Added password policy support

diff --git a/clients/tools/common.c b/clients/tools/common.c
index 94840f39c33e9613af386332606f8c8b185eec70..6841db3442b1f3dabb3cfba96f93ea8405bdf7d1 100644 (file)
--- a/clients/tools/common.c
+++ b/clients/tools/common.c
@@ -65,6 +65,7 @@ char *assertion = NULL;
 char *authzid = NULL;
 int   manageDSAit = 0;
 int   noop = 0;
+int   ppolicy = 0;
 int   preread = 0;
 char *preread_attrs = NULL;
 int   postread = 0;
@@ -103,6 +104,7 @@ N_("             [!]assert=<filter>     (an RFC 2254 Filter)\n")
 N_("             [!]authzid=<authzid>   (\"dn:<dn>\" or \"u:<user>\")\n")
 N_("             [!]manageDSAit\n")
 N_("             [!]noop\n"),
+N_("             ppolicy\n"),
 N_("             [!]postread[=<attrs>]  (a comma-separated attribute list)\n"),
 N_("             [!]preread[=<attrs>]   (a comma-separated attribute list)\n"),
 N_("  -f file    read operations from `file'\n"),
@@ -241,6 +243,22 @@ tool_args( int argc, char **argv )
 
                                noop = 1 + crit;
 
+                       } else if ( strcasecmp( control, "ppolicy" ) == 0 ) {
+                               if( ppolicy ) {
+                                       fprintf( stderr, "ppolicy control previously specified\n");
+                                       exit( EXIT_FAILURE );
+                               }
+                               if( cvalue != NULL ) {
+                                       fprintf( stderr, "ppolicy: no control value expected\n" );
+                                       usage();
+                               }
+                               if( crit ) {
+                                       fprintf( stderr, "ppolicy: critical flag not allowed\n" );
+                                       usage();
+                               }
+
+                               ppolicy = 1;
+
                        } else if ( strcasecmp( control, "preread" ) == 0 ) {
                                if( preread ) {
                                        fprintf( stderr, "preread control previously specified\n");
@@ -598,7 +616,7 @@ tool_args( int argc, char **argv )
                }
        }
        if( protocol == LDAP_VERSION2 ) {
-               if( authzid || manageDSAit || noop ) {
+               if( authzid || manageDSAit || noop || ppolicy ) {
                        fprintf( stderr, "%s: -e/-M incompatible with LDAPv2\n", prog );
                        exit( EXIT_FAILURE );
                }
@@ -713,6 +731,17 @@ tool_conn_setup( int not, void (*private_setup)( LDAP * ) )
 void
 tool_bind( LDAP *ld )
 {
+       if ( ppolicy ) {
+               LDAPControl *ctrls[2], c;
+               c.ldctl_oid = LDAP_CONTROL_PASSWORDPOLICYREQUEST;
+               c.ldctl_value.bv_val = NULL;
+               c.ldctl_value.bv_len = 0;
+               c.ldctl_iscritical = 0;
+               ctrls[0] = &c;
+               ctrls[1] = NULL;
+               ldap_set_option( ld, LDAP_OPT_SERVER_CONTROLS, ctrls );
+       }
+
        if ( authmethod == LDAP_AUTH_SASL ) {
 #ifdef HAVE_CYRUS_SASL
                void *defaults;
@@ -752,12 +781,49 @@ tool_bind( LDAP *ld )
                exit( EXIT_FAILURE );
 #endif
        } else {
-               if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod )
-                       != LDAP_SUCCESS )
+               int msgid, err;
+               LDAPMessage *result;
+               LDAPControl **ctrls;
+
+               if (( msgid = ldap_bind( ld, binddn, passwd.bv_val, authmethod )) == -1 )
                {
                        ldap_perror( ld, "ldap_bind" );
                        exit( EXIT_FAILURE );
                }
+
+               if ( ldap_result( ld, msgid, 1, NULL, &result ) == -1 ) {
+                       ldap_perror( ld, "ldap_result" );
+                       exit( EXIT_FAILURE );
+               }
+
+               if ( ldap_parse_result( ld, result, &err, NULL, NULL, NULL,
+                       &ctrls, 1 ) != LDAP_SUCCESS ) {
+                       ldap_perror( ld, "ldap_bind parse result" );
+                       exit( EXIT_FAILURE );
+               }
+
+               if ( ctrls && ppolicy ) {
+                       LDAPControl *ctrl;
+                       int expire, grace;
+                       LDAPPasswordPolicyError pErr = -1;
+                       
+                       ctrl = ldap_find_control( LDAP_CONTROL_PASSWORDPOLICYRESPONSE, ctrls );
+                       if ( ctrl && ldap_parse_passwordpolicy_control( ld, ctrl,
+                               &expire, &grace, &pErr ) == LDAP_SUCCESS ) {
+                               if ( expire >= 0 ) {
+                                       fprintf( stderr, "Password expires in %d seconds\n", expire );
+                               } else if ( grace >= 0 ) {
+                                       fprintf( stderr, "Password expired, %d grace logins remain\n", grace );
+                               }
+                               if ( pErr != PP_noError ){
+                                       fprintf( stderr, "%s\n", ldap_passwordpolicy_err2txt( pErr ) );
+                               }
+                       }
+               }
+               if ( err != LDAP_SUCCESS ) {
+                       fprintf( stderr, "ldap_bind result: %s\n", ldap_err2string( err ));
+                       exit( EXIT_FAILURE );
+               }
        }
 }
 
@@ -767,7 +833,7 @@ void
 tool_server_controls( LDAP *ld, LDAPControl *extra_c, int count )
 {
        int i = 0, j, crit = 0, err;
-       LDAPControl c[6], **ctrls;
+       LDAPControl c[8], **ctrls;
 
        ctrls = (LDAPControl**) malloc(sizeof(c) + (count+1)*sizeof(LDAPControl*));
        if ( ctrls == NULL ) {
@@ -830,6 +896,15 @@ tool_server_controls( LDAP *ld, LDAPControl *extra_c, int count )
                ctrls[i] = &c[i];
                i++;
        }
+
+       if ( ppolicy ) {
+               c[i].ldctl_oid = LDAP_CONTROL_PASSWORDPOLICYREQUEST;
+               c[i].ldctl_value.bv_val = NULL;
+               c[i].ldctl_value.bv_len = 0;
+               c[i].ldctl_iscritical = 0;
+               ctrls[i] = &c[i];
+               i++;
+       }
        
        if ( preread ) {
                char berbuf[LBER_ELEMENT_SIZEOF];

diff --git a/clients/tools/common.h b/clients/tools/common.h
index cbc8cc21524b66948a3a450dc799ae2264231884..2675a8751cff925a603046a5796f551e7bef189a 100644 (file)
--- a/clients/tools/common.h
+++ b/clients/tools/common.h
@@ -47,6 +47,7 @@ extern char *assertion;
 extern char *authzid;
 extern int   manageDSAit;
 extern int   noop;
+extern int   ppolicy;
 extern int     preread, postread;
 
 extern int   not;