Chapter 6

Writing Pre/Post-Operation Plug-ins

This chapter explains how to write functions that the Red Hat Directory Server (Directory Server) calls before and after executing an LDAP operation. These functions are called pre-operation and post-operation plug-in functions.

How Pre/Post-Operation Plug-ins Work

The Directory Server can perform the following LDAP operations: bind, unbind, search, modify, add, delete, modifyRDN, compare, and abandon.


Note	The Directory Server can also perform extended operations as defined in the LDAPv3 protocol. For information on implementing plug-in functions to execute extended operations, see Chapter 10, "Writing Extended Operation Plug-ins."

You can configure the Directory Server to call your custom plug-in functions before and after executing any of these LDAP operations.

For example, you can write a pre-operation function that validates an entry before the server performs an LDAP add operation. An example of a post-operation plug-in function would be one that sends a notification to a user after their entry has been modified by an LDAP modify operation.

You can also set up the Directory Server to call your own plug-in functions before and after:

Sending an LDAP entry back to the client.
Sending an LDAP result code back to the client.
Sending an LDAP referral back to the client.

Figure 6-1 illustrates how the Directory Server front-end calls pre-operation and post-operation functions before and after executing an LDAP operation.

When processing a request, the Directory Server will call all registered pre-operation functions before it calls the backend to service the request. All pre-operation functions must return before the front-end calls the associated backend function.

Figure 6-1 Calling Pre-Operation and Post-Operation Plug-in Functions

Types of Pre-Operation and Post-Operation Functions

As is the case with other server plug-in functions, pre-operation functions and post-operation functions are specified in a parameter block that you can set on server startup. Each function corresponds to an ID in the parameter block. In your initialization function, you can call the slapi_pblock_set() function to specify the name of your function that corresponds to the pre-operation or post-operation function. For more information on the parameter block, see "Getting Data from the Parameter Block," on page 39.

Types of Pre-Operation Functions

Table 6-1 lists the Directory Server pre-operation functions and the purpose of each function.

Table 6-1 Functions Called before the Directory Server Executes an Operation
ID in Parameter Block	Description
SLAPI_PLUGIN_PRE_BIND_FN	Specifies the function called before the Directory Server executes an LDAP bind operation. For information on writing this type of function, see "Processing an LDAP Bind Operation," on page 86.
SLAPI_PLUGIN_PRE_UNBIND_FN	Specifies the function called before the Directory Server executes an LDAP unbind operation. For information on writing this type of function, see "Processing an LDAP Unbind Operation," on page 87.
SLAPI_PLUGIN_PRE_SEARCH_FN	Specifies the function called before the Directory Server executes an LDAP search operation. For information on writing this type of function, see "Processing an LDAP Search Operation," on page 88.
SLAPI_PLUGIN_PRE_COMPARE_FN	Specifies the function called before the Directory Server executes an LDAP compare operation. For information on writing this type of function, see "Processing an LDAP Compare Operation," on page 92.
SLAPI_PLUGIN_PRE_ADD_FN	Specifies the function called before the Directory Server executes an LDAP add operation. For information on writing this type of function, see "Processing an LDAP Add Operation," on page 92.
SLAPI_PLUGIN_PRE_MODIFY_FN	Specifies the function called before the Directory Server executes an LDAP modify operation. For information on writing this type of function, see "Processing an LDAP Modify Operation," on page 94.
SLAPI_PLUGIN_PRE_MODRDN_FN	Specifies the function called before the Directory Server executes an LDAP modifyRDN operation. For information on writing this type of function, see "Processing an LDAP Modify RDN Operation," on page 95.
SLAPI_PLUGIN_PRE_DELETE_FN	Specifies the function called before the Directory Server executes an LDAP delete operation. For information on writing this type of function, see "Processing an LDAP Delete Operation," on page 97.
SLAPI_PLUGIN_PRE_ABANDON_FN	Specifies the function called before the Directory Server executes an LDAP abandon operation. For information on writing this type of function, see "Processing an LDAP Abandon Operation," on page 97.
SLAPI_PLUGIN_PRE_ENTRY_FN	Specifies the function called before the Directory Server sends an entry back to the client (for example, when you call slapi_send_ldap_search_entry(), the pre-operation entry function is called before the entry is sent back to the client).
SLAPI_PLUGIN_PRE_REFERRAL_FN	Specifies the function called before the Directory Server sends a referral back to the client (for example, when you call slapi_str2filter(), the pre-operation referral function is called before the referral is sent back to the client).
SLAPI_PLUGIN_PRE_RESULT_FN	Specifies the function called before the Directory Server sends a result code back to the client (for example, when you call slapi_send_ldap_result(), the pre-operation result function is called before the result code is sent back to the client).

Types of Post-Operation Functions

Table 6-2 lists the Directory Server post-operation functions and the purpose of each function.

Table 6-2 Functions Called after the Directory Server Executes an Operation
ID in Parameter Block	Description
SLAPI_PLUGIN_POST_BIND_FN	Specifies the function called after the Directory Server executes an LDAP bind operation. For information on writing this type of function, see "Processing an LDAP Bind Operation," on page 86.
SLAPI_PLUGIN_POST_UNBIND_FN	Specifies the function called after the Directory Server executes an LDAP unbind operation. For information on writing this type of function, see "Processing an LDAP Unbind Operation," on page 87.
SLAPI_PLUGIN_POST_SEARCH_FN	Specifies the function called after the Directory Server executes an LDAP search operation. For information on writing this type of function, see "Processing an LDAP Search Operation," on page 88.
SLAPI_PLUGIN_POST_COMPARE_FN	Specifies the function called after the Directory Server executes an LDAP compare operation. For information on writing this type of function, see "Processing an LDAP Compare Operation," on page 92.
SLAPI_PLUGIN_POST_ADD_FN	Specifies the function called after the Directory Server executes an LDAP add operation. For information on writing this type of function, see "Processing an LDAP Add Operation," on page 92.
SLAPI_PLUGIN_POST_MODIFY_FN	Specifies the function called after the Directory Server executes an LDAP modify operation. For information on writing this type of function, see "Processing an LDAP Modify Operation," on page 94.
SLAPI_PLUGIN_POST_MODRDN_FN	Specifies the function called after the Directory Server executes an LDAP modifyRDN operation. For information on writing this type of function, see "Processing an LDAP Modify RDN Operation," on page 95.
SLAPI_PLUGIN_POST_DELETE_FN	Specifies the function called after the Directory Server executes an LDAP delete operation. For information on writing this type of function, see "Processing an LDAP Delete Operation," on page 97.
SLAPI_PLUGIN_POST_ABANDON_FN	Specifies the function called after the Directory Server executes an LDAP abandon operation. For information on writing this type of function, see "Processing an LDAP Abandon Operation," on page 97.
SLAPI_PLUGIN_POST_ENTRY_FN	Specifies the function called after the Directory Server sends an entry back to the client (for example, when you call slapi_send_ldap_search_entry(), the post-operation entry function is called after the entry is sent back to the client).
SLAPI_PLUGIN_POST_REFERRAL_FN	Specifies the function called after the Directory Server sends a referral back to the client (for example, when you call slapi_str2filter(), the post-operation referral function is called after the referral is sent back to the client).
SLAPI_PLUGIN_POST_RESULT_FN	Specifies the function called after the Directory Server sends a result code back to the client (for example, when you call slapi_send_ldap_result(), the post-operation result function is called after the result code is sent back to the client).

Registering Pre/Post-Operation Functions

To register your pre-operation and post-operation plug-in functions, you need to write an initialization function and then configure the server to load your plug-in. For details, follow the procedures outlined in "Writing Plug-in Initialization Functions," on page 42, and "Configuring Plug-ins," on page 47.