From 22b25dd6bf247814f75e800ae844d14fd1726431 Mon Sep 17 00:00:00 2001
From: Thierry Bordaz <tbordaz@redhat.com>
Date: Fri, 10 Jun 2016 09:47:36 +0200
Subject: [PATCH] ticket 48880: use case

The use case is to allow a pre extop plugin
(that will be freeipa Schema compat plugin) to translate a "fake" DN into
a real one, before applying the password update (through password modify extop)

To test it required:
    - a dummy plugin 'mapddn' that register its PER_EXTOP: mapdn_pre_extop
      The plugin read dn from the ber, and if it startswith 'uid=new_account"
      replace the next char by '1', for example
        uid=new_account0,dc=example,dc=com  --> uid=new_account1,dc=example,dc=com
      The result is set in SLAPI_TARGET_SDN
    - change in password_modify_extop so that if the pblock contains a non
      empty SLAPI_TARGET_SDN, it us it in place of the DN in the ber operation.
      An other minor change is to allow 'password_extop' on regular port that simplify the test

test case is
    create entries
        uid=new_account0,dc=example,dc=com
        uid=new_account1,dc=example,dc=com
        uid=new_account2,dc=example,dc=com

    Then run
        ldapsearch -LLL -h localhost -p 31389 -D "cn=directory manager" -w password -b "uid=new_account0,dc=example,dc=com" userPassword
        ldapsearch -LLL -h localhost -p 31389 -D "cn=directory manager" -w password -b "uid=new_account1,dc=example,dc=com" userPassword
        ldapsearch -LLL -h localhost -p 31389 -D "cn=directory manager" -w password -b "uid=new_account2,dc=example,dc=com" userPassword

        ldappasswd -h localhost -p <port> -D "cn=directory manager" -w xxx "uid=new_account0,dc=example,dc=com" -s Secret123
        ldapsearch -LLL -h localhost -p 31389 -D "cn=directory manager" -w password -b "uid=new_account0,dc=example,dc=com" userPassword
        ldapsearch -LLL -h localhost -p 31389 -D "cn=directory manager" -w password -b "uid=new_account1,dc=example,dc=com" userPassword
        ldapsearch -LLL -h localhost -p 31389 -D "cn=directory manager" -w password -b "uid=new_account2,dc=example,dc=com" userPassword
        # checks that userPassword was changed only on uid=new_account1,dc=example,dc=com
        ldappasswd -h localhost -p <port> -D "cn=directory manager" -w xxx "uid=new_account2,dc=example,dc=com" -s Secret123
        ldapsearch -LLL -h localhost -p 31389 -D "cn=directory manager" -w password -b "uid=new_account0,dc=example,dc=com" userPassword
        ldapsearch -LLL -h localhost -p 31389 -D "cn=directory manager" -w password -b "uid=new_account1,dc=example,dc=com" userPassword
        ldapsearch -LLL -h localhost -p 31389 -D "cn=directory manager" -w password -b "uid=new_account2,dc=example,dc=com" userPassword
        # checks that userPassword was changed only on uid=new_account1,dc=example,dc=com
---
 Makefile.in                        |  52 +++++++++-
 ldap/ldif/template-dse.ldif.in     |  11 +++
 ldap/servers/plugins/mapdn/mapdn.c | 194 +++++++++++++++++++++++++++++++++++++
 ldap/servers/slapd/passwd_extop.c  |  37 ++++---
 4 files changed, 274 insertions(+), 20 deletions(-)
 create mode 100644 ldap/servers/plugins/mapdn/mapdn.c

diff --git a/Makefile.in b/Makefile.in
index 0752ff1..a468af8 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -934,6 +934,15 @@ libwhoami_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
 	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
 	$(AM_CFLAGS) $(CFLAGS) $(libwhoami_plugin_la_LDFLAGS) \
 	$(LDFLAGS) -o $@
+libmapdn_plugin_la_DEPENDENCIES = libslapd.la $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1)
+am_libmapdn_plugin_la_OBJECTS =  \
+	ldap/servers/plugins/mapdn/libmapdn_plugin_la-mapdn.lo
+libmapdn_plugin_la_OBJECTS = $(am_libmapdn_plugin_la_OBJECTS)
+libmapdn_plugin_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \
+	$(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \
+	$(AM_CFLAGS) $(CFLAGS) $(libmapdn_plugin_la_LDFLAGS) \
+	$(LDFLAGS) -o $@
 PROGRAMS = $(bin_PROGRAMS) $(noinst_PROGRAMS) $(sbin_PROGRAMS)
 am_dbscan_bin_OBJECTS =  \
 	ldap/servers/slapd/tools/dbscan_bin-dbscan.$(OBJEXT)
@@ -1175,7 +1184,7 @@ SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \
 	$(libschemareload_plugin_la_SOURCES) $(libslapd_la_SOURCES) \
 	$(libstatechange_plugin_la_SOURCES) \
 	$(libsyntax_plugin_la_SOURCES) $(libusn_plugin_la_SOURCES) \
-	$(libviews_plugin_la_SOURCES) $(libwhoami_plugin_la_SOURCES) \
+	$(libviews_plugin_la_SOURCES) $(libwhoami_plugin_la_SOURCES) $(libmapdn_plugin_la_SOURCES) \
 	$(dbscan_bin_SOURCES) $(dsktune_bin_SOURCES) \
 	$(infadd_bin_SOURCES) $(ldap_agent_bin_SOURCES) \
 	$(ldclt_bin_SOURCES) $(ldif_bin_SOURCES) $(makstrdb_SOURCES) \
@@ -1211,7 +1220,7 @@ DIST_SOURCES = $(libavl_a_SOURCES) $(libldaputil_a_SOURCES) \
 	$(am__libslapd_la_SOURCES_DIST) \
 	$(libstatechange_plugin_la_SOURCES) \
 	$(libsyntax_plugin_la_SOURCES) $(libusn_plugin_la_SOURCES) \
-	$(libviews_plugin_la_SOURCES) $(libwhoami_plugin_la_SOURCES) \
+	$(libviews_plugin_la_SOURCES) $(libwhoami_plugin_la_SOURCES) $(libmapdn_plugin_la_SOURCES) \
 	$(dbscan_bin_SOURCES) $(dsktune_bin_SOURCES) \
 	$(infadd_bin_SOURCES) $(ldap_agent_bin_SOURCES) \
 	$(am__ldclt_bin_SOURCES_DIST) $(ldif_bin_SOURCES) \
@@ -1664,7 +1673,7 @@ serverplugin_LTLIBRARIES = libacl-plugin.la libattr-unique-plugin.la \
 	libroles-plugin.la libstatechange-plugin.la libsyntax-plugin.la \
 	libviews-plugin.la libschemareload-plugin.la libusn-plugin.la \
 	libacctusability-plugin.la librootdn-access-plugin.la \
-	libwhoami-plugin.la $(LIBACCTPOLICY_PLUGIN) \
+	libwhoami-plugin.la libmapdn-plugin.la $(LIBACCTPOLICY_PLUGIN) \
 	$(LIBPAM_PASSTHRU_PLUGIN) $(LIBDNA_PLUGIN) \
 	$(LIBBITWISE_PLUGIN) $(LIBPRESENCE_PLUGIN) $(LIBPOSIX_WINSYNC_PLUGIN)
 
@@ -2921,6 +2930,14 @@ libwhoami_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK)
 libwhoami_plugin_la_LDFLAGS = -avoid-version
 
 #------------------------
+# libmapdn-plugin
+#------------------------
+libmapdn_plugin_la_SOURCES = ldap/servers/plugins/mapdn/mapdn.c
+libmapdn_plugin_la_CPPFLAGS = $(PLUGIN_CPPFLAGS)
+libmapdn_plugin_la_LIBADD = libslapd.la $(LDAPSDK_LINK) $(NSPR_LINK)
+libmapdn_plugin_la_LDFLAGS = -avoid-version
+
+#------------------------
 #////////////////////////////////////////////////////////////////
 #
 #   Programs
@@ -4900,6 +4917,18 @@ ldap/servers/plugins/whoami/libwhoami_plugin_la-whoami.lo:  \
 
 libwhoami-plugin.la: $(libwhoami_plugin_la_OBJECTS) $(libwhoami_plugin_la_DEPENDENCIES) $(EXTRA_libwhoami_plugin_la_DEPENDENCIES) 
 	$(AM_V_CCLD)$(libwhoami_plugin_la_LINK) -rpath $(serverplugindir) $(libwhoami_plugin_la_OBJECTS) $(libwhoami_plugin_la_LIBADD) $(LIBS)
+ldap/servers/plugins/mapdn/$(am__dirstamp):
+	@$(MKDIR_P) ldap/servers/plugins/mapdn
+	@: > ldap/servers/plugins/mapdn/$(am__dirstamp)
+ldap/servers/plugins/mapdn/$(DEPDIR)/$(am__dirstamp):
+	@$(MKDIR_P) ldap/servers/plugins/mapdn/$(DEPDIR)
+	@: > ldap/servers/plugins/mapdn/$(DEPDIR)/$(am__dirstamp)
+ldap/servers/plugins/mapdn/libmapdn_plugin_la-mapdn.lo:  \
+	ldap/servers/plugins/mapdn/$(am__dirstamp) \
+	ldap/servers/plugins/mapdn/$(DEPDIR)/$(am__dirstamp)
+
+libmapdn-plugin.la: $(libmapdn_plugin_la_OBJECTS) $(libmapdn_plugin_la_DEPENDENCIES) $(EXTRA_libmapdn_plugin_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libmapdn_plugin_la_LINK) -rpath $(serverplugindir) $(libmapdn_plugin_la_OBJECTS) $(libmapdn_plugin_la_LIBADD) $(LIBS)
 install-binPROGRAMS: $(bin_PROGRAMS)
 	@$(NORMAL_INSTALL)
 	@list='$(bin_PROGRAMS)'; test -n "$(bindir)" || list=; \
@@ -5520,6 +5549,8 @@ mostlyclean-compile:
 	-rm -f ldap/servers/plugins/views/*.lo
 	-rm -f ldap/servers/plugins/whoami/*.$(OBJEXT)
 	-rm -f ldap/servers/plugins/whoami/*.lo
+	-rm -f ldap/servers/plugins/mapdn/*.$(OBJEXT)
+	-rm -f ldap/servers/plugins/mapdn/*.lo
 	-rm -f ldap/servers/slapd/*.$(OBJEXT)
 	-rm -f ldap/servers/slapd/*.lo
 	-rm -f ldap/servers/slapd/back-ldbm/*.$(OBJEXT)
@@ -5731,6 +5762,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/usn/$(DEPDIR)/libusn_plugin_la-usn_cleanup.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/views/$(DEPDIR)/libviews_plugin_la-views.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/whoami/$(DEPDIR)/libwhoami_plugin_la-whoami.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/plugins/mapdn/$(DEPDIR)/libmapdn_plugin_la-mapdn.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/slapd/$(DEPDIR)/ldap_agent_bin-agtmmap.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/slapd/$(DEPDIR)/libslapd_la-add.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@ldap/servers/slapd/$(DEPDIR)/libslapd_la-agtmmap.Plo@am__quote@
@@ -8669,6 +8701,13 @@ ldap/servers/plugins/whoami/libwhoami_plugin_la-whoami.lo: ldap/servers/plugins/
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libwhoami_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/whoami/libwhoami_plugin_la-whoami.lo `test -f 'ldap/servers/plugins/whoami/whoami.c' || echo '$(srcdir)/'`ldap/servers/plugins/whoami/whoami.c
 
+ldap/servers/plugins/mapdn/libmapdn_plugin_la-mapdn.lo: ldap/servers/plugins/mapdn/mapdn.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libmapdn_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/plugins/mapdn/libmapdn_plugin_la-mapdn.lo -MD -MP -MF ldap/servers/plugins/mapdn/$(DEPDIR)/libmapdn_plugin_la-mapdn.Tpo -c -o ldap/servers/plugins/mapdn/libmapdn_plugin_la-mapdn.lo `test -f 'ldap/servers/plugins/mapdn/mapdn.c' || echo '$(srcdir)/'`ldap/servers/plugins/mapdn/mapdn.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) ldap/servers/plugins/mapdn/$(DEPDIR)/libmapdn_plugin_la-mapdn.Tpo ldap/servers/plugins/mapdn/$(DEPDIR)/libmapdn_plugin_la-mapdn.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='ldap/servers/plugins/mapdn/mapdn.c' object='ldap/servers/plugins/mapdn/libmapdn_plugin_la-mapdn.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libmapdn_plugin_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ldap/servers/plugins/mapdn/libmapdn_plugin_la-mapdn.lo `test -f 'ldap/servers/plugins/mapdn/mapdn.c' || echo '$(srcdir)/'`ldap/servers/plugins/mapdn/mapdn.c
+
 ldap/servers/slapd/tools/dbscan_bin-dbscan.o: ldap/servers/slapd/tools/dbscan.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(dbscan_bin_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ldap/servers/slapd/tools/dbscan_bin-dbscan.o -MD -MP -MF ldap/servers/slapd/tools/$(DEPDIR)/dbscan_bin-dbscan.Tpo -c -o ldap/servers/slapd/tools/dbscan_bin-dbscan.o `test -f 'ldap/servers/slapd/tools/dbscan.c' || echo '$(srcdir)/'`ldap/servers/slapd/tools/dbscan.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) ldap/servers/slapd/tools/$(DEPDIR)/dbscan_bin-dbscan.Tpo ldap/servers/slapd/tools/$(DEPDIR)/dbscan_bin-dbscan.Po
@@ -9846,6 +9885,7 @@ clean-libtool:
 	-rm -rf ldap/servers/plugins/usn/.libs ldap/servers/plugins/usn/_libs
 	-rm -rf ldap/servers/plugins/views/.libs ldap/servers/plugins/views/_libs
 	-rm -rf ldap/servers/plugins/whoami/.libs ldap/servers/plugins/whoami/_libs
+	-rm -rf ldap/servers/plugins/mapdn/.libs ldap/servers/plugins/mapdn/_libs
 	-rm -rf ldap/servers/slapd/.libs ldap/servers/slapd/_libs
 	-rm -rf ldap/servers/slapd/back-ldbm/.libs ldap/servers/slapd/back-ldbm/_libs
 	-rm -rf lib/base/.libs lib/base/_libs
@@ -10558,6 +10598,8 @@ distclean-generic:
 	-rm -f ldap/servers/plugins/views/$(am__dirstamp)
 	-rm -f ldap/servers/plugins/whoami/$(DEPDIR)/$(am__dirstamp)
 	-rm -f ldap/servers/plugins/whoami/$(am__dirstamp)
+	-rm -f ldap/servers/plugins/mapdn/$(DEPDIR)/$(am__dirstamp)
+	-rm -f ldap/servers/plugins/mapdn/$(am__dirstamp)
 	-rm -f ldap/servers/slapd/$(DEPDIR)/$(am__dirstamp)
 	-rm -f ldap/servers/slapd/$(am__dirstamp)
 	-rm -f ldap/servers/slapd/back-ldbm/$(DEPDIR)/$(am__dirstamp)
@@ -10596,7 +10638,7 @@ clean-am: clean-binPROGRAMS clean-generic clean-libtool clean-local \
 
 distclean: distclean-am
 	-rm -f $(am__CONFIG_DISTCLEAN_FILES)
-	-rm -rf ldap/libraries/libavl/$(DEPDIR) ldap/servers/plugins/acct_usability/$(DEPDIR) ldap/servers/plugins/acctpolicy/$(DEPDIR) ldap/servers/plugins/acl/$(DEPDIR) ldap/servers/plugins/automember/$(DEPDIR) ldap/servers/plugins/bitwise/$(DEPDIR) ldap/servers/plugins/chainingdb/$(DEPDIR) ldap/servers/plugins/collation/$(DEPDIR) ldap/servers/plugins/cos/$(DEPDIR) ldap/servers/plugins/deref/$(DEPDIR) ldap/servers/plugins/distrib/$(DEPDIR) ldap/servers/plugins/dna/$(DEPDIR) ldap/servers/plugins/http/$(DEPDIR) ldap/servers/plugins/linkedattrs/$(DEPDIR) ldap/servers/plugins/memberof/$(DEPDIR) ldap/servers/plugins/mep/$(DEPDIR) ldap/servers/plugins/pam_passthru/$(DEPDIR) ldap/servers/plugins/passthru/$(DEPDIR) ldap/servers/plugins/posix-winsync/$(DEPDIR) ldap/servers/plugins/presence/$(DEPDIR) ldap/servers/plugins/pwdstorage/$(DEPDIR) ldap/servers/plugins/referint/$(DEPDIR) ldap/servers/plugins/replication/$(DEPDIR) ldap/servers/plugins/retrocl/$(DEPDIR) ldap/servers/plugins/rever/$(DEPDIR) ldap/servers/plugins/roles/$(DEPDIR) ldap/servers/plugins/rootdn_access/$(DEPDIR) ldap/servers/plugins/schema_reload/$(DEPDIR) ldap/servers/plugins/statechange/$(DEPDIR) ldap/servers/plugins/sync/$(DEPDIR) ldap/servers/plugins/syntaxes/$(DEPDIR) ldap/servers/plugins/uiduniq/$(DEPDIR) ldap/servers/plugins/usn/$(DEPDIR) ldap/servers/plugins/views/$(DEPDIR) ldap/servers/plugins/whoami/$(DEPDIR) ldap/servers/slapd/$(DEPDIR) ldap/servers/slapd/back-ldbm/$(DEPDIR) ldap/servers/slapd/tools/$(DEPDIR) ldap/servers/slapd/tools/ldclt/$(DEPDIR) ldap/servers/slapd/tools/rsearch/$(DEPDIR) ldap/servers/snmp/$(DEPDIR) ldap/systools/$(DEPDIR) lib/base/$(DEPDIR) lib/ldaputil/$(DEPDIR) lib/libaccess/$(DEPDIR) lib/libadmin/$(DEPDIR) lib/libsi18n/$(DEPDIR)
+	-rm -rf ldap/libraries/libavl/$(DEPDIR) ldap/servers/plugins/acct_usability/$(DEPDIR) ldap/servers/plugins/acctpolicy/$(DEPDIR) ldap/servers/plugins/acl/$(DEPDIR) ldap/servers/plugins/automember/$(DEPDIR) ldap/servers/plugins/bitwise/$(DEPDIR) ldap/servers/plugins/chainingdb/$(DEPDIR) ldap/servers/plugins/collation/$(DEPDIR) ldap/servers/plugins/cos/$(DEPDIR) ldap/servers/plugins/deref/$(DEPDIR) ldap/servers/plugins/distrib/$(DEPDIR) ldap/servers/plugins/dna/$(DEPDIR) ldap/servers/plugins/http/$(DEPDIR) ldap/servers/plugins/linkedattrs/$(DEPDIR) ldap/servers/plugins/memberof/$(DEPDIR) ldap/servers/plugins/mep/$(DEPDIR) ldap/servers/plugins/pam_passthru/$(DEPDIR) ldap/servers/plugins/passthru/$(DEPDIR) ldap/servers/plugins/posix-winsync/$(DEPDIR) ldap/servers/plugins/presence/$(DEPDIR) ldap/servers/plugins/pwdstorage/$(DEPDIR) ldap/servers/plugins/referint/$(DEPDIR) ldap/servers/plugins/replication/$(DEPDIR) ldap/servers/plugins/retrocl/$(DEPDIR) ldap/servers/plugins/rever/$(DEPDIR) ldap/servers/plugins/roles/$(DEPDIR) ldap/servers/plugins/rootdn_access/$(DEPDIR) ldap/servers/plugins/schema_reload/$(DEPDIR) ldap/servers/plugins/statechange/$(DEPDIR) ldap/servers/plugins/sync/$(DEPDIR) ldap/servers/plugins/syntaxes/$(DEPDIR) ldap/servers/plugins/uiduniq/$(DEPDIR) ldap/servers/plugins/usn/$(DEPDIR) ldap/servers/plugins/views/$(DEPDIR) ldap/servers/plugins/whoami/$(DEPDIR) ldap/servers/plugins/mapdn/$(DEPDIR) ldap/servers/slapd/$(DEPDIR) ldap/servers/slapd/back-ldbm/$(DEPDIR) ldap/servers/slapd/tools/$(DEPDIR) ldap/servers/slapd/tools/ldclt/$(DEPDIR) ldap/servers/slapd/tools/rsearch/$(DEPDIR) ldap/servers/snmp/$(DEPDIR) ldap/systools/$(DEPDIR) lib/base/$(DEPDIR) lib/ldaputil/$(DEPDIR) lib/libaccess/$(DEPDIR) lib/libadmin/$(DEPDIR) lib/libsi18n/$(DEPDIR)
 	-rm -f Makefile
 distclean-am: clean-am distclean-compile distclean-generic \
 	distclean-hdr distclean-libtool distclean-tags
@@ -10652,7 +10694,7 @@ installcheck-am:
 maintainer-clean: maintainer-clean-am
 	-rm -f $(am__CONFIG_DISTCLEAN_FILES)
 	-rm -rf $(top_srcdir)/autom4te.cache
-	-rm -rf ldap/libraries/libavl/$(DEPDIR) ldap/servers/plugins/acct_usability/$(DEPDIR) ldap/servers/plugins/acctpolicy/$(DEPDIR) ldap/servers/plugins/acl/$(DEPDIR) ldap/servers/plugins/automember/$(DEPDIR) ldap/servers/plugins/bitwise/$(DEPDIR) ldap/servers/plugins/chainingdb/$(DEPDIR) ldap/servers/plugins/collation/$(DEPDIR) ldap/servers/plugins/cos/$(DEPDIR) ldap/servers/plugins/deref/$(DEPDIR) ldap/servers/plugins/distrib/$(DEPDIR) ldap/servers/plugins/dna/$(DEPDIR) ldap/servers/plugins/http/$(DEPDIR) ldap/servers/plugins/linkedattrs/$(DEPDIR) ldap/servers/plugins/memberof/$(DEPDIR) ldap/servers/plugins/mep/$(DEPDIR) ldap/servers/plugins/pam_passthru/$(DEPDIR) ldap/servers/plugins/passthru/$(DEPDIR) ldap/servers/plugins/posix-winsync/$(DEPDIR) ldap/servers/plugins/presence/$(DEPDIR) ldap/servers/plugins/pwdstorage/$(DEPDIR) ldap/servers/plugins/referint/$(DEPDIR) ldap/servers/plugins/replication/$(DEPDIR) ldap/servers/plugins/retrocl/$(DEPDIR) ldap/servers/plugins/rever/$(DEPDIR) ldap/servers/plugins/roles/$(DEPDIR) ldap/servers/plugins/rootdn_access/$(DEPDIR) ldap/servers/plugins/schema_reload/$(DEPDIR) ldap/servers/plugins/statechange/$(DEPDIR) ldap/servers/plugins/sync/$(DEPDIR) ldap/servers/plugins/syntaxes/$(DEPDIR) ldap/servers/plugins/uiduniq/$(DEPDIR) ldap/servers/plugins/usn/$(DEPDIR) ldap/servers/plugins/views/$(DEPDIR) ldap/servers/plugins/whoami/$(DEPDIR) ldap/servers/slapd/$(DEPDIR) ldap/servers/slapd/back-ldbm/$(DEPDIR) ldap/servers/slapd/tools/$(DEPDIR) ldap/servers/slapd/tools/ldclt/$(DEPDIR) ldap/servers/slapd/tools/rsearch/$(DEPDIR) ldap/servers/snmp/$(DEPDIR) ldap/systools/$(DEPDIR) lib/base/$(DEPDIR) lib/ldaputil/$(DEPDIR) lib/libaccess/$(DEPDIR) lib/libadmin/$(DEPDIR) lib/libsi18n/$(DEPDIR)
+	-rm -rf ldap/libraries/libavl/$(DEPDIR) ldap/servers/plugins/acct_usability/$(DEPDIR) ldap/servers/plugins/acctpolicy/$(DEPDIR) ldap/servers/plugins/acl/$(DEPDIR) ldap/servers/plugins/automember/$(DEPDIR) ldap/servers/plugins/bitwise/$(DEPDIR) ldap/servers/plugins/chainingdb/$(DEPDIR) ldap/servers/plugins/collation/$(DEPDIR) ldap/servers/plugins/cos/$(DEPDIR) ldap/servers/plugins/deref/$(DEPDIR) ldap/servers/plugins/distrib/$(DEPDIR) ldap/servers/plugins/dna/$(DEPDIR) ldap/servers/plugins/http/$(DEPDIR) ldap/servers/plugins/linkedattrs/$(DEPDIR) ldap/servers/plugins/memberof/$(DEPDIR) ldap/servers/plugins/mep/$(DEPDIR) ldap/servers/plugins/pam_passthru/$(DEPDIR) ldap/servers/plugins/passthru/$(DEPDIR) ldap/servers/plugins/posix-winsync/$(DEPDIR) ldap/servers/plugins/presence/$(DEPDIR) ldap/servers/plugins/pwdstorage/$(DEPDIR) ldap/servers/plugins/referint/$(DEPDIR) ldap/servers/plugins/replication/$(DEPDIR) ldap/servers/plugins/retrocl/$(DEPDIR) ldap/servers/plugins/rever/$(DEPDIR) ldap/servers/plugins/roles/$(DEPDIR) ldap/servers/plugins/rootdn_access/$(DEPDIR) ldap/servers/plugins/schema_reload/$(DEPDIR) ldap/servers/plugins/statechange/$(DEPDIR) ldap/servers/plugins/sync/$(DEPDIR) ldap/servers/plugins/syntaxes/$(DEPDIR) ldap/servers/plugins/uiduniq/$(DEPDIR) ldap/servers/plugins/usn/$(DEPDIR) ldap/servers/plugins/views/$(DEPDIR) ldap/servers/plugins/whoami/$(DEPDIR) ldap/servers/plugins/mapdn/$(DEPDIR) ldap/servers/slapd/$(DEPDIR) ldap/servers/slapd/back-ldbm/$(DEPDIR) ldap/servers/slapd/tools/$(DEPDIR) ldap/servers/slapd/tools/ldclt/$(DEPDIR) ldap/servers/slapd/tools/rsearch/$(DEPDIR) ldap/servers/snmp/$(DEPDIR) ldap/systools/$(DEPDIR) lib/base/$(DEPDIR) lib/ldaputil/$(DEPDIR) lib/libaccess/$(DEPDIR) lib/libadmin/$(DEPDIR) lib/libsi18n/$(DEPDIR)
 	-rm -f Makefile
 maintainer-clean-am: distclean-am maintainer-clean-generic
 
diff --git a/ldap/ldif/template-dse.ldif.in b/ldap/ldif/template-dse.ldif.in
index f18c082..91f525b 100644
--- a/ldap/ldif/template-dse.ldif.in
+++ b/ldap/ldif/template-dse.ldif.in
@@ -756,6 +756,17 @@ nsslapd-plugintype: betxnpreoperation
 nsslapd-pluginenabled: on
 nsslapd-plugin-depends-on-type: database
 
+dn: cn=Mapdn,cn=plugins,cn=config
+objectclass: top
+objectclass: nsSlapdPlugin
+objectclass: extensibleObject
+cn: Mapdn
+nsslapd-pluginpath: libmapdn-plugin
+nsslapd-plugininitfunc: mapdn_init
+nsslapd-plugintype: preextendedop
+nsslapd-pluginenabled: on
+nsslapd-plugin-depends-on-type: database
+
 dn: cn=Pass Through Authentication,cn=plugins,cn=config
 objectclass: top
 objectclass: nsSlapdPlugin
diff --git a/ldap/servers/plugins/mapdn/mapdn.c b/ldap/servers/plugins/mapdn/mapdn.c
new file mode 100644
index 0000000..70b0485
--- /dev/null
+++ b/ldap/servers/plugins/mapdn/mapdn.c
@@ -0,0 +1,194 @@
+/** BEGIN COPYRIGHT BLOCK
+ * Copyright (C) 2013 Red Hat, Inc.
+ * All rights reserved.
+ *
+ * License: GPL (version 3 or any later version).
+ * See LICENSE for details. 
+ * END COPYRIGHT BLOCK **/
+
+#ifdef HAVE_CONFIG_H
+#  include <config.h>
+#endif
+
+/**
+ * LDAP mapdn extended operation plug-in
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include "slapi-plugin.h"
+#include "slap.h"
+
+/* ber tags for the PasswdModifyRequestValue sequence */
+#define LDAP_EXTOP_PASSMOD_TAG_USERID	0x80U
+
+#define PLUGIN_NAME              "mapdn-plugin"
+#define PLUGIN_DESC              "mapdn extended operation plugin"
+
+static Slapi_PluginDesc expdesc = { PLUGIN_NAME, VENDOR, DS_PACKAGE_VERSION, PLUGIN_DESC };
+
+
+int mapdn_init( Slapi_PBlock *pb );
+int mapdn_exop( Slapi_PBlock *pb );
+
+/* Extended operation function */
+
+int mapdn_pre_extop( Slapi_PBlock *pb )
+{
+	struct berval retbval;
+        struct berval	*extop_value = NULL;
+        BerElement	*ber = NULL;
+	ber_tag_t	tag = 0;
+        ber_len_t	len = (ber_len_t) -1;
+        char		*rawdn = NULL;
+        char		*errMesg = NULL;
+        Slapi_DN	*target_sdn = NULL;
+        const char      *dn;
+        char            *head;
+        char            *pt;
+
+	char *client_dn = NULL;
+	char *fdn = NULL;
+	char *oid = NULL;
+	/* Get the OID and the value included in the request */
+	if ( slapi_pblock_get( pb, SLAPI_EXT_OP_REQ_OID, &oid ) != 0 )
+   	{
+		slapi_log_error( SLAPI_LOG_FATAL, PLUGIN_NAME, "Could not get OID from request\n" );
+		slapi_send_ldap_result( pb, LDAP_OPERATIONS_ERROR, NULL, "Could not get OID from request\n", 0, NULL );
+		return( SLAPI_PLUGIN_EXTENDED_SENT_RESULT );
+	} 
+	
+        if (strcmp( oid, EXTOP_PASSWD_OID ) != 0 ) {
+		slapi_log_error( SLAPI_LOG_FATAL, "mapdn_pre_extop", 
+				 "OID is missing or is not %s\n", EXTOP_PASSWD_OID );
+		return(SLAPI_PLUGIN_SUCCESS);
+	} else {
+		slapi_log_error( SLAPI_LOG_FATAL, "mapdn_pre_extop", 
+				 "This is the OID %s\n", EXTOP_PASSWD_OID);
+	}
+        
+        /* Get the ber value of the extended operation */
+	slapi_pblock_get(pb, SLAPI_EXT_OP_REQ_VALUE, &extop_value);
+        slapi_pblock_get(pb, SLAPI_TARGET_SDN, &target_sdn);
+        
+        dn = slapi_sdn_get_ndn(target_sdn);
+        slapi_log_error( SLAPI_LOG_FATAL, "mapdn_pre_extop", 
+				 "SLAPI_TARGET_SDN is %s\n", dn ? dn : "<empty>");
+        
+
+
+	if (!BV_HAS_DATA(extop_value))
+	{
+		/* The request field wasn't provided.  We'll
+		 * now try to determine the userid and verify
+		 * knowledge of the old password via other
+		 * means.
+		 */
+		goto parse_req_done;
+	}
+
+        if ((ber = ber_init(extop_value)) == NULL)
+	{
+		errMesg = "Request decode failed.\n";
+		goto free_and_return;
+	}
+        
+        	/* Format of request to parse
+	 *
+   	 * PasswdModifyRequestValue ::= SEQUENCE {
+     	 * userIdentity    [0]  OCTET STRING OPTIONAL
+     	 * oldPasswd       [1]  OCTET STRING OPTIONAL
+     	 * newPasswd       [2]  OCTET STRING OPTIONAL }
+	 *
+	 * The request value field is optional. If it is
+	 * provided, at least one field must be filled in.
+	 */
+
+	/* ber parse code */
+	if ( ber_scanf( ber, "{") == LBER_ERROR )
+    	{
+		/* The request field wasn't provided.  We'll
+		 * now try to determine the userid and verify
+		 * knowledge of the old password via other
+		 * means.
+		 */
+		goto parse_req_done;
+    	} else {
+		tag = ber_peek_tag( ber, &len);
+	}
+
+	
+	/* identify userID field by tags */
+	if (tag == LDAP_EXTOP_PASSMOD_TAG_USERID )
+	{
+		if ( ber_scanf( ber, "a", &rawdn) == LBER_ERROR ) {
+			slapi_ch_free_string(&rawdn);
+			errMesg = "ber_scanf failed at userID parse.\n";
+			goto free_and_return;
+		}
+
+                slapi_log_error( SLAPI_LOG_FATAL, "mapdn_preextop",
+		"rawdn = %s\n", rawdn ? rawdn : "<unknown>" );
+                
+                if (rawdn && *rawdn != '\0') {
+                    head = "uid=new_account";
+                    if (pt = strstr(rawdn, head)) {
+                        pt[strlen(head)] = '1';
+                    }
+                    slapi_sdn_free(&target_sdn);
+                    target_sdn = slapi_sdn_new_dn_passin(rawdn);
+                    slapi_log_error(SLAPI_LOG_FATAL, "mapdn_pre_extop",
+                            "SLAPI_TARGET_SDN is now %s\n", rawdn);
+                    slapi_pblock_set(pb, SLAPI_TARGET_SDN, target_sdn);
+                }
+
+	} 
+        
+parse_req_done:
+        
+	if( client_dn == NULL )
+	{
+		retbval.bv_val = NULL;
+        	retbval.bv_len = 0;
+	}
+	else
+	{
+		fdn = slapi_ch_smprintf( "dn: %s", client_dn );
+		retbval.bv_val = fdn;
+		retbval.bv_len = strlen( retbval.bv_val );
+	}
+
+free_and_return:
+        slapi_log_error( SLAPI_LOG_FATAL, "mapdn_preextop",
+		"%s", errMesg ? errMesg : "success" );
+
+	/* Free any memory allocated by this plug-in. */ 
+	
+	slapi_ch_free_string( &client_dn );
+	slapi_ch_free_string( &fdn );
+        
+        if ( ber != NULL ){
+		ber_free(ber, 1);
+		ber = NULL;
+	}
+	return( SLAPI_PLUGIN_SUCCESS );
+}
+
+/* Initialization function */
+
+int mapdn_init( Slapi_PBlock *pb )
+{
+
+	/* Register the plugin function as an extended operation plugin function */
+
+	if ( slapi_pblock_set( pb, SLAPI_PLUGIN_VERSION, SLAPI_PLUGIN_VERSION_03 ) != 0 ||
+			slapi_pblock_set( pb, SLAPI_PLUGIN_DESCRIPTION, ( void * )&expdesc ) != 0 ||
+			slapi_pblock_set( pb, SLAPI_PLUGIN_PRE_EXTOP_FN, ( void * )mapdn_pre_extop ) != 0)
+	{
+		slapi_log_error( SLAPI_LOG_FATAL, PLUGIN_NAME, "mapdn_init: Failed to register plug-in.\n" );
+		return( -1 );
+	}
+
+	return( 0 );
+}
+
diff --git a/ldap/servers/slapd/passwd_extop.c b/ldap/servers/slapd/passwd_extop.c
index ad5b8da..8972a2b 100644
--- a/ldap/servers/slapd/passwd_extop.c
+++ b/ldap/servers/slapd/passwd_extop.c
@@ -472,7 +472,7 @@ passwd_modify_extop( Slapi_PBlock *pb )
 	
 	/* Now , at least we know that the request was indeed a Password Modify one. */
 
-#ifdef LDAP_EXTOP_PASSMOD_CONN_SECURE
+#ifdef LDAP_EXTOP_PASSMOD_CONN_SECURE_XXX
 	/* Allow password modify only for SSL/TLS established connections and
 	 * connections using SASL privacy layers */
 	conn = pb->pb_conn;
@@ -613,20 +613,27 @@ parse_req_done:
 		goto free_and_return;
 	}
 
-	/* Find and set the target DN. */
-	if (rawdn && *rawdn != '\0') {
-	    target_sdn = slapi_sdn_new_dn_passin(rawdn);
-	} else { /* We already checked (bindDN && *bindDN != '\0') above  */
-	    target_sdn = bindSDN = slapi_sdn_new_normdn_byref(bindDN);
-	}
-	dn = slapi_sdn_get_ndn(target_sdn);
-	if (dn == NULL || *dn == '\0') {
-		/* Refuse the operation because they're bound anonymously */
-		errMesg = "Invalid dn.\n";
-		rc = LDAP_INVALID_DN_SYNTAX;
-		goto free_and_return;
-	}
-	slapi_pblock_set(pb, SLAPI_TARGET_SDN, target_sdn);
+        slapi_pblock_get(pb, SLAPI_TARGET_SDN, &target_sdn);
+        dn = slapi_sdn_get_ndn(target_sdn);
+        if (dn) {
+            slapi_log_error( SLAPI_LOG_FATAL, "passwd_extop", 
+				 "SLAPI_TARGET_SDN already set %s (by a pre-extop)\n", dn);
+        } else {
+            /* Find and set the target DN. */
+            if (rawdn && *rawdn != '\0') {
+                target_sdn = slapi_sdn_new_dn_passin(rawdn);
+            } else { /* We already checked (bindDN && *bindDN != '\0') above  */
+                target_sdn = bindSDN = slapi_sdn_new_normdn_byref(bindDN);
+            }
+            dn = slapi_sdn_get_ndn(target_sdn);
+            if (dn == NULL || *dn == '\0') {
+                    /* Refuse the operation because they're bound anonymously */
+                    errMesg = "Invalid dn.\n";
+                    rc = LDAP_INVALID_DN_SYNTAX;
+                    goto free_and_return;
+            }
+            slapi_pblock_set(pb, SLAPI_TARGET_SDN, target_sdn);
+        }
 
 	/* Check if we need to send any referrals. */
 	if (slapi_dn_write_needs_referral(target_sdn, &referrals)) {
-- 
2.5.0

