auth: Debug log an LDAP request result only once

auth: Added hardcoded 5 second timeout to LDAP connect() Although it doesn't look like the timeout is exactly 5 seconds always due to OpenSSL's internal workings, but this should be good enough.

auth ldap: Fixed assert-crash when both passdb ldap and userdb ldap was used

auth ldap: Start LDAP connection only after auth process initialization is finished. This way even if connecting to LDAP takes a while it won't cause the master process to kill the auth process due to it not sending the startup "I'm ok" notification early enough.

auth ldap: More concentration of i_fatal() calls to db_ldap_init()

ldap: Added blocking=yes setting to use auth-workers.

auth: Use refcounting for LDAPMessage to make sure it always gets freed correctly. This may fix some memory leaks in some (error?) cases.

auth: If passdb ldap returned no values for userdb_ fields, use userdb prefetch anyway.

ldap auth: Don't access freed memory.

ldap: Crashfix

ldap: Various crashfixes

ldap auth: "!ldapField" now requests the given field, but doesn't return it directly. It's only useful for listing fields that %{ldap_ptr} can potentially access.

ldap auth: Support field values containing DNs to other LDAP records and getting them. For example: user_attrs = \ =user=%{ldap:uid}, \ @mail=base(%{ldap:mailDN}), \ =uid=%{ldap:uidNumber@mail}, \ =gid=%{ldap:gidNumber@mail}, \ =home=%{ldap:rootPath@mail}/%d/%n This first does the regular lookup, and then does another lookup using mailDN's value as the new lookup's base. The other lookup's filter is currently hardcoded to "no filter".

Array API changed: ARRAY_DEFINE(name, type) -> ARRAY(type) name Easy way to update your existing code: perl -i -pe 's:ARRAY_DEFINE\(([^,]+), *([^)]+)\);:ARRAY($2) $1;:' **/*.[ch]

Marked functions parameters that are allowed to be NULL. Some APIs were also changed. The non-obvious APIs where NULL parameter was changed to "" are master_service_init() and auth_master_user_list_init(). These checks can currently be enabled only on a patched clang: http://llvm.org/bugs/show_bug.cgi?id=6786

ldap: Removed warning about changed user_* settings. This warning can happen even with recommended settings when symlinking the passdb's ldap config to userdb ldap config.

ldap: Treat =key the same as =key=, just like v2.0.

ldap: Crashfixes to previous change.

ldap: Support using the same LDAP attribute in multiple fields.

auth: Log a warning if userdb ldap isn't used, but user_* or iterate_* aren't defaults. This is intended to stop people from wondering why their changes don't do anything.

auth: Removed max. request queue limit from LDAP. Old requests get dropped after 60 seconds, but other than that there is probably not much point in having a hard coded limit.

auth: Log a warning if ldap attribute has unexpectedly multiple values.

ldap: Reduce max. queued request count to 8. OpenLDAP seems to default to 16 worker threads.

Implemented support for listing all users in userdb. --HG-- branch : HEAD

Added ldaprc_path setting. --HG-- branch : HEAD

Added debug_level LDAP option to specify OpenLDAP's debug level. --HG-- branch : HEAD

Added support for OpenLDAP-specific TLS settings. --HG-- branch : HEAD

Renamed queue to aqueue ("array queue") because struct queue already exists in Solaris. --HG-- branch : HEAD

LDAP handling rewrite. Reconnections are handled a lot better now. If connection is down, requests are added to queue and they always stay there at least 4 seconds. --HG-- branch : HEAD

If LDAP server disconnects the connection and we haven't sent requests for a minute, disconnect silently and don't reconnect until the next auth request comes. --HG-- branch : HEAD

Changed .h ifdef/defines to use <NAME>_H format. --HG-- branch : HEAD

Removed deprecated pass_attrs and user_attrs configuration method. --HG-- branch : HEAD

Moved generic LDAP result iteration to db_ldap. It also supports now templates in values. --HG-- branch : HEAD

Changed userdb callback API. Don't require uid/gid to be returned by userdb. --HG-- branch : HEAD

#define LDAP_DEPRECATED for now. --HG-- branch : HEAD

Several fixes to handling deinitialization without crashing. --HG-- branch : HEAD

Handle LDAP requests while being disconnected more correctly. --HG-- branch : HEAD

Remove sasl_props from here too. --HG-- branch : HEAD

Crashfixes --HG-- branch : HEAD

LDAP code changes: If auth binds are used, bind back to the default dn before doing a search. Otherwise it could fail if user gave an invalid password. Initial binding is now also done asynchronously. Reconnecting to LDAP server wasn't working with auth binds. Use pass_attrs even with auth_bind=yes since it may contain other non-password fields also. Updated dovecot-ldap.conf to contain sasl_bind settings and reflect these changes. --HG-- branch : HEAD

Check for sasl.h and sasl/sasl.h existence and use the one that's found. If neither is found, disable support for LDAP SASL. --HG-- branch : HEAD

Added TLS support for LDAP if the library supports it. --HG-- branch : HEAD

Added support for SASL binding. Patch by Geert Jansen --HG-- branch : HEAD

Escape SQL strings using sql_escape_string(). Fixes the problems with PostgreSQL. --HG-- branch : HEAD

deinit, unref, destroy, close, free, etc. functions now take a pointer to their data pointer, and set it to NULL. This makes double-frees less likely to cause security holes. --HG-- branch : HEAD

Added "bool" type and changed all ints that were used as booleans to bool. --HG-- branch : HEAD

Added fast authbinding and auth_bind_userdn setting. Patch by Geff <boing@boing.com> --HG-- branch : HEAD

Added authentication bind support. Patch by J.M. Maurer. Also cleaned up the LDAP code a bit and made it possible for passdbs to disable lookup_credentials in runtime. --HG-- branch : HEAD

If LDAP lookup fails because connection gets closed, try retrying it again after reconnect. --HG-- branch : HEAD

user_global_uid and user_global_gid settings weren't working. Also changed them to now allow named user/group. --HG-- branch : HEAD

If both userdb and passdb used LDAP the later one was overriding first one's attribute names. --HG-- branch : HEAD

userdb can now return extra parameters to master. Removed special handling of home/mail wherever possible, they're just regular extra parameters now. LDAP passdb and static userdb can return extra parameters now. --HG-- branch : HEAD

Added preinit() call to userdb/passdbs, which is called before dropping privileges. init() is called after. SQL/LDAP now parses the config file in preinit, but does the actual connecting only in init(). This fixes LDAP crashing at startup. --HG-- branch : HEAD

Patch by Quentin Garnier: 1. Change default value for 'hosts' to NULL instead of 'localhost'. That way, libldap will choose the default list of server as specified in OpenLDAP's ldap.conf configuration file. 2. Add a new configuration stance, 'uris', which you can set to a list of URIs that will be passed directly to libldap, which understands them. --HG-- branch : HEAD

Added ldap_version setting. --HG-- branch : HEAD

minor ldap fixes --HG-- branch : HEAD

Added default_pass_scheme to LDAP. Support for more password schemes. Merged password checking code with LDAP and passwd-file, so both support the same schemes now. --HG-- branch : HEAD

Escape special chars in username if needed. --HG-- branch : HEAD

Use the same LDAP connection for both userdb and passdb if config_path is the same. --HG-- branch : HEAD

Added user_global_uid and user_global_gid LDAP settings. --HG-- branch : HEAD

Separate user and pass attrs/filters in config file --HG-- branch : HEAD

passdb ldap added. fixes to userdb ldap. --HG-- branch : HEAD

auth process fixes, LDAP seems to be working (with the kludge define or fixed libldap) --HG-- branch : HEAD

Cleanups, LDAP support compiles again and generally looks ok, even if it doesn't necessarily work :) Works now with new master config. --HG-- branch : HEAD