5:05 p.m.
Author: nkinder
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv22785/ldap/servers/slapd
Modified Files:
connection.c extendop.c passwd_extop.c slap.h
Log Message:
Resolves: 201332
Summary: Allow password modify extop when password reset is needed.
Index: connection.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/connection.c,v
retrieving revision 1.23
retrieving revision 1.24
diff -u -r1.23 -r1.24
--- connection.c 5 Dec 2008 22:41:52 -0000 1.23
+++ connection.c 11 Dec 2008 23:05:23 -0000 1.24
@@ -449,7 +449,7 @@
if ( conn->c_needpw && op->o_tag != LDAP_REQ_MODIFY &&
op->o_tag != LDAP_REQ_BIND && op->o_tag != LDAP_REQ_UNBIND &&
- op->o_tag != LDAP_REQ_ABANDON )
+ op->o_tag != LDAP_REQ_ABANDON && op->o_tag != LDAP_REQ_EXTENDED)
{
slapi_add_pwd_control ( pb, LDAP_CONTROL_PWEXPIRED, 0);
slapi_log_access( LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d
%s\n",
Index: extendop.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/extendop.c,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- extendop.c 5 Dec 2008 22:41:52 -0000 1.10
+++ extendop.c 11 Dec 2008 23:05:23 -0000 1.11
@@ -295,6 +295,22 @@
goto free_and_return;
}
+ /* If a password change is required, only allow the password
+ * modify extended operation */
+ if (!pb->pb_conn->c_isreplication_session &&
+ pb->pb_conn->c_needpw && (strcmp(extoid, EXTOP_PASSWD_OID)
!= 0))
+ {
+ char *dn = NULL;
+ slapi_pblock_get(pb, SLAPI_CONN_DN, &dn);
+
+ (void)slapi_add_pwd_control ( pb, LDAP_CONTROL_PWEXPIRED, 0);
+ op_shared_log_error_access (pb, "EXT", dn ? dn : "", "need new
password");
+ send_ldap_result( pb, LDAP_UNWILLING_TO_PERFORM, NULL, NULL, 0, NULL );
+
+ slapi_ch_free_string(&dn);
+ goto free_and_return;
+ }
+
slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_OID, extoid );
slapi_pblock_set( pb, SLAPI_EXT_OP_REQ_VALUE, &extval );
rc = plugin_call_exop_plugins( pb, extoid );
Index: passwd_extop.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/passwd_extop.c,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -r1.17 -r1.18
--- passwd_extop.c 27 Aug 2008 21:05:30 -0000 1.17
+++ passwd_extop.c 11 Dec 2008 23:05:23 -0000 1.18
@@ -82,9 +82,6 @@
/* number of random bytes needed to generate password */
#define LDAP_EXTOP_PASSMOD_RANDOM_BYTES 6
-/* OID of the extended operation handled by this plug-in */
-#define EXOP_PASSWD_OID "1.3.6.1.4.1.4203.1.11.1"
-
Slapi_PluginDesc passwdopdesc = { "passwd_modify_plugin", "Fedora",
"0.1",
"Password Modify extended operation plugin" };
@@ -450,7 +447,7 @@
/* Before going any further, we'll make sure that the right extended operation
plugin
* has been called: i.e., the OID shipped whithin the extended operation request must
- * match this very plugin's OID: EXOP_PASSWD_OID. */
+ * match this very plugin's OID: EXTOP_PASSWD_OID. */
if ( slapi_pblock_get( pb, SLAPI_EXT_OP_REQ_OID, &oid ) != 0 ) {
errMesg = "Could not get OID value from request.\n";
rc = LDAP_OPERATIONS_ERROR;
@@ -462,7 +459,7 @@
"Received extended operation request with OID %s\n", oid );
}
- if ( strcasecmp( oid, EXOP_PASSWD_OID ) != 0) {
+ if ( strcasecmp( oid, EXTOP_PASSWD_OID ) != 0) {
errMesg = "Request OID does not match Passwd OID.\n";
rc = LDAP_OPERATIONS_ERROR;
goto free_and_return;
@@ -783,7 +780,7 @@
static char *passwd_oid_list[] = {
- EXOP_PASSWD_OID,
+ EXTOP_PASSWD_OID,
NULL
};
@@ -812,9 +809,9 @@
/* Compare the OID specified in the configuration file against the Passwd OID. */
- if ( argv == NULL || strcmp( argv[0], EXOP_PASSWD_OID ) != 0 ) {
+ if ( argv == NULL || strcmp( argv[0], EXTOP_PASSWD_OID ) != 0 ) {
slapi_log_error( SLAPI_LOG_PLUGIN, "passwd_modify_init",
- "OID is missing or is not %s\n", EXOP_PASSWD_OID );
+ "OID is missing or is not %s\n", EXTOP_PASSWD_OID );
return( -1 );
} else {
oid = slapi_ch_strdup( argv[0] );
Index: slap.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/slap.h,v
retrieving revision 1.43
retrieving revision 1.44
diff -u -r1.43 -r1.44
--- slap.h 5 Dec 2008 22:41:52 -0000 1.43
+++ slap.h 11 Dec 2008 23:05:23 -0000 1.44
@@ -540,6 +540,7 @@
/* extended operations supported by the server */
#define EXTOP_BULK_IMPORT_START_OID "2.16.840.1.113730.3.5.7"
#define EXTOP_BULK_IMPORT_DONE_OID "2.16.840.1.113730.3.5.8"
+#define EXTOP_PASSWD_OID "1.3.6.1.4.1.4203.1.11.1"
/*
* Represents a Distinguished Name of an entry