1 /* ldapvc.c -- a tool for verifying credentials */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 1998-2014 The OpenLDAP Foundation.
6 * Portions Copyright 2010 Kurt D. Zeilenga.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted only as authorized by the OpenLDAP
13 * A copy of this license is available in the file LICENSE in the
14 * top-level directory of the distribution or, alternatively, at
15 * <http://www.OpenLDAP.org/license.html>.
17 /* Portions Copyright (c) 1992-1996 Regents of the University of Michigan.
18 * All rights reserved.
20 * Redistribution and use in source and binary forms are permitted
21 * provided that this notice is preserved and that due credit is given
22 * to the University of Michigan at Ann Arbor. The name of the
23 * University may not be used to endorse or promote products derived
24 * from this software without specific prior written permission. This
25 * software is provided ``as is'' without express or implied warranty.
28 * This work was originally developed by Kurt D. Zeilenga for inclusion
29 * in OpenLDAP Software based, in part, on other client tools.
36 #include <ac/stdlib.h>
39 #include <ac/socket.h>
40 #include <ac/string.h>
42 #include <ac/unistd.h>
46 #include "lutil_ldap.h"
47 #include "ldap_defaults.h"
51 static int req_authzid = 0;
52 static int req_pp = 0;
54 #if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
55 #define LDAP_SASL_NONE (~0U)
56 static unsigned vc_sasl = LDAP_SASL_NONE;
57 static char *vc_sasl_realm = NULL;
58 static char *vc_sasl_authcid = NULL;
59 static char *vc_sasl_authzid = NULL;
60 static char *vc_sasl_mech = NULL;
61 static char *vc_sasl_secprops = NULL;
63 static char * dn = NULL;
64 static struct berval cred = {0, NULL};
69 fprintf( stderr, _("Issue LDAP Verify Credentials operation to verify a user's credentials\n\n"));
70 fprintf( stderr, _("usage: %s [options] [DN [cred]])\n"), prog);
71 fprintf( stderr, _("where:\n"));
72 fprintf( stderr, _(" DN\tDistinguished Name\n"));
73 fprintf( stderr, _(" cred\tCredentials (prompt if not present)\n"));
74 fprintf( stderr, _("options:\n"));
75 fprintf( stderr, _(" -a\tRequest AuthzId\n"));
76 fprintf( stderr, _(" -b\tRequest Password Policy Information\n"));
77 fprintf( stderr, _(" -E sasl=(a[utomatic]|i[nteractive]|q[uiet]>\tSASL mode (defaults to automatic if any other -E option provided, otherwise none))\n"));
78 fprintf( stderr, _(" -E mech=<mech>\tSASL mechanism (default "" e.g. Simple)\n"));
79 fprintf( stderr, _(" -E realm=<realm>\tSASL Realm (defaults to none)\n"));
80 fprintf( stderr, _(" -E authcid=<authcid>\tSASL Authenication Identity (defaults to USER)\n"));
81 fprintf( stderr, _(" -E authzid=<authzid>\tSASL Authorization Identity (defaults to none)\n"));
82 fprintf( stderr, _(" -E secprops=<secprops>\tSASL Security Properties (defaults to none)\n"));
88 const char options[] = "abE:"
89 "d:D:e:h:H:InNO:o:p:QR:U:vVw:WxX:y:Y:Z";
92 handle_private_option( int i )
95 char *control, *cvalue;
97 case 'E': /* vc extension */
98 if( protocol == LDAP_VERSION2 ) {
99 fprintf( stderr, _("%s: -E incompatible with LDAPv%d\n"),
101 exit( EXIT_FAILURE );
104 /* should be extended to support comma separated list of
105 * [!]key[=value] parameters, e.g. -E !foo,bar=567
110 if( optarg[0] == '!' ) {
115 control = strdup( optarg );
116 if ( (cvalue = strchr( control, '=' )) != NULL ) {
120 if (strcasecmp(control, "sasl") == 0) {
121 #if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
122 if (vc_sasl != LDAP_SASL_NONE) {
124 _("SASL option previously specified\n"));
127 if (cvalue == NULL) {
129 _("missing mode in SASL option\n"));
136 vc_sasl = LDAP_SASL_AUTOMATIC;
140 vc_sasl = LDAP_SASL_INTERACTIVE;
144 vc_sasl = LDAP_SASL_QUIET;
148 _("unknown mode %s in SASL option\n"), cvalue);
153 _("%s: not compiled with SASL support\n"), prog);
157 } else if (strcasecmp(control, "mech") == 0) {
158 #if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
161 _("SASL mech previously specified\n"));
164 if (cvalue == NULL) {
166 _("missing mech in SASL option\n"));
170 vc_sasl_mech = ber_strdup(cvalue);
174 } else if (strcasecmp(control, "realm") == 0) {
175 #if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
178 _("SASL realm previously specified\n"));
181 if (cvalue == NULL) {
183 _("missing realm in SASL option\n"));
187 vc_sasl_realm = ber_strdup(cvalue);
190 _("%s: not compiled with SASL support\n"), prog);
194 } else if (strcasecmp(control, "authcid") == 0) {
195 #if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
196 if (vc_sasl_authcid) {
198 _("SASL authcid previously specified\n"));
201 if (cvalue == NULL) {
203 _("missing authcid in SASL option\n"));
207 vc_sasl_authcid = ber_strdup(cvalue);
210 _("%s: not compiled with SASL support\n"), prog);
214 } else if (strcasecmp(control, "authzid") == 0) {
215 #if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
216 if (vc_sasl_authzid) {
218 _("SASL authzid previously specified\n"));
221 if (cvalue == NULL) {
223 _("missing authzid in SASL option\n"));
227 vc_sasl_authzid = ber_strdup(cvalue);
230 _("%s: not compiled with SASL support\n"), prog);
234 } else if (strcasecmp(control, "secprops") == 0) {
235 #if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
236 if (vc_sasl_secprops) {
238 _("SASL secprops previously specified\n"));
241 if (cvalue == NULL) {
243 _("missing secprops in SASL option\n"));
247 vc_sasl_secprops = ber_strdup(cvalue);
250 _("%s: not compiled with SASL support\n"), prog);
255 fprintf( stderr, _("Invalid Verify Credentials extension name: %s\n"), control );
259 case 'a': /* request authzid */
263 case 'b': /* request authzid */
275 main( int argc, char *argv[] )
279 char *matcheddn = NULL, *text = NULL, **refs = NULL;
282 struct berval *scookie = NULL;
283 struct berval *scred = NULL;
286 LDAPControl **ctrls = NULL;
287 LDAPControl **vcctrls = NULL;
290 tool_init( TOOL_VC );
291 prog = lutil_progname( "ldapvc", argc, argv );
294 protocol = LDAP_VERSION3;
296 tool_args( argc, argv );
298 if (argc - optind > 0) {
301 if (argc - optind > 0) {
302 cred.bv_val = strdup(argv[optind++]);
303 cred.bv_len = strlen(cred.bv_val);
305 if (argc - optind > 0) {
309 #ifdef LDAP_API_FEATURE_VERIFY_CREDENTIALS_INTERACTIVE
314 cred.bv_val = strdup(getpassphrase(_("User's password: ")));
315 cred.bv_len = strlen(cred.bv_val);
318 #ifdef LDAP_API_FEATURE_VERIFY_CREDENTIALS_INTERACTIVE
319 if (vc_sasl_mech && (vc_sasl == LDAP_SASL_NONE)) {
320 vc_sasl = LDAP_SASL_AUTOMATIC;
324 ld = tool_conn_setup( 0, 0 );
333 tool_server_controls( ld, NULL, 0 );
336 vcctrls = (LDAPControl **) malloc(3*sizeof(LDAPControl *));
337 vcctrls[nvcctrls] = (LDAPControl *) malloc(sizeof(LDAPControl));
338 vcctrls[nvcctrls]->ldctl_oid = ldap_strdup(LDAP_CONTROL_AUTHZID_REQUEST);
339 vcctrls[nvcctrls]->ldctl_iscritical = 0;
340 vcctrls[nvcctrls]->ldctl_value.bv_val = NULL;
341 vcctrls[nvcctrls]->ldctl_value.bv_len = 0;
342 vcctrls[++nvcctrls] = NULL;
346 if (!vcctrls) vcctrls = (LDAPControl **) malloc(3*sizeof(LDAPControl *));
347 vcctrls[nvcctrls] = (LDAPControl *) malloc(sizeof(LDAPControl));
348 vcctrls[nvcctrls]->ldctl_oid = ldap_strdup(LDAP_CONTROL_PASSWORDPOLICYREQUEST);
349 vcctrls[nvcctrls]->ldctl_iscritical = 0;
350 vcctrls[nvcctrls]->ldctl_value.bv_val = NULL;
351 vcctrls[nvcctrls]->ldctl_value.bv_len = 0;
352 vcctrls[++nvcctrls] = NULL;
355 #ifdef LDAP_API_FEATURE_VERIFY_CREDENTIALS_INTERACTIVE
356 #ifdef HAVE_CYRUS_SASL
360 void * context = NULL;
361 const char *rmech = NULL;
363 defaults = lutil_sasl_defaults(ld,
371 rc = ldap_verify_credentials_interactive(ld, dn, vc_sasl_mech,
373 vc_sasl, lutil_sasl_interact, defaults, context,
374 res, &rmech, &msgid);
376 if (rc != LDAP_SASL_BIND_IN_PROGRESS) break;
380 if (ldap_result(ld, msgid, LDAP_MSG_ALL, NULL, &res) == -1 || !res) {
381 ldap_get_option(ld, LDAP_OPT_RESULT_CODE, (void*) &rc);
382 ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE, (void*) &text);
383 tool_perror( "ldap_verify_credentials_interactive", rc, NULL, NULL, text, NULL);
387 } while (rc == LDAP_SASL_BIND_IN_PROGRESS);
389 lutil_sasl_freedefs(defaults);
391 if( rc != LDAP_SUCCESS ) {
392 ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE, (void*) &text);
393 tool_perror( "ldap_verify_credentials", rc, NULL, NULL, text, NULL );
402 rc = ldap_verify_credentials( ld,
404 dn, NULL, cred.bv_val ? &cred: NULL, vcctrls,
407 if( rc != LDAP_SUCCESS ) {
408 ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE, (void*) &text);
409 tool_perror( "ldap_verify_credentials", rc, NULL, NULL, text, NULL );
417 if ( tool_check_abandon( ld, id ) ) {
418 tool_exit( ld, LDAP_CANCELLED );
424 rc = ldap_result( ld, LDAP_RES_ANY, LDAP_MSG_ALL, &tv, &res );
426 tool_perror( "ldap_result", rc, NULL, NULL, NULL, NULL );
436 ldap_controls_free(vcctrls);
439 rc = ldap_parse_result( ld, res,
440 &code, &matcheddn, &text, &refs, &ctrls, 0 );
442 if (rc == LDAP_SUCCESS) rc = code;
444 if (rc != LDAP_SUCCESS) {
445 tool_perror( "ldap_parse_result", rc, NULL, matcheddn, text, refs );
450 rc = ldap_parse_verify_credentials( ld, res, &rcode, &diag, &scookie, &scred, &vcctrls );
453 if (rc != LDAP_SUCCESS) {
454 tool_perror( "ldap_parse_verify_credentials", rc, NULL, NULL, NULL, NULL );
459 if (rcode != LDAP_SUCCESS) {
460 printf(_("Failed: %s (%d)\n"), ldap_err2string(rcode), rcode);
464 printf(_("Diagnostic: %s\n"), diag);
468 tool_print_ctrls( ld, vcctrls );
472 if ( verbose || code != LDAP_SUCCESS ||
473 ( matcheddn && *matcheddn ) || ( text && *text ) || refs || ctrls )
475 printf( _("Result: %s (%d)\n"), ldap_err2string( code ), code );
477 if( text && *text ) {
478 printf( _("Additional info: %s\n"), text );
481 if( matcheddn && *matcheddn ) {
482 printf( _("Matched DN: %s\n"), matcheddn );
487 for( i=0; refs[i]; i++ ) {
488 printf(_("Referral: %s\n"), refs[i] );
493 tool_print_ctrls( ld, ctrls );
494 ldap_controls_free( ctrls );
499 ber_memfree( matcheddn );
500 ber_memvfree( (void **) refs );
501 ber_bvfree( scookie );
506 /* disconnect from server */
507 tool_exit( ld, code == LDAP_SUCCESS ? EXIT_SUCCESS : EXIT_FAILURE );