text: /* rbacsess.c - RBAC session */
  /* $OpenLDAP$ */
  /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   *
   *
   * All rights reserved.
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted only as authorized by the OpenLDAP
   * Public License.
   *
   * A copy of this license is available in the file LICENSE in the
   * top-level directory of the distribution or, alternatively, at
   * <http://www.OpenLDAP.org/license.html>.
   */
  /* ACKNOWLEDGEMENTS:
   */
  
  #include "portable.h"
  
  #include <stdio.h>
  
  #include <ac/string.h>
  
  #include "slap.h"
  #include "slap-config.h"
  #include "lutil.h"
  
  #include "rbac.h"
  
  static slap_callback nullsc = { NULL, NULL, NULL, NULL };
  
  extern rbac_ad_t rbac_session_permission_ads[];
  extern rbac_ad_t rbac_session_ads[];
  
  struct berval slapo_session_oc = BER_BVC("rbacSession");
  
  typedef struct session_perm_req {
  	Operation *op;
  	SlapReply *rs;
  	struct berval *sessid;
  	struct berval permdn;
  	tenant_info_t *tenantp;
  } session_perm_req_t;
  
  static int
  rbac_sess_fake_cb( Operation *op, SlapReply *rs )
  {
  	Debug( LDAP_DEBUG_ANY, "rbac_sess_fake_cb\n" );
  
  	return 0;
  }
  
  static int
  rbac_send_session_permission(
  		session_perm_req_t *sess_perm_reqp,
  		rbac_permission_t *perm )
  {
  	int i, rc = LDAP_SUCCESS;
  	Operation *op = sess_perm_reqp->op;
  	SlapReply *rs = sess_perm_reqp->rs;
  	struct berval *sessidp = sess_perm_reqp->sessid;
  	struct berval *permdnp = &sess_perm_reqp->permdn;
  
  	Entry *e = entry_alloc();
  	e->e_attrs = NULL;
  	ber_dupbv( &e->e_name, permdnp );
  	ber_dupbv( &e->e_nname, permdnp );
  	e->e_private = NULL;
  	attr_merge_one( e, slap_rbac_schema.ad_session_id, sessidp, NULL );
  
  	for ( i = 0; !BER_BVISNULL( &rbac_session_permission_ads[i].attr ); i++ ) {
  		switch ( rbac_session_permission_ads[i].type ) {
  			case RBAC_OP_NAME:
  				attr_merge_one( e, *rbac_session_permission_ads[i].ad,
  						&perm->opName[0], NULL );
  				break;
  			case RBAC_OBJ_NAME:
  				attr_merge_one( e, *rbac_session_permission_ads[i].ad,
  						&perm->objName[0], NULL );
  				break;
  			case RBAC_ROLE_NAME:
  				attr_merge( e, *rbac_session_permission_ads[i].ad, perm->roles,
  						NULL );
  				break;
  			default:
  				break;
  		}
  	}
  
  	rs->sr_entry = e;
  	rs->sr_flags = REP_ENTRY_MUSTRELEASE;
  	rc = send_search_entry( op, rs );
  
  	return rc;
  }
  
  static int
  rbac_session_permissions_cb( Operation *op, SlapReply *rs )
  {
  	session_perm_req_t *sess_perm_reqp = op->o_callback->sc_private;
  	tenant_info_t *tenantp = NULL;
  	rbac_permission_t *permp = NULL;
  	rbac_ad_t *session_permissions_ads;
  	int i;
  
  	if ( rs->sr_type != REP_SEARCH ) return 0;
  
  	assert( sess_perm_reqp );
  
  	tenantp = sess_perm_reqp->tenantp;
  	session_permissions_ads = tenantp->schema->session_permissions_ads;
  
  	permp = ch_calloc( 1, sizeof(rbac_permission_t) );
  
  	for ( i = 0; !BER_BVISNULL( &session_permissions_ads[i].attr ); i++ ) {
  		Attribute *attr = NULL;
  
  		attr = attr_find(
  				rs->sr_entry->e_attrs, *session_permissions_ads[i].ad );
  		if ( attr != NULL ) {
  			switch ( session_permissions_ads[i].type ) {
  				case RBAC_USERS:
  					ber_bvarray_dup_x( &permp->uids, attr->a_nvals, NULL );
  					break;
  				case RBAC_ROLES:
  					ber_bvarray_dup_x( &permp->roles, attr->a_nvals, NULL );
  					break;
  				case RBAC_OBJ_NAME:
  					ber_bvarray_dup_x( &permp->objName, attr->a_nvals, NULL );
  					break;
  				case RBAC_OP_NAME:
  					ber_bvarray_dup_x( &permp->opName, attr->a_nvals, NULL );
  					break;
  			}
  		}
  	}
  
  	rbac_send_session_permission( sess_perm_reqp, permp );
  	rbac_free_permission( permp );
  	permp = NULL;
  
  	return SLAP_CB_CONTINUE;
  }
  
  static int
  rbac_read_session_cb( Operation *op, SlapReply *rs )
  {
  	rbac_session_t *sessp = op->o_callback->sc_private;
  	int i;
  
  	if ( rs->sr_type != REP_SEARCH ) return 0;
  
  	ber_dupbv( &sessp->sessdn, &rs->sr_entry->e_name );
  
  	for ( i = 0; !BER_BVISNULL( &rbac_session_ads[i].attr ); i++ ) {
  		Attribute *attr = NULL;
  		attr = attr_find( rs->sr_entry->e_attrs, *rbac_session_ads[i].ad );
  		if ( attr != NULL ) {
  			switch ( rbac_session_ads[i].type ) {
  				case RBAC_SESSION_ID:
  					ber_dupbv( &sessp->sessid, &attr->a_vals[0] );
  					break;
  				case RBAC_USER_DN:
  					ber_dupbv( &sessp->userdn, &attr->a_vals[0] );
  					break;
  				case RBAC_ROLES:
  					ber_bvarray_dup_x( &sessp->roles, attr->a_nvals, NULL );
  					break;
  				case RBAC_ROLE_CONSTRAINTS:
  					ber_bvarray_dup_x(
  							&sessp->role_constraints, attr->a_nvals, NULL );
  					break;
  				case RBAC_UID:
  					ber_dupbv( &sessp->uid, &attr->a_vals[0] );
  					break;
  				case RBAC_TENANT_ID:
  					ber_dupbv( &sessp->tenantid, &attr->a_vals[0] );
  					break;
  				default:
  					break;
  			}
  		}
  	}
  
  	//return SLAP_CB_CONTINUE;
  	return 0;
  }
  
  /* check whether the session is owned by the user */
  int
  rbac_is_session_owner( rbac_session_t *sessp, rbac_req_t *reqp )
  {
  	int rc = 0;
  
  	if ( BER_BVISEMPTY( &sessp->uid ) || BER_BVISEMPTY( &reqp->uid ) ) {
  		Debug( LDAP_DEBUG_ANY, "session not owned by user\n" );
  		rc = 0;
  		goto done;
  	}
  
  	if ( !ber_bvstrcasecmp( &sessp->uid, &reqp->uid ) ) {
  		rc = 1;
  		goto done;
  	}
  
  done:;
  	return rc;
  }
  
  int
  rbac_session_add_role( Operation *op, rbac_session_t *sessp, rbac_req_t *reqp )
  {
  	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
  	slap_callback cb = { 0 };
  	SlapReply rs2 = { REP_RESULT };
  	Operation op2 = *op;
  	rbac_callback_info_t rbac_cb;
  	tenant_info_t *tenantp = NULL;
  	struct berval vals[2];
  	Modifications mod;
  	int rc = LDAP_SUCCESS;
  
  	tenantp = rbac_tid2tenant( &reqp->tenantid );
  	if ( !tenantp ) {
  		Debug( LDAP_DEBUG_ANY, "rbac_session_add_role: "
  				"no tenant info with the req\n" );
  		goto done;
  	}
  
  	// convert the role name to lower case:
  	rbac_to_lower( &reqp->role );
  
  	//ber_dupbv( &vals[0], &reqp->roles[0]);
  	ber_dupbv( &vals[0], &reqp->role );
  	BER_BVZERO( &vals[1] );
  
  	/* create mod list */
  	mod.sml_op = LDAP_MOD_ADD;
  	mod.sml_flags = 0;
  	mod.sml_type = slap_rbac_schema.ad_session_roles->ad_cname;
  	mod.sml_desc = slap_rbac_schema.ad_session_roles;
  	mod.sml_numvals = 1;
  	mod.sml_values = vals;
  	mod.sml_nvalues = NULL;
  	mod.sml_next = NULL;
  
  	cb.sc_private = &rbac_cb;
  	cb.sc_response = rbac_sess_fake_cb;
  	op2.o_callback = &cb;
  
  	op2.o_tag = LDAP_REQ_MODIFY;
  	op2.orm_modlist = &mod;
  	op2.o_req_dn = sessp->sessdn;
  	op2.o_req_ndn = sessp->sessdn;
  	op2.o_bd = select_backend( &op2.o_req_ndn, 0 );
  	op2.o_dn = op2.o_bd->be_rootdn;
  	op2.o_ndn = op2.o_bd->be_rootdn;
  	op2.ors_limit = NULL;
  	rc = op2.o_bd->be_modify( &op2, &rs2 );
  	ch_free( vals[0].bv_val );
  
  done:;
  	if ( rc == LDAP_TYPE_OR_VALUE_EXISTS ) {
  		Debug( LDAP_DEBUG_ANY, "rbac_add_active_role: "
  				"role already activated in session\n" );
  	}
  	return rc;
  }
  
  int
  rbac_session_drop_role( Operation *op, rbac_session_t *sessp, rbac_req_t *reqp )
  {
  	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
  	slap_callback cb = { 0 };
  	SlapReply rs2 = { REP_RESULT };
  	Operation op2 = *op;
  	rbac_callback_info_t rbac_cb;
  	tenant_info_t *tenantp = NULL;
  	Modifications *m = NULL;
  	int rc = LDAP_SUCCESS;
  
  	tenantp = rbac_tid2tenant( &reqp->tenantid );
  	if ( !tenantp ) {
  		Debug( LDAP_DEBUG_ANY, "rbac_session_drop_role: "
  				"no tenant info with the req\n" );
  		goto done;
  	}
  
  	/* create mod list */
  	m = ch_calloc( sizeof(Modifications), 1 );
  	m->sml_op = LDAP_MOD_DELETE;
  	m->sml_flags = 0;
  	m->sml_type = slap_rbac_schema.ad_session_roles->ad_cname;
  	m->sml_desc = slap_rbac_schema.ad_session_roles;
  	m->sml_numvals = 1;
  	m->sml_values = ch_calloc( sizeof(struct berval), 2 );
  	m->sml_nvalues = ch_calloc( sizeof(struct berval), 2 );
  	//ber_dupbv( &m->sml_values[0], &reqp->roles[0]);
  
  	// convert the role name to lower case:
  	rbac_to_lower( &reqp->role );
  
  	ber_dupbv( &m->sml_values[0], &reqp->role );
  
  	// todo: determine if this needs to be done:
  	//BER_BVZERO(&m->sml_values[1]);
  
  	ber_dupbv( &m->sml_nvalues[0], &reqp->role );
  	BER_BVZERO( &m->sml_nvalues[1] );
  
  	//ber_dupbv( &m->sml_nvalues[0], &reqp->roles[0]);
  	//ber_dupbv( &m->sml_nvalues[0], &reqp->role);
  	//BER_BVZERO(&m->sml_nvalues[1]);
  
  	m->sml_next = NULL;
  
  	cb.sc_private = &rbac_cb;
  	cb.sc_response = rbac_sess_fake_cb;
  	op2.o_callback = &cb;
  
  	op2.o_dn = tenantp->session_admin;
  	op2.o_ndn = tenantp->session_admin;
  	op2.o_tag = LDAP_REQ_MODIFY;
  	op2.orm_modlist = m;
  	op2.o_req_dn = sessp->sessdn;
  	op2.o_req_ndn = sessp->sessdn;
  	op2.o_bd = select_backend( &op2.o_req_ndn, 0 );
  
  	op2.ors_limit = NULL;
  	rc = op2.o_bd->be_modify( &op2, &rs2 );
  
  done:;
  	if ( m ) {
  		slap_mods_free( m, 1 );
  	}
  
  	return rc;
  }
  
  /* delete the session */
  int
  rbac_int_delete_session( Operation *op, rbac_session_t *sessp )
  {
  	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
  	slap_callback cb = { 0 };
  	SlapReply rs2 = { REP_RESULT };
  	Operation op2 = *op;
  	rbac_callback_info_t rbac_cb;
  	tenant_info_t *tenantp = NULL;
  	int rc = LDAP_SUCCESS;
  
  	tenantp = rbac_tid2tenant( &sessp->tenantid );
  	if ( !tenantp ) {
  		Debug( LDAP_DEBUG_ANY, "rbac_session_drop_role: "
  				"no tenant info with the req\n" );
  		goto done;
  	}
  
  	/* delete RBAC session */
  	cb.sc_private = &rbac_cb;
  	cb.sc_response = rbac_sess_fake_cb;
  	op2.o_callback = &cb;
  
  	op2.o_dn = tenantp->session_admin;
  	op2.o_ndn = tenantp->session_admin;
  	op2.o_tag = LDAP_REQ_DELETE;
  	op2.o_req_dn = sessp->sessdn;
  	op2.o_req_ndn = sessp->sessdn;
  	op2.o_bd = select_backend( &op2.o_req_ndn, 0 );
  	rc = op2.o_bd->be_delete( &op2, &rs2 );
  
  done:;
  	return rc;
  }
  
  rbac_session_t *
  rbac_alloc_session()
  {
  	rbac_session_t *sessp = NULL;
  
  	sessp = ch_malloc( sizeof(rbac_session_t) );
  	sessp->sessid.bv_len =
  			lutil_uuidstr( sessp->uuidbuf, sizeof(sessp->uuidbuf) );
  	sessp->sessid.bv_val = sessp->uuidbuf;
  
  	sessp->user = NULL;
  	BER_BVZERO( &sessp->tenantid );
  	BER_BVZERO( &sessp->uid );
  	BER_BVZERO( &sessp->userdn );
  	BER_BVZERO( &sessp->sessdn );
  	BER_BVZERO( &sessp->message );
  
  	sessp->last_access = 0;
  	sessp->timeout = 0;
  	sessp->warning_id = 0;
  	sessp->error_id = 0;
  	sessp->grace_logins = 0;
  	sessp->expiration_secs = 0;
  	sessp->is_authenticated = 0;
  
  	sessp->roles = NULL;
  	sessp->role_constraints = NULL;
  
  	return sessp;
  }
  
  int
  rbac_register_session( Operation *op, SlapReply *rs, rbac_session_t *sessp )
  {
  	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
  	struct berval rdn, nrdn;
  	SlapReply rs2 = { REP_RESULT };
  	OperationBuffer opbuf;
  	Operation *op2;
  	Connection conn = { 0 };
  	Entry *e = NULL;
  	int rc = LDAP_SUCCESS;
  	char rdnbuf[
  		STRLENOF(RBAC_SESSION_RDN_EQ) + LDAP_LUTIL_UUIDSTR_BUFSIZE + 1];
  	tenant_info_t *tenantp = rbac_tid2tenant( &sessp->tenantid );
  #ifdef USE_NEW_THREAD_CONTEXT
  	void *thrctx = ldap_pvt_thread_pool_context();
  #else
  	void *thrctx = op->o_tmpmemctx;
  #endif
  
  	if ( !sessp ) {
  		rc = LDAP_UNWILLING_TO_PERFORM;
  		goto done;
  	}
  
  	/* dynamic objects */
  	e = entry_alloc();
  
  	strcpy( rdnbuf, RBAC_SESSION_RDN_EQ );
  	strncat( rdnbuf, sessp->sessid.bv_val, sessp->sessid.bv_len );
  	rdn.bv_val = rdnbuf;
  	rdn.bv_len = STRLENOF(RBAC_SESSION_RDN_EQ) + sessp->sessid.bv_len;
  	nrdn.bv_val = rdnbuf;
  	nrdn.bv_len = STRLENOF(RBAC_SESSION_RDN_EQ) + sessp->sessid.bv_len;
  
  	build_new_dn( &e->e_name, &tenantp->sessions_basedn, &rdn, NULL );
  	build_new_dn( &e->e_nname, &tenantp->sessions_basedn, &nrdn, NULL );
  
  	attr_merge_one( e, slap_schema.si_ad_objectClass, &slapo_session_oc, NULL );
  	attr_merge_one( e, slap_schema.si_ad_structuralObjectClass,
  			&slapo_session_oc, NULL );
  	attr_merge_one( e, slap_rbac_schema.ad_session_id, &sessp->sessid, NULL );
  
  	if ( !BER_BVISNULL( &sessp->uid ) ) {
  		attr_merge_one( e, slap_schema.si_ad_uid, &sessp->uid, NULL );
  	}
  
  	/* add tenant id */
  	if ( !BER_BVISNULL( &sessp->tenantid ) ) {
  		attr_merge_one(
  				e, slap_rbac_schema.ad_tenant_id, &sessp->tenantid, NULL );
  	}
  
  	/* add the userdn */
  	if ( !BER_BVISNULL( &sessp->userdn ) ) {
  		attr_merge_one(
  				e, slap_rbac_schema.ad_session_user_dn, &sessp->userdn, NULL );
  	}
  
  	if ( sessp->roles ) {
  		attr_merge( e, slap_rbac_schema.ad_session_roles, sessp->roles, NULL );
  	}
  
  	// TODO: ensure this is correct way to store constraints in session:
  	if ( sessp->role_constraints ) {
  		attr_merge( e, slap_rbac_schema.ad_session_role_constraints,
  				sessp->role_constraints, NULL );
  	}
  	/* rendered dynmaicObject */
  	attr_merge_one( e, slap_schema.si_ad_objectClass,
  			&slap_schema.si_oc_dynamicObject->soc_cname, NULL );
  
  	/* store RBAC session */
  	connection_fake_init2( &conn, &opbuf, thrctx, 0 );
  	op2 = &opbuf.ob_op;
  	//Operation op2 = *op;
  	//op2.o_callback = &nullsc;
  	//rbac_callback_info_t rbac_cb;
  	//cb.sc_private      = &rbac_cb;
  	//cb.sc_response     = rbac_sess_fake_cb;
  	//op2.o_callback    = &cb;
  	//op2.ors_limit     = NULL;
  	op->o_callback = &nullsc;
  	op2->o_dn = tenantp->session_admin;
  	op2->o_ndn = tenantp->session_admin;
  	op2->o_tag = LDAP_REQ_ADD;
  	op2->o_protocol = LDAP_VERSION3;
  	op2->o_req_dn = e->e_name;
  	op2->o_req_ndn = e->e_nname;
  	op2->ora_e = e;
  	op2->o_bd = frontendDB;
  
  	rc = op2->o_bd->be_add( op2, &rs2 );
  
  done:;
  	if ( e ) entry_free( e );
  	return rc;
  }
  
  int
  rbac_register_session2( Operation *op, SlapReply *rs, rbac_session_t *sessp )
  {
  	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
  	struct berval rdn, nrdn;
  	SlapReply rs2 = { REP_RESULT };
  	Operation op2 = *op;
  	rbac_callback_info_t rbac_cb;
  	//OperationBuffer opbuf;
  	//Connection conn = {0};
  	Entry *e = NULL;
  	int rc = LDAP_SUCCESS;
  	char rdnbuf[STRLENOF(RBAC_SESSION_RDN_EQ) + LDAP_LUTIL_UUIDSTR_BUFSIZE +
  			1];
  	tenant_info_t *tenantp = rbac_tid2tenant( &sessp->tenantid );
  	slap_callback cb = { 0 };
  	//#ifdef USE_NEW_THREAD_CONTEXT
  	//	void *thrctx = ldap_pvt_thread_pool_context();
  	//#else
  	//	void *thrctx = op->o_tmpmemctx;
  	//#endif
  
  	if ( !sessp ) {
  		rc = LDAP_UNWILLING_TO_PERFORM;
  		goto done;
  	}
  
  	/* dynamic objects */
  	e = entry_alloc();
  
  	strcpy( rdnbuf, RBAC_SESSION_RDN_EQ );
  	strncat( rdnbuf, sessp->sessid.bv_val, sessp->sessid.bv_len );
  	rdn.bv_val = rdnbuf;
  	rdn.bv_len = STRLENOF(RBAC_SESSION_RDN_EQ) + sessp->sessid.bv_len;
  	nrdn.bv_val = rdnbuf;
  	nrdn.bv_len = STRLENOF(RBAC_SESSION_RDN_EQ) + sessp->sessid.bv_len;
  
  	build_new_dn( &e->e_name, &tenantp->sessions_basedn, &rdn, NULL );
  	build_new_dn( &e->e_nname, &tenantp->sessions_basedn, &nrdn, NULL );
  
  	attr_merge_one( e, slap_schema.si_ad_objectClass, &slapo_session_oc, NULL );
  	attr_merge_one( e, slap_schema.si_ad_structuralObjectClass,
  			&slapo_session_oc, NULL );
  	attr_merge_one( e, slap_rbac_schema.ad_session_id, &sessp->sessid, NULL );
  
  	if ( !BER_BVISNULL( &sessp->uid ) ) {
  		attr_merge_one( e, slap_schema.si_ad_uid, &sessp->uid, NULL );
  	}
  
  	/* add tenant id */
  	if ( !BER_BVISNULL( &sessp->tenantid ) ) {
  		attr_merge_one(
  				e, slap_rbac_schema.ad_tenant_id, &sessp->tenantid, NULL );
  	}
  
  	/* add the userdn */
  	if ( !BER_BVISNULL( &sessp->userdn ) ) {
  		attr_merge_one(
  				e, slap_rbac_schema.ad_session_user_dn, &sessp->userdn, NULL );
  	}
  
  	if ( sessp->roles ) {
  		attr_merge( e, slap_rbac_schema.ad_session_roles, sessp->roles, NULL );
  	}
  
  	// TODO: ensure this is correct way to store constraints in session:
  	if ( sessp->role_constraints ) {
  		attr_merge( e, slap_rbac_schema.ad_session_role_constraints,
  				sessp->role_constraints, NULL );
  	}
  	/* rendered dynmaicObject */
  	attr_merge_one( e, slap_schema.si_ad_objectClass,
  			&slap_schema.si_oc_dynamicObject->soc_cname, NULL );
  
  	/* store RBAC session */
  	//connection_fake_init2( &conn, &opbuf, thrctx, 0 );
  	//op2 = &opbuf.ob_op;
  	//op2.o_ctrlflag = op->o_ctrlflag;
  	// todo this ain't right"
  	//op2.o_ctrlflag = 0;
  	//OperationBuffer *opbuf;
  	//memset( opbuf, 0, sizeof(OperationBuffer));
  	//op2.o_hdr = &opbuf->ob_hdr;
  	//op2.o_controls = opbuf->ob_controls;
  
  	// fails on modify.c:353 with segfault
  
  	//op2.o_callback = &nullsc;
  	cb.sc_private = &rbac_cb;
  	cb.sc_response = rbac_sess_fake_cb;
  	op2.o_callback = &cb;
  	op2.o_dn = tenantp->session_admin;
  	op2.o_ndn = tenantp->session_admin;
  	op2.o_tag = LDAP_REQ_ADD;
  	op2.o_protocol = LDAP_VERSION3;
  	op2.o_req_dn = e->e_name;
  	op2.o_req_ndn = e->e_nname;
  	op2.ora_e = e;
  	op2.o_bd = frontendDB;
  	//op2.ors_limit     = NULL;
  
  	rc = op2.o_bd->be_add( &op2, &rs2 );
  
  done:;
  	if ( e ) entry_free( e );
  
  	return rc;
  }
  
  int
  rbac_is_valid_session_id( struct berval *sessid )
  {
  	/* TODO: simple test */
  	if ( !sessid || sessid->bv_len != 36 ) {
  		if ( !sessid ) {
  			Debug( LDAP_DEBUG_ANY, "rbac_is_valid_session_id: "
  					"null sessid\n" );
  		} else {
  			Debug( LDAP_DEBUG_ANY, "rbac_is_valid_session_id: "
  					"len (%lu)\n",
  					sessid->bv_len );
  		}
  		return 0;
  	}
  
  	else {
  		return 1;
  	}
  }
  
  /* create an rbac request with the session ID */
  rbac_req_t *
  rbac_is_search_session_permissions( Operation *op )
  {
  	rbac_req_t *reqp = NULL;
  
  	/* check whether the search for sessionPermissions and *
  	 * with a valid sessionID */
  
  	return reqp;
  }
  
  rbac_session_t *
  rbac_session_byid_fake( Operation *op, rbac_req_t *reqp )
  {
  	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
  	rbac_session_t *sessp = NULL;
  	int rc = LDAP_SUCCESS;
  	char fbuf[RBAC_BUFLEN];
  	struct berval filter = { sizeof(fbuf), fbuf };
  	SlapReply rs2 = { REP_RESULT };
  	Operation op2 = *op;
  	rbac_callback_info_t rbac_cb;
  	slap_callback cb = { 0 };
  	tenant_info_t *tenantp = NULL;
  
  	if ( !rbac_is_valid_session_id( &reqp->sessid ) ) {
  		Debug( LDAP_DEBUG_ANY, "rbac_session_byid: "
  				"invalid session id (%s)\n",
  				reqp->sessid.bv_val );
  		rc = LDAP_UNWILLING_TO_PERFORM;
  		goto done;
  	}
  
  	sessp = rbac_alloc_session();
  	if ( !sessp ) {
  		Debug( LDAP_DEBUG_ANY, "rbac_session_byid: "
  				"unable to allocate session memory\n" );
  		rc = LDAP_UNWILLING_TO_PERFORM;
  		goto done;
  	}
  
  	tenantp = rbac_tid2tenant( &reqp->tenantid );
  
  	/* session id filter */
  	memset( fbuf, 0, sizeof(fbuf) );
  	strcpy( fbuf, RBAC_SESSION_RDN_EQ );
  	strncpy( &fbuf[0] + sizeof(RBAC_SESSION_RDN_EQ) - 1, reqp->sessid.bv_val,
  			reqp->sessid.bv_len );
  	filter.bv_val = fbuf;
  	filter.bv_len = strlen( fbuf );
  
  	//cb.sc_private     = sessp;
  	//cb.sc_response    = rbac_read_session_cb;
  	cb.sc_private = &rbac_cb;
  	cb.sc_response = rbac_sess_fake_cb;
  	op2.o_callback = &cb;
  	op2.o_tag = LDAP_REQ_SEARCH;
  	op2.o_dn = tenantp->session_admin;
  	op2.o_ndn = tenantp->session_admin;
  	op2.o_req_dn = tenantp->sessions_basedn;
  	op2.o_req_ndn = tenantp->sessions_basedn;
  	op2.ors_filterstr = filter;
  	op2.ors_filter = str2filter_x( &op2, filter.bv_val );
  	op2.ors_scope = LDAP_SCOPE_SUBTREE;
  	op2.ors_attrs = slap_rbac_schema.session_attrs;
  	op2.ors_tlimit = SLAP_NO_LIMIT;
  	op2.ors_slimit = SLAP_NO_LIMIT;
  	op2.o_bd = frontendDB;
  	// hyc change to fix seg fault:
  	op2.ors_limit = NULL;
  
  	rc = op2.o_bd->be_search( &op2, &rs2 );
  	filter_free_x( &op2, op2.ors_filter, 1 );
  
  done:
  	// TODO: find equivalent way of check nentries (broke with fake connection fix)
  	//if ( rc != LDAP_SUCCESS || rs2.sr_nentries <= 0 ) {
  	if ( rc != LDAP_SUCCESS ) {
  		rbac_free_session( sessp );
  		sessp = NULL;
  	}
  
  	return sessp;
  }
  
  rbac_session_t *
  rbac_session_byid( Operation *op, rbac_req_t *reqp )
  {
  	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
  	rbac_session_t *sessp = NULL;
  	int rc = LDAP_SUCCESS;
  	char fbuf[RBAC_BUFLEN];
  	struct berval filter = { sizeof(fbuf), fbuf };
  	SlapReply rs2 = { REP_RESULT };
  	Operation op2 = *op;
  	slap_callback cb = { 0 };
  	tenant_info_t *tenantp = NULL;
  
  	if ( !rbac_is_valid_session_id( &reqp->sessid ) ) {
  		Debug( LDAP_DEBUG_ANY, "rbac_session_byid: "
  				"invalid session id (%s)\n",
  				reqp->sessid.bv_val );
  		rc = LDAP_UNWILLING_TO_PERFORM;
  		goto done;
  	}
  
  	sessp = rbac_alloc_session();
  	if ( !sessp ) {
  		Debug( LDAP_DEBUG_ANY, "rbac_session_byid: "
  				"unable to allocate session memory\n" );
  		rc = LDAP_UNWILLING_TO_PERFORM;
  		goto done;
  	}
  
  	tenantp = rbac_tid2tenant( &reqp->tenantid );
  
  	/* session id filter */
  	memset( fbuf, 0, sizeof(fbuf) );
  	strcpy( fbuf, RBAC_SESSION_RDN_EQ );
  	strncpy( &fbuf[0] + sizeof(RBAC_SESSION_RDN_EQ) - 1, reqp->sessid.bv_val,
  			reqp->sessid.bv_len );
  	filter.bv_val = fbuf;
  	filter.bv_len = strlen( fbuf );
  
  	cb.sc_private = sessp;
  	cb.sc_response = rbac_read_session_cb;
  	op2.o_callback = &cb;
  	op2.o_tag = LDAP_REQ_SEARCH;
  	op2.o_dn = tenantp->session_admin;
  	op2.o_ndn = tenantp->session_admin;
  	op2.o_req_dn = tenantp->sessions_basedn;
  	op2.o_req_ndn = tenantp->sessions_basedn;
  	op2.ors_filterstr = filter;
  	op2.ors_filter = str2filter_x( &op2, filter.bv_val );
  	op2.ors_scope = LDAP_SCOPE_SUBTREE;
  	op2.ors_attrs = slap_rbac_schema.session_attrs;
  	op2.ors_tlimit = SLAP_NO_LIMIT;
  	op2.ors_slimit = SLAP_NO_LIMIT;
  	op2.o_bd = frontendDB;
  	// hyc change to fix seg fault:
  	op2.ors_limit = NULL;
  
  	rc = op2.o_bd->be_search( &op2, &rs2 );
  	filter_free_x( &op2, op2.ors_filter, 1 );
  
  done:
  	// TODO: find equivalent way of check nentries (broke with fake connection fix)
  	//if ( rc != LDAP_SUCCESS || rs2.sr_nentries <= 0 ) {
  	if ( rc != LDAP_SUCCESS ) {
  		rbac_free_session( sessp );
  		sessp = NULL;
  	}
  
  	return sessp;
  }
  
  static char *
  rbac_int_session_permissions_filterstr( Operation *op, rbac_session_t *sessp )
  {
  	char filterbuf[RBAC_BUFLEN];
  	int i;
  
  	memset( filterbuf, 0, sizeof(filterbuf) );
  
  	strcat( filterbuf, "(&(objectClass=ftOperation)(|" );
  	strcat( filterbuf, "(ftUsers=" );
  	strcat( filterbuf, sessp->uid.bv_val );
  	strcat( filterbuf, ")" );
  
  	/* add ftRoles filters */
  	for ( i = 0; !BER_BVISEMPTY( &sessp->roles[i] ); i++ ) {
  		strcat( filterbuf, "(ftRoles=" );
  		strncat( filterbuf, sessp->roles[i].bv_val, sessp->roles[i].bv_len );
  		strcat( filterbuf, ")" );
  	}
  	strcat( filterbuf, "))" );
  	return strdup( filterbuf );
  }
  
  int
  rbac_int_session_permissions(
  		Operation *op,
  		SlapReply *rs,
  		rbac_req_t *reqp,
  		rbac_session_t *sessp )
  {
  	slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
  	tenant_info_t *tenantp = NULL;
  	int rc;
  	struct berval filter;
  	char *filterstr;
  	struct berval permndn = BER_BVNULL;
  	OperationBuffer opbuf;
  	Connection conn = { 0 };
  	SlapReply rs2 = { REP_RESULT };
  	Operation *op2;
  	slap_callback cb = { 0 };
  	char permbuf[1024];
  	session_perm_req_t sess_perm_req;
  #ifdef USE_NEW_THREAD_CONTEXT
  	void *thrctx = ldap_pvt_thread_pool_context();
  #else
  	void *thrctx = op->o_tmpmemctx;
  #endif
  
  	tenantp = rbac_tid2tenant( &reqp->tenantid );
  
  	/* construct session permissions dn */
  	memset( permbuf, 0, sizeof(permbuf) );
  	strcat( permbuf, "rbacSessid=" );
  	strncat( permbuf, sessp->sessid.bv_val, sessp->sessid.bv_len );
  	strcat( permbuf, ",dc=rbac" );
  	sess_perm_req.op = op;
  	sess_perm_req.rs = rs;
  	sess_perm_req.permdn.bv_val = permbuf;
  	sess_perm_req.permdn.bv_len = strlen( permbuf );
  	sess_perm_req.sessid = &reqp->sessid;
  	sess_perm_req.tenantp = tenantp;
  
  	filterstr = rbac_int_session_permissions_filterstr( op, sessp );
  	if ( !filterstr ) {
  		Debug( LDAP_DEBUG_ANY, "unable to construct filter for session permissions\n" );
  		rc = LDAP_UNWILLING_TO_PERFORM;
  		goto done;
  	}
  	filter.bv_val = filterstr;
  	filter.bv_len = strlen( filterstr );
  
  	rc = dnNormalize(
  			0, NULL, NULL, &tenantp->permissions_basedn, &permndn, NULL );
  	if ( rc != LDAP_SUCCESS ) {
  		Debug( LDAP_DEBUG_ANY, "rbac_read_permission: "
  				"unable to normalize permission DN\n" );
  		rc = LDAP_UNWILLING_TO_PERFORM;
  		goto done;
  	}
  
  	connection_fake_init2( &conn, &opbuf, thrctx, 0 );
  	op2 = &opbuf.ob_op;
  	//Operation op2 = *op;
  	cb.sc_private = &sess_perm_req;
  	cb.sc_response = rbac_session_permissions_cb;
  	op2->o_callback = &cb;
  	op2->o_tag = LDAP_REQ_SEARCH;
  	op2->o_dn = tenantp->admin;
  	op2->o_ndn = tenantp->admin;
  	op2->o_req_dn = tenantp->permissions_basedn;
  	op2->o_req_ndn = permndn;
  	op2->ors_filterstr = filter;
  	op2->ors_filter = str2filter_x( op, filter.bv_val );
  	op2->ors_scope = LDAP_SCOPE_SUB;
  	op2->ors_attrs = tenantp->schema->session_perm_attrs;
  	op2->ors_tlimit = SLAP_NO_LIMIT;
  	op2->ors_slimit = SLAP_NO_LIMIT;
  	op2->ors_attrsonly = 0;
  	op2->o_bd = frontendDB;
  	//op2.ors_limit     = NULL;
  	rc = op2->o_bd->be_search( op2, &rs2 );
  	filter_free_x( op, op2->ors_filter, 1 );
  
  done:;
  	/* generate audit log */
  	rbac_audit( op, SessionPermissions, sessp, reqp, rc, (char *)rs->sr_text );
  
  	rs->sr_err = rc;
  	return rs->sr_err;
  }
  
  void
  rbac_free_session( rbac_session_t *sessp )
  {
  	if ( !sessp ) return;
  
  	if ( sessp->user ) {
  		rbac_free_user( sessp->user );
  	}
  
  	if ( !BER_BVISNULL( &sessp->uid ) ) {
  		ber_memfree( sessp->uid.bv_val );
  	}
  
  	if ( !BER_BVISNULL( &sessp->tenantid ) ) {
  		ber_memfree( sessp->tenantid.bv_val );
  	}
  
  	if ( !BER_BVISNULL( &sessp->userdn ) ) {
  		ber_memfree( sessp->userdn.bv_val );
  	}
  
  	if ( !BER_BVISNULL( &sessp->sessdn ) ) {
  		ber_memfree( sessp->sessdn.bv_val );
  	}
  
  	if ( !BER_BVISNULL( &sessp->message ) ) {
  		ber_memfree( sessp->message.bv_val );
  	}
  
  	if ( sessp->roles ) {
  		ber_bvarray_free( sessp->roles );
  	}
  
  	if ( sessp->role_constraints ) {
  		ber_bvarray_free( sessp->role_constraints );
  	}
  
  	ch_free( sessp );
  
  	return;
  }
  
  /* roles included from request are activated into a session only when
   * they exist and have been assigned to the user. If no roles included in request, all
   * roles assigned to the user are activated into the rbac session.
   */
  int
  activate_session_roles(
  		rbac_session_t *sessp,
  		rbac_req_t *reqp,
  		rbac_user_t *userp )
  {
  	int i, j, rc = LDAP_UNWILLING_TO_PERFORM;
  	if ( !sessp || !reqp || !userp ) {
  		goto done;
  	}
  
  	/* no role requested, assign all roles from the user to the session. */
  	if ( reqp->roles == NULL || BER_BVISNULL( &reqp->roles[0] ) ) {
  		//if (!reqp->roles || BER_BVISNULL(&reqp->roles[0])) {
  		/* no roles assigned to the user */
  		if ( !userp->roles || BER_BVISNULL( &userp->roles[0] ) ) goto done;
  		for ( i = 0; !BER_BVISNULL( &userp->roles[i] ); i++ ) {
  			struct berval role;
  			ber_dupbv_x( &role, &userp->roles[i], NULL );
  			ber_bvarray_add( &sessp->roles, &role );
  			rc = LDAP_SUCCESS;
  		}
  
  		// TODO: smm 20141218 - make sure this is correct way to add constraints to user session.
  		for ( i = 0; !BER_BVISNULL( &userp->role_constraints[i] ); i++ ) {
  			struct berval roleconstraint;
  			ber_dupbv_x( &roleconstraint, &userp->role_constraints[i], NULL );
  			ber_bvarray_add( &sessp->role_constraints, &roleconstraint );
  			rc = LDAP_SUCCESS;
  		}
  
  	} else {
  		for ( i = 0; !BER_BVISNULL( &reqp->roles[i] ); i++ ) {
  			for ( j = 0; !BER_BVISNULL( &userp->roles[j] ); j++ ) {
  				if ( !ber_bvstrcasecmp( &reqp->roles[i], &userp->roles[j] ) ) {
  					/* requested role is assigned to the user */
  					struct berval role;
  					ber_dupbv_x( &role, &userp->roles[i], NULL );
  					ber_bvarray_add( &sessp->roles, &role );
  					rc = LDAP_SUCCESS;
  				}
  			}
  		}
  	}
  
  done:;
  	return rc;
  }
  