[Fedora-directory-commits] adminserver/admserv/cgi-src40 security.c, 1.15, 1.16
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/adminserver/admserv/cgi-src40
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv3348/adminserver/admserv/cgi-src40
Modified Files:
security.c
Log Message:
Resolves: bug 462411
Bug Description: certificate request wizard returns an error
Reviewed by: nkinder (Thanks!)
Fix Description: This was broken as part of the fix for the XSS issues. To fix that, in order to make sure we never displayed any string that contained unescaped HTML entities, we just go ahead and escape everything when we read the values from the CGI GET or POST arguments. For this particular bug, this meant the cert CGI was getting a DN like this: CN="ldap.example.com" instead of CN="ldap.example.com". The solution is to add some functions to adminutil (stolen from dsgw) that can be used to escape/unescape HTML entities. We have to be careful never to display unescaped strings - in this particular case, the DN is never printed.
Platforms tested: RHEL5
Flag Day: yes - will require new adminutil, adminserver
Doc impact: no
Index: security.c
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/cgi-src40/security.c,v
retrieving revision 1.15
retrieving revision 1.16
diff -u -r1.15 -r1.16
--- security.c 14 Jul 2008 20:00:02 -0000 1.15
+++ security.c 3 Dec 2008 17:32:17 -0000 1.16
@@ -1165,6 +1165,9 @@
/* to do token here */
privateKey = generateKey(&publicKey, tokenName);
+ /* can be done in place */
+ unescape_entities(DN); /* e.g. convert " to " */
+ /* since DN now contains unescaped entities, it must never be displayed */
fprintf(stdout, HEADERREQUEST, _new?CERTREQ_NEW:CERTREQ_OLD);
fprintf(stdout, "%s", BTOA_ConvertItemToAscii(generateCertificateRequest(privateKey, publicKey, DN)));
fprintf(stdout, FOOTERREQUEST, _new?CERTREQ_NEW:CERTREQ_OLD);
15 years, 4 months
[Fedora-directory-commits] adminutil/lib/libadminutil form_post.c, 1.10, 1.11
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/adminutil/lib/libadminutil
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv3272/adminutil/lib/libadminutil
Modified Files:
form_post.c
Log Message:
Resolves: bug 462411
Bug Description: certificate request wizard returns an error
Reviewed by: nkinder (Thanks!)
Fix Description: This was broken as part of the fix for the XSS issues. To fix that, in order to make sure we never displayed any string that contained unescaped HTML entities, we just go ahead and escape everything when we read the values from the CGI GET or POST arguments. For this particular bug, this meant the cert CGI was getting a DN like this: CN="ldap.example.com" instead of CN="ldap.example.com". The solution is to add some functions to adminutil (stolen from dsgw) that can be used to escape/unescape HTML entities. We have to be careful never to display unescaped strings - in this particular case, the DN is never printed.
Platforms tested: RHEL5
Flag Day: yes - will require new adminutil, adminserver
Doc impact: no
Index: form_post.c
===================================================================
RCS file: /cvs/dirsec/adminutil/lib/libadminutil/form_post.c,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- form_post.c 27 Aug 2008 20:02:23 -0000 1.10
+++ form_post.c 3 Dec 2008 17:31:26 -0000 1.11
@@ -82,6 +82,100 @@
return input;
}
+#define ADMINUTIL_MAX_ENTITY_LEN 6 /* " */
+static char *specials = "&\"<>\'";
+static char *entities[] = { "&", """, "<", ">", "'" };
+static int entitylen[] = { 5, 6, 4, 4, 5 };
+static int entitynum = sizeof(entities)/sizeof(entities[0]);
+
+PR_IMPLEMENT(char *)
+strdup_escape_entities( char *s, int *madecopyp )
+{
+/*
+ * If the UTF8 string "s" contains any HTML special characters, make a
+ * duplicate where the appropriate HTML "entities" have been substituted
+ * for the special chars. For example, "<mcs(a)ace.com>" will be translated
+ * to "<mcs(a)ace.com>".
+ *
+ * If "s" does not contain any special characters, it is returned and
+ * *madecopyp is set to 0.
+ * Otherwise a malloc'd string is returned and *madecopyp is set to 1.
+ */
+ int spcount, idx;
+ char *p, *q, *r, *d;
+
+ spcount = 0;
+ for ( p = s; *p != '\0'; LDAP_UTF8INC( p )) {
+ if ( ((*p) & 0x80) == 0 && strchr( specials, *p ) != NULL ) {
+ ++spcount;
+ }
+ }
+
+ if ( spcount == 0 ) {
+ *madecopyp = 0;
+ return( s );
+ }
+
+ d = r = PR_Malloc( strlen( s ) + 1 + spcount * ADMINUTIL_MAX_ENTITY_LEN );
+ for ( p = s; *p != '\0'; LDAP_UTF8INC( p )) {
+ if ( ((*p) & 0x80) == 0 && ( q = strchr( specials, *p )) != NULL ) {
+ idx = ( q - specials );
+ memcpy( r, entities[ idx ], entitylen[ idx ] );
+ r += entitylen[ idx ];
+ } else {
+ r += LDAP_UTF8COPY( r, p );
+ }
+ }
+ *r = '\0';
+
+ *madecopyp = 1;
+ return( d );
+}
+
+/* this will convert a string with escaped entities ("&")
+ back to the original unescaped string ("&")
+ This is necessary for converting URLs which would normally
+ have entities in them (e.g. search?context=foo&dn=bar)
+ for use in javascript (e.g. window.href = 'search?context=foo&dn=bar')
+ since javascript must use the unescaped version
+ This converts the string in place since the entities "&"
+ take up much more room than the single character represented
+ If you need to work on a copy then make a copy with strdup first.
+*/
+PR_IMPLEMENT(void)
+unescape_entities(char *s)
+{
+ int idx;
+ char *p, *r, *d;
+
+ if (!s || !*s) {
+ return;
+ }
+
+ d = r = s;
+ for ( p = s; *p != '\0'; LDAP_UTF8INC( p )) {
+ if ( ((*p) & 0x80) == 0 && ( (*p) == '&') ) {
+ for( idx = 0; idx < entitynum; ++idx ) {
+ if (!strncmp(p, entities[ idx ], entitylen[ idx ])) {
+ break;
+ }
+ }
+ if (idx < entitynum) {
+ *r = specials[idx];
+ ++r;
+ p += entitylen[ idx ]-1; /* the 1 will be added in the for loop */
+ } else {
+ r += LDAP_UTF8COPY( r, p );
+ }
+ } else {
+ r += LDAP_UTF8COPY( r, p );
+ }
+ }
+ *r = '\0';
+
+ return;
+}
+
PR_IMPLEMENT(void)
form_unescape(char *str)
{
15 years, 4 months
[Fedora-directory-commits] adminutil/include/libadminutil admutil.h, 1.9, 1.10
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/adminutil/include/libadminutil
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv3272/adminutil/include/libadminutil
Modified Files:
admutil.h
Log Message:
Resolves: bug 462411
Bug Description: certificate request wizard returns an error
Reviewed by: nkinder (Thanks!)
Fix Description: This was broken as part of the fix for the XSS issues. To fix that, in order to make sure we never displayed any string that contained unescaped HTML entities, we just go ahead and escape everything when we read the values from the CGI GET or POST arguments. For this particular bug, this meant the cert CGI was getting a DN like this: CN="ldap.example.com" instead of CN="ldap.example.com". The solution is to add some functions to adminutil (stolen from dsgw) that can be used to escape/unescape HTML entities. We have to be careful never to display unescaped strings - in this particular case, the DN is never printed.
Platforms tested: RHEL5
Flag Day: yes - will require new adminutil, adminserver
Doc impact: no
Index: admutil.h
===================================================================
RCS file: /cvs/dirsec/adminutil/include/libadminutil/admutil.h,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- admutil.h 27 Aug 2008 20:05:58 -0000 1.9
+++ admutil.h 3 Dec 2008 17:31:26 -0000 1.10
@@ -424,6 +424,30 @@
#define WORD_WRAP_WIDTH 80
PR_IMPLEMENT(char) *alert_wrd_wrap(char *str, int width, char *linefeed);
+/*
+ * If the UTF8 string "s" contains any HTML special characters, make a
+ * duplicate where the appropriate HTML "entities" have been substituted
+ * for the special chars. For example, "<mcs(a)ace.com>" will be translated
+ * to "<mcs(a)ace.com>".
+ *
+ * If "s" does not contain any special characters, it is returned and
+ * *madecopyp is set to 0.
+ * Otherwise a malloc'd string is returned and *madecopyp is set to 1.
+ */
+PR_IMPLEMENT(char *) strdup_escape_entities(char *s, int *madecopyp);
+
+/* this will convert a string with escaped entities ("&")
+ back to the original unescaped string ("&")
+ This is necessary for converting URLs and other values which would normally
+ have entities in them (e.g. search?context=foo&dn=bar)
+ for use in javascript (e.g. window.href = 'search?context=foo&dn=bar')
+ since javascript must use the unescaped version
+ This converts the string in place since the entities "&"
+ take up much more room than the single character represented
+ If you need to work on a copy then make a copy with strdup first.
+*/
+PR_IMPLEMENT(void) unescape_entities(char *s);
+
/* Get internal variable info data structure */
/* This is hack, should be removed later - YJH */
/* form_post.c */
15 years, 4 months
[Fedora-directory-commits] ldapserver/ldap/schema 01common.ldif, 1.2, 1.3 60autofs.ldif, 1.1, 1.2 60eduperson.ldif, 1.1, 1.2 60mozilla.ldif, 1.1, 1.2 60pureftpd.ldif, 1.1, 1.2 60rfc2739.ldif, 1.1, 1.2 60rfc3712.ldif, 1.1, 1.2 60sabayon.ldif, 1.1, 1.2 60trust.ldif, 1.1, 1.2
by Nathan Kinder
Author: nkinder
Update of /cvs/dirsec/ldapserver/ldap/schema
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv26645/ldap/schema
Modified Files:
01common.ldif 60autofs.ldif 60eduperson.ldif 60mozilla.ldif
60pureftpd.ldif 60rfc2739.ldif 60rfc3712.ldif 60sabayon.ldif
60trust.ldif
Log Message:
Resolves: 474254
Summary: A number of the default attribute and objectclass definitions end up in 99user.ldif if you add any custom schema over LDAP.
Index: 01common.ldif
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/schema/01common.ldif,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- 01common.ldif 16 May 2007 20:07:48 -0000 1.2
+++ 01common.ldif 3 Dec 2008 00:03:25 -0000 1.3
@@ -125,7 +125,7 @@
attributeTypes: ( 1.3.6.1.4.1.1466.101.120.14 NAME 'supportedSASLMechanisms' DESC 'Standard LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE dSAOperation X-ORIGIN 'RFC 2252' )
attributeTypes: ( 1.3.6.1.4.1.1466.101.120.15 NAME 'supportedLDAPVersion' DESC 'Standard LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 USAGE dSAOperation X-ORIGIN 'RFC 2252' )
attributeTypes: ( 1.3.6.1.4.1.1466.101.120.16 NAME 'ldapSyntaxes' DESC 'Standard LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 USAGE directoryOperation X-ORIGIN 'RFC 2252' )
-attributeTypes: ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' DESC 'features supported by the server' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation )
+attributeTypes: ( 1.3.6.1.4.1.4203.1.3.5 NAME 'supportedFeatures' DESC 'features supported by the server' EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 USAGE dSAOperation X-ORIGIN 'RFC 3674')
attributeTypes: ( 2.16.840.1.113730.3.1.36 NAME 'nsLicensedFor' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
attributeTypes: ( 2.16.840.1.113730.3.1.37 NAME 'nsLicenseStartTime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
attributeTypes: ( 2.16.840.1.113730.3.1.38 NAME 'nsLicenseEndTime' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Administration Services' )
@@ -266,11 +266,9 @@
objectClasses: ( 2.16.840.1.113730.3.2.32 NAME 'netscapeMachineData' DESC 'Netscape defined objectclass' SUP top X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.38 NAME 'vlvSearch' DESC 'Netscape defined objectclass' SUP top MUST ( cn $ vlvBase $ vlvScope $ vlvFilter ) MAY ( multiLineDescription ) X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.39 NAME 'nsslapdConfig' DESC 'Netscape defined objectclass' SUP top MAY ( cn ) X-ORIGIN 'Netscape Directory Server' )
-objectClasses: ( 2.16.840.1.113730.3.2.39 NAME 'nsslapdConfig' DESC 'Netscape defined objectclass' SUP top MAY ( cn ) X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.42 NAME 'vlvIndex' DESC 'Netscape defined objectclass' SUP top MUST ( cn $ vlvSort ) MAY ( vlvEnabled $ vlvUses ) X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.43 NAME 'nsSNMP' DESC 'Netscape defined objectclass' SUP top MUST ( cn $ nsSNMPEnabled ) MAY ( nsSNMPOrganization $ nsSNMPLocation $ nsSNMPContact $ nsSNMPDescription $ nsSNMPName $ nsSNMPMasterHost $ nsSNMPMasterPort ) X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.84 NAME 'cosDefinition' DESC 'Netscape defined objectclass' SUP top MAY ( costargettree $ costemplatedn $ cosspecifier $ cosattribute $ aci $ cn $ uid ) X-ORIGIN 'Netscape Directory Server' )
-objectClasses: ( 2.16.840.1.113719.2.142.6.1.1 NAME 'ldapSubEntry' DESC 'LDAP Subentry class, version 1' SUP top STRUCTURAL MAY ( cn ) X-ORIGIN 'LDAP Subentry Internet Draft' )
objectClasses: ( 2.16.840.1.113730.3.2.93 NAME 'nsRoleDefinition' DESC 'Netscape defined objectclass' SUP ldapSubEntry MAY ( description ) X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.94 NAME 'nsSimpleRoleDefinition' DESC 'Netscape defined objectclass' SUP nsRoleDefinition X-ORIGIN 'Netscape Directory Server' )
objectClasses: ( 2.16.840.1.113730.3.2.95 NAME 'nsComplexRoleDefinition' DESC 'Netscape defined objectclass' SUP nsRoleDefinition X-ORIGIN 'Netscape Directory Server' )
Index: 60autofs.ldif
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/schema/60autofs.ldif,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- 60autofs.ldif 16 Oct 2008 16:43:36 -0000 1.1
+++ 60autofs.ldif 3 Dec 2008 00:03:25 -0000 1.2
@@ -12,6 +12,7 @@
EQUALITY caseExactIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
+ X-ORIGIN 'draft-howard-rfc2307bis'
)
#
################################################################################
@@ -24,6 +25,7 @@
STRUCTURAL
MUST ( cn $ automountInformation )
MAY ( description )
+ X-ORIGIN 'draft-howard-rfc2307bis'
)
#
################################################################################
@@ -35,6 +37,7 @@
SUP top
STRUCTURAL
MUST ( ou )
+ X-ORIGIN 'draft-howard-rfc2307bis'
)
#
################################################################################
Index: 60eduperson.ldif
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/schema/60eduperson.ldif,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- 60eduperson.ldif 16 Oct 2008 16:43:36 -0000 1.1
+++ 60eduperson.ldif 3 Dec 2008 00:03:25 -0000 1.2
@@ -1,4 +1,4 @@
-# 60eduperson.ldif - See http://www.educause.edu/eduperso
+# 60eduperson.ldif - See http://middleware.internet2.edu/eduperson/
################################################################################
#
dn: cn=schema
@@ -10,6 +10,7 @@
NAME 'eduPersonAffiliation'
DESC 'Affiliation'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+ X-ORIGIN 'http://middleware.internet2.edu/eduperson/'
)
#
################################################################################
@@ -19,6 +20,7 @@
NAME 'eduPersonNickName'
DESC 'NickName'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+ X-ORIGIN 'http://middleware.internet2.edu/eduperson/'
)
#
################################################################################
@@ -29,6 +31,7 @@
DESC 'Organization DN'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
SINGLE-VALUE
+ X-ORIGIN 'http://middleware.internet2.edu/eduperson/'
)
#
################################################################################
@@ -38,6 +41,7 @@
NAME 'eduPersonOrgUnitDN'
DESC 'Organizational Unit DN'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
+ X-ORIGIN 'http://middleware.internet2.edu/eduperson/'
)
#
################################################################################
@@ -48,6 +52,7 @@
DESC 'Primary Affiliation'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
+ X-ORIGIN 'http://middleware.internet2.edu/eduperson/'
)
#
################################################################################
@@ -58,6 +63,7 @@
DESC 'Principal Name'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
+ X-ORIGIN 'http://middleware.internet2.edu/eduperson/'
)
#
################################################################################
@@ -67,6 +73,7 @@
NAME 'eduPersonEntitlement'
DESC 'Entitlement'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+ X-ORIGIN 'http://middleware.internet2.edu/eduperson/'
)
#
################################################################################
@@ -76,6 +83,7 @@
NAME 'eduPersonPrimaryOrgUnitDN'
DESC 'Primary Organizational Unit'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
+ X-ORIGIN 'http://middleware.internet2.edu/eduperson/'
)
#
################################################################################
@@ -85,6 +93,7 @@
NAME 'eduPersonScopedAffiliation'
DESC 'Scoped Affiliation'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+ X-ORIGIN 'http://middleware.internet2.edu/eduperson/'
)
#
################################################################################
@@ -94,6 +103,7 @@
NAME 'eduPerson'
AUXILIARY
MAY ( eduPersonAffiliation $ eduPersonNickName $ eduPersonOrgDN $ eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $ eduPersonPrincipalName $ eduPersonEntitlement $eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation )
+ X-ORIGIN 'http://middleware.internet2.edu/eduperson/'
)
#
################################################################################
Index: 60mozilla.ldif
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/schema/60mozilla.ldif,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- 60mozilla.ldif 16 Oct 2008 16:43:36 -0000 1.1
+++ 60mozilla.ldif 3 Dec 2008 00:03:25 -0000 1.2
@@ -29,6 +29,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -40,6 +41,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -51,6 +53,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -62,6 +65,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -73,6 +77,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -84,6 +89,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -93,6 +99,7 @@
NAME 'mozillaHomeLocalityName'
SUP name
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -102,6 +109,7 @@
NAME 'mozillaHomeState'
SUP name
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -113,6 +121,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{40}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -122,6 +131,7 @@
NAME 'mozillaHomeCountryName'
SUP name
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -132,6 +142,7 @@
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -143,6 +154,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -153,6 +165,7 @@
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -161,6 +174,7 @@
1.3.6.1.4.1.13769.2.1
NAME ( 'mozillaNickname' 'xmozillanickname' )
SUP name
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -172,6 +186,7 @@
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256}
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -181,6 +196,7 @@
NAME ( 'mozillaUseHtmlMail' 'xmozillausehtmlmail' )
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -191,6 +207,7 @@
EQUALITY telephoneNumberMatch
SUBSTR telephoneNumberSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.50
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
@@ -207,6 +224,7 @@
AUXILIARY
MUST ( cn )
MAY ( c $ description $ displayName $ fax $ givenName $ homePhone $ l $ mail $ mobile $ mozillaCustom1 $ mozillaCustom2 $ mozillaCustom3 $ mozillaCustom4 $ mozillaHomeCountryName $ mozillaHomeLocalityName $ mozillaHomePostalCode $ mozillaHomeState $ mozillaHomeStreet $ mozillaHomeStreet2 $ mozillaHomeUrl $ mozillaNickname $ mozillaSecondEmail $ mozillaUseHtmlMail $ mozillaWorkStreet2 $ mozillaWorkUrl $ nsAIMid $ o $ ou $ pager $ postalCode $ postOfficeBox $ sn $ st $ street $ telephoneNumber $ title )
+ X-ORIGIN 'Mozilla Address Book'
)
#
################################################################################
Index: 60pureftpd.ldif
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/schema/60pureftpd.ldif,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- 60pureftpd.ldif 16 Oct 2008 16:43:36 -0000 1.1
+++ 60pureftpd.ldif 3 Dec 2008 00:03:25 -0000 1.2
@@ -16,6 +16,7 @@
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'Pure-FTPd'
)
#
################################################################################
@@ -27,6 +28,7 @@
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'Pure-FTPd'
)
#
################################################################################
@@ -38,6 +40,7 @@
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'Pure-FTPd'
)
#
################################################################################
@@ -49,6 +52,7 @@
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'Pure-FTPd'
)
#
################################################################################
@@ -60,6 +64,7 @@
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'Pure-FTPd'
)
#
################################################################################
@@ -71,6 +76,7 @@
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'Pure-FTPd'
)
#
################################################################################
@@ -82,6 +88,7 @@
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE
+ X-ORIGIN 'Pure-FTPd'
)
#
################################################################################
@@ -93,6 +100,7 @@
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'Pure-FTPd'
)
#
################################################################################
@@ -104,6 +112,7 @@
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'Pure-FTPd'
)
#
################################################################################
@@ -113,6 +122,7 @@
NAME 'PureFTPdUser'
DESC 'PureFTPd user with optional quota, throttling and ratio'
MAY ( FTPStatus $ FTPQuotaFiles $ FTPQuotaMBytes $ FTPUploadRatio $ FTPDownloadRatio $ FTPUploadBandwidth $ FTPDownloadBandwidth $ FTPuid $ FTPgid )
+ X-ORIGIN 'Pure-FTPd'
)
#
################################################################################
Index: 60rfc2739.ldif
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/schema/60rfc2739.ldif,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- 60rfc2739.ldif 16 Oct 2008 16:43:36 -0000 1.1
+++ 60rfc2739.ldif 3 Dec 2008 00:03:25 -0000 1.2
@@ -13,6 +13,7 @@
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
USAGE userApplications
+ X-ORIGIN 'rfc2739'
)
#
################################################################################
@@ -25,6 +26,7 @@
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
USAGE userApplications
+ X-ORIGIN 'rfc2739'
)
#
################################################################################
@@ -37,6 +39,7 @@
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
USAGE userApplications
+ X-ORIGIN 'rfc2739'
)
#
################################################################################
@@ -49,6 +52,7 @@
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
USAGE userApplications
+ X-ORIGIN 'rfc2739'
)
#
################################################################################
@@ -61,6 +65,7 @@
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
USAGE userApplications
+ X-ORIGIN 'rfc2739'
)
#
################################################################################
@@ -73,6 +78,7 @@
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
USAGE userApplications
+ X-ORIGIN 'rfc2739'
)
#
################################################################################
@@ -85,6 +91,7 @@
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
USAGE userApplications
+ X-ORIGIN 'rfc2739'
)
#
################################################################################
@@ -97,6 +104,7 @@
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
USAGE userApplications
+ X-ORIGIN 'rfc2739'
)
#
################################################################################
@@ -108,6 +116,7 @@
SUP top
AUXILIARY
MAY ( calCalURI $ calFBURL $ calOtherCalURIs $ calOtherFBURLs $ calCAPURI $ calOtherCAPURIs )
+ X-ORIGIN 'rfc2739'
)
#
################################################################################
Index: 60rfc3712.ldif
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/schema/60rfc3712.ldif,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- 60rfc3712.ldif 16 Oct 2008 16:43:36 -0000 1.1
+++ 60rfc3712.ldif 3 Dec 2008 00:03:25 -0000 1.2
@@ -13,6 +13,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -24,6 +25,7 @@
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -36,6 +38,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -48,6 +51,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -60,6 +64,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -72,6 +77,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -84,6 +90,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -96,6 +103,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -107,6 +115,7 @@
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -118,6 +127,7 @@
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -129,6 +139,7 @@
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{63}
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -139,6 +150,7 @@
DESC 'Set of charsets supported for the attribute values of syntax DirectoryString for this directory entry.'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{63}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -150,6 +162,7 @@
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{63}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -161,6 +174,7 @@
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -172,6 +186,7 @@
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -183,6 +198,7 @@
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -195,6 +211,7 @@
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -207,6 +224,7 @@
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -218,6 +236,7 @@
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -229,6 +248,7 @@
EQUALITY integerMatch
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -239,6 +259,7 @@
DESC 'The number of impression sides (one or two) and the two-sided impression rotations supported by this printer.'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -250,6 +271,7 @@
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -261,6 +283,7 @@
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -272,6 +295,7 @@
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -282,6 +306,7 @@
DESC 'List of print qualities supported for printing documents on this printer.'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -294,6 +319,7 @@
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -306,6 +332,7 @@
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -318,6 +345,7 @@
ORDERING integerOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -330,6 +358,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -342,6 +371,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
SINGLE-VALUE
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -352,6 +382,7 @@
DESC 'The possible delivery orientations of pages as they are printed and ejected from this printer.'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -362,6 +393,7 @@
DESC 'The possible stacking order of pages as they are printed and ejected from this printer.'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -372,6 +404,7 @@
DESC 'The possible output features supported by this printer.'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -383,6 +416,7 @@
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{127}
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -391,6 +425,7 @@
NAME 'printer-uri'
DESC 'A URI supported by this printer.'
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -402,6 +437,7 @@
SUP top
ABSTRACT
MAY ( printer-name $ printer-natural-language-configured $ printer-location $ printer-info $ printer-more-info $ printer-make-and-model $ printer-multiple-document-jobs-supported $ printer-charset-configured $ printer-charset-supported $ printer-generated-natural-language-supported $ printer-document-format-supported $ printer-color-supported $ printer-compression-supported $ printer-pages-per-minute $ printer-pages-per-minute-color $ printer-finishings-supported $ printer-number-up-supported $ printer-sides-supported $ printer-media-supported $ printer-media-local-supported $ printer-resolution-supported $ printer-print-quality-supported $ printer-job-priority-supported $ printer-copies-supported $ printer-job-k-octets-supported $ printer-current-operator $ printer-service-person $ printer-delivery-orientation-supported $ printer-stacking-order-supported $ printer-output-features-supported )
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -413,6 +449,7 @@
SUP printerAbstract
STRUCTURAL
MAY ( printer-uri $ printer-xri-supported )
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -424,6 +461,7 @@
SUP printerAbstract
AUXILIARY
MAY ( printer-uri $ printer-xri-supported )
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -435,6 +473,7 @@
SUP top
AUXILIARY
MAY ( printer-ipp-versions-supported $ printer-multiple-document-jobs-supported )
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
@@ -447,6 +486,7 @@
AUXILIARY
MUST ( printer-name )
MAY ( printer-aliases )
+ X-ORIGIN 'rfc3712'
)
#
################################################################################
Index: 60sabayon.ldif
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/schema/60sabayon.ldif,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- 60sabayon.ldif 16 Oct 2008 16:43:36 -0000 1.1
+++ 60sabayon.ldif 3 Dec 2008 00:03:25 -0000 1.2
@@ -14,6 +14,7 @@
NAME 'sabayonProfileURL'
DESC 'The URL of a sabayon profile'
SUP labeledURI
+ X-ORIGIN 'Sabayon'
)
# This attribute is used to store the name of a sabayon profile.
# It can refer to either a local zipfile (which will be looked up
@@ -27,6 +28,7 @@
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
SINGLE-VALUE
+ X-ORIGIN 'Sabayon'
)
# Simple example object to store profile information
# If you use this or something similar instead of a direct URL
@@ -39,6 +41,7 @@
STRUCTURAL
MUST cn
MAY ( sabayonProfileURL $ description )
+ X-ORIGIN 'Sabayon'
)
# Use these to put sabayonProfileName or sabayonProfileURL
# attributes in an objetc
@@ -49,6 +52,7 @@
SUP top
AUXILIARY
MUST sabayonProfileName
+ X-ORIGIN 'Sabayon'
)
objectClasses: (
1.3.6.1.4.1.2312.4.3.4.3
@@ -58,4 +62,5 @@
AUXILIARY
MUST cn
MAY sabayonProfileURL
+ X-ORIGIN 'Sabayon'
)
Index: 60trust.ldif
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/schema/60trust.ldif,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- 60trust.ldif 16 Oct 2008 16:43:36 -0000 1.1
+++ 60trust.ldif 3 Dec 2008 00:03:25 -0000 1.2
@@ -15,6 +15,7 @@
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
SINGLE-VALUE
+ X-ORIGIN 'nss_ldap/pam_ldap'
)
#
################################################################################
@@ -26,6 +27,7 @@
EQUALITY caseIgnoreIA5Match
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+ X-ORIGIN 'nss_ldap/pam_ldap'
)
#
################################################################################
@@ -38,6 +40,7 @@
AUXILIARY
MUST ( trustModel )
MAY ( accessTo )
+ X-ORIGIN 'nss_ldap/pam_ldap'
)
#
################################################################################
15 years, 4 months
[Fedora-directory-commits] ldapserver/ldap/servers/slapd globals.c, 1.9, 1.10 libglobs.c, 1.32, 1.33 proto-slap.h, 1.43, 1.44 sasl_map.c, 1.11, 1.12 slap.h, 1.41, 1.42 slapi-private.h, 1.30, 1.31 ssl.c, 1.19, 1.20 util.c, 1.19, 1.20
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/slapd
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv1168/ldapserver/ldap/servers/slapd
Modified Files:
globals.c libglobs.c proto-slap.h sasl_map.c slap.h
slapi-private.h ssl.c util.c
Log Message:
Resolves: bug 469261
Bug Description: Support server-to-server SASL - console chaining, server cleanup
Reviewed by: nkinder (Thanks!)
Fix Description: There are two sets of diffs here. The first set adds tls, gssapi, and digest to the chaining database (aka database link) panels in the console. I had to add support for revert to some of the code to make the Reset button work without having to retrieve the values from the server each time. We already store the original values locally in the _origModel - I added code to allow the use of that in the Reset button.
The second set of diffs is for the server.
1) I had to add support for "SIMPLE" for bindMechanism - this translates to LDAP_SASL_SIMPLE for the actual mechanism. This value is NULL, so I had to add handling for NULL values in the cb config code (slapi_ch_* work fine with NULL values).
2) Added some more debugging/tracing code
3) The server to server SSL code would only work if the server were configured to be an SSL server. But for the server to be an SSL client, it only needs NSS initialized and to have the CA cert. It also needs to configured some of the SSL settings and install the correct policy. I changed the server code to do this.
Platforms tested: RHEL5
Flag Day: no
Doc impact: Yes
Index: globals.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/globals.c,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- globals.c 24 Oct 2008 22:36:58 -0000 1.9
+++ globals.c 2 Dec 2008 15:29:30 -0000 1.10
@@ -165,7 +165,6 @@
sep->sep_ps_wakeup_all = (caddr_t)ps_wakeup_all;
sep->sep_ps_service = (caddr_t)ps_service_persistent_searches;
sep->sep_disconnect_server = (caddr_t)disconnect_server;
- sep->sep_slapd_SSL_client_init = (caddr_t)slapd_SSL_client_init;
sep->sep_slapd_ssl_init = (caddr_t)slapd_ssl_init;
sep->sep_slapd_ssl_init2 = (caddr_t)slapd_ssl_init2;
set_dll_entry_points( sep );
Index: libglobs.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/libglobs.c,v
retrieving revision 1.32
retrieving revision 1.33
diff -u -r1.32 -r1.33
--- libglobs.c 26 Nov 2008 17:32:21 -0000 1.32
+++ libglobs.c 2 Dec 2008 15:29:30 -0000 1.33
@@ -1036,9 +1036,6 @@
case ENTRY_POINT_DISCONNECT_SERVER:
*ep_addr = sep->sep_disconnect_server;
break;
- case ENTRY_POINT_SLAPD_SSL_CLIENT_INIT:
- *ep_addr = sep->sep_slapd_SSL_client_init;
- break;
case ENTRY_POINT_SLAPD_SSL_INIT:
*ep_addr = sep->sep_slapd_ssl_init;
break;
Index: proto-slap.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/proto-slap.h,v
retrieving revision 1.43
retrieving revision 1.44
diff -u -r1.43 -r1.44
--- proto-slap.h 25 Nov 2008 19:20:27 -0000 1.43
+++ proto-slap.h 2 Dec 2008 15:29:30 -0000 1.44
@@ -899,9 +899,6 @@
/*
* ssl.c
*/
-int slapd_SSL_client_init();
-int slapd_SSL_client_bind_s( LDAP* ld, char* DN, char* pw, int use_SSL, int LDAPv);
-int slapd_sasl_ext_client_bind( LDAP* ld, int **msgid);
int slapd_nss_init(int init_ssl, int config_available);
int slapd_ssl_init();
int slapd_ssl_init2(PRFileDesc **fd, int startTLS);
Index: sasl_map.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/sasl_map.c,v
retrieving revision 1.11
retrieving revision 1.12
diff -u -r1.11 -r1.12
--- sasl_map.c 6 Nov 2008 00:34:19 -0000 1.11
+++ sasl_map.c 2 Dec 2008 15:29:30 -0000 1.12
@@ -320,6 +320,7 @@
sasl_map_data *dp = NULL;
for (map_entry = map_entry_list; *map_entry && !ret; map_entry++) {
+ LDAPDebug( LDAP_DEBUG_CONFIG, "sasl_map_read_config_startup - proceesing [%s]\n", *map_entry, 0, 0 );
getConfigEntry( *map_entry, &entry );
if ( entry == NULL ) {
continue;
@@ -331,6 +332,8 @@
ret = sasl_map_insert_list_entry(priv,dp);
if (ret) {
LDAPDebug( LDAP_DEBUG_ANY, "sasl_map_read_config_startup failed to insert entry\n", 0, 0, 0 );
+ } else {
+ LDAPDebug( LDAP_DEBUG_CONFIG, "sasl_map_read_config_startup - processed [%s]\n", *map_entry, 0, 0 );
}
}
freeConfigEntry( &entry );
@@ -513,6 +516,7 @@
while (this_map) {
int matched = 0;
/* If one matches, then make the search params */
+ LDAPDebug( LDAP_DEBUG_TRACE, "sasl_map_domap - trying map [%s]\n", this_map->name, 0, 0 );
matched = sasl_map_check(this_map, sasl_user_and_realm, ldap_search_base, ldap_search_filter);
if (1 == matched) {
ret = 1;
Index: slap.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/slap.h,v
retrieving revision 1.41
retrieving revision 1.42
diff -u -r1.41 -r1.42
--- slap.h 26 Nov 2008 17:32:21 -0000 1.41
+++ slap.h 2 Dec 2008 15:29:30 -0000 1.42
@@ -1601,7 +1601,6 @@
typedef void (*ps_service_fn_ptr)(Slapi_Entry *, Slapi_Entry *, int, int );
typedef char *(*get_config_dn_fn_ptr)();
typedef void (*get_disconnect_server_fn_ptr)(Connection *conn, PRUint64 opconnid, int opid, PRErrorCode reason, PRInt32 error );
-typedef int (*slapd_SSL_client_init_fn_ptr)( void );
typedef int (*modify_config_dse_fn_ptr)( Slapi_PBlock *pb );
typedef int (*slapd_ssl_init_fn_ptr)( void );
typedef int (*slapd_ssl_init_fn_ptr2)( PRFileDesc **s, int StartTLS);
@@ -1614,7 +1613,6 @@
caddr_t sep_ps_wakeup_all;
caddr_t sep_ps_service;
caddr_t sep_disconnect_server;
- caddr_t sep_slapd_SSL_client_init;
caddr_t sep_slapd_ssl_init;
caddr_t sep_slapd_ssl_init2;
} slapdEntryPoints;
Index: slapi-private.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/slapi-private.h,v
retrieving revision 1.30
retrieving revision 1.31
diff -u -r1.30 -r1.31
--- slapi-private.h 26 Nov 2008 22:42:12 -0000 1.30
+++ slapi-private.h 2 Dec 2008 15:29:30 -0000 1.31
@@ -1108,11 +1108,7 @@
time_t parse_genTime(char* from);
/* Client SSL code */
-int slapd_SSL_client_init( void );
int slapd_security_library_is_initialized( void );
-int slapd_SSL_client_bind_s(LDAP* ld, char* DN, char* pw, int use_SSL, int LDAPv);
-int slapd_sasl_ext_client_bind(LDAP* ld, int **msgid);
-int slapd_Client_auth(LDAP* ld);
char* slapd_get_tmp_dir( void );
/* Misc crrrrrrap */
Index: ssl.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/ssl.c,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- ssl.c 4 Nov 2008 18:23:08 -0000 1.19
+++ ssl.c 2 Dec 2008 15:29:30 -0000 1.20
@@ -459,6 +459,14 @@
rv = -1;
}
+ if(SSLPLCY_Install() != PR_SUCCESS) {
+ errorCode = PR_GetError();
+ slapd_SSL_warn("Security Initialization: Unable to set SSL export policy ("
+ SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
+ errorCode, slapd_pr_strerror(errorCode));
+ return -1;
+ }
+
/****** end of NSS Initialization ******/
slapi_ch_free_string(&certdir);
@@ -622,15 +630,6 @@
}
freeConfigEntry( &entry );
- if(SSLPLCY_Install() != PR_SUCCESS) {
- errorCode = PR_GetError();
- slapd_SSL_warn("Security Initialization: Unable to set SSL export policy ("
- SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- errorCode, slapd_pr_strerror(errorCode));
- return -1;
- }
-
-
/* ugaston- Cipher preferences must be set before any sslSocket is created
* for such sockets to take preferences into account.
*/
@@ -1041,12 +1040,6 @@
*/
int
-slapd_SSL_client_init()
-{
- return 0;
-}
-
-int
slapd_SSL_client_auth (LDAP* ld)
{
int rc = 0;
@@ -1205,111 +1198,6 @@
return rc;
}
-int
-slapd_simple_client_bind_s(LDAP* ld, char* DN, char* pw, int LDAPv)
-{
- int rc;
- PRErrorCode errorCode;
-
- ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, (void *) &LDAPv);
- rc = ldap_simple_bind_s (ld, DN, pw);
- if (rc != 0) {
- errorCode = PR_GetError();
- slapd_SSL_warn("ldap_simple_bind_s(%s, %s) %i (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- DN, pw, rc, errorCode, slapd_pr_strerror(errorCode));
- }
- LDAPDebug (LDAP_DEBUG_TRACE, "slapd_simple_client_bind_s(%s, %i) %i\n", DN, LDAPv, rc);
- return rc;
-}
-
-int
-slapd_SSL_client_bind_s (LDAP* ld, char* DN, char* pw, int use_SSL, int LDAPv)
-{
- int rc;
- struct berval noCred = {0, 0};
-
- if (!use_SSL || LDAPv == LDAP_VERSION2) {
- rc = slapd_simple_client_bind_s(ld, DN, pw, LDAPv);
- } else {
-
- LDAPDebug (
- LDAP_DEBUG_TRACE,
- "slapd_SSL_client_bind_s: Trying SSL Client Authentication\n",
- 0, 0, 0);
-
- rc = slapd_SSL_client_auth(ld);
-
- if(rc != 0)
- {
- LDAPDebug (
- LDAP_DEBUG_TRACE,
- "slapd_SSL_client_bind_s: SSL Client Auth Failed during replication Bind\n",
- 0, 0, 0);
- return rc;
- }
-
- rc = ldap_sasl_bind_s (ld, "", LDAP_SASL_EXTERNAL, &noCred,
- NULL /* LDAPControl **serverctrls */,
- NULL /* LDAPControl **clientctrls */,
- NULL /* struct berval **servercredp */);
-
- }
- LDAPDebug (
- LDAP_DEBUG_TRACE,
- "slapd_SSL_client_bind_s(%i,%i) %i\n", use_SSL, LDAPv, rc);
- return rc;
-}
-
-int
-slapd_sasl_ext_client_bind (LDAP* ld, int **msgid)
-{
- int rc;
- PRErrorCode errorCode;
- struct berval noCred = {0, 0};
-
- LDAPDebug (
- LDAP_DEBUG_TRACE,
- "slapd_sasl_ext_client_bind: Trying SSL Client Authentication\n",
- 0, 0, 0);
-
- rc = slapd_SSL_client_auth(ld);
- if(rc != 0)
- {
- LDAPDebug (
- LDAP_DEBUG_TRACE,
- "slapd_sasl_ext_client_bind: SSL Client Auth Failed during replication Bind\n",
- 0, 0, 0);
- return rc;
- }
-
- rc = ldap_sasl_bind (ld, "", LDAP_SASL_EXTERNAL, &noCred,
- NULL,
- NULL,
- *msgid);
- if (rc != 0) {
- errorCode = PR_GetError();
- slapd_SSL_warn("ldap_sasl_bind(\"\",LDAP_SASL_EXTERNAL) %i (" SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- rc, errorCode, slapd_pr_strerror(errorCode));
- }
-
- LDAPDebug (
- LDAP_DEBUG_TRACE,
- "slapd_sasl_ext_client_bind %i\n", rc, 0, 0);
-
- return rc;
-}
-
-
-int slapd_Client_auth(LDAP* ld)
-{
- int rc=0;
-
- rc = slapd_SSL_client_auth (ld);
-
- return rc;
-}
-
-
/* Function for keeping track of the SSL initialization status:
* - returns 1: when slapd_ssl_init has been executed
*/
Index: util.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/slapd/util.c,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- util.c 12 Nov 2008 17:42:37 -0000 1.19
+++ util.c 2 Dec 2008 15:29:31 -0000 1.20
@@ -961,6 +961,7 @@
*/
if (secure > 0) {
int ssl_strength = 0;
+ LDAP *myld = NULL;
if (config_get_ssl_check_hostname()) {
/* check hostname against name in certificate */
@@ -970,24 +971,23 @@
ssl_strength = LDAPSSL_AUTH_CERT;
}
- /* Can only use ldapssl_set_strength on and LDAP* already
- initialized for SSL - this is not the case when using
- startTLS, so we use NULL to set the default for all
- new connections */
+ /* we can only use the set functions below with a real
+ LDAP* if it has already gone through ldapssl_init -
+ so, use NULL if using starttls */
if (secure == 1) {
- rc = ldapssl_set_strength(ld, ssl_strength);
- } else {
- rc = ldapssl_set_strength(NULL, ssl_strength);
+ myld = ld;
}
- if (rc != 0) {
+ if ((rc = ldapssl_set_strength(myld, ssl_strength)) ||
+ (rc = ldapssl_set_option(myld, SSL_ENABLE_SSL2, PR_FALSE)) ||
+ (rc = ldapssl_set_option(myld, SSL_ENABLE_SSL3, PR_TRUE)) ||
+ (rc = ldapssl_set_option(myld, SSL_ENABLE_TLS, PR_TRUE))) {
int prerr = PR_GetError();
slapi_log_error(SLAPI_LOG_FATAL, "slapi_ldap_init_ext",
- "failed: unable to set SSL strength to %d ("
+ "failed: unable to set SSL options ("
SLAPI_COMPONENT_NAME_NSPR " error %d - %s)",
- ssl_strength, prerr,
- slapd_pr_strerror(prerr));
+ prerr, slapd_pr_strerror(prerr));
}
if (secure == 1) {
@@ -1023,6 +1023,11 @@
ldap_controls_free(clientctrls); /* free the copy */
}
+ slapi_log_error(SLAPI_LOG_SHELL, "slapi_ldap_init_ext",
+ "Success: set up conn to [%s:%d]%s\n",
+ hostname, port,
+ (secure == 2) ? " using startTLS" :
+ ((secure == 1) ? " using SSL" : ""));
done:
ldap_free_urldesc(ludp);
@@ -1092,7 +1097,10 @@
"auth - error %d - make sure the server is "
"correctly configured for SSL/TLS\n", rc);
goto done;
- }
+ } else {
+ slapi_log_error(SLAPI_LOG_SHELL, "slapi_ldap_bind",
+ "Set up conn to use client auth\n");
+ }
bvcreds.bv_val = NULL; /* ignore username and passed in creds */
bvcreds.bv_len = 0; /* for external auth */
bindid = NULL;
@@ -1110,6 +1118,8 @@
rc, ldap_err2string(rc));
goto done;
}
+ slapi_log_error(SLAPI_LOG_SHELL, "slapi_ldap_bind",
+ "startTLS started on connection\n");
}
/* The connection has been set up - now do the actual bind, depending on
@@ -1118,14 +1128,20 @@
!strcmp(mech, LDAP_SASL_EXTERNAL)) {
int mymsgid = 0;
+ slapi_log_error(SLAPI_LOG_SHELL, "slapi_ldap_bind",
+ "attempting %s bind with id [%s] creds [%s]\n",
+ mech ? mech : "SIMPLE",
+ bindid, creds);
if ((rc = ldap_sasl_bind(ld, bindid, mech, &bvcreds, serverctrls,
NULL /* clientctrls */, &mymsgid))) {
slapi_log_error(SLAPI_LOG_FATAL, "slapi_ldap_bind",
"Error: could not send bind request for id "
- "[%s] mech [%s]: error %d (%s)\n",
+ "[%s] mech [%s]: error %d (%s) %d (%s) %d (%s)\n",
bindid ? bindid : "(anon)",
mech ? mech : "SIMPLE",
- rc, ldap_err2string(rc));
+ rc, ldap_err2string(rc),
+ PR_GetError(), slapd_pr_strerror(PR_GetError()),
+ errno, slapd_system_strerror(errno));
goto done;
}
15 years, 4 months
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/replication repl5_connection.c, 1.12, 1.13 windows_connection.c, 1.21, 1.22
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/replication
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv1168/ldapserver/ldap/servers/plugins/replication
Modified Files:
repl5_connection.c windows_connection.c
Log Message:
Resolves: bug 469261
Bug Description: Support server-to-server SASL - console chaining, server cleanup
Reviewed by: nkinder (Thanks!)
Fix Description: There are two sets of diffs here. The first set adds tls, gssapi, and digest to the chaining database (aka database link) panels in the console. I had to add support for revert to some of the code to make the Reset button work without having to retrieve the values from the server each time. We already store the original values locally in the _origModel - I added code to allow the use of that in the Reset button.
The second set of diffs is for the server.
1) I had to add support for "SIMPLE" for bindMechanism - this translates to LDAP_SASL_SIMPLE for the actual mechanism. This value is NULL, so I had to add handling for NULL values in the cb config code (slapi_ch_* work fine with NULL values).
2) Added some more debugging/tracing code
3) The server to server SSL code would only work if the server were configured to be an SSL server. But for the server to be an SSL client, it only needs NSS initialized and to have the CA cert. It also needs to configured some of the SSL settings and install the correct policy. I changed the server code to do this.
Platforms tested: RHEL5
Flag Day: no
Doc impact: Yes
Index: repl5_connection.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/repl5_connection.c,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- repl5_connection.c 10 Nov 2008 23:57:47 -0000 1.12
+++ repl5_connection.c 2 Dec 2008 15:29:30 -0000 1.13
@@ -949,30 +949,25 @@
/* ugaston: if SSL has been selected in the replication agreement, SSL client
* initialisation should be done before ever trying to open any connection at all.
*/
- if ((conn->transport_flags == TRANSPORT_FLAG_TLS) ||
- (conn->transport_flags == TRANSPORT_FLAG_SSL))
- {
+ if (conn->transport_flags == TRANSPORT_FLAG_TLS) {
+ secure = 2;
+ } else if (conn->transport_flags == TRANSPORT_FLAG_SSL) {
+ secure = 1;
+ }
- /** Make sure the SSL Library has been initialized before anything else **/
- if(slapd_security_library_is_initialized() != 1)
- {
+ if (secure > 0) {
+ if (!NSS_IsInitialized()) {
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
- "%s: SSL Not Initialized, Replication over SSL FAILED\n",
- agmt_get_long_name(conn->agmt));
+ "%s: SSL Not Initialized, Replication over SSL FAILED\n",
+ agmt_get_long_name(conn->agmt));
conn->last_ldap_error = LDAP_INAPPROPRIATE_AUTH;
conn->last_operation = CONN_INIT;
ber_bvfree(creds);
creds = NULL;
return CONN_SSL_NOT_ENABLED;
- } else if (conn->transport_flags == TRANSPORT_FLAG_SSL)
- {
- secure = 1;
- } else
- {
- secure = 2; /* 2 means starttls security */
}
}
-
+
if (return_value == CONN_OPERATION_SUCCESS) {
int io_timeout_ms;
/* Now we initialize the LDAP Structure and set options */
Index: windows_connection.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/replication/windows_connection.c,v
retrieving revision 1.21
retrieving revision 1.22
diff -u -r1.21 -r1.22
--- windows_connection.c 10 Nov 2008 23:57:47 -0000 1.21
+++ windows_connection.c 2 Dec 2008 15:29:30 -0000 1.22
@@ -1193,30 +1193,25 @@
/* ugaston: if SSL has been selected in the replication agreement, SSL client
* initialisation should be done before ever trying to open any connection at all.
*/
- if ((conn->transport_flags == TRANSPORT_FLAG_TLS) ||
- (conn->transport_flags == TRANSPORT_FLAG_SSL))
- {
-
- /** Make sure the SSL Library has been initialized before anything else **/
- if(slapd_security_library_is_initialized() != 1)
- {
+ if (conn->transport_flags == TRANSPORT_FLAG_TLS) {
+ secure = 2;
+ } else if (conn->transport_flags == TRANSPORT_FLAG_SSL) {
+ secure = 1;
+ }
+
+ if (secure > 0) {
+ if (!NSS_IsInitialized()) {
slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name,
- "%s: SSL Not Initialized, Replication over SSL FAILED\n",
- agmt_get_long_name(conn->agmt));
+ "%s: SSL Not Initialized, Replication over SSL FAILED\n",
+ agmt_get_long_name(conn->agmt));
conn->last_ldap_error = LDAP_INAPPROPRIATE_AUTH;
conn->last_operation = CONN_INIT;
ber_bvfree(creds);
creds = NULL;
return CONN_SSL_NOT_ENABLED;
- } else if (conn->transport_flags == TRANSPORT_FLAG_SSL)
- {
- secure = 1;
- } else
- {
- secure = 2; /* 2 means starttls security */
}
}
-
+
if (return_value == CONN_OPERATION_SUCCESS) {
int io_timeout_ms;
/* Now we initialize the LDAP Structure and set options */
15 years, 4 months
[Fedora-directory-commits] ldapserver/ldap/servers/plugins/chainingdb cb.h, 1.6, 1.7 cb_conn_stateless.c, 1.9, 1.10 cb_instance.c, 1.12, 1.13
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/ldapserver/ldap/servers/plugins/chainingdb
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv1168/ldapserver/ldap/servers/plugins/chainingdb
Modified Files:
cb.h cb_conn_stateless.c cb_instance.c
Log Message:
Resolves: bug 469261
Bug Description: Support server-to-server SASL - console chaining, server cleanup
Reviewed by: nkinder (Thanks!)
Fix Description: There are two sets of diffs here. The first set adds tls, gssapi, and digest to the chaining database (aka database link) panels in the console. I had to add support for revert to some of the code to make the Reset button work without having to retrieve the values from the server each time. We already store the original values locally in the _origModel - I added code to allow the use of that in the Reset button.
The second set of diffs is for the server.
1) I had to add support for "SIMPLE" for bindMechanism - this translates to LDAP_SASL_SIMPLE for the actual mechanism. This value is NULL, so I had to add handling for NULL values in the cb config code (slapi_ch_* work fine with NULL values).
2) Added some more debugging/tracing code
3) The server to server SSL code would only work if the server were configured to be an SSL server. But for the server to be an SSL client, it only needs NSS initialized and to have the CA cert. It also needs to configured some of the SSL settings and install the correct policy. I changed the server code to do this.
Platforms tested: RHEL5
Flag Day: no
Doc impact: Yes
Index: cb.h
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/chainingdb/cb.h,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- cb.h 5 Nov 2008 18:21:05 -0000 1.6
+++ cb.h 2 Dec 2008 15:29:30 -0000 1.7
@@ -168,6 +168,8 @@
#define CB_DEF_STARTTLS "off" /* CB_CONFIG_STARTTLS */
#define CB_DEF_BINDMECH LDAP_SASL_SIMPLE /* CB_CONFIG_BINDMECH */
+#define CB_SIMPLE_BINDMECH "SIMPLE" /* will be translated to LDAP_SASL_SIMPLE */
+
typedef void *cb_config_get_fn_t(void *arg);
typedef int cb_config_set_fn_t(void *arg, void *value, char *errorbuf, int phase, int apply);
typedef struct _cb_instance_config_info {
Index: cb_conn_stateless.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/chainingdb/cb_conn_stateless.c,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- cb_conn_stateless.c 5 Nov 2008 18:21:05 -0000 1.9
+++ cb_conn_stateless.c 2 Dec 2008 15:29:30 -0000 1.10
@@ -318,15 +318,6 @@
int version=LDAP_VERSION3;
- /* check wether the security libraries are correctly initialized */
- if (secure && slapd_security_library_is_initialized() != 1) {
- slapi_log_error(
- SLAPI_LOG_FATAL, CB_PLUGIN_SUBSYSTEM,
- "SSL Not Initialized, Chaining Backend over SSL FAILED\n");
- rc = LDAP_CONNECT_ERROR;
- goto unlock_and_return;
- }
-
/*
* we have not exceeded the maximum number of connections allowed,
* so we initialize a new one and add it to the end of our list.
Index: cb_instance.c
===================================================================
RCS file: /cvs/dirsec/ldapserver/ldap/servers/plugins/chainingdb/cb_instance.c,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- cb_instance.c 13 Nov 2008 23:08:17 -0000 1.12
+++ cb_instance.c 2 Dec 2008 15:29:30 -0000 1.13
@@ -1380,11 +1380,17 @@
( phase != CB_CONFIG_PHASE_STARTUP )) {
/* Dynamic modif */
- charray_add(&inst->pool->waste_basket,inst->pool->mech);
+ if (inst->pool->mech) {
+ charray_add(&inst->pool->waste_basket,inst->pool->mech);
+ }
rc=CB_REOPEN_CONN;
}
- inst->pool->mech=slapi_ch_strdup((char *) value);
+ if (value && !PL_strcasecmp((char *) value, CB_SIMPLE_BINDMECH)) {
+ inst->pool->mech=slapi_ch_strdup(LDAP_SASL_SIMPLE);
+ } else {
+ inst->pool->mech=slapi_ch_strdup((char *) value);
+ }
PR_RWLock_Unlock(inst->rwl_config_lock);
}
return rc;
@@ -1513,8 +1519,12 @@
/* Remember the get function for strings returns memory
* that must be freed. */
tmp_string = (char *) config->config_get_fn(arg);
- PR_snprintf(buf, CB_BUFSIZE, "%s", (char *) tmp_string);
- slapi_ch_free((void **)&tmp_string);
+ if (tmp_string) {
+ PR_snprintf(buf, CB_BUFSIZE, "%s", (char *) tmp_string);
+ slapi_ch_free_string(&tmp_string);
+ } else {
+ buf[0] = '\0';
+ }
break;
case CB_CONFIG_TYPE_ONOFF:
if ((int) ((uintptr_t)config->config_get_fn(arg))) {
@@ -1606,8 +1616,11 @@
val.bv_val = buf;
val.bv_len = strlen(buf);
- if (val.bv_len)
- slapi_entry_attr_replace(e, config->config_name, vals);
+ if (val.bv_len) {
+ slapi_entry_attr_replace(e, config->config_name, vals);
+ } else {
+ slapi_entry_attr_delete(e, config->config_name);
+ }
}
*returncode = LDAP_SUCCESS;
15 years, 4 months
[Fedora-directory-commits] directoryconsole/src/com/netscape/admin/dirserv/panel BlankPanel.java, 1.2, 1.3 ChainingInstanceAuthPanel.java, 1.1.1.1, 1.2 DSEntry.java, 1.1.1.1, 1.2 NewChainingInstancePanel.java, 1.1.1.1, 1.2 NewChainingPanel.java, 1.1.1.1, 1.2
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/directoryconsole/src/com/netscape/admin/dirserv/panel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv764/directoryconsole/src/com/netscape/admin/dirserv/panel
Modified Files:
BlankPanel.java ChainingInstanceAuthPanel.java DSEntry.java
NewChainingInstancePanel.java NewChainingPanel.java
Log Message:
Resolves: bug 469261
Bug Description: Support server-to-server SASL - console chaining, server cleanup
Reviewed by: nkinder (Thanks!)
Fix Description: There are two sets of diffs here. The first set adds tls, gssapi, and digest to the chaining database (aka database link) panels in the console. I had to add support for revert to some of the code to make the Reset button work without having to retrieve the values from the server each time. We already store the original values locally in the _origModel - I added code to allow the use of that in the Reset button.
The second set of diffs is for the server.
1) I had to add support for "SIMPLE" for bindMechanism - this translates to LDAP_SASL_SIMPLE for the actual mechanism. This value is NULL, so I had to add handling for NULL values in the cb config code (slapi_ch_* work fine with NULL values).
2) Added some more debugging/tracing code
3) The server to server SSL code would only work if the server were configured to be an SSL server. But for the server to be an SSL client, it only needs NSS initialized and to have the CA cert. It also needs to configured some of the SSL settings and install the correct policy. I changed the server code to do this.
Platforms tested: RHEL5
Flag Day: no
Doc impact: Yes
Index: BlankPanel.java
===================================================================
RCS file: /cvs/dirsec/directoryconsole/src/com/netscape/admin/dirserv/panel/BlankPanel.java,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- BlankPanel.java 2 Jul 2007 19:44:09 -0000 1.2
+++ BlankPanel.java 2 Dec 2008 15:27:37 -0000 1.3
@@ -339,6 +339,31 @@
}
}
+ /**
+ * Reverts all DSEntries registered with the panel
+ * Mainly used by the panels that us DSEntry for
+ * display management rather than data transfer
+ * Usually, the remoteToLocal is used to refresh
+ * the model from the server, but this takes the
+ * short cut of using revert to just replace the
+ * model with the original model stored in the DSEntry
+ * then to use show to "flush" the model to the view
+ */
+ protected void revertAll () {
+ Enumeration values = _componentMapDSEntryTable.elements();
+ while ( values.hasMoreElements() ) {
+ Vector v = (Vector)values.nextElement();
+ Enumeration entries = v.elements();
+ while( entries.hasMoreElements() ) {
+ DSEntry entry = (DSEntry)entries.nextElement();
+ if (entry != null) {
+ entry.revert();
+ entry.show();
+ }
+ }
+ }
+ }
+
/* Validates all elements of the panel */
private void validateAll () {
int result;
Index: ChainingInstanceAuthPanel.java
===================================================================
RCS file: /cvs/dirsec/directoryconsole/src/com/netscape/admin/dirserv/panel/ChainingInstanceAuthPanel.java,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- ChainingInstanceAuthPanel.java 18 Jul 2005 00:55:53 -0000 1.1.1.1
+++ ChainingInstanceAuthPanel.java 2 Dec 2008 15:27:37 -0000 1.2
@@ -28,8 +28,6 @@
import javax.swing.event.*;
import com.netscape.admin.dirserv.*;
import com.netscape.management.client.*;
-import com.netscape.management.client.util.AbstractDialog;
-import com.netscape.management.client.util.Debug;
import com.netscape.management.client.util.*;
import netscape.ldap.*;
import netscape.ldap.util.DN;
@@ -71,6 +69,7 @@
createComment( _myPanel );
checkComment();
addBottomGlue();
+ showAll();
_isInitialized = true;
}
@@ -153,8 +152,6 @@
_lcommentAciLabel = makeJLabel( _section,
"proxy-help-aci" );
- _lcommentAci = new JLabel();
-
_tfaCommentAci = new JTextArea( 3, 10);
_lcommentAciLabel.setLabelFor(_tfaCommentAci);
_tfaCommentAci.setWrapStyleWord( true );
@@ -220,6 +217,29 @@
pgbc.weightx = 1;
panel.add( _lSuffixText, pgbc);
+ pgbc.gridy++;
+ pgbc.gridx = 0;
+ pgbc.fill = pgbc.NONE;
+ pgbc.weightx = 0;
+ pgbc.anchor = pgbc.EAST;
+ panel.add( _lConnType, pgbc);
+
+ pgbc.gridx = 1;
+ pgbc.anchor = pgbc.WEST;
+ pgbc.weightx = 1;
+ panel.add( _noEncrypt, pgbc);
+
+ pgbc.gridy++;
+ pgbc.gridx = 1;
+ pgbc.anchor = pgbc.WEST;
+ pgbc.weightx = 1;
+ panel.add( _sslEncrypt, pgbc);
+
+ pgbc.gridy++;
+ pgbc.gridx = 1;
+ pgbc.anchor = pgbc.WEST;
+ pgbc.weightx = 1;
+ panel.add( _tlsEncrypt, pgbc);
pgbc.gridy++;
pgbc.gridx = 0;
@@ -228,7 +248,37 @@
_lnsfarmserverurl,
_tfnsfarmserverurl);
- pgbc.gridy++;
+ pgbc.gridy++;
+ pgbc.gridx = 0;
+ pgbc.fill = pgbc.NONE;
+ pgbc.weightx = 0;
+ pgbc.anchor = pgbc.EAST;
+ panel.add( _authMechLabel, pgbc);
+
+ pgbc.gridx = 1;
+ pgbc.anchor = pgbc.WEST;
+ pgbc.weightx = 1;
+ panel.add( _sslAuth, pgbc);
+
+ pgbc.gridy++;
+ pgbc.gridx = 1;
+ pgbc.anchor = pgbc.WEST;
+ pgbc.weightx = 1;
+ panel.add( _gssapiAuth, pgbc);
+
+ pgbc.gridy++;
+ pgbc.gridx = 1;
+ pgbc.anchor = pgbc.WEST;
+ pgbc.weightx = 1;
+ panel.add( _digestAuth, pgbc);
+
+ pgbc.gridy++;
+ pgbc.gridx = 1;
+ pgbc.anchor = pgbc.WEST;
+ pgbc.weightx = 1;
+ panel.add( _simpleAuth, pgbc);
+
+ pgbc.gridy++;
pgbc.gridx = 0;
addEntryField( panel,
pgbc,
@@ -266,10 +316,12 @@
STRETCH_FIELDS ? ((label2 != null) ? label2 : field) : endGlue;
gbc.fill = gbc.NONE;
gbc.weightx = 0.0;
+ int gridwidth = gbc.gridwidth;
gbc.gridwidth = 1;
// gbc.gridx = 0;
gbc.anchor = gbc.EAST;
int space = UIFactory.getComponentSpace();
+ Insets insets = gbc.insets;
gbc.insets = new Insets( space, space, 0, space/2 );
panel.add( label, gbc );
@@ -300,6 +352,9 @@
gbc.gridwidth = gbc.REMAINDER;
panel.add( endGlue, gbc );
}
+ // restore previous values
+ gbc.insets = insets;
+ gbc.gridwidth = gridwidth;
}
/**
@@ -328,24 +383,112 @@
entries = new DSEntrySet( false );
setDSEntrySet( entries );
+
+ _lConnType = makeJLabel( _comsection, "conntype" );
- /* nsmultiplexorbinddn */
+ ButtonGroup connGroup = new ButtonGroup();
+ _noEncrypt = makeJRadioButton( _comsection, "url-ldap" );
+ _noEncrypt.setSelected(true); // default is on
+ connGroup.add(_noEncrypt);
+
+ _sslEncrypt = makeJRadioButton( _comsection, "url-ldaps" );
+ connGroup.add(_sslEncrypt);
+
+ _tlsEncrypt = makeJRadioButton( _comsection, "url-starttls" );
+ connGroup.add(_tlsEncrypt);
+
+ /* add DSEntry to correctly update field
+ coloring and buttons enabling/disabling */
+ _ldapDSEntry = new DSEntryBoolean ("on", _noEncrypt);
+ setComponentTable(_noEncrypt, _ldapDSEntry);
+ _sslDSEntry = new DSEntryBoolean ("off", _sslEncrypt);
+ setComponentTable(_sslEncrypt, _sslDSEntry);
+ _tlsDSEntry = new DSEntryBoolean ("off", _tlsEncrypt);
+ setComponentTable(_tlsEncrypt, _tlsDSEntry);
+
+ entryurl = getAttrVal( NSFARMSERVERURL_ATTR );
+ boolean ssl = (entryurl != null) &&
+ entryurl.toLowerCase().startsWith("ldaps");
+ _sslEncrypt.setSelected(ssl);
+ _sslDSEntry.fakeInitModel(ssl ? "on" : "off");
+ // set starttls initial value
+ useStartTLS = getAttrVal( NSUSESTARTTLS_ATTR );
+ // cannot use starttls with ldaps
+ boolean tls = !ssl && (useStartTLS != null) &&
+ useStartTLS.equalsIgnoreCase("on");
+ _tlsEncrypt.setSelected(tls);
+ _tlsDSEntry.fakeInitModel(tls ? "on" : "off");
+ _noEncrypt.setSelected(!ssl && !tls);
+ _ldapDSEntry.fakeInitModel((!ssl && !tls) ? "on" : "off");
+
+ _authMechLabel = makeJLabel( _comsection, "authmech" );
+
+ //ssl auth radio button
+ ButtonGroup authGroup = new ButtonGroup();
+ _sslAuth = makeJRadioButton( _comsection, "authmech-sslcert" );
+ _sslAuth.setEnabled(false); // because default is plain ldap
+ authGroup.add(_sslAuth);
+
+ _gssapiAuth = makeJRadioButton( _comsection, "authmech-gssapi" );
+ authGroup.add(_gssapiAuth);
+
+ _digestAuth = makeJRadioButton( _comsection, "authmech-digest" );
+ authGroup.add(_digestAuth);
+
+ _simpleAuth = makeJRadioButton( _comsection, "authmech-simple" );
+ _simpleAuth.setSelected(true); // default auth mech
+ authGroup.add(_simpleAuth);
+
+ /* add DSEntry to correctly update field
+ coloring and buttons enabling/disabling */
+ _sslAuthDSEntry = new DSEntryBoolean ("off", _sslAuth);
+ setComponentTable(_sslAuth, _sslAuthDSEntry);
+ _gssapiAuthDSEntry = new DSEntryBoolean ("off", _gssapiAuth);
+ setComponentTable(_gssapiAuth, _gssapiAuthDSEntry);
+ _digestAuthDSEntry = new DSEntryBoolean ("off", _digestAuth);
+ setComponentTable(_digestAuth, _digestAuthDSEntry);
+ _simpAuthDSEntry = new DSEntryBoolean ("on", _simpleAuth);
+ setComponentTable(_simpleAuth, _simpAuthDSEntry);
+
+ bindMech = getAttrVal( NSBINDMECHANISM_ATTR );
+ boolean simpauth = (bindMech == null) || bindMech.equalsIgnoreCase("SIMPLE");
+ boolean sslauth = (bindMech != null) && bindMech.equalsIgnoreCase("EXTERNAL");
+ boolean gssapi = (bindMech != null) && bindMech.equalsIgnoreCase("GSSAPI");
+ boolean digest = (bindMech != null) && bindMech.equalsIgnoreCase("DIGEST-MD5");
+ if (!ssl && !tls) {
+ sslauth = false;
+ _sslAuth.setEnabled(false);
+ }
+ if (ssl || tls) {
+ gssapi = false;
+ _gssapiAuth.setEnabled(false);
+ }
+ _sslAuth.setSelected(sslauth);
+ _sslAuthDSEntry.fakeInitModel(sslauth ? "on" : "off");
+ _gssapiAuth.setSelected(gssapi);
+ _gssapiAuthDSEntry.fakeInitModel(gssapi ? "on" : "off");
+ _digestAuth.setSelected(digest);
+ _digestAuthDSEntry.fakeInitModel(digest ? "on" : "off");
+ // if one of the other auth was selected, but it would be
+ // invalid to use them, just default to simple auth
+ simpauth = simpauth || (!sslauth && !gssapi && !digest);
+ _simpleAuth.setSelected(simpauth);
+ _simpAuthDSEntry.fakeInitModel(simpauth ? "on" : "off");
+
+ /* nsmultiplexorbinddn */
_tfnsmultiplexorbinddn = makeJTextField( _section,
"nsmultiplexorbinddn" );
_lnsmultiplexorbinddn = makeJLabel( _section,
"nsmultiplexorbinddn" );
_lnsmultiplexorbinddn.setLabelFor(_tfnsmultiplexorbinddn);
- LDAPAttribute binddn =
- _chEntry.getAttribute( NSMULTIPLEXORBINDDN_ATTR );
- _isBindDNExist = ( binddn != null );
-
- DSEntryDN _nsmultiplexorbinddn =
- new DSEntryDN("",
+ AbstractButton ary[] = {_sslAuth, _gssapiAuth};
+ bindDSEntry _nsmultiplexorbinddn =
+ new bindDSEntry("",
_tfnsmultiplexorbinddn,
_lnsmultiplexorbinddn,
NSMULTIPLEXORBINDDN_ATTR,
- _model );
+ _model, ary );
entries.add( _dnEntry,
NSMULTIPLEXORBINDDN_ATTR,
_nsmultiplexorbinddn );
@@ -364,23 +507,20 @@
makeJLabel( _section,
"confirmcredentials" );
_lConfirmPassword.setLabelFor(_pfConfirmPassword);
- LDAPAttribute passwd =
- _chEntry.getAttribute( NSMULTIPLEXORCREDENTIALS_ATTR );
- _isPasswdExist = ( passwd != null );
- DSEntryConfirmPassword dsEntryConfirm =
- new DSEntryConfirmPassword("",
+ confirmPwdDSEntry dsEntryConfirm =
+ new confirmPwdDSEntry("",
_pfConfirmPassword,
_lConfirmPassword,
_pfnsmultiplexorcredentials,
- 1);
+ 1, ary);
setComponentTable(_pfConfirmPassword, dsEntryConfirm);
- DSEntryPassword dsEntryPwd =
- new DSEntryPassword("",
+ pwdDSEntry dsEntryPwd =
+ new pwdDSEntry("",
_pfnsmultiplexorcredentials,
_lnsmultiplexorcredentials,
dsEntryConfirm,
- 1);
+ 1, ary);
setComponentTable(_pfConfirmPassword, dsEntryPwd);
entries.add(_dnEntry,
NSMULTIPLEXORCREDENTIALS_ATTR,
@@ -392,8 +532,8 @@
_lnsfarmserverurl = makeJLabel( _section,
"nsfarmserverurl" );
_lnsfarmserverurl.setLabelFor(_tfnsfarmserverurl);
- DSEntryText _nsfarmserverurl =
- new DSEntryText("",
+ urlDSEntry _nsfarmserverurl =
+ new urlDSEntry("",
_tfnsfarmserverurl,
_lnsfarmserverurl );
entries.add( _dnEntry,
@@ -404,11 +544,88 @@
entrybind = getAttrVal( NSMULTIPLEXORBINDDN_ATTR );
entrypwd = getAttrVal( NSMULTIPLEXORCREDENTIALS_ATTR );
- entryurl = getAttrVal( NSFARMSERVERURL_ATTR );
}
- private void checkComment() {
+ private void enableSimpleAuth (boolean enable){
+ _lnsmultiplexorbinddn.setEnabled(enable);
+ _tfnsmultiplexorbinddn.setEnabled(enable);
+ _lnsmultiplexorcredentials.setEnabled(enable);
+ _pfnsmultiplexorcredentials.setEnabled(enable);
+ _pfnsmultiplexorcredentials.setBackground(_tfnsmultiplexorbinddn.getBackground());
+ _lConfirmPassword.setEnabled(enable);
+ _pfConfirmPassword.setEnabled(enable);
+ _pfConfirmPassword.setBackground(_tfnsmultiplexorbinddn.getBackground());
+ }
+
+ /* We need to intercept the conn type and auth type buttons in order
+ * to enable/disable various combinations of them
+ * @see com.netscape.admin.dirserv.panel.BlankPanel#actionPerformed(java.awt.event.ActionEvent)
+ */
+ public void actionPerformed(ActionEvent e) {
+ if (e.getSource().equals(_sslAuth) && _sslAuth.isSelected()) {
+ //disable
+ enableSimpleAuth (false);
+ }
+ if (e.getSource().equals(_gssapiAuth) && _gssapiAuth.isSelected()) {
+ // enable
+ enableSimpleAuth (true);
+ }
+ if (e.getSource().equals(_simpleAuth) && _simpleAuth.isSelected()) {
+ //enable
+ enableSimpleAuth (true);
+ }
+ if (e.getSource().equals(_digestAuth) && _digestAuth.isSelected()) {
+ //enable
+ enableSimpleAuth (true);
+ }
+ if (e.getSource().equals(_noEncrypt) && _noEncrypt.isSelected()) {
+ //disable
+ _sslAuth.setEnabled(false);
+ if (_sslAuth.isSelected()) {
+ // have to select something else
+ _simpleAuth.setSelected(true);
+ }
+ enableSimpleAuth(true);
+ _gssapiAuth.setEnabled(true);
+ _digestAuth.setEnabled(true);
+ String url = _tfnsfarmserverurl.getText();
+ if (url.startsWith("ldaps://")) {
+ url = url.replaceFirst("ldaps://", "ldap://");
+ _tfnsfarmserverurl.setText(url);
+ }
+ }
+ boolean ssl_selected = false;
+ if (e.getSource().equals(_sslEncrypt) && _sslEncrypt.isSelected()) {
+ ssl_selected = true;
+ String url = _tfnsfarmserverurl.getText();
+ if (url.startsWith("ldap://")) {
+ url = url.replaceFirst("ldap://", "ldaps://");
+ _tfnsfarmserverurl.setText(url);
+ }
+ }
+ if (e.getSource().equals(_tlsEncrypt) && _tlsEncrypt.isSelected()) {
+ ssl_selected = true;
+ String url = _tfnsfarmserverurl.getText();
+ if (url.startsWith("ldaps://")) {
+ url = url.replaceFirst("ldaps://", "ldap://");
+ _tfnsfarmserverurl.setText(url);
+ }
+ }
+ if (ssl_selected) {
+ _sslAuth.setEnabled(true);
+ _gssapiAuth.setEnabled(false);
+ if (_gssapiAuth.isSelected()) {
+ // have to select something else
+ _simpleAuth.setSelected(true);
+ enableSimpleAuth(true);
+ }
+ }
+
+ super.actionPerformed(e);
+ }
+
+ private void checkComment() {
String usr = _tfnsmultiplexorbinddn.getText();
String suf = _chEntry.getAttribute( SUFFIX_ATTR_NAM ).getStringValueArray()[0];
String aci = "(targetattr = \"*\")" +
@@ -422,121 +639,57 @@
_tfaCommentAci.setText( aci );
}
+
+ private void checkURL(DocumentEvent e) {
+ if (!e.getDocument().equals(_tfnsfarmserverurl.getDocument())) {
+ return;
+ }
+ String url = _tfnsfarmserverurl.getText();
+ if (url != null) {
+ // user typed in ldap url
+ if (url.startsWith("ldap://") && _sslEncrypt.isSelected()) {
+ if (_sslAuth.isSelected()) {
+ _tlsEncrypt.setSelected(true); // preserve security setting
+ } else {
+ _noEncrypt.setSelected(true);
+ _sslAuth.setEnabled(false);
+ _gssapiAuth.setEnabled(true);
+ enableSimpleAuth(true);
+ }
+ }
+ // user typed in ldaps url
+ if (url.startsWith("ldaps://") && !_sslEncrypt.isSelected()) {
+ _sslEncrypt.setSelected(true);
+ if (!_sslAuth.isSelected()) {
+ _sslAuth.setEnabled(true);
+ _gssapiAuth.setEnabled(false);
+ enableSimpleAuth(true);
+ }
+ }
+ }
+ }
public void changedUpdate(DocumentEvent e) {
+ checkURL(e);
super.changedUpdate( e );
- if((e.getDocument() ==
- _pfnsmultiplexorcredentials.getDocument()) ||
- (e.getDocument() ==
- _pfConfirmPassword.getDocument())) {
- _isPasswdExist = true;
- }
modelUpdate();
}
public void insertUpdate(DocumentEvent e) {
- super.changedUpdate( e );
+ checkURL(e);
+ super.insertUpdate( e );
modelUpdate();
}
public void removeUpdate(DocumentEvent e) {
+ checkURL(e);
super.removeUpdate( e );
modelUpdate();
}
private void modelUpdate(){
- checkValues();
- checkOkay();
checkComment();
}
- private void checkValues() {
-
- _isBindDNValid = DN.isDN( _tfnsmultiplexorbinddn.getText());
-
- if( entrybind == null ) {
- _isBindDNDirty = ( _tfnsmultiplexorbinddn.getText().trim().length() != 0);
- } else {
- _isBindDNDirty = (entrybind.compareTo( _tfnsmultiplexorbinddn.getText()) != 0 );
- }
-
- if(_isBindDNValid){
- if(_isBindDNDirty){
- setChangeState( _lnsmultiplexorbinddn, CHANGE_STATE_MODIFIED );
- } else {
- setChangeState( _lnsmultiplexorbinddn, CHANGE_STATE_UNMODIFIED );
- }
- } else {
- setChangeState( _lnsmultiplexorbinddn,
- CHANGE_STATE_ERROR);
- }
-
- String pwd = new String( _pfnsmultiplexorcredentials.getPassword());
- String confpwd = new String( _pfConfirmPassword.getPassword());
- _isPasswdValid = ( pwd.compareTo( confpwd ) == 0);
- if ( entrypwd == null ) {
- _isPasswdDirty = (pwd.trim().compareTo("") != 0);
- } else {
- _isPasswdDirty = (entrypwd.compareTo( pwd ) != 0);
- }
-
- if(_isPasswdValid) {
- if ( _isPasswdDirty ){
- setChangeState( _lnsmultiplexorcredentials,
- CHANGE_STATE_MODIFIED);
- setChangeState( _lConfirmPassword,
- CHANGE_STATE_MODIFIED);
- } else {
- setChangeState( _lnsmultiplexorcredentials,
- CHANGE_STATE_UNMODIFIED );
- setChangeState( _lConfirmPassword,
- CHANGE_STATE_UNMODIFIED );
- }
- } else {
- setChangeState( _lnsmultiplexorcredentials,
- CHANGE_STATE_ERROR);
- setChangeState( _lConfirmPassword,
- CHANGE_STATE_ERROR);
- }
-
- _isURLDirty = (entryurl.compareTo( _tfnsfarmserverurl.getText()) != 0);
- _isURLValid = valideChainingURL( _tfnsfarmserverurl.getText() );
- if(_isURLValid){
- if(_isURLDirty) {
- setChangeState( _lnsfarmserverurl,
- CHANGE_STATE_MODIFIED);
- } else {
- setChangeState( _lnsfarmserverurl,
- CHANGE_STATE_UNMODIFIED );
- }
- } else {
- setChangeState( _lnsfarmserverurl,
- CHANGE_STATE_ERROR);
- }
- }
-
- public boolean valideChainingURL( String url ){
- boolean ok;
- if(( url == null) || (url.length() == 0)){
- return false;
- }
- ok = ( url.startsWith("ldap://") || url.startsWith("ldaps://") );
- ok = ok && ( url.endsWith("/"));
- return( ok );
- }
-
- /**
- * Enable/disable OK button
- *
- * @param ok true to enable the OK button
- */
- private void setOkay( boolean ok ) {
- if( ok ) {
- setValidFlag();
- } else {
- clearValidFlag();
- }
- }
-
private String getAttrVal( String attrName ) {
if ( _chEntry != null ) {
LDAPAttribute attr = _chEntry.getAttribute( attrName );
@@ -548,166 +701,226 @@
}
return null;
}
-
- private void checkDirtyFlag(){
- boolean dirty = _isBindDNDirty || _isPasswdDirty || _isURLDirty;
- if ( dirty ) {
- setDirtyFlag();
- } else {
- clearDirtyFlag();
- }
- }
-
- private void checkOkay() {
- boolean ok = (_isBindDNValid && _isPasswdValid && _isURLValid );
- checkDirtyFlag();
- setOkay( ok);
+
+ public void resetCallback() {
+ revertAll();
+ if (_noEncrypt.isSelected()) {
+ //disable
+ _sslAuth.setEnabled(false);
+ if (_sslAuth.isSelected()) {
+ // have to select something else
+ _simpleAuth.setSelected(true);
+ }
+ enableSimpleAuth(true);
+ _gssapiAuth.setEnabled(true);
+ _digestAuth.setEnabled(true);
+ String url = _tfnsfarmserverurl.getText();
+ if (url.startsWith("ldaps://")) {
+ url = url.replaceFirst("ldaps://", "ldap://");
+ _tfnsfarmserverurl.setText(url);
+ }
+ }
+ boolean ssl_selected = false;
+ if (_sslEncrypt.isSelected()) {
+ ssl_selected = true;
+ String url = _tfnsfarmserverurl.getText();
+ if (url.startsWith("ldap://")) {
+ url = url.replaceFirst("ldap://", "ldaps://");
+ _tfnsfarmserverurl.setText(url);
+ }
+ }
+ if (_tlsEncrypt.isSelected()) {
+ ssl_selected = true;
+ String url = _tfnsfarmserverurl.getText();
+ if (url.startsWith("ldaps://")) {
+ url = url.replaceFirst("ldaps://", "ldap://");
+ _tfnsfarmserverurl.setText(url);
+ }
+ }
+ if (ssl_selected) {
+ _sslAuth.setEnabled(true);
+ _gssapiAuth.setEnabled(false);
+ if (_gssapiAuth.isSelected()) {
+ // have to select something else
+ _simpleAuth.setSelected(true);
+ enableSimpleAuth(true);
+ }
+ }
+ super.resetCallback();
}
-
public void okCallback() {
LDAPConnection ldc = _model.getServerInfo().getLDAPConnection();
- if( _isBindDNDirty){
- String bindn = _tfnsmultiplexorbinddn.getText();
- String bindnL[] = { bindn };
- boolean deleted = false;
- LDAPModificationSet attrs = new LDAPModificationSet();
-
- if(( bindn == null) ||
- ( bindn.length() == 0)) {
- deleted = true;
- attrs.add(LDAPModification.DELETE,
- new LDAPAttribute(NSMULTIPLEXORBINDDN_ATTR));
-
- } else if( ! _isBindDNExist) {
- attrs.add(LDAPModification.ADD,
- new LDAPAttribute( NSMULTIPLEXORBINDDN_ATTR,
- bindnL));
- } else {
- attrs.add(LDAPModification.REPLACE,
- new LDAPAttribute( NSMULTIPLEXORBINDDN_ATTR,
- bindnL));
- }
- try {
- ldc.modify( _chEntry.getDN(), attrs );
- clearDirtyFlag();
- _isBindDNDirty = false;
- _isBindDNExist = !deleted;
- entrybind = bindn;
- /*
- DSEntryDN _nsmultiplexorbinddn =
- new DSEntryDN("",
- _tfnsmultiplexorbinddn,
- _lnsmultiplexorbinddn,
- NSMULTIPLEXORBINDDN_ATTR,
- _model );
- entries.add( _dnEntry,
- NSMULTIPLEXORBINDDN_ATTR,
- _nsmultiplexorbinddn );
- setComponentTable( _tfnsmultiplexorbinddn,
- _nsmultiplexorbinddn );
- */
- } catch (LDAPException e) {
- String[] args_m = { _chEntry.getDN(), e.toString() };
- DSUtil.showErrorDialog( getModel().getFrame(),
- "update-binddn-error",
- args_m,
- _section );
- }
- }
+ int errors = 0;
- if( _isPasswdDirty ){
- String pwd = new String( _pfnsmultiplexorcredentials.getPassword());
- String pwdL[] = { pwd };
- boolean deleted = false;
- LDAPModificationSet attrs = new LDAPModificationSet();
- if (( pwd == null) || ( pwd.length() == 0)){
- deleted = true;
- attrs.add(LDAPModification.DELETE,
- new LDAPAttribute( NSMULTIPLEXORCREDENTIALS_ATTR));
- } else if( !_isPasswdExist ) {
- attrs.add(LDAPModification.ADD,
- new LDAPAttribute( NSMULTIPLEXORCREDENTIALS_ATTR,
- pwdL ));
- } else {
- attrs.add(LDAPModification.REPLACE,
- new LDAPAttribute( NSMULTIPLEXORCREDENTIALS_ATTR,
- pwdL ));
- }
- try {
- ldc.modify( _chEntry.getDN(), attrs );
- clearDirtyFlag();
- _isPasswdDirty = false;
- _isPasswdExist = ! deleted;
- entrypwd = pwd;
- /*
- DSEntryConfirmPassword dsEntryConfirm =
- new DSEntryConfirmPassword("",
- _pfConfirmPassword,
- _lConfirmPassword,
- _pfnsmultiplexorcredentials,
- 1);
- setComponentTable(_pfConfirmPassword, dsEntryConfirm);
-
- DSEntryPassword dsEntryPwd =
- new DSEntryPassword("",
- _pfnsmultiplexorcredentials,
- _lnsmultiplexorcredentials,
- dsEntryConfirm,
- 1);
- setComponentTable(_pfConfirmPassword, dsEntryPwd);
- entries.add(_dnEntry,
- NSMULTIPLEXORCREDENTIALS_ATTR,
- dsEntryPwd);
- */
- } catch (LDAPException e) {
- String[] args_m = { _chEntry.getDN(), e.toString() };
- DSUtil.showErrorDialog( getModel().getFrame(),
- "update-passwd-error",
- args_m,
- _section );
-
- }
- }
+ // need to update nsUseStartTLS?
+ if (_tlsDSEntry.getDirty()) {
+ useStartTLS = _tlsEncrypt.isSelected() ? "on" : "off";
+ LDAPModificationSet attrs = new LDAPModificationSet();
+ attrs.add(LDAPModification.REPLACE,
+ new LDAPAttribute( NSUSESTARTTLS_ATTR,
+ useStartTLS ));
+ try {
+ ldc.modify( _chEntry.getDN(), attrs );
+ _ldapDSEntry.reset();
+ _sslDSEntry.reset();
+ _tlsDSEntry.reset();
+ } catch (LDAPException e) {
+ errors++;
+ String[] args_m = { _chEntry.getDN(), e.toString() };
+ DSUtil.showErrorDialog( getModel().getFrame(),
+ "update-starttls-error",
+ args_m,
+ _section );
+ }
+ }
+
+ if (_simpAuthDSEntry.getDirty() || _sslAuthDSEntry.getDirty() ||
+ _gssapiAuthDSEntry.getDirty() || _digestAuthDSEntry.getDirty()) {
+ if (_sslAuth.isSelected()) {
+ bindMech = "EXTERNAL";
+ }
+ if (_gssapiAuth.isSelected()) {
+ bindMech = "GSSAPI";
+ }
+ if (_digestAuth.isSelected()) {
+ bindMech = "DIGEST-MD5";
+ }
+ if (_simpleAuth.isSelected()) {
+ bindMech = "SIMPLE";
+ }
+ LDAPModificationSet attrs = new LDAPModificationSet();
+ attrs.add( LDAPModification.REPLACE,
+ new LDAPAttribute ( NSBINDMECHANISM_ATTR,
+ bindMech ));
+ try {
+ ldc.modify( _chEntry.getDN(), attrs );
+ _simpAuthDSEntry.reset();
+ _sslAuthDSEntry.reset();
+ _gssapiAuthDSEntry.reset();
+ _digestAuthDSEntry.reset();
+ } catch (LDAPException e) {
+ errors++;
+ String[] args_m = { _chEntry.getDN(), e.toString() };
+ DSUtil.showErrorDialog( getModel().getFrame(),
+ "update-bindmech-error",
+ args_m,
+ _section );
+ }
+ }
+ super.okCallback();
+ // clear dirty flag if all changes saved successfully
+ if (errors == 0) {
+ clearDirtyFlag();
+ }
+ }
+
+ class urlDSEntry extends DSEntryTextStrict
+ {
+ urlDSEntry(String model, JComponent view1, JComponent view2) {
+ super (model, view1, view2);
+ }
+
+ public int validate (){
+ JTextField tf = (JTextField) getView (0);
+ String url = tf.getText ();
+
+ boolean ok = (url != null) && (url.length() > 0);
+ ok = ok && ( url.startsWith("ldap://") || url.startsWith("ldaps://") );
+ ok = ok && ( url.endsWith("/"));
+ return ok ? 0 : 1;
+ }
+ }
- String url = _tfnsfarmserverurl.getText();
- String urlL[] = { url };
- if ( _isURLDirty ) {
- LDAPModificationSet attrs = new LDAPModificationSet();
- attrs.add(LDAPModification.REPLACE,
- new LDAPAttribute( NSFARMSERVERURL_ATTR,
- urlL ));
- try {
- ldc.modify( _chEntry.getDN(), attrs );
- clearDirtyFlag();
- _isURLDirty = false;
- _isURLValid = true;
- entryurl = url;
- } catch (LDAPException e) {
- String[] args_m = { _chEntry.getDN(), e.toString() };
- DSUtil.showErrorDialog( getModel().getFrame(),
- "update-passwd-error",
- args_m,
- _section );
- }
-
- }
- // super.okCallback();
- }
-
- public void resetCallback() {
- _isPasswdDirty = false;
- if( ! _isBindDNExist ){
- _tfnsmultiplexorbinddn.setText("");
- }
- if( ! _isPasswdExist ){
- _pfnsmultiplexorcredentials.setText("");
- _pfConfirmPassword.setText("");
- }
- super.resetCallback();
- }
-
- private IDSModel _model = null;
+ class bindDSEntry extends DSEntryDN
+ {
+ private AbstractButton ary[];
+
+ bindDSEntry( String model, JComponent view1, JComponent view2,
+ String attrName, IDSModel dsModel, AbstractButton ary[] ) {
+ super (model, view1, view2, attrName, dsModel);
+ this.ary = ary;
+ }
+
+ public int validate (){
+ JTextField tf = (JTextField) getView (0);
+
+ /* disabled field is always valid */
+ if (!tf.isEnabled ())
+ return 0;
+
+ // skip check if any of these buttons are
+ // selected
+ for (int ii = 0; ii < ary.length; ++ii) {
+ if (ary[ii].isSelected()) {
+ return 0;
+ }
+ }
+
+ return super.validate();
+ }
+ }
+
+ class pwdDSEntry extends DSEntryPassword
+ {
+ private AbstractButton ary[];
+
+ pwdDSEntry(String model, JPasswordField pfPwd,
+ JLabel lPwd,
+ DSEntryConfirmPassword dsEntryConfirm,
+ int minLength, AbstractButton ary[]) {
+ super (model, pfPwd, lPwd, dsEntryConfirm, minLength);
+ this.ary = ary;
+ }
+
+ public int validate (){
+ JTextField tf = (JTextField) getView (0);
+
+ /* disabled field is always valid */
+ if (!tf.isEnabled ())
+ return 0;
+
+ // skip check if any of these buttons are
+ // selected
+ for (int ii = 0; ii < ary.length; ++ii) {
+ if (ary[ii].isSelected()) {
+ return 0;
+ }
+ }
+
+ return super.validate();
+ }
+ }
+
+ class confirmPwdDSEntry extends DSEntryConfirmPassword {
+ private AbstractButton ary[];
+
+ confirmPwdDSEntry(String model, JPasswordField pfConfirm,
+ JLabel confirm, JPasswordField pfPwd, int minLength, AbstractButton ary[]) {
+ super(model, pfConfirm, confirm, pfPwd, minLength);
+ this.ary = ary;
+ }
+
+ public int validate (){
+ JTextField tf = (JTextField) getView (0);
+
+ /* disabled field is always valid */
+ if (!tf.isEnabled ())
+ return 0;
+
+ // skip check if any of these buttons are
+ // selected
+ for (int ii = 0; ii < ary.length; ++ii) {
+ if (ary[ii].isSelected()) {
+ return 0;
+ }
+ }
+
+ return super.validate();
+ }
+ }
+
+ private IDSModel _model = null;
private LDAPEntry _chEntry = null;
private String _dnEntry;
@@ -727,32 +940,40 @@
private JLabel _lcommentUsrLabel;
private JLabel _lcommentUsr;
private JLabel _lcommentAciLabel;
- private JLabel _lcommentAci;
private JTextArea _tfaCommentAci;
-
- private boolean _isPasswdExist;
- private boolean _isBindDNExist;
- private boolean _isPasswdValid = true;
- private boolean _isBindDNValid = true;
- private boolean _isPasswdDirty = false;
- private boolean _isBindDNDirty = false;
- private boolean _isURLValid = true;
- private boolean _isURLDirty = false;
+ private JLabel _lConnType;
+ private JRadioButton _noEncrypt, _sslEncrypt, _tlsEncrypt;
+ private JLabel _authMechLabel;
+ private JRadioButton _simpleAuth, _sslAuth, _gssapiAuth, _digestAuth;
private DSEntrySet entries;
+ private DSEntryBoolean _ldapDSEntry;
+ private DSEntryBoolean _sslDSEntry;
+ private DSEntryBoolean _tlsDSEntry;
+ private DSEntryBoolean _sslAuthDSEntry = null;
+ private DSEntryBoolean _simpAuthDSEntry = null;
+ private DSEntryBoolean _gssapiAuthDSEntry = null;
+ private DSEntryBoolean _digestAuthDSEntry = null;
private String entrybind;
private String entrypwd;
private String entryurl;
+ private String bindMech;
+ private String useStartTLS;
private static final String _section = "chaining-instance-auth";
+ private static final String _comsection = "newchaining";
private static final String NSMULTIPLEXORBINDDN_ATTR =
"nsmultiplexorbinddn";
private static final String NSMULTIPLEXORCREDENTIALS_ATTR =
"nsmultiplexorcredentials" ;
private static final String NSFARMSERVERURL_ATTR =
"nsfarmserverurl";
+ private static final String NSUSESTARTTLS_ATTR =
+ "nsusestarttls";
+ private static final String NSBINDMECHANISM_ATTR =
+ "nsbindmechanism";
private static final String SUFFIX_ATTR_NAM= "nsslapd-suffix";
private static final String SUFFIX_ATTR_NULL="";
Index: DSEntry.java
===================================================================
RCS file: /cvs/dirsec/directoryconsole/src/com/netscape/admin/dirserv/panel/DSEntry.java,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- DSEntry.java 18 Jul 2005 00:55:54 -0000 1.1.1.1
+++ DSEntry.java 2 Dec 2008 15:27:37 -0000 1.2
@@ -408,6 +408,19 @@
}
/**
+ * This function can be called from a panel Reset button, to revert
+ * the model back to the original model. After calling this, the
+ * panel should show() to change the UI components back to their
+ * original states
+ */
+
+ public void revert () {
+ dirty = false;
+ _model=null;
+ _model = (Vector)_origModel.clone();
+ }
+
+ /**
* This method updates the view to reflect the contents of the
* local model. This must be defined for the particular model/view combo
*
Index: NewChainingInstancePanel.java
===================================================================
RCS file: /cvs/dirsec/directoryconsole/src/com/netscape/admin/dirserv/panel/NewChainingInstancePanel.java,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- NewChainingInstancePanel.java 18 Jul 2005 00:56:01 -0000 1.1.1.1
+++ NewChainingInstancePanel.java 2 Dec 2008 15:27:37 -0000 1.2
@@ -121,6 +121,15 @@
_instanceNameText.setText( "New Chaining" );
HostPanel.add( _instanceNameText, HLgbc );
+ _authMechLabel = makeJLabel( _section, "authmech" );
+ HLgbc.gridy++;
+ HLgbc.gridx = 0;
+ HLgbc.gridwidth = 1;
+ HLgbc.fill = HLgbc.NONE;
+ HLgbc.weightx = 0;
+ HLgbc.anchor = HLgbc.EAST;
+ HostPanel.add( _authMechLabel, HLgbc );
+
_bindDNLabel = makeJLabel( _section, "bind-DN" );
HLgbc.gridy++;
HLgbc.gridx = 0;
@@ -1074,7 +1083,7 @@
}
private JTextField _instanceNameText;
- private JLabel _instanceNameLabel;
+ private JLabel _instanceNameLabel, _authMechLabel;
private JTextField _mappingNameText;
private JLabel _mappingNameLabel;
private JTextField _NewNodeText;
Index: NewChainingPanel.java
===================================================================
RCS file: /cvs/dirsec/directoryconsole/src/com/netscape/admin/dirserv/panel/NewChainingPanel.java,v
retrieving revision 1.1.1.1
retrieving revision 1.2
diff -u -r1.1.1.1 -r1.2
--- NewChainingPanel.java 18 Jul 2005 00:56:01 -0000 1.1.1.1
+++ NewChainingPanel.java 2 Dec 2008 15:27:37 -0000 1.2
@@ -26,13 +26,14 @@
import javax.swing.border.*;
import javax.swing.event.*;
import javax.swing.text.*;
-import netscape.ldap.LDAPUrl;
import netscape.ldap.*;
import netscape.ldap.util.*;
import com.netscape.management.client.util.*;
import com.netscape.admin.dirserv.*;
import com.netscape.admin.dirserv.task.ListDB;
import com.netscape.admin.dirserv.panel.MappingUtils;
+import com.netscape.admin.dirserv.panel.replication.ReplicationTool;
+
import netscape.ldap.*;
import netscape.ldap.util.*;
import com.netscape.management.nmclf.SuiConstants;
@@ -141,7 +142,62 @@
_instanceNameText.setColumns( 10 );
HostPanel.add( _instanceNameText, HLgbc );
- _bindDNLabel = makeJLabel( _section, "bind-DN" );
+ _authMechLabel = makeJLabel( _section, "authmech" );
+ HLgbc.gridy++;
+ HLgbc.gridx = 0;
+ HLgbc.gridwidth = 1;
+ HLgbc.fill = HLgbc.NONE;
+ HLgbc.weightx = 0;
+ HLgbc.anchor = HLgbc.EAST;
+ HostPanel.add( _authMechLabel, HLgbc );
+
+ //ssl auth radio button
+ ButtonGroup authGroup = new ButtonGroup();
+ _sslAuth = makeJRadioButton( _section, "authmech-sslcert" );
+ _sslAuth.addActionListener(this);
+ _sslAuth.setEnabled(false); // because default is plain ldap
+ authGroup.add(_sslAuth);
+ HLgbc.gridx = 1;
+ HLgbc.fill = HLgbc.HORIZONTAL;
+ HLgbc.gridwidth = HLgbc.REMAINDER;
+ HLgbc.weightx = 1;
+ HostPanel.add( _sslAuth, HLgbc );
+
+ //gssapi auth radio button
+ _gssapiAuth = makeJRadioButton( _section, "authmech-gssapi" );
+ _gssapiAuth.addActionListener(this);
+ authGroup.add(_gssapiAuth);
+ HLgbc.gridy++;
+ HLgbc.gridx = 1;
+ HLgbc.fill = HLgbc.HORIZONTAL;
+ HLgbc.gridwidth = HLgbc.REMAINDER;
+ HLgbc.weightx = 1;
+ HostPanel.add( _gssapiAuth, HLgbc );
+
+ //digest auth radio button
+ _digestAuth = makeJRadioButton( _section, "authmech-digest" );
+ _digestAuth.addActionListener(this);
+ authGroup.add(_digestAuth);
+ HLgbc.gridy++;
+ HLgbc.gridx = 1;
+ HLgbc.fill = HLgbc.HORIZONTAL;
+ HLgbc.gridwidth = HLgbc.REMAINDER;
+ HLgbc.weightx = 1;
+ HostPanel.add( _digestAuth, HLgbc );
+
+ //simple auth radio button
+ _simpleAuth = makeJRadioButton( _section, "authmech-simple" );
+ _simpleAuth.setSelected(true); // default auth mech
+ _simpleAuth.addActionListener(this);
+ authGroup.add(_simpleAuth);
+ HLgbc.gridy++;
+ HLgbc.gridx = 1;
+ HLgbc.fill = HLgbc.HORIZONTAL;
+ HLgbc.gridwidth = HLgbc.REMAINDER;
+ HLgbc.weightx = 1;
+ HostPanel.add( _simpleAuth, HLgbc );
+
+ _bindDNLabel = makeJLabel( _section, "bind-DN" );
HLgbc.gridy++;
HLgbc.gridx = 0;
HLgbc.gridwidth = 1;
@@ -157,8 +213,7 @@
HLgbc.gridwidth = HLgbc.REMAINDER;
HLgbc.weightx = 1;
HostPanel.add( _bindDNText, HLgbc );
-
-
+
_bindPasswdLabel = makeJLabel( _section, "bind-Passwd" );
HLgbc.gridy++;
HLgbc.gridx = 0;
@@ -175,51 +230,7 @@
HLgbc.gridwidth = 1;
HLgbc.weightx = 1;
HostPanel.add( _bindPasswdText, HLgbc );
- /*
- _cbUrlLdapSecureMode = makeJCheckBox( _section, "ldap-url-secu" );
- HLgbc.gridy++;
- HLgbc.gridx = 0;
- HLgbc.anchor = HLgbc.WEST;
- HLgbc.fill = HLgbc.NONE;
- HLgbc.gridwidth = HLgbc.REMAINDER;
- HLgbc.weightx = 0;
- _cbUrlLdapSecureMode.setSelected( false );
- HostPanel.add( _cbUrlLdapSecureMode, HLgbc );
-
- _urlLdapHostLabel = makeJLabel( _section, "ldap-url-host" );
- HLgbc.gridy++;
- HLgbc.gridx = 0;
- HLgbc.gridwidth = 1;
- HLgbc.fill = HLgbc.NONE;
- HLgbc.anchor = HLgbc.EAST;
- HLgbc.weightx = 0;
- HostPanel.add( _urlLdapHostLabel, HLgbc );
-
- _urlLdapHostText = makeJTextField( _section, "ldap-url-host" );
- HLgbc.fill = HLgbc.HORIZONTAL;
- HLgbc.gridx = 1;
- HLgbc.gridwidth = 1;
- HLgbc.weightx = 1;
- _urlLdapHostText.setColumns( 12 );
- HostPanel.add( _urlLdapHostText, HLgbc );
-
- _urlLdapPortLabel = makeJLabel( _section, "ldap-url-port" );
- HLgbc.gridx = 2;
- HLgbc.gridwidth = 1;
- HLgbc.fill = HLgbc.NONE;
- HLgbc.anchor = HLgbc.EAST;
- HLgbc.weightx = 0;
- HostPanel.add( _urlLdapPortLabel, HLgbc );
-
- _urlLdapPortText = makeJTextField( _section, "ldap-url-port" );
- HLgbc.fill = HLgbc.HORIZONTAL;
- HLgbc.gridx = 3;
- HLgbc.gridwidth = 1;
- HLgbc.weightx = 0; // doesn't need to extend when screen is resized
- _urlLdapPortText.setColumns( 5 );
- _urlLdapPortText.setText( _sDefaultPort );
- HostPanel.add( _urlLdapPortText, HLgbc );
- */
+
createRemoteServers( HostPanel, HLgbc );
createURLArea( HostPanel, HLgbc );
@@ -329,16 +340,40 @@
AlternatePanel.setLayout(HLbag);
- //
- _cbUrlLdapSecureMode = makeJCheckBox( _section, "ldap-url-secu" );
+ ButtonGroup connGroup = new ButtonGroup();
+ _noEncrypt = makeJRadioButton( _section, "url-ldap" );
+ _noEncrypt.setSelected(true); // default is on
+ _noEncrypt.addActionListener(this);
+ connGroup.add(_noEncrypt);
HLgbc.gridy++;
HLgbc.gridx = 0;
HLgbc.anchor = HLgbc.WEST;
HLgbc.fill = HLgbc.NONE;
HLgbc.gridwidth = HLgbc.REMAINDER;
HLgbc.weightx = 0;
- _cbUrlLdapSecureMode.setSelected( false );
- AlternatePanel.add( _cbUrlLdapSecureMode, HLgbc );
+ AlternatePanel.add( _noEncrypt, HLgbc );
+
+ _sslEncrypt = makeJRadioButton( _section, "url-ldaps" );
+ _sslEncrypt.addActionListener(this);
+ connGroup.add(_sslEncrypt);
+ HLgbc.gridy++;
+ HLgbc.gridx = 0;
+ HLgbc.anchor = HLgbc.WEST;
+ HLgbc.fill = HLgbc.NONE;
+ HLgbc.gridwidth = HLgbc.REMAINDER;
+ HLgbc.weightx = 0;
+ AlternatePanel.add( _sslEncrypt, HLgbc );
+
+ _tlsEncrypt = makeJRadioButton( _section, "url-starttls" );
+ _tlsEncrypt.addActionListener(this);
+ connGroup.add(_tlsEncrypt);
+ HLgbc.gridy++;
+ HLgbc.gridx = 0;
+ HLgbc.anchor = HLgbc.WEST;
+ HLgbc.fill = HLgbc.NONE;
+ HLgbc.gridwidth = HLgbc.REMAINDER;
+ HLgbc.weightx = 0;
+ AlternatePanel.add( _tlsEncrypt, HLgbc );
_urlLdapHostLabel = makeJLabel( _section, "ldap-url-host" );
HLgbc.gridy++;
@@ -509,7 +544,20 @@
return;
} // getChainingLoc
-
+ private boolean checkConnAndAuth() {
+ boolean ret = true;
+ if (_simpleAuth.isSelected() || _digestAuth.isSelected()) {
+ // dn & pwd required
+ ret = ( _bindDNText.getText() != null ) &&
+ ( _bindDNText.getText().trim().length() > 0 ) &&
+ DN.isDN(_bindDNText.getText()) &&
+ ( _bindPasswdText.getText() != null ) &&
+ ( _bindPasswdText.getText().trim().length() > 0 );
+
+ }
+
+ return ret;
+ }
/**
* Enable/disable OK button
@@ -531,36 +579,81 @@
boolean ok = ( (chname != null) &&
(chname.length() > 0) &&
(DSUtil.isValidBckName (chname)) &&
- _isBindDNValid &&
+ checkConnAndAuth() &&
(chserver != null) &&
(chserver.length() > 0));
setOkay( ok );
}
+ private void enableSimpleAuth (boolean enable){
+ _bindDNLabel.setEnabled(enable);
+ _bindDNText.setEnabled(enable);
+ _bindPasswdLabel.setEnabled(enable);
+ _bindPasswdText.setEnabled(enable);
+ _bindPasswdText.setBackground(_bindDNText.getBackground());
+ }
+
/**
* handle incoming event
*
* @param e event
*/
public void actionPerformed(ActionEvent e) {
- if (e.getSource().equals( _cbUrlLdapSecureMode )) {
- if ( _cbUrlLdapSecureMode.isSelected() ) {
- _sDefaultPort = DEFAULT_LDAPS_PORT;
- } else {
- _sDefaultPort = DEFAULT_LDAP_PORT;
- }
- if ( ! _bHostModified ) {
- _urlLdapPortText.setText( _sDefaultPort );
+ if (e.getSource().equals(_sslAuth) && _sslAuth.isSelected()) {
+ //disable
+ enableSimpleAuth (false);
+ }
+ if (e.getSource().equals(_gssapiAuth) && _gssapiAuth.isSelected()) {
+ // enable
+ enableSimpleAuth (true);
+ }
+ if (e.getSource().equals(_simpleAuth) && _simpleAuth.isSelected()) {
+ //enable
+ enableSimpleAuth (true);
+ }
+ if (e.getSource().equals(_digestAuth) && _digestAuth.isSelected()) {
+ //enable
+ enableSimpleAuth (true);
+ }
+ if (e.getSource().equals(_noEncrypt) && _noEncrypt.isSelected()) {
+ /* set to use non-SSL port LDAP */
+ _sDefaultPort = DEFAULT_LDAP_PORT;
+ //disable
+ _sslAuth.setEnabled(false);
+ if (_sslAuth.isSelected()) {
+ // have to select something else
+ _simpleAuth.setSelected(true);
}
- if ( ! _bAlterModified ) {
- _urlAltPortText.setText( _sDefaultPort );
+ enableSimpleAuth(true);
+ _gssapiAuth.setEnabled(true);
+ _digestAuth.setEnabled(true);
+ }
+ boolean ssl_selected = false;
+ if (e.getSource().equals(_sslEncrypt) && _sslEncrypt.isSelected()) {
+ /* set to use SSL port */
+ _sDefaultPort = DEFAULT_LDAPS_PORT;
+ ssl_selected = true;
+ }
+ if (e.getSource().equals(_tlsEncrypt) && _tlsEncrypt.isSelected()) {
+ /* set to use non-SSL port for startTLS */
+ _sDefaultPort = DEFAULT_LDAP_PORT;
+ ssl_selected = true;
+ }
+ if (ssl_selected) {
+ _sslAuth.setEnabled(true);
+ _gssapiAuth.setEnabled(false);
+ if (_gssapiAuth.isSelected()) {
+ // have to select something else
+ _simpleAuth.setSelected(true);
+ enableSimpleAuth(true);
}
- } else if (e.getSource().equals( _bAddAlternateServer )) {
+ }
+ if (e.getSource().equals( _bAddAlternateServer )) {
StringBuffer nalt = new StringBuffer();
nalt.append( _urlAltHostText.getText() );
if (( _urlAltPortText.getText() != null ) &&
- ( _urlAltPortText.getText().trim().length() > 0)) {
+ ( _urlAltPortText.getText().trim().length() > 0)) {
nalt.append( ":" );
nalt.append( _urlAltPortText.getText().trim() );
}
@@ -585,7 +678,7 @@
private String getUrlVal() {
StringBuffer nurl = new StringBuffer();
- if ( _cbUrlLdapSecureMode.isSelected() ) {
+ if ( _sslEncrypt.isSelected() ) {
nurl.append( "ldaps://");
} else {
nurl.append( "ldap://");
@@ -672,6 +765,25 @@
}
+ String mech = null;
+ if (_sslAuth.isSelected()) {
+ mech = "EXTERNAL";
+ }
+ if (_gssapiAuth.isSelected()) {
+ mech = "GSSAPI";
+ }
+ if (_digestAuth.isSelected()) {
+ mech = "DIGEST-MD5";
+ }
+ if (mech != null) {
+ attrs.add( new LDAPAttribute ( "nsBindMechanism",
+ mech ));
+ }
+ if (_tlsEncrypt.isSelected()) {
+ attrs.add( new LDAPAttribute ( "nsUseStartTLS",
+ "on" ));
+ }
+
String ldapurl = getUrlVal();
if(( ldapurl != null ) &&
( ldapurl.trim().length() > 0)) {
@@ -859,7 +971,9 @@
if( e.getDocument() == _bindDNText.getDocument() ) {
if(( _bindDNText.getText() != null) &&
( _bindDNText.getText().trim().length() > 0 )){
- if ( DN.isDN ( _bindDNText.getText() )) {
+ // depends on auth type
+ boolean required = _simpleAuth.isSelected() || _digestAuth.isSelected();
+ if ( !required || DN.isDN ( _bindDNText.getText() )) {
setChangeState( _bindDNLabel, CHANGE_STATE_UNMODIFIED );
_isBindDNValid = true;
} else {
@@ -966,7 +1080,6 @@
private String _PluginLoc = "";
- private JCheckBox _cbUrlLdapSecureMode;
private JTextField _urlLdapHostText;
private JLabel _urlLdapHostLabel;
private JTextField _urlLdapPortText;
@@ -977,10 +1090,13 @@
private JTextField _urlAltPortText;
private JLabel _urlAltPortLabel;
+ private JLabel _authMechLabel;
+ private JRadioButton _sslAuth, _gssapiAuth, _digestAuth, _simpleAuth;
private JLabel _bindDNLabel;
private JTextField _bindDNText;
private JLabel _bindPasswdLabel;
private JTextField _bindPasswdText;
+ private JRadioButton _noEncrypt, _sslEncrypt, _tlsEncrypt;
private JComboBox _comboNewNodeMapping;
private JLabel _comboNewNodeLabel;
15 years, 4 months
[Fedora-directory-commits] directoryconsole/src/com/netscape/admin/dirserv/panel/replication replication.properties, 1.2, 1.3
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/directoryconsole/src/com/netscape/admin/dirserv/panel/replication
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv764/directoryconsole/src/com/netscape/admin/dirserv/panel/replication
Modified Files:
replication.properties
Log Message:
Resolves: bug 469261
Bug Description: Support server-to-server SASL - console chaining, server cleanup
Reviewed by: nkinder (Thanks!)
Fix Description: There are two sets of diffs here. The first set adds tls, gssapi, and digest to the chaining database (aka database link) panels in the console. I had to add support for revert to some of the code to make the Reset button work without having to retrieve the values from the server each time. We already store the original values locally in the _origModel - I added code to allow the use of that in the Reset button.
The second set of diffs is for the server.
1) I had to add support for "SIMPLE" for bindMechanism - this translates to LDAP_SASL_SIMPLE for the actual mechanism. This value is NULL, so I had to add handling for NULL values in the cb config code (slapi_ch_* work fine with NULL values).
2) Added some more debugging/tracing code
3) The server to server SSL code would only work if the server were configured to be an SSL server. But for the server to be an SSL client, it only needs NSS initialized and to have the CA cert. It also needs to configured some of the SSL settings and install the correct policy. I changed the server code to do this.
Platforms tested: RHEL5
Flag Day: no
Doc impact: Yes
Index: replication.properties
===================================================================
RCS file: /cvs/dirsec/directoryconsole/src/com/netscape/admin/dirserv/panel/replication/replication.properties,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- replication.properties 24 Nov 2008 16:09:23 -0000 1.2
+++ replication.properties 2 Dec 2008 15:27:38 -0000 1.3
@@ -165,14 +165,14 @@
replication-destination-noEncrypt-label=Use LDAP (no encryption)
replication-destination-noEncrypt-ttip=Use plain LDAP with no encryption
replication-destination-sslEncrypt-label=Use TLS/SSL (TLS/SSL encryption with LDAPS)
-replication-destination-sslEncrypt-ttip=Use TLSv1/SSLv3 encryption using the LDAPS port (636)
+replication-destination-sslEncrypt-ttip=Use TLSv1/SSLv3 encryption using the LDAPS port
replication-destination-startTLS-label=Use StartTLS (TLS/SSL encryption with LDAP)
replication-destination-startTLS-ttip=Start a TLSv1/SSLv3 encryption session on the LDAP connection
replication-destination-authUsing-label=Authentication mechanism:
replication-destination-simpleAuth-label=Simple (Bind DN/Password)
replication-destination-simpleAuth-ttip=Authenticate using a DN and a password (Simple auth)
replication-destination-sslClientAuth-label=Server TLS/SSL Certificate (requires TLS/SSL server set up)
-replication-destination-sslClientAuth-ttip=Use the server's certificate to do TLS/SSL client cert auth (requires that the server has been set up to be an SSL server)
+replication-destination-sslClientAuth-ttip=Use the server's certificate to do TLS/SSL client cert auth (requires that the server has been set up to be a TLS/SSL server)
replication-destination-gssapiAuth-label=SASL/GSSAPI (requires server Kerberos keytab)
replication-destination-gssapiAuth-ttip=Authenticate using SASL/GSSAPI and the server's Kerberos keytab (supplier and consumer must both support SASL/GSSAPI/Kerberos)
replication-destination-digestAuth-label=SASL/DIGEST-MD5 (SASL user id and password)
15 years, 4 months
[Fedora-directory-commits] directoryconsole/src/com/netscape/admin/dirserv dirserv.properties, 1.8, 1.9
by Richard Allen Megginson
Author: rmeggins
Update of /cvs/dirsec/directoryconsole/src/com/netscape/admin/dirserv
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv764/directoryconsole/src/com/netscape/admin/dirserv
Modified Files:
dirserv.properties
Log Message:
Resolves: bug 469261
Bug Description: Support server-to-server SASL - console chaining, server cleanup
Reviewed by: nkinder (Thanks!)
Fix Description: There are two sets of diffs here. The first set adds tls, gssapi, and digest to the chaining database (aka database link) panels in the console. I had to add support for revert to some of the code to make the Reset button work without having to retrieve the values from the server each time. We already store the original values locally in the _origModel - I added code to allow the use of that in the Reset button.
The second set of diffs is for the server.
1) I had to add support for "SIMPLE" for bindMechanism - this translates to LDAP_SASL_SIMPLE for the actual mechanism. This value is NULL, so I had to add handling for NULL values in the cb config code (slapi_ch_* work fine with NULL values).
2) Added some more debugging/tracing code
3) The server to server SSL code would only work if the server were configured to be an SSL server. But for the server to be an SSL client, it only needs NSS initialized and to have the CA cert. It also needs to configured some of the SSL settings and install the correct policy. I changed the server code to do this.
Platforms tested: RHEL5
Flag Day: no
Doc impact: Yes
Index: dirserv.properties
===================================================================
RCS file: /cvs/dirsec/directoryconsole/src/com/netscape/admin/dirserv/dirserv.properties,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- dirserv.properties 17 Oct 2007 18:04:33 -0000 1.8
+++ dirserv.properties 2 Dec 2008 15:27:37 -0000 1.9
@@ -1164,8 +1164,26 @@
newchaining-new-mapping-title=Associate database with a suffix
newchaining-instance-name-label=Database link name:
newchaining-instance-name-ttip=Unique name of your new database link
+newchaining-authmech-label=Authentication mechanism:
+newchaining-authmech-ttip=How the server will authenticate to the remote server
+newchaining-authmech-simple-label=Simple (Bind DN/Password)
+newchaining-authmech-simple-ttip=Authenticate using a DN and a password (Simple auth)
+newchaining-authmech-sslcert-label=Server TLS/SSL Certificate (requires TLS/SSL server set up)
+newchaining-authmech-sslcert-ttip=Use the server's certificate to do TLS/SSL client cert auth (requires that the server has been set up to be an SSL server)
+newchaining-authmech-gssapi-label=SASL/GSSAPI (requires server Kerberos keytab)
+newchaining-authmech-gssapi-ttip=Authenticate using SASL/GSSAPI and the server's Kerberos keytab (supplier and consumer must both support SASL/GSSAPI/Kerberos)
+newchaining-authmech-digest-label=SASL/DIGEST-MD5 (SASL user id and password)
+newchaining-authmech-digest-ttip=Authenticate using SASL/DIGEST-MD5 - requires consumer support for digest password and identity mapping
+newchaining-conntype-label=Connection Type:
+newchaining-conntype-ttip=Type of connection to use to remote server (LDAP, LDAPS, LDAP with StartTLS)
newchaining-url-title=LDAP URL
+newchaining-url-ldap-label=Use LDAP (no encryption)
+newchaining-url-ldap-ttip=Use plain LDAP with no encryption
+newchaining-url-ldaps-label=Use TLS/SSL (TLS/SSL encryption with LDAPS)
+newchaining-url-ldaps-ttip=Use TLSv1/SSLv3 encryption using the LDAPS port
+newchaining-url-starttls-label=Use StartTLS (TLS/SSL encryption with LDAP)
+newchaining-url-starttls-ttip=Start a TLSv1/SSLv3 encryption session on the LDAP connection
newchaining-ldap-url-secu-label=Use a secure LDAP connection between servers
newchaining-ldap-url-secu-ttip=Use SSL connection between remote and local servers
newchaining-ldap-url-host-label=Remote server
@@ -3090,6 +3108,10 @@
chaining-instance-auth-update-passwd-error-msg=Error updating :%0 \n %1
chaining-instance-auth-update-url-error-title=Failed to Update URL
chaining-instance-auth-update-url-error-msg==Error updating :%0 \n %1
+chaining-instance-auth-update-starttls-error-title=Failed to Update StartTLS setting
+chaining-instance-auth-update-starttls-error-msg=Error updating :%0 \n %1
+chaining-instance-auth-update-bindmech-error-title=Failed to Update Authentication Mechanism
+chaining-instance-auth-update-bindmech-error-msg=Error updating :%0 \n %1
#
# Account Inactivation
15 years, 4 months