}
 
-#if SASL_VERSION_MAJOR < 2
-	if( response.bv_len ) ch_free( response.bv_val );
-#endif
-
 	Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rs->sr_err, 0, 0);
 
 #elif defined(SLAP_BUILTIN_SASL)
@@ -1739,7 +1717,7 @@ int slap_sasl_bind( Operation *op, SlapReply *rs )
 		/* EXTERNAL */
 
 		if( op->orb_cred.bv_len ) {
-			rs->sr_text = "proxy authorization not support";
+			rs->sr_text = "proxy authorization not supported";
 			rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 			send_ldap_result( op, rs );
 
@@ -1821,16 +1799,11 @@ slap_sasl_setpass( Operation *op, SlapReply *rs )
 		rs->sr_rspdata = slap_passwd_return( &new );
 	}
 
-#if SASL_VERSION_MAJOR < 2
-	rs->sr_err = sasl_setpass( op->o_conn->c_sasl_authctx,
-		id.bv_val, new.bv_val, new.bv_len, 0, &rs->sr_text );
-#else
 	rs->sr_err = sasl_setpass( op->o_conn->c_sasl_authctx, id.bv_val,
 		new.bv_val, new.bv_len, old.bv_val, old.bv_len, 0 );
 	if( rs->sr_err != SASL_OK ) {
 		rs->sr_text = sasl_errdetail( op->o_conn->c_sasl_authctx );
 	}
-#endif
 	switch(rs->sr_err) {
 		case SASL_OK:
 			rs->sr_err = LDAP_SUCCESS;