Expose SASL context to SLAPI plugins (SLAPI_X_CONN_SASL_CONTEXT)

Useful for plugins that may wish to collude with the SASL library to,
for example, retrieve a user's authorization data from a Kerberos ticket
for access control purposes

diff --git a/servers/slapd/slapi/slapi.h b/servers/slapd/slapi/slapi.h
index 3b5bd4f6e7ea456bc92fc85a26e0a291c08f50d6..bf1e0953ed08badf69b7c18fd95bac24057412bb 100644 (file)
--- a/servers/slapd/slapi/slapi.h
+++ b/servers/slapd/slapi/slapi.h
@@ -274,6 +274,7 @@ extern Backend * slapi_cl_get_be(char *dn);
 #define SLAPI_X_CONN_SERVERPATH                        1301
 #define SLAPI_X_CONN_IS_UDP                    1302
 #define SLAPI_X_CONN_SSF                       1303
+#define SLAPI_X_CONN_SASL_CONTEXT              1304
 
 #define SLAPD_AUTH_NONE   "none"
 #define SLAPD_AUTH_SIMPLE "simple"

diff --git a/servers/slapd/slapi/slapi_pblock.c b/servers/slapd/slapi/slapi_pblock.c
index dc0897d146d5daa434b761372c8a628f5e77b1ac..a366859f658ebaa95499f2f296d6605f21f72ddb 100644 (file)
--- a/servers/slapd/slapi/slapi_pblock.c
+++ b/servers/slapd/slapi/slapi_pblock.c
@@ -45,6 +45,7 @@ isOkNetscapeParam( int param )
        case SLAPI_X_CONN_CLIENTPATH:
        case SLAPI_X_CONN_SERVERPATH:
        case SLAPI_X_CONN_SSF:
+       case SLAPI_X_CONN_SASL_CONTEXT:
        case SLAPI_IBM_CONN_DN_ALT:
        case SLAPI_IBM_CONN_DN_ORIG:
        case SLAPI_IBM_GSSAPI_CONTEXT:

diff --git a/servers/slapd/slapi/slapi_utils.c b/servers/slapd/slapi/slapi_utils.c
index 8764ceed8275bd88978e49df1f1b2d323acbb435..f53ebd1874db3f46c6b45305ed1c79dcf4bdee71 100644 (file)
--- a/servers/slapd/slapi/slapi_utils.c
+++ b/servers/slapd/slapi/slapi_utils.c
@@ -2265,6 +2265,14 @@ static int initConnectionPB( Slapi_PBlock *pb, Connection *conn )
        }
 
        rc = slapi_pblock_set(pb, SLAPI_X_CONN_SSF, (void *)conn->c_ssf);
+       if ( rc != LDAP_SUCCESS )
+               return rc;
+
+       rc = slapi_pblock_set(pb, SLAPI_X_CONN_SASL_CONTEXT,
+               ( conn->c_sasl_authctx != NULL ? conn->c_sasl_authctx :
+                                                conn->c_sasl_sockctx ) );
+       if ( rc != LDAP_SUCCESS )
+               return rc;
 
        return rc;
 }