Rework bind restrictions

diff --git a/servers/slapd/backend.c b/servers/slapd/backend.c
index 3cc017ca2f981bdfa3767e730199248912c8c30d..8953d8e8de19bdd72e4fd7bb055b641b5b3b3002 100644 (file)
--- a/servers/slapd/backend.c
+++ b/servers/slapd/backend.c
@@ -682,10 +682,8 @@ backend_check_restrictions(
                return LDAP_OTHER;
        }
 
-       if( ( extoid == NULL || strcmp( extoid, LDAP_EXOP_START_TLS ) )
-               && op->o_tag != LDAP_REQ_BIND )
-       {
-               /* these checks don't apply to bind nor StartTLS */
+       if (( extoid == NULL || strcmp( extoid, LDAP_EXOP_START_TLS ) ) ) {
+               /* these checks don't apply to StartTLS */
 
                if( op->o_tag == LDAP_REQ_EXTENDED ) {
                        /* threat other extended operations as update ops */
@@ -727,6 +725,12 @@ backend_check_restrictions(
                                return LDAP_CONFIDENTIALITY_REQUIRED;
                        }
                }
+       }
+
+       if (( extoid == NULL || strcmp( extoid, LDAP_EXOP_START_TLS ) )
+               || op->o_tag == LDAP_REQ_BIND )
+       {
+               /* these checks don't apply to StartTLS or Bind */
 
                if( requires & SLAP_REQUIRE_STRONG ) {
                        /* should check mechanism */
@@ -777,9 +781,7 @@ backend_check_restrictions(
        }
 
        if( restrictops & opflag ) {
-               if( (restrictops & SLAP_RESTRICT_OP_READS)
-                       == SLAP_RESTRICT_OP_READS )
-               {
+               if( restrictops == SLAP_RESTRICT_OP_READS ) {
                        *text = "read operations restricted";
                } else {
                        *text = "operation restricted";

diff --git a/servers/slapd/bind.c b/servers/slapd/bind.c
index d65bd9c22373f12f0b3f3df656df1e8fb6cdebf2..e825eeb850d6352af19e2a05341d2d45e7c6ba0a 100644 (file)
--- a/servers/slapd/bind.c
+++ b/servers/slapd/bind.c
@@ -346,33 +346,6 @@ do_bind(
                goto cleanup;
        }
 
-       if( op->o_ssf < be->be_ssf_set.sss_ssf ) {
-               text = "confidentiality required";
-               rc = LDAP_CONFIDENTIALITY_REQUIRED;
-
-       } else if( op->o_transport_ssf < be->be_ssf_set.sss_transport ) {
-               text = "transport confidentiality required";
-               rc = LDAP_CONFIDENTIALITY_REQUIRED;
-
-       } else if( op->o_tls_ssf < be->be_ssf_set.sss_tls ) {
-               text = "TLS confidentiality required";
-               rc = LDAP_CONFIDENTIALITY_REQUIRED;
-
-       } else if( op->o_sasl_ssf < be->be_ssf_set.sss_sasl ) {
-               text = "SASL confidentiality required";
-               rc = LDAP_CONFIDENTIALITY_REQUIRED;
-
-       } else if( be->be_restrictops & SLAP_RESTRICT_OP_BIND ) {
-               text = "bind operation restricted";
-               rc = LDAP_UNWILLING_TO_PERFORM;
-       }
-
-       if( rc != LDAP_SUCCESS ) {
-               send_ldap_result( conn, op, rc,
-                       NULL, text, NULL, NULL );
-               goto cleanup;
-       }
-
        conn->c_authz_backend = be;
 
        if ( be->be_bind ) {