ITS#6147

diff --git a/CHANGES b/CHANGES
index 665aa68a9c6bd0cf43c3345bc6d463823635b04b..2d84a411601efe3361220123b224cfd001a8b7f5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,7 @@ OpenLDAP 2.4.17 Engineering
        Fixed libldap tls NULL error messages (ITS#6079)
        Fixed liblutil opendir/closedir on windows (ITS#6041)
        Fixed liblutil for _GNU_SOURCE (ITS#5464,ITS#5666)
+       Added slapd sasl auxprop support (ITS#6147)
        Fixed slapd assert with closing connections (ITS#6111)
        Fixed slapd cert validation (ITS#6098)
        Fixed slapd errno handling (ITS#6037)

diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5
index bde39220f33f34600507790b37c546e69cf40b7c..e3e76914aed1b9904d378d44781779a2eca4d959 100644 (file)
--- a/doc/man/man5/slapd-config.5
+++ b/doc/man/man5/slapd-config.5
@@ -665,6 +665,11 @@ ldapsearch -x -b "" -s base "+"
 .br
 See RFC 4512 section 5.1 for details.
 .TP
+.B olcSaslAuxprops: <plugin> [...]
+Specify which auxprop plugins to use for authentication lookups. The
+default is empty, which just uses slapd's internal support. Usually
+no other auxprop plugins are needed.
+.TP
 .B olcSaslHost: <fqdn>
 Used to specify the fully qualified domain name used for SASL processing.
 .TP

diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5
index 4229c7a02238e66996d0a579b34cfff3bd577aab..5753beba2cc920fc09dcc22a2742b1d0354cb6a6 100644 (file)
--- a/doc/man/man5/slapd.conf.5
+++ b/doc/man/man5/slapd.conf.5
@@ -814,6 +814,11 @@ ldapsearch -x -b "" -s base "+"
 .br
 See RFC 4512 section 5.1 for details.
 .TP
+.B sasl-auxprops <plugin> [...]
+Specify which auxprop plugins to use for authentication lookups. The
+default is empty, which just uses slapd's internal support. Usually
+no other auxprop plugins are needed.
+.TP
 .B sasl-host <fqdn>
 Used to specify the fully qualified domain name used for SASL processing.
 .TP

diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index d78ae6176db40e3b05af73c7cfc98bb6022dd030..fae59ceb3bde15d5d341280e4ea65559b791c579 100644 (file)
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -530,6 +530,14 @@ static ConfigTable config_back_cf_table[] = {
                        "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
        { "sasl-authz-policy", NULL, 2, 2, 0, ARG_MAGIC|CFG_AZPOLICY,
                &config_generic, NULL, NULL, NULL },
+       { "sasl-auxprops", NULL, 2, 0, 0,
+#ifdef HAVE_CYRUS_SASL
+               ARG_STRING|ARG_UNIQUE, &slap_sasl_auxprops,
+#else
+               ARG_IGNORED, NULL,
+#endif
+               "( OLcfgGlAt:89 NAME 'olcSaslAuxprops' "
+                       "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
        { "sasl-host", "host", 2, 2, 0,
 #ifdef HAVE_CYRUS_SASL
                ARG_STRING|ARG_UNIQUE, &sasl_host,
@@ -757,7 +765,7 @@ static ConfigOCs cf_ocs[] = {
                 "olcPluginLogFile $ olcReadOnly $ olcReferral $ "
                 "olcReplogFile $ olcRequires $ olcRestrict $ olcReverseLookup $ "
                 "olcRootDSE $ "
-                "olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ "
+                "olcSaslAuxprops $ olcSaslHost $ olcSaslRealm $ olcSaslSecProps $ "
                 "olcSecurity $ olcServerID $ olcSizeLimit $ "
                 "olcSockbufMaxIncoming $ olcSockbufMaxIncomingAuth $ "
                 "olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ "

diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index e52288cc675491cd30923256a97ef897437ffbb0..afa95ac91f56340da0a00dc2198f31ba43aeacaf 100644 (file)
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -1934,6 +1934,7 @@ LDAP_SLAPD_V (int)                global_idletimeout;
 LDAP_SLAPD_V (char *)  global_host;
 LDAP_SLAPD_V (char *)  global_realm;
 LDAP_SLAPD_V (char *)  sasl_host;
+LDAP_SLAPD_V (char *)  slap_sasl_auxprops;
 LDAP_SLAPD_V (char **) default_passwd_hash;
 LDAP_SLAPD_V (int)             lber_debug;
 LDAP_SLAPD_V (int)             ldap_syslog;

diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index 459d38ce610d1ad2b66d8765bd7ad9c61ac4458b..14e3d25b6eaf7885fe0fb439c4f5a9b8f4ebcdbd 100644 (file)
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -63,8 +63,29 @@ typedef struct sasl_ctx {
 
 static struct berval ext_bv = BER_BVC( "EXTERNAL" );
 
+char *slap_sasl_auxprops;
+
 #ifdef HAVE_CYRUS_SASL
 
+/* Just use our internal auxprop by default */
+static int
+slap_sasl_getopt(
+       void *context,
+       const char *plugin_name,
+       const char *option,
+       const char **result,
+       unsigned *len)
+{
+       if ( strcmp( option, "auxprop_plugin" )) {
+               return SASL_FAIL;
+       }
+       if ( slap_sasl_auxprops )
+               *result = slap_sasl_auxprops;
+       else
+               *result = "slapd";
+       return SASL_OK;
+}
+
 int
 slap_sasl_log(
        void *context,
@@ -1078,6 +1099,7 @@ int slap_sasl_init( void )
        int rc;
        static sasl_callback_t server_callbacks[] = {
                { SASL_CB_LOG, &slap_sasl_log, NULL },
+               { SASL_CB_GETOPT, &slap_sasl_getopt, NULL },
                { SASL_CB_LIST_END, NULL, NULL }
        };
 #endif