//******************************************************************************
// @@@ START COPYRIGHT @@@
//
// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.
//
// @@@ END COPYRIGHT @@@
//******************************************************************************

// LCOV_EXCL_START -- lets be a little paranoid and not let any in-line funcs
//                    from the header files slip into the coverage count

#include "dbUserAuth.h"
#include "token.h"
#include "tokenkey.h"
#include "ldapconfignode.h"
#include <stdio.h>
#include <stddef.h>
#include <stdlib.h>
#include <limits.h>
#include <string.h>
#include <string>
#include <vector>
#include <exception>
#include <ctype.h>

#include <iostream>
#include <sys/types.h>
#include <linux/unistd.h> // gettid
#include "../../../sqf/inc/cextdecs/cextdecs.h"

// Used to disable and enable dumps via setrlimit in a release env.
#ifndef DBSECURITY_DEBUG
#include <sys/resource.h>
#endif

#include "authEvents.h"
#include "ldapconfignode.h"

#include "common/evl_sqlog_eventnum.h"
#include "sqevlog/evl_sqlog_writer.h"
#include "seabed/int/types.h"
#include "seabed/pctl.h"
#include "seabed/ms.h"
#include "seabed/fserr.h"
class ComDiagsArea;
class Queue;
#include "SQLCLIdev.h"
#ifndef Lng32
typedef int             Lng32;
#endif
#include "ComSmallDefs.h"
#include "NAUserId.h"
#include "ExExeUtilCli.h"
enum {INTERNAL_QUERY_FROM_EXEUTIL   = 0x20000};
// LCOV_EXCL_STOP

#define ZFIL_ERR_BADPARMVALUE 590
#define ZFIL_ERR_BOUNDSERR 22
#define ZFIL_ERR_OK 0
#define ZFIL_ERR_SECVIOL 48
#ifndef SEABASE_AUTHS
#define SEABASE_AUTHS            "AUTHS"
#endif 

using namespace std;

class UserCacheContents;
class ClientContents;

static void authenticateUser(
   DBUserAuthContents  & self,
   const char          * username,
   const char          * password,
   ClientContents      & clientInfo,
   AUTHENTICATION_INFO & authenticationInfo,
   PERFORMANCE_INFO    & performanceInfo);
   
void cacheUserInfo(
   const char    * username,
   const char    * databaseUsername,
   int32_t         userID,
   bool            isValid,
   int64_t         redefTime);   
   
static LDAuthStatus executeLDAPAuthentication(
   DBUserAuthContents &            self,
   const char *                    username,
   const char *                    password,
   LDAPConfigNode::LDAPConfigType  configType,
   PERFORMANCE_INFO &              performanceInfo);

inline static const UserCacheContents * fetchFromCacheByUsername(const char * username);

inline static const UserCacheContents * fetchFromCacheByUserID(long userID);

static int32_t fetchFromAUTHSTable(
   const char     * externalUsername,
   char           * databaseUsername,
   int32_t        & userID,
   bool           & isValid,
   int64_t        & redefTime);

static int32_t fetchFromAUTHSTable(
   int32_t          userID,
   char           * databaseUsername,
   char           * externalUsername,
   bool           & isValid,
   int64_t        & redefTime);
 

static void logAuthenticationErrors(std::vector<AuthEvent>  & authEvents);

static void logAuthenticationOutcome(
   const string   & external_user_name,
   const string   & internal_user_name,
   const int32_t    user_id,
   ClientContents & clientInfo,
   const AUTH_OUTCOME    outcome);
                                    
static void logAuthenticationRetries(
   int          nodeID,
   const char * username);
 
static void logToEventTable(
   int                    nodeID,
   DB_SECURITY_EVENTID    eventID, 
   posix_sqlog_severity_t severity, 
   const char *           msg);                                    

static void prepareUserNameForQuery(
   char       *nameForQuery,
   const char *extName);

static void stripAllTrailingBlanks(
   char   * buf,
   size_t   len);

static void timeDiff (
   struct timespec t1,
   struct timespec t2,
   struct timespec &tDiff);
   
inline static void upshiftString(
   const char * inputString,
   char       * outputString); 
   
static void writeLog(const char * text);     

class ClientContents
{
public:
   char            clientName[257];
   char            clientUserName[257];
   char            applicationName[257];
};


class BlackBox
{
public:
   USERS_INFO      usersInfo;
   int             error;   //ACH do we need this?
   UA_Status       errorDetail;
   bool            isAuthenticated;
};

class DBUserAuthContents
{
public:
   BlackBox                   bb;
   int                        nodeID;
   std::vector<AuthEvent>     authEvents;

   int bypassAuthentication(
      Token &               token,
      AUTHENTICATION_INFO & authenticationInfo);

   std::vector<AuthEvent> &getAuthEvents() { return authEvents; }

   void deserialize(Token &token);
   void reset();
};

class UserCacheContents
{
public:
   char            externalUsername[257];
   char            databaseUsername[257];
   int32_t         userID;
   bool            isValid;
   int64_t         redefTime;
};

static std::vector<UserCacheContents> userCache;

#define gettid() static_cast<pid_t>(syscall(__NR_gettid))

static DBUserAuth * me = NULL;

#pragma page "DBUserAuth::CloseConnection"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::CloseConnection                                     *
// *                                                                           *
// *    Closes any open LDAP connections.                                      *
// *                                                                           *
// *****************************************************************************

void DBUserAuth::CloseConnection()

{

   LDAPConfigNode::CloseConnection();

}
//******************** End of DBUserAuth::CloseConnection **********************

#pragma page "DBUserAuth::FreeInstance"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::FreeInstance                                        *
// *                                                                           *
// *    Destroys the singleton instance of a DBUserAuth object.                *
// *                                                                           *
// *****************************************************************************

void DBUserAuth::FreeInstance()

{

   if (me != NULL)
      delete me;

}
//********************* End of DBUserAuth::FreeInstance *************************

#pragma page "DBUserAuth::GetInstance"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::GetInstance                                         *
// *    Constructs or returns the singleton instance of a DBUserAuth object.   *
// *                                                                           *
// *****************************************************************************

DBUserAuth * DBUserAuth::GetInstance()

{

   if (me != NULL)
      return me;

   me = new DBUserAuth();
   return me;

}
//********************** End of DBUserAuth::GetInstance ************************

#pragma page "DBUserAuth::GetBlackBox"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::GetBlackBox                                         *
// *                                                                           *
// *    Returns the black box data associated with this session.  If there is  *
// * no black box associated with this session, an empty string is returned.   *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <blackBox>                      char *                          Out      *
// *    is the external username (not the database username).                  *
// *                                                                           *
// *  <pretendTokenIsNull>            bool                            In       *
// *    is a minivan boolean used in testing.                                  *
// *                                                                           *
// *****************************************************************************
void DBUserAuth::GetBlackBox(
   char *blackBox,
   bool  pretendTokenIsNull)

{

Token *token = Token::Obtain();

//
// The only way Token::Obtain could return a NULL is if we were unable to
// allocate memory (a couple hundred bytes), which either means there is a
// serious memory leak somewhere or the heap is corrupted.  Neither is very
// likely, but good coding practice dictates we check for NULL anyway.  So
// why would we ever want to pretend the token is NULL?  Just to take a
// different branch and execute a few lines?  Count on it.
//

   if (pretendTokenIsNull)
      token = NULL;

//
// If token is NULL, either real or pretend, return an empty black box.
//

   if (token == NULL)
   {
      blackBox[0] = 0;
      return;
   }

   token->getData(blackBox);

}
//********************** End of DBUserAuth::GetBlackBox ************************


#pragma page "DBUserAuth::GetBlackBoxSize"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::GetBlackBoxSize                                     *
// *    Returns the size of the black box data associated with this session.   *
// * If there is no black box associated with this session, zero is returned.  *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameter:                                                               *
// *                                                                           *
// *  <pretendTokenIsNull>            bool                            In       *
// *    is a minivan boolean used in testing.                                  *
// *                                                                           *
// *****************************************************************************
size_t DBUserAuth::GetBlackBoxSize(bool  pretendTokenIsNull)

{

Token *token = Token::Obtain();

   if (pretendTokenIsNull)
      token = NULL;

   if (token == NULL)
      return 0;

   return token->getDataSize();

}
//******************** End of DBUserAuth::GetBlackBoxSize **********************

#pragma page "DBUserAuth::FormatStatusMsg"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::FormatStatusMsg                                     *
// *    Formats a status error or warning as a message.                        *
// *                                                                           *
// *                                                                           *
// * If there is no black box associated with this session, zero is returned.  *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <status>                        UA_Status                       In       *
// *    is the status code to be formatted.                                    *
// *                                                                           *
// *  <statusMsg>                     char *                          Out      *
// *    returns the formatted message.                                         *
// *                                                                           *
// *****************************************************************************
void DBUserAuth::FormatStatusMsg(
   UA_Status status,
   char *    statusMsg)

{

   switch (status)
   {
      case UA_STATUS_OK:
         strcpy(statusMsg,"OK, no warnings");
         break;
      case UA_STATUS_ERR_INVALID:
         strcpy(statusMsg,"Username or password is invalid");
         break;
      case UA_STATUS_ERR_SYSTEM:
         strcpy(statusMsg,"Resource or internal error occurred");
         break;
      default:
         strcpy(statusMsg,"Resource or internal error occurred");
         break;
   }

}
//******************** End of DBUserAuth::FormatStatusMsg **********************

#pragma page "DBUserAuth::CheckExternalUsernameDefined"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::CheckExternalUsernameDefined                        *
// *                                                                           *
// *    Determines if an external username of the form expected by the         *
// *    identity during authentication is defined on the identity store.       *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <externalUsername>              const char *                    In       *
// *    is the external username to be checked on the identity.                *
// *                                                                           *
// *  <configurationOrdinal>          AuthenticationConfiguration     In       *
// *    specifies which configuration to use when searching for the username.  *
// *    If Unknown, LDAPConfigNode will use the default specified in the       *
// *    config file (.traf_authentication_config).                             *
// *                                                                           *
// *  <foundConfigurationOrdinal>     AuthenticationConfiguration &   Out      *
// *    passes back the configuration where the user was found, or zero if the *
// *    user was not found.                                                    *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// * Returns: CheckUserResult                                                  *
// *                                                                           *
// *   UserExists       -- User was found on LDAP server                       *
// *   UserDoesNotExist -- User was not found on LDAP server                   *
// *   ErrorInCheck     -- An error prevented checking                         *
// *                                                                           *
// *****************************************************************************
DBUserAuth::CheckUserResult DBUserAuth::CheckExternalUsernameDefined(
   const char *                  externalUsername,          
   AuthenticationConfiguration   configurationOrdinal,    
   AuthenticationConfiguration & foundConfigurationOrdinal)   

{
  
#ifdef __SQ_LDAP_NO_SECURITY_CHECKING
  return CheckUserResult_UserExists;
#else

   char *authEnv;
   std::vector<AuthEvent> authEvents;

   authEnv = getenv("TRAFODION_ENABLE_AUTHENTICATION");
   if (authEnv == NULL || strcmp(authEnv,"YES") != 0)
   {
      foundConfigurationOrdinal = PrimaryConfiguration;
      return UserExists;
   }

   string userDN = "";       // User DN, used to bind to LDAP serer
   LDAPConfigNode *searchNode;

   LDAPConfigNode::LDAPConfigType configType = LDAPConfigNode::UnknownConfiguration;

   switch (configurationOrdinal)
   {
      case 1:
         configType = LDAPConfigNode::PrimaryConfiguration;
         break;
      case 2:
         configType = LDAPConfigNode::SecondaryConfiguration;
         break;
      default:
         configType = LDAPConfigNode::UnknownConfiguration;
    } 

   searchNode = LDAPConfigNode::GetLDAPConnection(authEvents,configType,SearchConnection);

   if (searchNode == NULL) 
      return ErrorDuringCheck;

   LDSearchStatus searchStatus = searchNode->lookupUser(authEvents,externalUsername,userDN);
                                                     
   if (searchStatus == LDSearchNotFound)
      return UserDoesNotExist;
     
   // didn't get "found" or "not found", so we have problems!
   if (searchStatus != LDSearchFound) 
      return ErrorDuringCheck;

   // External username was found.  But where?      
   switch (searchNode->getConfigType())
   {
      case LDAPConfigNode::UnknownConfiguration:
         foundConfigurationOrdinal = DefaultConfiguration;
         break;
      case LDAPConfigNode::PrimaryConfiguration:
         foundConfigurationOrdinal = PrimaryConfiguration;
         break;
      case LDAPConfigNode::SecondaryConfiguration:
         foundConfigurationOrdinal = SecondaryConfiguration;
         break;
      default:
         foundConfigurationOrdinal = DefaultConfiguration;
   }   
      
   return UserExists;

#endif

}
//************** End of DBUserAuth::CheckExternalUsernameDefined ***************

#pragma page "void DBUserAuth::DBUserAuth"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::DBUserAuth                                          *
// *    This function constructs a DBUserAuth object and its contents.         *
// *                                                                           *
// *****************************************************************************
DBUserAuth::DBUserAuth()
: self(*new DBUserAuthContents())

{

   self.reset();

char processName[MS_MON_MAX_PROCESS_NAME+1]; // +1 for trailing null
        
// obtain our node ID from Seabed
    msg_mon_get_my_info(&self.nodeID,              // nodeID
                        NULL,                      // mon process-id
                        processName,               // mon name
                        MS_MON_MAX_PROCESS_NAME,   // mon name-len
                        NULL,                      // mon process-type
                        NULL,                      // mon zone-id
                        NULL,                      // os process-id
                        NULL);                     // os thread-id

}
//********************** End of DBUserAuth::DBUserAuth *************************


#pragma page "void DBUserAuth::~DBUserAuth"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::~DBUserAuth                                         *
// *    This function destroysa DBUserAuth object and its contents.            *
// *                                                                           *
// *****************************************************************************
DBUserAuth::~DBUserAuth()

{

   delete &self;

}
//********************** End of DBUserAuth::~DBUserAuth ************************


#pragma page "DBUserAuth::getAuthFunction"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::getAuthFunction                                     *
// *                                                                           *
// *    Returns the token verification function set by MXOSRVR.                *
// *                                                                           *
// *****************************************************************************
AuthFunction DBUserAuth::getAuthFunction()

{

   return validateTokenFunc;

}
//******************* End of DBUserAuth::getAuthFunction ***********************
#pragma page "DBUserAuth::getUserID"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::getUserID                                           *
// *                                                                           *
// *    Returns the database user ID for the user.                             *
// *                                                                           *
// *****************************************************************************
int32_t DBUserAuth::getUserID() const

{

   return self.bb.usersInfo.effectiveUserID;

}
//************************ End of DBUserAuth::getUserID ************************

#pragma page "DBUserAuth::getDBUserName"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::getDBUserName                                       *
// *                                                                           *
// *    Returns the database username for the user.                           *
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <databaseUsername>              char *                          Out      *
// *    returns the user name as a null terminated string.                     *
// *  <maxLen>                        size_t                          In       *
// *    maximum size of the null terminated string.                            *
// *                                                                           *
// *****************************************************************************
void DBUserAuth::getDBUserName(char *databaseUsername, size_t maxLen) const

{

   memset(databaseUsername, '\0', maxLen);
   strncpy(databaseUsername,self.bb.usersInfo.databaseUsername, maxLen - 1);
   databaseUsername[maxLen -1] = '\0';

}
//********************** End of DBUserAuth::getDBUserName **********************

#pragma page "DBUserAuth::getExternalUsername"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::getExternalUsername                                 *
// *                                                                           *
// *    Returns the external username for the user.                            *
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <externalUsername>              char *                          Out      *
// *    passes back the external username as a null terminated string.         *
// *                                                                           *
// *  <maxLen>                        size_t                          In       *
// *    maximum size of the null terminated string.                            *
// *                                                                           *
// *****************************************************************************
void DBUserAuth::getExternalUsername(
   char * externalUsername,
   size_t maxLen) const

{

   memset(externalUsername,'\0',maxLen);
   strncpy(externalUsername,self.bb.usersInfo.externalUsername,maxLen - 1);
   externalUsername[maxLen - 1] = '\0';

}
//****************** End of DBUserAuth::getExternalUsername ********************


#pragma page "DBUserAuth::getTokenKeyAsString"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::getTokenKeyAsString                                 *
// *    Returns the Token Key as a formatted ASCII string.                     *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <tokenKeyString>                char *                          Out      *
// *    returns the Token Key as a formatted ASCII string.                     *
// *                                                                           *
// *****************************************************************************

void DBUserAuth::getTokenKeyAsString(char *tokenKeyString) const

{

Token *token = Token::Obtain();

// LCOV_EXCL_START
   if (token == NULL)
   {
      tokenKeyString[0] = 0;
      return;
   }
// LCOV_EXCL_STOP

   token->getTokenKeyAsString(tokenKeyString);

}
//***************** End of DBUserAuth::getTokenKeyAsString *********************


#pragma page "Token::getTokenKeySize"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::getTokenKeySize                                     *
// *                                                                           *
// *    Returns the token key size.  Only used in testing.                     *
// *                                                                           *
// *****************************************************************************
size_t DBUserAuth::getTokenKeySize() const

{

Token *token = Token::Obtain();

   if (token == NULL)
      return 0;
      
   return token->getTokenKeySize();

}
//******************* End of DBUserAuth:getTokenKeySize ************************


#pragma page "DBUserAuth::setAuthFunction"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::setAuthFunction                                     *
// *                                                                           *
// *    Sets the token verification function.                                  *
// *                                                                           *
// *****************************************************************************
void DBUserAuth::setAuthFunction(AuthFunction somefunc)

{

   validateTokenFunc = somefunc;

}
//******************** End of DBUserAuth::setAuthFunction **********************


#pragma page "DBUserAuth::verify"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::verify                                              *
// *                                                                           *
// *    Verifies a username and password on a database instance.               *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <username>                      const char *                    In       *
// *    is the external username (not the database username).                  *
// *                                                                           *
// *  <credentials>                   char *                          In/Out   *
// *    is the password for the user or a token that represents the user       *
// *  session.  On return is a token.                                          *
// *                                                                           *
// *  <errorDetail>                   UA_Status &                     Out      *
// *    passes back which input parameter is at fault on failure.              *
// *                                                                           *
// *  <authenticationInfo             AUTHENTICATION_INFO &           Out      *
// *    passes back user and error data related to the authentication.         *
// *                                                                           *
// *  <client_info>                   const CLIENT_INFO &             In       *
// *    is the client related information needed for audit logging.            *
// *                                                                           *
// *  <performanceInfo>               PERFORMANCE_INFO &              Out      *
// *    passes back elapsed time for authentication suboperations.             *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// * Returns: int                                                              *
// *                                                                           *
// *   0 - Authentication completed.                                           *
// *  22 - Bounds error.  Number of param in error returned in errorDetail.    *
// * 590 - NULL param.  Number of param in error returned in errorDetail.      *
// *                                                                           *
// *****************************************************************************
int DBUserAuth::verify(
   const char           * externalUsername,        
   char                 * credentials,     
   UA_Status            & errorDetail,     
   AUTHENTICATION_INFO  & authenticationInfo,  
   const CLIENT_INFO    & client_info,     
   PERFORMANCE_INFO     & performanceInfo) 


{

char buf[500];

   memset((void *)&performanceInfo, '\0', sizeof(performanceInfo));


   if (externalUsername == NULL)
   {
      errorDetail = UA_STATUS_PARAM1;
      return ZFIL_ERR_BADPARMVALUE;
   }

   if (credentials == NULL)
   {
      errorDetail = UA_STATUS_PARAM2;
      return ZFIL_ERR_BADPARMVALUE;
   }

   if (strlen(externalUsername) > MAX_EXTUSERNAME_LEN)
   {
      errorDetail = UA_STATUS_PARAM1;
      return ZFIL_ERR_BOUNDSERR;
   }

   if (strlen(credentials) > MAX_EXTPASSWORD_LEN)
   {
      errorDetail = UA_STATUS_PARAM2;
      return ZFIL_ERR_BOUNDSERR;
   }
   
static ClientContents clientInfo;

   memset((void *)&clientInfo, '\0', sizeof(clientInfo));

   if (client_info.client_name != NULL)
      strncpy(clientInfo.clientName,
              client_info.client_name,
              sizeof(clientInfo.clientName) - 1);
   if (client_info.client_user_name != NULL)
       strncpy(clientInfo.clientUserName,
               client_info.client_user_name,
               sizeof(clientInfo.clientUserName) - 1);
   if (client_info.application_name != NULL)
       strncpy(clientInfo.applicationName,
               client_info.application_name,
               sizeof(clientInfo.applicationName) - 1);
   

   errorDetail = UA_STATUS_OK;
   self.reset();

Token *token = Token::Verify(credentials,validateTokenFunc);

// If we have a valid token, we need to deserialize the black box data
   if (token != NULL)
   {
      self.deserialize(*token);  //ACH load auth info from black box data.

      //Need to set performance info
      return ZFIL_ERR_OK;
   }

//
// Credentials are not a valid token; must be a password.  Proceed with normal
// authentication.  First, obtain a token to store authentication results.
//

   token = Token::Obtain();

   if (token == NULL)
      return ZFIL_ERR_BOUNDSERR; //ACH better error?

   token->reset();
char *authEnv;

   authEnv = getenv("TRAFODION_ENABLE_AUTHENTICATION");
   if (authEnv == NULL || strcmp(authEnv,"YES") != 0)
      return self.bypassAuthentication(*token,authenticationInfo);

//
// Ok, let's actually verify the username and password.
//

   authenticateUser(self,externalUsername,credentials,clientInfo,
                    authenticationInfo,performanceInfo);
   
// Convert password to a token key.  Note this is done for all authentications,
// both successful and unsuccessful.

   token->getTokenKey(authenticationInfo.tokenKey);
   authenticationInfo.tokenKeySize = token->getTokenKeySize();

// Save authentication results in black box within token container
   token->setData((char *)&self.bb,sizeof(self.bb));   
   
   return ZFIL_ERR_OK;

}
//************************* End of DBUserAuth::verify **************************

#pragma page "DBUserAuth::verifyChild"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuth::verifyChild                                         *
// *                                                                           *
// *    Verifies the token key sent by a child MXOSRVR and returns the         *
// * blackbox data.                                                            *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <credentials>                   const char *                    In       *
// *    is the token sent by the child server.                                 *
// *                                                                           *
// *  <data>                          char *                          Out      *
// *    passes back the authentication data (black box) associated with        *
// *    this token.                                                            *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// * Returns: size_t                                                           *
// *                                                                           *
// *    The number of bytes in <data>.                                         *
// *                                                                           *
// *****************************************************************************
size_t DBUserAuth::verifyChild(
   const char  * credentials,
   char        * data)

{

// Compare the token key sent with the one stored in this server
Token *token = Token::Verify(credentials);

   if (token == NULL)
      return 0;

   token->getData(data);

   return token->getDataSize();

}
//********************* End of DBUserAuth::verifyChild **********************

// DBUserAuthContents functions

#pragma page "DBUserAuthContents::bypassAuthentication"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuthContents::bypassAuthentication                        *
// *                                                                           *
// *    Skip authentication, populate fields as if DB__ROOT logged on          *
// *  successfully.                                                            *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <token>                         Token &                         In       *
// *    is a reference to the token containing the data to be deserialized.    *
// *                                                                           *
// *  <authenticationInfo             AUTHENTICATION_INFO &           Out      *
// *    passes back user and error data related to the authentication.         *
// *                                                                           *
// *****************************************************************************
int DBUserAuthContents::bypassAuthentication(
   Token &               token,
   AUTHENTICATION_INFO & authenticationInfo)

{

   bb.error = ZFIL_ERR_OK;
   bb.isAuthenticated = true;
   bb.errorDetail = UA_STATUS_OK;
   bb.usersInfo.effectiveUserID = SUPER_USER;
   bb.usersInfo.sessionUserID = SUPER_USER;
   strcpy(bb.usersInfo.databaseUsername,"DB__ROOT");
   strcpy(bb.usersInfo.externalUsername,"DB__ROOT");
   token.setData((char *)&bb,sizeof(bb)); 
   
   authenticationInfo.error = bb.error;
   authenticationInfo.errorDetail = bb.errorDetail;   
   authenticationInfo.usersInfo.effectiveUserID = SUPER_USER;
   authenticationInfo.usersInfo.sessionUserID = SUPER_USER;
   strcpy(authenticationInfo.usersInfo.databaseUsername,"DB__ROOT");
   strcpy(authenticationInfo.usersInfo.externalUsername,"DB__ROOT");
   authenticationInfo.tokenKeySize = token.getTokenKeySize();
   token.getTokenKey(authenticationInfo.tokenKey);
   
   return ZFIL_ERR_OK;

}
//************* End of DBUserAuthContents::bypassAuthentication ****************


#pragma page "DBUserAuthContents::deserialize"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuthContents::deserialize                                 *
// *    Sets all member values from a serialized token blackbox.               *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <token>                         Token &                         In       *
// *    is a reference to the token containing the data to be deserialized.    *
// *                                                                           *
// *****************************************************************************

void DBUserAuthContents::deserialize(Token &token)

{

size_t blackBoxSize = token.getDataSize();

char *blackBox = new char[blackBoxSize];

   token.getData(blackBox);

   memcpy((char *)(&bb),blackBox,blackBoxSize);

   delete [] blackBox;

}
//***************** End of DBUserAuthContents::deserialize *********************

#pragma page "DBUserAuthContents::reset"
// *****************************************************************************
// *                                                                           *
// * Function: DBUserAuthContents::reset                                       *
// *    Resets all the member values to their default.                         *
// *                                                                           *
// *****************************************************************************
void DBUserAuthContents::reset()

{

   bb.usersInfo.effectiveUserID = 0;//ACH can we reserve value for NO_SUCH_USER?
   bb.usersInfo.sessionUserID = 0;//ACH can we reserve value for NO_SUCH_USER?
   bb.usersInfo.externalUsername[0] = 0;
   bb.usersInfo.databaseUsername[0] = 0;
   bb.usersInfo.redefTime = 0;
   bb.isAuthenticated = false;
   bb.error = 0;
   bb.errorDetail = UA_STATUS_OK;

}
//********************* End of DBUserAuthContents::reset ***********************

// Begin private functions


#pragma page "authenticateUser"
// *****************************************************************************
// *                                                                           *
// * Function: authenticateUser                                                *
// *                                                                           *
// *    Validates user is registered on Trafodion, and the username and        *
// *  password are valid on the directory server.                              *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <self>                          DBUserAuthContents &            In/Out   *
// *    is a reference to a DBUserAuthContents object.  Results of the         *
// *  authentication are stored here.                                          *
// *                                                                           *
// *  <externalUsername>              const char *                    In       *
// *    is the username.  Username must be registered (in AUTHS table) and     *
// *  defined on LDAP server.                                                  *
// *                                                                           *
// *  <password>                      const char *                    In       *
// *    is the password for username.  Password is authenticated on LDAP server*
// *                                                                           *
// *  <authenticationInfo             AUTHENTICATION_INFO &           Out      *
// *    passes back user and error data related to the authentication.         *
// *                                                                           *
// *  <client_info>                   const CLIENT_INFO &             In       *
// *    is the client related information needed for audit logging.            *
// *                                                                           *
// *  <performanceInfo>               PERFORMANCE_INFO &              Out      *
// *    passes back elapsed time for authentication suboperations.             *
// *                                                                           *
// *****************************************************************************

static void authenticateUser(
   DBUserAuthContents &  self,
   const char *          externalUsername,
   const char *          password,
   ClientContents &      clientInfo,
   AUTHENTICATION_INFO & authenticationInfo,
   PERFORMANCE_INFO &    performanceInfo)

{

   self.bb.isAuthenticated = false;

   long retCode;
   bool isValid;
   AuthConfigType authType;
   USERS_INFO usersInfo;

   char eventMsg[MAX_EVENT_MSG_SIZE];
   
   //
   // First step; is the user registered.  If not, no sense bothering the
   // LDAP server.
   //
   memset(usersInfo.databaseUsername,' ',sizeof(usersInfo.databaseUsername));
   strcpy(usersInfo.externalUsername,externalUsername);
   
   int64_t startTime = JULIANTIMESTAMP();

   retCode = fetchFromAUTHSTable(externalUsername,usersInfo.databaseUsername,
                                 usersInfo.sessionUserID,isValid,
                                 usersInfo.redefTime);                                   
   
   performanceInfo.sqlUserTime = JULIANTIMESTAMP() - startTime;
   if (retCode != 0)
   {
      authenticationInfo.error = self.bb.error = ZFIL_ERR_SECVIOL;
      // Error 100 (NOT FOUND) means user isn't a registered SQ user.
      // For now this is an error, in the future there could be an
      // option to auto-register users.
      if (retCode == 100)
         self.bb.errorDetail = UA_STATUS_ERR_INVALID;

      else//ACH Should we log other SQL errors here?
         self.bb.errorDetail = UA_STATUS_ERR_SYSTEM;

      authenticationInfo.errorDetail = self.bb.errorDetail;
      
      logAuthenticationOutcome(usersInfo.externalUsername,
                               usersInfo.databaseUsername,
                               usersInfo.sessionUserID,clientInfo,
                               (retCode = 100) ? AUTH_NOT_REGISTERED : AUTH_MD_NOT_AVAILABLE);
      return;
   }

   //
   // User is registered, but is the account still valid?  Users can be
   // marked offline by ALTER USER command or possibly in the future when
   // we detect a registered user is no longer defined on the directory server.
   //
   if (!isValid)
   {
      authenticationInfo.error = self.bb.error = ZFIL_ERR_SECVIOL;
      authenticationInfo.errorDetail = self.bb.errorDetail = UA_STATUS_ERR_INVALID;

      logAuthenticationOutcome(usersInfo.externalUsername,
                               usersInfo.databaseUsername,
                               usersInfo.sessionUserID,clientInfo,AUTH_USER_INVALID);
      return;
   }
   
   //
   // User is registered and valid, but is the authentication type recognized?  
   // If not, reject the authentication.
   //
   //ACH not in metadata currently.
/*
   if (authType == AuthUnknownConfiguration)
   {
      self.bb.error = ZFIL_ERR_SECVIOL;
      self.bb.errorDetail = UA_STATUS_ERR_INVALID;

      logAuthenticationOutcome(usersInfo.externalUsername,
                               usersInfo.databaseUsername,
                               usersInfo.sessionUserID,clientInfo,AUTH_USER_INVALID);
      return;
   }
*/      
   //
   // Let's check on the credentials first.
   //
   if (strlen(password) == 0)
   {
      // zero len password is a non-auth bind in LDAP, so we treat it
      // as a failed authorization
      authenticationInfo.error = self.bb.error = ZFIL_ERR_SECVIOL;
      authenticationInfo.errorDetail = self.bb.errorDetail = UA_STATUS_ERR_INVALID;
      logAuthenticationOutcome(usersInfo.externalUsername,
                               usersInfo.databaseUsername,
                               usersInfo.sessionUserID,clientInfo,AUTH_NO_PASSWORD);
      return;
   }

   LDAuthStatus authStatus = LDAuthSuccessful;
   
   //
   // Next step, see if the user is defined on the LDAP server.
   //

   //ACH For now, only support primary configuration   
   authStatus = executeLDAPAuthentication(self,usersInfo.externalUsername,
                                          password,
                                          LDAPConfigNode::PrimaryConfiguration,
                                          performanceInfo);
   

   //
   // If all is well, save all the relevant user data in our container.
   //
   if (authStatus == LDAuthSuccessful)
   {
      // Logging retries when the authentication was successful allows 
      // operations to be aware of potential problems.
      // Retries are logged later for unsuccessful authentications.
      logAuthenticationRetries(self.nodeID,externalUsername);

      // Strings returned from SQL could have trailing blanks and nulls
      // Remove all trailing blanks so callers have an accurate length
      // for comparison.
      stripAllTrailingBlanks(usersInfo.databaseUsername,256);
      //ACH copy from BB usersInfo to authenticationInfo.usersInfo?
      strcpy(authenticationInfo.usersInfo.databaseUsername,usersInfo.databaseUsername);
      strcpy(authenticationInfo.usersInfo.externalUsername,externalUsername);
      usersInfo.effectiveUserID = usersInfo.sessionUserID;      

      // Copy USERS_INFO fields.  Class, = operator, byte copy
      authenticationInfo.usersInfo.effectiveUserID = usersInfo.effectiveUserID; 
      authenticationInfo.usersInfo.sessionUserID = usersInfo.sessionUserID; 
      authenticationInfo.usersInfo.redefTime = usersInfo.redefTime; 
      authenticationInfo.error = ZFIL_ERR_OK; 
      authenticationInfo.errorDetail = UA_STATUS_OK; 
   

       // copy user info to black box
      self.bb.error = ZFIL_ERR_OK;
      self.bb.errorDetail = UA_STATUS_OK;
      self.bb.usersInfo.effectiveUserID = usersInfo.effectiveUserID;
      self.bb.usersInfo.sessionUserID = usersInfo.sessionUserID;
      self.bb.usersInfo.redefTime = usersInfo.redefTime;
      strcpy(self.bb.usersInfo.databaseUsername,usersInfo.databaseUsername);
      strcpy(self.bb.usersInfo.externalUsername,externalUsername);
      self.bb.isAuthenticated = true;

      // Log the successful authentication to the log repository.
      logAuthenticationOutcome(externalUsername,usersInfo.databaseUsername,
                               usersInfo.sessionUserID,clientInfo,AUTH_OK);

      return;
   }

   //
   // Rejected!
   //
   // Either the provided password does not match the one stored on the LDAP 
   // server or we had internal problems with the server.
   //
   // No soup for you.
   //

   authenticationInfo.error = ZFIL_ERR_SECVIOL; 
   self.bb.error = ZFIL_ERR_SECVIOL;
   if (authStatus == LDAuthRejected)
      self.bb.errorDetail = UA_STATUS_ERR_INVALID;
   else 
   {
      self.bb.errorDetail = UA_STATUS_ERR_SYSTEM;
   }
   authenticationInfo.errorDetail = self.bb.errorDetail; 

   // Log the failed authentication to the log repository.
   logAuthenticationOutcome(externalUsername,usersInfo.databaseUsername,
                            usersInfo.sessionUserID,clientInfo,
                           (authStatus = LDAuthRejected) ? AUTH_REJECTED : AUTH_FAILED);
   // Log any events generated
   logAuthenticationErrors(self.authEvents);

}
//************************** End of authenticateUser ***************************


// *****************************************************************************
// *                                                                           *
// * Function: cacheUserInfo                                                   *
// *                                                                           *
// *    Stores information for the user in local cache.                        *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <externalUsername>              const char *                    In       *
// *    is the external username.                                              *
// *                                                                           *
// *  <databaseUsername>              const char *                    In       *
// *    is the database username associated with the external username.        *
// *                                                                           *
// *  <userID>                        int32_t                         In       *
// *    passes back the numeric ID of the database user associated             *
// *  with the external username.                                              *
// *                                                                           *
// *  <isValid>                       bool                            In       *
// *    is true if the user is online, false if offline.                       *
// *                                                                           *
// *  <redefTime>                     int64_t                         In       *
// *    is the time the user record was last written.                          *
// *                                                                           * 
// *****************************************************************************
void cacheUserInfo(
   const char    * externalUsername,
   const char    * databaseUsername,
   int32_t         userID,
   bool            isValid,
   int64_t         redefTime)
   
{

UserCacheContents userInfo;

   strcpy(userInfo.externalUsername,externalUsername);
   strcpy(userInfo.databaseUsername,databaseUsername);
   userInfo.userID = userID;
   userInfo.isValid = isValid;
   userInfo.redefTime = redefTime;
   
   userCache.push_back(userInfo);
   
}
//*************************** End of cacheUserInfo *****************************


#pragma page "executeLDAPAuthentication"
// *****************************************************************************
// *                                                                           *
// * Function: executeLDAPAuthentication                                       *
// *                                                                           *
// *    Sends request to LDAP server (via LDAPConfigNode class) to authenticate*
// *  the provided username and password.                                      *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <self>                          DBUserAuthContents &            In/Out   *
// *    is a reference to a DBUserAuthContents object.  Results of the         *
// *    authentication are stored here.                                        *
// *                                                                           *
// *  <username>                      const char *                    In       *
// *    is the username.  Username must be  defined on LDAP server.            *
// *                                                                           *
// *  <password>                      const char *                    In       *
// *    is the password for username.  Password is authenticated on LDAP server*
// *                                                                           *
// *  <configType>                    LDAPConfigNode::LDAPConfigType  In       *
// *    is the LDAP configuration to use, either primary or secondary.         *
// *                                                                           *
// *****************************************************************************

static LDAuthStatus executeLDAPAuthentication(
   DBUserAuthContents &            self,
   const char *                    username,
   const char *                    password,
   LDAPConfigNode::LDAPConfigType  configType,
   PERFORMANCE_INFO &              performanceInfo)

{

   LDAPConfigNode::ClearRetryCounts();
   self.getAuthEvents().clear();
   
   //
   // First get a search connection for the specified configuration. 
   // If we can't get a search connection, could be network problem or a
   // bad configuration.  Either way, tough luck for the user.
   //

   int64_t startTime = JULIANTIMESTAMP();
   LDAPConfigNode *searchNode = LDAPConfigNode::GetLDAPConnection(self.authEvents,configType,
                                                               SearchConnection);

   performanceInfo.searchConnectionTime = JULIANTIMESTAMP() - startTime;

   char eventMsg[MAX_EVENT_MSG_SIZE];

   if (searchNode == NULL)
   {
      self.bb.error = ZFIL_ERR_SECVIOL;
      self.bb.errorDetail = UA_STATUS_ERR_SYSTEM;
      snprintf(eventMsg, MAX_EVENT_MSG_SIZE,
               "Failed to get LDAP connection for user %s",username);
      insertAuthEvent(self.authEvents,DBS_NO_LDAP_SEARCH_CONNECTION,eventMsg, LL_ERROR);

      return LDAuthResourceFailure;
   }

   string userDN = "";       // User DN, used to bind to LDAP serer

   startTime = JULIANTIMESTAMP();

   LDSearchStatus searchStatus = searchNode->lookupUser(self.authEvents,username,userDN);
                                                     
   performanceInfo.searchTime = JULIANTIMESTAMP() - startTime; 
                                                       
   if (searchStatus == LDSearchNotFound)
   {
      self.bb.error = ZFIL_ERR_SECVIOL;
      self.bb.errorDetail = UA_STATUS_ERR_INVALID;
      snprintf(eventMsg, MAX_EVENT_MSG_SIZE,
               "Failed LDAP search for user %s",username);
      insertAuthEvent(self.authEvents,DBS_NO_LDAP_SEARCH_CONNECTION,eventMsg, LL_ERROR);

      return LDAuthRejected;
   }

   if (searchStatus != LDSearchFound)
   {
      self.bb.error = ZFIL_ERR_SECVIOL;
      self.bb.errorDetail = UA_STATUS_ERR_SYSTEM;
      snprintf(eventMsg, MAX_EVENT_MSG_SIZE,
               "Failed LDAP search for user %s",username);
      insertAuthEvent(self.authEvents,DBS_NO_LDAP_SEARCH_CONNECTION,eventMsg, LL_ERROR);
      return LDAuthResourceFailure;
   }

   // (searchStatus == LDSearchFound)
   // ACH: Should we compare UUIDOnLDAP and dsUUID and give "not registered"
   //       (or some other) error if they don't match?

   //
   // User is defined here and there.  But is their password correct?
   // Let's get an authentication connection to check on the password
   //
   startTime = JULIANTIMESTAMP();

   LDAPConfigNode *authNode = LDAPConfigNode::GetLDAPConnection(self.authEvents,configType,
                                                             AuthenticationConnection);

   performanceInfo.authenticationConnectionTime = JULIANTIMESTAMP() - startTime;
   
   if (authNode == NULL)
   {
      self.bb.error = ZFIL_ERR_SECVIOL;
      self.bb.errorDetail = UA_STATUS_ERR_SYSTEM;
      snprintf(eventMsg, MAX_EVENT_MSG_SIZE,
               "Failed LDAP search on password for user %s",username);
      insertAuthEvent(self.authEvents,DBS_NO_LDAP_SEARCH_CONNECTION,eventMsg, LL_ERROR);
      return LDAuthResourceFailure;
   }

   //
   // Non-blank password, a user we know about, let's validate that password!
   //
   startTime = JULIANTIMESTAMP();

   LDAuthStatus authStatus = authNode->authenticateUser(self.authEvents,userDN.c_str(),password);
                                     
   performanceInfo.authenticationTime = JULIANTIMESTAMP() - startTime;
                                          
   return authStatus;                                       

}
//********************** End of executeLDAPAuthentication **********************

#pragma page "fetchFromAUTHSTable"
// *****************************************************************************
// *                                                                           *
// * Function: fetchFromAUTHSTable                                             *
// *                                                                           *
// *    Fetches the requested columns from the row of the AUTHS table          *
// * containing the provided external username.                                *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <externalUsername>              const char *                    In       *
// *    is the external username.                                              *
// *                                                                           *
// *  <databaseUsername>              char *                          Out      *
// *    passes back the database username associated with the external         *
// *  username.                                                                *
// *                                                                           *
// *  <userID>                        long &                          Out      *
// *    passes back the numeric ID of the database user associated             *
// *  with the external username.                                              *
// *                                                                           *
// *  <isValid>                       long *                          Out      *
// *    passes back the status (valid Y/N) of the database user associated     *
// *  with the external username.                                              *
// *                                                                           *
// *  <redefTime>                     int64_t &                       Out      *
// *                                                                           * 
// *****************************************************************************
// *                                                                           *
// * Returns: int32_t/SQL error code                                           *
// *                                                                           *
// *   0 - External username found, all return parameters set.                 *
// * 100 - External username not found.                                        *
// *   * - Query error                                                         *
// *                                                                           *
// *****************************************************************************
static int32_t fetchFromAUTHSTable(
   const char     * externalUsername,
   char           * databaseUsername,
   int32_t        & userID,
   bool           & isValid,
   int64_t        & redefTime)
   
{

const UserCacheContents *userInfo = fetchFromCacheByUsername(externalUsername);

   if (userInfo != NULL)
   {
      strcpy(databaseUsername,userInfo->databaseUsername);
      userID = userInfo->userID;
      isValid = userInfo->isValid;
      redefTime = userInfo->redefTime;
      return 0;
   }

ExeCliInterface cliInterface;
char stmt[2000]; 

   sprintf(stmt,"SELECT AUTH_TYPE,AUTH_ID,AUTH_DB_NAME,AUTH_IS_VALID,"
                "AUTH_REDEF_TIME"
//                ",AUTH_IS_IMMUTABLE"
//                ",AUTH_CONFIGURATION"
                " FROM %s.\"%s\".%s WHERE AUTH_EXT_NAME = '%s' ",
                "TRAFODION",SEABASE_MD_SCHEMA,SEABASE_AUTHS,externalUsername);
                
uint32_t savedParserFlags;
int32_t cliRC = 0;

   SQL_EXEC_GetParserFlagsForExSqlComp_Internal(savedParserFlags);
   
   try
   {
      SQL_EXEC_SetParserFlagsForExSqlComp_Internal(INTERNAL_QUERY_FROM_EXEUTIL);
      cliRC = cliInterface.fetchRowsPrologue(stmt,true/*no exec*/);
      SQL_EXEC_AssignParserFlagsForExSqlComp_Internal(savedParserFlags);
   }
   catch (...)
   {
      SQL_EXEC_AssignParserFlagsForExSqlComp_Internal(savedParserFlags);
      throw;
   }
   
   if (cliRC < 0)
      return cliRC;
  
   cliRC = cliInterface.clearExecFetchClose(NULL,0);
   if (cliRC < 0)
      return cliRC;

   if (cliRC == 100) // did not find the row
     return cliRC;

char *ptr = NULL;
int32_t len = 0;
   
   cliInterface.getPtrAndLen(1,ptr,len);
   if (ptr[0] != 'U')
      return 100;
      
   cliInterface.getPtrAndLen(2,ptr,len);
   userID = *reinterpret_cast<int32_t *>(ptr);

   cliInterface.getPtrAndLen(3,ptr,len);
   strncpy(databaseUsername,ptr,len);
   databaseUsername[len] = '\0';

   cliInterface.getPtrAndLen(4,ptr,len);
    
   if (ptr[0] == 'Y')
      isValid = true;
   else
      isValid = false;
       
   cliInterface.getPtrAndLen(5,ptr,len);
   redefTime = *reinterpret_cast<int64_t *>(ptr);
      
//ACH Add support for immutable users
/*   
   cliInterface.getPtrAndLen(6,ptr,len);
    
   if (ptr[0] == 'Y')
      cacheUserInfo(externalUsername,databaseUsername,userID,isValid,redefTime);
*/  
//ACH add support for configuration number
/*
   cliInterface.getPtrAndLen(7,ptr,len);
   configurationNumber = *reinterpret_cast<int32_t *>(ptr);
*/  
   cliInterface.fetchRowsEpilogue(NULL,true);
   return 0;
  
}
//************************* End of fetchFromAUTHSTable *************************


#pragma page "fetchFromAUTHSTable"
// *****************************************************************************
// *                                                                           *
// * Function: fetchFromAUTHSTable                                             *
// *                                                                           *
// *    Fetches the requested columns from the row of the AUTHS table          *
// * containing the provided database user ID.                                 *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <userID>                        int32_t                         In       *
// *    is the nummeric ID of the database user.                               *
// *                                                                           *
// *  <databaseUsername>              char *                          Out      *
// *    passes back the database username associated with the numeric user ID. *
// *                                                                           *
// *  <externalUsername>              char *                          Out      *
// *    passes back the external username associated with the numeric user ID. *
// *                                                                           *
// *  <isValid>                       bool &                          Out      *
// *    passes back the status of the database user associated with the        *
// *    numeric user ID.                                                       *
// *                                                                           *
// *  <redefTime>                     int64_t &                       Out      *
// *                                                                           * 
// *****************************************************************************
// *                                                                           *
// * Returns: int32_t/SQL error code                                           *
// *                                                                           *
// *   0 - External username found, all return parameters set.                 *
// * 100 - External username not found.                                        *
// *   * - Query error                                                         *
// *                                                                           *
// *****************************************************************************
static int32_t fetchFromAUTHSTable(
   int32_t          userID,
   char           * databaseUsername,
   char           * externalUsername,
   bool           & isValid,
   int64_t        & redefTime)
   
{

const UserCacheContents *userInfo = fetchFromCacheByUserID(userID);

   if (userInfo != NULL)
   {
      strcpy(databaseUsername,userInfo->databaseUsername);
      strcpy(externalUsername,userInfo->externalUsername);
      isValid = userInfo->isValid;
      redefTime = userInfo->redefTime;
      return 0;
   }

ExeCliInterface cliInterface;
char stmt[2000]; 

   sprintf(stmt,"SELECT AUTH_TYPE,AUTH_EXT_NAME,AUTH_DB_NAME,AUTH_IS_VALID,"
                "AUTH_REDEF_TIME"
//                ",AUTH_IS_IMMUTABLE"
                " FROM %s.\"%s\".%s WHERE AUTH_ID = %ld ",
                "TRAFODION",SEABASE_MD_SCHEMA,SEABASE_AUTHS,userID);

uint32_t savedParserFlags;
int32_t cliRC = 0;

   SQL_EXEC_GetParserFlagsForExSqlComp_Internal(savedParserFlags);

   try
   {
      SQL_EXEC_SetParserFlagsForExSqlComp_Internal(INTERNAL_QUERY_FROM_EXEUTIL);
      int32_t cliRC = cliInterface.fetchRowsPrologue(stmt,true/*no exec*/);
      SQL_EXEC_AssignParserFlagsForExSqlComp_Internal(savedParserFlags);
   }
   catch (...)
   {
      SQL_EXEC_AssignParserFlagsForExSqlComp_Internal(savedParserFlags);
      throw;
   }

   if (cliRC < 0)
      return cliRC;

   cliRC = cliInterface.clearExecFetchClose(NULL,0);
   if (cliRC < 0)
      return cliRC;

   if (cliRC == 100) // did not find the row
     return cliRC;

char *ptr = NULL;
int32_t len = 0;
   
   cliInterface.getPtrAndLen(1,ptr,len);
   if (ptr[0] != 'U')
      return 100;
      
   cliInterface.getPtrAndLen(2,ptr,len);
   strncpy(externalUsername,ptr,len);
   databaseUsername[len] = '\0';

   cliInterface.getPtrAndLen(3,ptr,len);
   strncpy(databaseUsername,ptr,len);
   databaseUsername[len] = '\0';

   cliInterface.getPtrAndLen(4,ptr,len);
    
   if (ptr[0] == 'Y')
      isValid = true;
   else
      isValid = false;
       
   cliInterface.getPtrAndLen(5,ptr,len);
   redefTime = *reinterpret_cast<int64_t *>(ptr);
//ACH Add support for immutable users
/*   
   cliInterface.getPtrAndLen(6,ptr,len);
    
   if (ptr[0] == 'Y')
      cacheUserInfo(externalUsername,databaseUsername,userID,isValid,redefTime);
*/    
   cliInterface.fetchRowsEpilogue(NULL,true);
   return 0;
  
}
//************************* End of fetchFromAUTHSTable *************************


// *****************************************************************************
// *                                                                           *
// * Function: fetchFromCacheByUsername                                        *
// *                                                                           *
// *    Searches local cache for user information.  If found, a record with    *
// * the data is returned, otherwise NULL is returned.                         *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <externalUsername>              const char *                    In       *
// *    is the external username to search for in cache.                       *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// * Returns: const UserCacheContents *                                        *
// *                                                                           *
// *     NULL - External username not found in cache.                          *
// * Not NULL - External username was found, cached record returned.           *
// *                                                                           *
// *****************************************************************************
inline static const UserCacheContents * fetchFromCacheByUsername(const char * externalUsername)

{

size_t cacheCount = userCache.size();
char upperUsername[129] = {0};

   upshiftString(externalUsername,upperUsername);

   for (size_t index = 0; index < cacheCount; index++)
      if (strcmp(userCache[index].externalUsername,upperUsername) == 0)
         return &userCache[index]; 
   
   return NULL;

}
//********************** End of fetchFromCacheByUsername ***********************


// *****************************************************************************
// *                                                                           *
// * Function: fetchFromCacheByUserID                                          *
// *                                                                           *
// *    Searches local cache for user information.  If found, a record with    *
// * the data is returned, otherwise NULL is returned.                         *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <userID>                        long                            In       *
// *    is the database userID to search for in cache.                         *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// * Returns: const UserCacheContents *                                        *
// *                                                                           *
// *     NULL - Database userID not found in cache.                            *
// * Not NULL - Database userID was found, cached record returned.             *
// *                                                                           *
// *****************************************************************************
inline static const UserCacheContents * fetchFromCacheByUserID(long userID)

{

size_t cacheCount = userCache.size();

   for (size_t index = 0; index < cacheCount; index++)
      if (userCache[index].userID == userID)
         return &userCache[index]; 
   
   return NULL;

}
//*********************** End of fetchFromCacheByUserID ************************


#pragma page "logAuthenticationErrors"
// *****************************************************************************
// *                                                                           *
// * Function: logAuthenticationErrors                                         *
// *                                                                           *
// * Logs resource failure errors encountered during authentication.           *
// * Resource failure errors include problems with the                         *
// * configuration in .traf_authrntication_config, network issues,             *
// * LDAP server issues, or coding blunders.                                   *
// *                                                                           *
// * Resource failures have already been inserted into authEvents structure    *
// *                                                                           *
// *****************************************************************************
static void logAuthenticationErrors(std::vector<AuthEvent> &authEvents)

{
   size_t errorCount = authEvents.size();

   for (size_t i = 0; i < errorCount; i++)
   {
     AuthEvent authEvent = authEvents[i];
     authEvent.setCallerName("mxosrvr");
     authEvent.logAuthEvent();
   }
}
//************************ End of logAuthenticationErrors **********************

#pragma page "logAuthenticationOutcome"
// *****************************************************************************
// *                                                                           *
// * Function: logAuthenticationOutcome                                        *
// *                                                                           *
// *    Logs the outcome.                                                      *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <external_user_name>            string &                        In       *
// *    is the external username.                                              *
// *                                                                           *
// *  <internal_user_name>            string &                        In       *
// *    internal user name                                                     *
// *                                                                           *
// *  <userID>                        long                            In       *
// *    is the numeric ID of the database user associated                      *
// *  with the external username.                                              *
// *                                                                           *
// *  <outcome>                       string &                        In       *
// *    the outcome of the authentication                                      *
// *                                                                           *
// *****************************************************************************
static void logAuthenticationOutcome(
   const string       & external_user_name,
   const string       & internal_user_name,
   const int32_t        user_id,
   ClientContents     & clientInfo,
   const AUTH_OUTCOME   outcome)
   
{
   string internalUser("??");
   if (user_id > 0) 
     internalUser = internal_user_name; 
   logLevel severity = (outcome == AUTH_FAILED) ? LL_ERROR : LL_INFO; 

   // Currently this code has hard coded error messages in many places, this
   // need to be fixed in order to allow errors to be reported in different 
   // languages.
   string outcomeDesc = getAuthOutcome(outcome);
   
   char buf[MAX_EVENT_MSG_SIZE];
   snprintf(buf, MAX_EVENT_MSG_SIZE,
                "Authentication request: externalUser %s, "
                "databaseUser %s, userID %u, "
                "clientName %s, clientUserName %s, "
                "result %d (%s)",
                external_user_name.c_str(), 
                internalUser.c_str(), user_id,
                clientInfo.clientName, clientInfo.clientUserName,
                (int)outcome, outcomeDesc.c_str());
   std::string msg(buf);
   AuthEvent authEvent (DBS_AUTHENTICATION_ATTEMPT,msg,severity); 
   authEvent.setCallerName("mxosrvr");
   authEvent.logAuthEvent();
}
//*********************** End of logAuthenticationOutcome **********************


#pragma page "logAuthenticationRetries"
// *****************************************************************************
// *                                                                           *
// * Function: logAuthenticationRetries                                        *
// *                                                                           *
// *    Logs retries encountered during authentication.                        *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <nodeID>                        int                             In       *
// *    is the ID of the node this process is executing on.  The node ID is    *
// *  needed to log to the EVENT_TEXT_TABLE table.                             *
// *                                                                           *
// *  <username>                      char *                          In       *
// *    is the name of the user that we attempted to authenticate.             *
// *                                                                           *
// *****************************************************************************
static void logAuthenticationRetries(
   int          nodeID,
   const char * username)

{
   size_t bindRetryCount = LDAPConfigNode::GetBindRetryCount();
   size_t searchRetryCount = LDAPConfigNode::GetSearchRetryCount();

   // If there were no retries, there is nothing to log.  
   if (bindRetryCount == 0 && searchRetryCount == 0)
      return;
      
   char buf[MAX_EVENT_MSG_SIZE];

   // Log if the search (name lookup) operation had to be retried.          
   if (searchRetryCount > 0)
   { 
      snprintf(buf,MAX_EVENT_MSG_SIZE,
               "Authentication for user %s required %d search retries. ",
              username,searchRetryCount);
       
      std::string msg(buf);
      AuthEvent authEvent (DBS_AUTH_RETRY_SEARCH, msg, LL_INFO);
      authEvent.setCallerName("mxosrvr");
      authEvent.logAuthEvent();
   }
   
   // Log if the bind (password authentication) operation had to be retried.          
   if (bindRetryCount > 0)
   { 
      snprintf(buf,MAX_EVENT_MSG_SIZE,
               "Authentication for user %s required %d bind retries. ",
              username,bindRetryCount);
       
      std::string msg(buf);
      AuthEvent authEvent (DBS_AUTH_RETRY_BIND, msg, LL_INFO);
      authEvent.setCallerName("mxosrvr");
      authEvent.logAuthEvent();
   }
}
//*********************** End of logAuthenticationRetries **********************


#pragma page "logToEventTable"
// *****************************************************************************
// *                                                                           *
// * Function: logToEventTable                                                 *
// *                                                                           *
// *    Logs to the EVENT_TEXT_TABLE table in the INSTANCE_REPOSITORY schema.  *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <nodeID>                        int                             In       *
// *    is the ID of the node this process is executing on.                    *
// *                                                                           *
// *  <eventID>                       DB_SECURITY_EVENTID             In       *
// *    is the ID of the event to be logged.                                   *
// *                                                                           *
// *  <severity>                      posix_sqlog_severity_t          In       *
// *    is the severity of the event.                                          *
// *                                                                           *
// *  <msg>                           char *                          In       *
// *    is the message text to be logged.                                      *
// *                                                                           *
// *****************************************************************************
static void logToEventTable(
   int                    nodeID,
   DB_SECURITY_EVENTID    eventID, 
   posix_sqlog_severity_t severity, 
   const char *           msg)

{
}
//**************************** End of logToEventTable **************************


#pragma page "prepareUserNameForQuery"
// *****************************************************************************
// *                                                                           *
// * Function: prepareUserNameForQuery                                         *
// *                                                                           *
// *    Converts a username into uppercase and escapes any single quote        *
// * chars to match SQL string literal rules (by replacing each single         *
// *  quote char with a pair of single quote chars).                           *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <nameForQuery>                  char *                          Out      *
// *    is the converted username.                                             *
// *                                                                           *
// *  <extName>                       const char *                    In       *
// *    is the external username to be converted.                              *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// * Returns: int                                                              *
// *                                                                           *
// *  0  - Validation successful.                                              *
// * 22  - Bounds error.  Number of param in error returned in status.         *
// * 590 - NULL param.  Number of param in error returned in status.           *
// *                                                                           *
// *****************************************************************************
static void prepareUserNameForQuery(
   char       * nameForQuery,
   const char * extName)

{

   while (*extName != '\0')
   {
      if (*extName == '\'')
      {
         // replace original single quote with a pair of single quotes
         *(nameForQuery++) = '\'';
         *(nameForQuery++) = '\'';
      }
      else
         *(nameForQuery++) = toupper(*extName);

      extName++;
   }
   *nameForQuery = '\0';

}
//*********************** End of prepareUserNameForQuery ***********************

#pragma page "stripAllTrailingBlanks"
// *****************************************************************************
// *                                                                           *
// * Function: stripAllTrailingBlanks                                          *
// *                                                                           *
// *  Removes trailing blanks (replaces with null). String may have embedded   *
// *  NULLs; trailing blanks are replaced with NULL until first non-blank,     *
// *  non-null character.                                                      *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <buf>                          char *                           In/Out   *
// *    is a character buffer whose trailing blanks are to be trimmed.         *
// *                                                                           *
// *  <len>                          size_t                           In       *
// *    is the size of <buf>.                                                  *
// *                                                                           *
// *                                                                           *
// *                                                                           *
// *****************************************************************************
static void stripAllTrailingBlanks(
   char   * buf,
   size_t   len)

{

char *ptr = &buf[len];

    while (*ptr == ' ' || *ptr == 0)
    {
       *ptr = 0;
       ptr--;
    }

}
//****************** End of trimLeadingandTrailingBlanks ***********************

#pragma page "timeDiff"
// *****************************************************************************
// *                                                                           *
// * Function: timeDiff                                                        *
// *                                                                           *
// *  Find the difference between two timestamps                               *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <t1>                          timespec                          In       *
// *    First timestamp                                                        *
// *                                                                           *
// *  <t2>                          timespec                          In       *
// *    Second timestamp                                                       *
// *                                                                           *
// *  <tDiff>                       timespec                          Out      *
// *    Difference between t1 and t2                                           *
// *****************************************************************************

static void timeDiff (
   struct timespec t1,
   struct timespec t2,
   struct timespec &tDiff)

{
   if ( (t2.tv_nsec - t1.tv_nsec )  < 0 )
   {
      tDiff.tv_sec = t2.tv_sec - t1.tv_sec - 1;
      tDiff.tv_nsec = 1000000000 + t2.tv_nsec - t1.tv_nsec;
   }
   else
   {
      tDiff.tv_sec = t2.tv_sec - t1.tv_sec;
        tDiff.tv_nsec = t2.tv_nsec - t1.tv_nsec;
   }
}
//*************************** End of timeDiff **********************************

// *****************************************************************************
// *                                                                           *
// * Function: upshiftString                                                   *
// *                                                                           *
// *  Convert all characters of a string to upper case.                        *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <inputString>                 const char *                      In       *
// *    is the string to be converted to upper case.                           *
// *                                                                           *
// *  <outputString>                char *                            Out      *
// *    passes back the converted string.                                      *
// *                                                                           *
// *****************************************************************************
inline static void upshiftString(
   const char * inputString,
   char       * outputString)
   
{

   while (*inputString != '\0')
   {
      *(outputString++) = toupper(*inputString);

      inputString++;
   }
   *outputString = '\0';

}
//************************* End of upshiftString *******************************

// *****************************************************************************
// *                                                                           *
// * Function: writeLog                                                        *
// *                                                                           *
// *  Logging for testing ODBC authentications.                                *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <text>                        const char *                      In       *
// *    is the string to be written to the log file.                           *
// *                                                                           *
// *****************************************************************************
static void writeLog(const char * text)

{
}
//*************************** End of writeLog **********************************