1 /* SASL LDAP auxprop implementation
2 * Copyright (C) 2002,2003 Howard Chu, All rights reserved. <hyc@symas.com>
4 * Permission is granted to anyone to use this software for any purpose
5 * on any computer system, and to alter it and redistribute it, subject
6 * to the following restrictions:
8 * 1. The author is not responsible for the consequences of use of this
9 * software, no matter how awful, even if they arise from flaws in it.
11 * 2. The origin of this software must not be misrepresented, either by
12 * explicit claim or by omission. Since few users ever read sources,
13 * credits should appear in the documentation.
15 * 3. Altered versions must be plainly marked as such, and must not be
16 * misrepresented as being the original software. Since few users
17 * ever read sources, credits should appear in the documentation.
19 * 4. This notice may not be removed or altered.
30 #include "plugin_common.h"
34 static char ldapdb[] = "ldapdb";
36 typedef struct ldapctx {
37 const char *uri; /* URI of LDAP server */
38 struct berval id; /* SASL authcid to bind as */
39 struct berval pw; /* password for bind */
40 struct berval mech; /* SASL mech */
43 typedef struct gluectx {
45 sasl_server_params_t *lp;
48 static int ldapdb_interact(LDAP *ld, unsigned flags __attribute__((unused)),
49 void *def, void *inter)
51 sasl_interact_t *in = inter;
55 for (;in->id != SASL_CB_LIST_END;in++)
60 case SASL_CB_GETREALM:
61 ldap_get_option(ld, LDAP_OPT_X_SASL_REALM, &p.bv_val);
62 if (p.bv_val) p.bv_len = strlen(p.bv_val);
64 case SASL_CB_AUTHNAME:
73 in->result = gc->lp->utils->malloc(p.bv_len+1);
75 return LDAP_NO_MEMORY;
76 strcpy((char *)in->result, p.bv_val);
83 static void ldapdb_auxprop_lookup(void *glob_context,
84 sasl_server_params_t *sparams,
89 ldapctx *ctx = glob_context;
90 int ret, i, n, *aindx;
91 const struct propval *pr;
93 gluectx gc = { ctx, sparams };
94 struct berval *dn = NULL, **bvals;
95 LDAPMessage *msg, *res;
96 char **attrs = NULL, *authzid = NULL;
97 LDAPControl c, *ctrl[2] = {&c, NULL};
99 if(!ctx || !sparams || !user) return;
101 pr = sparams->utils->prop_get(sparams->propctx);
104 /* count how many attrs to fetch */
105 for(i = 0, n = 0; pr[i].name; i++) {
106 if(pr[i].name[0] == '*' && (flags & SASL_AUXPROP_AUTHZID))
108 if(pr[i].values && !(flags & SASL_AUXPROP_OVERRIDE))
112 /* nothing to do, bail out */
115 /* alloc an array of attr names for search, and index to the props */
116 attrs = sparams->utils->malloc((n+1)*sizeof(char *)*2);
119 aindx = (int *)(attrs + n + 1);
122 for (i=0, n=0; pr[i].name; i++) {
123 if(pr[i].name[0] == '*' && (flags & SASL_AUXPROP_AUTHZID))
125 if(pr[i].values && !(flags & SASL_AUXPROP_OVERRIDE))
127 attrs[n] = (char *)pr[i].name;
128 if (pr[i].name[0] == '*') attrs[n]++;
134 if(ldap_initialize(&ld, ctx->uri)) {
135 sparams->utils->free(attrs);
139 authzid = sparams->utils->malloc(ulen + sizeof("u:"));
140 if (!authzid) goto done;
141 strcpy(authzid, "u:");
142 strcpy(authzid+2, user);
143 c.ldctl_oid = LDAP_CONTROL_PROXY_AUTHZ;
144 c.ldctl_value.bv_val = authzid;
145 c.ldctl_value.bv_len = ulen + 2;
146 c.ldctl_iscritical = 1;
149 ret = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &i);
151 ret = ldap_sasl_interactive_bind_s(ld, NULL, ctx->mech.bv_val, NULL, NULL,
152 LDAP_SASL_QUIET, ldapdb_interact, &gc);
153 if (ret != LDAP_SUCCESS) goto done;
155 ret = ldap_whoami_s(ld, &dn, ctrl, NULL);
156 if (ret != LDAP_SUCCESS || !dn) goto done;
158 if (dn->bv_val && !strncmp(dn->bv_val, "dn:", 3))
159 ret = ldap_search_s(ld, dn->bv_val+3, LDAP_SCOPE_BASE, "(objectclass=*)",
163 if (ret != LDAP_SUCCESS) goto done;
165 for(msg=ldap_first_message(ld, res); msg; msg=ldap_next_message(ld, msg))
167 if (ldap_msgtype(msg) != LDAP_RES_SEARCH_ENTRY) continue;
170 bvals = ldap_get_values_len(ld, msg, attrs[i]);
171 if (!bvals) continue;
172 if (pr[aindx[i]].values)
173 sparams->utils->prop_erase(sparams->propctx, pr[aindx[i]].name);
174 sparams->utils->prop_set(sparams->propctx, pr[aindx[i]].name,
175 bvals[0]->bv_val, bvals[0]->bv_len);
182 if(authzid) sparams->utils->free(authzid);
183 if(attrs) sparams->utils->free(attrs);
184 if(ld) ldap_unbind(ld);
187 static void ldapdb_auxprop_free(void *glob_ctx, const sasl_utils_t *utils)
189 utils->free(glob_ctx);
192 static sasl_auxprop_plug_t ldapdb_auxprop_plugin = {
195 NULL, /* glob_context */
196 ldapdb_auxprop_free, /* auxprop_free */
197 ldapdb_auxprop_lookup, /* auxprop_lookup */
202 static int ldapdb_auxprop_plug_init(const sasl_utils_t *utils,
205 sasl_auxprop_plug_t **plug,
206 const char *plugname __attribute__((unused)))
211 if(!out_version || !plug) return SASL_BADPARAM;
213 if(max_version < SASL_AUXPROP_PLUG_VERSION) return SASL_BADVERS;
215 utils->getopt(utils->getopt_context, ldapdb, "ldapdb_uri", &tmp.uri, NULL);
216 if(!tmp.uri) return SASL_BADPARAM;
218 utils->getopt(utils->getopt_context, ldapdb, "ldapdb_id",
219 (const char **)&tmp.id.bv_val, (unsigned *)&tmp.id.bv_len);
220 utils->getopt(utils->getopt_context, ldapdb, "ldapdb_pw",
221 (const char **)&tmp.pw.bv_val, (unsigned *)&tmp.pw.bv_len);
222 utils->getopt(utils->getopt_context, ldapdb, "ldapdb_mech",
223 (const char **)&tmp.mech.bv_val, (unsigned *)&tmp.mech.bv_len);
224 utils->getopt(utils->getopt_context, ldapdb, "ldapdb_rc", &s, NULL);
225 if(s && setenv("LDAPRC", s, 1)) return SASL_BADPARAM;
227 p = utils->malloc(sizeof(ldapctx));
228 if (!p) return SASL_NOMEM;
230 ldapdb_auxprop_plugin.glob_context = p;
232 *out_version = SASL_AUXPROP_PLUG_VERSION;
234 *plug = &ldapdb_auxprop_plugin;
239 SASL_AUXPROP_PLUG_INIT( ldapdb )