X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fsaslauthz.c;h=9ceef3e6d0b20c6f36349e3e84c2ed69d25d72df;hb=f8fb4aca7668c722f41941be719203aa8c298e12;hp=d5a6389e553823a65f7f268bf4c7f846ff433a6b;hpb=ffcdc6d11d7e86260be64e47229ca75bc7b7ac20;p=openldap diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c index d5a6389e55..9ceef3e6d0 100644 --- a/servers/slapd/saslauthz.c +++ b/servers/slapd/saslauthz.c @@ -12,61 +12,65 @@ #include "portable.h" -#include #include -#include "slap.h" -#include "proto-slap.h" - +#include #include +#include "slap.h" + #ifdef HAVE_CYRUS_SASL #include #include #include #endif +/* URI format: ldap:///[?[][?[][?[]]]] */ - - - -/* URI format: ldap:///[?[][?[][?[]]]] */ - -int slap_parseURI( char *uri, char **searchbase, int *scope, Filter **filter ) +static int slap_parseURI( char *uri, + struct berval *searchbase, int *scope, Filter **filter ) { char *start, *end; + struct berval bv; + int rc; assert( uri != NULL ); - *searchbase = NULL; + searchbase->bv_val = NULL; + searchbase->bv_len = 0; *scope = -1; *filter = NULL; #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_parseURI: parsing %s\n", uri )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_parseURI: parsing %s\n", uri )); #else Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri, 0, 0 ); #endif - /* If it does not look like a URI, assume it is a DN */ - if( !strncasecmp( uri, "dn:", 3 ) ) { - uri += 3; + if( !strncasecmp( uri, "dn:", sizeof("dn:")-1 ) ) { + uri += sizeof("dn:")-1; uri += strspn( uri, " " ); - *searchbase = ch_strdup( uri ); - dn_normalize( *searchbase ); - *scope = LDAP_SCOPE_BASE; - return( LDAP_SUCCESS ); + bv.bv_val = uri; + /* FIXME: if dnNormalize actually uses input bv_len we + * will have to make this right. + */ +is_dn: bv.bv_len = 1; + rc = dnNormalize2( NULL, &bv, searchbase ); + if (rc == LDAP_SUCCESS) { + *scope = LDAP_SCOPE_BASE; + } + return( rc ); } - if( strncasecmp( uri, "ldap://", 7 ) ) { - *searchbase = ch_strdup( uri ); - dn_normalize( *searchbase ); - *scope = LDAP_SCOPE_BASE; - return( LDAP_SUCCESS ); + + /* FIXME: should use ldap_url_parse() */ + if( strncasecmp( uri, "ldap://", sizeof("ldap://")-1 ) ) { + bv.bv_val = uri; + goto is_dn; } - end = strchr( uri + 7, '/' ); + end = strchr( uri + (sizeof("ldap://")-1), '/' ); if ( end == NULL ) return( LDAP_PROTOCOL_ERROR ); @@ -75,15 +79,17 @@ int slap_parseURI( char *uri, char **searchbase, int *scope, Filter **filter ) /* Grab the searchbase */ start = end+1; end = strchr( start, '?' ); + bv.bv_val = start; if( end == NULL ) { - *searchbase = ch_strdup( start ); - dn_normalize( *searchbase ); - return( LDAP_SUCCESS ); + bv.bv_len = 1; + return dnNormalize2( NULL, &bv, searchbase ); } *end = '\0'; - *searchbase = ch_strdup( start ); + bv.bv_len = end - start; + rc = dnNormalize2( NULL, &bv, searchbase ); *end = '?'; - dn_normalize( *searchbase ); + if (rc != LDAP_SUCCESS) + return( rc ); /* Skip the attrs */ start = end+1; @@ -94,21 +100,21 @@ int slap_parseURI( char *uri, char **searchbase, int *scope, Filter **filter ) /* Grab the scope */ start = end+1; - if( !strncasecmp( start, "base?", 5 )) { + if( !strncasecmp( start, "base?", sizeof("base?")-1 )) { *scope = LDAP_SCOPE_BASE; - start += 5; + start += sizeof("base?")-1; } - else if( !strncasecmp( start, "one?", 4 )) { + else if( !strncasecmp( start, "one?", sizeof("one?")-1 )) { *scope = LDAP_SCOPE_ONELEVEL; - start += 4; + start += sizeof("one?")-1; } - else if( !strncasecmp( start, "sub?", 3 )) { + else if( !strncasecmp( start, "sub?", sizeof("sub?")-1 )) { *scope = LDAP_SCOPE_SUBTREE; - start += 4; + start += sizeof("sub?")-1; } else { - ch_free( *searchbase ); - *searchbase = NULL; + free( searchbase->bv_val ); + searchbase->bv_val = NULL; return( LDAP_PROTOCOL_ERROR ); } @@ -119,9 +125,6 @@ int slap_parseURI( char *uri, char **searchbase, int *scope, Filter **filter ) } - - - int slap_sasl_regexp_config( const char *match, const char *replace ) { #ifdef HAVE_CYRUS_SASL @@ -141,9 +144,9 @@ int slap_sasl_regexp_config( const char *match, const char *replace ) rc = regcomp( ®->workspace, reg->match, REG_EXTENDED|REG_ICASE ); if ( rc ) { #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ERR, - "slap_sasl_regexp_config: \"%s\" could not be compiled.\n" - reg->match )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ERR, + "slap_sasl_regexp_config: \"%s\" could not be compiled.\n", + reg->match )); #else Debug( LDAP_DEBUG_ANY, "SASL match pattern %s could not be compiled by regexp engine\n", @@ -156,7 +159,7 @@ int slap_sasl_regexp_config( const char *match, const char *replace ) /* Precompile replace pattern. Find the $ placeholders */ reg->offset[0] = -2; n = 1; - for ( c = reg->replace; *c; c++ ) { + for ( c = reg->replace; *c; c++ ) { if ( *c == '\\' ) { c++; continue; @@ -164,9 +167,9 @@ int slap_sasl_regexp_config( const char *match, const char *replace ) if ( *c == '$' ) { if ( n == SASLREGEX_REPLACE ) { #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ERR, - "slap_sasl_regexp_config: \"%s\" has too many $n placeholders (max %d)\n", - reg->replace, SASLREGEX_REPLACE )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ERR, + "slap_sasl_regexp_config: \"%s\" has too many $n placeholders (max %d)\n", + reg->replace, SASLREGEX_REPLACE )); #else Debug( LDAP_DEBUG_ANY, "SASL replace pattern %s has too many $n placeholders (max %d)\n", @@ -191,13 +194,8 @@ int slap_sasl_regexp_config( const char *match, const char *replace ) } - - - #ifdef HAVE_CYRUS_SASL - - /* Take the passed in SASL name and attempt to convert it into an LDAP URI to find the matching LDAP entry, using the pattern matching strings given in the saslregexp config file directive(s) */ @@ -208,10 +206,9 @@ char *slap_sasl_regexp( char *saslname ) int i, n, len, insert; SaslRegexp_t *reg; - #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_sasl_regexp: converting SASL name %s\n", saslname )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_sasl_regexp: converting SASL name %s\n", saslname )); #else Debug( LDAP_DEBUG_TRACE, "slap_sasl_regexp: converting SASL name %s\n", saslname, 0, 0 ); @@ -248,7 +245,7 @@ char *slap_sasl_regexp( char *saslname ) break; /* Len of string from saslname that matched next $i (b,d above) */ - i = reg->replace[ reg->offset[n] + 1 ] - '0'; + i = reg->replace[ reg->offset[n] + 1 ] - '0'; len += reg->strings[i].rm_eo - reg->strings[i].rm_so; n++; } @@ -266,7 +263,7 @@ char *slap_sasl_regexp( char *saslname ) break; /* Paste in string from saslname that matched next $i (b,d above) */ - i = reg->replace[ reg->offset[n] + 1 ] - '0'; + i = reg->replace[ reg->offset[n] + 1 ] - '0'; len = reg->strings[i].rm_eo - reg->strings[i].rm_so; strncpy( uri+insert, saslname + reg->strings[i].rm_so, len ); insert += len; @@ -276,8 +273,8 @@ char *slap_sasl_regexp( char *saslname ) uri[insert] = '\0'; #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_sasl_regexp: converted SASL name to %s\n", uri )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_sasl_regexp: converted SASL name to %s\n", uri )); #else Debug( LDAP_DEBUG_TRACE, "slap_sasl_regexp: converted SASL name to %s\n", uri, 0, 0 ); @@ -287,11 +284,8 @@ char *slap_sasl_regexp( char *saslname ) } - - - /* - * Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTHZID") + * Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTH") * return the LDAP DN to which it matches. The SASL regexp rules in the config * file turn the SASL name into an LDAP URI. If the URI is just a DN (or a * search with scope=base), just return the URI (or its searchbase). Otherwise @@ -301,7 +295,10 @@ char *slap_sasl_regexp( char *saslname ) char *slap_sasl2dn( char *saslname ) { - char *uri=NULL, *searchbase=NULL, *DN=NULL; + char *uri=NULL; + struct berval searchbase = {0, NULL}; + struct berval dn = {0, NULL}; + struct berval ndn; int rc, scope; Backend *be; Filter *filter=NULL; @@ -309,54 +306,55 @@ char *slap_sasl2dn( char *saslname ) LDAP *client=NULL; LDAPMessage *res=NULL, *msg; - #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_sasl2dn: converting SASL name %s to DN.\n", saslname )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_sasl2dn: converting SASL name %s to DN.\n", saslname )); #else Debug( LDAP_DEBUG_TRACE, - "==>slap_sasl2dn: Converting SASL name %s to a DN\n", saslname, 0,0 ); + "==>slap_sasl2dn: Converting SASL name %s to a DN\n", saslname, 0,0 ); #endif - /* Convert the SASL name into an LDAP URI */ uri = slap_sasl_regexp( saslname ); if( uri == NULL ) goto FINISHED; rc = slap_parseURI( uri, &searchbase, &scope, &filter ); - if( rc ) + if( rc ) { goto FINISHED; + } /* Massive shortcut: search scope == base */ if( scope == LDAP_SCOPE_BASE ) { - DN = ch_strdup( searchbase ); + dn = searchbase; + searchbase.bv_len = 0; + searchbase.bv_val = NULL; goto FINISHED; } /* Must do an internal search */ #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1, - "slap_sasl2dn: performing internal search (base=%s, scope=%s)\n", - searchbase, scope )); + LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1, + "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n", + searchbase.bv_val, scope )); #else Debug( LDAP_DEBUG_TRACE, "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n", - searchbase, scope, 0 ); + searchbase.bv_val, scope, 0 ); #endif - be = select_backend( searchbase, 0 ); + be = select_backend( &searchbase, 0, 1 ); if(( be == NULL ) || ( be->be_search == NULL)) goto FINISHED; - searchbase = suffix_alias( be, searchbase ); + suffix_alias( be, &searchbase ); rc = connection_internal_open( &conn, &client, saslname ); if( rc != LDAP_SUCCESS ) goto FINISHED; - (*be->be_search)( be, conn, conn->c_ops, /*base=*/NULL, searchbase, + (*be->be_search)( be, conn, LDAP_STAILQ_FIRST(&conn->c_ops), /*base*/NULL, &searchbase, scope, /*deref=*/1, /*sizelimit=*/1, /*time=*/0, filter, /*fstr=*/NULL, /*attrs=*/NULL, /*attrsonly=*/0 ); @@ -369,8 +367,8 @@ char *slap_sasl2dn( char *saslname ) /* Make sure exactly one entry was returned */ rc = ldap_count_entries( client, res ); #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1, - "slap_sasl2dn: search DN returned %d entries\n", rc )); + LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1, + "slap_sasl2dn: search DN returned %d entries\n", rc )); #else Debug( LDAP_DEBUG_TRACE, "slap_sasl2dn: search DN returned %d entries\n", rc,0,0 ); @@ -380,31 +378,40 @@ char *slap_sasl2dn( char *saslname ) goto FINISHED; msg = ldap_first_entry( client, res ); - DN = ldap_get_dn( client, msg ); + dn.bv_val = ldap_get_dn( client, msg ); + dn.bv_len = dn.bv_val ? strlen( dn.bv_val ) : 0; + if( dn.bv_val ) { + rc = dnNormalize2( NULL, &dn, &ndn ); + ldap_memfree( dn.bv_val ); + if( rc != LDAP_SUCCESS ) { + dn.bv_val = NULL; + dn.bv_len = 0; + goto FINISHED; + } + dn = ndn; + } FINISHED: - if( searchbase ) ch_free( searchbase ); + if( searchbase.bv_len ) ch_free( searchbase.bv_val ); if( filter ) filter_free( filter ); if( uri ) ch_free( uri ); if( conn ) connection_internal_close( conn ); if( res ) ldap_msgfree( res ); if( client ) ldap_unbind( client ); - if( DN ) dn_normalize( DN ); + #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_sasl2dn: Converted SASL name to %s\n", DN ? DN : "" )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_sasl2dn: Converted SASL name to %s\n", + dn.bv_len ? dn.bv_val : "" )); #else Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n", - DN ? DN : "", 0, 0 ); + dn.bv_len ? dn.bv_val : "", 0, 0 ); #endif - return( DN ); + return( dn.bv_val ); } - - - /* * Map a SASL regexp rule to a DN. If the rule is just a DN or a scope=base * URI, just strcmp the rule (or its searchbase) to the *assertDN. Otherwise, @@ -417,7 +424,7 @@ FINISHED: static int slap_sasl_match( char *rule, char *assertDN, char *authc ) { - char *searchbase=NULL, *dn=NULL; + struct berval searchbase = {0, NULL}; int rc, scope; Backend *be; Filter *filter=NULL; @@ -426,24 +433,22 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc ) LDAPMessage *res=NULL, *msg; regex_t reg; - #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule ); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule )); #else Debug( LDAP_DEBUG_TRACE, "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN, rule, 0 ); #endif - rc = slap_parseURI( rule, &searchbase, &scope, &filter ); if( rc != LDAP_SUCCESS ) goto CONCLUDED; /* Massive shortcut: search scope == base */ if( scope == LDAP_SCOPE_BASE ) { - dn_normalize( searchbase ); - rc = regcomp(®, searchbase, REG_EXTENDED|REG_ICASE|REG_NOSUB); + rc = regcomp(®, searchbase.bv_val, + REG_EXTENDED|REG_ICASE|REG_NOSUB); if ( rc == 0 ) { rc = regexec(®, assertDN, 0, NULL, 0); regfree( ® ); @@ -458,33 +463,31 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc ) /* Must run an internal search. */ #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1, - "slap_sasl_match: performing internal search (base=%s, scope=%d)\n", - searchbase, scope )); + LDAP_LOG(( "sasl", LDAP_LEVEL_DETAIL1, + "slap_sasl_match: performing internal search (base=%s, scope=%d)\n", + searchbase.bv_val, scope )); #else Debug( LDAP_DEBUG_TRACE, "slap_sasl_match: performing internal search (base=%s, scope=%d)\n", - searchbase, scope, 0 ); + searchbase.bv_val, scope, 0 ); #endif - - be = select_backend( searchbase, 0 ); + be = select_backend( &searchbase, 0, 1 ); if(( be == NULL ) || ( be->be_search == NULL)) { rc = LDAP_INAPPROPRIATE_AUTH; goto CONCLUDED; } - searchbase = suffix_alias( be, searchbase ); + suffix_alias( be, &searchbase ); /* Make an internal connection on which to run the search */ rc = connection_internal_open( &conn, &client, authc ); if( rc != LDAP_SUCCESS ) goto CONCLUDED; - (*be->be_search)( be, conn, conn->c_ops, /*base=*/NULL, searchbase, + (*be->be_search)( be, conn, LDAP_STAILQ_FIRST(&conn->c_ops), /*base=*/NULL, &searchbase, scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL, /*attrs=*/NULL, /*attrsonly=*/0 ); - /* On the client side of the internal search, read the results. Check if the assertDN matches any of the DN's returned by the search */ rc = ldap_result( client, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res ); @@ -493,27 +496,38 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc ) for( msg=ldap_first_entry( client, res ); msg; - msg=ldap_next_entry( client, msg ) ) { - dn = ldap_get_dn( client, msg ); - dn_normalize( dn ); - rc = strcmp( dn, assertDN ); - ch_free( dn ); - if( rc == 0 ) { - rc = LDAP_SUCCESS; - goto CONCLUDED; + msg=ldap_next_entry( client, msg ) ) + { + struct berval dn; + dn.bv_val = ldap_get_dn( client, msg ); + + if( dn.bv_val ) { + struct berval ndn; + dn.bv_len = strlen( dn.bv_val ); + rc = dnNormalize2( NULL, &dn, &ndn ); + ldap_memfree( dn.bv_val ); + if( rc != LDAP_SUCCESS ) { + goto CONCLUDED; + } + rc = strcmp( ndn.bv_val, assertDN ); + free( ndn.bv_val ); + if( rc == 0 ) { + rc = LDAP_SUCCESS; + goto CONCLUDED; + } } } rc = LDAP_INAPPROPRIATE_AUTH; CONCLUDED: - if( searchbase ) ch_free( searchbase ); + if( searchbase.bv_len ) ch_free( searchbase.bv_val ); if( filter ) filter_free( filter ); if( conn ) connection_internal_close( conn ); if( res ) ldap_msgfree( res ); if( client ) ldap_unbind( client ); #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_sasl_match: comparison returned %d\n", rc )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_sasl_match: comparison returned %d\n", rc )); #else Debug( LDAP_DEBUG_TRACE, "<===slap_sasl_match: comparison returned %d\n", rc, 0, 0); @@ -523,9 +537,6 @@ CONCLUDED: } - - - /* * This function answers the question, "Can this ID authorize to that ID?", * based on authorization rules. The rules are stored in the *searchDN, in the @@ -534,20 +545,19 @@ CONCLUDED: * * DN's passed in should have a dn: prefix */ - static int slap_sasl_check_authz(char *searchDN, char *assertDN, char *attr, char *authc) { const char *errmsg; int i, rc; - struct berval **vals=NULL; + BVarray vals=NULL; AttributeDescription *ad=NULL; - + struct berval bv; #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_sasl_check_authz: does %s match %s rule in %s?\n", - assertDN, attr, searchDN )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_sasl_check_authz: does %s match %s rule in %s?\n", + assertDN, attr, searchDN )); #else Debug( LDAP_DEBUG_TRACE, "==>slap_sasl_check_authz: does %s match %s rule in %s?\n", @@ -558,25 +568,26 @@ slap_sasl_check_authz(char *searchDN, char *assertDN, char *attr, char *authc) if( rc != LDAP_SUCCESS ) goto COMPLETE; - rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN+3, ad, &vals ); + bv.bv_val = searchDN+3; + bv.bv_len = strlen(bv.bv_val); + rc = backend_attribute( NULL, NULL, NULL, NULL, &bv, ad, &vals ); if( rc != LDAP_SUCCESS ) goto COMPLETE; /* Check if the *assertDN matches any **vals */ - for( i=0; vals[i] != NULL; i++ ) { - rc = slap_sasl_match( vals[i]->bv_val, assertDN+3, authc ); + for( i=0; vals[i].bv_val != NULL; i++ ) { + rc = slap_sasl_match( vals[i].bv_val, assertDN+3, authc ); if ( rc == LDAP_SUCCESS ) goto COMPLETE; } rc = LDAP_INAPPROPRIATE_AUTH; COMPLETE: - if( vals ) ber_bvecfree( vals ); - if( ad ) ad_free( ad, 1 ); + if( vals ) bvarray_free( vals ); #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_sasl_check_authz: %s check returning %s\n", attr, rc )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_sasl_check_authz: %s check returning %s\n", attr, rc )); #else Debug( LDAP_DEBUG_TRACE, "<==slap_sasl_check_authz: %s check returning %d\n", attr, rc, 0); @@ -584,13 +595,7 @@ COMPLETE: return( rc ); } - - - -#endif /* HAVE_CYRUS_SASL */ - - - +#endif /* HAVE_CYRUS_SASL */ /* Check if a bind can SASL authorize to another identity. @@ -598,7 +603,7 @@ COMPLETE: int slap_sasl_authorized( char *authcDN, char *authzDN ) { - int rc; + int rc = LDAP_INAPPROPRIATE_AUTH; #ifdef HAVE_CYRUS_SASL /* User binding as anonymous */ @@ -608,14 +613,13 @@ int slap_sasl_authorized( char *authcDN, char *authzDN ) } #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN )); #else Debug( LDAP_DEBUG_TRACE, "==>slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN, 0 ); #endif - /* If person is authorizing to self, succeed */ if ( !strcmp( authcDN, authzDN ) ) { rc = LDAP_SUCCESS; @@ -625,24 +629,28 @@ int slap_sasl_authorized( char *authcDN, char *authzDN ) /* Check source rules */ rc = slap_sasl_check_authz( authcDN, authzDN, SASL_AUTHZ_SOURCE_ATTR, authcDN ); - if( rc == LDAP_SUCCESS ) + if( rc == LDAP_SUCCESS ) { goto DONE; + } /* Check destination rules */ rc = slap_sasl_check_authz( authzDN, authcDN, SASL_AUTHZ_DEST_ATTR, authcDN ); - if( rc == LDAP_SUCCESS ) + if( rc == LDAP_SUCCESS ) { goto DONE; + } -#endif rc = LDAP_INAPPROPRIATE_AUTH; DONE: +#endif + #ifdef NEW_LOGGING - LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, - "slap_sasl_authorized: return %s\n", rc )); + LDAP_LOG(( "sasl", LDAP_LEVEL_ENTRY, + "slap_sasl_authorized: return %d\n", rc )); #else - Debug( LDAP_DEBUG_TRACE, "<== slap_sasl_authorized: return %d\n",rc,0,0 ); + Debug( LDAP_DEBUG_TRACE, + "<== slap_sasl_authorized: return %d\n", rc, 0, 0 ); #endif return( rc );