mirror of
https://git.openldap.org/openldap/openldap.git
synced 2026-02-18 18:18:06 -05:00
Sync with HEAD
This commit is contained in:
Kurt Zeilenga
parent
e4f3cd711e
commit
a394cbd2d4
14 changed files with 396 additions and 137 deletions
|
|
@ -63,6 +63,7 @@ int use_tls = 0;
|
|||
int assertctl;
|
||||
char *assertion = NULL;
|
||||
char *authzid = NULL;
|
||||
int manageDIT = 0;
|
||||
int manageDSAit = 0;
|
||||
int noop = 0;
|
||||
int ppolicy = 0;
|
||||
|
|
@ -133,6 +134,9 @@ N_(" [!]chaining[=<resolveBehavior>[/<continuationBehavior>]]\n")
|
|||
N_(" one of \"chainingPreferred\", \"chainingRequired\",\n")
|
||||
N_(" \"referralsPreferred\", \"referralsRequired\"\n")
|
||||
#endif /* LDAP_CONTROL_X_CHAINING_BEHAVIOR */
|
||||
#ifdef LDAP_DEVEL
|
||||
N_(" [!]manageDIT\n")
|
||||
#endif
|
||||
N_(" [!]manageDSAit\n")
|
||||
N_(" [!]noop\n")
|
||||
#ifdef LDAP_CONTROL_PASSWORDPOLICYREQUEST
|
||||
|
|
@ -256,6 +260,20 @@ tool_args( int argc, char **argv )
|
|||
assert( authzid == NULL );
|
||||
authzid = cvalue;
|
||||
|
||||
} else if ( strcasecmp( control, "manageDIT" ) == 0 ) {
|
||||
if( manageDIT ) {
|
||||
fprintf( stderr,
|
||||
"manageDIT control previously specified\n");
|
||||
exit( EXIT_FAILURE );
|
||||
}
|
||||
if( cvalue != NULL ) {
|
||||
fprintf( stderr,
|
||||
"manageDIT: no control value expected\n" );
|
||||
usage();
|
||||
}
|
||||
|
||||
manageDIT = 1 + crit;
|
||||
|
||||
} else if ( strcasecmp( control, "manageDSAit" ) == 0 ) {
|
||||
if( manageDSAit ) {
|
||||
fprintf( stderr,
|
||||
|
|
@ -720,7 +738,12 @@ tool_args( int argc, char **argv )
|
|||
}
|
||||
}
|
||||
if( protocol == LDAP_VERSION2 ) {
|
||||
if( authzid || manageDSAit || noop || ppolicy ) {
|
||||
if( assertctl || authzid || manageDIT || manageDSAit ||
|
||||
#ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
|
||||
chaining ||
|
||||
#endif
|
||||
noop || ppolicy || preread || postread )
|
||||
{
|
||||
fprintf( stderr, "%s: -e/-M incompatible with LDAPv2\n", prog );
|
||||
exit( EXIT_FAILURE );
|
||||
}
|
||||
|
|
@ -968,7 +991,7 @@ void
|
|||
tool_server_controls( LDAP *ld, LDAPControl *extra_c, int count )
|
||||
{
|
||||
int i = 0, j, crit = 0, err;
|
||||
LDAPControl c[9], **ctrls;
|
||||
LDAPControl c[10], **ctrls;
|
||||
|
||||
ctrls = (LDAPControl**) malloc(sizeof(c) + (count+1)*sizeof(LDAPControl*));
|
||||
if ( ctrls == NULL ) {
|
||||
|
|
@ -1014,6 +1037,14 @@ tool_server_controls( LDAP *ld, LDAPControl *extra_c, int count )
|
|||
i++;
|
||||
}
|
||||
|
||||
if ( manageDIT ) {
|
||||
c[i].ldctl_oid = LDAP_CONTROL_MANAGEDIT;
|
||||
BER_BVZERO( &c[i].ldctl_value );
|
||||
c[i].ldctl_iscritical = manageDIT > 1;
|
||||
ctrls[i] = &c[i];
|
||||
i++;
|
||||
}
|
||||
|
||||
if ( manageDSAit ) {
|
||||
c[i].ldctl_oid = LDAP_CONTROL_MANAGEDSAIT;
|
||||
BER_BVZERO( &c[i].ldctl_value );
|
||||
|
|
|
|||
|
|
@ -45,6 +45,7 @@ extern int use_tls;
|
|||
|
||||
extern char *assertion;
|
||||
extern char *authzid;
|
||||
extern int manageDIT;
|
||||
extern int manageDSAit;
|
||||
extern int noop;
|
||||
extern int ppolicy;
|
||||
|
|
|
|||
|
|
@ -170,7 +170,7 @@ main( int argc, char **argv )
|
|||
|
||||
tool_bind( ld );
|
||||
|
||||
if ( assertion || authzid || manageDSAit || noop ) {
|
||||
if ( assertion || authzid || manageDIT || manageDSAit || noop ) {
|
||||
tool_server_controls( ld, NULL, 0 );
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -310,11 +310,11 @@ main( int argc, char **argv )
|
|||
}
|
||||
#endif
|
||||
|
||||
if ( assertion || authzid || manageDSAit || noop || preread || postread
|
||||
if ( assertion || authzid || manageDIT || manageDSAit || noop
|
||||
#ifdef LDAP_GROUP_TRANSACTION
|
||||
|| txn
|
||||
#endif
|
||||
)
|
||||
|| preread || postread )
|
||||
{
|
||||
int err;
|
||||
int i = 0;
|
||||
|
|
|
|||
|
|
@ -9,7 +9,9 @@ output in multiple formats.
|
|||
sdf -2html guide.sdf # generate HTML for release
|
||||
sdf -2txt guide.sdf # generate TXT for release
|
||||
|
||||
More information (and SDF software) can be obtained from the
|
||||
SDF website at:
|
||||
http://www.mincom.com/mtr/sdf/
|
||||
More information about STF can be obtained from the CPAN at:
|
||||
http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html
|
||||
|
||||
SDF itself can be obtained at:
|
||||
http://search.cpan.org/~ianc/sdf-2.001/
|
||||
|
||||
|
|
|
|||
|
|
@ -61,10 +61,12 @@ and
|
|||
.B meta
|
||||
database.
|
||||
This is because operational attributes related to entry creation and
|
||||
modification should not be used, as they could be passed to the target
|
||||
servers, generating an error.
|
||||
The current implementation automatically sets ldapmod to off, so its use
|
||||
is redundant and can be safely omitted.
|
||||
modification should not be proxied, as they could be mistakenly written
|
||||
to the target server(s), generating an error.
|
||||
The current implementation automatically sets lastmod to off, so its use
|
||||
is redundant and should be omitted, because the lastmod directive will
|
||||
be deprecated in the future.
|
||||
|
||||
.TP
|
||||
.B uri <ldapurl>
|
||||
LDAP server to use. Multiple URIs can be set in in a single
|
||||
|
|
@ -75,76 +77,130 @@ call the first server of the list that responds, e.g.
|
|||
\fBuri "ldap://host/ ldap://backup-host"\fP
|
||||
|
||||
The URI list is space- or comma-separated.
|
||||
This statement is mandatory.
|
||||
.\".TP
|
||||
.\".B server <hostport>
|
||||
.\"Obsolete option; same as `uri ldap://<hostport>/'.
|
||||
.TP
|
||||
.B acl-authcDN "<administrative DN for access control purposes>"
|
||||
DN which is used to query the target server for acl checking; it
|
||||
is supposed to have read access on the target server to attributes used
|
||||
on the proxy for acl checking.
|
||||
.HP
|
||||
.hy 0
|
||||
.B acl-bind
|
||||
.B bindmethod=simple|sasl [binddn=<simple DN>] [credentials=<simple password>]
|
||||
.B [saslmech=<SASL mech>] [secprops=<properties>] [realm=<realm>]
|
||||
.B [authcId=<authentication ID>] [authzId=<authorization ID>]
|
||||
.RS
|
||||
Allows to define the parameters of the authentication method that is
|
||||
internally used by the proxy to collect info related to access control.
|
||||
The identity defined by this directive, according to the properties
|
||||
associated to the authentication method, is supposed to have read access
|
||||
on the target server to attributes used on the proxy for ACL checking.
|
||||
The
|
||||
.B secprops
|
||||
field is currently ignored.
|
||||
There is no risk of giving away such values; they are only used to
|
||||
check permissions.
|
||||
.B The acl-authcDN identity is by no means implicitly used by the proxy
|
||||
The default is to use
|
||||
.BR simple ,
|
||||
with empty binddn and credentials,
|
||||
which means that the related operations will be performed anonymously.
|
||||
|
||||
.B This identity is by no means implicitly used by the proxy
|
||||
.B when the client connects anonymously.
|
||||
See the
|
||||
.B idassert-*
|
||||
.B idassert-bind
|
||||
feature instead.
|
||||
.TP
|
||||
.B acl-passwd <password>
|
||||
Password used with the
|
||||
.B
|
||||
acl-authcDN
|
||||
above.
|
||||
.TP
|
||||
.B idassert-authcdn "<administrative DN for proxyAuthz purposes>"
|
||||
DN which is used to propagate the client's identity to the target
|
||||
by means of the proxyAuthz control when the client does not
|
||||
belong to the DIT fragment that is being proxyied by back-ldap.
|
||||
This is useful when operations performed by users bound to another
|
||||
backend are propagated through back-ldap.
|
||||
This requires the entry with
|
||||
.B idassert-authcdn
|
||||
identity on the remote server to have
|
||||
This directive obsoletes
|
||||
.BR acl-authcDN ,
|
||||
and
|
||||
.BR acl-passwd .
|
||||
.RE
|
||||
|
||||
.HP
|
||||
.hy 0
|
||||
.B idassert-bind
|
||||
.B bindmethod=none|simple|sasl [binddn=<simple DN>] [credentials=<simple password>]
|
||||
.B [saslmech=<SASL mech>] [secprops=<properties>] [realm=<realm>]
|
||||
.B [authcId=<authentication ID>] [authzId=<authorization ID>]
|
||||
.B [authz={native|proxyauthz}] [mode=<mode>] [flags=<flags>]
|
||||
.RS
|
||||
Allows to define the parameters of the authentication method that is
|
||||
internally used by the proxy to authorize connections that are
|
||||
authenticated by other databases.
|
||||
The identity defined by this directive, according to the properties
|
||||
associated to the authentication method, is supposed to have auth access
|
||||
on the target server to attributes used on the proxy for authentication
|
||||
and authorization, and to be allowed to authorize the users.
|
||||
This requires to have
|
||||
.B proxyAuthz
|
||||
privileges on a wide set of DNs, e.g.
|
||||
.BR authzTo=dn.subtree:"" ,
|
||||
and the remote server to have
|
||||
.B authz-policy
|
||||
set to
|
||||
set to
|
||||
.B to
|
||||
or
|
||||
or
|
||||
.BR both .
|
||||
See
|
||||
See
|
||||
.BR slapd.conf (5)
|
||||
for details on these statements and for remarks and drawbacks about
|
||||
their usage.
|
||||
.TP
|
||||
.B idassert-passwd <password>
|
||||
Password used with the
|
||||
.B idassert-authcdn
|
||||
above.
|
||||
.TP
|
||||
.B idassert-mode <mode> [<flags>]
|
||||
defines what type of
|
||||
.I identity assertion
|
||||
is used.
|
||||
The supported bindmethods are
|
||||
|
||||
\fBnone|simple|sasl\fP
|
||||
|
||||
where
|
||||
.B none
|
||||
is the default, i.e. no \fIidentity assertion\fP is performed.
|
||||
|
||||
The authz parameter is used to instruct the SASL bind to exploit
|
||||
.B native
|
||||
SASL authorization, if available; since connections are cached,
|
||||
this should only be used when authorizing with a fixed identity
|
||||
(e.g. by means of the
|
||||
.B authzDN
|
||||
or
|
||||
.B authzID
|
||||
parameters).
|
||||
Otherwise, the default
|
||||
.B proxyauthz
|
||||
is used, i.e. the proxyAuthz control is added to all operations.
|
||||
|
||||
The supported modes are:
|
||||
|
||||
\fB<mode> := {legacy|anonymous|none|<id>|self}\fP
|
||||
\fB<mode> := {legacy|anonymous|none|self}\fP
|
||||
|
||||
\fB<flags> := {override}\fP
|
||||
If
|
||||
.B <mode>
|
||||
is not present, and
|
||||
.B authzId
|
||||
is given, the proxy always authorizes that identity.
|
||||
.B <authorization ID>
|
||||
can be
|
||||
|
||||
\fB<id> := {u:<ID>|[dn:]<DN>}\fP
|
||||
\fBu:<user>\fP
|
||||
|
||||
The default is
|
||||
\fB[dn:]<DN>\fP
|
||||
|
||||
The former is supposed to be expanded by the remote server according
|
||||
to the authz rules; see
|
||||
.BR slapd.conf (5)
|
||||
for details.
|
||||
In the latter case, whether or not the
|
||||
.B dn:
|
||||
prefix is present, the string must pass DN validation and normalization.
|
||||
|
||||
The default mode is
|
||||
.BR legacy ,
|
||||
which implies that the proxy will bind as
|
||||
.I idassert-authcdn
|
||||
which implies that the proxy will either perform a simple bind as the
|
||||
.I authcDN
|
||||
or a SASL bind as the
|
||||
.I authcID
|
||||
and assert the client's identity when it is not anonymous.
|
||||
Direct binds are always proxied.
|
||||
The other modes imply that the proxy will always bind as
|
||||
.IR idassert-authcdn ,
|
||||
The other modes imply that the proxy will always either perform a simple bind
|
||||
as the
|
||||
.IR authcDN
|
||||
or a SASL bind as the
|
||||
.IR authcID ,
|
||||
unless restricted by
|
||||
.BR idassert-authzFrom
|
||||
rules (see below), in which case the operation will fail;
|
||||
|
|
@ -162,19 +218,10 @@ identity
|
|||
will be asserted;
|
||||
.BR none ,
|
||||
which means that no proxyAuthz control will be used, so the
|
||||
.I idassert-authcdn
|
||||
.I authcDN
|
||||
or the
|
||||
.I authcID
|
||||
identity will be asserted.
|
||||
Moreover, if a string prefixed with
|
||||
.B u:
|
||||
or
|
||||
.B dn:
|
||||
is used as
|
||||
.BR <mode> ,
|
||||
that identity will be asserted.
|
||||
Ths string is also treated as a DN if it is not prefixed
|
||||
by any recognized type indicator. Whether or not the
|
||||
.B dn:
|
||||
prefix is present, the string must pass DN validation and normalization.
|
||||
For all modes that require the use of the
|
||||
.I proxyAuthz
|
||||
control, on the remote server the proxy identity must have appropriate
|
||||
|
|
@ -183,6 +230,7 @@ permissions, or the asserted identities must have appropriate
|
|||
.I authzFrom
|
||||
permissions. Note, however, that the ID assertion feature is mostly
|
||||
useful when the asserted identities do not exist on the remote server.
|
||||
|
||||
When the
|
||||
.B override
|
||||
flag is used, identity assertion takes place even when the database
|
||||
|
|
@ -190,7 +238,15 @@ is authorizing for the identity of the client, i.e. after binding
|
|||
with the provided identity, and thus authenticating it, the proxy
|
||||
performs the identity assertion using the configured identity and
|
||||
authentication method.
|
||||
|
||||
This directive obsoletes
|
||||
.BR idassert-authcDN ,
|
||||
.BR idassert-passwd ,
|
||||
.BR idassert-mode ,
|
||||
and
|
||||
.BR idassert-method .
|
||||
.RE
|
||||
|
||||
.TP
|
||||
.B idassert-authzFrom <authz-regexp>
|
||||
if defined, selects what
|
||||
|
|
@ -206,80 +262,135 @@ See
|
|||
section related to
|
||||
.BR authz-policy ,
|
||||
for details on the syntax of this field.
|
||||
|
||||
.TP
|
||||
.B idassert-method <method> [<saslargs>]
|
||||
where valid method values are
|
||||
|
||||
\fB<method> := {none|simple|sasl}\fP
|
||||
|
||||
\fB<saslargs> := [mech=<mech>] [realm=<realm>] [authcid=<authcid>] [cred=<cred>] [authz={native|proxyauthz}]\fP
|
||||
|
||||
If method is
|
||||
.IR sasl ,
|
||||
extra parameters can be given as described above.
|
||||
The default is
|
||||
.BR simple ;
|
||||
.B none
|
||||
inhibits proxy authorization;
|
||||
.B sasl
|
||||
uses a SASL bind with the above parameters; if required,
|
||||
.I authorization
|
||||
is performed by means of native SASL mechanism, and no proxyAuthz
|
||||
is used for subsequent operations.
|
||||
.RE
|
||||
.TP
|
||||
.B proxy-whoami
|
||||
.B proxy-whoami {NO|yes}
|
||||
Turns on proxying of the WhoAmI extended operation. If this option is
|
||||
given, back-ldap will replace slapd's original WhoAmI routine with its
|
||||
own. On slapd sessions that were authenticated by back-ldap, the WhoAmI
|
||||
request will be forwarded to the remote LDAP server. Other sessions will
|
||||
be handled by the local slapd, as before. This option is mainly useful
|
||||
in conjunction with Proxy Authorization.
|
||||
|
||||
.TP
|
||||
.B rebind-as-user
|
||||
.B rebind-as-user {NO|yes}
|
||||
If this option is given, the client's bind credentials are remembered
|
||||
for rebinds when chasing referrals. Useful in conjunction with
|
||||
\fBchase-referrals\fP, useless if \fBdont-chase-referrals\fP is set.
|
||||
.LP
|
||||
.B chase-referrals
|
||||
.br
|
||||
.B dont-chase-referrals
|
||||
.RS
|
||||
for rebinds when chasing referrals. Useful when
|
||||
\fBchase-referrals\fP is set to \fByes\P, useless otherwise.
|
||||
|
||||
.TP
|
||||
.B chase-referrals {YES|no}
|
||||
enable/disable automatic referral chasing, which is delegated to the
|
||||
underlying libldap, with rebinding eventually performed if the
|
||||
\fBrebind-as-user\fP directive is used. The default is to chase referrals.
|
||||
.RE
|
||||
|
||||
.LP
|
||||
.B tls-start
|
||||
.br
|
||||
.B tls-try-start
|
||||
.br
|
||||
.B tls-propagate
|
||||
.br
|
||||
.B tls-try-propagate
|
||||
.RS
|
||||
.TP
|
||||
.B tls {[try-]start|[try-]propagate}
|
||||
execute the start TLS extended operation when the connection is initialized;
|
||||
only works if the URI directive protocol scheme is not \fBldaps://\fP.
|
||||
The \fBtls-propagate\fP version issues the Start TLS exop only if the original
|
||||
\fBpropagate\fP issues the Start TLS exop only if the original
|
||||
connection did.
|
||||
\fBtry-start-tls\fP and \fBtry-propagate-tls\fP continue operations
|
||||
if start TLS failed.
|
||||
.RE
|
||||
The \fBtry-\fP prefix instructs the proxy to continue operations
|
||||
if start TLS failed; its use is highly deprecated.
|
||||
|
||||
.TP
|
||||
.B t-f-support {NO|yes|discover}
|
||||
enable if the remote server supports absolute filters
|
||||
(see \fIdraft-zeilenga-ldap-t-f\fP for details).
|
||||
If set to
|
||||
.BR discover ,
|
||||
support is detected by reading the remote server's rootDSE.
|
||||
|
||||
.SH BACKWARD COMPATIBILITY
|
||||
The LDAP backend has been heavily reworked between releases 2.2 and 2.3;
|
||||
as a side-effect, some of the traditional directives have been
|
||||
deprecated and should be no longer used.
|
||||
|
||||
.TP
|
||||
.B server <hostname[:port]>
|
||||
this directive is no longer supported. Use the
|
||||
.B uri
|
||||
directive as described above.
|
||||
|
||||
.TP
|
||||
.B acl-authcDN "<administrative DN for access control purposes>"
|
||||
DN which is used to query the target server for acl checking; it
|
||||
is supposed to have read access on the target server to attributes used
|
||||
on the proxy for acl checking.
|
||||
There is no risk of giving away such values; they are only used to
|
||||
check permissions.
|
||||
.B The acl-authcDN identity is by no means implicitly used by the proxy
|
||||
.B when the client connects anonymously.
|
||||
See the
|
||||
.B idassert-*
|
||||
feature instead.
|
||||
This directive is obsoleted by
|
||||
.BR acl-bind ,
|
||||
and may dismissed in the future.
|
||||
|
||||
.TP
|
||||
.B acl-passwd <password>
|
||||
Password used with the
|
||||
.B
|
||||
acl-authcDN
|
||||
above.
|
||||
This directive is obsoleted by
|
||||
.BR acl-bind ,
|
||||
and may be dismissed in the future.
|
||||
|
||||
.TP
|
||||
.B idassert-authcDN "<administrative DN for proxyAuthz purposes>"
|
||||
DN which is used to propagate the client's identity to the target
|
||||
by means of the proxyAuthz control when the client does not
|
||||
belong to the DIT fragment that is being proxyied by back-ldap.
|
||||
This directive is obsoleted by
|
||||
.BR idassert-bind ,
|
||||
and may be dismissed in the future.
|
||||
|
||||
.TP
|
||||
.B idassert-passwd <password>
|
||||
Password used with the
|
||||
.B idassert-authcDN
|
||||
above.
|
||||
This directive is obsoleted by
|
||||
.BR idassert-bind ,
|
||||
and may be dismissed in the future.
|
||||
|
||||
.TP
|
||||
.B idassert-mode <mode> [<flags>]
|
||||
defines what type of
|
||||
.I identity assertion
|
||||
is used.
|
||||
This directive is obsoleted by
|
||||
.BR idassert-bind ,
|
||||
and may be dismissed in the future.
|
||||
|
||||
.TP
|
||||
.B idassert-method <method> [<saslargs>]
|
||||
This directive is obsoleted by
|
||||
.BR idassert-bind ,
|
||||
and may be dismissed in the future.
|
||||
|
||||
.TP
|
||||
.B suffixmassage, map, rewrite*
|
||||
These directives are no longer supported by back-ldap; their
|
||||
functionality is now delegated to the
|
||||
.B rwm
|
||||
overlay; see
|
||||
overlay. Essentially, add a statement
|
||||
|
||||
.B overlay rwm
|
||||
|
||||
first, and prefix all rewrite/map statements with
|
||||
.B rwm-
|
||||
to obtain the original behavior.
|
||||
See
|
||||
.BR slapo-rwm (5)
|
||||
for details.
|
||||
However, to ease update from existing configurations, back-ldap still
|
||||
recognizes them and automatically instantiates the
|
||||
.B rwm
|
||||
overlay if available and not instantiated yet.
|
||||
This behavior may change in the future.
|
||||
.\" However, to ease update from existing configurations, back-ldap still
|
||||
.\" recognizes them and automatically instantiates the
|
||||
.\" .B rwm
|
||||
.\" overlay if available and not instantiated yet.
|
||||
.\" This behavior may change in the future.
|
||||
|
||||
.SH ACCESS CONTROL
|
||||
The
|
||||
|
|
@ -296,12 +407,35 @@ returned by the
|
|||
.B search
|
||||
operation is honored, which is performed by the frontend.
|
||||
|
||||
.SH PROXY CACHE OVERLAY
|
||||
The proxy cache overlay
|
||||
allows caching of LDAP search requests (queries) in a local database.
|
||||
.SH OVERLAYS
|
||||
The LDAP backend provides basic proxying functionalities to many overlays.
|
||||
The
|
||||
.B chain
|
||||
overlay, described in
|
||||
.BR slapo\-chain (5),
|
||||
and the
|
||||
.B translucent
|
||||
overlay, described in
|
||||
.BR slapo\-translucent (5),
|
||||
deserve a special mention.
|
||||
|
||||
Conversely, there are many overlays that are best used in conjunction
|
||||
with the LDAP backend.
|
||||
The
|
||||
.B proxycache
|
||||
overlay allows caching of LDAP search requests (queries)
|
||||
in a local database.
|
||||
See
|
||||
.BR slapo-pcache (5)
|
||||
.BR slapo\-pcache (5)
|
||||
for details.
|
||||
The
|
||||
.B rwm
|
||||
overlay provides DN rewrite and attribute/objectClass mapping
|
||||
capabilities to the underlying database.
|
||||
See
|
||||
.BR slapo\-rwm (5)
|
||||
for details.
|
||||
|
||||
.SH FILES
|
||||
.TP
|
||||
ETCDIR/slapd.conf
|
||||
|
|
@ -309,8 +443,10 @@ default slapd configuration file
|
|||
.SH SEE ALSO
|
||||
.BR slapd.conf (5),
|
||||
.BR slapd\-meta (5),
|
||||
.BR slapo\-chain (5),
|
||||
.BR slapo\-pcache (5),
|
||||
.BR slapo\-rwm (5),
|
||||
.BR slapo\-translucent (5),
|
||||
.BR slapd (8),
|
||||
.BR ldap (3).
|
||||
.SH AUTHOR
|
||||
|
|
|
|||
|
|
@ -310,6 +310,13 @@ dependent attributes are \fBNOT\fP generated at this point, for
|
|||
consistency with the rest of slapd. This may change in the future.
|
||||
.RE
|
||||
|
||||
.TP
|
||||
.B check_schema { YES | no }
|
||||
Instructs the database to check schema adherence of entries after
|
||||
modifications, and structural objectClass chain when entries are built.
|
||||
By default it is set to
|
||||
.BR yes .
|
||||
|
||||
.TP
|
||||
.B sqllayer <name> [...]
|
||||
Loads the layer \fB<name>\fP onto a stack of helpers that are used
|
||||
|
|
|
|||
|
|
@ -41,9 +41,9 @@ directives that refer to the backend used for local storage.
|
|||
The following cache specific directives can be used to configure the proxy
|
||||
cache:
|
||||
.TP
|
||||
.B overlay proxycache
|
||||
This directive adds the proxycache overlay to the current backend. The
|
||||
proxycache overlay may be used with any backend but is intended for use
|
||||
.B overlay pcache
|
||||
This directive adds the proxy cache overlay to the current backend. The
|
||||
proxy cache overlay may be used with any backend but is intended for use
|
||||
with the
|
||||
.BR ldap ,
|
||||
.BR meta ,
|
||||
|
|
|
|||
|
|
@ -280,7 +280,7 @@ typedef struct ldapcontrol {
|
|||
|
||||
/* LDAP Chaining Behavior Control *//* work in progress */
|
||||
/* <draft-sermersheim-ldap-chaining>;
|
||||
* see also LDAP_REQUIRES_CHAINING, LDAP_CANNOT_CHAIN */
|
||||
* see also LDAP_NO_REFERRALS_FOUND, LDAP_CANNOT_CHAIN */
|
||||
#ifdef LDAP_DEVEL
|
||||
#define LDAP_CONTROL_X_CHAINING_BEHAVIOR "1.3.6.1.4.1.4203.666.11.3"
|
||||
|
||||
|
|
@ -582,7 +582,7 @@ typedef struct ldapcontrol {
|
|||
/* for the Chaining Behavior control (consecutive result codes requested;
|
||||
* see <draft-sermersheim-ldap-chaining> ) */
|
||||
#ifdef LDAP_CONTROL_X_CHAINING_BEHAVIOR
|
||||
#define LDAP_REQUIRES_CHAINING 0x4110
|
||||
#define LDAP_NO_REFERRALS_FOUND 0x4110
|
||||
#define LDAP_CANNOT_CHAIN 0x4111
|
||||
#endif
|
||||
|
||||
|
|
@ -726,6 +726,17 @@ ldap_set_rebind_proc LDAP_P((
|
|||
LDAP_REBIND_PROC *rebind_proc,
|
||||
void *params ));
|
||||
|
||||
/* V3 referral selection Function Callback Prototype */
|
||||
typedef int (LDAP_NEXTREF_PROC) LDAP_P((
|
||||
LDAP *ld, char ***refsp, int *cntp,
|
||||
void *params ));
|
||||
|
||||
LDAP_F( int )
|
||||
ldap_set_nextref_proc LDAP_P((
|
||||
LDAP *ld,
|
||||
LDAP_NEXTREF_PROC *nextref_proc,
|
||||
void *params ));
|
||||
|
||||
/*
|
||||
* in controls.c:
|
||||
*/
|
||||
|
|
|
|||
|
|
@ -325,7 +325,11 @@ typedef mpz_t ldap_pvt_mp_t;
|
|||
* Use unsigned long
|
||||
*/
|
||||
|
||||
typedef unsigned long ldap_pvt_mp_t;
|
||||
#ifdef HAVE_LONG_LONG
|
||||
typedef unsigned long long ldap_pvt_mp_t;
|
||||
#else /* !HAVE_LONG_LONG */
|
||||
typedef unsigned long ldap_pvt_mp_t;
|
||||
#endif /* !HAVE_LONG_LONG */
|
||||
|
||||
#define ldap_pvt_mp_init(mp) \
|
||||
(mp) = 0
|
||||
|
|
|
|||
|
|
@ -198,6 +198,8 @@ struct ldapoptions {
|
|||
/* LDAP rebind callback function */
|
||||
LDAP_REBIND_PROC *ldo_rebind_proc;
|
||||
void *ldo_rebind_params;
|
||||
LDAP_NEXTREF_PROC *ldo_nextref_proc;
|
||||
void *ldo_nextref_params;
|
||||
|
||||
LDAP_BOOLEANS ldo_booleans; /* boolean options */
|
||||
};
|
||||
|
|
@ -311,8 +313,10 @@ struct ldap {
|
|||
|
||||
#define ld_sctrls ld_options.ldo_sctrls
|
||||
#define ld_cctrls ld_options.ldo_cctrls
|
||||
#define ld_rebind_proc ld_options.ldo_rebind_proc
|
||||
#define ld_rebind_proc ld_options.ldo_rebind_proc
|
||||
#define ld_rebind_params ld_options.ldo_rebind_params
|
||||
#define ld_nextref_proc ld_options.ldo_nextref_proc
|
||||
#define ld_nextref_params ld_options.ldo_nextref_params
|
||||
|
||||
#define ld_version ld_options.ldo_version
|
||||
|
||||
|
|
|
|||
|
|
@ -28,6 +28,9 @@
|
|||
#define LDAP_OPT_REBIND_PROC 0x4e814d
|
||||
#define LDAP_OPT_REBIND_PARAMS 0x4e814e
|
||||
|
||||
#define LDAP_OPT_NEXTREF_PROC 0x4e815d
|
||||
#define LDAP_OPT_NEXTREF_PARAMS 0x4e815e
|
||||
|
||||
static const LDAPAPIFeatureInfo features[] = {
|
||||
#ifdef LDAP_API_FEATURE_X_OPENLDAP
|
||||
{ /* OpenLDAP Extensions API Feature */
|
||||
|
|
@ -166,7 +169,7 @@ ldap_get_option(
|
|||
|
||||
case LDAP_OPT_SOCKBUF:
|
||||
if( ld == NULL ) break;
|
||||
outvalue = ld->ld_sb;
|
||||
*(Sockbuf **)outvalue = ld->ld_sb;
|
||||
return LDAP_OPT_SUCCESS;
|
||||
|
||||
case LDAP_OPT_TIMEOUT:
|
||||
|
|
@ -454,6 +457,14 @@ ldap_set_option(
|
|||
case LDAP_OPT_REBIND_PARAMS: {
|
||||
lo->ldo_rebind_params = (void *)invalue;
|
||||
} return LDAP_OPT_SUCCESS;
|
||||
|
||||
/* Only accessed from inside this function by ldap_set_nextref_proc() */
|
||||
case LDAP_OPT_NEXTREF_PROC: {
|
||||
lo->ldo_nextref_proc = (LDAP_NEXTREF_PROC *)invalue;
|
||||
} return LDAP_OPT_SUCCESS;
|
||||
case LDAP_OPT_NEXTREF_PARAMS: {
|
||||
lo->ldo_nextref_params = (void *)invalue;
|
||||
} return LDAP_OPT_SUCCESS;
|
||||
}
|
||||
|
||||
if(invalue == NULL) {
|
||||
|
|
@ -670,3 +681,14 @@ ldap_set_rebind_proc( LDAP *ld, LDAP_REBIND_PROC *proc, void *params )
|
|||
rc = ldap_set_option( ld, LDAP_OPT_REBIND_PARAMS, (void *)params );
|
||||
return rc;
|
||||
}
|
||||
|
||||
int
|
||||
ldap_set_nextref_proc( LDAP *ld, LDAP_NEXTREF_PROC *proc, void *params )
|
||||
{
|
||||
int rc;
|
||||
rc = ldap_set_option( ld, LDAP_OPT_NEXTREF_PROC, (void *)proc );
|
||||
if( rc != LDAP_OPT_SUCCESS ) return rc;
|
||||
|
||||
rc = ldap_set_option( ld, LDAP_OPT_NEXTREF_PARAMS, (void *)params );
|
||||
return rc;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -657,6 +657,36 @@ ldap_free_request( LDAP *ld, LDAPRequest *lr )
|
|||
ldap_free_request_int( ld, lr );
|
||||
}
|
||||
|
||||
/*
|
||||
* call first time with *cntp = -1
|
||||
* when returns *cntp == -1, no referrals are left
|
||||
*
|
||||
* NOTE: may replace *refsp, or shuffle the contents
|
||||
* of the original array.
|
||||
*/
|
||||
static int ldap_int_nextref(
|
||||
LDAP *ld,
|
||||
char ***refsp,
|
||||
int *cntp,
|
||||
void *params )
|
||||
{
|
||||
assert( refsp != NULL );
|
||||
assert( *refsp != NULL );
|
||||
assert( cntp != NULL );
|
||||
|
||||
if ( *cntp < -1 ) {
|
||||
*cntp = -1;
|
||||
return -1;
|
||||
}
|
||||
|
||||
(*cntp)++;
|
||||
|
||||
if ( (*refsp)[ *cntp ] == NULL ) {
|
||||
*cntp = -1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Chase v3 referrals
|
||||
|
|
@ -718,8 +748,18 @@ ldap_chase_v3referrals( LDAP *ld, LDAPRequest *lr, char **refs, int sref, char *
|
|||
|
||||
refarray = refs;
|
||||
refs = NULL;
|
||||
|
||||
if ( ld->ld_nextref_proc == NULL ) {
|
||||
ld->ld_nextref_proc = ldap_int_nextref;
|
||||
}
|
||||
|
||||
/* parse out & follow referrals */
|
||||
for( i=0; refarray[i] != NULL; i++) {
|
||||
i = -1;
|
||||
for ( ld->ld_nextref_proc( ld, &refarray, &i, ld->ld_nextref_params );
|
||||
i != -1;
|
||||
ld->ld_nextref_proc( ld, &refarray, &i, ld->ld_nextref_params ) )
|
||||
{
|
||||
|
||||
/* Parse the referral URL */
|
||||
if (( rc = ldap_url_parse_ext( refarray[i], &srv)) != LDAP_SUCCESS) {
|
||||
ld->ld_errno = rc;
|
||||
|
|
|
|||
|
|
@ -288,9 +288,10 @@ wait4msg(
|
|||
}
|
||||
#endif /* LDAP_DEBUG */
|
||||
|
||||
if( (*result = chkResponseList(ld, msgid, all)) != NULL ) {
|
||||
rc = (*result)->lm_msgtype;
|
||||
} else {
|
||||
if ( (*result = chkResponseList(ld, msgid, all)) != NULL ) {
|
||||
rc = (*result)->lm_msgtype;
|
||||
|
||||
} else {
|
||||
int lc_ready = 0;
|
||||
|
||||
for ( lc = ld->ld_conns; lc != NULL; lc = nextlc ) {
|
||||
|
|
@ -300,11 +301,11 @@ wait4msg(
|
|||
rc = try_read1msg( ld, msgid, all, lc->lconn_sb,
|
||||
&lc, result );
|
||||
lc_ready = 1;
|
||||
break;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if ( !lc_ready ) {
|
||||
if ( !lc_ready ) {
|
||||
rc = ldap_int_select( ld, tvp );
|
||||
#ifdef LDAP_DEBUG
|
||||
if ( rc == -1 ) {
|
||||
|
|
|
|||
Loading…
Reference in a new issue