Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY CUSTOMIZATION, Manual

Page: 94 / 612

How the Authentication Process Works
94 Netscape Directory Server Plug-In Programmer’s Guide • December 2003
❍
If the credentials are correct, the server sets the
SLAPI_CONN_DN
parameter to the DN and the
SLAPI_CONN_AUTHTYPE
parameter to
LDAP_AUTH_SIMPLE
. The server sends an
LDAP_SUCCESS
result code back
to the client and ends the processing of the bind request.
❍
If the credentials are incorrect, the server sends an
LDAP_INVALID_CREDENTIALS
result code back to the client and ends the
processing of the bind request.
9.
The server calls any pre-operation bind plug-in functions. If the function
returns a non-zero value, the server ends the processing of the bind request.
If you are writing your own plug-in function to handle authentication, you
should return a non-zero value so that the server does not attempt to continue
processing the bind request.
10.
The server calls the backend bind function. The bind function returns one of
the following values:
❍
If the function returns a non-zero value (
SLAPI_BIND_FAIL_OR_ANONYMOUS
in Netscape Directory Server 4.x), the server ends the processing of the
bind request. The bind function is responsible for sending the appropriate
result code back to the client before returning a non-zero value.
❍
If the function returns 0 (
SLAPI_BIND_SUCCESS
in Netscape Directory
Server 4.x), the server continues processing the bind request. The server
sends the
LDAP_SUCCESS
result code back to the client. (The bind function
does not do this.)
11.
If the backend bind function succeeds, the server sets the
SLAPI_CONN_DN
parameter to the DN and the
SLAPI_CONN_AUTHTYPE
parameter to the
authentication method.
12.
The server sends an
LDAP_SUCCESS
result code back to the client and ends the
processing of the bind request.
If the client’s password is going to expire, the server includes a “password
expiring” control (with the OID 2.16.840.1.113730.3.4.5) with the result sent to
the client. If the client is logging in for the first time and needs to change the
password, the server includes a “password expired” control (with the OID
2.16.840.1.113730.3.4.4) with the result sent to the client.