Add AUTHZ stats logging

diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index 1129fa6f43793cff77935abd925be92935440582..1b3220c2c39080bd13a8a0a9b2d226d568eaed07 100644 (file)
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -58,6 +58,14 @@ do_bind(
         */
        ldap_pvt_thread_mutex_lock( &conn->c_mutex );
        if ( conn->c_sasl_bind_in_progress ) be = conn->c_authz_backend;
+
+       /* log authorization identity demotion */
+       if ( conn->c_dn.bv_len ) {
+               Statslog( LDAP_DEBUG_STATS,
+                       "conn=%lu op=%lu AUTHZ anonymous mech=implicit ssf=0",
+                       op->o_connid, op->o_opid, 0, 0, 0 );
+       }
+
        connection2anonymous( conn );
        if ( conn->c_sasl_bind_in_progress ) conn->c_authz_backend = be;
        ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
@@ -315,6 +323,12 @@ do_bind(
                                        LBER_SB_OPT_SET_MAX_INCOMING, &max );
                        }
 
+                       /* log authorization identity */
+                       Statslog( LDAP_DEBUG_STATS,
+                               "conn=%lu op=%lu AUTHZ dn=\"%s\" mech=%s ssf=%d\n",
+                               op->o_connid, op->o_opid,
+                               conn->c_dn.bv_val, conn->c_authmech.bv_val, ssf );
+
 #ifdef NEW_LOGGING
                        LDAP_LOG( OPERATION, DETAIL1, 
                                "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n",
@@ -546,6 +560,12 @@ do_bind(
                                        LBER_SB_OPT_SET_MAX_INCOMING, &max );
                        }
 
+                       /* log authorization identity */
+                       Statslog( LDAP_DEBUG_STATS,
+                               "conn=%lu op=%lu AUTHZ dn=\"%s\" mech=simple ssf=0\n",
+                               op->o_connid, op->o_opid,
+                               conn->c_dn.bv_val, conn->c_authmech.bv_val, 0 );
+
 #ifdef NEW_LOGGING
                        LDAP_LOG( OPERATION, DETAIL1, 
                                "do_bind: v%d bind: \"%s\" to \"%s\" \n",

diff --git a/servers/slapd/starttls.c b/servers/slapd/starttls.c
index 5f985d2007ea566671bbe7566d5bcd0407342ac1..46dbf83b91de5510fe2682a295159804f2e30381 100644 (file)
--- a/servers/slapd/starttls.c
+++ b/servers/slapd/starttls.c
@@ -65,6 +65,10 @@ starttls_extop (
        if ( !( global_disallows & SLAP_DISALLOW_TLS_2_ANON ) &&
                ( conn->c_dn.bv_len != 0 ) )
        {
+               Statslog( LDAP_DEBUG_STATS,
+                       "conn=%lu op=%lu AUTHZ anonymous mech=starttls ssf=0",
+                       op->o_connid, op->o_opid, 0, 0, 0 );
+
                /* force to anonymous */
                connection2anonymous( conn );
        }