dnl ----------------------------------------------------------------
dnl SLAPD Overlay Options
-Overlays="accesslog denyop dyngroup dynlist glue lastmod ppolicy proxycache \
- refint retcode rwm syncprov translucent unique"
+Overlays="accesslog \
+ denyop \
+ dyngroup \
+ dynlist \
+ glue \
+ lastmod \
+ ppolicy \
+ proxycache \
+ refint \
+ retcode \
+ rwm \
+ syncprov \
+ translucent \
+ unique \
+ valsort"
AC_ARG_WITH(xxslapoverlays,[
SLAPD Overlay Options:])
${ol_dflt_overlays-no}, [no yes mod])
OL_ARG_ENABLE(unique,[ --enable-unique Attribute Uniqueness overlay no|yes|mod],
${ol_dflt_overlays-no}, [no yes mod])
+OL_ARG_ENABLE(valsort,[ --enable-valsort Value Sorting overlay no|yes|mod],
+ ${ol_dflt_overlays-no}, [no yes mod])
dnl ----------------------------------------------------------------
BUILD_SYNCPROV=no
BUILD_TRANSLUCENT=no
BUILD_UNIQUE=no
+BUILD_VALSORT=no
SLAPD_STATIC_OVERLAYS=
SLAPD_DYNAMIC_OVERLAYS=
fi
if test "$ol_enable_shell" != no ; then
- if test "$ol_link_thread" != no ; then
+ if test "$ol_link_threads" != no ; then
AC_MSG_WARN([Use of --without-threads is recommended with back-shell])
fi
BUILD_SLAPD=yes
AC_DEFINE_UNQUOTED(SLAPD_OVER_UNIQUE,$MFLAG,[define for Attribute Uniqueness overlay])
fi
+if test "$ol_enable_valsort" != no ; then
+ BUILD_VALSORT=$ol_enable_valsort
+ if test "$ol_enable_valsort" = mod ; then
+ MFLAG=SLAPD_MOD_DYNAMIC
+ SLAPD_DYNAMIC_OVERLAYS="$SLAPD_DYNAMIC_OVERLAYS valsort.la"
+ else
+ MFLAG=SLAPD_MOD_STATIC
+ SLAPD_STATIC_OVERLAYS="$SLAPD_STATIC_OVERLAYS valsort.o"
+ fi
+ AC_DEFINE_UNQUOTED(SLAPD_OVER_VALSORT,$MFLAG,[define for Value Sorting overlay])
+fi
+
if test "$ol_enable_slurpd" != no -a "$ol_link_threads" != no -a \
$BUILD_SLAPD = yes ; then
BUILD_SLURPD=yes
AC_SUBST(BUILD_SYNCPROV)
AC_SUBST(BUILD_TRANSLUCENT)
AC_SUBST(BUILD_UNIQUE)
+ AC_SUBST(BUILD_VALSORT)
AC_SUBST(BUILD_SLURPD)
AC_SUBST(LDAP_LIBS)
pg_dynacl_parse(
const char *fname,
int lineno,
+ const char *opts,
slap_style_t style,
const char *pattern,
void **privp )
goto cleanup;
}
+ /* TODO: use opts to allow the use of different
+ * group objects and member attributes */
if ( pg_posixGroup == NULL ) {
pg_posixGroup = oc_find( "posixGroup" );
if ( pg_posixGroup == NULL ) {
+
+
+
Network Working Group J. Sermersheim
Internet-Draft Novell, Inc
-Expires: April 24, 2005 L. Poitou
+Expires: January 18, 2006 L. Poitou
Sun Microsystems
- October 24, 2004
+ July 17, 2005
Password Policy for LDAP Directories
- draft-behera-ldap-password-policy-08.txt
+ draft-behera-ldap-password-policy-09.txt
Status of this Memo
- This document is an Internet-Draft and is subject to all provisions
- of section 3 of RFC 3667. By submitting this Internet-Draft, each
- author represents that any applicable patent or other IPR claims of
- which he or she is aware have been or will be disclosed, and any of
- which he or she become aware will be disclosed, in accordance with
- RFC 3668.
+ By submitting this Internet-Draft, each author represents that any
+ applicable patent or other IPR claims of which he or she is aware
+ have been or will be disclosed, and any of which he or she becomes
+ aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
- other groups may also distribute working documents as
- Internet-Drafts.
+ other groups may also distribute working documents as Internet-
+ Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
- This Internet-Draft will expire on April 24, 2005.
+ This Internet-Draft will expire on January 18, 2006.
Copyright Notice
- Copyright (C) The Internet Society (2004).
+ Copyright (C) The Internet Society (2005).
Abstract
improve the security of LDAP directories and make it difficult for
password cracking programs to break into directories, it is desirable
to enforce a set of rules on password usage. These rules are made to
+ ensure that users change their passwords periodically, passwords meet
-Sermersheim & Poitou Expires April 24, 2005 [Page 1]
+Sermersheim & Poitou Expires January 18, 2006 [Page 1]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
- ensure that users change their passwords periodically, passwords meet
construction requirements, the re-use of old password is restricted,
and users are locked out after a certain number of failed attempts.
LDAP Extensions mailing list <ldapext@ietf.org>. Please send
editorial comments directly to the authors.
-Table of Contents
- 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
- 2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 5
- 3. Application of password policy . . . . . . . . . . . . . . . . 6
- 4. Articles of password policy . . . . . . . . . . . . . . . . . 7
- 4.1 Password Usage Policy . . . . . . . . . . . . . . . . . . . . 7
- 4.2 Password Modification Policy . . . . . . . . . . . . . . . . . 7
- 4.3 Restriction of the Password Policy . . . . . . . . . . . . . . 10
- 5. Schema used for Password Policy . . . . . . . . . . . . . . . 11
- 5.1 The pwdPolicy Object Class . . . . . . . . . . . . . . . . . . 11
- 5.2 Attribute Types used in the pwdPolicy ObjectClass . . . . . . 11
- 5.3 Attribute Types for Password Policy State Information . . . . 16
- 6. Controls used for Password Policy . . . . . . . . . . . . . . 20
- 6.1 Request Control . . . . . . . . . . . . . . . . . . . . . . . 20
- 6.2 Response Control . . . . . . . . . . . . . . . . . . . . . . . 20
- 7. Policy Decision Points . . . . . . . . . . . . . . . . . . . . 22
- 7.1 Locked Account Check . . . . . . . . . . . . . . . . . . . . . 22
- 7.2 Password Must be Changed Now Check . . . . . . . . . . . . . . 22
- 7.3 Password Expiration Check . . . . . . . . . . . . . . . . . . 22
- 7.4 Remaining Grace AuthN Check . . . . . . . . . . . . . . . . . 22
- 7.5 Time Before Expiration Check . . . . . . . . . . . . . . . . . 23
- 7.6 Intruder Detection Check . . . . . . . . . . . . . . . . . . . 23
- 7.7 Password Too Young Check . . . . . . . . . . . . . . . . . . . 23
- 8. Server Policy Enforcement Points . . . . . . . . . . . . . . . 24
- 8.1 Password-based Authentication . . . . . . . . . . . . . . . . 24
- 8.2 Password Update Operations . . . . . . . . . . . . . . . . . . 26
- 8.3 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 29
- 9. Client Policy Enforcement Points . . . . . . . . . . . . . . . 30
- 9.1 Bind Operation . . . . . . . . . . . . . . . . . . . . . . . . 30
- 9.2 Modify Operations . . . . . . . . . . . . . . . . . . . . . . 30
- 9.3 Add Operation . . . . . . . . . . . . . . . . . . . . . . . . 31
- 9.4 Compare Operation . . . . . . . . . . . . . . . . . . . . . . 32
- 9.5 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 32
- 10. Administration of the Password Policy . . . . . . . . . . . . 33
- 11. Password Policy and Replication . . . . . . . . . . . . . . . 34
- 12. Security Considerations . . . . . . . . . . . . . . . . . . . 35
- 13. Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . 36
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 2]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
- 14. Normative References . . . . . . . . . . . . . . . . . . . . . 36
- Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 37
- Intellectual Property and Copyright Statements . . . . . . . . 38
+Sermersheim & Poitou Expires January 18, 2006 [Page 2]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
+Table of Contents
+
+ 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
+ 2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 5
+ 3. Application of password policy . . . . . . . . . . . . . . . . 6
+ 4. Articles of password policy . . . . . . . . . . . . . . . . . 7
+ 4.1 Password Usage Policy . . . . . . . . . . . . . . . . . . . . 7
+ 4.2 Password Modification Policy . . . . . . . . . . . . . . . . . 7
+ 4.3 Restriction of the Password Policy . . . . . . . . . . . . . . 10
+ 5. Schema used for Password Policy . . . . . . . . . . . . . . . 11
+ 5.1 The pwdPolicy Object Class . . . . . . . . . . . . . . . . . . 11
+ 5.2 Attribute Types used in the pwdPolicy ObjectClass . . . . . . 11
+ 5.3 Attribute Types for Password Policy State Information . . . . 16
+ 6. Controls used for Password Policy . . . . . . . . . . . . . . 21
+ 6.1 Request Control . . . . . . . . . . . . . . . . . . . . . . . 21
+ 6.2 Response Control . . . . . . . . . . . . . . . . . . . . . . . 21
+ 7. Policy Decision Points . . . . . . . . . . . . . . . . . . . . 23
+ 7.1 Locked Account Check . . . . . . . . . . . . . . . . . . . . . 23
+ 7.2 Password Must be Changed Now Check . . . . . . . . . . . . . . 23
+ 7.3 Password Expiration Check . . . . . . . . . . . . . . . . . . 23
+ 7.4 Remaining Grace AuthN Check . . . . . . . . . . . . . . . . . 23
+ 7.5 Time Before Expiration Check . . . . . . . . . . . . . . . . . 24
+ 7.6 Intruder Detection Check . . . . . . . . . . . . . . . . . . . 24
+ 7.7 Password Too Young Check . . . . . . . . . . . . . . . . . . . 24
+ 8. Server Policy Enforcement Points . . . . . . . . . . . . . . . 25
+ 8.1 Password-based Authentication . . . . . . . . . . . . . . . . 25
+ 8.2 Password Update Operations . . . . . . . . . . . . . . . . . . 27
+ 8.3 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 30
+ 9. Client Policy Enforcement Points . . . . . . . . . . . . . . . 31
+ 9.1 Bind Operation . . . . . . . . . . . . . . . . . . . . . . . . 31
+ 9.2 Modify Operations . . . . . . . . . . . . . . . . . . . . . . 32
+ 9.3 Add Operation . . . . . . . . . . . . . . . . . . . . . . . . 33
+ 9.4 Compare Operation . . . . . . . . . . . . . . . . . . . . . . 33
+ 9.5 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 34
+ 10. Administration of the Password Policy . . . . . . . . . . . . 35
+ 11. Password Policy and Replication . . . . . . . . . . . . . . . 36
+ 12. Security Considerations . . . . . . . . . . . . . . . . . . . 37
+ 13. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 38
+ 14. Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . 39
+ 15. Normative References . . . . . . . . . . . . . . . . . . . . . 39
+ Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 40
+ Intellectual Property and Copyright Statements . . . . . . . . 41
-Sermersheim & Poitou Expires April 24, 2005 [Page 3]
+Sermersheim & Poitou Expires January 18, 2006 [Page 3]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
1. Overview
other things, this policy includes:
o Whether and when passwords expire.
+
o Whether failed bind attempts cause the account to be locked.
+
o If and how users are able to change their passwords.
In order to achieve greater security protection and ensure
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 4]
+Sermersheim & Poitou Expires January 18, 2006 [Page 4]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
2. Conventions
-Sermersheim & Poitou Expires April 24, 2005 [Page 5]
+Sermersheim & Poitou Expires January 18, 2006 [Page 5]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
3. Application of password policy
-Sermersheim & Poitou Expires April 24, 2005 [Page 6]
+Sermersheim & Poitou Expires January 18, 2006 [Page 6]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
4. Articles of password policy
4.1.1 Password Guessing Limit
In order to prevent intruders from guessing a user's password, a
- mechanism exists to track the number of failed authentication
- attempts, and take action when a limit is reached. This policy
- consists of five parts:
+ mechanism exists to track the number of consecutive failed
+ authentication attempts, and take action when a limit is reached.
+ This policy consists of five parts:
o A configurable limit on failed authentication attempts.
+
o A counter to track the number of failed authentication attempts.
+
o A timeframe in which the limit of consecutive failed
authentication attempts must happen before action is taken.
+
o The action to be taken when the limit is reached. The action will
either be nothing, or the account will be locked.
+
o An amount of time the account is locked (if it is to be locked).
This can be indefinite.
+
4.2 Password Modification Policy
This section describes policy enforced while users are modifying
password attribute during an add or modify operation, but MAY be done
by other means such as an extended operation.
-4.2.1 Password Expiration, Expiration Warning, and Grace
- Authentications
- One of the key properties of a password is the fact that it is not
- well known. If a password is frequently changed, the chances of that
- user's account being broken into are minimized.
-Sermersheim & Poitou Expires April 24, 2005 [Page 7]
+Sermersheim & Poitou Expires January 18, 2006 [Page 7]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
+4.2.1 Password Expiration, Expiration Warning, and Grace
+ Authentications
+ One of the key properties of a password is the fact that it is not
+ well known. If a password is frequently changed, the chances of that
+ user's account being broken into are minimized.
Password policy administrators may deploy a password policy that
causes passwords to expire after a given amount of time - thus
o A warning may be returned to the user sometime before his password
is due to expire. If the user fails to heed this warning before
the expiration time, his account will be locked.
+
o The user may bind to the directory a preset number of times after
her password has expired. If she fails to change her password
during one of her 'grace' authentications, her account will be
locked.
+
4.2.2 Password History
When the Password Expiration policy is used, an additional mechanism
This process may be made less attractive to users by employing a
minimum age for passwords. If users are forced to wait 24 hours
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 8]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
between password changes, they may be less likely to cycle through a
history of 10 passwords.
are easy to guess, a password quality policy may be employed. This
policy consists of two general mechanisms - ensuring that passwords
conform to a defined quality criterion and ensuring that they are of
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 8]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
a minimum length.
Forcing a password to comply with the quality policy may imply a
variety of things including:
o Disallowing trivial or well-known words make up the password.
+
o Forcing a certain number of digits be used.
+
o Disallowing anagrams of the user's name.
The implementation of this policy meets with the following problems:
before being sent, the server has no way of enforcing this policy.
Therefore, the onus of enforcing this policy falls upon client
implementations.
+
o There are no specific definitions of what 'quality checking'
means. This can lead to unexpected behavior in a heterogeneous
environment.
+
4.2.5 User Defined Passwords
In some cases, it is desirable to disallow users from adding and
updating their own passwords. This policy makes this functionality
possible.
- This implies that certain other policy, such as password expiration
- is not enforced.
-
4.2.6 Password Change after Reset
This policy forces the user to update her password after it has been
This is needed in scenarios where a password administrator has set or
reset the password to a well-known value.
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 9]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
4.2.7 Safe Modification
As directories become more commonly used, it will not be unusual for
This policy forces the user to prove his identity by specifying the
old password during a password modify operation.
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 9]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
{TODO: This allows a dictionary attack unless we specify that this is
- also subject to intruder detection}
+ also subject to intruder detection. One solution is to require users
+ to authN prior to changing password. Another solution is to perform
+ intruder detection checks when the password for a non-authenticated
+ identity is being updated}
4.3 Restriction of the Password Policy
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 10]
+Sermersheim & Poitou Expires January 18, 2006 [Page 10]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
5. Schema used for Password Policy
$ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $
pwdMustChange $ pwdAllowUserChange $ pwdSafeModify ) )
+
5.2 Attribute Types used in the pwdPolicy ObjectClass
Following are the attribute types used by the pwdPolicy object class.
EQUALITY objectIdentifierMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
+
5.2.2 pwdMinAge
This attribute holds the number of seconds that must elapse between
modifications to the password. If this attribute is not present, 0
seconds is assumed.
- ( 1.3.6.1.4.1.42.2.27.8.1.2
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 11]
+Sermersheim & Poitou Expires January 18, 2006 [Page 11]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ ( 1.3.6.1.4.1.42.2.27.8.1.2
NAME 'pwdMinAge'
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.3 pwdMaxAge
This attribute holds the number of seconds after which a modified
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.4 pwdInHistory
This attribute specifies the maximum number of used passwords stored
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.5 pwdCheckQuality
{TODO: Consider changing the syntax to OID. Each OID will list a
quality rule (like min len, # of special characters, etc). These
- rules can be specified outsid ethis document.}
+ rules can be specified outside this document.}
{TODO: Note that even though this is meant to be a check that happens
during password modification, it may also be allowed to happen during
authN. This is useful for situations where the password is encrypted
- when modified, but decrypted when used to authN.}
-
- This attribute indicates how the password quality will be verified
- while being modified or added. If this attribute is not present, or
-Sermersheim & Poitou Expires April 24, 2005 [Page 12]
+Sermersheim & Poitou Expires January 18, 2006 [Page 12]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ when modified, but decrypted when used to authN.}
+
+ This attribute indicates how the password quality will be verified
+ while being modified or added. If this attribute is not present, or
if the value is '0', quality checking will not be enforced. A value
of '1' indicates that the server will check the quality, and if the
server is unable to check it (due to a hashed password or other
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.6 pwdMinLength
When quality checking is enabled, this attribute holds the minimum
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.7 pwdExpireWarning
This attribute specifies the maximum number of seconds before a
( 1.3.6.1.4.1.42.2.27.8.1.7
NAME 'pwdExpireWarning'
EQUALITY integerMatch
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
- SINGLE-VALUE )
-5.2.8 pwdGraceAuthNLimit
- This attribute specifies the number of times an expired password can
+Sermersheim & Poitou Expires January 18, 2006 [Page 13]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
-Sermersheim & Poitou Expires April 24, 2005 [Page 13]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+ SINGLE-VALUE )
+
+5.2.8 pwdGraceAuthNLimit
+ This attribute specifies the number of times an expired password can
be used to authenticate. If this attribute is not present or if the
value is 0, authentication will fail.
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.9 pwdLockout
This attribute indicates, when its value is "TRUE", that the password
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
+
5.2.10 pwdLockoutDuration
This attribute holds the number of seconds that the password cannot
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 14]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
5.2.11 pwdMaxFailure
This attribute specifies the number of consecutive failed bind
If this attribute is not present, or if the value is 0, this policy
is not checked, and the value of pwdLockout will be ignored.
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 14]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
( 1.3.6.1.4.1.42.2.27.8.1.11
NAME 'pwdMaxFailure'
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.12 pwdFailureCountInterval
This attribute holds the number of seconds after which the password
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
+
5.2.13 pwdMustChange
This attribute specifies with a value of "TRUE" that users must
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 15]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
5.2.14 pwdAllowUserChange
This attribute indicates whether users can change their own
access control mechanism.
( 1.3.6.1.4.1.42.2.27.8.1.14
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 15]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
NAME 'pwdAllowUserChange'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
+
5.2.15 pwdSafeModify
This attribute specifies whether or not the existing password must be
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
+
5.3 Attribute Types for Password Policy State Information
Password policy state information must be maintained for each user.
(1.3.6.1.4.1.1466.115.121.1.38). The attribute type descriptor
(short name) MUST be used.
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 16]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
For example, if the pwdPolicy object has for pwdAttribute
"userPassword" then the pwdChangedTime operational attribute, in a
user entry, will be:
operation, and does not specify an option, all subtypes of that
policy state attribute are returned.
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 16]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
5.3.2 pwdChangedTime
This attribute specifies the last time the entry's password was
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
SINGLE-VALUE
+ NO-USER-MODIFICATION
USAGE directoryOperation )
+
5.3.3 pwdAccountLockedTime
This attribute holds the time that the user's account was locked. A
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
SINGLE-VALUE
+ NO-USER-MODIFICATION
USAGE directoryOperation )
+
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 17]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
5.3.4 pwdFailureTime
This attribute holds the timestamps of the consecutive authentication
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
+ NO-USER-MODIFICATION
USAGE directoryOperation )
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 17]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
5.3.5 pwdHistory
This attribute holds a history of previously used passwords. Values
( 1.3.6.1.4.1.42.2.27.8.1.20
NAME 'pwdHistory'
DESC 'The history of user s passwords'
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 18]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
EQUALITY octetStringMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
+ NO-USER-MODIFICATION
USAGE directoryOperation )
+
5.3.6 pwdGraceUseTime
This attribute holds the timestamps of grace authentications after a
password has expired'
EQUALITY generalizedTimeMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 18]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
+ NO-USER-MODIFICATION
USAGE directoryOperation )
+
5.3.7 pwdReset
This attribute holds a flag to indicate (when TRUE) that the password
has been updated by the password administrator and must be changed by
- the user on first authentication.
+ the user.
( 1.3.6.1.4.1.42.2.27.8.1.22
NAME 'pwdReset'
SINGLE-VALUE
USAGE directoryOperation )
+
5.3.8 pwdPolicySubentry
This attribute points to the pwdPolicy subentry in effect for this
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
SINGLE-VALUE
+ NO-USER-MODIFICATION
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 19]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
USAGE directoryOperation )
-Sermersheim & Poitou Expires April 24, 2005 [Page 19]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 20]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
6. Controls used for Password Policy
response control contains various warnings and errors associated with
password policy.
+ {TODO: add a note about advertisement and discovery}
+
6.1 Request Control
This control MAY be sent with any LDAP request message in order to
passwordInHistory (8) } OPTIONAL }
The timeBeforeExpiration warning specifies the number of seconds
- before a password will expire. The graceAuthNsRemaining warning
- specifies the remaining number of times a user will be allowed to
-Sermersheim & Poitou Expires April 24, 2005 [Page 20]
+Sermersheim & Poitou Expires January 18, 2006 [Page 21]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ before a password will expire. The graceAuthNsRemaining warning
+ specifies the remaining number of times a user will be allowed to
authenticate with an expired password. The passwordExpired error
signifies that the password has expired and must be reset. The
changeAfterReset error signifies that the password must be changed
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 21]
+Sermersheim & Poitou Expires January 18, 2006 [Page 22]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
7. Policy Decision Points
if any of these conditions are met:
o The value of the pwdAccountLockedTime attribute is 000001010000Z.
+
o The current time is less than the value of the
pwdAccountLockedTime attribute added to the value of the
pwdLockoutDuration.
if all of these conditions are met:
The pwdMustChange attribute is set to TRUE.
+
The pwdReset attribute is set to TRUE.
Otherwise a status of false is returned.
7.3 Password Expiration Check
A status of true is returned indicating that the password has expired
- if the value of the pwdExpireWarning attribute is 0, and the current
- time minus the value of pwdChangedTime is greater than the value of
- the pwdMaxAge.
+ if the current time minus the value of pwdChangedTime is greater than
+ the value of the pwdMaxAge.
Otherwise, a status of false is returned.
If the pwdGraceUseTime attribute is present, the number of values in
that attribute subtracted from the value of pwdGraceAuthNLimit is
returned. Otherwise zero is returned. A positive result specifies
- the number of remaining grace authentications.
-Sermersheim & Poitou Expires April 24, 2005 [Page 22]
+Sermersheim & Poitou Expires January 18, 2006 [Page 23]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ the number of remaining grace authentications.
+
7.5 Time Before Expiration Check
If the pwdExpireWarning attribute is not present a zero status is
returned if the following conditions are met:
The pwdLockout attribute is TRUE.
+
The number of values in the pwdFailureTime attribute that are
younger than pwdFailureCountInterval is greater or equal to the
pwdMaxFailure attribute.
password was last updated is returned if:
The value of pwdMinAge is non-zero and pwdChangedTime is present.
+
The value of pwdMinAge is greater than the current time minus the
value of pwdChangedTime.
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 23]
+Sermersheim & Poitou Expires January 18, 2006 [Page 24]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
8. Server Policy Enforcement Points
updates used while validating a password. Operations that validate
passwords include, but are not limited to, the Bind operation where
the simple choice specifies a password, and the compare operation
- where the attribute being compared holds a password.
+ where the attribute being compared holds a password. Note that while
+ the compare operation does not authenticate a user to the LDAP
+ server, it may be used by an external application for purposes of
+ authentication.
8.1.1 Fail if the account is locked
the error: accountLocked (1) in the passwordPolicyResponse in the
controls field of the message.
-8.1.2 AuthN Passed Procedures
+8.1.2 Validated Password Procedures
- If the authentication process indicates that the password validated,
+ If the validation operation indicates that the password validated,
these procedures are followed in order:
8.1.2.1 Policy state updates
If the decision in Section 7.2 returns true, the server sends to the
client a response with an appropriate successful resultCode (i.e.
- success (0), compareTrue (6), etc.), and includes the
- passwordPolicyResponse in the controls field of the bindResponse
- message with the warning: changeAfterReset specified.
-Sermersheim & Poitou Expires April 24, 2005 [Page 24]
+Sermersheim & Poitou Expires January 18, 2006 [Page 25]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ success (0), compareTrue (6), etc.), and includes the
+ passwordPolicyResponse in the controls field of the bindResponse
+ message with the warning: changeAfterReset specified.
+
For bind, the server MUST then disallow all operations issued by this
user except modify password, bind, unbind, abandon and StartTLS
extended operation.
If there are remaining grace authentications as per Section 7.4, the
server adds a new value with the current time in pwdGraceUseTime.
Then it sends to the client a response with an appropriate successful
- resultCode (i.e. success (0), compareTrue (6), etc.), and includes
+ resultCode (i.e. success (0), compareTrue (6), etc.), and includes
the passwordPolicyResponse in the controls field of the response
message with the warning: graceAuthNsRemaining choice set to the
number of grace authentications left.
If the result of Section 7.5 is a positive number, the server sends
to the client a response with an appropriate successful resultCode
- (i.e. success (0), compareTrue (6), etc.), and includes the
+ (i.e. success (0), compareTrue (6), etc.), and includes the
passwordPolicyResponse in the controls field of the bindResponse
message with the warning: timeBeforeExiration set to the value as
described above. Otherwise, the server sends a successful response,
and omits the passwordPolicyResponse.
-8.1.2.5 AuthN Failed Procedures
- If the authentication process indicates that the password failed
- validation due to invalid credentials, these procedures are followed:
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 25]
+Sermersheim & Poitou Expires January 18, 2006 [Page 26]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
+8.1.2.5 AuthN Failed Procedures
+ If the authentication process indicates that the password failed
+ validation due to invalid credentials, these procedures are followed:
8.1.2.5.1 Policy state update
When the LDAP modify operation is used to modify a password, this is
done by specifying both a delete action and an add or replace action,
- where the delete action is first, and specifies the existing
- password, and the add or replace action specifies the new password.
- Other password update operations SHOULD employ a similar mechanism.
- Otherwise this policy will fail.
+ where the delete action specifies the existing password, and the add
+ or replace action specifies the new password. Other password update
+ operations SHOULD employ a similar mechanism. Otherwise this policy
+ will fail.
- If the existing password is not specified, the server does not
- process the operation and sends the appropriate response message to
- the client with the resultCode: insufficientAccessRights (50), and
- includes the passwordPolicyResponse in the controls field of the
- response message with the error: mustSupplyOldPassword (4).
-Sermersheim & Poitou Expires April 24, 2005 [Page 26]
+Sermersheim & Poitou Expires January 18, 2006 [Page 27]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+ If the existing password is not specified, the server does not
+ process the operation and sends the appropriate response message to
+ the client with the resultCode: insufficientAccessRights (50), and
+ includes the passwordPolicyResponse in the controls field of the
+ response message with the error: mustSupplyOldPassword (4).
8.2.2 Change After Reset
If the value is 1, operation continues. If the value is 2, the
server sends a response message to the client with the resultCode:
constraintViolation (19), and includes the passwordPolicyResponse
- in the controls field of the response message with the error:
- insufficientPasswordQuality (5).
- If the server is able to check the password quality, and the check
- fails, the server sends a response message to the client with the
- resultCode: constraintViolation (19), and includes the
- passwordPolicyResponse in the controls field of the response
-Sermersheim & Poitou Expires April 24, 2005 [Page 27]
+Sermersheim & Poitou Expires January 18, 2006 [Page 28]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+ in the controls field of the response message with the error:
+ insufficientPasswordQuality (5).
+ If the server is able to check the password quality, and the check
+ fails, the server sends a response message to the client with the
+ resultCode: constraintViolation (19), and includes the
+ passwordPolicyResponse in the controls field of the response
message with the error: insufficientPasswordQuality (5).
+
o checks the value of the pwdMinLength attribute. If the value is
non-zero, it ensures that the new password is of at least the
minimum length.
passwordPolicyResponse in the controls field of the response
message with the error: passwordTooShort (6).
+
8.2.6 Invalid Reuse
If pwdInHistory is present and its value is non-zero, the server
If the value of pwdInHistory is non-zero, the server adds the
previous password (if one existed) to the pwdHistory attribute. If
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 29]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
the number of attributes held in the pwdHistory attribute exceeds the
value of pwdInHistory, the server removes the oldest excess
passwords.
set to TRUE. Otherwise, the pwdReset is removed from the user's
entry if it exists.
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 28]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
- The pwdFailureTime, pwdGraceUseTime and pwdExpirationWarned
- attributes is removed from the user's entry if they exist.
+ The pwdFailureTime and pwdGraceUseTime attributes is removed from the
+ user's entry if they exist.
8.3 Other Operations
-
-
-
-
-
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 29]
+Sermersheim & Poitou Expires January 18, 2006 [Page 30]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
9. Client Policy Enforcement Points
failure limit has been reached and the account is locked. The
user needs to retry later or contact the password administrator to
reset the password.
+
o bindResponse.resultCode = success (0),
passwordPolicyResponse.error = changeAfterReset (2): The user is
binding for the first time after the password administrator set
the password. In this scenario, the client SHOULD prompt the user
to change his password immediately.
+
o bindResponse.resultCode = success (0),
passwordPolicyResponse.warning = graceAuthNsRemaining: The
password has expired but there are remaining grace
authentications. The user needs to change it.
+
o bindResponse.resultCode = invalidCredentials (49),
passwordPolicyResponse.error = passwordExpired (0): The password
has expired and there are no more grace authentications. The user
contacts the password administrator in order to have its password
reset.
+
o bindResponse.resultCode = success (0),
passwordPolicyResponse.warning = timeBeforeExpiration: The user's
password will expire in n number of seconds.
-9.2 Modify Operations
-9.2.1 Modify Request
- If the application or client encrypts the password prior to sending
- it in a password modification operation (whether done through
-Sermersheim & Poitou Expires April 24, 2005 [Page 30]
+Sermersheim & Poitou Expires January 18, 2006 [Page 31]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+9.2 Modify Operations
+
+9.2.1 Modify Request
+
+ If the application or client encrypts the password prior to sending
+ it in a password modification operation (whether done through
modifyRequest or another password modification mechanism), it SHOULD
check the values of the pwdMinLength, and pwdCheckQuality attributes
and SHOULD enforce these policies.
passwordPolicyResponse.error = mustSupplyOldPassword (4): The user
attempted to change her password without specifying the old
password but the password policy requires this.
+
o <pwdModResponse>.resultCode = insufficientAccessRights (50),
passwordPolicyResponse.error = changeAfterReset (2): The user must
change her password before submitting any other LDAP requests.
+
o <pwdModResponse>.resultCode = insufficientAccessRights (50),
passwordPolicyResponse.error = passwordModNotAllowed (3): The user
doesn't have sufficient rights to change his password.
+
o <pwdModResponse>.resultCode = constraintViolation (19),
passwordPolicyResponse.error = passwordTooYoung (7): It is too
soon after the last password modification to change the password.
+
o <pwdModResponse>.resultCode = constraintViolation (19),
passwordPolicyResponse.error = insufficientPasswordQuality (5):
The password failed quality checking.
+
o <pwdModResponse>.resultCode = constraintViolation (19),
passwordPolicyResponse.error = passwordTooShort (6): The length of
the password is too short.
+
o <pwdModResponse>.resultCode = constraintViolation (19),
passwordPolicyResponse.error = passwordInHistory (8): The password
has already been used; the user must choose a different one.
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 32]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
9.3 Add Operation
If a password is specified in an addRequest, the client checks the
passwordPolicyResponse.error = passwordModNotAllowed (3): The user
doesn't have sufficient rights to add this password.
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 31]
-\f
-Internet-Draft Password Policy for LDAP Directories October 2004
-
-
o addResponse.resultCode = constraintViolation (19),
passwordPolicyResponse.error = insufficientPasswordQuality (5):
The password failed quality checking.
+
o addResponse.resultCode = constraintViolation (19),
passwordPolicyResponse.error = passwordTooShort (6): The length of
the password is too short.
+
9.4 Compare Operation
When a compare operation is used to compare a password, the client
failure limit has been reached and the account is locked. The
user needs to retry later or contact the password administrator to
reset the password.
+
o compareResponse.resultCode = compareTrue (6),
passwordPolicyResponse.warning = graceAuthNsRemaining: The
password has expired but there are remaining grace
authentications. The user needs to change it.
+
o compareResponse.resultCode = compareFalse (5),
passwordPolicyResponse.error = passwordExpired (0): The password
has expired and there are no more grace authentications. The user
must contact the password administrator to reset the password.
+
o compareResponse.resultCode = compareTrue (6),
passwordPolicyResponse.warning = timeBeforeExpiration: The user's
password will expire in n number of seconds.
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 33]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
9.5 Other Operations
For operations other than bind, unbind, abandon or StartTLS, the
-Sermersheim & Poitou Expires April 24, 2005 [Page 32]
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 34]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
10. Administration of the Password Policy
-Sermersheim & Poitou Expires April 24, 2005 [Page 33]
+Sermersheim & Poitou Expires January 18, 2006 [Page 35]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
11. Password Policy and Replication
+ {TODO: This section needs to be changed to highlight the pitfals of
+ replication, sugest some implementation choices to overcome those
+ pitfals, but remove prescriptive language relating to the update of
+ state information}
+
The pwdPolicy object defines the password policy for a portion of the
DIT and MUST be replicated on all the replicas of this subtree, as
any subentry would be, in order to have a consistent policy among all
doesn't have to be replicated to a read-only replica, since the
password will never be directly modified on this server.
- The pwdAccountLockedTime, pwdExpirationWarned, pwdFailureTime and
- pwdGraceUseTime attributes MUST be replicated to writable replicas,
- making the password policy global for all servers. When the user
- entry is replicated to a read-only replica, these attributes SHOULD
- NOT be replicated. This means that the number of failures, of grace
+ The pwdAccountLockedTime, pwdFailureTime and pwdGraceUseTime
+ attributes MUST be replicated to writable replicas, making the
+ password policy global for all servers. When the user entry is
+ replicated to a read-only replica, these attributes SHOULD NOT be
+ replicated. This means that the number of failures, of grace
authentications and the locking will take place on each replicated
server. For example, the effective number of failed attempts on a
user password will be N x M (where N is the number of servers and M
-
-
-
-
-
-Sermersheim & Poitou Expires April 24, 2005 [Page 34]
+Sermersheim & Poitou Expires January 18, 2006 [Page 36]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
12. Security Considerations
-Sermersheim & Poitou Expires April 24, 2005 [Page 35]
+Sermersheim & Poitou Expires January 18, 2006 [Page 37]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
+13. IANA Considerations
+
+ <<<TBD>>>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-13. Acknowledgement
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Sermersheim & Poitou Expires January 18, 2006 [Page 38]
+\f
+Internet-Draft Password Policy for LDAP Directories July 2005
+
+
+14. Acknowledgement
This document is based in part on prior work done by Valerie Chu from
Netscape Communications Corp, published as
draft-vchu-ldap-pwd-policy-00.txt (December 1998). Prasanta Behera
participated in early revisions of this document.
-14 Normative References
+15. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC2195] Klensin, J., Catoe, R. and P. Krumviede, "IMAP/POP
- AUTHorize Extension for Simple Challenge/Response", RFC
- 2195, September 1997.
+ [RFC2195] Klensin, J., Catoe, R., and P. Krumviede, "IMAP/POP
+ AUTHorize Extension for Simple Challenge/Response",
+ RFC 2195, September 1997.
[RFC2222] Myers, J., "Simple Authentication and Security Layer
(SASL)", RFC 2222, October 1997.
- [RFC2251] Wahl, M., Howes, T. and S. Kille, "Lightweight Directory
+ [RFC2251] Wahl, M., Howes, T., and S. Kille, "Lightweight Directory
Access Protocol (v3)", RFC 2251, December 1997.
- [RFC2252] Wahl, M., Coulbeck, A., Howes, T. and S. Kille,
+ [RFC2252] Wahl, M., Coulbeck, A., Howes, T., and S. Kille,
"Lightweight Directory Access Protocol (v3): Attribute
Syntax Definitions", RFC 2252, December 1997.
- [RFC2829] Wahl, M., Alvestrand, H., Hodges, J. and R. Morgan,
+ [RFC2829] Wahl, M., Alvestrand, H., Hodges, J., and R. Morgan,
"Authentication Methods for LDAP", RFC 2829, May 2000.
[RFC2831] Leach, P. and C. Newman, "Using Digest Authentication as a
-Sermersheim & Poitou Expires April 24, 2005 [Page 36]
+Sermersheim & Poitou Expires January 18, 2006 [Page 39]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
Encoding Rules (BER), Canonical Encoding Rules (CER) and
USA
Phone: +1 801 861-3088
- EMail: jimse@novell.com
+ Email: jimse@novell.com
Ludovic Poitou
France
Phone: +33 476 188 212
- EMail: ludovic.poitou@sun.com
+ Email: ludovic.poitou@sun.com
-Sermersheim & Poitou Expires April 24, 2005 [Page 37]
+Sermersheim & Poitou Expires January 18, 2006 [Page 40]
\f
-Internet-Draft Password Policy for LDAP Directories October 2004
+Internet-Draft Password Policy for LDAP Directories July 2005
Intellectual Property Statement
Copyright Statement
- Copyright (C) The Internet Society (2004). This document is subject
+ Copyright (C) The Internet Society (2005). This document is subject
to the rights, licenses and restrictions contained in BCP 78, and
except as set forth therein, the authors retain all their rights.
-Sermersheim & Poitou Expires April 24, 2005 [Page 38]
+Sermersheim & Poitou Expires January 18, 2006 [Page 41]
\f
+
sasl_ssf=<n>
aci[=<attrname>]
- dynacl/name[.<dynstyle>][=<pattern>]
+ dynacl/name[
/<options>][.<dynstyle>][=<pattern>]
.fi
.LP
with
ACIs are experimental; they must be enabled at compile time.
.LP
The statement
-.B dynacl/<name>[.<dynstyle>][=<pattern>]
+.B dynacl/<name>[
/<options>][.<dynstyle>][=<pattern>]
means that access checking is delegated to the admin-defined method
indicated by
.BR <name> ,
.B moduleload
statement.
The fields
+.BR <options> ,
.B <dynstyle>
and
.B <pattern>
.SH SEE ALSO
.BR slapd.conf (5),
.BR slapd (8).
-.SH AUTHOR
-Originally implemented by Pierangelo Masarati.
+.SH ACKNOWLEDGEMENTS
+.P
+This module was written in 2004 by Pierangelo Masarati for SysNet s.n.c.
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
SINGLE-VALUE
+ NO-USER-MODIFICATION
USAGE directoryOperation)
.RE
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SINGLE-VALUE
+ NO-USER-MODIFICATION
USAGE directoryOperation)
.RE
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SINGLE-VALUE
+ NO-USER-MODIFICATION
USAGE directoryOperation)
.RE
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
+ NO-USER-MODIFICATION
USAGE directoryOperation )
.RE
DESC 'The history of user passwords'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
EQUALITY octetStringMatch
+ NO-USER-MODIFICATION
USAGE directoryOperation)
.RE
DESC 'The timestamps of the grace login once the password has expired'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
EQUALITY generalizedTimeMatch
+ NO-USER-MODIFICATION
USAGE directoryOperation)
.RE
.LP
IETF LDAP password policy proposal by P. Behera, L. Poitou and J.
Sermersheim: documented in IETF document
-"draft-behera-ldap-password-policy-08.txt".
+"draft-behera-ldap-password-policy-09.txt".
.SH BUGS
The LDAP Password Policy specification is not yet an approved standard,
Poitou and J. Sermersheim.
The proposal is fully documented in
the
-IETF document named draft-behera-ldap-password-policy-08.txt,
-written in October of 2004.
+IETF document named draft-behera-ldap-password-policy-09.txt,
+written in July of 2005.
.P
.B OpenLDAP
is developed and maintained by The OpenLDAP Project (http://www.openldap.org/).
in \fBretcode.conf\fP, which can be included after instantiating
the overlay.
.LP
-In the second case, objects of the \fBerrObject\fP class, when returned
-as intermediate responses of a search request, are changed into
-the response dictated by their content.
+In the second case, objects of classes inherited from
+the \fBerrAbsObject\fP, like \fBerrObject\fP or \fBerrAuxObject\fP,
+when returned as intermediate responses of a search request, are changed
+into the response dictated by their content.
.LP
A third mode causes objects to be looked up from the underlying database
-to discover if their class is \fBerrObject\fP; in that case, their content
-is used to compute the corresponding response.
+to discover if their class inherits from \fBerrABsObject\fP;
+in that case, their content is used to compute the corresponding response.
.LP
The behavior is disabled by using the \fBmanageDSAit\fP control (RFC 3296);
in that case, the resulting object, either present in the directory
.RE
.TP
.B retcode\-indir
-Enables exploitation of in-directory stored errObjects. May result
-in lots of unnecessary overhead.
+Enables exploitation of in-directory stored errAbsObject.
+May result in a lot of unnecessary overhead.
.SH SCHEMA
The following schema items are created and used by the overlay:
SINGLE-VALUE )
.RE
.LP
-The objectclass:
+The abstract class that triggers the overlay:
.RS 4
-( 1.3.6.1.4.1.4203.666.11.4.3.1
- NAME ( 'errObject' )
- SUP top STRUCTURAL
+( 1.3.6.1.4.1.4203.666.11.4.3.0
+ NAME ( 'errAbsObject' )
+ SUP top ABSTRACT
MUST ( errCode )
MAY ( cn $ description $ errOp $ errText $ errSleepTime ) )
.RE
+.LP
+The standalone structural objectclass for specifically created data:
+.RS 4
+( 1.3.6.1.4.1.4203.666.11.4.3.1
+ NAME ( 'errObject' )
+ SUP errAbsObject STRUCTURAL )
+.RE
+.LP
+The auxiliary objectclass to alter the behavior of existing objects:
+.RS 4
+( 1.3.6.1.4.1.4203.666.11.4.3.2
+ NAME ( 'errAuxObject' )
+ SUP errAbsObject AUXILIARY )
+.RE
.SH EXAMPLE
.LP
.SH SEE ALSO
.BR slapd.conf (5),
.BR slapd (8),
-.SH AUTHOR
-Pierangelo Masarati
+.SH ACKNOWLEDGEMENTS
+.P
+This module was written in 2005 by Pierangelo Masarati for SysNet s.n.c.
#define LDAP_CONTROL_NO_SUBORDINATES "1.3.6.1.4.1.4203.666.5.11"
#define LDAP_CONTROL_MANAGEDIT "1.3.6.1.4.1.4203.666.5.12"
#define LDAP_CONTROL_SLURP "1.3.6.1.4.1.4203.666.5.13"
+#define LDAP_CONTROL_VALSORT "1.3.6.1.4.1.4203.666.5.14"
/* LDAP Duplicated Entry Control Extension *//* not implemented in slapd(8) */
#define LDAP_CONTROL_DUPENT_REQUEST "2.16.840.1.113719.1.27.101.1"
#define LDAP_CONTROL_VLVRESPONSE "2.16.840.1.113730.3.4.10"
/* Password policy Controls *//* work in progress */
-/* ITS#3458: released, but not to latest draft; disabled by default */
+/* ITS#3458: released; disabled by default */
#define LDAP_CONTROL_PASSWORDPOLICYREQUEST "1.3.6.1.4.1.42.2.27.8.5.1"
#define LDAP_CONTROL_PASSWORDPOLICYRESPONSE "1.3.6.1.4.1.42.2.27.8.5.1"
LDAP_F( void *)
ldap_pvt_thread_pool_context LDAP_P(( void ));
+LDAP_F( void )
+ldap_pvt_thread_pool_context_reset LDAP_P(( void *key ));
+
LDAP_END_DECL
#endif /* _LDAP_THREAD_H */
sprops[j].key.bv_len )) continue;
if ( sprops[j].ival ) {
int v;
- if ( props[i][sprops[j].key.bv_len] != '=' ) continue;
- if ( !isdigit( props[i][sprops[j].key.bv_len+1] )) continue;
- v = atoi( props[i]+sprops[j].key.bv_len+1 );
+ char *next = NULL;
+ if ( !isdigit( props[i][sprops[j].key.bv_len] )) continue;
+ v = strtoul( &props[i][sprops[j].key.bv_len], &next, 10 );
+ if ( next == NULL || next[ 0 ] != '\0' ) continue;
switch( sprops[j].ival ) {
case GOT_MINSSF:
min_ssf = v; got_min_ssf++; break;
* v3ref = flag for V3 referral / search reference
* 0 = not a ref, 1 = sucessfully chased ref, -1 = pass ref to application
*/
- int v3ref;
+ enum {
+ V3REF_NOREF = 0,
+ V3REF_SUCCESS = 1,
+ V3REF_TOAPP = -1
+ } v3ref;
assert( ld != NULL );
assert( lcp != NULL );
* This code figures out if we are going to chase a
* referral / search reference, or pass it back to the application
*/
- v3ref = 0; /* Assume not a V3 search reference or referral */
+ v3ref = V3REF_NOREF; /* Assume not a V3 search reference/referral */
if( (tag != LDAP_RES_SEARCH_ENTRY) && (ld->ld_version > LDAP_VERSION2) ) {
BerElement tmpber = *ber; /* struct copy */
char **refs = NULL;
- if( tag == LDAP_RES_SEARCH_REFERENCE) {
+ if( tag == LDAP_RES_SEARCH_REFERENCE ) {
/* This is a V3 search reference */
- /* Assume we do not chase the reference, but pass it to application */
- v3ref = -1;
+ /* Assume we do not chase the reference,
+ * but pass it to application */
+ v3ref = V3REF_TOAPP;
if( LDAP_BOOL_GET(&ld->ld_options, LDAP_BOOL_REFERRALS) ||
(lr->lr_parent != NULL) )
{
if ( ber_scanf( &tmpber, "{v}", &refs ) == LBER_ERROR ) {
rc = LDAP_DECODING_ERROR;
} else {
- /* Note: refs arrary is freed by ldap_chase_v3referrals */
+ /* Note: refs array is freed by ldap_chase_v3referrals */
refer_cnt = ldap_chase_v3referrals( ld, lr, refs,
1, &lr->lr_res_error, &hadref );
- if ( refer_cnt > 0 ) { /* sucessfully chased reference */
+ if ( refer_cnt > 0 ) {
+ /* sucessfully chased reference */
/* If haven't got end search, set chasing referrals */
if( lr->lr_status != LDAP_REQST_COMPLETED) {
lr->lr_status = LDAP_REQST_CHASINGREFS;
Debug( LDAP_DEBUG_TRACE,
- "read1msg: search ref chased, mark request chasing refs, id = %d\n",
- lr->lr_msgid, 0, 0);
+ "read1msg: search ref chased, "
+ "mark request chasing refs, "
+ "id = %d\n",
+ lr->lr_msgid, 0, 0);
}
- v3ref = 1; /* We sucessfully chased the reference */
+
+ /* We sucessfully chased the reference */
+ v3ref = V3REF_SUCCESS;
}
}
}
/* Check if V3 referral */
if ( ber_peek_tag( &tmpber, &len ) == LDAP_TAG_REFERRAL ) {
/* We have a V3 referral, assume we cannot chase it */
- v3ref = -1;
+ v3ref = V3REF_TOAPP;
if( LDAP_BOOL_GET(&ld->ld_options, LDAP_BOOL_REFERRALS)
|| (lr->lr_parent != NULL) )
{
- v3ref = -1; /* Assume referral not chased and return it to app */
+ /* Assume referral not chased and return it to app */
+ v3ref = V3REF_TOAPP;
+
/* Get the referral list */
if( ber_scanf( &tmpber, "{v}", &refs) == LBER_ERROR) {
rc = LDAP_DECODING_ERROR;
"read1msg: referral chased, mark request completed, id = %d\n",
lr->lr_msgid, 0, 0);
if( refer_cnt > 0) {
- v3ref = 1; /* Referral successfully chased */
+ /* Referral successfully chased */
+ v3ref = V3REF_SUCCESS;
}
}
}
* go through the following code. This code also chases V2 referrals
* and checks if all referrals have been chased.
*/
- if ( (tag != LDAP_RES_SEARCH_ENTRY) && (v3ref > -1) &&
+ if ( (tag != LDAP_RES_SEARCH_ENTRY) && (v3ref != V3REF_TOAPP) &&
(tag != LDAP_RES_INTERMEDIATE ))
{
/* For a v3 search referral/reference, only come here if already chased it */
char *lr_res_error = NULL;
tmpber = *ber; /* struct copy */
- if ( v3ref == 1 ) {
+ if ( v3ref == V3REF_SUCCESS ) {
/* V3 search reference or V3 referral
* sucessfully chased. If this message
* is a search result, then it has no more
} else {
lr->lr_res_error = lr_res_error;
}
+ lr_res_error = NULL;
}
- if ( lderr != LDAP_SUCCESS ) {
+ switch ( lderr ) {
+ case LDAP_SUCCESS:
+ case LDAP_COMPARE_TRUE:
+ case LDAP_COMPARE_FALSE:
+ break;
+
+ default:
+ if ( lr->lr_res_error == NULL
+ || lr->lr_res_error[ 0 ] == '\0' )
+ {
+ break;
+ }
+
/* referrals are in error string */
refer_cnt = ldap_chase_referrals( ld, lr,
&lr->lr_res_error, -1, &hadref );
lr->lr_status = LDAP_REQST_COMPLETED;
Debug( LDAP_DEBUG_TRACE,
- "read1msg: V2 referral chased, mark request completed, id = %d\n", lr->lr_msgid, 0, 0);
+ "read1msg: V2 referral chased, "
+ "mark request completed, id = %d\n",
+ lr->lr_msgid, 0, 0 );
+ break;
}
/* save errno, message, and matched string */
static void *ldap_int_thread_pool_wrapper( void *pool );
+static ldap_pvt_thread_t ldap_int_main_tid;
+
+static ldap_int_thread_key_t ldap_int_main_thrctx[LDAP_MAXTHR];
+
int
ldap_int_thread_pool_startup ( void )
{
+ ldap_int_main_tid = ldap_pvt_thread_self();
+
return ldap_pvt_thread_mutex_init(&ldap_pvt_thread_pool_mutex);
}
int i, hash;
tid = ldap_pvt_thread_self();
+ if ( TID_EQ( tid, ldap_int_main_tid ))
+ return ldap_int_main_thrctx;
TID_HASH( tid, hash );
for (i = hash & (LDAP_MAXTHR-1); !TID_EQ(thread_keys[i].id, tid_zero) &&
return thread_keys[i].ctx;
}
+void ldap_pvt_thread_pool_context_reset( void *vctx )
+{
+ ldap_int_thread_key_t *ctx = vctx;
+ int i;
+
+ for ( i=0; i<MAXKEYS && ctx[i].ltk_key; i++) {
+ if ( ctx[i].ltk_free )
+ ctx[i].ltk_free( ctx[i].ltk_key, ctx[i].ltk_data );
+ ctx[i].ltk_key = NULL;
+ }
+}
#endif /* LDAP_THREAD_HAVE_TPOOL */
}
#ifdef SLAPD_CLEARTEXT
+ /* Do we think there is a scheme specifier here that we
+ * didn't recognize? Assume a scheme name is at least 1 character.
+ */
+ if (( passwd->bv_val[0] == '{' ) &&
+ ( strchr( passwd->bv_val, '}' ) > passwd->bv_val+1 ))
+ return 1;
if( is_allowed_scheme("{CLEARTEXT}", schemes ) ) {
- return (( passwd->bv_len == cred->bv_len ) &&
- ( passwd->bv_val[0] != '{' /*'}'*/ ))
- ? memcmp( passwd->bv_val, cred->bv_val, passwd->bv_len )
+ return ( passwd->bv_len == cred->bv_len ) ?
+ memcmp( passwd->bv_val, cred->bv_val, passwd->bv_len )
: 1;
}
#endif
#define ACI_BUF_SIZE 1024 /* use most appropriate size */
+#ifdef SLAP_DYNACL
+static
+#endif /* SLAP_DYNACL */
+AttributeDescription *slap_ad_aci;
+
+static int
+OpenLDAPaciValidate(
+ Syntax *syntax,
+ struct berval *val );
+
+static int
+OpenLDAPaciPretty(
+ Syntax *syntax,
+ struct berval *val,
+ struct berval *out,
+ void *ctx );
+
+static int
+OpenLDAPaciNormalize(
+ slap_mask_t use,
+ Syntax *syntax,
+ MatchingRule *mr,
+ struct berval *val,
+ struct berval *out,
+ void *ctx );
+
+#define OpenLDAPaciMatch octetStringMatch
+
static int
aci_list_map_rights(
struct berval *list )
}
switch ( *bv.bv_val ) {
+ case 'x':
+ /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not
+ * define any equivalent to the AUTH right, so I've just used
+ * 'x' for now.
+ */
+ ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
+ break;
+ case 'd':
+ /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines
+ * the right 'd' to mean "delete"; we hijack it to mean
+ * "disclose" for consistency wuith the rest of slapd.
+ */
+ ACL_PRIV_SET(mask, ACL_PRIV_DISCLOSE);
+ break;
case 'c':
ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
break;
case 'w':
ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
break;
- case 'x':
- /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not
- * define any equivalent to the AUTH right, so I've just used
- * 'x' for now.
- */
- ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
- break;
default:
break;
}
const char *text;
int rc;
- /* format of string is "group/objectClassValue/groupAttrName" */
+ /* format of string is "{group|role}/objectClassValue/groupAttrName" */
if ( acl_get_part( subj, 0, '/', &subjdn ) < 0 ) {
return 0;
}
slap_access_t *deny,
slap_aci_scope_t asserted_scope )
{
- struct berval bv, scope, perms, type, sdn;
+ struct berval bv,
+ scope,
+ perms,
+ type,
+ opts,
+ sdn;
int rc;
sdn.bv_val = type.bv_val + type.bv_len + STRLENOF( "#" );
sdn.bv_len = aci->bv_len - ( sdn.bv_val - aci->bv_val );
+ /* get the type options, if any */
+ if ( acl_get_part( &type, 1, '/', &opts ) > 0 ) {
+ opts.bv_len = type.bv_len - ( opts.bv_val - type.bv_val );
+ type.bv_len = opts.bv_val - type.bv_val - 1;
+
+ } else {
+ BER_BVZERO( &opts );
+ }
+
if ( ber_bvcmp( &aci_bv[ ACI_BV_ACCESS_ID ], &type ) == 0 ) {
return dn_match( &op->o_ndn, &sdn );
return rc;
} else if ( ber_bvcmp( &aci_bv[ ACI_BV_GROUP ], &type ) == 0 ) {
- if ( aci_group_member( &sdn, &aci_bv[ ACI_BV_GROUP_CLASS ],
- &aci_bv[ ACI_BV_GROUP_ATTR ], op, e, nmatch, matches ) )
+ struct berval oc,
+ at;
+
+ if ( BER_BVISNULL( &opts ) ) {
+ oc = aci_bv[ ACI_BV_GROUP_CLASS ];
+ at = aci_bv[ ACI_BV_GROUP_ATTR ];
+
+ } else {
+ if ( acl_get_part( &opts, 0, '/', &oc ) < 0 ) {
+ assert( 0 );
+ }
+
+ if ( acl_get_part( &opts, 1, '/', &at ) < 0 ) {
+ at = aci_bv[ ACI_BV_GROUP_ATTR ];
+ }
+ }
+
+ if ( aci_group_member( &sdn, &oc, &at, op, e, nmatch, matches ) )
{
return 1;
}
} else if ( ber_bvcmp( &aci_bv[ ACI_BV_ROLE ], &type ) == 0 ) {
- if ( aci_group_member( &sdn, &aci_bv[ ACI_BV_ROLE_CLASS ],
- &aci_bv[ ACI_BV_ROLE_ATTR ], op, e, nmatch, matches ) )
+ struct berval oc,
+ at;
+
+ if ( BER_BVISNULL( &opts ) ) {
+ oc = aci_bv[ ACI_BV_ROLE_CLASS ];
+ at = aci_bv[ ACI_BV_ROLE_ATTR ];
+
+ } else {
+ if ( acl_get_part( &opts, 0, '/', &oc ) < 0 ) {
+ assert( 0 );
+ }
+
+ if ( acl_get_part( &opts, 1, '/', &at ) < 0 ) {
+ at = aci_bv[ ACI_BV_ROLE_ATTR ];
+ }
+ }
+
+ if ( aci_group_member( &sdn, &oc, &at, op, e, nmatch, matches ) )
{
return 1;
}
if ( acl_match_set( &sdn, op, e, 1 ) ) {
return 1;
}
+
+ } else {
+ /* it passed normalization! */
+ assert( 0 );
}
return 0;
}
+int
+aci_init( void )
+{
+ /* OpenLDAP Experimental Syntax */
+ static slap_syntax_defs_rec aci_syntax_def = {
+ "( 1.3.6.1.4.1.4203.666.2.1 DESC 'OpenLDAP Experimental ACI' )",
+ SLAP_SYNTAX_HIDE,
+ OpenLDAPaciValidate,
+ OpenLDAPaciPretty
+ };
+ static slap_mrule_defs_rec aci_mr_def = {
+ "( 1.3.6.1.4.1.4203.666.4.2 NAME 'OpenLDAPaciMatch' "
+ "SYNTAX 1.3.6.1.4.1.4203.666.2.1 )",
+ SLAP_MR_HIDE | SLAP_MR_EQUALITY, NULL,
+ NULL, OpenLDAPaciNormalize, OpenLDAPaciMatch,
+ NULL, NULL,
+ NULL
+ };
+ static struct {
+ char *name;
+ char *desc;
+ slap_mask_t flags;
+ AttributeDescription **ad;
+ } aci_at = {
+ "OpenLDAPaci", "( 1.3.6.1.4.1.4203.666.1.5 "
+ "NAME 'OpenLDAPaci' "
+ "DESC 'OpenLDAP access control information (experimental)' "
+ "EQUALITY OpenLDAPaciMatch "
+ "SYNTAX 1.3.6.1.4.1.4203.666.2.1 "
+ "USAGE directoryOperation )",
+ SLAP_AT_HIDE,
+ &slap_ad_aci
+ };
+
+ LDAPAttributeType *at;
+ AttributeType *sat;
+ int rc;
+ const char *text;
+
+ /* ACI syntax */
+ rc = register_syntax( &aci_syntax_def );
+ if ( rc != 0 ) {
+ return rc;
+ }
+
+ /* ACI equality rule */
+ rc = register_matching_rule( &aci_mr_def );
+ if ( rc != 0 ) {
+ return rc;
+ }
+
+ /* ACI attribute */
+ at = ldap_str2attributetype( aci_at.desc,
+ &rc, &text, LDAP_SCHEMA_ALLOW_ALL );
+ if ( !at ) {
+ Debug( LDAP_DEBUG_ANY,
+ "%s AttributeType load failed: %s %s\n",
+ aci_at.name, ldap_scherr2str( rc ), text );
+ return rc;
+ }
+
+ rc = at_add( at, 0, &sat, &text );
+ if ( rc != LDAP_SUCCESS ) {
+ ldap_attributetype_free( at );
+ fprintf( stderr, "iMUX_monitor_schema_init: "
+ "AttributeType load failed: %s %s\n",
+ scherr2str( rc ), text );
+ return rc;
+ }
+ ldap_memfree( at );
+
+ rc = slap_str2ad( aci_at.name,
+ aci_at.ad, &text );
+ if ( rc != LDAP_SUCCESS ) {
+ Debug( LDAP_DEBUG_ANY,
+ "unable to find AttributeDescription "
+ "\"%s\": %d (%s)\n",
+ aci_at.name, rc, text );
+ return 1;
+ }
+
+ /* install flags */
+ sat->sat_flags |= aci_at.flags;
+
+ return rc;
+}
+
#ifdef SLAP_DYNACL
/*
* FIXME: there is a silly dependence that makes it difficult
* umbrella, because sets share some helpers with ACIs.
*/
static int
-dynacl_aci_parse( const char *fname, int lineno, slap_style_t sty, const char *right, void **privp )
+dynacl_aci_parse(
+ const char *fname,
+ int lineno,
+ const char *opts,
+ slap_style_t sty,
+ const char *right,
+ void **privp )
{
AttributeDescription *ad = NULL;
const char *text = NULL;
}
} else {
- ad = slap_schema.si_ad_aci;
+ ad = slap_ad_aci;
}
if ( !is_at_syntax( ad->ad_type, SLAPD_ACI_SYNTAX) ) {
int
dynacl_aci_init( void )
{
- return slap_dynacl_register( &dynacl_aci );
+ int rc;
+
+ rc = aci_init();
+
+ if ( rc == 0 ) {
+ rc = slap_dynacl_register( &dynacl_aci );
+ }
+
+ return rc;
}
#endif /* SLAP_DYNACL */
for ( i = 0; i < perms->bv_len; ) {
switch ( perms->bv_val[ i ] ) {
+ case 'x':
+ case 'd':
case 'c':
case 's':
case 'r':
case 'w':
- case 'x':
break;
default:
NULL
};
-int
+static int
OpenLDAPaciValidate(
Syntax *syntax,
struct berval *val )
subject = BER_BVNULL,
nsubject = BER_BVNULL;
int idx,
- rc,
+ rc = LDAP_SUCCESS,
freesubject = 0,
freetype = 0;
char *ptr;
- ( ocbv.bv_val - type.bv_val );
}
- if ( oc_bvfind( &ocbv ) == NULL ) {
+ oc = oc_bvfind( &ocbv );
+ if ( oc == NULL ) {
rc = LDAP_INVALID_SYNTAX;
goto cleanup;
}
return rc;
}
-int
+static int
OpenLDAPaciPretty(
Syntax *syntax,
struct berval *val,
return OpenLDAPaciPrettyNormal( val, out, ctx, 0 );
}
-int
+static int
OpenLDAPaciNormalize(
slap_mask_t use,
Syntax *syntax,
int
acl_init( void )
{
-#ifdef SLAP_DYNACL
- int rc;
+ int rc = 0;
#ifdef SLAPD_ACI_ENABLED
+#ifdef SLAP_DYNACL
rc = dynacl_aci_init();
+#else /* !SLAP_DYNACL */
+ rc = aci_init();
+#endif /* !SLAP_DYNACL */
if ( rc != 0 ) {
return rc;
}
#endif /* SLAPD_ACI_ENABLED */
-#endif /* SLAP_DYNACL */
-
- return 0;
+ return rc;
}
int
#ifdef SLAP_DYNACL
static int
-slap_dynacl_config( const char *fname, int lineno, Access *b, const char *name, slap_style_t sty, const char *right )
+slap_dynacl_config(
+ const char *fname,
+ int lineno,
+ Access *b,
+ const char *name,
+ const char *opts,
+ slap_style_t sty,
+ const char *right )
{
slap_dynacl_t *da, *tmp;
int rc = 0;
*tmp = *da;
if ( tmp->da_parse ) {
- rc = ( *tmp->da_parse )( fname, lineno, sty, right, &tmp->da_private );
+ rc = ( *tmp->da_parse )( fname, lineno, opts, sty, right, &tmp->da_private );
if ( rc ) {
ch_free( tmp );
return rc;
#ifdef SLAP_DYNACL
{
- char *name = NULL;
+ char *name = NULL,
+ *opts = NULL;
if ( strcasecmp( left, "aci" ) == 0 ) {
name = "aci";
} else if ( strncasecmp( left, "dynacl/", STRLENOF( "dynacl/" ) ) == 0 ) {
name = &left[ STRLENOF( "dynacl/" ) ];
+ opts = strchr( name, '/' );
+ if ( opts ) {
+ opts[ 0 ] = '\0';
+ opts++;
+ }
}
if ( name ) {
- if ( slap_dynacl_config( fname, lineno, b, name, sty, right ) ) {
+ if ( slap_dynacl_config( fname, lineno, b, name, opts, sty, right ) ) {
fprintf( stderr, "%s: line %d: "
"unable to configure dynacl \"%s\"\n",
fname, lineno, name );
}
} else {
- b->a_aci_at = slap_schema.si_ad_aci;
+ b->a_aci_at = slap_ad_aci;
}
if( !is_at_syntax( b->a_aci_at->ad_type,
"\t[aci[=<attrname>]]\n"
#endif
#ifdef SLAP_DYNACL
- "\t[dynacl/<name>[.<dynstyle>][=<pattern>]]\n"
+ "\t[dynacl/<name>[
/<options>][.<dynstyle>][=<pattern>]]\n"
#endif /* SLAP_DYNACL */
"\t[ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>]\n",
"<style> ::= exact | regex | base(Object)\n"
/* canonical to upper case */
ldap_pvt_str2upper( desc->ad_cname.bv_val );
+ /* shouldn't we protect this for concurrency? */
desc->ad_type = slap_schema.si_at_undefined;
+ ldap_pvt_thread_mutex_lock( &ad_undef_mutex );
desc->ad_next = desc->ad_type->sat_ad;
desc->ad_type->sat_ad = desc;
+ ldap_pvt_thread_mutex_unlock( &ad_undef_mutex );
}
if( !*ad ) {
tmp = attr_alloc( a->a_desc );
if ( a->a_vals != NULL ) {
- int i;
+ int i;
for ( i = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ ) {
/* EMPTY */ ;
assert( a->a_nvals != NULL );
if ( a->a_nvals != a->a_vals ) {
+ int j;
+
tmp->a_nvals = ch_malloc( (i + 1) * sizeof(struct berval) );
- for ( i = 0; !BER_BVISNULL( &a->a_nvals[i] ); i++ ) {
- ber_dupbv( &tmp->a_nvals[i], &a->a_nvals[i] );
- if ( BER_BVISNULL( &tmp->a_nvals[i] ) ) break;
+ for ( j = 0; !BER_BVISNULL( &a->a_nvals[j] ); j++ ) {
+ assert( j < i );
+ ber_dupbv( &tmp->a_nvals[j], &a->a_nvals[j] );
+ if ( BER_BVISNULL( &tmp->a_nvals[j] ) ) break;
/* FIXME: error? */
}
- BER_BVZERO( &tmp->a_nvals[i] );
+ assert( j == i );
+ BER_BVZERO( &tmp->a_nvals[j] );
} else {
tmp->a_nvals = tmp->a_vals;
}
/* Prev environment had TXN support, get rid of it */
if ( !flags_ok ) {
+ bdb->bi_dbenv->close( bdb->bi_dbenv, 0 );
+ bdb->bi_dbenv = NULL;
+ rc = db_env_create( &bdb->bi_dbenv, 0 );
+ if( rc != 0 ) {
+ Debug( LDAP_DEBUG_ANY,
+ "bdb_db_open: db_env_create failed: %s (%d)\n",
+ db_strerror(rc), rc, 0 );
+ return rc;
+ }
bdb->bi_dbenv->remove( bdb->bi_dbenv, dbhome, 0 );
bdb->bi_dbenv = NULL;
}
bdb_cache_return_entry_r(bdb->bi_dbenv, &bdb->bi_cache, e, &lock);
}
send_ldap_result( op, rs );
- return 1;
+ return rs->sr_err;
}
#endif /* SLAP_ACL_HONOR_DISCLOSE */
/* wait for all other ops to release the connection */
retry_lock:;
- switch ( ldap_pvt_thread_mutex_trylock( &li->conn_mutex ) ) {
- case LDAP_PVT_THREAD_EBUSY:
- default:
+ ldap_pvt_thread_mutex_lock( &li->conn_mutex );
+ if ( lc->lc_refcnt > 1 ) {
+ ldap_pvt_thread_mutex_unlock( &li->conn_mutex );
ldap_pvt_thread_yield();
goto retry_lock;
-
- case 0:
- if ( lc->lc_refcnt > 1 ) {
- ldap_pvt_thread_mutex_unlock( &li->conn_mutex );
- ldap_pvt_thread_yield();
- goto retry_lock;
- }
- break;
}
assert( lc->lc_refcnt == 1 );
if ( rc == LDAP_SUCCESS ) {
LDAPMessage *res = NULL;
int retries = 1;
- struct timeval tv = { 0, 0 };
+ struct timeval tv = { 0, 100000 };
retry:;
rc = ldap_result( ld, msgid, LDAP_MSG_ALL, &tv, &res );
* remote server response */
if ( ERR_OK( rs->sr_err ) ) {
int rc;
- struct timeval tv = { 0, 0 };
+ struct timeval tv = { 0, 100000 };
retry:;
/* if result parsing fails, note the failure reason */
} else {
tv.tv_sec = 0;
+ tv.tv_usec = 100000;
}
if ( op->ors_attrs ) {
op->o_ctrls, NULL, &msgid );
if ( rs->sr_err == LDAP_SUCCESS ) {
LDAPMessage *res;
- struct timeval tv;
+ struct timeval tv = { 0, 100000 };
int rc;
int nretries = mt->mt_nretries;
if ( nretries > 0 ) {
nretries--;
}
+ tv.tv_sec = 0;
+ tv.tv_usec = 100000;
goto retry;
}
rs->sr_err = LDAP_BUSY;
NULL, NULL, &msgid );
if ( rc == LDAP_SUCCESS ) {
LDAPMessage *res;
- struct timeval tv;
+ struct timeval tv = { 0, 100000 };
/*
* handle response!!!
if ( nretries > 0 ) {
nretries--;
}
+ tv.tv_sec = 0;
+ tv.tv_usec = 100000;
goto retry;
}
struct timeval tv = { 0 };
tv.tv_sec = 0;
- tv.tv_usec = 0;
+ tv.tv_usec = 100000; /* 0.1 s */
if ( msgid[ i ] == -1 ) {
continue;
dc.ctx = "searchAttrDN";
while ( ber_scanf( &ber, "{m", &a ) != LBER_ERROR ) {
- int last = 0;
+ int last = 0;
+ slap_syntax_validate_func *validate;
+ slap_syntax_transform_func *pretty;
ldap_back_map( &mi->mi_targets[ target ].mt_rwmap.rwm_at,
&a, &mapped, BACKLDAP_REMAP );
{
attr->a_vals = (struct berval *)&slap_dummy_bv;
- } else if ( attr->a_desc == slap_schema.si_ad_objectClass
+ } else {
+ for ( last = 0; !BER_BVISNULL( &attr->a_vals[ last ] ); ++last )
+ ;
+ }
+
+ validate = attr->a_desc->ad_type->sat_syntax->ssyn_validate;
+ pretty = attr->a_desc->ad_type->sat_syntax->ssyn_pretty;
+
+ if ( !validate && !pretty ) {
+ attr->a_nvals = NULL;
+ attr_free( attr );
+ goto next_attr;
+ }
+
+ if ( attr->a_desc == slap_schema.si_ad_objectClass
|| attr->a_desc == slap_schema.si_ad_structuralObjectClass )
{
- for ( last = 0; !BER_BVISNULL( &attr->a_vals[ last ] ); ++last );
-
for ( bv = attr->a_vals; !BER_BVISNULL( bv ); bv++ ) {
ldap_back_map( &mi->mi_targets[ target ].mt_rwmap.rwm_oc,
bv, &mapped, BACKLDAP_REMAP );
} else if ( attr->a_desc == slap_schema.si_ad_ref ) {
ldap_back_referral_result_rewrite( &dc, attr->a_vals );
+
+ } else {
+ int i;
+
+ for ( i = 0; i < last; i++ ) {
+ struct berval pval;
+ int rc;
+
+ if ( pretty ) {
+ rc = pretty( attr->a_desc->ad_type->sat_syntax,
+ &attr->a_vals[i], &pval, NULL );
+
+ } else {
+ rc = validate( attr->a_desc->ad_type->sat_syntax,
+ &attr->a_vals[i] );
+ }
+
+ if ( pretty ) {
+ LBER_FREE( attr->a_vals[i].bv_val );
+ attr->a_vals[i] = pval;
+ }
+ }
}
if ( last && attr->a_desc->ad_type->sat_equality &&
- attr->a_desc->ad_type->sat_equality->smr_normalize ) {
+ attr->a_desc->ad_type->sat_equality->smr_normalize )
+ {
int i;
attr->a_nvals = ch_malloc( ( last + 1 ) * sizeof( struct berval ) );
*attrp = attr;
attrp = &attr->a_next;
+next_attr:;
}
rs->sr_entry = &ent;
rs->sr_attrs = op->ors_attrs;
return 1;
if ( readit ) {
+ void *thrctx = ldap_pvt_thread_pool_context();
+
op = (Operation *)opbuf;
- connection_fake_init( &conn, op, cfb );
+ connection_fake_init( &conn, op, thrctx );
filter.f_desc = slap_schema.si_ad_objectClass;
op->o_bd = &cfb->cb_db;
rc = op->o_bd->be_search( op, &rs );
- slap_sl_mem_destroy( NULL, op->o_tmpmemctx );
+ ldap_pvt_thread_pool_context_reset( thrctx );
}
cfb->cb_use_ldif = 1;
Operation *op;
slap_callback cb = { NULL, slap_null_cb, NULL, NULL };
SlapReply rs = {REP_RESULT};
+ void *thrctx = NULL;
/* If we read the config from back-ldif, nothing to do here */
if ( cfb->cb_got_ldif )
return 0;
if ( cfb->cb_use_ldif ) {
+ thrctx = ldap_pvt_thread_pool_context();
op = (Operation *)opbuf;
- connection_fake_init( &conn, op, cfb );
+ connection_fake_init( &conn, op, thrctx );
op->o_dn = be->be_rootdn;
op->o_ndn = be->be_rootndn;
}
}
}
- if ( op )
- slap_sl_mem_destroy( NULL, op->o_tmpmemctx );
+ if ( thrctx )
+ ldap_pvt_thread_pool_context_reset( thrctx );
return 0;
}
int is_entry_objectclass(
Entry* e,
ObjectClass *oc,
- int set_flags )
+ unsigned flags )
{
/*
* set_flags should only be true if oc is one of operational
Attribute *attr;
struct berval *bv;
- AttributeDescription *objectClass = slap_schema.si_ad_objectClass;
- assert(!( e == NULL || oc == NULL ));
+ assert( !( e == NULL || oc == NULL ) );
+ assert( ( flags & SLAP_OCF_MASK ) != SLAP_OCF_MASK );
if( e == NULL || oc == NULL ) {
return 0;
}
- if( set_flags && ( e->e_ocflags & SLAP_OC__END )) {
+ if( flags == SLAP_OCF_SET_FLAGS && ( e->e_ocflags & SLAP_OC__END ) )
+ {
/* flags are set, use them */
return (e->e_ocflags & oc->soc_flags & SLAP_OC__MASK) != 0;
}
/*
* find objectClass attribute
*/
- attr = attr_find(e->e_attrs, objectClass);
+ attr = attr_find( e->e_attrs, slap_schema.si_ad_objectClass );
if( attr == NULL ) {
/* no objectClass attribute */
Debug( LDAP_DEBUG_ANY, "is_entry_objectclass(\"%s\", \"%s\") "
for( bv=attr->a_vals; bv->bv_val; bv++ ) {
ObjectClass *objectClass = oc_bvfind( bv );
- if ( !set_flags && objectClass == oc ) {
- return 1;
+ if ( objectClass == NULL ) {
+ /* FIXME: is this acceptable? */
+ continue;
}
-
- if ( objectClass != NULL ) {
- e->e_ocflags |= objectClass->soc_flags;
+
+ if ( !( flags & SLAP_OCF_SET_FLAGS ) ) {
+ if ( objectClass == oc ) {
+ return 1;
+ }
+
+ if ( ( flags & SLAP_OCF_CHECK_SUP )
+ && is_object_subclass( oc, objectClass ) )
+ {
+ return 1;
+ }
}
+
+ e->e_ocflags |= objectClass->soc_flags;
}
/* mark flags as set */
e->e_ocflags |= SLAP_OC__END;
- return (e->e_ocflags & oc->soc_flags & SLAP_OC__MASK) != 0;
+ return ( e->e_ocflags & oc->soc_flags & SLAP_OC__MASK ) != 0;
}
AC_MEMCPY( oc->soc_cname.bv_val, ocname->bv_val, ocname->bv_len );
LDAP_STAILQ_NEXT( oc, soc_next ) = NULL;
+ ldap_pvt_thread_mutex_lock( &oc_undef_mutex );
LDAP_STAILQ_INSERT_HEAD( &oc_undef_list, oc, soc_next );
+ ldap_pvt_thread_mutex_unlock( &oc_undef_mutex );
return oc;
}
rwm.c rwmconf.c rwmdn.c rwmmap.c \
syncprov.c \
translucent.c \
- unique.c
+ unique.c \
+ valsort.c
OBJS = overlays.o \
@SLAPD_STATIC_OVERLAYS@
+# Add here the objs that are needed by overlays, but do not make it
+# into SLAPD_STATIC_OVERLAYS...
+OBJDEP=rwm.o rwmconf.o rwmdn.o rwmmap.o
+
LTONLY_MOD = $(LTONLY_mod)
LDAP_INCDIR= ../../../include
LDAP_LIBDIR= ../../../libraries
unique.la : unique.lo
$(LTLINK_MOD) -module -o $@ unique.lo version.lo $(LINK_LIBS)
+valsort.la : valsort.lo
+ $(LTLINK_MOD) -module -o $@ valsort.lo version.lo $(LINK_LIBS)
+
install-local: $(PROGRAMS)
@if test -n "$?" ; then \
$(MKDIR) $(DESTDIR)$(moduledir); \
# Must fixup depends for non-libtool objects
depend-local:
@if test -n "$(OBJS)"; then \
- OBJ2=`echo $(OBJS) | $(SED) -e 's/\.o//g'`; \
+ OBJ2=`echo $(OBJS) $(OBJDEP) | $(SED) -e 's/\.o//g'`; \
SCR=''; for i in $$OBJ2; do SCR="$$SCR -e s/^$$i.lo:/$$i.o:/"; done; \
mv Makefile Makefile.bak; $(SED) $$SCR Makefile.bak > Makefile && \
$(RM) Makefile.bak; fi
#if SLAPD_OVER_UNIQUE == SLAPD_MOD_STATIC
extern int unique_init();
#endif
+#if SLAPD_OVER_VALSORT == SLAPD_MOD_STATIC
+extern int valsort_init();
+#endif
static struct {
char *name;
#endif
#if SLAPD_OVER_UNIQUE == SLAPD_MOD_STATIC
{ "Attribute Uniqueness", unique_init },
+#endif
+#if SLAPD_OVER_VALSORT == SLAPD_MOD_STATIC
+ { "Value Sorting", valsort_init },
#endif
{ NULL, NULL }
};
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
* Copyright 2004-2005 The OpenLDAP Foundation.
- * Portions Copyright 2004 Howard Chu, Symas Corporation.
+ * Portions Copyright 2004-2005 Howard Chu, Symas Corporation.
* Portions Copyright 2004 Hewlett-Packard Company.
* All rights reserved.
*
#include "portable.h"
/* This file implements "Password Policy for LDAP Directories",
- * based on draft behera-ldap-password-policy-08
+ * based on draft behera-ldap-password-policy-09
*/
#ifdef SLAPD_OVER_PPOLICY
"EQUALITY generalizedTimeMatch "
"ORDERING generalizedTimeOrderingMatch "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
- "SINGLE-VALUE USAGE directoryOperation NO-USER-MODIFICATION )",
+ "SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
&ad_pwdChangedTime },
{ "( 1.3.6.1.4.1.42.2.27.8.1.17 "
"NAME ( 'pwdAccountLockedTime' ) "
"EQUALITY generalizedTimeMatch "
"ORDERING generalizedTimeOrderingMatch "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
- "SINGLE-VALUE USAGE directoryOperation )",
+ "SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
&ad_pwdAccountLockedTime },
{ "( 1.3.6.1.4.1.42.2.27.8.1.19 "
"NAME ( 'pwdFailureTime' ) "
"EQUALITY generalizedTimeMatch "
"ORDERING generalizedTimeOrderingMatch "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
- "USAGE directoryOperation )",
+ "NO-USER-MODIFICATION USAGE directoryOperation )",
&ad_pwdFailureTime },
{ "( 1.3.6.1.4.1.42.2.27.8.1.20 "
"NAME ( 'pwdHistory' ) "
"DESC 'The history of users passwords' "
"EQUALITY octetStringMatch "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 "
- "USAGE directoryOperation NO-USER-MODIFICATION )",
+ "NO-USER-MODIFICATION USAGE directoryOperation )",
&ad_pwdHistory },
{ "( 1.3.6.1.4.1.42.2.27.8.1.21 "
"NAME ( 'pwdGraceUseTime' ) "
"DESC 'The timestamps of the grace login once the password has expired' "
"EQUALITY generalizedTimeMatch "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
- "USAGE directoryOperation NO-USER-MODIFICATION )",
+ "NO-USER-MODIFICATION USAGE directoryOperation )",
&ad_pwdGraceUseTime },
{ "( 1.3.6.1.4.1.42.2.27.8.1.22 "
"NAME ( 'pwdReset' ) "
"DESC 'The pwdPolicy subentry in effect for this object' "
"EQUALITY distinguishedNameMatch "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 "
- "SINGLE-VALUE USAGE directoryOperation )",
+ "SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation )",
&ad_pwdPolicySubentry },
{ NULL, NULL }
};
scherr2str(code), err );
return code;
}
+ /* Allow Manager to set these as needed */
+ if ( is_at_no_user_mod( (*pwd_OpSchema[i].ad)->ad_type )) {
+ (*pwd_OpSchema[i].ad)->ad_type->sat_flags |=
+ SLAP_AT_MANAGEABLE;
+ }
}
code = register_supported_control( LDAP_CONTROL_PASSWORDPOLICYREQUEST,
static AttributeDescription *ad_errText;
static AttributeDescription *ad_errOp;
static AttributeDescription *ad_errSleepTime;
+static ObjectClass *oc_errAbsObject;
static ObjectClass *oc_errObject;
+static ObjectClass *oc_errAuxObject;
typedef enum retcode_op_e {
SN_DG_OP_NONE = 0x0000,
typedef struct retcode_cb_t {
unsigned rdc_flags;
ber_tag_t rdc_tag;
+ AttributeName *rdc_attrs;
} retcode_cb_t;
static int
int rc;
op->o_tag = rdc->rdc_tag;
+ if ( op->o_tag == LDAP_REQ_SEARCH ) {
+ rs->sr_attrs = rdc->rdc_attrs;
+ }
rc = retcode_entry_response( op, rs, rs->sr_entry );
op->o_tag = o_tag;
op2.ors_attrsonly = 0;
op2.ors_attrs = slap_anlist_all_attributes;
- ber_str2bv_x( "(objectClass=errObject)", STRLENOF( "(objectClass=errObject)" ),
+ ber_str2bv_x( "(objectClass=errAbsObject)",
+ STRLENOF( "(objectClass=errAbsObject)" ),
1, &op2.ors_filterstr, op2.o_tmpmemctx );
op2.ors_filter = str2filter_x( &op2, op2.ors_filterstr.bv_val );
op2.o_bd = &db;
rdc.rdc_flags = RETCODE_FINDIR;
+ if ( op->o_tag == LDAP_REQ_SEARCH ) {
+ rdc.rdc_attrs = op->ors_attrs;
+ }
rdc.rdc_tag = op->o_tag;
sc.sc_response = retcode_cb_response;
sc.sc_private = &rdc;
send_ldap_result( op, rs );
if ( rs->sr_ref != NULL ) {
ber_bvarray_free( rs->sr_ref );
+ rs->sr_ref = NULL;
}
rs->sr_matched = NULL;
rs->sr_text = NULL;
return SLAP_CB_CONTINUE;
}
- if ( !is_entry_objectclass( e, oc_errObject, 0 ) ) {
+ if ( !is_entry_objectclass_or_sub( e, oc_errAbsObject ) ) {
return SLAP_CB_CONTINUE;
}
char *desc;
ObjectClass **oc;
} retcode_oc[] = {
- { "errObject", "( 1.3.6.1.4.1.4203.666.11.4.3.1 "
- "NAME ( 'errObject' ) "
- "SUP top STRUCTURAL "
+ { "errAbsObject", "( 1.3.6.1.4.1.4203.666.11.4.3.0 "
+ "NAME ( 'errAbsObject' ) "
+ "SUP top ABSTRACT "
"MUST ( errCode ) "
"MAY ( "
"cn "
"$ errText "
"$ errSleepTime "
") )",
+ &oc_errAbsObject },
+ { "errObject", "( 1.3.6.1.4.1.4203.666.11.4.3.1 "
+ "NAME ( 'errObject' ) "
+ "SUP errAbsObject STRUCTURAL "
+ ")",
&oc_errObject },
+ { "errAuxObject", "( 1.3.6.1.4.1.4203.666.11.4.3.2 "
+ "NAME ( 'errAuxObject' ) "
+ "SUP errAbsObject AUXILIARY "
+ ")",
+ &oc_errAuxObject },
{ NULL }
};
if ( rc != LDAP_SUCCESS ) {
fprintf( stderr,
"%s: line %d: destination attributeType '%s': %d (%s)\n",
- fname, lineno, src, rc, text ? text : "null" );
+ fname, lineno, dst, rc, text ? text : "null" );
return 1;
}
}
return rc;
}
-/* Cheating - we have no thread pool context for these functions,
- * so make one.
- */
-typedef struct thread_keys {
- void *key;
- void *data;
- ldap_pvt_thread_pool_keyfree_t *xfree;
-} thread_keys;
-
-#define MAXKEYS 32
-/* A fake thread context */
-static thread_keys thrctx[MAXKEYS];
-
/* ITS#3456 we cannot run this search on the main thread, must use a
* child thread in order to insure we have a big enough stack.
*/
Entry *e;
Attribute *a;
int rc;
+ void *thrctx = NULL;
if ( slapMode & SLAP_TOOL_MODE ) {
return 0;
return rc;
}
+ thrctx = ldap_pvt_thread_pool_context();
connection_fake_init( &conn, op, thrctx );
op->o_bd = be;
op->o_dn = be->be_rootdn;
out:
op->o_bd->bd_info = (BackendInfo *)on;
+ ldap_pvt_thread_pool_context_reset( thrctx );
return 0;
}
char opbuf[OPERATION_BUFFER_SIZE];
Operation *op = (Operation *)opbuf;
SlapReply rs = {REP_RESULT};
+ void *thrctx;
+ thrctx = ldap_pvt_thread_pool_context();
connection_fake_init( &conn, op, thrctx );
op->o_bd = be;
op->o_dn = be->be_rootdn;
op->o_ndn = be->be_rootndn;
syncprov_checkpoint( op, &rs, on );
- }
- for ( i=0; thrctx[i].key; i++) {
- if ( thrctx[i].xfree )
- thrctx[i].xfree( thrctx[i].key, thrctx[i].data );
- thrctx[i].key = NULL;
+ ldap_pvt_thread_pool_context_reset( thrctx );
}
return 0;
slap_access_t *grant,
slap_access_t *deny,
slap_aci_scope_t scope));
-LDAP_SLAPD_F (int) OpenLDAPaciValidate LDAP_P((
- Syntax *syn, struct berval *in ));
-LDAP_SLAPD_F (int) OpenLDAPaciPretty LDAP_P((
- Syntax *syn, struct berval *val, struct berval *out, void *ctx ));
-LDAP_SLAPD_F (slap_mr_normalize_func) OpenLDAPaciNormalize;
#ifdef SLAP_DYNACL
LDAP_SLAPD_F (int) dynacl_aci_init LDAP_P(( void ));
-#endif /* SLAP_DYNACL */
+#else /* !SLAP_DYNACL */
+LDAP_SLAPD_F (int) aci_init LDAP_P(( void ));
+LDAP_SLAPD_V (AttributeDescription *) slap_ad_aci;
+#endif /* !SLAP_DYNACL */
#endif /* SLAPD_ACI_ENABLED */
/*
ObjectClass *sub ));
LDAP_SLAPD_F (int) is_entry_objectclass LDAP_P((
- Entry *, ObjectClass *oc, int set_flags ));
+ Entry *, ObjectClass *oc, unsigned flags ));
+#define is_entry_objectclass_or_sub(e,oc) \
+ (is_entry_objectclass((e),(oc),SLAP_OCF_CHECK_SUP))
#define is_entry_alias(e) \
(((e)->e_ocflags & SLAP_OC__END) \
? (((e)->e_ocflags & SLAP_OC_ALIAS) != 0) \
- : is_entry_objectclass((e), slap_schema.si_oc_alias, 1))
+ : is_entry_objectclass((e), slap_schema.si_oc_alias, SLAP_OCF_SET_FLAGS))
#define is_entry_referral(e) \
(((e)->e_ocflags & SLAP_OC__END) \
? (((e)->e_ocflags & SLAP_OC_REFERRAL) != 0) \
- : is_entry_objectclass((e), slap_schema.si_oc_referral, 1))
+ : is_entry_objectclass((e), slap_schema.si_oc_referral, SLAP_OCF_SET_FLAGS))
#define is_entry_subentry(e) \
(((e)->e_ocflags & SLAP_OC__END) \
? (((e)->e_ocflags & SLAP_OC_SUBENTRY) != 0) \
- : is_entry_objectclass((e), slap_schema.si_oc_subentry, 1))
+ : is_entry_objectclass((e), slap_schema.si_oc_subentry, SLAP_OCF_SET_FLAGS))
#define is_entry_collectiveAttributeSubentry(e) \
(((e)->e_ocflags & SLAP_OC__END) \
? (((e)->e_ocflags & SLAP_OC_COLLECTIVEATTRIBUTESUBENTRY) != 0) \
- : is_entry_objectclass((e), slap_schema.si_oc_collectiveAttributeSubentry, 1))
+ : is_entry_objectclass((e), slap_schema.si_oc_collectiveAttributeSubentry, SLAP_OCF_SET_FLAGS))
#define is_entry_dynamicObject(e) \
(((e)->e_ocflags & SLAP_OC__END) \
? (((e)->e_ocflags & SLAP_OC_DYNAMICOBJECT) != 0) \
- : is_entry_objectclass((e), slap_schema.si_oc_dynamicObject, 1))
+ : is_entry_objectclass((e), slap_schema.si_oc_dynamicObject, SLAP_OCF_SET_FLAGS))
#define is_entry_glue(e) \
(((e)->e_ocflags & SLAP_OC__END) \
? (((e)->e_ocflags & SLAP_OC_GLUE) != 0) \
- : is_entry_objectclass((e), slap_schema.si_oc_glue, 1))
+ : is_entry_objectclass((e), slap_schema.si_oc_glue, SLAP_OCF_SET_FLAGS))
#define is_entry_syncProviderSubentry(e) \
(((e)->e_ocflags & SLAP_OC__END) \
? (((e)->e_ocflags & SLAP_OC_SYNCPROVIDERSUBENTRY) != 0) \
- : is_entry_objectclass((e), slap_schema.si_oc_syncProviderSubentry, 1))
+ : is_entry_objectclass((e), slap_schema.si_oc_syncProviderSubentry, SLAP_OCF_SET_FLAGS))
#define is_entry_syncConsumerSubentry(e) \
(((e)->e_ocflags & SLAP_OC__END) \
? (((e)->e_ocflags & SLAP_OC_SYNCCONSUMERSUBENTRY) != 0) \
- : is_entry_objectclass((e), slap_schema.si_oc_syncConsumerSubentry, 1))
+ : is_entry_objectclass((e), slap_schema.si_oc_syncConsumerSubentry, SLAP_OCF_SET_FLAGS))
LDAP_SLAPD_F (int) oc_schema_info( Entry *e );
LDAP_SLAPD_F (void) oc_unparse LDAP_P((
LDAP_SLAPD_F( slap_mr_indexer_func ) octetStringIndexer;
LDAP_SLAPD_F( slap_mr_filter_func ) octetStringFilter;
+
LDAP_SLAPD_F( int ) numericoidValidate LDAP_P((
struct slap_syntax *syntax,
struct berval *in ));
+LDAP_SLAPD_F( int ) octetStringMatch LDAP_P((
+ int *matchp,
+ slap_mask_t flags,
+ Syntax *syntax,
+ MatchingRule *mr,
+ struct berval *value,
+ void *assertedValue ));
/*
* schema_prep.c
LDAP_SLAPD_V (ldap_pvt_thread_mutex_t) gmtime_mutex;
#endif
+LDAP_SLAPD_V (ldap_pvt_thread_mutex_t) ad_undef_mutex;
+LDAP_SLAPD_V (ldap_pvt_thread_mutex_t) oc_undef_mutex;
+
LDAP_SLAPD_V (ber_socket_t) dtblsize;
LDAP_SLAPD_V (int) use_reverse_lookup;
int finish = 0;
if ( rs->sr_attrs == NULL ) {
- /* all attrs request, skip operational attributes */
+ /* all user attrs request, skip operational attributes */
if( is_at_operational( desc->ad_type ) ) {
continue;
}
/* specific attrs requested */
if ( is_at_operational( desc->ad_type ) ) {
if ( !SLAP_OPATTRS( rs->sr_attr_flags ) &&
- !ad_inlist( desc, rs->sr_attrs ) )
+ !ad_inlist( desc, rs->sr_attrs ) )
{
continue;
}
} else {
- if ( !userattrs && !ad_inlist( desc, rs->sr_attrs ) )
- {
+ if ( !userattrs && !ad_inlist( desc, rs->sr_attrs ) ) {
continue;
}
}
AttributeDescription *desc = a->a_desc;
if ( rs->sr_attrs == NULL ) {
- /* all attrs request, skip operational attributes */
+ /* all user attrs request, skip operational attributes */
if( is_at_operational( desc->ad_type ) ) {
continue;
}
/* specific attrs requested */
if( is_at_operational( desc->ad_type ) ) {
if ( !SLAP_OPATTRS( rs->sr_attr_flags ) &&
- !ad_inlist( desc, rs->sr_attrs ) )
+ !ad_inlist( desc, rs->sr_attrs ) )
{
continue;
}
#ifdef LDAP_CONNECTIONLESS
}
#endif
+ if ( rs->sr_ref != NULL ) {
+ int r;
+
+ for ( r = 0; !BER_BVISNULL( &rs->sr_ref[ r ] ); r++ ) {
+ Statslog( LDAP_DEBUG_STATS2, "%s REF #%d \"%s\"\n",
+ op->o_log_prefix, r, rs->sr_ref[0].bv_val,
+ 0, 0 );
+ }
- Statslog( LDAP_DEBUG_STATS2, "%s REF dn=\"%s\"\n",
- op->o_log_prefix, rs->sr_entry ? rs->sr_entry->e_dn : "(null)",
- 0, 0, 0 );
+ } else {
+ Statslog( LDAP_DEBUG_STATS2, "%s REF \"(null)\"\n",
+ op->o_log_prefix, 0, 0, 0, 0 );
+ }
Debug( LDAP_DEBUG_TRACE, "<= send_search_reference\n", 0, 0, 0 );
#define HASH_Update(c,buf,len) lutil_HASHUpdate(c,buf,len)
#define HASH_Final(d,c) lutil_HASHFinal(d,c)
-#define OpenLDAPaciMatch octetStringMatch
-
/* approx matching rules */
#define directoryStringApproxMatchOID "1.3.6.1.4.1.4203.666.4.4"
#define directoryStringApproxMatch approxMatch
unsigned int index_substr_any_len = SLAP_INDEX_SUBSTR_ANY_LEN_DEFAULT;
unsigned int index_substr_any_step = SLAP_INDEX_SUBSTR_ANY_STEP_DEFAULT;
+ldap_pvt_thread_mutex_t ad_undef_mutex;
+ldap_pvt_thread_mutex_t oc_undef_mutex;
+
static int
inValidate(
Syntax *syntax,
#define certificateValidate sequenceValidate
#endif
-static int
+int
octetStringMatch(
int *matchp,
slap_mask_t flags,
serialNumberAndIssuerValidate,
serialNumberAndIssuerPretty},
-#ifdef SLAPD_ACI_ENABLED
- /* OpenLDAP Experimental Syntaxes */
- {"( 1.3.6.1.4.1.4203.666.2.1 DESC 'OpenLDAP Experimental ACI' )",
- SLAP_SYNTAX_HIDE,
- OpenLDAPaciValidate,
- OpenLDAPaciPretty},
-#endif
-
#ifdef SLAPD_AUTHPASSWD
/* needs updating */
{"( 1.3.6.1.4.1.4203.666.2.2 DESC 'OpenLDAP authPassword' )",
NULL},
#endif
-#ifdef SLAPD_ACI_ENABLED
- {"( 1.3.6.1.4.1.4203.666.4.2 NAME 'OpenLDAPaciMatch' "
- "SYNTAX 1.3.6.1.4.1.4203.666.2.1 )",
- SLAP_MR_HIDE | SLAP_MR_EQUALITY, NULL,
- NULL, OpenLDAPaciNormalize, OpenLDAPaciMatch,
- NULL, NULL,
- NULL},
-#endif
-
{"( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' "
"SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )",
SLAP_MR_EXT, NULL,
mr_destroy();
mru_destroy();
syn_destroy();
+
+ ldap_pvt_thread_mutex_destroy( &ad_undef_mutex );
+ ldap_pvt_thread_mutex_destroy( &oc_undef_mutex );
}
LDAP_STAILQ_ENTRY(slap_object_class) soc_next;
} ObjectClass;
+#define SLAP_OCF_SET_FLAGS 0x1
+#define SLAP_OCF_CHECK_SUP 0x2
+#define SLAP_OCF_MASK (SLAP_OCF_SET_FLAGS|SLAP_OCF_CHECK_SUP)
+
#define SLAP_OC_ALIAS 0x0001
#define SLAP_OC_REFERRAL 0x0002
#define SLAP_OC_SUBENTRY 0x0004
AttributeDescription *si_ad_children;
AttributeDescription *si_ad_saslAuthzTo;
AttributeDescription *si_ad_saslAuthzFrom;
-#ifdef SLAPD_ACI_ENABLED
- AttributeDescription *si_ad_aci;
-#endif /* SLAPD_ACI_ENABLED */
/* dynamic entries */
AttributeDescription *si_ad_entryTtl;
/*
* "dynamic" ACL infrastructure (for ACIs and more)
*/
-typedef int (slap_dynacl_parse)( const char *fname, int lineno, slap_style_t, const char *, void **privp );
-typedef int (slap_dynacl_unparse)( void *priv, struct berval *bv );
-typedef int (slap_dynacl_mask)(
+typedef int (slap_dynacl_parse) LDAP_P(( const char *fname, int lineno,
+ const char *opts, slap_style_t, const char *, void **privp ));
+typedef int (slap_dynacl_unparse) LDAP_P(( void *priv, struct berval *bv ));
+typedef int (slap_dynacl_mask) LDAP_P((
void *priv,
struct slap_op *op,
Entry *e,
int nmatch,
regmatch_t *matches,
slap_access_t *grant,
- slap_access_t *deny );
-typedef int (slap_dynacl_destroy)( void *priv );
+ slap_access_t *deny ));
+typedef int (slap_dynacl_destroy) LDAP_P(( void *priv ));
typedef struct slap_dynacl_t {
char *da_name;
#define sl_addr sl_sa.sa_in_addr
};
-#ifdef SLAPD_MONITOR
/*
* Operation indices
*/
SLAP_OP_EXTENDED,
SLAP_OP_LAST
};
-#endif /* SLAPD_MONITOR */
typedef struct slap_counters_t {
ldap_pvt_thread_mutex_t sc_sent_mutex;
{
struct berval parent_dn;
- dnParent( (struct berval *)&sdn->dn, &parent_dn );
-
- slapi_sdn_set_dn_byval( sdn_parent, parent_dn.bv_val );
+ if ( !(sdn->flag & FLAG_DN) ) {
+ dnParent( (struct berval *)&sdn->ndn, &parent_dn );
+ slapi_sdn_set_ndn_byval( sdn_parent, parent_dn.bv_val );
+ } else {
+ dnParent( (struct berval *)&sdn->dn, &parent_dn );
+ slapi_sdn_set_dn_byval( sdn_parent, parent_dn.bv_val );
+ }
}
void slapi_sdn_get_backend_parent( const Slapi_DN *sdn,
code = syn_add( syn, def, &err );
- ldap_memfree( syn );
-
if ( code ) {
Debug( LDAP_DEBUG_ANY, "Error in register_syntax: %s %s in %s\n",
scherr2str(code), err, def->sd_desc );
+ ldap_syntax_free( syn );
return( -1 );
}
+ ldap_memfree( syn );
+
return( 0 );
}
retcode-item "cn=strongerAuthRequired" 0x08 text="same as strongAuthRequired"
#retcode-item "cn=partialResults" 0x09 "LDAPv2+ (not LDAPv3)"
-retcode-item "cn=referral" 0x0a text="LDAPv3" ref="ldap://:9010"
+retcode-item "cn=referral" 0x0a text="LDAPv3" ref="ldap://:9019"
retcode-item "cn=adminLimitExceeded" 0x0b text="LDAPv3"
retcode-item "cn=unavailableCriticalExtension" 0x0c text="LDAPv3"
retcode-item "cn=confidentialityRequired" 0x0d text="LDAPv3"
AC_unique=unique@BUILD_UNIQUE@
AC_rwm=rwm@BUILD_RWM@
AC_syncprov=syncprov@BUILD_SYNCPROV@
+AC_valsort=valsort@BUILD_VALSORT@
# misc
AC_WITH_SASL=@WITH_SASL@
AC_WITH_TLS=@WITH_TLS@
AC_WITH_MODULES_ENABLED=@WITH_MODULES_ENABLED@
+AC_ACI_ENABLED=aci@SLAPD_ACI_ENABLED@
export AC_bdb AC_hdb AC_ldap AC_ldbm AC_meta AC_monitor AC_relay AC_sql
export AC_glue AC_pcache AC_ppolicy AC_refint AC_retcode AC_rwm AC_unique AC_syncprov
-export AC_translucent AC_WITH_SASL AC_WITH_TLS AC_WITH_MODULES_ENABLED
+export AC_translucent AC_WITH_SASL AC_WITH_TLS AC_WITH_MODULES_ENABLED AC_ACI_ENABLED
+export AC_valsort
if test ! -x ../servers/slapd/slapd ; then
echo "Could not locate slapd(8)"
## A copy of this license is available in the file LICENSE in the
## top-level directory of the distribution or, alternatively, at
## <http://www.OpenLDAP.org/license.html>.
+MONMOD=nomod
if [ x"$MONITORDB" = xyes -o x"$MONITORDB" = xmod ] ; then
MON=monitor
if [ $MONITORDB = mod ] ; then
MONMOD=monitormod
- else
- MONMOD=nomod
fi
else
MON=nomonitor
-e "s/^#${AC_syncprov}#//" \
-e "s/^#${AC_translucent}#//" \
-e "s/^#${AC_unique}#//" \
+ -e "s/^#${AC_valsort}#//" \
-e "s/^#${MON}#//" \
-e "s/^#${MONMOD}#//" \
-e "s/^#${SASL}#//" \
+ -e "s/^#${ACI}#//" \
-e "s;@URI1@;${URI1};" \
-e "s;@URI2@;${URI2};" \
-e "s;@URI3@;${URI3};" \
WITH_SASL=${AC_WITH_SASL-no}
USE_SASL=${SLAPD_USE_SASL-no}
WITHTLS=${AC_WITHTLS-yes}
+ACI=${AC_ACI_ENABLED-acino}
+VALSORT=${AC_valsort-valsortno}
DATADIR=./testdata
PROGDIR=./progs
METACONF=$DATADIR/slapd-meta.conf
METACONF2=$DATADIR/slapd-meta2.conf
GLUELDAPCONF=$DATADIR/slapd-glue-ldap.conf
+ACICONF=$DATADIR/slapd-aci.conf
+VALSORTCONF=$DATADIR/slapd-valsort.conf
CONF1=$TESTDIR/slapd.1.conf
CONF2=$TESTDIR/slapd.2.conf
LDIFTRANSLUCENTADD=$DATADIR/test-translucent-add.ldif
LDIFTRANSLUCENTMERGED=$DATADIR/test-translucent-merged.ldif
LDIFMETA=$DATADIR/test-meta.ldif
+LDIFVALSORT=$DATADIR/test-valsort.ldif
SQLADD=$DATADIR/sql-add.ldif
MONITOR=""
REFDN="c=US"
TRANSLUCENTPASSWD="bindtest"
METABASEDN="ou=Meta,dc=example,dc=com"
METAMANAGERDN="cn=Manager,$METABASEDN"
+VALSORTDN="cn=Manager,o=valsort"
+VALSORTBASEDN="o=valsort"
LOG1=$TESTDIR/slapd.1.log
LOG2=$TESTDIR/slapd.2.log
LDIFFLT=$TESTDIR/ldif.flt
TESTOUT=$TESTDIR/test.out
INITOUT=$TESTDIR/init.out
+VALSORTOUT1=$DATADIR/valsort1.out
+VALSORTOUT2=$DATADIR/valsort2.out
+VALSORTOUT3=$DATADIR/valsort3.out
SERVER1OUT=$TESTDIR/server1.out
SERVER1FLT=$TESTDIR/server1.flt
METACONCURRENCYOUT=$DATADIR/metaconcurrency.out
MANAGEOUT=$DATADIR/manage.out
SUBTREERENAMEOUT=$DATADIR/subtree-rename.out
+ACIOUT=$DATADIR/aci.out
# Just in case we linked the binaries dynamically
LD_LIBRARY_PATH=`pwd`/../libraries:${LD_LIBRARY_PATH} export LD_LIBRARY_PATH
echo -n "Testing incorrect bind (should fail)... "
$LDAPWHOAMI -h $LOCALHOST -p $PORT1 -D "$BINDDN" -w "XXX"
RC=$?
-if test $RC == 0 ; then
+if test $RC = 0 ; then
echo "ldapwhoami should have failed ($RC)!"
test $KILLSERVERS != no && kill -HUP $KILLPIDS
exit $RC
fi
+count=2
if test $RC = 0 ; then
if test $MONITORDB = yes -o $MONITORDB = mod ; then
+ count=3
echo "Using ldapsearch to retrieve the cn=Monitor..."
$LDAPSEARCH -b "cn=Monitor" -s base -h $LOCALHOST -p $PORT1 \
'+extensibleObject' >> $SEARCHOUT 2>&1
echo ">>>>> Test failed"
else
RC=`grep '^dn:' $SEARCHOUT | wc -l`
- if test $RC != 3 ; then
- echo ">>>>> Test failed: expected 3 entries, got" $RC
+ if test $RC != $count ; then
+ echo ">>>>> Test failed: expected $count entries, got" $RC
RC=1
else
echo ">>>>> Test succeeded"
fi
echo "Using ldapadd to populate the database..."
-$LDAPADD -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD < \
+$LDAPADD -D "$MANAGERDN" -h $LOCALHOST -p $PORT1 -w $PASSWD -e manageDIT < \
$LDIFPPOLICY > $TESTOUT 2>&1
RC=$?
if test $RC != 0 ; then
fi
echo "Running slapadd to build empty DN slapd database..."
-$SLAPADD -f $CONF1 -n 3 -l $LDIFEMPTYDN2
+$SLAPADD -f $CONF1 -b "" -l $LDIFEMPTYDN2
RC=$?
if test $RC != 0 ; then
echo "slapadd failed ($RC)!"
projects / openldap / commitdiff