New LDAP search options for scope

diff --git a/config/Makefile.am b/config/Makefile.am
index 31370340d85b19906c253165b389bd98f67059c7..905368cd715f2164da675f373c9fe117c1caea06 100644 (file)
--- a/config/Makefile.am
+++ b/config/Makefile.am
@@ -1,17 +1,17 @@
 ## Makefile.am for config/
 
 SUBDIRS = pam
-
 SUFFIXES = .tmpl .
 
 GENFILES = afpd.conf AppleVolumes.default
 TMPLFILES = afpd.conf.tmpl AppleVolumes.default.tmpl
-CONFFILES = AppleVolumes.system \
-       atalkd.conf netatalk.conf papd.conf
-OVERWRITE_CONFIG = @OVERWRITE_CONFIG@
+CONFFILES = AppleVolumes.system atalkd.conf netatalk.conf papd.conf
+if USE_NFSv4_ACLS
+CONFFILES += afp_ldap.conf
+endif
 
+OVERWRITE_CONFIG = @OVERWRITE_CONFIG@
 EXTRA_DIST = $(CONFFILES) $(TMPLFILES)
-
 CLEANFILES = $(GENFILES)
 
 pkgconfdir = @PKGCONFDIR@

diff --git a/config/afp_ldap.conf b/config/afp_ldap.conf
new file mode 100644 (file)
index 0000000..dff1568
--- /dev/null
+++ b/config/afp_ldap.conf
@@ -0,0 +1,11 @@
+# ldap_server      = localhost
+# ldap_auth_method = simple
+# ldap_auth_dn     = cn=admin,dc=domain,dc=org
+# ldap_auth_pw     = notthisone
+# ldap_userbase    = ou=users,dc=domain,dc=org
+# ldap_userscope   = one
+# ldap_groupbase   = ou=groups,dc=domain,dc=org
+# ldap_groupscope  = one
+# ldap_uuid_attr   = apple-generateduid
+# ldap_name_attr   = cn
+# ldap_group_attr  = cn

diff --git a/libatalk/acl/ldap.c b/libatalk/acl/ldap.c
index 9a9645b340933e7b8131ef0a60b02edd5e6f27f8..d2d6ac2c0d9afa2e589f1a73d25b65b3343c0857 100644 (file)
--- a/libatalk/acl/ldap.c
+++ b/libatalk/acl/ldap.c
@@ -1,5 +1,5 @@
 /*
-  $Id: ldap.c,v 1.2 2009-11-27 15:16:26 franklahm Exp $
+  $Id: ldap.c,v 1.3 2009-11-28 10:03:01 franklahm Exp $
   Copyright (c) 2008,2009 Frank Lahm <franklahm@gmail.com>
 
   This program is free software; you can redistribute it and/or modify
@@ -43,7 +43,9 @@ int  ldap_auth_method;
 char *ldap_auth_dn;
 char *ldap_auth_pw;
 char *ldap_userbase;
+int  ldap_userscope;
 char *ldap_groupbase;
+int  ldap_groupscope;
 char *ldap_uuid_attr;
 char *ldap_name_attr;
 char *ldap_group_attr;
@@ -55,7 +57,9 @@ struct ldap_pref ldap_prefs[] = {
     {&ldap_auth_dn,    "ldap_auth_dn",     0, 0,  0},
     {&ldap_auth_pw,    "ldap_auth_pw",     0, 0,  0},
     {&ldap_userbase,   "ldap_userbase",    0, 0, -1},
+    {&ldap_userscope}, "ldap_userscope",   1 ,1, -1},
     {&ldap_groupbase,  "ldap_groupbase",   0, 0, -1},
+    {&ldap_groupscope},"ldap_groupscope",  1 ,1, -1},
     {&ldap_uuid_attr,  "ldap_uuid_attr",   0, 0, -1},
     {&ldap_name_attr,  "ldap_name_attr",   0, 0, -1},
     {&ldap_group_attr, "ldap_group_attr",  0, 0, -1},
@@ -67,6 +71,9 @@ struct pref_array prefs_array[] = {
     {"ldap_auth_method", "none",   LDAP_AUTH_NONE},
     {"ldap_auth_method", "simple", LDAP_AUTH_SIMPLE},
     {"ldap_auth_method", "sasl",   LDAP_AUTH_SASL},
+    {"ldap_userscope",   "base",   LDAP_SCOPE_BASE},
+    {"ldap_userscope",   "one",    LDAP_SCOPE_ONELEVEL},
+    {"ldap_userscope",   "sub",    LDAP_SCOPE_SUBTREE},
     {NULL,               NULL,     0}
 };
 
@@ -228,9 +235,9 @@ int ldap_getuuidfromname( const char *name, uuidtype_t type, char **uuid_string)
     }
 
     if (type == UUID_GROUP) {
-        ret = ldap_getattr_fromfilter_withbase_scope( ldap_groupbase, filter, attributes, LDAP_SCOPE_ONELEVEL, KEEPALIVE, uuid_string);
+        ret = ldap_getattr_fromfilter_withbase_scope( ldap_groupbase, filter, attributes, ldap_userscope, KEEPALIVE, uuid_string);
     } else  { /* type hopefully == UUID_USER */
-        ret = ldap_getattr_fromfilter_withbase_scope( ldap_userbase, filter, attributes, LDAP_SCOPE_ONELEVEL, 0, uuid_string);
+        ret = ldap_getattr_fromfilter_withbase_scope( ldap_userbase, filter, attributes, ldap_groupscope, 0, uuid_string);
     }
     return ret;
 }
@@ -249,13 +256,13 @@ int ldap_getnamefromuuid( char *uuidstr, char **name, uuidtype_t *type) {
     }
     /* search groups first. group acls are probably used more often */
     attributes[0] = ldap_group_attr;
-    ret = ldap_getattr_fromfilter_withbase_scope( ldap_groupbase, filter, attributes, LDAP_SCOPE_ONELEVEL, KEEPALIVE, name);
+    ret = ldap_getattr_fromfilter_withbase_scope( ldap_groupbase, filter, attributes, ldap_groupscope, KEEPALIVE, name);
     if (ret == 0) {
         *type = UUID_GROUP;
         return 0;
     }
     attributes[0] = ldap_name_attr;
-    ret = ldap_getattr_fromfilter_withbase_scope( ldap_userbase, filter, attributes, LDAP_SCOPE_ONELEVEL, 0, name);
+    ret = ldap_getattr_fromfilter_withbase_scope( ldap_userbase, filter, attributes, ldap_userscope, 0, name);
     if (ret == 0) {
         *type = UUID_USER;
         return 0;

diff --git a/man/man5/afp_ldap.conf.5.tmpl b/man/man5/afp_ldap.conf.5.tmpl
index cabe336b26bc7d5e955dc4dfe2377d2fea621495..a5676616a239fdb249a5067b3ceac71bcd0f3c30 100644 (file)
--- a/man/man5/afp_ldap.conf.5.tmpl
+++ b/man/man5/afp_ldap.conf.5.tmpl
@@ -1,83 +1,13 @@
+'\" t
 .\"     Title: afp_ldap.conf
 .\"    Author: [FIXME: author] [see http://docbook.sf.net/el/author]
-.\" Generator: DocBook XSL Stylesheets v1.74.0 <http://docbook.sf.net/>
-.\"      Date: 31-01-2009
-.\"    Manual: Netatalk 2.0 Manual
-.\"    Source: :NETATALK_VERSION:
+.\" Generator: DocBook XSL Stylesheets v1.74.3 <http://docbook.sf.net/>
+.\"      Date: 28 November 2009
+.\"    Manual: Netatalk 2.1
+.\"    Source: Netatalk 2.1
 .\"  Language: English
 .\"
-.TH "LDAP\&.CONF" "5" "31-01-2009" ":NETATALK_VERSION:" "Netatalk 2.0 Manual"
-.\" -----------------------------------------------------------------
-.\" * (re)Define some macros
-.\" -----------------------------------------------------------------
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" BB/BE - put background/screen (filled box) around block of text
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de BB
-.if t \{\
-.sp -.5
-.br
-.in +2n
-.ll -2n
-.gcolor red
-.di BX
-.\}
-..
-.de EB
-.if t \{\
-.if "\\$2"adjust-for-leading-newline" \{\
-.sp -1
-.\}
-.br
-.di
-.in
-.ll
-.gcolor
-.nr BW \\n(.lu-\\n(.i
-.nr BH \\n(dn+.5v
-.ne \\n(BHu+.5v
-.ie "\\$2"adjust-for-leading-newline" \{\
-\M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
-.\}
-.el \{\
-\M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[]
-.\}
-.in 0
-.sp -.5v
-.nf
-.BX
-.in
-.sp .5v
-.fi
-.\}
-..
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.\" BM/EM - put colored marker in margin next to block of text
-.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-.de BM
-.if t \{\
-.br
-.ll -2n
-.gcolor red
-.di BX
-.\}
-..
-.de EM
-.if t \{\
-.br
-.di
-.ll
-.gcolor
-.nr BH \\n(dn
-.ne \\n(BHu
-\M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[]
-.in 0
-.nf
-.BX
-.in
-.fi
-.\}
-..
+.TH "AFP_LDAP\&.CONF" "5" "28 November 2009" "Netatalk 2.1" "Netatalk 2.1"
 .\" -----------------------------------------------------------------
 .\" * set default formatting
 .\" -----------------------------------------------------------------
@@ -88,11 +18,11 @@
 .\" -----------------------------------------------------------------
 .\" * MAIN CONTENT STARTS HERE *
 .\" -----------------------------------------------------------------
-.SH "Name"
+.SH "NAME"
 afp_ldap.conf \- Configuration file used by afpd(8) to configure a LDAP connection to an LDAP server\&. That is needed for ACL support in order to be able to query LDAP for UUIDs\&.
-.SH "Description"
+.SH "DESCRIPTION"
 .PP
-\FC:ETCDIR:/ldap\&.conf\F[]
+:ETCDIR:/afp_ldap\&.conf
 is the configuration file used by
 \fBafpd\fR
 to set up an LDAP connection to an LDAP server\&.
@@ -103,7 +33,6 @@ Any line not prefixed with # is interpreted\&.
 .sp
 .\}
 .RS 4
-.BM yellow
 .it 1 an-trap
 .nr an-no-space-flag 1
 .nr an-break-flag 1
@@ -117,10 +46,9 @@ You can use
 \fBafpldaptest\fR(1)
 to syntactically check your config
 .sp .5v
-.EM yellow
 .RE
 The required parameters and their meanings are:
-.SH "Parameter"
+.SH "PARAMETER"
 .PP
 ldap_server
 .RS 4
@@ -130,7 +58,8 @@ Name or IP address of your LDAP Server
 .PP
 ldap_auth_method
 .RS 4
-<none|simple|sasl>
+Authentication method:
+\fBnone | simple | sasl\fR
 .PP
 none
 .RS 4
@@ -166,12 +95,26 @@ DN of the user container in LDAP\&.
 .sp
 .RE
 .PP
+ldap_userscobe
+.RS 4
+Search scope for user search:
+\fBbase | one | sub\fR
+.sp
+.RE
+.PP
 ldap_groupbase
 .RS 4
 DN of the group container in LDAP\&.
 .sp
 .RE
 .PP
+ldap_groupscope
+.RS 4
+Search scope for user search:
+\fBbase | one |\ \&sub\fR
+.sp
+.RE
+.PP
 ldap_uuuid_attr
 .RS 4
 Name of the LDAP attribute with the UUIDs\&.
@@ -191,34 +134,30 @@ ldap_group_attr
 Name of the LDAP attribute with the groups short name\&.
 .sp
 .RE
-.SH "Examples"
+.SH "EXAMPLES"
 .PP
 \fBExample.\ \&afp_ldap.conf setup with simple bind\fR
 .sp
 .if n \{\
 .RS 4
 .\}
-.fam C
-.ps -1
 .nf
-.BB lightgray
 ldap_server      = localhost
 ldap_auth_method = simple
 ldap_auth_dn     = cn=admin,dc=domain,dc=org
 ldap_auth_pw     = notthisone
 ldap_userbase    = ou=users,dc=domain,dc=org
+ldap_userscobe   = one
 ldap_groupbase   = ou=groups,dc=domain,dc=org
+ldap_groupscope  = one
 ldap_uuid_attr   = some_attribute
 ldap_name_attr   = cn
 ldap_group_attr  = cn
-.EB lightgray
 .fi
-.fam
-.ps +1
 .if n \{\
 .RE
 .\}
-.SH "See also"
+.SH "SEE ALSO"
 .PP
 \fBafpd\fR(8),
 \fBAppleVolumes.default\fR(5),\fBafpldaptest\fR(1)