Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY CUSTOMIZATION, Manual

Page: 98 / 612

Writing a Pre-Operation Bind Plug-in
98 Netscape Directory Server Plug-In Programmer’s Guide • December 2003
•
SLAPI_BIND_CREDENTIALS
(a
berval
structure containing the credentials sent
by the client)
If you plan to support authentication through SASL mechanisms, you should also
get the value of the
SLAPI_BIND_SASLMECHANISM
parameter (a string value
specifying the name of the SASL mechanism to use for authentication).
Make sure to check the following:
• Determine if the client is requesting to bind as an anonymous user.
If the
SLAPI_BIND_METHOD
parameter is
LDAP_AUTH_SIMPLE
and the
SLAPI_BIND_CREDENTIALS
parameter is empty or NULL, the client is
attempting to bind anonymously.
Call
slapi_send_ldap_result()
to send the LDAP result code
LDAP_SUCCESS
back to the client.
• If the
SLAPI_BIND_METHOD
parameter specifies a method that you do not
recognize or support, call
slapi_send_ldap_result()
to send an
LDAP_STRONG_AUTH_NOT_SUPPORTED
result code back to the client.
In both cases, return a non-zero value to prevent the server from calling the default
backend function for authentication.
Getting the Entry and Checking the Credentials
Get the entry for the DN specified by the
SLAPI_BIND_TARGET
parameter and
compare the credentials in the
SLAPI_BIND_CREDENTIALS
parameter against the
known credentials for that entry.
By default, Directory Server 4.x uses the
userpassword
attribute to store the
credentials for an entry. The server encodes the password using the scheme
specified in the
passwdhash
directive of the
slapd.conf
configuration file. The
scheme can be
crypt
or
sha
or “ “ (for cleartext).
By default, Directory Server 6.x uses the
userpassword
attribute to store the
credentials for an entry. The server encodes the password using the scheme
specified in the
nsslapd-rootpwstoragescheme
or
passwordStorageScheme
attributes of the
cn=config
entry contained in the
dse.ldif
file. The scheme can
be any of the following:
•
CLEAR
(means no encryption and can be defined using the
clear-password-storage-scheme
plug-in)
•
CRYPT
(means Unix crypt algorithm and can be defined using the
crypt-password-storage-scheme
plug-in)