mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2024-12-09 02:52:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Cleanup priv/idassert choice: check for configured bind method, not authcDN

Browse Source
This commit is contained in:
Howard Chu 2011-02-02 20:32:48 +00:00
parent aec5adac17
commit d626977848
1 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
servers/slapd/back-ldap/bind.c
View File

@ -710,9 +710,9 @@ ldap_back_prepare_conn( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_
#ifdef HAVE_TLS
if ( LDAP_BACK_CONN_ISPRIV( lc ) ) {
/* See "rationale:" comment in ldap_back_getconn() */
if ( BER_BVISNULL( &li->li_acl_authcDN ) &&
!BER_BVISNULL( &li->li_idassert_authcDN ) )
/* See "rationale" comment in ldap_back_getconn() */
if ( li->li_acl_authmethod == LDAP_AUTH_NONE &&
li->li_idassert_authmethod != LDAP_AUTH_NONE )
sb = &li->li_idassert.si_bc;
else
sb = &li->li_acl;
@ -981,10 +981,10 @@ retry_lock:
/*
* the rationale is: connections as the rootdn are privileged,
* so acl_authcDN is to be used; however, in some cases
* so li_acl is to be used; however, in some cases
* one already configured identity assertion with a highly
* privileged idassert_authcDN, so if acl_authcDN is NULL
* and idassert_authcDN is not, use the second instead.
* privileged idassert_authcDN, so if li_acl is not configured
* and idassert is, use idassert instead.
*
* might change in the future, because it's preferable
* to make clear what identity is being used, since
@ -992,7 +992,8 @@ retry_lock:
* the same identity twice...
*/
if ( LDAP_BACK_CONN_ISPRIV( &lc_curr ) ) {
if ( BER_BVISNULL( &li->li_acl_authcDN ) && !BER_BVISNULL( &li->li_idassert_authcDN ) ) {
if ( li->li_acl_authmethod == LDAP_AUTH_NONE &&
li->li_idassert_authmethod != LDAP_AUTH_NONE ) {
ber_dupbv( &lc->lc_bound_ndn, &li->li_idassert_authcDN );
ber_dupbv( &lc->lc_cred, &li->li_idassert_passwd );