git.sur5r.net Git - openldap/blob - clients/tools/ldappasswd.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6
   7 #include "portable.h"
   8
   9 #include <stdio.h>
  10
  11 #include <ac/stdlib.h>
  12
  13 #include <ac/ctype.h>
  14 #include <ac/signal.h>
  15 #include <ac/socket.h>
  16 #include <ac/string.h>
  17 #include <ac/time.h>
  18 #include <ac/unistd.h>
  19
  20 #include <ldap.h>
  21
  22 #include "ldap_defaults.h"
  23
  24 static int      verbose = 0;
  25
  26 static void
  27 usage(const char *s)
  28 {
  29         fprintf(stderr,
  30 "Change the password of an LDAP entry\n\n"
  31 "usage: %s [options] dn\n"
  32 "       dn: the DN of the entry whose password must be changed\n"
  33 "options:\n"
  34 "       -a secret\told password\n"
  35 "       -A\t\tprompt for old password\n"
  36 "       -d level\tdebugging level\n"
  37 "       -C\t\tchase referrals\n"
  38 "       -D binddn\tbind DN\n"
  39 "       -E\t\trequest SASL privacy (-EE to make it critical)\n"
  40 "       -h host\t\tLDAP server (default: localhost)\n"
  41 "       -I\t\trequest SASL integrity checking (-II to make it\n"
  42 "               \tcritical)\n"
  43 "       -n\t\tmake no modifications\n"
  44 "       -p port\t\tport on LDAP server\n"
  45 "       -S\t\tprompt for new password\n"
  46 "       -s secret\tnew password\n"
  47 "       -U user\t\tSASL authentication identity (username)\n"
  48 "       -v\t\tverbose mode\n"
  49 "       -w passwd\tbind password (for simple authentication)\n"
  50 "       -W\t\tprompt for bind password\n"
  51 "       -X id\t\tSASL authorization identity (\"dn:<dn>\" or \"u:<user>\")\n"
  52 "       -Y mech\t\tSASL mechanism\n"
  53 "       -Z\t\tissue Start TLS request (-ZZ to require successful response)\n"
  54                 , s );
  55
  56         exit( EXIT_FAILURE );
  57 }
  58
  59 int
  60 main( int argc, char *argv[] )
  61 {
  62         int rc;
  63         char    *ldaphost = NULL;
  64
  65         char    *dn = NULL;
  66         char    *binddn = NULL;
  67
  68         struct berval passwd = { 0, NULL};
  69         char    *newpw = NULL;
  70         char    *oldpw = NULL;
  71
  72         int             want_bindpw = 0;
  73         int             want_newpw = 0;
  74         int             want_oldpw = 0;
  75
  76         int             noupdates = 0;
  77         int             i;
  78         int             ldapport = 0;
  79         int             debug = 0;
  80         int             version = -1;
  81         int             authmethod = LDAP_AUTH_SIMPLE;
  82 #ifdef HAVE_CYRUS_SASL
  83         char            *sasl_authc_id = NULL;
  84         char            *sasl_authz_id = NULL;
  85         char            *sasl_mech = NULL;
  86         int             sasl_integrity = 0;
  87         int             sasl_privacy = 0;
  88 #endif
  89         int             use_tls = 0;
  90         int             referrals = 0;
  91         LDAP           *ld;
  92         struct berval *bv = NULL;
  93
  94         char    *retoid;
  95         struct berval *retdata;
  96
  97         if (argc == 1)
  98                 usage (argv[0]);
  99
 100         while( (i = getopt( argc, argv,
 101                 "Aa:CD:d:EIh:np:Ss:U:vWw:X:Y:Z" )) != EOF )
 102         {
 103                 switch (i) {
 104                 case 'A':       /* prompt for oldr password */
 105                         want_oldpw++;
 106                         break;
 107                 case 'a':       /* old password (secret) */
 108                         oldpw = strdup (optarg);
 109
 110                         {
 111                                 char* p;
 112
 113                                 for( p = optarg; *p == '\0'; p++ ) {
 114                                         *p = '*';
 115                                 }
 116                         }
 117                         break;
 118                 case 'C':
 119                         referrals++;
 120                         break;
 121                 case 'D':       /* bind distinguished name */
 122                         binddn = strdup (optarg);
 123                         break;
 124
 125                 case 'd':       /* debugging option */
 126                         debug |= atoi (optarg);
 127                         break;
 128
 129                 case 'h':       /* ldap host */
 130                         ldaphost = strdup (optarg);
 131                         break;
 132
 133                 case 'n':       /* don't update entry(s) */
 134                         noupdates++;
 135                         break;
 136
 137                 case 'p':       /* ldap port */
 138                         ldapport = strtol( optarg, NULL, 10 );
 139                         break;
 140
 141                 case 'S':       /* prompt for user password */
 142                         want_newpw++;
 143                         break;
 144
 145                 case 's':       /* new password (secret) */
 146                         newpw = strdup (optarg);
 147                         {
 148                                 char* p;
 149
 150                                 for( p = optarg; *p == '\0'; p++ ) {
 151                                         *p = '*';
 152                                 }
 153                         }
 154                         break;
 155
 156                 case 'v':       /* verbose */
 157                         verbose++;
 158                         break;
 159
 160                 case 'W':       /* prompt for bind password */
 161                         want_bindpw++;
 162                         break;
 163
 164                 case 'w':       /* bind password */
 165                         passwd.bv_val = strdup (optarg);
 166                         {
 167                                 char* p;
 168
 169                                 for( p = optarg; *p == '\0'; p++ ) {
 170                                         *p = '*';
 171                                 }
 172                         }
 173                         passwd.bv_len = strlen( passwd.bv_val );
 174                         break;
 175
 176                 case 'I':
 177 #ifdef HAVE_CYRUS_SASL
 178                         sasl_integrity++;
 179                         authmethod = LDAP_AUTH_SASL;
 180 #else
 181                         fprintf( stderr, "%s was not compiled with SASL "
 182                                 "support\n", argv[0] );
 183                         return( EXIT_FAILURE );
 184 #endif
 185                         break;
 186                 case 'E':
 187 #ifdef HAVE_CYRUS_SASL
 188                         sasl_privacy++;
 189                         authmethod = LDAP_AUTH_SASL;
 190 #else
 191                         fprintf( stderr, "%s was not compiled with SASL "
 192                                 "support\n", argv[0] );
 193                         return( EXIT_FAILURE );
 194 #endif
 195                         break;
 196                 case 'Y':
 197 #ifdef HAVE_CYRUS_SASL
 198                         if ( strcasecmp( optarg, "any" ) &&
 199                                         strcmp( optarg, "*" ) ) {
 200                                 sasl_mech = strdup( optarg );
 201                         }
 202                         authmethod = LDAP_AUTH_SASL;
 203 #else
 204                         fprintf( stderr, "%s was not compiled with SASL "
 205                                 "support\n", argv[0] );
 206                         return( EXIT_FAILURE );
 207 #endif
 208                         break;
 209                 case 'U':
 210 #ifdef HAVE_CYRUS_SASL
 211                         sasl_authc_id = strdup( optarg );
 212                         authmethod = LDAP_AUTH_SASL;
 213 #else
 214                         fprintf( stderr, "%s was not compiled with SASL "
 215                                 "support\n", argv[0] );
 216                         return( EXIT_FAILURE );
 217 #endif
 218                         break;
 219                 case 'X':
 220 #ifdef HAVE_CYRUS_SASL
 221                         sasl_authz_id = strdup( optarg );
 222                         authmethod = LDAP_AUTH_SASL;
 223 #else
 224                         fprintf( stderr, "%s was not compiled with SASL "
 225                                 "support\n", argv[0] );
 226                         return( EXIT_FAILURE );
 227 #endif
 228                         break;
 229                 case 'Z':
 230 #ifdef HAVE_TLS
 231                         use_tls++;
 232 #else
 233                         fprintf( stderr, "%s was not compiled with TLS "
 234                                 "support\n", argv[0] );
 235                         return( EXIT_FAILURE );
 236 #endif
 237                         break;
 238
 239                 default:
 240                         usage (argv[0]);
 241                 }
 242         }
 243
 244         if( argc - optind != 1 ) {
 245                 usage( argv[0] );
 246         }
 247
 248         dn = strdup( argv[optind] );
 249
 250         if( want_oldpw && oldpw == NULL ) {
 251                 /* prompt for old password */
 252                 char *ckoldpw;
 253                 newpw = strdup(getpassphrase("Old password: "));
 254                 ckoldpw = getpassphrase("Re-enter old password: ");
 255
 256                 if( newpw== NULL || ckoldpw == NULL ||
 257                         strncmp( oldpw, ckoldpw, strlen(oldpw) ))
 258                 {
 259                         fprintf( stderr, "passwords do not match\n" );
 260                         return EXIT_FAILURE;
 261                 }
 262         }
 263
 264         if( want_newpw && newpw == NULL ) {
 265                 /* prompt for new password */
 266                 char *cknewpw;
 267                 newpw = strdup(getpassphrase("New password: "));
 268                 cknewpw = getpassphrase("Re-enter new password: ");
 269
 270                 if( newpw== NULL || cknewpw == NULL ||
 271                         strncmp( newpw, cknewpw, strlen(newpw) ))
 272                 {
 273                         fprintf( stderr, "passwords do not match\n" );
 274                         return EXIT_FAILURE;
 275                 }
 276         }
 277
 278         if( binddn == NULL && dn != NULL ) {
 279                 binddn = dn;
 280                 dn = NULL;
 281
 282                 if( passwd.bv_val == NULL ) {
 283                         passwd.bv_val = oldpw;
 284                         passwd.bv_len = oldpw == NULL ? 0 : strlen( oldpw );
 285                 }
 286         }
 287
 288         if (want_bindpw && passwd.bv_val == NULL ) {
 289                 /* handle bind password */
 290                 fprintf( stderr, "Bind DN: %s\n", binddn );
 291                 passwd.bv_val = strdup( getpassphrase("Enter bind password: "));
 292                 passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
 293         }
 294
 295         if ( debug ) {
 296                 if( ber_set_option( NULL, LBER_OPT_DEBUG_LEVEL, &debug ) != LBER_OPT_SUCCESS ) {
 297                         fprintf( stderr, "Could not set LBER_OPT_DEBUG_LEVEL %d\n", debug );
 298                 }
 299                 if( ldap_set_option( NULL, LDAP_OPT_DEBUG_LEVEL, &debug ) != LDAP_OPT_SUCCESS ) {
 300                         fprintf( stderr, "Could not set LDAP_OPT_DEBUG_LEVEL %d\n", debug );
 301                 }
 302         }
 303
 304 #ifdef SIGPIPE
 305         (void) SIGNAL( SIGPIPE, SIG_IGN );
 306 #endif
 307
 308         /* connect to server */
 309         if ((ld = ldap_init( ldaphost, ldapport )) == NULL) {
 310                 perror("ldap_init");
 311                 return EXIT_FAILURE;
 312         }
 313
 314         /* referrals */
 315         if (ldap_set_option( ld, LDAP_OPT_REFERRALS,
 316                 referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
 317         {
 318                 fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
 319                         referrals ? "on" : "off" );
 320                 return EXIT_FAILURE;
 321         }
 322
 323         /* LDAPv3 only */
 324         version = 3;
 325         rc = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version );
 326
 327         if(rc != LDAP_OPT_SUCCESS ) {
 328                 fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n", version );
 329         }
 330
 331         if ( use_tls && ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS ) {
 332                 if ( use_tls > 1 ) {
 333                         ldap_perror( ld, "ldap_start_tls" );
 334                         return( EXIT_FAILURE );
 335                 }
 336                 fprintf( stderr, "WARNING: could not start TLS\n" );
 337         }
 338
 339         if ( authmethod == LDAP_AUTH_SASL ) {
 340 #ifdef HAVE_CYRUS_SASL
 341                 int     minssf = 0, maxssf = 0;
 342
 343                 if ( sasl_integrity > 0 )
 344                         maxssf = 1;
 345                 if ( sasl_integrity > 1 )
 346                         minssf = 1;
 347                 if ( sasl_privacy > 0 )
 348                         maxssf = 100000; /* Something big value */
 349                 if ( sasl_privacy > 1 )
 350                         minssf = 56;
 351
 352                 if ( ldap_set_option( ld, LDAP_OPT_X_SASL_MINSSF,
 353                                 (void *)&minssf ) != LDAP_OPT_SUCCESS ) {
 354                         fprintf( stderr, "Could not set LDAP_OPT_X_SASL_MINSSF"
 355                                 "%d\n", minssf);
 356                         return( EXIT_FAILURE );
 357                 }
 358                 if ( ldap_set_option( ld, LDAP_OPT_X_SASL_MAXSSF,
 359                                 (void *)&maxssf ) != LDAP_OPT_SUCCESS ) {
 360                         fprintf( stderr, "Could not set LDAP_OPT_X_SASL_MAXSSF"
 361                                 "%d\n", maxssf);
 362                         return( EXIT_FAILURE );
 363                 }
 364
 365                 rc = ldap_negotiated_sasl_bind_s( ld, binddn, sasl_authc_id,
 366                                 sasl_authz_id, sasl_mech,
 367                                 passwd.bv_len ? &passwd : NULL,
 368                                 NULL, NULL );
 369
 370                 if( rc != LDAP_SUCCESS ) {
 371                         ldap_perror( ld, "ldap_negotiated_sasl_bind_s" );
 372                         return( EXIT_FAILURE );
 373                 }
 374 #else
 375                 fprintf( stderr, "%s was not compiled with SASL support\n",
 376                         argv[0] );
 377                 return( EXIT_FAILURE );
 378 #endif
 379         }
 380         else {
 381                 if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod )
 382                                 != LDAP_SUCCESS ) {
 383                         ldap_perror( ld, "ldap_bind" );
 384                         return( EXIT_FAILURE );
 385                 }
 386         }
 387
 388         if( dn != NULL || oldpw != NULL || newpw != NULL ) {
 389                 /* build change password control */
 390                 BerElement *ber = ber_alloc_t( LBER_USE_DER );
 391
 392                 if( ber == NULL ) {
 393                         perror( "ber_alloc_t" );
 394                         ldap_unbind( ld );
 395                         return EXIT_FAILURE;
 396                 }
 397
 398                 ber_printf( ber, "{" /*}*/ );
 399
 400                 if( dn != NULL ) {
 401                         ber_printf( ber, "ts",
 402                                 LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, dn );
 403                         free(dn);
 404                 }
 405
 406                 if( oldpw != NULL ) {
 407                         ber_printf( ber, "ts",
 408                                 LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW, oldpw );
 409                         free(oldpw);
 410                 }
 411
 412                 if( newpw != NULL ) {
 413                         ber_printf( ber, "ts",
 414                                 LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW, newpw );
 415                         free(newpw);
 416                 }
 417
 418                 ber_printf( ber, /*{*/ "N}" );
 419
 420                 rc = ber_flatten( ber, &bv );
 421
 422                 if( rc < 0 ) {
 423                         perror( "ber_flatten" );
 424                         ldap_unbind( ld );
 425                         return EXIT_FAILURE;
 426                 }
 427
 428                 ber_free( ber, 1 );
 429         }
 430
 431         rc = ldap_extended_operation_s( ld,
 432                 LDAP_EXOP_X_MODIFY_PASSWD, bv,
 433                 NULL, NULL,
 434                 &retoid, &retdata );
 435
 436         ber_bvfree( bv );
 437
 438         if( retdata != NULL ) {
 439                 ber_tag_t tag;
 440                 char *s;
 441                 BerElement *ber = ber_init( retdata );
 442
 443                 if( ber == NULL ) {
 444                         perror( "ber_init" );
 445                         ldap_unbind( ld );
 446                         return EXIT_FAILURE;
 447                 }
 448
 449                 /* we should check the tag */
 450                 tag = ber_scanf( ber, "{a}", &s);
 451
 452                 if( tag == LBER_ERROR ) {
 453                         perror( "ber_scanf" );
 454                 } else {
 455                         printf("New password: %s\n", s);
 456                         free( s );
 457                 }
 458
 459                 ber_free( ber, 1 );
 460         }
 461
 462         if ( rc != LDAP_SUCCESS ) {
 463                 ldap_perror( ld, "ldap_extended_operation" );
 464                 ldap_unbind( ld );
 465                 return EXIT_FAILURE;
 466         }
 467
 468         ldap_memfree( retoid );
 469         ber_bvfree( retdata );
 470
 471         /* disconnect from server */
 472         ldap_unbind (ld);
 473
 474         return EXIT_SUCCESS;
 475 }