git.sur5r.net Git - openldap/blob - clients/tools/ldappasswd.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6
   7 #include "portable.h"
   8
   9 #include <stdio.h>
  10
  11 #include <ac/stdlib.h>
  12
  13 #include <ac/ctype.h>
  14 #include <ac/signal.h>
  15 #include <ac/socket.h>
  16 #include <ac/string.h>
  17 #include <ac/time.h>
  18 #include <ac/unistd.h>
  19
  20 #include <ldap.h>
  21
  22 #include "lutil_ldap.h"
  23 #include "ldap_defaults.h"
  24
  25 static int      verbose = 0;
  26
  27 static void
  28 usage(const char *s)
  29 {
  30         fprintf(stderr,
  31 "Change the password of an LDAP entry\n\n"
  32 "usage: %s [options] dn\n"
  33 "       dn: the DN of the entry whose password must be changed\n"
  34 "options:\n"
  35 "       -a secret\told password\n"
  36 "       -A\t\tprompt for old password\n"
  37 "       -d level\tdebugging level\n"
  38 "       -C\t\tchase referrals\n"
  39 "       -D binddn\tbind DN\n"
  40 "       -E\t\trequest SASL privacy (-EE to make it critical)\n"
  41 "       -h host\t\tLDAP server (default: localhost)\n"
  42 "       -I\t\trequest SASL integrity checking (-II to make it\n"
  43 "               \tcritical)\n"
  44 "       -n\t\tmake no modifications\n"
  45 "       -O secprops\tSASL security properties\n"
  46 "       -p port\t\tport on LDAP server\n"
  47 "       -S\t\tprompt for new password\n"
  48 "       -s secret\tnew password\n"
  49 "       -U user\t\tSASL authentication identity (username)\n"
  50 "       -v\t\tverbose mode\n"
  51 "       -w passwd\tbind password (for simple authentication)\n"
  52 "       -W\t\tprompt for bind password\n"
  53 "       -X id\t\tSASL authorization identity (\"dn:<dn>\" or \"u:<user>\")\n"
  54 "       -Y mech\t\tSASL mechanism\n"
  55 "       -Z\t\tissue Start TLS request (-ZZ to require successful response)\n"
  56                 , s );
  57
  58         exit( EXIT_FAILURE );
  59 }
  60
  61 int
  62 main( int argc, char *argv[] )
  63 {
  64         int rc;
  65         char    *ldaphost = NULL;
  66
  67         char    *dn = NULL;
  68         char    *binddn = NULL;
  69
  70         struct berval passwd = { 0, NULL };
  71         char    *newpw = NULL;
  72         char    *oldpw = NULL;
  73
  74         int             want_bindpw = 0;
  75         int             want_newpw = 0;
  76         int             want_oldpw = 0;
  77
  78         int             noupdates = 0;
  79         int             i;
  80         int             ldapport = 0;
  81         int             debug = 0;
  82         int             version = -1;
  83         int             authmethod = LDAP_AUTH_SIMPLE;
  84 #ifdef HAVE_CYRUS_SASL
  85         char            *sasl_authc_id = NULL;
  86         char            *sasl_authz_id = NULL;
  87         char            *sasl_mech = NULL;
  88         char            *sasl_secprops = NULL;
  89 #endif
  90         int             use_tls = 0;
  91         int             referrals = 0;
  92         LDAP           *ld;
  93         struct berval *bv = NULL;
  94
  95         int id, code;
  96         LDAPMessage *res;
  97         char *matcheddn = NULL, *text = NULL, **refs = NULL;
  98         char    *retoid = NULL;
  99         struct berval *retdata = NULL;
 100
 101         if (argc == 1)
 102                 usage (argv[0]);
 103
 104         while( (i = getopt( argc, argv,
 105                 "Aa:CD:d:h:nO:p:Ss:U:vWw:X:Y:Z" )) != EOF )
 106         {
 107                 switch (i) {
 108                 case 'A':       /* prompt for oldr password */
 109                         want_oldpw++;
 110                         break;
 111                 case 'a':       /* old password (secret) */
 112                         oldpw = strdup (optarg);
 113
 114                         {
 115                                 char* p;
 116
 117                                 for( p = optarg; *p == '\0'; p++ ) {
 118                                         *p = '*';
 119                                 }
 120                         }
 121                         break;
 122                 case 'C':
 123                         referrals++;
 124                         break;
 125                 case 'D':       /* bind distinguished name */
 126                         binddn = strdup (optarg);
 127                         break;
 128
 129                 case 'd':       /* debugging option */
 130                         debug |= atoi (optarg);
 131                         break;
 132
 133                 case 'h':       /* ldap host */
 134                         ldaphost = strdup (optarg);
 135                         break;
 136
 137                 case 'n':       /* don't update entry(s) */
 138                         noupdates++;
 139                         break;
 140
 141                 case 'p':       /* ldap port */
 142                         ldapport = strtol( optarg, NULL, 10 );
 143                         break;
 144
 145                 case 'S':       /* prompt for user password */
 146                         want_newpw++;
 147                         break;
 148
 149                 case 's':       /* new password (secret) */
 150                         newpw = strdup (optarg);
 151                         {
 152                                 char* p;
 153
 154                                 for( p = optarg; *p == '\0'; p++ ) {
 155                                         *p = '*';
 156                                 }
 157                         }
 158                         break;
 159
 160                 case 'v':       /* verbose */
 161                         verbose++;
 162                         break;
 163
 164                 case 'W':       /* prompt for bind password */
 165                         want_bindpw++;
 166                         break;
 167
 168                 case 'w':       /* bind password */
 169                         passwd.bv_val = strdup (optarg);
 170                         {
 171                                 char* p;
 172
 173                                 for( p = optarg; *p == '\0'; p++ ) {
 174                                         *p = '*';
 175                                 }
 176                         }
 177                         passwd.bv_len = strlen( passwd.bv_val );
 178                         break;
 179
 180                 case 'O':
 181 #ifdef HAVE_CYRUS_SASL
 182                         sasl_secprops = strdup( optarg );
 183                         authmethod = LDAP_AUTH_SASL;
 184 #else
 185                         fprintf( stderr, "%s was not compiled with SASL support\n",
 186                                 argv[0] );
 187                         return( EXIT_FAILURE );
 188 #endif
 189                         break;
 190                 case 'Y':
 191 #ifdef HAVE_CYRUS_SASL
 192                         if ( strcasecmp( optarg, "any" ) &&
 193                                         strcmp( optarg, "*" ) ) {
 194                                 sasl_mech = strdup( optarg );
 195                         }
 196                         authmethod = LDAP_AUTH_SASL;
 197 #else
 198                         fprintf( stderr, "%s was not compiled with SASL "
 199                                 "support\n", argv[0] );
 200                         return( EXIT_FAILURE );
 201 #endif
 202                         break;
 203                 case 'U':
 204 #ifdef HAVE_CYRUS_SASL
 205                         sasl_authc_id = strdup( optarg );
 206                         authmethod = LDAP_AUTH_SASL;
 207 #else
 208                         fprintf( stderr, "%s was not compiled with SASL "
 209                                 "support\n", argv[0] );
 210                         return( EXIT_FAILURE );
 211 #endif
 212                         break;
 213                 case 'X':
 214 #ifdef HAVE_CYRUS_SASL
 215                         sasl_authz_id = strdup( optarg );
 216                         authmethod = LDAP_AUTH_SASL;
 217 #else
 218                         fprintf( stderr, "%s was not compiled with SASL "
 219                                 "support\n", argv[0] );
 220                         return( EXIT_FAILURE );
 221 #endif
 222                         break;
 223                 case 'Z':
 224 #ifdef HAVE_TLS
 225                         use_tls++;
 226 #else
 227                         fprintf( stderr, "%s was not compiled with TLS "
 228                                 "support\n", argv[0] );
 229                         return( EXIT_FAILURE );
 230 #endif
 231                         break;
 232
 233                 default:
 234                         usage (argv[0]);
 235                 }
 236         }
 237
 238         if( argc - optind != 1 ) {
 239                 usage( argv[0] );
 240         }
 241
 242         dn = strdup( argv[optind] );
 243
 244         if( want_oldpw && oldpw == NULL ) {
 245                 /* prompt for old password */
 246                 char *ckoldpw;
 247                 newpw = strdup(getpassphrase("Old password: "));
 248                 ckoldpw = getpassphrase("Re-enter old password: ");
 249
 250                 if( newpw== NULL || ckoldpw == NULL ||
 251                         strncmp( oldpw, ckoldpw, strlen(oldpw) ))
 252                 {
 253                         fprintf( stderr, "passwords do not match\n" );
 254                         return EXIT_FAILURE;
 255                 }
 256         }
 257
 258         if( want_newpw && newpw == NULL ) {
 259                 /* prompt for new password */
 260                 char *cknewpw;
 261                 newpw = strdup(getpassphrase("New password: "));
 262                 cknewpw = getpassphrase("Re-enter new password: ");
 263
 264                 if( newpw== NULL || cknewpw == NULL ||
 265                         strncmp( newpw, cknewpw, strlen(newpw) ))
 266                 {
 267                         fprintf( stderr, "passwords do not match\n" );
 268                         return EXIT_FAILURE;
 269                 }
 270         }
 271
 272         if( binddn == NULL && dn != NULL ) {
 273                 binddn = dn;
 274                 dn = NULL;
 275
 276                 if( passwd.bv_val == NULL ) {
 277                         passwd.bv_val = oldpw;
 278                         passwd.bv_len = oldpw == NULL ? 0 : strlen( oldpw );
 279                 }
 280         }
 281
 282         if (want_bindpw && passwd.bv_val == NULL ) {
 283                 /* handle bind password */
 284                 fprintf( stderr, "Bind DN: %s\n", binddn );
 285                 passwd.bv_val = strdup( getpassphrase("Enter bind password: "));
 286                 passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0;
 287         }
 288
 289         if ( debug ) {
 290                 if( ber_set_option( NULL, LBER_OPT_DEBUG_LEVEL, &debug ) != LBER_OPT_SUCCESS ) {
 291                         fprintf( stderr, "Could not set LBER_OPT_DEBUG_LEVEL %d\n", debug );
 292                 }
 293                 if( ldap_set_option( NULL, LDAP_OPT_DEBUG_LEVEL, &debug ) != LDAP_OPT_SUCCESS ) {
 294                         fprintf( stderr, "Could not set LDAP_OPT_DEBUG_LEVEL %d\n", debug );
 295                 }
 296         }
 297
 298 #ifdef SIGPIPE
 299         (void) SIGNAL( SIGPIPE, SIG_IGN );
 300 #endif
 301
 302         /* connect to server */
 303         if ((ld = ldap_init( ldaphost, ldapport )) == NULL) {
 304                 perror("ldap_init");
 305                 return EXIT_FAILURE;
 306         }
 307
 308         /* referrals */
 309         if (ldap_set_option( ld, LDAP_OPT_REFERRALS,
 310                 referrals ? LDAP_OPT_ON : LDAP_OPT_OFF ) != LDAP_OPT_SUCCESS )
 311         {
 312                 fprintf( stderr, "Could not set LDAP_OPT_REFERRALS %s\n",
 313                         referrals ? "on" : "off" );
 314                 return EXIT_FAILURE;
 315         }
 316
 317         /* LDAPv3 only */
 318         version = 3;
 319         rc = ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version );
 320
 321         if(rc != LDAP_OPT_SUCCESS ) {
 322                 fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n", version );
 323                 return EXIT_FAILURE;
 324         }
 325
 326         if ( use_tls && ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS ) {
 327                 if ( use_tls > 1 ) {
 328                         ldap_perror( ld, "ldap_start_tls" );
 329                         return( EXIT_FAILURE );
 330                 }
 331                 fprintf( stderr, "WARNING: could not start TLS\n" );
 332         }
 333
 334         if ( authmethod == LDAP_AUTH_SASL ) {
 335 #ifdef HAVE_CYRUS_SASL
 336                 ldap_set_sasl_interact_proc( ld, lutil_sasl_interact );
 337
 338                 if( sasl_secprops != NULL ) {
 339                         rc = ldap_set_option( ld, LDAP_OPT_X_SASL_SECPROPS,
 340                                 (void *) sasl_secprops );
 341
 342                         if( rc != LDAP_OPT_SUCCESS ) {
 343                                 fprintf( stderr,
 344                                         "Could not set LDAP_OPT_X_SASL_SECPROPS: %s\n",
 345                                         sasl_secprops );
 346                                 return( EXIT_FAILURE );
 347                         }
 348                 }
 349
 350                 rc = ldap_sasl_interactive_bind_s( ld, binddn,
 351                                 sasl_mech, NULL, NULL );
 352
 353                 if( rc != LDAP_SUCCESS ) {
 354                         ldap_perror( ld, "ldap_sasl_interactive_bind_s" );
 355                         return( EXIT_FAILURE );
 356                 }
 357 #else
 358                 fprintf( stderr, "%s was not compiled with SASL support\n",
 359                         argv[0] );
 360                 return( EXIT_FAILURE );
 361 #endif
 362         }
 363         else {
 364                 if ( ldap_bind_s( ld, binddn, passwd.bv_val, authmethod )
 365                                 != LDAP_SUCCESS ) {
 366                         ldap_perror( ld, "ldap_bind" );
 367                         return( EXIT_FAILURE );
 368                 }
 369         }
 370
 371         if( dn != NULL || oldpw != NULL || newpw != NULL ) {
 372                 /* build change password control */
 373                 BerElement *ber = ber_alloc_t( LBER_USE_DER );
 374
 375                 if( ber == NULL ) {
 376                         perror( "ber_alloc_t" );
 377                         ldap_unbind( ld );
 378                         return EXIT_FAILURE;
 379                 }
 380
 381                 ber_printf( ber, "{" /*}*/ );
 382
 383                 if( dn != NULL ) {
 384                         ber_printf( ber, "ts",
 385                                 LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, dn );
 386                         free(dn);
 387                 }
 388
 389                 if( oldpw != NULL ) {
 390                         ber_printf( ber, "ts",
 391                                 LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW, oldpw );
 392                         free(oldpw);
 393                 }
 394
 395                 if( newpw != NULL ) {
 396                         ber_printf( ber, "ts",
 397                                 LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW, newpw );
 398                         free(newpw);
 399                 }
 400
 401                 ber_printf( ber, /*{*/ "N}" );
 402
 403                 rc = ber_flatten( ber, &bv );
 404
 405                 if( rc < 0 ) {
 406                         perror( "ber_flatten" );
 407                         ldap_unbind( ld );
 408                         return EXIT_FAILURE;
 409                 }
 410
 411                 ber_free( ber, 1 );
 412         }
 413
 414         if ( noupdates ) {
 415                 rc = LDAP_SUCCESS;
 416                 goto skip;
 417         }
 418
 419         rc = ldap_extended_operation( ld,
 420                 LDAP_EXOP_X_MODIFY_PASSWD, bv,
 421                 NULL, NULL, &id );
 422
 423         ber_bvfree( bv );
 424
 425         if( rc != LDAP_SUCCESS ) {
 426                 ldap_perror( ld, "ldap_extended_operation" );
 427                 ldap_unbind( ld );
 428                 return EXIT_FAILURE;
 429         }
 430
 431         rc = ldap_result( ld, LDAP_RES_ANY, LDAP_MSG_ALL, NULL, &res );
 432         if ( rc < 0 ) {
 433                 ldap_perror( ld, "ldappasswd: ldap_result" );
 434                 return rc;
 435         }
 436
 437         rc = ldap_parse_result( ld, res, &code, &matcheddn, &text, &refs, NULL, 0 );
 438
 439         if( rc != LDAP_SUCCESS ) {
 440                 ldap_perror( ld, "ldap_parse_result" );
 441                 return rc;
 442         }
 443
 444         rc = ldap_parse_extended_result( ld, res, &retoid, &retdata, 1 );
 445
 446         if( rc != LDAP_SUCCESS ) {
 447                 ldap_perror( ld, "ldap_parse_result" );
 448                 return rc;
 449         }
 450
 451         if( retdata != NULL ) {
 452                 ber_tag_t tag;
 453                 char *s;
 454                 BerElement *ber = ber_init( retdata );
 455
 456                 if( ber == NULL ) {
 457                         perror( "ber_init" );
 458                         ldap_unbind( ld );
 459                         return EXIT_FAILURE;
 460                 }
 461
 462                 /* we should check the tag */
 463                 tag = ber_scanf( ber, "{a}", &s);
 464
 465                 if( tag == LBER_ERROR ) {
 466                         perror( "ber_scanf" );
 467                 } else {
 468                         printf("New password: %s\n", s);
 469                         free( s );
 470                 }
 471
 472                 ber_free( ber, 1 );
 473         }
 474
 475         if( verbose || code != LDAP_SUCCESS || matcheddn || text || refs ) {
 476                 printf( "Result: %s (%d)\n", ldap_err2string( code ), code );
 477
 478                 if( text && *text ) {
 479                         printf( "Additional info: %s\n", text );
 480                 }
 481
 482                 if( matcheddn && *matcheddn ) {
 483                         printf( "Matched DN: %s\n", matcheddn );
 484                 }
 485
 486                 if( refs ) {
 487                         int i;
 488                         for( i=0; refs[i]; i++ ) {
 489                                 printf("Referral: %s\n", refs[i] );
 490                         }
 491                 }
 492         }
 493
 494         ber_memfree( text );
 495         ber_memfree( matcheddn );
 496         ber_memvfree( (void **) refs );
 497         ber_memfree( retoid );
 498         ber_bvfree( retdata );
 499
 500 skip:
 501         /* disconnect from server */
 502         ldap_unbind (ld);
 503
 504         return EXIT_SUCCESS;
 505 }