Skip to content
GitLab
Explore
Sign in
Register
Primary navigation
Search or go to…
Project
O
OpenLDAP
Manage
Activity
Members
Labels
Plan
Wiki
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Locked files
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Package registry
Container Registry
Model registry
Operate
Environments
Terraform modules
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Code review analytics
Insights
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Christopher Ng
OpenLDAP
Commits
7be4d566
Commit
7be4d566
authored
22 years ago
by
Kurt Zeilenga
Browse files
Options
Downloads
Patches
Plain Diff
cleanup
parent
14360369
No related branches found
Branches containing commit
No related tags found
Tags containing commit
No related merge requests found
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
servers/slapd/sasl.c
+1
-2
1 addition, 2 deletions
servers/slapd/sasl.c
servers/slapd/saslauthz.c
+23
-21
23 additions, 21 deletions
servers/slapd/saslauthz.c
with
24 additions
and
23 deletions
servers/slapd/sasl.c
+
1
−
2
View file @
7be4d566
...
...
@@ -1562,8 +1562,7 @@ int slap_sasl_getdn( Connection *conn, char *id, int len,
is_dn
=
SET_DN
;
ber_str2bv
(
id
,
len
,
1
,
dn
);
}
else
{
}
else
{
/* convert to u:<username> form */
is_dn
=
SET_U
;
dn
->
bv_val
=
id
;
...
...
This diff is collapsed.
Click to expand it.
servers/slapd/saslauthz.c
+
23
−
21
View file @
7be4d566
...
...
@@ -51,16 +51,17 @@ int slap_sasl_setpolicy( const char *arg )
{
int
rc
=
LDAP_SUCCESS
;
if
(
strcasecmp
(
arg
,
"none"
)
==
0
)
if
(
strcasecmp
(
arg
,
"none"
)
==
0
)
{
authz_policy
=
SASL_AUTHZ_NONE
;
else
if
(
strcasecmp
(
arg
,
"from"
)
==
0
)
}
else
if
(
strcasecmp
(
arg
,
"from"
)
==
0
)
{
authz_policy
=
SASL_AUTHZ_FROM
;
else
if
(
strcasecmp
(
arg
,
"to"
)
==
0
)
}
else
if
(
strcasecmp
(
arg
,
"to"
)
==
0
)
{
authz_policy
=
SASL_AUTHZ_TO
;
else
if
(
strcasecmp
(
arg
,
"both"
)
==
0
)
}
else
if
(
strcasecmp
(
arg
,
"both"
)
==
0
)
{
authz_policy
=
SASL_AUTHZ_FROM
|
SASL_AUTHZ_TO
;
else
}
else
{
rc
=
LDAP_OTHER
;
}
return
rc
;
}
...
...
@@ -292,8 +293,9 @@ static int slap_sasl_regexp( struct berval *in, struct berval *out )
saslname
,
0
,
0
);
#endif
if
((
saslname
==
NULL
)
||
(
nSaslRegexp
==
0
))
if
((
saslname
==
NULL
)
||
(
nSaslRegexp
==
0
))
{
return
(
0
);
}
/* Match the normalized SASL name to the saslregexp patterns */
for
(
reg
=
SaslRegexp
,
i
=
0
;
i
<
nSaslRegexp
;
i
++
,
reg
++
)
{
...
...
@@ -302,8 +304,7 @@ static int slap_sasl_regexp( struct berval *in, struct berval *out )
break
;
}
if
(
i
>=
nSaslRegexp
)
return
(
0
);
if
(
i
>=
nSaslRegexp
)
return
(
0
);
/*
* The match pattern may have been of the form "a(b.*)c(d.*)e" and the
...
...
@@ -379,9 +380,9 @@ static int sasl_sc_smatch( BackendDB *be, Connection *conn, Operation *o,
if
(
dn_match
(
sm
->
dn
,
&
e
->
e_nname
))
{
sm
->
match
=
1
;
return
-
1
;
/* short-circuit the search */
}
else
{
return
1
;
}
return
1
;
}
/*
...
...
@@ -411,12 +412,12 @@ int slap_sasl_match(Connection *conn, struct berval *rule, struct berval *assert
assertDN
->
bv_val
,
rule
->
bv_val
,
0
);
#else
Debug
(
LDAP_DEBUG_TRACE
,
"===>slap_sasl_match: comparing DN %s to rule %s
\n
"
,
assertDN
->
bv_val
,
rule
->
bv_val
,
0
);
"===>slap_sasl_match: comparing DN %s to rule %s
\n
"
,
assertDN
->
bv_val
,
rule
->
bv_val
,
0
);
#endif
rc
=
slap_parseURI
(
rule
,
&
searchbase
,
&
scope
,
&
filter
);
if
(
rc
!=
LDAP_SUCCESS
)
goto
CONCLUDED
;
if
(
rc
!=
LDAP_SUCCESS
)
goto
CONCLUDED
;
/* Massive shortcut: search scope == base */
if
(
scope
==
LDAP_SCOPE_BASE
)
{
...
...
@@ -426,10 +427,11 @@ int slap_sasl_match(Connection *conn, struct berval *rule, struct berval *assert
rc
=
regexec
(
&
reg
,
assertDN
->
bv_val
,
0
,
NULL
,
0
);
regfree
(
&
reg
);
}
if
(
rc
==
0
)
if
(
rc
==
0
)
{
rc
=
LDAP_SUCCESS
;
else
}
else
{
rc
=
LDAP_INAPPROPRIATE_AUTH
;
}
goto
CONCLUDED
;
}
...
...
@@ -468,14 +470,16 @@ int slap_sasl_match(Connection *conn, struct berval *rule, struct berval *assert
scope
,
/*deref=*/
1
,
/*sizelimit=*/
0
,
/*time=*/
0
,
filter
,
/*fstr=*/
NULL
,
/*attrs=*/
NULL
,
/*attrsonly=*/
0
);
if
(
sm
.
match
)
if
(
sm
.
match
)
{
rc
=
LDAP_SUCCESS
;
else
}
else
{
rc
=
LDAP_INAPPROPRIATE_AUTH
;
}
CONCLUDED:
if
(
searchbase
.
bv_len
)
ch_free
(
searchbase
.
bv_val
);
if
(
filter
)
filter_free
(
filter
);
#ifdef NEW_LOGGING
LDAP_LOG
(
TRANSPORT
,
ENTRY
,
"slap_sasl_match: comparison returned %d
\n
"
,
rc
,
0
,
0
);
...
...
@@ -518,14 +522,12 @@ slap_sasl_check_authz( Connection *conn,
rc
=
backend_attribute
(
NULL
,
NULL
,
conn
->
c_sasl_bindop
,
NULL
,
searchDN
,
ad
,
&
vals
);
if
(
rc
!=
LDAP_SUCCESS
)
goto
COMPLETE
;
if
(
rc
!=
LDAP_SUCCESS
)
goto
COMPLETE
;
/* Check if the *assertDN matches any **vals */
for
(
i
=
0
;
vals
[
i
].
bv_val
!=
NULL
;
i
++
)
{
rc
=
slap_sasl_match
(
conn
,
&
vals
[
i
],
assertDN
,
authc
);
if
(
rc
==
LDAP_SUCCESS
)
goto
COMPLETE
;
if
(
rc
==
LDAP_SUCCESS
)
goto
COMPLETE
;
}
rc
=
LDAP_INAPPROPRIATE_AUTH
;
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment