git.sur5r.net Git - openldap/blob - contrib/slapd-modules/nssov/pam.c

   1 /* pam.c - pam processing routines */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 2008-2015 The OpenLDAP Foundation.
   6  * Portions Copyright 2008 by Howard Chu, Symas Corp.
   7  * Portions Copyright 2013 by Ted C. Cheng, Symas Corp.
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted only as authorized by the OpenLDAP
  12  * Public License.
  13  *
  14  * A copy of this license is available in the file LICENSE in the
  15  * top-level directory of the distribution or, alternatively, at
  16  * <http://www.OpenLDAP.org/license.html>.
  17  */
  18
  19 #include "nssov.h"
  20 #include "lutil.h"
  21
  22 static int ppolicy_cid;
  23 static AttributeDescription *ad_loginStatus;
  24
  25 struct paminfo {
  26         struct berval uid;
  27         struct berval dn;
  28         struct berval svc;
  29         struct berval pwd;
  30         int authz;
  31         struct berval msg;
  32         int ispwdmgr;
  33 };
  34
  35 static int pam_bindcb(
  36         Operation *op, SlapReply *rs)
  37 {
  38         struct paminfo *pi = op->o_callback->sc_private;
  39         LDAPControl *ctrl = ldap_control_find(LDAP_CONTROL_PASSWORDPOLICYRESPONSE,
  40                 rs->sr_ctrls, NULL);
  41         if (ctrl) {
  42                 LDAP *ld;
  43                 ber_int_t expire, grace;
  44                 LDAPPasswordPolicyError error;
  45
  46                 ldap_create(&ld);
  47                 if (ld) {
  48                         int rc = ldap_parse_passwordpolicy_control(ld,ctrl,
  49                                 &expire,&grace,&error);
  50                         if (rc == LDAP_SUCCESS) {
  51                                 if (expire >= 0) {
  52                                         char *unit = "seconds";
  53                                         if (expire > 60) {
  54                                                 expire /= 60;
  55                                                 unit = "minutes";
  56                                         }
  57                                         if (expire > 60) {
  58                                                 expire /= 60;
  59                                                 unit = "hours";
  60                                         }
  61                                         if (expire > 24) {
  62                                                 expire /= 24;
  63                                                 unit = "days";
  64                                         }
  65 #if 0   /* Who warns about expiration so far in advance? */
  66                                         if (expire > 7) {
  67                                                 expire /= 7;
  68                                                 unit = "weeks";
  69                                         }
  70                                         if (expire > 4) {
  71                                                 expire /= 4;
  72                                                 unit = "months";
  73                                         }
  74                                         if (expire > 12) {
  75                                                 expire /= 12;
  76                                                 unit = "years";
  77                                         }
  78 #endif
  79                                         pi->msg.bv_len = sprintf(pi->msg.bv_val,
  80                                                 "\nWARNING: Password expires in %d %s\n", expire, unit);
  81                                 } else if (grace > 0) {
  82                                         pi->msg.bv_len = sprintf(pi->msg.bv_val,
  83                                                 "Password expired; %d grace logins remaining",
  84                                                 grace);
  85                                         pi->authz = NSLCD_PAM_NEW_AUTHTOK_REQD;
  86                                 } else if (error != PP_noError) {
  87                                         ber_str2bv(ldap_passwordpolicy_err2txt(error), 0, 0,
  88                                                 &pi->msg);
  89                                         switch (error) {
  90                                         case PP_passwordExpired:
  91                                                 /* report this during authz */
  92                                                 rs->sr_err = LDAP_SUCCESS;
  93                                                 /* fallthru */
  94                                         case PP_changeAfterReset:
  95                                                 pi->authz = NSLCD_PAM_NEW_AUTHTOK_REQD;
  96                                         }
  97                                 }
  98                         }
  99                         ldap_ld_free(ld,0,NULL,NULL);
 100                 }
 101         }
 102         return LDAP_SUCCESS;
 103 }
 104
 105 static int pam_uid2dn(nssov_info *ni, Operation *op,
 106         struct paminfo *pi)
 107 {
 108         struct berval sdn;
 109
 110         BER_BVZERO(&pi->dn);
 111
 112         if (!isvalidusername(&pi->uid)) {
 113                 Debug(LDAP_DEBUG_ANY,"nssov_pam_uid2dn(%s): invalid user name\n",
 114                         pi->uid.bv_val ? pi->uid.bv_val : "NULL",0,0);
 115                 return NSLCD_PAM_USER_UNKNOWN;
 116         }
 117
 118         if (ni->ni_pam_opts & NI_PAM_SASL2DN) {
 119                 int hlen = global_host_bv.bv_len;
 120
 121                 /* cn=<service>+uid=<user>,cn=<host>,cn=pam,cn=auth */
 122                 sdn.bv_len = pi->uid.bv_len + pi->svc.bv_len + hlen +
 123                         STRLENOF( "cn=+uid=,cn=,cn=pam,cn=auth" );
 124                 sdn.bv_val = op->o_tmpalloc( sdn.bv_len + 1, op->o_tmpmemctx );
 125                 sprintf(sdn.bv_val, "cn=%s+uid=%s,cn=%s,cn=pam,cn=auth",
 126                         pi->svc.bv_val, pi->uid.bv_val, global_host_bv.bv_val);
 127                 slap_sasl2dn(op, &sdn, &pi->dn, 0);
 128                 op->o_tmpfree( sdn.bv_val, op->o_tmpmemctx );
 129         }
 130
 131         /* If no luck, do a basic uid search */
 132         if (BER_BVISEMPTY(&pi->dn) && (ni->ni_pam_opts & NI_PAM_UID2DN)) {
 133                 nssov_uid2dn(op, ni, &pi->uid, &pi->dn);
 134                 if (!BER_BVISEMPTY(&pi->dn)) {
 135                         sdn = pi->dn;
 136                         dnNormalize( 0, NULL, NULL, &sdn, &pi->dn, op->o_tmpmemctx );
 137                 }
 138         }
 139         if (BER_BVISEMPTY(&pi->dn)) {
 140                 return NSLCD_PAM_USER_UNKNOWN;
 141         }
 142         return 0;
 143 }
 144
 145 int pam_do_bind(nssov_info *ni,TFILE *fp,Operation *op,
 146         struct paminfo *pi)
 147 {
 148         int rc;
 149         slap_callback cb = {0};
 150         SlapReply rs = {REP_RESULT};
 151
 152         pi->msg.bv_val = pi->pwd.bv_val;
 153         pi->msg.bv_len = 0;
 154         pi->authz = NSLCD_PAM_SUCCESS;
 155
 156         if (!pi->ispwdmgr) {
 157
 158                 BER_BVZERO(&pi->dn);
 159                 rc = pam_uid2dn(ni, op, pi);
 160                 if (rc) goto finish;
 161
 162                 if (BER_BVISEMPTY(&pi->pwd)) {
 163                         rc = NSLCD_PAM_PERM_DENIED;
 164                         goto finish;
 165                 }
 166
 167                 /* Should only need to do this once at open time, but there's always
 168                  * the possibility that ppolicy will get loaded later.
 169                  */
 170                 if (!ppolicy_cid) {
 171                         rc = slap_find_control_id(LDAP_CONTROL_PASSWORDPOLICYREQUEST,
 172                                 &ppolicy_cid);
 173                 }
 174                 /* of course, 0 is a valid cid, but it won't be ppolicy... */
 175                 if (ppolicy_cid) {
 176                         op->o_ctrlflag[ppolicy_cid] = SLAP_CONTROL_NONCRITICAL;
 177                 }
 178         }
 179
 180         cb.sc_response = pam_bindcb;
 181         cb.sc_private = pi;
 182         op->o_callback = &cb;
 183         op->o_dn.bv_val[0] = 0;
 184         op->o_dn.bv_len = 0;
 185         op->o_ndn.bv_val[0] = 0;
 186         op->o_ndn.bv_len = 0;
 187         op->o_tag = LDAP_REQ_BIND;
 188         op->o_protocol = LDAP_VERSION3;
 189         op->orb_method = LDAP_AUTH_SIMPLE;
 190         op->orb_cred = pi->pwd;
 191         op->o_req_dn = pi->dn;
 192         op->o_req_ndn = pi->dn;
 193         slap_op_time( &op->o_time, &op->o_tincr );
 194         rc = op->o_bd->be_bind( op, &rs );
 195         memset(pi->pwd.bv_val,0,pi->pwd.bv_len);
 196         /* quirk: on successful bind, caller has to send result. we need
 197          * to make sure callbacks run.
 198          */
 199         if (rc == LDAP_SUCCESS)
 200                 send_ldap_result(op, &rs);
 201         switch(rs.sr_err) {
 202         case LDAP_SUCCESS: rc = NSLCD_PAM_SUCCESS; break;
 203         case LDAP_INVALID_CREDENTIALS: rc = NSLCD_PAM_AUTH_ERR; break;
 204         default: rc = NSLCD_PAM_AUTH_ERR; break;
 205         }
 206 finish:
 207         Debug(LDAP_DEBUG_ANY,"pam_do_bind (%s): rc (%d)\n",
 208                 pi->dn.bv_val ? pi->dn.bv_val : "NULL", rc, 0);
 209         return rc;
 210 }
 211
 212 int pam_authc(nssov_info *ni,TFILE *fp,Operation *op,uid_t calleruid)
 213 {
 214         int32_t tmpint32;
 215         int rc;
 216         slap_callback cb = {0};
 217         char dnc[1024];
 218         char uidc[32];
 219         char svcc[256];
 220         char pwdc[256];
 221         struct berval sdn, dn;
 222         struct paminfo pi;
 223
 224
 225         READ_STRING(fp,uidc);
 226         pi.uid.bv_val = uidc;
 227         pi.uid.bv_len = tmpint32;
 228         READ_STRING(fp,dnc);
 229         pi.dn.bv_val = dnc;
 230         pi.dn.bv_len = tmpint32;
 231         READ_STRING(fp,svcc);
 232         pi.svc.bv_val = svcc;
 233         pi.svc.bv_len = tmpint32;
 234         READ_STRING(fp,pwdc);
 235         pi.pwd.bv_val = pwdc;
 236         pi.pwd.bv_len = tmpint32;
 237
 238         Debug(LDAP_DEBUG_TRACE,"nssov_pam_authc(%s)\n",
 239                         pi.uid.bv_val ? pi.uid.bv_val : "NULL",0,0);
 240
 241         pi.ispwdmgr = 0;
 242
 243         /* if service is "passwd" and "nssov-pam-password-prohibit-message */
 244         /* is set, deny the auth request */
 245         if (!strcmp(svcc, "passwd") &&
 246                 !BER_BVISEMPTY(&ni->ni_pam_password_prohibit_message)) {
 247                 Debug(LDAP_DEBUG_TRACE,"nssov_pam_authc(): %s (%s)\n",
 248                         "password_prohibit_message for passwd",
 249                         ni->ni_pam_password_prohibit_message.bv_val,0);
 250                 ber_str2bv(ni->ni_pam_password_prohibit_message.bv_val, 0, 0, &pi.msg);
 251                 pi.authz = NSLCD_PAM_PERM_DENIED;
 252                 rc = NSLCD_PAM_PERM_DENIED;
 253                 goto finish;
 254         }
 255
 256         /* if username is null, pwdmgr password preliminary check */
 257         if (BER_BVISEMPTY(&pi.uid)) {
 258                 if (BER_BVISEMPTY(&ni->ni_pam_pwdmgr_dn)) {
 259                         /* pwdmgr dn not configured */
 260                         Debug(LDAP_DEBUG_TRACE,"nssov_pam_authc(prelim check): %s\n",
 261                                 "pwdmgr dn not configured", 0, 0);
 262                         ber_str2bv("pwdmgr dn not configured", 0, 0, &pi.msg);
 263                         pi.authz = NSLCD_PAM_PERM_DENIED;
 264                         rc = NSLCD_PAM_PERM_DENIED;
 265                         goto finish;
 266                 } else if (calleruid != 0) {
 267                         Debug(LDAP_DEBUG_TRACE,"nssov_pam_authc(prelim check): %s\n",
 268                                 "caller is not root", 0, 0);
 269                         ber_str2bv("only root may do that", 0, 0, &pi.msg);
 270                         pi.authz = NSLCD_PAM_PERM_DENIED;
 271                         rc = NSLCD_PAM_PERM_DENIED;
 272                         goto finish;
 273                 } else {
 274                         /* use pwdmgr dn */
 275                         ber_str2bv(ni->ni_pam_pwdmgr_dn.bv_val, 0, 0, &pi.dn);
 276                 }
 277
 278                 /* use pwdmgr pwd if configured */
 279                 if (BER_BVISEMPTY(&pi.pwd)) {
 280                         if (BER_BVISEMPTY(&ni->ni_pam_pwdmgr_pwd)) {
 281                                 Debug(LDAP_DEBUG_TRACE,"nssov_pam_authc(prelim check): %s\n",
 282                                         "no pwdmgr pwd", 0, 0);
 283                                 ber_str2bv("pwdmgr pwd not configured", 0, 0, &pi.msg);
 284                                 pi.authz = NSLCD_PAM_PERM_DENIED;
 285                                 rc = NSLCD_PAM_PERM_DENIED;
 286                                 goto finish;
 287                         }
 288                         /* use configured pwdmgr pwd */
 289                         memset((void *) pwdc, 0, 256);
 290                         strncpy(pi.pwd.bv_val, ni->ni_pam_pwdmgr_pwd.bv_val,
 291                                         ni->ni_pam_pwdmgr_pwd.bv_len);
 292                         pi.pwd.bv_len = ni->ni_pam_pwdmgr_pwd.bv_len;
 293                 }
 294                 pi.ispwdmgr = 1;
 295         }
 296
 297
 298         rc = pam_do_bind(ni, fp, op, &pi);
 299
 300 finish:
 301         Debug(LDAP_DEBUG_TRACE,"nssov_pam_authc(%s): rc (%d)\n",
 302                 pi.dn.bv_val ? pi.dn.bv_val : "NULL",rc,0);
 303         WRITE_INT32(fp,NSLCD_VERSION);
 304         WRITE_INT32(fp,NSLCD_ACTION_PAM_AUTHC);
 305         WRITE_INT32(fp,NSLCD_RESULT_BEGIN);
 306         WRITE_BERVAL(fp,&pi.uid);
 307         WRITE_BERVAL(fp,&pi.dn);
 308         WRITE_INT32(fp,rc);
 309         WRITE_INT32(fp,pi.authz);       /* authz */
 310         WRITE_BERVAL(fp,&pi.msg);       /* authzmsg */
 311         return 0;
 312 }
 313
 314 static struct berval grpmsg =
 315         BER_BVC("Access denied by group check");
 316 static struct berval hostmsg =
 317         BER_BVC("Access denied for this host");
 318 static struct berval svcmsg =
 319         BER_BVC("Access denied for this service");
 320 static struct berval uidmsg =
 321         BER_BVC("Access denied by UID check");
 322
 323 static int pam_compare_cb(Operation *op, SlapReply *rs)
 324 {
 325         if (rs->sr_err == LDAP_COMPARE_TRUE)
 326                 op->o_callback->sc_private = (void *)1;
 327         return LDAP_SUCCESS;
 328 }
 329
 330 int pam_authz(nssov_info *ni,TFILE *fp,Operation *op)
 331 {
 332         struct berval dn, uid, svc, ruser, rhost, tty;
 333         struct berval authzmsg = BER_BVNULL;
 334         int32_t tmpint32;
 335         char dnc[1024];
 336         char uidc[32];
 337         char svcc[256];
 338         char ruserc[32];
 339         char rhostc[256];
 340         char ttyc[256];
 341         int rc;
 342         Entry *e = NULL;
 343         Attribute *a;
 344         slap_callback cb = {0};
 345
 346         READ_STRING(fp,uidc);
 347         uid.bv_val = uidc;
 348         uid.bv_len = tmpint32;
 349         READ_STRING(fp,dnc);
 350         dn.bv_val = dnc;
 351         dn.bv_len = tmpint32;
 352         READ_STRING(fp,svcc);
 353         svc.bv_val = svcc;
 354         svc.bv_len = tmpint32;
 355         READ_STRING(fp,ruserc);
 356         ruser.bv_val = ruserc;
 357         ruser.bv_len = tmpint32;
 358         READ_STRING(fp,rhostc);
 359         rhost.bv_val = rhostc;
 360         rhost.bv_len = tmpint32;
 361         READ_STRING(fp,ttyc);
 362         tty.bv_val = ttyc;
 363         tty.bv_len = tmpint32;
 364
 365         Debug(LDAP_DEBUG_TRACE,"nssov_pam_authz(%s)\n",
 366                         dn.bv_val ? dn.bv_val : "NULL",0,0);
 367
 368         /* If we didn't do authc, we don't have a DN yet */
 369         if (BER_BVISEMPTY(&dn)) {
 370                 struct paminfo pi;
 371                 pi.uid = uid;
 372                 pi.svc = svc;
 373
 374                 rc = pam_uid2dn(ni, op, &pi);
 375                 if (rc) goto finish;
 376                 dn = pi.dn;
 377         }
 378
 379         /* See if they have access to the host and service */
 380         if ((ni->ni_pam_opts & NI_PAM_HOSTSVC) && nssov_pam_svc_ad) {
 381                 AttributeAssertion ava = ATTRIBUTEASSERTION_INIT;
 382                 struct berval hostdn = BER_BVNULL;
 383                 struct berval odn = op->o_ndn;
 384                 SlapReply rs = {REP_RESULT};
 385                 op->o_dn = dn;
 386                 op->o_ndn = dn;
 387                 {
 388                         nssov_mapinfo *mi = &ni->ni_maps[NM_host];
 389                         char fbuf[1024];
 390                         struct berval filter = {sizeof(fbuf),fbuf};
 391                         SlapReply rs2 = {REP_RESULT};
 392
 393                         /* Lookup the host entry */
 394                         nssov_filter_byname(mi,0,&global_host_bv,&filter);
 395                         cb.sc_private = &hostdn;
 396                         cb.sc_response = nssov_name2dn_cb;
 397                         op->o_callback = &cb;
 398                         op->o_req_dn = mi->mi_base;
 399                         op->o_req_ndn = mi->mi_base;
 400                         op->ors_scope = mi->mi_scope;
 401                         op->ors_filterstr = filter;
 402                         op->ors_filter = str2filter_x(op, filter.bv_val);
 403                         op->ors_attrs = slap_anlist_no_attrs;
 404                         op->ors_tlimit = SLAP_NO_LIMIT;
 405                         op->ors_slimit = 2;
 406                         rc = op->o_bd->be_search(op, &rs2);
 407                         filter_free_x(op, op->ors_filter, 1);
 408
 409                         if (BER_BVISEMPTY(&hostdn) &&
 410                                 !BER_BVISEMPTY(&ni->ni_pam_defhost)) {
 411                                 filter.bv_len = sizeof(fbuf);
 412                                 filter.bv_val = fbuf;
 413                                 rs_reinit(&rs2, REP_RESULT);
 414                                 nssov_filter_byname(mi,0,&ni->ni_pam_defhost,&filter);
 415                                 op->ors_filterstr = filter;
 416                                 op->ors_filter = str2filter_x(op, filter.bv_val);
 417                                 rc = op->o_bd->be_search(op, &rs2);
 418                                 filter_free_x(op, op->ors_filter, 1);
 419                         }
 420
 421                         /* no host entry, no default host -> deny */
 422                         if (BER_BVISEMPTY(&hostdn)) {
 423                                 rc = NSLCD_PAM_PERM_DENIED;
 424                                 authzmsg = hostmsg;
 425                                 goto finish;
 426                         }
 427                 }
 428
 429                 cb.sc_response = pam_compare_cb;
 430                 cb.sc_private = NULL;
 431                 op->o_tag = LDAP_REQ_COMPARE;
 432                 op->o_req_dn = hostdn;
 433                 op->o_req_ndn = hostdn;
 434                 ava.aa_desc = nssov_pam_svc_ad;
 435                 ava.aa_value = svc;
 436                 op->orc_ava = &ava;
 437                 rc = op->o_bd->be_compare( op, &rs );
 438                 if ( cb.sc_private == NULL ) {
 439                         authzmsg = svcmsg;
 440                         rc = NSLCD_PAM_PERM_DENIED;
 441                         goto finish;
 442                 }
 443                 op->o_dn = odn;
 444                 op->o_ndn = odn;
 445         }
 446
 447         /* See if they're a member of the group */
 448         if ((ni->ni_pam_opts & NI_PAM_USERGRP) &&
 449                 !BER_BVISEMPTY(&ni->ni_pam_group_dn) &&
 450                 ni->ni_pam_group_ad) {
 451                 AttributeAssertion ava = ATTRIBUTEASSERTION_INIT;
 452                 SlapReply rs = {REP_RESULT};
 453                 op->o_callback = &cb;
 454                 cb.sc_response = pam_compare_cb;
 455                 cb.sc_private = NULL;
 456                 op->o_tag = LDAP_REQ_COMPARE;
 457                 op->o_req_dn = ni->ni_pam_group_dn;
 458                 op->o_req_ndn = ni->ni_pam_group_dn;
 459                 ava.aa_desc = ni->ni_pam_group_ad;
 460                 ava.aa_value = dn;
 461                 op->orc_ava = &ava;
 462                 rc = op->o_bd->be_compare( op, &rs );
 463                 if ( cb.sc_private == NULL ) {
 464                         authzmsg = grpmsg;
 465                         rc = NSLCD_PAM_PERM_DENIED;
 466                         goto finish;
 467                 }
 468         }
 469
 470         /* We need to check the user's entry for these bits */
 471         if ((ni->ni_pam_opts & (NI_PAM_USERHOST|NI_PAM_USERSVC)) ||
 472                 ni->ni_pam_template_ad ||
 473                 ni->ni_pam_min_uid || ni->ni_pam_max_uid ) {
 474                 rc = be_entry_get_rw( op, &dn, NULL, NULL, 0, &e );
 475                 if (rc != LDAP_SUCCESS) {
 476                         rc = NSLCD_PAM_USER_UNKNOWN;
 477                         goto finish;
 478                 }
 479         }
 480         if ((ni->ni_pam_opts & NI_PAM_USERHOST) && nssov_pam_host_ad) {
 481                 a = attr_find(e->e_attrs, nssov_pam_host_ad);
 482                 if (!a || attr_valfind( a,
 483                         SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
 484                         SLAP_MR_VALUE_OF_SYNTAX,
 485                         &global_host_bv, NULL, op->o_tmpmemctx )) {
 486                         rc = NSLCD_PAM_PERM_DENIED;
 487                         authzmsg = hostmsg;
 488                         goto finish;
 489                 }
 490         }
 491         if ((ni->ni_pam_opts & NI_PAM_USERSVC) && nssov_pam_svc_ad) {
 492                 a = attr_find(e->e_attrs, nssov_pam_svc_ad);
 493                 if (!a || attr_valfind( a,
 494                         SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
 495                         SLAP_MR_VALUE_OF_SYNTAX,
 496                         &svc, NULL, op->o_tmpmemctx )) {
 497                         rc = NSLCD_PAM_PERM_DENIED;
 498                         authzmsg = svcmsg;
 499                         goto finish;
 500                 }
 501         }
 502
 503 /* from passwd.c */
 504 #define UIDN_KEY        2
 505
 506         if (ni->ni_pam_min_uid || ni->ni_pam_max_uid) {
 507                 int id;
 508                 char *tmp;
 509                 nssov_mapinfo *mi = &ni->ni_maps[NM_passwd];
 510                 a = attr_find(e->e_attrs, mi->mi_attrs[UIDN_KEY].an_desc);
 511                 if (!a) {
 512                         rc = NSLCD_PAM_PERM_DENIED;
 513                         authzmsg = uidmsg;
 514                         goto finish;
 515                 }
 516                 id = (int)strtol(a->a_vals[0].bv_val,&tmp,0);
 517                 if (a->a_vals[0].bv_val[0] == '\0' || *tmp != '\0') {
 518                         rc = NSLCD_PAM_PERM_DENIED;
 519                         authzmsg = uidmsg;
 520                         goto finish;
 521                 }
 522                 if ((ni->ni_pam_min_uid && id < ni->ni_pam_min_uid) ||
 523                         (ni->ni_pam_max_uid && id > ni->ni_pam_max_uid)) {
 524                         rc = NSLCD_PAM_PERM_DENIED;
 525                         authzmsg = uidmsg;
 526                         goto finish;
 527                 }
 528         }
 529
 530         if (ni->ni_pam_template_ad) {
 531                 a = attr_find(e->e_attrs, ni->ni_pam_template_ad);
 532                 if (a)
 533                         uid = a->a_vals[0];
 534                 else if (!BER_BVISEMPTY(&ni->ni_pam_template))
 535                         uid = ni->ni_pam_template;
 536         }
 537         rc = NSLCD_PAM_SUCCESS;
 538
 539 finish:
 540         WRITE_INT32(fp,NSLCD_VERSION);
 541         WRITE_INT32(fp,NSLCD_ACTION_PAM_AUTHZ);
 542         WRITE_INT32(fp,NSLCD_RESULT_BEGIN);
 543         WRITE_BERVAL(fp,&uid);
 544         WRITE_BERVAL(fp,&dn);
 545         WRITE_INT32(fp,rc);
 546         WRITE_BERVAL(fp,&authzmsg);
 547         if (e) {
 548                 be_entry_release_r(op, e);
 549         }
 550         switch (rc) {
 551         case NSLCD_PAM_SUCCESS:
 552                 Debug(LDAP_DEBUG_TRACE,"nssov_pam_authz(): success\n", 0,0,0);
 553                 break;
 554         case NSLCD_PAM_PERM_DENIED:
 555                 Debug(LDAP_DEBUG_TRACE,"nssov_pam_authz(): %s\n",
 556                         authzmsg.bv_val ? authzmsg.bv_val : "NULL",0,0);
 557                 break;
 558         default:
 559                 Debug(LDAP_DEBUG_TRACE,
 560                         "nssov_pam_authz(): permission denied, rc (%d)\n",
 561                         rc, 0, 0);
 562         }
 563         return 0;
 564 }
 565
 566 static int pam_sess(nssov_info *ni,TFILE *fp,Operation *op,int action)
 567 {
 568         struct berval dn, uid, svc, tty, rhost, ruser;
 569         int32_t tmpint32;
 570         char dnc[1024];
 571         char svcc[256];
 572         char uidc[32];
 573         char ttyc[32];
 574         char rhostc[256];
 575         char ruserc[32];
 576         slap_callback cb = {0};
 577         SlapReply rs = {REP_RESULT};
 578         char timebuf[LDAP_LUTIL_GENTIME_BUFSIZE];
 579         struct berval timestamp, bv[2], *nbv;
 580         time_t stamp;
 581         Modifications mod;
 582         int rc = 0;
 583         int sessionID = -1;
 584
 585         READ_STRING(fp,uidc);
 586         uid.bv_val = uidc;
 587         uid.bv_len = tmpint32;
 588         READ_STRING(fp,dnc);
 589         dn.bv_val = dnc;
 590         dn.bv_len = tmpint32;
 591         READ_STRING(fp,svcc);
 592         svc.bv_val = svcc;
 593         svc.bv_len = tmpint32;
 594         READ_STRING(fp,ttyc);
 595         tty.bv_val = ttyc;
 596         tty.bv_len = tmpint32;
 597         READ_STRING(fp,rhostc);
 598         rhost.bv_val = rhostc;
 599         rhost.bv_len = tmpint32;
 600         READ_STRING(fp,ruserc);
 601         ruser.bv_val = ruserc;
 602         ruser.bv_len = tmpint32;
 603         READ_INT32(fp,stamp);
 604
 605         Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_%c(%s)\n",
 606                 action==NSLCD_ACTION_PAM_SESS_O ? 'o' : 'c', dn.bv_val,0);
 607
 608         if (!dn.bv_len) {
 609                 Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_%c(): %s\n",
 610                         action==NSLCD_ACTION_PAM_SESS_O ? 'o' : 'c', "null DN",0);
 611                 rc = -1;
 612                 goto done;
 613         }
 614
 615         if (!ni->ni_pam_sessions) {
 616                 Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_%c(): %s\n",
 617                         action==NSLCD_ACTION_PAM_SESS_O ? 'o' : 'c',
 618                         "pam session(s) not configured, ignored",0);
 619                 rc = -1;
 620                 goto done;
 621         }
 622
 623         {
 624                 int i, found=0;
 625                 for (i=0; !BER_BVISNULL(&ni->ni_pam_sessions[i]); i++) {
 626                         if (ni->ni_pam_sessions[i].bv_len != svc.bv_len)
 627                                 continue;
 628                         if (!strcasecmp(ni->ni_pam_sessions[i].bv_val, svc.bv_val)) {
 629                                 found = 1;
 630                                 break;
 631                         }
 632                 }
 633                 if (!found) {
 634                         Debug(LDAP_DEBUG_TRACE,
 635                                 "nssov_pam_sess_%c(): service(%s) not configured, ignored\n",
 636                                 action==NSLCD_ACTION_PAM_SESS_O ? 'o' : 'c',
 637                                 svc.bv_val,0);
 638                         rc = -1;
 639                         goto done;
 640                 }
 641         }
 642
 643         slap_op_time( &op->o_time, &op->o_tincr );
 644         timestamp.bv_len = sizeof(timebuf);
 645         timestamp.bv_val = timebuf;
 646         if (action == NSLCD_ACTION_PAM_SESS_O )
 647                 stamp = op->o_time;
 648         slap_timestamp( &stamp, &timestamp );
 649         bv[0].bv_len = timestamp.bv_len + global_host_bv.bv_len + svc.bv_len +
 650                 tty.bv_len + ruser.bv_len + rhost.bv_len + STRLENOF("    (@)");
 651         bv[0].bv_val = op->o_tmpalloc( bv[0].bv_len+1, op->o_tmpmemctx );
 652         sprintf(bv[0].bv_val, "%s %s %s %s (%s@%s)",
 653                 timestamp.bv_val, global_host_bv.bv_val, svc.bv_val, tty.bv_val,
 654                 ruser.bv_val, rhost.bv_val);
 655
 656         Debug(LDAP_DEBUG_TRACE, "nssov_pam_sess_%c(): loginStatus (%s) \n",
 657                         action==NSLCD_ACTION_PAM_SESS_O ? 'o' : 'c', bv[0].bv_val,0);
 658
 659         mod.sml_numvals = 1;
 660         mod.sml_values = bv;
 661         BER_BVZERO(&bv[1]);
 662         attr_normalize( ad_loginStatus, bv, &nbv, op->o_tmpmemctx );
 663         mod.sml_nvalues = nbv;
 664         mod.sml_desc = ad_loginStatus;
 665         mod.sml_op = action == NSLCD_ACTION_PAM_SESS_O ? LDAP_MOD_ADD :
 666                 LDAP_MOD_DELETE;
 667         mod.sml_flags = SLAP_MOD_INTERNAL;
 668         mod.sml_next = NULL;
 669
 670         cb.sc_response = slap_null_cb;
 671         op->o_callback = &cb;
 672         op->o_tag = LDAP_REQ_MODIFY;
 673         op->o_dn = op->o_bd->be_rootdn;
 674         op->o_ndn = op->o_bd->be_rootndn;
 675         op->orm_modlist = &mod;
 676         op->orm_no_opattrs = 1;
 677         op->o_req_dn = dn;
 678         op->o_req_ndn = dn;
 679         if (op->o_bd->be_modify( op, &rs ) != LDAP_SUCCESS) {
 680                 Debug(LDAP_DEBUG_TRACE,
 681                         "nssov_pam_sess_%c(): modify op failed\n",
 682                         action==NSLCD_ACTION_PAM_SESS_O ? 'o' : 'c',
 683                         0,0);
 684                 rc = -1;
 685         }
 686
 687         if ( mod.sml_next ) {
 688                 slap_mods_free( mod.sml_next, 1 );
 689         }
 690         ber_bvarray_free_x( nbv, op->o_tmpmemctx );
 691
 692 done:;
 693
 694         if (rc == 0) {
 695                 Debug(LDAP_DEBUG_TRACE,
 696                         "nssov_pam_sess_%c(): success\n",
 697                         action==NSLCD_ACTION_PAM_SESS_O ? 'o' : 'c',
 698                         0,0);
 699                 sessionID = op->o_time;
 700         }
 701         WRITE_INT32(fp,NSLCD_VERSION);
 702         WRITE_INT32(fp,action);
 703         WRITE_INT32(fp,NSLCD_RESULT_BEGIN);
 704         WRITE_INT32(fp,sessionID);
 705         return 0;
 706 }
 707
 708 int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
 709 {
 710         return pam_sess(ni,fp,op,NSLCD_ACTION_PAM_SESS_O);
 711 }
 712
 713 int pam_sess_c(nssov_info *ni,TFILE *fp,Operation *op)
 714 {
 715         return pam_sess(ni,fp,op,NSLCD_ACTION_PAM_SESS_C);
 716 }
 717
 718 int pam_pwmod(nssov_info *ni,TFILE *fp,Operation *op,uid_t calleruid)
 719 {
 720         struct berval npw;
 721         int32_t tmpint32;
 722         char dnc[1024];
 723         char uidc[32];
 724         char opwc[256];
 725         char npwc[256];
 726         char svcc[256];
 727         struct paminfo pi;
 728         int rc;
 729
 730         READ_STRING(fp,uidc);
 731         pi.uid.bv_val = uidc;
 732         pi.uid.bv_len = tmpint32;
 733         READ_STRING(fp,dnc);
 734         pi.dn.bv_val = dnc;
 735         pi.dn.bv_len = tmpint32;
 736         READ_STRING(fp,svcc);
 737         pi.svc.bv_val = svcc;
 738         pi.svc.bv_len = tmpint32;
 739         READ_STRING(fp,opwc);
 740         pi.pwd.bv_val = opwc;
 741         pi.pwd.bv_len = tmpint32;
 742         READ_STRING(fp,npwc);
 743         npw.bv_val = npwc;
 744         npw.bv_len = tmpint32;
 745
 746         Debug(LDAP_DEBUG_TRACE,"nssov_pam_pwmod(%s), %s\n",
 747                 pi.dn.bv_val ? pi.dn.bv_val : "NULL",
 748                 pi.uid.bv_val ? pi.uid.bv_val : "NULL" ,0);
 749
 750         BER_BVZERO(&pi.msg);
 751         pi.ispwdmgr = 0;
 752
 753         /* nssov_pam prohibits password mod */
 754         if (!BER_BVISEMPTY(&ni->ni_pam_password_prohibit_message)) {
 755                 Debug(LDAP_DEBUG_TRACE,"nssov_pam_pwmod(): %s (%s)\n",
 756                         "password_prohibit_message",
 757                         ni->ni_pam_password_prohibit_message.bv_val,0);
 758                 ber_str2bv(ni->ni_pam_password_prohibit_message.bv_val, 0, 0, &pi.msg);
 759                 rc = NSLCD_PAM_PERM_DENIED;
 760                 goto done;
 761         }
 762
 763         if (BER_BVISEMPTY(&pi.dn)) {
 764                 /* should not be here at all, pam_authc() should have returned */
 765                 /* error */
 766                 Debug(LDAP_DEBUG_TRACE,"nssov_pam_pwmod(), %s\n",
 767                         "prelim checking failed", 0, 0);
 768                 ber_str2bv("no pwmod requesting dn", 0, 0, &pi.msg);
 769                 rc = NSLCD_PAM_PERM_DENIED;
 770                 goto done;
 771         }
 772
 773         if (!BER_BVISEMPTY(&ni->ni_pam_pwdmgr_dn) &&
 774                 !ber_bvcmp(&pi.dn, &ni->ni_pam_pwdmgr_dn)) {
 775                 if (calleruid != 0) {
 776                         Debug(LDAP_DEBUG_TRACE,"nssov_pam_pwmod(): %s\n",
 777                                 "caller is not root", 0, 0);
 778                         ber_str2bv("only root may do that", 0, 0, &pi.msg);
 779                         rc = NSLCD_PAM_PERM_DENIED;
 780                         goto done;
 781                 }
 782                 /* root user requesting pwmod, convert uid to dn */
 783                 pi.ispwdmgr = 1;
 784                 rc = pam_uid2dn(ni, op, &pi);
 785                 if (rc) {
 786                         ber_str2bv("unable to convert uid to dn", 0, 0, &pi.msg);
 787                         rc = NSLCD_PAM_PERM_DENIED;
 788                         goto done;
 789                 }
 790         }
 791
 792         if (!pi.ispwdmgr && BER_BVISEMPTY(&pi.pwd)) {
 793                 Debug(LDAP_DEBUG_TRACE,"nssov_pam_pwmod(), %s\n",
 794                         "not pwdmgr and old pwd empty", 0, 0);
 795                 ber_str2bv("must provide old password", 0, 0, &pi.msg);
 796                 rc = NSLCD_PAM_PERM_DENIED;
 797                 goto done;
 798         }
 799
 800         BerElementBuffer berbuf;
 801         BerElement *ber = (BerElement *)&berbuf;
 802         struct berval bv;
 803         SlapReply rs = {REP_RESULT};
 804         slap_callback cb = {0};
 805
 806         ber_init_w_nullc(ber, LBER_USE_DER);
 807         ber_printf(ber, "{");
 808         if (!BER_BVISEMPTY(&pi.dn))
 809                 ber_printf(ber, "tO", LDAP_TAG_EXOP_MODIFY_PASSWD_ID,
 810                         &pi.dn);
 811         /* supply old pwd whenever it's given */
 812         if (!BER_BVISEMPTY(&pi.pwd))
 813                 ber_printf(ber, "tO", LDAP_TAG_EXOP_MODIFY_PASSWD_OLD,
 814                         &pi.pwd);
 815         if (!BER_BVISEMPTY(&npw))
 816                 ber_printf(ber, "tO", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW,
 817                         &npw);
 818         ber_printf(ber, "N}");
 819         ber_flatten2(ber, &bv, 0);
 820         op->o_tag = LDAP_REQ_EXTENDED;
 821         op->ore_reqoid = slap_EXOP_MODIFY_PASSWD;
 822         op->ore_reqdata = &bv;
 823
 824         if (pi.ispwdmgr) {
 825                 /* root user changing end-user passwords */
 826                 op->o_dn = ni->ni_pam_pwdmgr_dn;
 827                 op->o_ndn = ni->ni_pam_pwdmgr_dn;
 828         } else {
 829                 /* end-user self-pwd-mod */
 830                 op->o_dn = pi.dn;
 831                 op->o_ndn = pi.dn;
 832         }
 833         op->o_callback = &cb;
 834         op->o_conn->c_authz_backend = op->o_bd;
 835         cb.sc_response = slap_null_cb;
 836         op->o_bd = frontendDB;
 837         rc = op->o_bd->be_extended(op, &rs);
 838         if (rs.sr_text)
 839                 ber_str2bv(rs.sr_text, 0, 0, &pi.msg);
 840         if (rc == LDAP_SUCCESS)
 841                 rc = NSLCD_PAM_SUCCESS;
 842         else
 843                 rc = NSLCD_PAM_PERM_DENIED;
 844
 845 done:;
 846         Debug(LDAP_DEBUG_TRACE,"nssov_pam_pwmod(), rc (%d)\n", rc, 0, 0);
 847         WRITE_INT32(fp,NSLCD_VERSION);
 848         WRITE_INT32(fp,NSLCD_ACTION_PAM_PWMOD);
 849         WRITE_INT32(fp,NSLCD_RESULT_BEGIN);
 850         WRITE_BERVAL(fp,&pi.uid);
 851         WRITE_BERVAL(fp,&pi.dn);
 852         WRITE_INT32(fp,rc);
 853         WRITE_BERVAL(fp,&pi.msg);
 854         return 0;
 855 }
 856
 857 int nssov_pam_init()
 858 {
 859         int code = 0;
 860         const char *text;
 861         if (!ad_loginStatus)
 862                 code = slap_str2ad("loginStatus", &ad_loginStatus, &text);
 863
 864         return code;
 865 }