path: root/daemon/ldap.c

/*
 * HttpAuth
 *
 * Copyright (C) 2004 Nate Nielsen
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU General Public License for more details.
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the
 * Free Software Foundation, Inc.,
 * 59 Temple Place, Suite 330,
 * Boston, MA 02111-1307, USA.
 */

#include "usuals.h"
#include "httpauthd.h"
#include "md5.h"
#include "sha1.h"
#include "bd.h"

#include <sys/time.h>

/* LDAP library */
#include <ldap.h>

/* -------------------------------------------------------------------------------
 * Defaults and Constants
 */

/* TODO: We need to support more password types */
#define LDAP_PW_CLEAR    0
#define LDAP_PW_CRYPT    1
#define LDAP_PW_MD5      2
#define LDAP_PW_SHA      3
#define LDAP_PW_UNKNOWN -1

typedef struct ldap_pw_type
{
    const char* name;
    int type;
}
ldap_pw_type_t;

static const ldap_pw_type_t kLDAPPWTypes[] =
{
    { "cleartext", LDAP_PW_CLEAR },
    { "crypt", LDAP_PW_CRYPT },
    { "md5", LDAP_PW_MD5 },
    { "sha", LDAP_PW_SHA }
};


/* -------------------------------------------------------------------------------
 * Structures
 */

/* Our hanler context */
typedef struct ldap_context
{
    /* Base Handler ------------------------------------------------------ */
    bd_context_t bd;

    /* Read Only --------------------------------------------------------- */
    const char* servers;      /* Servers to authenticate against (required) */
    const char* filter;       /* Filter (either this or dnmap must be set) */
    const char* base;         /* Base for the filter */
    const char* pw_attr;      /* The clear password attribute */
    const char* ha1_attr;     /* Password for an encrypted Digest H(A1) */
    const char* user;         /* User to bind as */
    const char* password;     /* Password to bind with */
    const char* dnmap;        /* For mapping users to dns */
    int port;                 /* Port to connect to LDAP server on */
    int scope;                /* Scope for filter */

    int dobind;               /* Bind to do simple authentication */
    int ldap_max;             /* Number of open connections allowed */
    int ldap_timeout;         /* Maximum amount of time to dedicate to an ldap query */

    /* Require Locking --------------------------------------------------- */
    LDAP** pool;            /* Pool of available connections */
    int pool_mark;          /* Amount of connections allocated */
}
ldap_context_t;

/* Forward declarations for callbacks */
static int validate_digest(ha_request_t* rq, const char* user, digest_context_t* dg);
static int validate_basic(ha_request_t* rq, const char* user, const char* password);
static void escape_ldap(const ha_request_t* rq, ha_buffer_t* buf, const char* value);

/* The defaults for the context */
static const ldap_context_t ldap_defaults =
{
    BD_CALLBACKS(validate_digest,
        validate_basic, escape_ldap),
    NULL,               /* servers */
    NULL,               /* filter */
    NULL,               /* base */
    "userPassword",     /* pw_attr */
    NULL,               /* ha1_attr */
    NULL,               /* user */
    NULL,               /* password */
    NULL,               /* dnmap */
    389,                /* port */
    LDAP_SCOPE_SUBTREE, /* scope */
    1,                  /* dobind */
    10,                 /* ldap_max */
    30,                 /* ldap_timeout */
    NULL,               /* pool */
    0                   /* pool_mark */
};


/* -------------------------------------------------------------------------------
 * Internal Functions
 */

static int report_ldap(const ha_request_t* rq, const char* msg, int code)
{
    ASSERT(code != LDAP_SUCCESS);

    switch(code)
    {
    case LDAP_NO_MEMORY:
		ha_memerr(NULL);
        return HA_CRITERROR;

    default:
        if(!msg)
            msg = "error";
        ha_messagex(rq, LOG_ERR, "%s: %s", msg, ldap_err2string(code));
        return HA_FAILED;
    };
}

#define LDAP_NO_ESCAPE "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-_0123456789"
#define LDAP_HEX "0123456789abcdef"

static void escape_ldap(const ha_request_t* rq, ha_buffer_t* buf, const char* str)
{
    const char* t = str;
    size_t pos;

    ha_bufcpy(buf, "");

    while(*t)
    {
        pos = strspn(t, LDAP_NO_ESCAPE);

        if(pos > 0)
        {
            ha_bufjoin(buf);
            ha_bufncpy(buf, t, pos);

            t += pos;
        }

        while(*t && !strchr(LDAP_NO_ESCAPE, *t))
        {
            char hex[4];
            hex[0] = '\\';
            hex[1] = LDAP_HEX[*t >> 4 & 0xf];
            hex[2] = LDAP_HEX[*t & 0xf];
            hex[3] = '\0';

            ha_bufjoin(buf);
            ha_bufcpy(buf, hex);

            t++;
        }
    }
}


static const char* make_password_md5(ha_buffer_t* buf, const char* clearpw)
{
    md5_ctx_t md5;
    unsigned char digest[MD5_LEN];

    ASSERT(buf && clearpw);

    md5_init(&md5);
    md5_update(&md5, clearpw, strlen(clearpw));
    md5_final(digest, &md5);

    return ha_bufenc64(buf, digest, MD5_LEN);
}

static const char* make_password_sha(ha_buffer_t* buf, const char* clearpw)
{
    sha1_ctx_t sha;
    unsigned char digest[SHA1_LEN];

    ASSERT(buf && clearpw);

    sha1_init(&sha);
    sha1_update(&sha, clearpw, strlen(clearpw));
    sha1_final(digest, &sha);

    return ha_bufenc64(buf, digest, SHA1_LEN);
}

static int parse_ldap_password(const char** password)
{
    const char* pw;
    const char* scheme;
    int i;

    ASSERT(password && *password);

    pw = *password;

    /* zero length passwords are clear */
    if(strlen(pw) == 0)
        return LDAP_PW_CLEAR;

    /* passwords without a scheme are clear */
    if(pw[0] != '{')
        return LDAP_PW_CLEAR;

    pw++;
    scheme = pw;

    while(*pw && (isalpha(*pw) || isdigit(*pw) || *pw == '-'))
        pw++;

    /* scheme should end in a brace */
    if(*pw != '}')
        return LDAP_PW_CLEAR;

    *password = pw + 1;

    /* find a scheme in our map */
    for(i = 0; i < countof(kLDAPPWTypes); i++)
    {
        if(strncasecmp(kLDAPPWTypes[i].name, scheme, pw - scheme) == 0)
            return kLDAPPWTypes[i].type;
    }

    return LDAP_PW_UNKNOWN;
}

static const char** find_cleartext_password(ha_buffer_t* buf, const char** pws)
{
    ASSERT(buf);

    for(; pws && *pws; pws++)
    {
        if(parse_ldap_password(pws) == LDAP_PW_CLEAR)
            return pws;
    }

    return NULL;
}

static int parse_ldap_ha1(const ha_request_t* rq, struct berval* bv, unsigned char* ha1)
{
    size_t len;
    void* d;

    ASSERT(rq && bv && ha1);

    /* Raw binary */
    if(bv->bv_len == MD5_LEN)
    {
        ha_messagex(rq, LOG_DEBUG, "found ha1 in raw binary format");
        memcpy(ha1, bv->bv_val, MD5_LEN);
        return HA_OK;
    }

    /* Hex encoded */
    else if(bv->bv_len == (MD5_LEN * 2))
    {
        len = MD5_LEN;
        d = ha_bufdechex(rq->buf, bv->bv_val, &len);

        if(d && len == MD5_LEN)
        {
            ha_messagex(rq, LOG_DEBUG, "found ha1 in hex encoded format");
            memcpy(ha1, d, MD5_LEN);
            return HA_OK;
        }
    }

    /* B64 Encoded */
    else
    {
        len = MD5_LEN;
        d = ha_bufdec64(rq->buf, bv->bv_val, &len);

        if(d && len == MD5_LEN)
        {
            ha_messagex(rq, LOG_DEBUG, "found ha1 in b64 encoded format");
            memcpy(ha1, ha_bufdata(rq->buf), MD5_LEN);
            return HA_OK;
        }
    }

    return CHECK_RBUF(rq) ? HA_CRITERROR : HA_FALSE;
}

static int validate_ldap_password(const ha_request_t* rq, ldap_context_t* ctx, LDAP* ld,
                                  LDAPMessage* entry, const char* user, const char* clearpw)
{
    char** pws;
    char** t;
    const char* pw;
    const char* p;
    int type;
    int res = HA_FALSE;
    int foundany = 0;

    ASSERT(entry && ld && ctx && clearpw && rq);

    ASSERT(ctx->pw_attr);
    pws = ldap_get_values(ld, entry, ctx->pw_attr);

    if(pws)
    {
        for(t = pws ; *t; t++)
        {
            pw = *t;
            type = parse_ldap_password(&pw);

            if(type != LDAP_PW_UNKNOWN)
                foundany = 1;
            else
                continue;

            switch(type)
            {
            case LDAP_PW_CLEAR:
                p = clearpw;
                break;

            case LDAP_PW_MD5:
                p = make_password_md5(rq->buf, clearpw);
                break;

            case LDAP_PW_CRYPT:
                /* Not sure if crypt is thread safe */
                ha_lock(NULL);
                    p = (const char*)crypt(clearpw, pw);
                ha_unlock(NULL);
                break;

            case LDAP_PW_SHA:
                p = make_password_sha(rq->buf, clearpw);
                break;

            default:
                /* Not reached */
                ASSERT(0);
            };

            if(!p)
            {
                res = HA_CRITERROR;
                break;
            }

            if(strcmp(pw, p) == 0)
            {
                ha_messagex(rq, LOG_DEBUG, "successful validate against password");
                res = HA_OK;
                break;
            }
        }

        ldap_value_free(pws);
    }

    if(res == HA_FALSE && !foundany)
        ha_messagex(rq, LOG_ERR, "server does not contain any compatible passwords for user: %s", user);

    return res;
}

static int validate_ldap_ha1(const ha_request_t* rq, ldap_context_t* ctx, LDAP* ld,
                             LDAPMessage* entry, const char* user, const char* realm,
                             const char* clearpw)
{
    struct berval** ha1s;
    struct berval** b;
    unsigned char key[MD5_LEN];
    unsigned char k[MD5_LEN];
    int r, first = 1;
    int res = HA_FALSE;

    ASSERT(ctx && ld && entry && rq && user && clearpw);

    if(!ctx->ha1_attr)
        return HA_FALSE;

    ha1s = ldap_get_values_len(ld, entry, ctx->ha1_attr);

    if(ha1s)
    {
        digest_makeha1(key, user, realm, clearpw);

        for(b = ha1s ; *b; b++)
        {
            r = parse_ldap_ha1(rq, *b, k);
            if(r < 0)
            {
                res = r;
                break;
            }

            if(r == HA_FALSE)
            {
                if(first)
                    ha_messagex(rq, LOG_ERR, "server contains invalid HA1 digest hash for user: %s", user);

                first = 0;
                continue;
            }

            if(memcmp(key, k, MD5_LEN) == 0)
            {
                ha_messagex(rq, LOG_DEBUG, "successful validate against ha1");
                res = HA_OK;
                break;
            }
        }

        ldap_value_free_len(ha1s);
    }

    return res;
}

static LDAP* get_ldap_connection(const ha_request_t* rq, ldap_context_t* ctx)
{
    LDAP* ld = NULL;
    int i, r, create = 1;

    ASSERT(ctx);

    /*
     * Note that below there maybe a race condition between the two locks
     * but this will only allow a few extra connections to open at best
     * and as such really isn't a big issue.
     */

    ha_lock(NULL);

        for(i = 0; i < ctx->ldap_max; i++)
        {
            /* An open connection in the pool */
            if(ctx->pool[i])
            {
                ha_messagex(rq, LOG_DEBUG, "using cached LDAP connection");
                ld = ctx->pool[i];
                ctx->pool[i] = NULL;
                break;
            }
        }

        if(ld == NULL && ctx->pool_mark >= ctx->ldap_max)
        {
            ha_messagex(rq, LOG_ERR, "too many open LDAP connections");
            create = 0;
        }

    ha_unlock(NULL);

    if(ld != NULL || create == 0)
        return ld;

    ld = ldap_init(ctx->servers, ctx->port);
    if(!ld)
    {
        ha_message(rq, LOG_ERR, "couldn't initialize LDAP connection");
        return NULL;
    }

    if(ctx->user || ctx->password)
    {
        r = ldap_simple_bind_s(ld, ctx->user ? ctx->user : "",
                               ctx->password ? ctx->password : "");
        if(r != LDAP_SUCCESS)
        {
            report_ldap(rq, "couldn't bind to LDAP server", r);
            ldap_unbind_s(ld);
            return NULL;
        }
    }

    ha_lock(NULL);

        ctx->pool_mark++;
        ha_messagex(rq, LOG_DEBUG, "opened new connection (total %d)", ctx->pool_mark);

    ha_unlock(NULL);

    return ld;
}

static void discard_ldap_connection(const ha_request_t* rq, ldap_context_t* ctx, LDAP* ld)
{
    ldap_unbind_s(ld);

    ha_lock(NULL);

        ctx->pool_mark--;
        ha_messagex(rq, LOG_DEBUG, "discarding connection (total %d)", ctx->pool_mark);

    ha_unlock(NULL);
}

static void save_ldap_connection(const ha_request_t* rq, ldap_context_t* ctx, LDAP* ld)
{
    int i, e;

    ASSERT(ctx);

    if(!ld)
        return;

    ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &e);

    /* Make sure it's worth saving */
    switch(e)
    {
    case LDAP_SERVER_DOWN:
    case LDAP_LOCAL_ERROR:
    case LDAP_NO_MEMORY:
        break;

    default:
        ha_lock(NULL);

            for(i = 0; i < ctx->ldap_max; i++)
            {
                /* An open connection in the pool */
                if(!ctx->pool[i])
                {
                    ha_messagex(rq, LOG_DEBUG, "caching ldap connection for later use");
                    ctx->pool[i] = ld;
                    ld = NULL;
                    break;
                }
            }

        ha_unlock(NULL);
        break;
    };

    if(ld != NULL)
        discard_ldap_connection(rq, ctx, ld);
}

static int retrieve_user_entry(const ha_request_t* rq, ldap_context_t* ctx, LDAP* ld,
                               const char* user, const char** dn,
                               LDAPMessage** entry, LDAPMessage** result)
{
    struct timeval tv;
    const char* filter;
    const char* attrs[3];
    const char* base;
    int scope;
    int r;

    ASSERT(ctx && rq && ld && user && dn && entry && result);

    if(ctx->filter)
    {
        /* Filters can also have %u and %r */
        filter = bd_substitute(rq, user, ctx->filter);
        if(!filter)
            return HA_CRITERROR;
    }
    else
    {
        filter = "(objectClass=*)";
    }

    attrs[0] = ctx->dobind ? NULL : ctx->pw_attr;
    attrs[1] = ctx->dobind ? NULL : ctx->ha1_attr;
    attrs[2] = NULL;

    tv.tv_sec = ctx->ldap_timeout;
    tv.tv_usec = 0;

    base = *dn ? *dn : ctx->base;
    scope = *dn ? LDAP_SCOPE_BASE : ctx->scope;

    ha_messagex(rq, LOG_DEBUG, "performing search: [ base: %s / scope: %d / filter: %s ]",
                base, scope, filter);

    r = ldap_search_st(ld, base, scope, filter, (char**)attrs, 0, &tv, result);

    if(r != LDAP_SUCCESS)
    {
        if(r == LDAP_NO_SUCH_OBJECT)
        {
            ha_messagex(rq, LOG_WARNING, "user not found in %s", user);
            return HA_FALSE;
        }

        return report_ldap(rq, "couldn't search LDAP server", r);
    }


    /* Only one result should exist */
    switch(r = ldap_count_entries(ld, *result))
    {
    case 1:
        *entry = ldap_first_entry(ld, *result);
        if(!(*dn))
        {
            *dn = ldap_get_dn(ld, *entry);
            ha_messagex(rq, LOG_DEBUG, "found entry for user: %s", *dn);
        }
        return HA_OK;

    case 0:
        ha_messagex(rq, LOG_WARNING, "user not found in %s", user);
        break;

    default:
        ha_messagex(rq, LOG_WARNING, "more than one user found for filter: %s", filter);
        break;
    };

    return HA_FALSE;
}

static int validate_digest(ha_request_t* rq, const char* user, digest_context_t* dg)
{
    ldap_context_t* ctx = (ldap_context_t*)rq->context->ctx_data;
    LDAP* ld = NULL;                /* freed in finally */
    LDAPMessage* results = NULL;    /* freed in finally */
    LDAPMessage* entry = NULL;      /* no need to free */
    struct berval** ha1s = NULL;    /* freed in finally */
    const char** pws = NULL;        /* freed in finally */
    int ret = HA_FALSE;
    const char* dn = NULL;
    int r;
    int foundany = 0;

    ASSERT(rq && dg && user);

    ld = get_ldap_connection(rq, ctx);
    if(!ld)
        RETURN(HA_FAILED);

    /*
     * Discover the DN of the user. If there's a DN map string
     * then we can do this really quickly here without querying
     * the LDAP tree
     */
    if(ctx->dnmap)
    {
        /* The map can have %u and %r to denote user and realm */
        dn = bd_substitute(rq, user, ctx->dnmap);
        if(!dn)
            RETURN(HA_CRITERROR);

        ha_messagex(rq, LOG_INFO, "mapped %s to %s", user, dn);
    }

    /* Okay now we contact the LDAP server. */
    r = retrieve_user_entry(rq, ctx, ld, user, &dn, &entry, &results);
    if(r != HA_OK)
        RETURN(r);

    /* Figure out the users ha1 */
    if(ctx->ha1_attr)
        ha1s = ldap_get_values_len(ld, entry, ctx->ha1_attr);

    if(ha1s && *ha1s)
    {
        int foundinvalid = 0;
		struct berval** h = NULL;

		for(h = ha1s; *h; ++h)
		{
            r = parse_ldap_ha1(rq, *h, dg->ha1);

            if(r == HA_FALSE)
            {
                foundinvalid = 1;
            }

            else if(r == HA_OK)
            {
                foundany = 1;

                /* Run the actual check */
                ret = digest_complete_check(dg, rq->buf);

                if(ret != HA_FALSE)
                    RETURN(ret);
            }

            else if(r < 0)
                RETURN(r);
        }

        if(foundinvalid)
            ha_messagex(rq, LOG_ERR, "server contains invalid HA1 for user: %s", user);
    }

    /* If no ha1 set or none found, use password and make a HA1 */
    pws = (const char**)ldap_get_values(ld, entry, ctx->pw_attr);

    if(pws && *pws)
    {
		const char** p = pws;

        /* Find a cleartext password */
        while((p = find_cleartext_password(rq->buf, p)))
        {
            foundany = 1;

            digest_makeha1(dg->ha1, user, rq->context->realm, *p);

            /* Run the actual check */
            ret = digest_complete_check(dg, rq->buf);

            if(ret != HA_FALSE)
                RETURN(ret);

			p++;
        }
    }

    if(!foundany)
        ha_messagex(rq, LOG_WARNING, "server contains no clear password or HA1 for user: %s", user);

finally:

    if(ha1s)
        ldap_value_free_len(ha1s);

    if(pws)
        ldap_value_free((char**)pws);

    if(results)
        ldap_msgfree(results);

    if(ld)
        save_ldap_connection(rq, ctx, ld);

    return ret;
}

static int validate_basic(ha_request_t* rq, const char* user, const char* password)
{
    ldap_context_t* ctx = (ldap_context_t*)rq->context->ctx_data;
    LDAP* ld = NULL;
    LDAPMessage* entry = NULL;
    LDAPMessage* results = NULL;
    const char* dn = NULL;
    int ret = HA_FALSE;
    int found = 0;
    int r;

    ASSERT(rq && user && password);

    ld = get_ldap_connection(rq, ctx);
    if(!ld)
        RETURN(HA_FAILED);


    /*
     * Discover the DN of the user. If there's a DN map string
     * then we can do this really quickly here without querying
     * the LDAP tree
     */
    if(ctx->dnmap)
    {
        /* The map can have %u and %r to denote user and realm */
        dn = bd_substitute(rq, user, ctx->dnmap);
        if(!dn)
            RETURN(HA_CRITERROR);

        ha_messagex(rq, LOG_INFO, "mapped %s to %s", user, dn);
    }


    /**
     * Okay now we contact the LDAP server. There are many ways
     * this is used for different authentication modes:
     *
     * - If a dn has been mapped above, this can apply a
     *   configured filter to narrow things down.
     * - If no dn has been mapped, then this maps out a dn
     *   by using the single object the filter returns.
     * - If not in 'dobind' mode we also retrieve the password
     *   here.
     *
     * All this results in only one query to the LDAP server,
     * except for the case of dobind without a dnmap.
     */

    if(!ctx->dobind || !dn || ctx->filter)
    {
        r = retrieve_user_entry(rq, ctx, ld, user, &dn, &entry, &results);
        if(r != HA_OK)
            RETURN(r);
    }


    /* Now if in bind mode we try to bind as that user */
    if(ctx->dobind)
    {
        ASSERT(dn);

        r = ldap_simple_bind_s(ld, dn, password);
        if(r != LDAP_SUCCESS)
        {
            if(r == LDAP_INVALID_CREDENTIALS)
            {
                ha_messagex(rq, LOG_WARNING, "basic authentication (via bind) failed for user: %s", user);
                RETURN(HA_FALSE);
            }
            else
            {
                report_ldap(rq, "couldn't bind to LDAP server", r);
                RETURN(HA_FAILED);
            }
        }

        /* It worked! */
        ha_messagex(rq, LOG_NOTICE, "validated basic user using bind: %s", user);
        found = 1;

        /* Now we have to rebind the connection back to the main user */
        r = ldap_simple_bind_s(ld, ctx->user ? ctx->user : "",
                               ctx->password ? ctx->password : "");
        if(r != LDAP_SUCCESS)
        {
            report_ldap(rq, "couldn't rebind LDAP connection back to auth credentials", r);

            /* Discard the connection since it's useless to us */
            discard_ldap_connection(rq, ctx, ld);
            ld = NULL;
        }
    }


    /* Otherwise we compare the password attribute */
    else
    {
        ret = validate_ldap_password(rq, ctx, ld, entry, user, password);
        if(ret == HA_FALSE)
        ret = validate_ldap_ha1(rq, ctx, ld, entry, user,
                                rq->context->realm, password);

        if(ret == HA_OK)
        {
            ha_messagex(rq, LOG_NOTICE, "validated basic user password/ha1: %s", user);
            found = 1;
        }

        else
        {
            ha_messagex(rq, LOG_WARNING, "invalid, unreadable or unrecognized password for user: %s", user);
        }
    }

finally:

    if(results)
        ldap_msgfree(results);

    if(ld)
        save_ldap_connection(rq, ctx, ld);

    return ret;
}


/* -------------------------------------------------------------------------------
 * Handler Functions
 */

int ldap_config(ha_context_t* context, const char* name, const char* value)
{
    ldap_context_t* ctx = (ldap_context_t*)(context->ctx_data);

    ASSERT(name && value && value[0]);

    if(strcmp(name, "ldapservers") == 0)
    {
        ctx->servers = value;
        return HA_OK;
    }

    else if(strcmp(name, "ldapfilter") == 0)
    {
        ctx->filter = value;
        return HA_OK;
    }

    else if(strcmp(name, "ldapbase") == 0)
    {
        ctx->base = value;
        return HA_OK;
    }

    else if(strcmp(name, "ldappwattr") == 0)
    {
        ctx->pw_attr = value;
        return HA_OK;
    }

    else if(strcmp(name, "ldapha1attr") == 0)
    {
        ctx->ha1_attr = value;
        return HA_OK;
    }

    else if(strcmp(name, "ldapuser") == 0)
    {
        ctx->user = value;
        return HA_OK;
    }

    else if(strcmp(name, "ldappassword") == 0)
    {
        ctx->password = value;
        return HA_OK;
    }

    else if(strcmp(name, "ldapdnmap") == 0)
    {
        ctx->dnmap = value;
        return HA_OK;
    }

    else if(strcmp(name, "ldapscope") == 0)
    {
        if(strcmp(value, "sub") == 0 || strcmp(value, "subtree") == 0)
            ctx->scope = LDAP_SCOPE_SUBTREE;
        else if(strcmp(value, "base") == 0)
            ctx->scope = LDAP_SCOPE_BASE;
        else if(strcmp(value, "one") == 0 || strcmp(value, "onelevel") == 0)
            ctx->scope = LDAP_SCOPE_ONELEVEL;
        else
        {
            ha_messagex(NULL, LOG_ERR, "invalid value for '%s' (must be 'sub', 'base' or 'one')", name);
            return HA_FAILED;
        }

        return HA_OK;
    }

    else if(strcmp(name, "ldapdobind") == 0)
    {
        return ha_confbool(name, value, &(ctx->dobind));
    }

    else if(strcmp(name, "ldapmax") == 0)
    {
        return ha_confint(name, value, 1, 256, &(ctx->ldap_max));
    }

    else if(strcmp(name, "ldaptimeout") == 0)
    {
        return ha_confint(name, value, 0, 86400, &(ctx->ldap_timeout));
    }

    return HA_FALSE;
}

int ldap_inithand(ha_context_t* context)
{
    int r;

    if((r = bd_init(context)) != HA_OK)
        return r;

    /* Context specific initialization */
    if(context)
    {
        ldap_context_t* ctx = (ldap_context_t*)(context->ctx_data);
        ASSERT(ctx);

        /* Check for mandatory configuration */
        if(!ctx->servers)
        {
            ha_messagex(NULL, LOG_ERR, "configuration incomplete. "
                           "Must have LDAPServers.");
            return HA_FAILED;
        }

        if(!ctx->dnmap && (!ctx->filter || !ctx->base))
        {
            ha_messagex(NULL, LOG_ERR, "configuration incomplete. "
                                 "When not using LDAPDNMap must specify LDAPBase and LDAPFilter.");
            return HA_FAILED;
        }

        ASSERT(!ctx->pool);
        ASSERT(ctx->ldap_max > 0);

        /*
         * Our connection pool. It's the size of our maximum
         * amount of pending connections as that's the max
         * we'd be able to use at a time anyway.
         */
        ctx->pool = (LDAP**)malloc(sizeof(LDAP*) * ctx->ldap_max);
        if(!ctx->pool)
        {
			ha_memerr(NULL);
            return HA_CRITERROR;
        }

        memset(ctx->pool, 0, sizeof(LDAP*) * ctx->ldap_max);
        ha_messagex(NULL, LOG_INFO, "initialized ldap handler");
    }

    return HA_OK;
}

void ldap_destroy(ha_context_t* context)
{
    if(context)
    {
        /* Note: We don't need to be thread safe here anymore */
        ldap_context_t* ctx = (ldap_context_t*)(context->ctx_data);
        int i;

        ASSERT(ctx);

        if(ctx->pool)
        {
            /* Close any connections we have open */
            for(i = 0; i < ctx->ldap_max; i++)
            {
                if(ctx->pool[i])
                    ldap_unbind_s(ctx->pool[i]);
            }

            /* And free the connection pool */
            free(ctx->pool);
        }
    }

    bd_destroy(context);
    ha_messagex(NULL, LOG_INFO, "uninitialized ldap handler");
}



/* -------------------------------------------------------------------------------
 * Handler Definition
 */

ha_handler_t ldap_handler =
{
    "LDAP",                  /* The type */
    ldap_inithand,           /* Initialization function */
    ldap_destroy,            /* Uninitialization routine */
    ldap_config,             /* Config routine */
    bd_process,              /* Processing routine */
    &ldap_defaults,          /* The context defaults */
    sizeof(ldap_context_t)
};