* Retrieve the values of a specific attribute on a given DN.

 * @param r The request record

 * @param ldc The LDAP connection being used.

 * @param url The URL of the LDAP connection - used for deciding which cache to use.

 * @param dn The Base DN to search for the user in.

 * @param attrib The LDAP attribute name to return in search.

 * @param values On success, *values is set to a NULL-terminated array of attribute values,

 *               values[0] through values[n] == NULL

 * @deffunc int util_ldap_cache_getattrvals(request_rec *r, util_ldap_connection_t *ldc,

 *                                          const char *url, const char *dn,

 *                                          const char *attrib, const char ***values)

 */

APR_DECLARE_OPTIONAL_FN(int,uldap_cache_getattrvals,(request_rec *r, util_ldap_connection_t *ldc,

                                                     const char *url, const char *dn, 

                                                     const char *attrib, const char ***values));

/**

static int uldap_cache_getattrvals(request_rec *r, 

                                   util_ldap_connection_t *ldc,

                                   const char *url, const char *dn,

                                   const char *attrib,

                                   const char ***values)

{

    int failures = 0, result, n, count;

    LDAPMessage *res, *entry;

    char **attrs, **vals;

    attrs = apr_pcalloc(r->pool, 2 * sizeof *attrs);

    attrs[0] = (char *)attrib;

start_over:

    if (failures++ > 10) {

        /* too many failures */

        return result;

    }

    result = uldap_connection_open(r, ldc);

    if (result != LDAP_SUCCESS) {

        return result;

    }

    result = ldap_search_ext_s(ldc->ldap, dn, LDAP_SCOPE_BASE,

                               "(objectclass=*)", attrs, 0,

                               NULL, NULL, NULL, APR_LDAP_SIZELIMIT, &res);

    if (AP_LDAP_IS_SERVER_DOWN(result)) {

        ldc->reason = "DN Comparison ldap_search_ext_s() "

                      "failed with server down";

        uldap_connection_unbind(ldc);

        goto start_over;

    }

    if (result != LDAP_SUCCESS) {

        ldc->reason = "DN attribute fetch ldap_search_ext_s() failed";

        return result;

    }

    /* Require exactly one entry to be returned. */

    count = ldap_count_entries(ldc->ldap, res);

    if (count != 1) {

        ldc->reason = apr_psprintf(r->pool, "found %d entries, expected "

                                   "exactly one match", count);

        ldap_msgfree(res);

        return LDAP_NO_SUCH_OBJECT;

    }

    entry = ldap_first_entry(ldc->ldap, res);

    vals = ldap_get_values(ldc->ldap, entry, attrib);

    if (!vals) {

        ldap_memfree(res);

        ldc->reason = "ldap_get_values() failed";

        return LDAP_NO_SUCH_OBJECT;

    }

    count = ldap_count_values(vals);

    /* Duplicate into pool space. */

    *values = apr_palloc(r->pool, (count + 1) * sizeof **values);

    for (n = 0; n < count; n++) {

        (*values)[n] = apr_pstrdup(r->pool, vals[n]);

    }

    values[n] = NULL;

    ldap_value_free(vals);

    ldap_memfree(res);

    return LDAP_SUCCESS;

}

    APR_REGISTER_OPTIONAL_FN(uldap_cache_getattrvals);

    int dynamic_groups;             /* If true, dynamic group lookups are enabled. */

static APR_OPTIONAL_FN_TYPE(uldap_cache_getattrvals) *util_ldap_cache_getattrvals;

/* Evaluates to a string description of a scope integer. */

#define SCOPE_TO_STR(scope_)                                    \

    (scope_ == LDAP_SCOPE_SUBTREE? "subtree" :                  \

     scope_ == LDAP_SCOPE_BASE? "base" :                        \

     scope_ == LDAP_SCOPE_ONELEVEL? "onelevel" : "unknown")

/* Check whether user is a member of dynamic group groupDN.  Returns

 * LDAP_COMPARE_TRUE on success or LDAP_COMPARE_FALSE otherwise.  */

static int check_dynamic_groups(request_rec *r, util_ldap_connection_t *ldc,

                                authn_ldap_config_t *sec, authn_ldap_request_t *req,

                                const char *attrib, const char *groupDN)

{

    apr_ldap_url_desc_t *gurl;

    apr_ldap_err_t *err;

    const char **vals;

    int result, n;

    /* Retrieve the set of memberURL attribute values from the group

     * DN which specify the search URLs which define the group. */

    result = util_ldap_cache_getattrvals(r, ldc, sec->url, groupDN, attrib, &vals);

    if (result != LDAP_SUCCESS) {

        return LDAP_COMPARE_FALSE;

    }

    /* Iterate through the returned search URLs attempting to match

     * the user's DN against the results of each search.  */

    for (n = 0, result = LDAP_COMPARE_FALSE; 

         vals[n] && result != LDAP_COMPARE_TRUE; 

         n++) {

        char filter[FILTER_LENGTH];

        const char *dn;

        /* Parse the URL. */

        result = apr_ldap_url_parse(r->pool, vals[n], &gurl, &err);

        if (result) {

            ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

                          "auth_ldap authorise: could not parse URL %s for dynamic group",

                          vals[n]);

            result = LDAP_COMPARE_FALSE;

            ldc->reason = "could not parse URL";

            continue;

        }

        /* The host and attribute fields will be ignored so warn if

         * they are specified. */

        if (gurl->lud_host || gurl->lud_attrs) {

            ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

                          "auth_ldap authorise: attrib/host are ignored in dynamic group URL %s",

                          vals[n]);

        }

        /* Build the search filter; a boolean AND of the group's

         * search filter and a search filter for the user. */

        authn_ldap_build_filter(filter, r, req->user, gurl->lud_filter, sec);

        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                      "auth_ldap authorise: checking dynamic group ldap:///%s?%s?%s",

                      gurl->lud_dn, SCOPE_TO_STR(gurl->lud_scope), filter);

        /* Search for the user DN. */

        result = util_ldap_cache_getuserdn(r, ldc, sec->url, 

                                           gurl->lud_dn, gurl->lud_scope, NULL, 

                                           filter, &dn, &vals);

        if (result == LDAP_SUCCESS) {

            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                          "[%" APR_PID_T_FMT "] auth_ldap authorise: checking "

                          "DN %s match for dynamic group",

                          getpid(), dn);

            result = util_ldap_cache_comparedn(r, ldc, sec->url, req->dn, dn,

                                               sec->compare_dn_on_server);

        }

        if (result != LDAP_COMPARE_TRUE) {

            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                          "[%" APR_PID_T_FMT "] auth_ldap authorise: failed to find user DN "

                          "in dynamic group %s",

                          getpid(), vals[n]);

            result = LDAP_COMPARE_FALSE;

        }

    }

    return result;

}

            if (sec->dynamic_groups) {

                ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                              "[%" APR_PID_T_FMT "] auth_ldap authorise: require group: "

                              "testing for dynamic group membership in \"%s\"",

                              getpid(), t);

                result = check_dynamic_groups(r, ldc, sec, req, "memberURL", t);

                switch (result) {

                case LDAP_COMPARE_TRUE:

                    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                                  "[%" APR_PID_T_FMT "] auth_ldap authorise: require dynamic group: "

                                  "authorisation successful [%s][%s]",

                                  getpid(), ldc->reason, ldap_err2string(result));

                    return OK;

                default:

                    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                                  "[%" APR_PID_T_FMT "] auth_ldap authorise: require dynamic group \"%s\": "

                                  "authorisation failed [%s][%s]",

                                  getpid(), t, ldc->reason, ldap_err2string(result));

                    break;

                }

            }

    AP_INIT_FLAG("AuthLDAPDynamicGroupLookup", ap_set_flag_slot,

                 (void *)APR_OFFSETOF(authn_ldap_config_t, dynamic_groups), OR_AUTHCFG,

                 "If set to 'on', auth_ldap will look for dynamic group URI in a group DN "

                 "and attempt to see if a user is part of a group defined by that URI "

                 "Defaults to 'off'."),

    util_ldap_cache_getattrvals = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_getattrvals);