X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fsaslauthz.c;h=b3885374fe1f1e8c2de8b31b011153d64b5119cd;hb=8b54d3b7e19d875550377be5fc815c03b327110e;hp=52e5bbadc419016ac206a6db49376eccd506fa6d;hpb=d1b692ceb4167fc583d04ced0cb5ca3bdff1dfa1;p=openldap diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c index 52e5bbadc4..b3885374fe 100644 --- a/servers/slapd/saslauthz.c +++ b/servers/slapd/saslauthz.c @@ -1,7 +1,7 @@ /* $OpenLDAP$ */ /* This work is part of OpenLDAP Software . * - * Copyright 1998-2004 The OpenLDAP Foundation. + * Copyright 1998-2005 The OpenLDAP Foundation. * Portions Copyright 2000 Mark Adamson, Carnegie Mellon. * All rights reserved. * @@ -17,6 +17,9 @@ #include "portable.h" #include +#ifdef HAVE_LIMITS_H +#include +#endif #include #include @@ -24,9 +27,6 @@ #include "slap.h" -#include - -#include #include "lutil.h" #define SASLREGEX_REPLACE 10 @@ -37,6 +37,7 @@ #define LDAP_X_SCOPE_SUBTREE ((ber_int_t) 0x0040) #define LDAP_X_SCOPE_ONELEVEL ((ber_int_t) 0x0050) #define LDAP_X_SCOPE_GROUP ((ber_int_t) 0x0060) +#define LDAP_X_SCOPE_USERS ((ber_int_t) 0x0070) /* * IDs in DNauthzid form can now have a type specifier, that @@ -87,10 +88,14 @@ struct rewrite_info *sasl_rwinfo = NULL; #define SASL_AUTHZ_TO 0x02 #define SASL_AUTHZ_AND 0x10 +static const char *policy_txt[] = { + "none", "from", "to", "any" +}; + static int authz_policy = SASL_AUTHZ_NONE; -static -int slap_sasl_match( Operation *opx, struct berval *rule, +static int +slap_sasl_match( Operation *opx, struct berval *rule, struct berval *assertDN, struct berval *authc ); int slap_sasl_setpolicy( const char *arg ) @@ -113,16 +118,24 @@ int slap_sasl_setpolicy( const char *arg ) return rc; } +const char * slap_sasl_getpolicy() +{ + if ( authz_policy == (SASL_AUTHZ_FROM | SASL_AUTHZ_TO | SASL_AUTHZ_AND) ) + return "all"; + else + return policy_txt[authz_policy]; +} + int slap_parse_user( struct berval *id, struct berval *user, struct berval *realm, struct berval *mech ) { char u; - assert( id ); + assert( id != NULL ); assert( !BER_BVISNULL( id ) ); - assert( user ); - assert( realm ); - assert( mech ); + assert( user != NULL ); + assert( realm != NULL ); + assert( mech != NULL ); u = id->bv_val[ 0 ]; @@ -205,15 +218,11 @@ static int slap_parseURI( Operation *op, struct berval *uri, *scope = -1; *filter = NULL; -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ENTRY, - "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 ); -#endif rc = LDAP_PROTOCOL_ERROR; + /* * dn[.]: * ::= {exact|regex|children|subtree|onelevel} @@ -264,6 +273,11 @@ static int slap_parseURI( Operation *op, struct berval *uri, * and uri was not an URI... HEADS-UP: assuming EXACT */ is_dn: bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val); + /* a single '*' means any DN without using regexes */ + if ( ber_bvccmp( &bv, '*' ) ) { + *scope = LDAP_X_SCOPE_USERS; + } + switch ( *scope ) { case LDAP_X_SCOPE_EXACT: case LDAP_X_SCOPE_CHILDREN: @@ -277,6 +291,8 @@ is_dn: bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val); case LDAP_X_SCOPE_REGEX: ber_dupbv_x( nbase, &bv, op->o_tmpmemctx ); + + case LDAP_X_SCOPE_USERS: rc = LDAP_SUCCESS; break; @@ -365,11 +381,11 @@ is_dn: bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val); } else { group_oc.bv_len = group_dn.bv_val - group_oc.bv_val; - BER_BVSTR( &member_at, "member" ); + BER_BVSTR( &member_at, SLAPD_GROUP_ATTR ); } } else { - BER_BVSTR( &group_oc, "groupOfNames" ); + BER_BVSTR( &group_oc, SLAPD_GROUP_CLASS ); } group_dn.bv_val++; group_dn.bv_len = uri->bv_len - ( group_dn.bv_val - uri->bv_val ); @@ -407,22 +423,41 @@ is_dn: bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val); * must pass str2filter() */ rc = ldap_url_parse( uri->bv_val, &ludp ); - if ( rc == LDAP_URL_ERR_BADSCHEME ) { + switch ( rc ) { + case LDAP_URL_SUCCESS: + /* FIXME: the check is pedantic, but I think it's necessary, + * because people tend to use things like ldaps:// which + * gives the idea SSL is being used. Maybe we could + * accept ldapi:// as well, but the point is that we use + * an URL as an easy means to define bits of a search with + * little parsing. + */ + if ( strcasecmp( ludp->lud_scheme, "ldap" ) != 0 ) { + /* + * must be ldap:/// + */ + rc = LDAP_PROTOCOL_ERROR; + goto done; + } + break; + + case LDAP_URL_ERR_BADSCHEME: /* * last chance: assume it's a(n exact) DN ... * * NOTE: must pass DN normalization */ + ldap_free_urldesc( ludp ); bv.bv_val = uri->bv_val; *scope = LDAP_X_SCOPE_EXACT; goto is_dn; - } - if ( rc != LDAP_URL_SUCCESS ) { - return LDAP_PROTOCOL_ERROR; + default: + rc = LDAP_PROTOCOL_ERROR; + goto done; } - if (( ludp->lud_host && *ludp->lud_host ) + if ( ( ludp->lud_host && *ludp->lud_host ) || ludp->lud_attrs || ludp->lud_exts ) { /* host part must be empty */ @@ -463,6 +498,7 @@ done: return( rc ); } +#ifndef SLAP_AUTH_REWRITE static int slap_sasl_rx_off(char *rep, int *off) { const char *c; @@ -478,16 +514,10 @@ static int slap_sasl_rx_off(char *rep, int *off) } if ( *c == '$' ) { if ( n == SASLREGEX_REPLACE ) { -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ERR, - "slap_sasl_rx_off: \"%s\" has too many $n " - "placeholders (max %d)\n", rep, SASLREGEX_REPLACE, 0 ); -#else Debug( LDAP_DEBUG_ANY, "SASL replace pattern %s has too many $n " "placeholders (max %d)\n", rep, SASLREGEX_REPLACE, 0 ); -#endif return( LDAP_OTHER ); } @@ -502,6 +532,7 @@ static int slap_sasl_rx_off(char *rep, int *off) off[n] = -1; return( LDAP_SUCCESS ); } +#endif /* ! SLAP_AUTH_REWRITE */ #ifdef SLAP_AUTH_REWRITE int slap_sasl_rewrite_config( @@ -546,8 +577,7 @@ int slap_sasl_regexp_rewrite_config( const char *context ) { int rc; - char *newreplace, *p; - char *argvRule[] = { "rewriteRule", NULL, NULL, "@", NULL }; + char *argvRule[] = { "rewriteRule", NULL, NULL, ":@", NULL }; /* init at first call */ if ( sasl_rwinfo == NULL ) { @@ -571,20 +601,9 @@ int slap_sasl_regexp_rewrite_config( } } - newreplace = ch_strdup( replace ); - - for (p = strchr( newreplace, '$' ); p; p = strchr( p + 1, '$' ) ) { - if ( isdigit( p[1] ) ) { - p[0] = '%'; - } else { - p++; - } - } - argvRule[1] = (char *)match; - argvRule[2] = newreplace; + argvRule[2] = (char *)replace; rc = rewrite_parse( sasl_rwinfo, fname, lineno, 4, argvRule ); - ch_free( newreplace ); return rc; } @@ -592,10 +611,6 @@ int slap_sasl_regexp_rewrite_config( int slap_sasl_regexp_config( const char *match, const char *replace ) { -#ifdef SLAP_AUTH_REWRITE - return slap_sasl_regexp_rewrite_config( "sasl-regexp", 0, - match, replace, AUTHID_CONTEXT ); -#else /* ! SLAP_AUTH_REWRITE */ int rc; SaslRegexp_t *reg; @@ -607,18 +622,19 @@ int slap_sasl_regexp_config( const char *match, const char *replace ) reg->sr_match = ch_strdup( match ); reg->sr_replace = ch_strdup( replace ); +#ifdef SLAP_AUTH_REWRITE + rc = slap_sasl_regexp_rewrite_config( "sasl-regexp", 0, + match, replace, AUTHID_CONTEXT ); + if ( rc == LDAP_SUCCESS ) nSaslRegexp++; + return rc; +#else /* ! SLAP_AUTH_REWRITE */ + /* Precompile matching pattern */ rc = regcomp( ®->sr_workspace, reg->sr_match, REG_EXTENDED|REG_ICASE ); if ( rc ) { -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ERR, - "slap_sasl_regexp_config: \"%s\" could not be compiled.\n", - reg->sr_match, 0, 0 ); -#else Debug( LDAP_DEBUG_ANY, "SASL match pattern %s could not be compiled by regexp engine\n", reg->sr_match, 0, 0 ); -#endif return( LDAP_OTHER ); } @@ -631,6 +647,35 @@ int slap_sasl_regexp_config( const char *match, const char *replace ) #endif /* ! SLAP_AUTH_REWRITE */ } +void slap_sasl_regexp_unparse( BerVarray *out ) +{ + int i; + BerVarray bva = NULL; + char ibuf[32], *ptr; + struct berval idx; + + if ( !nSaslRegexp ) return; + + idx.bv_val = ibuf; + bva = ch_malloc( (nSaslRegexp+1) * sizeof(struct berval) ); + BER_BVZERO(bva+nSaslRegexp); + for ( i=0; ibv_val[insert] = '\0'; } +#endif /* ! SLAP_AUTH_REWRITE */ /* Take the passed in SASL name and attempt to convert it into an LDAP URI to find the matching LDAP entry, using the pattern matching @@ -706,19 +752,15 @@ static int slap_authz_regexp( struct berval *in, struct berval *out, if ( !BER_BVISNULL( out ) ) { char *val = out->bv_val; ber_str2bv_x( val, 0, 1, out, ctx ); - free( val ); + if ( val != in->bv_val ) { + free( val ); + } } else { ber_dupbv_x( out, in, ctx ); } -#ifdef NEW_LOGGING - LDAP_LOG( BACK_LDAP, DETAIL1, - "[rw] %s: \"%s\" -> \"%s\"\n", - context, in->bv_val, out->bv_val ); -#else /* !NEW_LOGGING */ Debug( LDAP_DEBUG_ARGS, "[rw] %s: \"%s\" -> \"%s\"\n", context, in->bv_val, out->bv_val ); -#endif /* !NEW_LOGGING */ return 1; case REWRITE_REGEXEC_UNWILLING: @@ -735,13 +777,8 @@ static int slap_authz_regexp( struct berval *in, struct berval *out, memset( out, 0, sizeof( *out ) ); -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ENTRY, - "slap_authz_regexp: converting SASL name %s\n", saslname, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "slap_authz_regexp: converting SASL name %s\n", saslname, 0, 0 ); -#endif if (( saslname == NULL ) || ( nSaslRegexp == 0 )) { return( 0 ); @@ -764,15 +801,9 @@ static int slap_authz_regexp( struct berval *in, struct berval *out, slap_sasl_rx_exp( reg->sr_replace, reg->sr_offset, sr_strings, saslname, out, ctx ); -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ENTRY, - "slap_authz_regexp: converted SASL name to %s\n", - BER_BVISEMPTY( out ) ? "" : out->bv_val, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "slap_authz_regexp: converted SASL name to %s\n", BER_BVISEMPTY( out ) ? "" : out->bv_val, 0, 0 ); -#endif return( 1 ); #endif /* ! SLAP_AUTH_REWRITE */ @@ -790,13 +821,8 @@ static int sasl_sc_sasl2dn( Operation *o, SlapReply *rs ) o->o_tmpfree(ndn->bv_val, o->o_tmpmemctx); BER_BVZERO( ndn ); -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, DETAIL1, - "slap_sc_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "slap_sc_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 ); -#endif return -1; } @@ -863,8 +889,8 @@ slap_sasl_matches( Operation *op, BerVarray rules, * The assertDN should not have the dn: prefix */ -static -int slap_sasl_match( Operation *opx, struct berval *rule, +static int +slap_sasl_match( Operation *opx, struct berval *rule, struct berval *assertDN, struct berval *authc ) { int rc; @@ -873,27 +899,22 @@ int slap_sasl_match( Operation *opx, struct berval *rule, slap_callback cb = { NULL, sasl_sc_smatch, NULL, NULL }; Operation op = {0}; SlapReply rs = {REP_RESULT}; + struct berval base = BER_BVNULL; sm.dn = assertDN; sm.match = 0; cb.sc_private = &sm; -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ENTRY, - "slap_sasl_match: comparing DN %s to rule %s\n", - assertDN->bv_val, rule->bv_val,0 ); -#else Debug( LDAP_DEBUG_TRACE, "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val, 0 ); -#endif - rc = slap_parseURI( opx, rule, &op.o_req_dn, - &op.o_req_ndn, &op.oq_search.rs_scope, &op.oq_search.rs_filter, + rc = slap_parseURI( opx, rule, &base, + &op.o_req_ndn, &op.ors_scope, &op.ors_filter, &op.ors_filterstr ); if( rc != LDAP_SUCCESS ) goto CONCLUDED; - switch ( op.oq_search.rs_scope ) { + switch ( op.ors_scope ) { case LDAP_X_SCOPE_EXACT: exact_match: if ( dn_match( &op.o_req_ndn, assertDN ) ) { @@ -911,7 +932,7 @@ exact_match: rc = LDAP_INAPPROPRIATE_AUTH; - if ( d == 0 && op.oq_search.rs_scope == LDAP_X_SCOPE_SUBTREE ) { + if ( d == 0 && op.ors_scope == LDAP_X_SCOPE_SUBTREE ) { goto exact_match; } else if ( d > 0 ) { @@ -927,7 +948,7 @@ exact_match: bv.bv_val = assertDN->bv_val + d; if ( bv.bv_val[ -1 ] == ',' && dn_match( &op.o_req_ndn, &bv ) ) { - switch ( op.oq_search.rs_scope ) { + switch ( op.ors_scope ) { case LDAP_X_SCOPE_SUBTREE: case LDAP_X_SCOPE_CHILDREN: rc = LDAP_SUCCESS; @@ -1004,25 +1025,27 @@ exact_match: break; } + case LDAP_X_SCOPE_USERS: + if ( !BER_BVISEMPTY( assertDN ) ) { + rc = LDAP_SUCCESS; + } else { + rc = LDAP_INAPPROPRIATE_AUTH; + } + goto CONCLUDED; + default: break; } /* Must run an internal search. */ - if ( op.oq_search.rs_filter == NULL ) { + if ( op.ors_filter == NULL ) { rc = LDAP_FILTER_ERROR; goto CONCLUDED; } -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, DETAIL1, - "slap_sasl_match: performing internal search (base=%s, scope=%d)\n", - op.o_req_ndn.bv_val, op.oq_search.rs_scope, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "slap_sasl_match: performing internal search (base=%s, scope=%d)\n", - op.o_req_ndn.bv_val, op.oq_search.rs_scope, 0 ); -#endif + op.o_req_ndn.bv_val, op.ors_scope, 0 ); op.o_bd = select_backend( &op.o_req_ndn, 0, 1 ); if(( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL)) { @@ -1030,27 +1053,25 @@ exact_match: goto CONCLUDED; } + op.o_hdr = opx->o_hdr; op.o_tag = LDAP_REQ_SEARCH; - op.o_protocol = LDAP_VERSION3; op.o_ndn = *authc; op.o_callback = &cb; op.o_time = slap_get_time(); op.o_do_not_cache = 1; op.o_is_auth_check = 1; - op.o_threadctx = opx->o_threadctx; - op.o_tmpmemctx = opx->o_tmpmemctx; - op.o_tmpmfuncs = opx->o_tmpmfuncs; -#ifdef LDAP_SLAPI - op.o_pb = opx->o_pb; -#endif - op.o_conn = opx->o_conn; - op.o_connid = opx->o_connid; /* use req_ndn as req_dn instead of non-pretty base of uri */ - if( !BER_BVISNULL( &op.o_req_dn ) ) ch_free( op.o_req_dn.bv_val ); + if( !BER_BVISNULL( &base ) ) { + ch_free( base.bv_val ); + /* just in case... */ + BER_BVZERO( &base ); + } ber_dupbv_x( &op.o_req_dn, &op.o_req_ndn, op.o_tmpmemctx ); - op.oq_search.rs_slimit = 1; - op.oq_search.rs_tlimit = SLAP_NO_LIMIT; - op.o_sync_slog_size = -1; + op.ors_deref = LDAP_DEREF_NEVER; + op.ors_slimit = 1; + op.ors_tlimit = SLAP_NO_LIMIT; + op.ors_attrs = slap_anlist_no_attrs; + op.ors_attrsonly = 1; op.o_bd->be_search( &op, &rs ); @@ -1063,16 +1084,11 @@ exact_match: CONCLUDED: if( !BER_BVISNULL( &op.o_req_dn ) ) slap_sl_free( op.o_req_dn.bv_val, opx->o_tmpmemctx ); if( !BER_BVISNULL( &op.o_req_ndn ) ) slap_sl_free( op.o_req_ndn.bv_val, opx->o_tmpmemctx ); - if( op.oq_search.rs_filter ) filter_free_x( opx, op.oq_search.rs_filter ); + if( op.ors_filter ) filter_free_x( opx, op.ors_filter ); if( !BER_BVISNULL( &op.ors_filterstr ) ) ch_free( op.ors_filterstr.bv_val ); -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ENTRY, - "slap_sasl_match: comparison returned %d\n", rc, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "<===slap_sasl_match: comparison returned %d\n", rc, 0, 0); -#endif return( rc ); } @@ -1093,20 +1109,14 @@ slap_sasl_check_authz( Operation *op, AttributeDescription *ad, struct berval *authc ) { - int i, rc; + int rc; BerVarray vals = NULL; -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ENTRY, - "slap_sasl_check_authz: does %s match %s rule in %s?\n", - assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val); -#else Debug( LDAP_DEBUG_TRACE, "==>slap_sasl_check_authz: does %s match %s rule in %s?\n", assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val); -#endif - rc = backend_attribute( op, NULL, searchDN, ad, &vals ); + rc = backend_attribute( op, NULL, searchDN, ad, &vals, ACL_AUTH ); if( rc != LDAP_SUCCESS ) goto COMPLETE; /* Check if the *assertDN matches any *vals */ @@ -1115,15 +1125,9 @@ slap_sasl_check_authz( Operation *op, COMPLETE: if( vals ) ber_bvarray_free_x( vals, op->o_tmpmemctx ); -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, RESULTS, - "slap_sasl_check_authz: %s check returning %s\n", - ad->ad_cname.bv_val, rc, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "<==slap_sasl_check_authz: %s check returning %d\n", ad->ad_cname.bv_val, rc, 0); -#endif return( rc ); } @@ -1136,27 +1140,25 @@ COMPLETE: * an internal search must be done, and if that search returns exactly one * entry, return the DN of that one entry. */ -void slap_sasl2dn( Operation *opx, - struct berval *saslname, struct berval *sasldn, int flags ) +void +slap_sasl2dn( + Operation *opx, + struct berval *saslname, + struct berval *sasldn, + int flags ) { int rc; slap_callback cb = { NULL, sasl_sc_sasl2dn, NULL, NULL }; Operation op = {0}; SlapReply rs = {REP_RESULT}; struct berval regout = BER_BVNULL; + struct berval base = BER_BVNULL; -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ENTRY, - "slap_sasl2dn: converting SASL name %s to DN.\n", - saslname->bv_val, 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "==>slap_sasl2dn: " "converting SASL name %s to a DN\n", saslname->bv_val, 0,0 ); -#endif - sasldn->bv_val = NULL; - sasldn->bv_len = 0; + BER_BVZERO( sasldn ); cb.sc_private = sasldn; /* Convert the SASL name into a minimal URI */ @@ -1164,8 +1166,8 @@ void slap_sasl2dn( Operation *opx, goto FINISHED; } - rc = slap_parseURI( opx, ®out, &op.o_req_dn, - &op.o_req_ndn, &op.oq_search.rs_scope, &op.oq_search.rs_filter, + rc = slap_parseURI( opx, ®out, &base, + &op.o_req_ndn, &op.ors_scope, &op.ors_filter, &op.ors_filterstr ); if ( !BER_BVISNULL( ®out ) ) slap_sl_free( regout.bv_val, opx->o_tmpmemctx ); if ( rc != LDAP_SUCCESS ) { @@ -1175,7 +1177,7 @@ void slap_sasl2dn( Operation *opx, /* Must do an internal search */ op.o_bd = select_backend( &op.o_req_ndn, 0, 1 ); - switch ( op.oq_search.rs_scope ) { + switch ( op.ors_scope ) { case LDAP_X_SCOPE_EXACT: *sasldn = op.o_req_ndn; BER_BVZERO( &op.o_req_ndn ); @@ -1186,6 +1188,7 @@ void slap_sasl2dn( Operation *opx, case LDAP_X_SCOPE_CHILDREN: case LDAP_X_SCOPE_ONELEVEL: case LDAP_X_SCOPE_GROUP: + case LDAP_X_SCOPE_USERS: /* correctly parsed, but illegal */ goto FINISHED; @@ -1203,41 +1206,38 @@ void slap_sasl2dn( Operation *opx, assert( 0 ); } -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, DETAIL1, - "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n", - op.o_req_ndn.bv_val, op.oq_search.rs_scope, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n", - op.o_req_ndn.bv_val, op.oq_search.rs_scope, 0 ); -#endif + op.o_req_ndn.bv_val, op.ors_scope, 0 ); - if(( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL)) { + if ( ( op.o_bd == NULL ) || ( op.o_bd->be_search == NULL) ) { + goto FINISHED; + } + + /* Must run an internal search. */ + if ( op.ors_filter == NULL ) { + rc = LDAP_FILTER_ERROR; goto FINISHED; } - op.o_conn = opx->o_conn; - op.o_connid = opx->o_connid; + op.o_hdr = opx->o_hdr; op.o_tag = LDAP_REQ_SEARCH; - op.o_protocol = LDAP_VERSION3; op.o_ndn = opx->o_conn->c_ndn; op.o_callback = &cb; op.o_time = slap_get_time(); op.o_do_not_cache = 1; op.o_is_auth_check = 1; - op.o_threadctx = opx->o_threadctx; - op.o_tmpmemctx = opx->o_tmpmemctx; - op.o_tmpmfuncs = opx->o_tmpmfuncs; -#ifdef LDAP_SLAPI - op.o_pb = opx->o_pb; -#endif - op.oq_search.rs_deref = LDAP_DEREF_NEVER; - op.oq_search.rs_slimit = 1; - op.oq_search.rs_tlimit = SLAP_NO_LIMIT; - op.oq_search.rs_attrsonly = 1; + op.ors_deref = LDAP_DEREF_NEVER; + op.ors_slimit = 1; + op.ors_tlimit = SLAP_NO_LIMIT; + op.ors_attrs = slap_anlist_no_attrs; + op.ors_attrsonly = 1; /* use req_ndn as req_dn instead of non-pretty base of uri */ - if( !BER_BVISNULL( &op.o_req_dn ) ) ch_free( op.o_req_dn.bv_val ); + if( !BER_BVISNULL( &base ) ) { + ch_free( base.bv_val ); + /* just in case... */ + BER_BVZERO( &base ); + } ber_dupbv_x( &op.o_req_dn, &op.o_req_ndn, op.o_tmpmemctx ); op.o_bd->be_search( &op, &rs ); @@ -1252,21 +1252,15 @@ FINISHED: if( !BER_BVISNULL( &op.o_req_ndn ) ) { slap_sl_free( op.o_req_ndn.bv_val, opx->o_tmpmemctx ); } - if( op.oq_search.rs_filter ) { - filter_free_x( opx, op.oq_search.rs_filter ); + if( op.ors_filter ) { + filter_free_x( opx, op.ors_filter ); } if( !BER_BVISNULL( &op.ors_filterstr ) ) { ch_free( op.ors_filterstr.bv_val ); } -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ENTRY, - "slap_sasl2dn: Converted SASL name to %s\n", - !BER_BVISEMPTY( sasldn ) ? sasldn->bv_val : "", 0, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n", !BER_BVISEMPTY( sasldn ) ? sasldn->bv_val : "", 0, 0 ); -#endif return; } @@ -1287,15 +1281,9 @@ int slap_sasl_authorized( Operation *op, goto DONE; } -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, ENTRY, - "slap_sasl_authorized: can %s become %s?\n", - authcDN->bv_val, authzDN->bv_val, 0 ); -#else Debug( LDAP_DEBUG_TRACE, "==>slap_sasl_authorized: can %s become %s?\n", authcDN->bv_val, authzDN->bv_val, 0 ); -#endif /* If person is authorizing to self, succeed */ if ( dn_match( authcDN, authzDN ) ) { @@ -1333,12 +1321,8 @@ int slap_sasl_authorized( Operation *op, DONE: -#ifdef NEW_LOGGING - LDAP_LOG( TRANSPORT, RESULTS, "slap_sasl_authorized: return %d\n", rc,0,0 ); -#else Debug( LDAP_DEBUG_TRACE, "<== slap_sasl_authorized: return %d\n", rc, 0, 0 ); -#endif return( rc ); }