allow 'AUTHZ' mech in proxyAuthz control to allow also the <mech> part of the 'u...

diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c
index 1433e1fef079acd680e8da28b7c47bd5b79094bd..1ede30038f801a69dea0035ed98969a8e9321ddc 100644 (file)
--- a/servers/slapd/controls.c
+++ b/servers/slapd/controls.c
@@ -761,7 +761,9 @@ static int parseProxyAuthz (
 
                rc = slap_parse_user( &id, &user, &realm, &mech );
                if ( rc == LDAP_SUCCESS ) {
-                       if ( mech.bv_len ) {
+                       struct berval authz = BER_BVC( "AUTHZ" );
+
+                       if ( mech.bv_len && !bvmatch( &mech, &authz) ) {
                                rs->sr_text = "mech not allowed in authzId";
                                return LDAP_PROXY_AUTHZ_FAILURE;
                        }

diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index b5d1d7b38c6ea41571a2713eccb566b15c6b79a2..a2f7fe02219be1348cc835becc1044474356b8fe 100644 (file)
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -131,9 +131,11 @@ int slap_parse_user( struct berval *id, struct berval *user,
                mech->bv_val[ 0 ] = '\0';
                mech->bv_val++;
 
-               realm->bv_val = strchr( id->bv_val, '/' );
+               realm->bv_val = strchr( mech->bv_val, '/' );
 
                if ( realm->bv_val ) {
+                       realm->bv_val[ 0 ] = '\0';
+                       realm->bv_val++;
                        mech->bv_len = realm->bv_val - mech->bv_val - 1;
                        realm->bv_len = user->bv_val - realm->bv_val - 1;
                } else {