mirror of
https://git.openldap.org/openldap/openldap.git
synced 2024-12-21 03:10:25 +08:00
Make SASL authorization work for NULL, "u:", and "dn:" authz strings.
This commit is contained in:
Mark Adamson
parent
fc630ea1f8
commit
2231d5e64e
@ -572,10 +572,10 @@ LDAP_SLAPD_F (int) slap_sasl_bind LDAP_P((
|
||||
/*
|
||||
* saslauthz.c
|
||||
*/
|
||||
LDAP_SLAPD_F (char *) slap_sasl2dn LDAP_P(( char *saslname ));
|
||||
LDAP_SLAPD_F (int) slap_sasl_authorized LDAP_P((
|
||||
Connection *conn,
|
||||
const char *authcid,
|
||||
const char *authzid ));
|
||||
char *authcid,
|
||||
char *authzid ));
|
||||
LDAP_SLAPD_F (int) slap_sasl_regexp_config LDAP_P((
|
||||
const char *match, const char *replace ));
|
||||
|
||||
|
||||
@ -66,6 +66,116 @@ slap_sasl_log(
|
||||
return SASL_OK;
|
||||
}
|
||||
|
||||
|
||||
/* Take any sort of identity string and return a DN with the "dn:" prefix. The
|
||||
string returned in *dnptr is in its own allocated memory, and must be free'd
|
||||
by the calling process.
|
||||
-Mark Adamson, Carnegie Mellon
|
||||
*/
|
||||
|
||||
int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags )
|
||||
{
|
||||
char *c, *c1, *dn=NULL;
|
||||
int rc, len, len1;
|
||||
sasl_conn_t *ctx;
|
||||
|
||||
|
||||
Debug( LDAP_DEBUG_ARGS, "slap_sasl_getdn: id=%s\n",
|
||||
id?(*id?id:"<empty>"):"NULL",0,0 );
|
||||
|
||||
/* Blatantly anonymous ID */
|
||||
len = strlen( "anonymous" );
|
||||
if( id && !strncasecmp( id, "anonymous", len) &&
|
||||
( id[len] == '\0' || id[len] == '@' ) ) {
|
||||
*dnptr = NULL;
|
||||
return( LDAP_SUCCESS );
|
||||
}
|
||||
ctx = conn->c_sasl_context;
|
||||
dn = ch_strdup( id );
|
||||
len = strlen( id );
|
||||
|
||||
/* An authcID will need to be prefixed with u: */
|
||||
if( flags & FLAG_GETDN_AUTHCID ) {
|
||||
dn = ch_realloc( dn, len+3 );
|
||||
memmove( dn+2, dn, len+1 );
|
||||
dn[0] = 'u';
|
||||
dn[1] = ':';
|
||||
len += 2;
|
||||
}
|
||||
|
||||
/* An authzID must be properly prefixed */
|
||||
if( flags & FLAG_GETDN_AUTHZID && strncasecmp( dn, "u:", 2 ) &&
|
||||
strncasecmp( dn, "dn:", 3 ) ) {
|
||||
ch_free( dn );
|
||||
*dnptr = NULL;
|
||||
return( LDAP_INAPPROPRIATE_AUTH );
|
||||
}
|
||||
|
||||
/* Username strings */
|
||||
len1 = strlen( ",cn=authzid" );
|
||||
if( !strncasecmp( dn, "u:", 2 ) ) {
|
||||
len += strlen( "dn:uid=" ) + len1;
|
||||
|
||||
/* Figure out how much data we have for the dn */
|
||||
rc = sasl_getprop( ctx, SASL_REALM, (void **)&c );
|
||||
if( rc != SASL_OK ) {
|
||||
Debug(LDAP_DEBUG_TRACE,
|
||||
"getdn: getprop(REALM) failed!\n", 0,0,0);
|
||||
ch_free( dn );
|
||||
*dnptr = NULL;
|
||||
return( LDAP_OPERATIONS_ERROR );
|
||||
}
|
||||
if( c ) {
|
||||
len += strlen( c ) + strlen(",cn=" );
|
||||
}
|
||||
if( conn->c_sasl_bind_mech ) {
|
||||
len += strlen( conn->c_sasl_bind_mech ) + strlen( ",cn=mech" );
|
||||
}
|
||||
|
||||
/* Build the new dn */
|
||||
c1 = dn;
|
||||
dn = ch_malloc( len );
|
||||
len = sprintf( dn, "dn:uid=%s", c1+2 );
|
||||
ch_free( c1 );
|
||||
|
||||
if( c ) {
|
||||
len += sprintf( dn+len, ",cn=%s", c );
|
||||
}
|
||||
if( conn->c_sasl_bind_mech ) {
|
||||
len += sprintf( dn+len, ",cn=%s", conn->c_sasl_bind_mech );
|
||||
}
|
||||
strcpy( dn+len, ",cn=authzid" );
|
||||
len += len1;
|
||||
Debug( LDAP_DEBUG_TRACE, "getdn: u:id converted to %s\n", dn,0,0 );
|
||||
}
|
||||
|
||||
/* DN strings that are a cn=authzid identity to run through regexp */
|
||||
if( !strncasecmp( dn, "dn:", 3) && ( ( flags & FLAG_GETDN_FINAL ) == 0 ) ) {
|
||||
c1 = slap_sasl2dn( dn + 3 );
|
||||
if( c1 ) {
|
||||
ch_free( dn );
|
||||
dn = c1;
|
||||
/* Reaffix the dn: prefix if it was removed */
|
||||
if( strncasecmp( dn, "dn:", 3) ) {
|
||||
c1 = dn;
|
||||
dn = ch_malloc( strlen( c1 ) + 4 );
|
||||
sprintf( dn, "dn:%s", c1 );
|
||||
ch_free( c1 );
|
||||
}
|
||||
Debug( LDAP_DEBUG_TRACE, "getdn: dn:id converted to %s\n", dn,0,0 );
|
||||
}
|
||||
}
|
||||
|
||||
if( ( flags & FLAG_GETDN_FINAL ) == 0 ) {
|
||||
dn_normalize( dn );
|
||||
}
|
||||
|
||||
*dnptr = dn;
|
||||
return( LDAP_SUCCESS );
|
||||
}
|
||||
|
||||
|
||||
|
||||
static int
|
||||
slap_sasl_authorize(
|
||||
void *context,
|
||||
@ -74,61 +184,47 @@ slap_sasl_authorize(
|
||||
const char **user,
|
||||
const char **errstr)
|
||||
{
|
||||
char *cuser;
|
||||
char *authcDN, *authzDN;
|
||||
int rc;
|
||||
Connection *conn = context;
|
||||
|
||||
*user = NULL;
|
||||
|
||||
if ( authcid == NULL || *authcid == '\0' ) {
|
||||
*errstr = "empty authentication identity";
|
||||
|
||||
Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
|
||||
"empty authentication identity\n",
|
||||
(long) (conn ? conn->c_connid : -1),
|
||||
0, 0 );
|
||||
return SASL_BADAUTH;
|
||||
}
|
||||
|
||||
Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
|
||||
"authcid=\"%s\" authzid=\"%s\"\n",
|
||||
(long) (conn ? conn->c_connid : -1),
|
||||
authcid ? authcid : "<empty>",
|
||||
authzid ? authzid : "<empty>" );
|
||||
|
||||
if ( authzid == NULL || *authzid == '\0' ||
|
||||
( authzid[0] == 'u' && authzid[1] == ':' &&
|
||||
strcmp( authcid, &authzid[2] ) == 0 ) ||
|
||||
strcmp( authcid, authzid ) == 0 )
|
||||
{
|
||||
/* authzid is:
|
||||
* empty
|
||||
* u:authcid
|
||||
* authcid
|
||||
*/
|
||||
|
||||
size_t len = sizeof("u:") + strlen( authcid );
|
||||
|
||||
cuser = ch_malloc( len );
|
||||
strcpy( cuser, "u:" );
|
||||
strcpy( &cuser[sizeof("u:")-1], authcid );
|
||||
|
||||
*user = cuser;
|
||||
|
||||
/* Convert the identities to DN's. If no authzid was given, client will
|
||||
be bound as the DN matching their username */
|
||||
rc = slap_sasl_getdn( conn, (char *)authcid, &authcDN, FLAG_GETDN_AUTHCID );
|
||||
if( rc != LDAP_SUCCESS ) {
|
||||
*errstr = ldap_err2string( rc );
|
||||
return SASL_NOAUTHZ;
|
||||
}
|
||||
if( ( authzid == NULL ) || !strcmp( authcid,authzid ) ) {
|
||||
Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
|
||||
"\"%s\" as \"%s\"\n",
|
||||
(long) (conn ? conn->c_connid : -1),
|
||||
authcid, cuser );
|
||||
|
||||
"Using authcDN=%s\n", (long) (conn ? conn->c_connid : -1), authcDN,0 );
|
||||
*user = authcDN;
|
||||
*errstr = NULL;
|
||||
return SASL_OK;
|
||||
}
|
||||
rc = slap_sasl_getdn( conn, (char *)authzid, &authzDN, FLAG_GETDN_AUTHZID );
|
||||
if( rc != LDAP_SUCCESS ) {
|
||||
ch_free( authcDN );
|
||||
*errstr = ldap_err2string( rc );
|
||||
return SASL_NOAUTHZ;
|
||||
}
|
||||
|
||||
rc = slap_sasl_authorized( conn, authcid, authzid );
|
||||
rc = slap_sasl_authorized( authcDN, authzDN );
|
||||
if( rc ) {
|
||||
Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
|
||||
" authorization disallowed (%d)\n",
|
||||
(long) (conn ? conn->c_connid : -1), rc, 0 );
|
||||
*errstr = "not authorized";
|
||||
ch_free( authcDN );
|
||||
ch_free( authzDN );
|
||||
return SASL_NOAUTHZ;
|
||||
}
|
||||
|
||||
@ -136,10 +232,9 @@ slap_sasl_authorize(
|
||||
" authorization allowed\n",
|
||||
(long) (conn ? conn->c_connid : -1), 0, 0 );
|
||||
|
||||
cuser = ch_strdup( authzid );
|
||||
dn_normalize( cuser );
|
||||
ch_free( authcDN );
|
||||
*user = authzDN;
|
||||
*errstr = NULL;
|
||||
*user = cuser;
|
||||
return SASL_OK;
|
||||
}
|
||||
|
||||
@ -442,100 +537,13 @@ int slap_sasl_bind(
|
||||
send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
|
||||
NULL, "no SASL username", NULL, NULL );
|
||||
|
||||
} else if ( username == NULL || *username == '\0' ) {
|
||||
Debug(LDAP_DEBUG_TRACE,
|
||||
"slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
|
||||
0, 0, 0);
|
||||
|
||||
send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
|
||||
NULL, "no SASL username", NULL, NULL );
|
||||
|
||||
} else {
|
||||
char *realm = NULL;
|
||||
sasl_ssf_t *ssf = NULL;
|
||||
|
||||
(void) sasl_getprop( ctx,
|
||||
SASL_REALM, (void **)&realm );
|
||||
|
||||
(void) sasl_getprop( ctx,
|
||||
SASL_SSF, (void *)&ssf );
|
||||
|
||||
Debug(LDAP_DEBUG_TRACE,
|
||||
"slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
|
||||
username ? username : "",
|
||||
realm ? realm : "",
|
||||
(unsigned long) ( ssf ? *ssf : 0 ) );
|
||||
|
||||
rc = LDAP_SUCCESS;
|
||||
|
||||
if( username == NULL || (
|
||||
!strncasecmp( username, "anonymous", sizeof("anonymous")-1 ) &&
|
||||
( username[sizeof("anonymous")-1] == '\0' ||
|
||||
username[sizeof("anonymous")-1] == '@' ) ) )
|
||||
{
|
||||
Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
|
||||
0, 0, 0);
|
||||
|
||||
} else if ( username[0] == 'u' && username[1] == ':'
|
||||
&& username[2] != '\0' )
|
||||
{
|
||||
*edn = ch_malloc( sizeof( "uid=,cn=" )
|
||||
+ strlen( &username[2] )
|
||||
+ ( realm ? strlen( realm ) : 0 ) );
|
||||
|
||||
strcpy( *edn, "uid=" );
|
||||
strcat( *edn, &username[2] );
|
||||
|
||||
if( realm && *realm ) {
|
||||
strcat( *edn, ",cn=" );
|
||||
strcat( *edn, realm );
|
||||
}
|
||||
|
||||
if( dn_normalize( *edn ) == NULL ) {
|
||||
Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
|
||||
"authzid (\"%s\") to authzdn failed: \"%s\"\n",
|
||||
username, *edn, 0);
|
||||
ch_free( *edn );
|
||||
*edn = NULL;
|
||||
rc = LDAP_INAPPROPRIATE_AUTH;
|
||||
errstr = "could not form a valid DN from authzid";
|
||||
|
||||
} else {
|
||||
Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
|
||||
"authzdn: \"%s\"\n",
|
||||
*edn, 0, 0);
|
||||
}
|
||||
|
||||
} else if ( username[0] == 'd' && username[1] == 'n'
|
||||
&& username[2] != ':' && username[3] != '\0' )
|
||||
{
|
||||
*edn = ch_strdup( &username[3] );
|
||||
|
||||
if( dn_normalize( *edn ) == NULL ) {
|
||||
Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
|
||||
"authzid (\"%s\") to authzdn failed: \"%s\"\n",
|
||||
username, *edn, 0);
|
||||
|
||||
ch_free( *edn );
|
||||
*edn = NULL;
|
||||
rc = LDAP_INAPPROPRIATE_AUTH;
|
||||
errstr = "could not form a valid DN from authzid";
|
||||
|
||||
} else {
|
||||
Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
|
||||
"authzdn: \"%s\"\n",
|
||||
*edn, 0, 0);
|
||||
}
|
||||
|
||||
} else {
|
||||
Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
|
||||
"authzid (\"%s\") inappropriate form\n",
|
||||
username, 0, 0);
|
||||
rc = LDAP_INAPPROPRIATE_AUTH;
|
||||
errstr = "inappropriate authorization identity form";
|
||||
}
|
||||
rc = slap_sasl_getdn( conn, username, edn, FLAG_GETDN_FINAL );
|
||||
|
||||
if( rc == LDAP_SUCCESS ) {
|
||||
int i;
|
||||
sasl_ssf_t *ssf = NULL;
|
||||
(void) sasl_getprop( ctx, SASL_SSF, (void *)&ssf );
|
||||
*ssfp = ssf ? *ssf : 0;
|
||||
|
||||
if( *ssfp ) {
|
||||
@ -544,6 +552,15 @@ int slap_sasl_bind(
|
||||
ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
|
||||
}
|
||||
|
||||
/* Store the authorization DN as a subjectDN */
|
||||
if ( *edn ) {
|
||||
i = 2;
|
||||
do {
|
||||
i++;
|
||||
(*edn)[i-3] = (*edn)[i];
|
||||
} while( (*edn)[i] );
|
||||
}
|
||||
|
||||
send_ldap_sasl( conn, op, rc,
|
||||
NULL, NULL, NULL, NULL,
|
||||
response.bv_len ? &response : NULL );
|
||||
|
||||
@ -45,6 +45,14 @@ int slap_parseURI( char *uri, char **searchbase, int *scope, Filter **filter )
|
||||
Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri, 0, 0 );
|
||||
|
||||
/* If it does not look like a URI, assume it is a DN */
|
||||
if( !strncasecmp( uri, "dn:", 3 ) ) {
|
||||
uri += 3;
|
||||
uri += strspn( uri, " " );
|
||||
*searchbase = ch_strdup( uri );
|
||||
dn_normalize( *searchbase );
|
||||
*scope = LDAP_SCOPE_BASE;
|
||||
return( LDAP_SUCCESS );
|
||||
}
|
||||
if( strncasecmp( uri, "ldap://", 7 ) ) {
|
||||
*searchbase = ch_strdup( uri );
|
||||
dn_normalize( *searchbase );
|
||||
@ -251,7 +259,7 @@ char *slap_sasl_regexp( char *saslname )
|
||||
|
||||
|
||||
/*
|
||||
* Given a SASL name (e.g. "UID=name+cn=REALM,cn=MECH,cn=AUTHZ")
|
||||
* Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTHZID")
|
||||
* return the LDAP DN to which it matches. The SASL regexp rules in the config
|
||||
* file turn the SASL name into an LDAP URI. If the URI is just a DN (or a
|
||||
* search with scope=base), just return the URI (or its searchbase). Otherwise
|
||||
@ -259,7 +267,6 @@ char *slap_sasl_regexp( char *saslname )
|
||||
* entry, return the DN of that one entry.
|
||||
*/
|
||||
|
||||
static
|
||||
char *slap_sasl2dn( char *saslname )
|
||||
{
|
||||
char *uri=NULL, *searchbase=NULL, *DN=NULL;
|
||||
@ -346,6 +353,8 @@ FINISHED:
|
||||
* URI, just strcmp the rule (or its searchbase) to the *assertDN. Otherwise,
|
||||
* the rule must be used as an internal search for entries. If that search
|
||||
* returns the *assertDN entry, the match is successful.
|
||||
*
|
||||
* The assertDN should not have the dn: prefix
|
||||
*/
|
||||
|
||||
static
|
||||
@ -358,6 +367,7 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc )
|
||||
Connection *conn=NULL;
|
||||
LDAP *client=NULL;
|
||||
LDAPMessage *res=NULL, *msg;
|
||||
regex_t reg;
|
||||
|
||||
|
||||
Debug( LDAP_DEBUG_TRACE,
|
||||
@ -370,7 +380,12 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc )
|
||||
/* Massive shortcut: search scope == base */
|
||||
if( scope == LDAP_SCOPE_BASE ) {
|
||||
dn_normalize( searchbase );
|
||||
if( strcmp( searchbase, assertDN ) == 0 )
|
||||
rc = regcomp(®, searchbase, REG_EXTENDED|REG_ICASE|REG_NOSUB);
|
||||
if ( rc == 0 ) {
|
||||
rc = regexec(®, assertDN, 0, NULL, 0);
|
||||
regfree( ® );
|
||||
}
|
||||
if ( rc == 0 )
|
||||
rc = LDAP_SUCCESS;
|
||||
else
|
||||
rc = LDAP_INAPPROPRIATE_AUTH;
|
||||
@ -440,6 +455,8 @@ CONCLUDED:
|
||||
* based on authorization rules. The rules are stored in the *searchDN, in the
|
||||
* attribute named by *attr. If any of those rules map to the *assertDN, the
|
||||
* authorization is approved.
|
||||
*
|
||||
* DN's passed in should have a dn: prefix
|
||||
*/
|
||||
|
||||
static int
|
||||
@ -458,13 +475,13 @@ slap_sasl_check_authz(char *searchDN, char *assertDN, char *attr, char *authc)
|
||||
if( rc != LDAP_SUCCESS )
|
||||
goto COMPLETE;
|
||||
|
||||
rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN, ad, &vals );
|
||||
rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN+3, ad, &vals );
|
||||
if( rc != LDAP_SUCCESS )
|
||||
goto COMPLETE;
|
||||
|
||||
/* Check if the *assertDN matches any **vals */
|
||||
for( i=0; vals[i] != NULL; i++ ) {
|
||||
rc = slap_sasl_match( vals[i]->bv_val, assertDN, authc );
|
||||
rc = slap_sasl_match( vals[i]->bv_val, assertDN+3, authc );
|
||||
if ( rc == LDAP_SUCCESS )
|
||||
goto COMPLETE;
|
||||
}
|
||||
@ -487,50 +504,28 @@ COMPLETE:
|
||||
|
||||
|
||||
|
||||
/* Check if a bind can SASL authorize to another identity. */
|
||||
/* Check if a bind can SASL authorize to another identity.
|
||||
Accepts authorization DN's with "dn:" prefix */
|
||||
|
||||
int slap_sasl_authorized( Connection *conn,
|
||||
const char *authcid, const char *authzid )
|
||||
int slap_sasl_authorized( char *authcDN, char *authzDN )
|
||||
{
|
||||
int rc;
|
||||
char *saslname=NULL,*authcDN=NULL,*realm=NULL, *authzDN=NULL;
|
||||
|
||||
#ifdef HAVE_CYRUS_SASL
|
||||
Debug( LDAP_DEBUG_TRACE,
|
||||
"==>slap_sasl_authorized: can %s become %s?\n", authcid, authzid, 0 );
|
||||
|
||||
/* Create a complete SASL name for the SASL regexp patterns */
|
||||
|
||||
sasl_getprop( conn->c_sasl_context, SASL_REALM, (void **)&realm );
|
||||
|
||||
/* Allocate space */
|
||||
rc = strlen("uid=,cn=,cn=,cn=AUTHZ ");
|
||||
if ( realm ) rc += strlen( realm );
|
||||
if ( authcid ) rc += strlen( authcid );
|
||||
rc += strlen( conn->c_sasl_bind_mech );
|
||||
saslname = ch_malloc( rc );
|
||||
|
||||
/* Build the SASL name with whatever we have, and normalize it */
|
||||
saslname[0] = '\0';
|
||||
rc = 0;
|
||||
if ( authcid )
|
||||
rc += sprintf( saslname+rc, "%sUID=%s", rc?",":"", authcid);
|
||||
if ( realm )
|
||||
rc += sprintf( saslname+rc, "%sCN=%s", rc?",":"", realm);
|
||||
if ( conn->c_sasl_bind_mech )
|
||||
rc += sprintf( saslname+rc, "%sCN=%s", rc?",":"",
|
||||
conn->c_sasl_bind_mech);
|
||||
sprintf( saslname+rc, "%sCN=AUTHZ", rc?",":"");
|
||||
dn_normalize( saslname );
|
||||
|
||||
authcDN = slap_sasl2dn( saslname );
|
||||
if( authcDN == NULL )
|
||||
/* User binding as anonymous */
|
||||
if ( authzDN == NULL ) {
|
||||
rc = LDAP_SUCCESS;
|
||||
goto DONE;
|
||||
}
|
||||
|
||||
/* Normalize the name given by the clientside of the connection */
|
||||
authzDN = ch_strdup( authzid );
|
||||
dn_normalize( authzDN );
|
||||
Debug( LDAP_DEBUG_TRACE,
|
||||
"==>slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN, 0 );
|
||||
|
||||
/* If person is authorizing to self, succeed */
|
||||
if ( !strcmp( authcDN, authzDN ) ) {
|
||||
rc = LDAP_SUCCESS;
|
||||
goto DONE;
|
||||
}
|
||||
|
||||
/* Check source rules */
|
||||
rc = slap_sasl_check_authz( authcDN, authzDN, SASL_AUTHZ_SOURCE_ATTR,
|
||||
@ -548,9 +543,6 @@ int slap_sasl_authorized( Connection *conn,
|
||||
rc = LDAP_INAPPROPRIATE_AUTH;
|
||||
|
||||
DONE:
|
||||
if( saslname ) ch_free( saslname );
|
||||
if( authcDN ) ch_free( authcDN );
|
||||
if( authzDN ) ch_free( authzDN );
|
||||
Debug( LDAP_DEBUG_TRACE, "<== slap_sasl_authorized: return %d\n",rc,0,0 );
|
||||
return( rc );
|
||||
}
|
||||
|
||||
@ -1202,6 +1202,11 @@ typedef struct sasl_regexp {
|
||||
int offset[SASLREGEX_REPLACE+2]; /* offsets of $1,$2... in *replace */
|
||||
} SaslRegexp_t;
|
||||
|
||||
/* Flags for telling slap_sasl_getdn() what type of identity is being passed */
|
||||
#define FLAG_GETDN_FINAL 1
|
||||
#define FLAG_GETDN_AUTHCID 2
|
||||
#define FLAG_GETDN_AUTHZID 4
|
||||
|
||||
|
||||
LDAP_END_DECL
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user