import fix to ITS#4798

diff --git a/CHANGES b/CHANGES
index bd1a4cd90198568c4c83a3ec7e21d5f2b122a662..a0d73a582d8886074dfad9a0069cb14c21ce2f06 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,7 @@ OpenLDAP 2.3.33 Engineering
        Fixed slapd-ldap chase-referrals switch (ITS#4557)
        Fixed slapd-ldap bind behavior when idassert is always used (ITS#4781)
        Fixed slapd-ldap response handling bugs (ITS#4782)
+       Fixed slapd-ldap idassert mode=self anonymous ops (ITS#4798)
        Fixed slapd-ldap/meta privileged connections handling (ITS#4791)
        Fixed slapd-meta retrying (ITS#4594, 4762)
        Fixed slapo-chain referral DN use (ITS#4776)

diff --git a/servers/slapd/back-ldap/bind.c b/servers/slapd/back-ldap/bind.c
index 2fb5f27488a270ff44b886c8c3200a4c4243cca7..10a562f5abe768d278a1e6c41af0cbb409419f3f 100644 (file)
--- a/servers/slapd/back-ldap/bind.c
+++ b/servers/slapd/back-ldap/bind.c
@@ -2131,6 +2131,7 @@ ldap_back_proxy_authz_ctrl(
        slap_idassert_mode_t    mode;
        struct berval           assertedID,
                                ndn;
+       int                     isroot = 0;
 
        *pctrls = NULL;
 
@@ -2160,7 +2161,7 @@ ldap_back_proxy_authz_ctrl(
                goto done;
        }
 
-       if ( !op->o_conn || op->o_do_not_cache || be_isroot( op ) ) {
+       if ( !op->o_conn || op->o_do_not_cache || ( isroot = be_isroot( op ) ) ) {
                goto done;
        }
 
@@ -2212,7 +2213,7 @@ ldap_back_proxy_authz_ctrl(
                        goto done;
                }
 
-       } else if ( si->si_authz && !be_isroot( op ) ) {
+       } else if ( si->si_authz && !isroot ) {
                int             rc;
                struct berval authcDN;
 
@@ -2263,21 +2264,11 @@ ldap_back_proxy_authz_ctrl(
        }
 
        switch ( mode ) {
-       case LDAP_BACK_IDASSERT_SELF:
-               if ( BER_BVISNULL( &ndn ) ) {
-                       goto done;
-               }
-               assertedID = ndn;
-               break;
-
        case LDAP_BACK_IDASSERT_LEGACY:
                /* original behavior:
                 * assert the client's identity */
-               if ( BER_BVISNULL( &ndn ) ) {
-                       assertedID = slap_empty_bv;
-               } else {
-                       assertedID = ndn;
-               }
+       case LDAP_BACK_IDASSERT_SELF:
+               assertedID = ndn;
                break;
 
        case LDAP_BACK_IDASSERT_ANONYMOUS:
@@ -2299,6 +2290,7 @@ ldap_back_proxy_authz_ctrl(
                assert( 0 );
        }
 
+       /* if we got here, "" is allowed to proxyAuthz */
        if ( BER_BVISNULL( &assertedID ) ) {
                assertedID = slap_empty_bv;
        }