1 2 #include <ldap.h> 3 #include <errno.h> 4 /* Solaris Kerberos: errors are handled diff from MIT */ 5 #if 0 /************** Begin IFDEF'ed OUT *******************************/ 6 #include <kdb5_err.h> 7 #endif /**************** END IFDEF'ed OUT *******************************/ 8 #include <krb5.h> 9 #include "ldap_err.h" 10 #ifndef LDAP_X_ERROR 11 #define LDAP_X_ERROR(x) (0) 12 #endif 13 14 #ifndef LDAP_NAME_ERROR 15 #ifdef NAME_ERROR 16 #define LDAP_NAME_ERROR NAME_ERROR 17 #else 18 #define LDAP_NAME_ERROR(x) (0) 19 #endif 20 #endif 21 22 #ifndef LDAP_SECURITY_ERROR 23 #define LDAP_SECURITY_ERROR(x) (0) 24 #endif 25 26 #ifndef LDAP_SERVICE_ERROR 27 #define LDAP_SERVICE_ERROR(x) (0) 28 #endif 29 30 #ifndef LDAP_API_ERROR 31 #define LDAP_API_ERROR(x) (0) 32 #endif 33 34 #ifndef LDAP_UPDATE_ERROR 35 #define LDAP_UPDATE_ERROR(x) (0) 36 #endif 37 38 /* 39 * The possible KDB errors are 40 * 1. KRB5_KDB_UK_RERROR 41 * 2. KRB5_KDB_UK_SERROR 42 * 3. KRB5_KDB_NOENTRY 43 * 4. KRB5_KDB_TRUNCATED_RECORD 44 * 5. KRB5_KDB_UNAUTH 45 * 6. KRB5_KDB_DB_CORRUPT 46 * 7. KRB5_KDB_ACCESS_ERROR (NEW) 47 * 8. KRB5_KDB_INTERNAL_ERROR (NEW) 48 * 9. KRB5_KDB_SERVER_INTERNAL_ERR (NEW) 49 * 10. KRB5_KDB_CONSTRAINT_VIOLATION (NEW) 50 * 51 */ 52 53 /* 54 * op : 55 * 0 => not specified 56 * OP_INIT => ldap_init 57 * OP_BIND => ldap_bind 58 * OP_UNBIND => ldap_unbind 59 * OP_ADD => ldap_add 60 * OP_MOD => ldap_modify 61 * OP_DEL => ldap_delete 62 * OP_SEARCH => ldap_search 63 * OP_CMP => ldap_compare 64 * OP_ABANDON => ldap_abandon 65 */ 66 translate_ldap_error(int err,int op)67int translate_ldap_error(int err, int op) { 68 69 switch (err) { 70 case LDAP_SUCCESS: 71 return 0; 72 73 case LDAP_OPERATIONS_ERROR: 74 /* LDAP_OPERATIONS_ERROR: Indicates an internal error. The server is 75 * unable to respond with a more specific error and is also unable 76 * to properly respond to a request */ 77 case LDAP_UNAVAILABLE_CRITICAL_EXTENSION: 78 /* LDAP server was unable to satisfy a request because one or more 79 * critical extensions were not available */ 80 /* This might mean that the schema was not extended ... */ 81 case LDAP_UNDEFINED_TYPE: 82 /* The attribute specified in the modify or add operation does not 83 * exist in the LDAP server's schema. */ 84 return KRB5_KDB_INTERNAL_ERROR; 85 86 87 case LDAP_INAPPROPRIATE_MATCHING: 88 /* The matching rule specified in the search filter does not match a 89 * rule defined for the attribute's syntax */ 90 return KRB5_KDB_UK_RERROR; 91 92 case LDAP_CONSTRAINT_VIOLATION: 93 /* The attribute value specified in a modify, add, or modify DN 94 * operation violates constraints placed on the attribute */ 95 case LDAP_TYPE_OR_VALUE_EXISTS: 96 /* The attribute value specified in a modify or add operation 97 * already exists as a value for that attribute */ 98 return KRB5_KDB_UK_SERROR; 99 100 case LDAP_INVALID_SYNTAX: 101 /* The attribute value specified in an add, compare, or modify 102 * operation is an unrecognized or invalid syntax for the attribute */ 103 if (op == OP_ADD || op == OP_MOD) 104 return KRB5_KDB_UK_SERROR; 105 else /* OP_CMP */ 106 return KRB5_KDB_UK_RERROR; 107 108 /* Ensure that the following don't occur in the DAL-LDAP code. 109 * Don't rely on the LDAP server to catch it */ 110 case LDAP_SASL_BIND_IN_PROGRESS: 111 /* This is not an error. So, this function should not be called */ 112 case LDAP_COMPARE_FALSE: 113 case LDAP_COMPARE_TRUE: 114 /* LDAP_COMPARE_FALSE and LDAP_COMPARE_TRUE are not errors. This 115 * function should not be invoked for them */ 116 case LDAP_RESULTS_TOO_LARGE: /* CLDAP */ 117 case LDAP_TIMELIMIT_EXCEEDED: 118 case LDAP_SIZELIMIT_EXCEEDED: 119 return KRB5_KDB_SERVER_INTERNAL_ERR; 120 121 case LDAP_INVALID_DN_SYNTAX: 122 /* The syntax of the DN is incorrect */ 123 return EINVAL; 124 125 case LDAP_PROTOCOL_ERROR: 126 /* LDAP_PROTOCOL_ERROR: Indicates that the server has received an 127 * invalid or malformed request from the client */ 128 case LDAP_CONFIDENTIALITY_REQUIRED: 129 130 /* Bind problems ... */ 131 case LDAP_AUTH_METHOD_NOT_SUPPORTED: 132 /* case LDAP_STRONG_AUTH_NOT_SUPPORTED: // Is this a bind error ? */ 133 case LDAP_INAPPROPRIATE_AUTH: 134 case LDAP_INVALID_CREDENTIALS: 135 case LDAP_UNAVAILABLE: 136 case LDAP_SERVER_DOWN: /* Solaris Kerberos */ 137 case LDAP_CONNECT_ERROR: /* Solaris Kerberos */ 138 return KRB5_KDB_ACCESS_ERROR; 139 140 case LDAP_STRONG_AUTH_REQUIRED: 141 if (op == OP_BIND) /* the LDAP server accepts only strong authentication. */ 142 return KRB5_KDB_ACCESS_ERROR; 143 else /* Client requested an operation such that requires strong authentication */ 144 return KRB5_KDB_CONSTRAINT_VIOLATION; 145 146 case LDAP_REFERRAL: 147 return KRB5_KDB_NOENTRY; 148 149 case LDAP_ADMINLIMIT_EXCEEDED: 150 /* An LDAP server limit set by an administrative authority has been 151 * exceeded */ 152 return KRB5_KDB_CONSTRAINT_VIOLATION; 153 case LDAP_UNWILLING_TO_PERFORM: 154 /* The LDAP server cannot process the request because of 155 * server-defined restrictions */ 156 return KRB5_KDB_CONSTRAINT_VIOLATION; 157 158 159 case LDAP_NO_SUCH_ATTRIBUTE: 160 /* Indicates that the attribute specified in the modify or compare 161 * operation does not exist in the entry */ 162 if (op == OP_MOD) 163 return KRB5_KDB_UK_SERROR; 164 else /* OP_CMP */ 165 return KRB5_KDB_TRUNCATED_RECORD; 166 167 168 case LDAP_ALIAS_DEREF_PROBLEM: 169 /* Either the client does not have access rights to read the aliased 170 * object's name or dereferencing is not allowed */ 171 #ifdef LDAP_PROXY_AUTHZ_FAILURE 172 case LDAP_PROXY_AUTHZ_FAILURE: // Is this correct ? 173 #endif 174 case LDAP_INSUFFICIENT_ACCESS: 175 /* Caller does not have sufficient rights to perform the requested 176 * operation */ 177 return KRB5_KDB_UNAUTH; 178 179 case LDAP_LOOP_DETECT: 180 /* Client discovered an alias or referral loop */ 181 return KRB5_KDB_DB_CORRUPT; 182 183 default: 184 185 if (LDAP_NAME_ERROR (err)) 186 return KRB5_KDB_NOENTRY; 187 188 /*LINTED*/ 189 if (LDAP_SECURITY_ERROR (err)) 190 return KRB5_KDB_UNAUTH; 191 192 /*LINTED*/ 193 if (LDAP_SERVICE_ERROR (err) || LDAP_API_ERROR (err) || LDAP_X_ERROR (err)) 194 return KRB5_KDB_ACCESS_ERROR; 195 196 /*LINTED*/ 197 if (LDAP_UPDATE_ERROR(err)) 198 return KRB5_KDB_UK_SERROR; 199 200 /* LDAP_OTHER */ 201 return KRB5_KDB_SERVER_INTERNAL_ERR; 202 } 203 } 204