Ticket 534 - Add SASL mappings fallback

Bug Description:  IPA team requested that the fallback feature be configurable.

Fix Description:  Added new config setting under cn=config to turn feature "on",
                  the default is "off".

https://fedorahosted.org/389/ticket/534

Reviewed by: richm(Thanks Rich!)

ldap/ldif/template-dse.ldif.in

@@ -57,6 +57,7 @@ nsslapd-rootpw: %ds_passwd%
 nsslapd-maxdescriptors: 1024
 nsslapd-max-filter-nest-level: 40
 nsslapd-ndn-cache-enabled: off
+nsslapd-sasl-mapping-fallback: off
 
 dn: cn=features,cn=config
 objectclass: top

ldap/schema/01core389.ldif

@@ -140,6 +140,7 @@ attributeTypes: ( 2.16.840.1.113730.3.1.2136 NAME 'nsds5ReplicaCleanRUVNotified'
 attributeTypes: ( 2.16.840.1.113730.3.1.2137 NAME 'nsds5ReplicaAbortCleanRUV' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'Netscape Directory Server' )
 attributeTypes: ( 2.16.840.1.113730.3.1.2111 NAME 'tombstoneNumSubordinates' DESC 'count of immediate subordinates for tombstone entries' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE NO-USER-MODIFICATION USAGE directoryOperation X-ORIGIN '389 directory server' )
 attributeTypes: ( 2.16.840.1.113730.3.1.2138 NAME 'nsslapd-readonly' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
+attributeTypes: ( 2.16.840.1.113730.3.1.2142 NAME 'nsslapd-sasl-mapping-fallback' DESC 'Netscape defined attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'Netscape Directory Server' )
 #
 # objectclasses
 #

ldap/servers/slapd/libglobs.c

@@ -251,6 +251,7 @@ int init_disk_monitoring;
 int init_disk_logging_critical;
 int init_disk_preserve_logging;
 int init_ndn_cache_enabled;
+int init_sasl_mapping_fallback;
 #ifdef MEMPOOL_EXPERIMENTAL
 int init_mempool_switch;
 #endif
@@ -427,6 +428,11 @@ static struct config_get_and_set {
 		NULL, 0,
 		(void**)&global_slapdFrontendConfig.readonly,
 		CONFIG_ON_OFF, NULL, &init_readonly},
+	{CONFIG_SASL_MAPPING_FALLBACK, config_set_sasl_mapping_fallback,
+		NULL, 0,
+		(void**)&global_slapdFrontendConfig.sasl_mapping_fallback,
+		CONFIG_ON_OFF, (ConfigGetFunc)config_get_sasl_mapping_fallback,
+		&init_sasl_mapping_fallback},
 	{CONFIG_THREADNUMBER_ATTRIBUTE, config_set_threadnumber,
 		NULL, 0,
 		(void**)&global_slapdFrontendConfig.threadnumber,
@@ -1441,6 +1447,8 @@ FrontendConfig_init () {
   init_ndn_cache_enabled = cfg->ndn_cache_enabled = LDAP_OFF;
   cfg->ndn_cache_max_size = NDN_DEFAULT_SIZE;
   cfg->ignore_vattrs = slapi_counter_new();
+  cfg->sasl_mapping_fallback = slapi_counter_new();
+  init_sasl_mapping_fallback = LDAP_OFF;
 
 #ifdef MEMPOOL_EXPERIMENTAL
   init_mempool_switch = cfg->mempool_switch = LDAP_ON;
@@ -1580,6 +1588,20 @@ config_set_ignore_vattrs (const char *attrname, char *value, char *errorbuf, int
     return retVal;
 }
 
+int
+config_set_sasl_mapping_fallback (const char *attrname, char *value, char *errorbuf, int apply )
+{
+    slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+    int retVal = LDAP_SUCCESS;
+    int val;
+
+    retVal = config_set_onoff ( attrname, value, &val, errorbuf, apply);
+    if(retVal == LDAP_SUCCESS){
+        slapi_counter_set_value(slapdFrontendConfig->sasl_mapping_fallback, val);
+    }
+    return retVal;
+}
+
 int
 config_set_disk_monitoring( const char *attrname, char *value, char *errorbuf, int apply )
 {
@@ -3129,7 +3151,6 @@ config_set_readonly( const char *attrname, char *value, char *errorbuf, int appl
   return retVal;
 }
 
-
 int
 config_set_schemacheck( const char *attrname, char *value, char *errorbuf, int apply ) {
   int retVal = LDAP_SUCCESS;
@@ -4154,6 +4175,14 @@ config_get_ignore_vattrs()
     return slapi_counter_get_value(slapdFrontendConfig->ignore_vattrs);
 }
 
+int
+config_get_sasl_mapping_fallback()
+{
+    slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+
+    return slapi_counter_get_value(slapdFrontendConfig->sasl_mapping_fallback);
+}
+
 int
 config_get_disk_monitoring(){
     slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();

ldap/servers/slapd/proto-slap.h

@@ -556,6 +556,8 @@ int config_set_allowed_sasl_mechs(const char *attrname, char *value, char *error
 int config_get_schemamod();
 int config_set_ignore_vattrs(const char *attrname, char *value, char *errorbuf, int apply);
 int config_get_ignore_vattrs();
+int config_set_sasl_mapping_fallback(const char *attrname, char *value, char *errorbuf, int apply);
+int config_get_sasl_mapping_fallback();
 
 PLHashNumber hashNocaseString(const void *key);
 PRIntn hashNocaseCompare(const void *v1, const void *v2);

ldap/servers/slapd/saslbind.c

@@ -377,7 +377,8 @@ static Slapi_Entry *ids_sasl_user_to_entry(
                 break;
             }
         }
-        if(map == NULL){
+        /* break if the next map is NULL, or we are not checking all the mappings */
+        if(map == NULL || !config_get_sasl_mapping_fallback()){
             break;
         }
     }

ldap/servers/slapd/slap.h

@@ -2054,6 +2054,7 @@ typedef struct _slapdEntryPoints {
 #define CONFIG_NDN_CACHE_SIZE "nsslapd-ndn-cache-max-size"
 #define CONFIG_ALLOWED_SASL_MECHS "nsslapd-allowed-sasl-mechanisms"
 #define CONFIG_IGNORE_VATTRS "nsslapd-ignore-virtual-attrs"
+#define CONFIG_SASL_MAPPING_FALLBACK "nsslapd-sasl-mapping-fallback"
 
 #ifdef MEMPOOL_EXPERIMENTAL
 #define CONFIG_MEMPOOL_SWITCH_ATTRIBUTE "nsslapd-mempool"
@@ -2279,6 +2280,7 @@ typedef struct _slapdFrontendConfig {
 
   /* atomic settings */
   Slapi_Counter *ignore_vattrs;
+  Slapi_Counter *sasl_mapping_fallback;
 } slapdFrontendConfig_t;
 
 /* possible values for slapdFrontendConfig_t.schemareplace */