git.sur5r.net Git - openldap/blob - contrib/slapd-modules/nssov/pam.c

   1 /* pam.c - pam processing routines */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 2009 by Howard Chu, Symas Corp.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in the file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15
  16 #include "nssov.h"
  17 #include "lutil.h"
  18
  19 static int ppolicy_cid;
  20 static AttributeDescription *ad_loginStatus;
  21
  22 const char *at_loginStatus =
  23         "( 1.3.6.1.4.1.4745.1.20.1 "
  24         "NAME ( 'loginStatus' ) "
  25         "DESC 'Currently logged in sessions for a user' "
  26         "EQUALITY caseIgnoreMatch "
  27         "SUBSTR caseIgnoreSubstringsMatch "
  28         "ORDERING caseIgnoreOrderingMatch "
  29         "SYNTAX OMsDirectoryString "
  30         "USAGE directoryOperation )";
  31
  32 struct paminfo {
  33         struct berval uid;
  34         struct berval dn;
  35         struct berval svc;
  36         struct berval pwd;
  37         int authz;
  38         struct berval msg;
  39 };
  40
  41 static int pam_bindcb(
  42         Operation *op, SlapReply *rs)
  43 {
  44         struct paminfo *pi = op->o_callback->sc_private;
  45         LDAPControl *ctrl = ldap_control_find(LDAP_CONTROL_PASSWORDPOLICYRESPONSE,
  46                 rs->sr_ctrls, NULL);
  47         if (ctrl) {
  48                 LDAP *ld;
  49                 ber_int_t expire, grace;
  50                 LDAPPasswordPolicyError error;
  51
  52                 ldap_create(&ld);
  53                 if (ld) {
  54                         int rc = ldap_parse_passwordpolicy_control(ld,ctrl,
  55                                 &expire,&grace,&error);
  56                         if (rc == LDAP_SUCCESS) {
  57                                 if (expire >= 0) {
  58                                         char *unit = "seconds";
  59                                         if (expire > 60) {
  60                                                 expire /= 60;
  61                                                 unit = "minutes";
  62                                         }
  63                                         if (expire > 60) {
  64                                                 expire /= 60;
  65                                                 unit = "hours";
  66                                         }
  67                                         if (expire > 24) {
  68                                                 expire /= 24;
  69                                                 unit = "days";
  70                                         }
  71 #if 0   /* Who warns about expiration so far in advance? */
  72                                         if (expire > 7) {
  73                                                 expire /= 7;
  74                                                 unit = "weeks";
  75                                         }
  76                                         if (expire > 4) {
  77                                                 expire /= 4;
  78                                                 unit = "months";
  79                                         }
  80                                         if (expire > 12) {
  81                                                 expire /= 12;
  82                                                 unit = "years";
  83                                         }
  84 #endif
  85                                         pi->msg.bv_len = sprintf(pi->msg.bv_val,
  86                                                 "\nWARNING: Password expires in %d %s\n", expire, unit);
  87                                 } else if (grace > 0) {
  88                                         pi->msg.bv_len = sprintf(pi->msg.bv_val,
  89                                                 "Password expired; %d grace logins remaining",
  90                                                 grace);
  91                                         pi->authz = NSLCD_PAM_NEW_AUTHTOK_REQD;
  92                                 } else if (error != PP_noError) {
  93                                         ber_str2bv(ldap_passwordpolicy_err2txt(error), 0, 0,
  94                                                 &pi->msg);
  95                                         switch (error) {
  96                                         case PP_passwordExpired:
  97                                                 /* report this during authz */
  98                                                 rs->sr_err = LDAP_SUCCESS;
  99                                                 /* fallthru */
 100                                         case PP_changeAfterReset:
 101                                                 pi->authz = NSLCD_PAM_NEW_AUTHTOK_REQD;
 102                                         }
 103                                 }
 104                         }
 105                         ldap_ld_free(ld,0,NULL,NULL);
 106                 }
 107         }
 108         return LDAP_SUCCESS;
 109 }
 110
 111 int pam_do_bind(nssov_info *ni,TFILE *fp,Operation *op,
 112         struct paminfo *pi)
 113 {
 114         int rc;
 115         slap_callback cb = {0};
 116         SlapReply rs = {REP_RESULT};
 117         struct berval sdn;
 118
 119         pi->msg.bv_val = pi->pwd.bv_val;
 120         pi->msg.bv_len = 0;
 121         pi->authz = NSLCD_PAM_SUCCESS;
 122         BER_BVZERO(&pi->dn);
 123
 124         if (!isvalidusername(&pi->uid)) {
 125                 Debug(LDAP_DEBUG_ANY,"nssov_pam_do_bind(%s): invalid user name\n",
 126                         pi->uid.bv_val,0,0);
 127                 rc = NSLCD_PAM_USER_UNKNOWN;
 128                 goto finish;
 129         }
 130
 131         if (ni->ni_pam_opts & NI_PAM_SASL2DN) {
 132                 int hlen = global_host_bv.bv_len;
 133
 134                 /* cn=<service>+uid=<user>,cn=<host>,cn=pam,cn=auth */
 135                 sdn.bv_len = pi->uid.bv_len + pi->svc.bv_len + hlen +
 136                         STRLENOF( "cn=+uid=,cn=,cn=pam,cn=auth" );
 137                 sdn.bv_val = op->o_tmpalloc( sdn.bv_len + 1, op->o_tmpmemctx );
 138                 sprintf(sdn.bv_val, "cn=%s+uid=%s,cn=%s,cn=pam,cn=auth",
 139                         pi->svc.bv_val, pi->uid.bv_val, global_host_bv.bv_val);
 140                 slap_sasl2dn(op, &sdn, &pi->dn, 0);
 141                 op->o_tmpfree( sdn.bv_val, op->o_tmpmemctx );
 142         }
 143
 144         /* If no luck, do a basic uid search */
 145         if (BER_BVISEMPTY(&pi->dn) && (ni->ni_pam_opts & NI_PAM_UID2DN)) {
 146                 nssov_uid2dn(op, ni, &pi->uid, &pi->dn);
 147                 if (!BER_BVISEMPTY(&pi->dn)) {
 148                         sdn = pi->dn;
 149                         dnNormalize( 0, NULL, NULL, &sdn, &pi->dn, op->o_tmpmemctx );
 150                 }
 151         }
 152         BER_BVZERO(&sdn);
 153         if (BER_BVISEMPTY(&pi->dn)) {
 154                 rc = NSLCD_PAM_USER_UNKNOWN;
 155                 goto finish;
 156         }
 157
 158         if (BER_BVISEMPTY(&pi->pwd)) {
 159                 rc = NSLCD_PAM_IGNORE;
 160                 goto finish;
 161         }
 162
 163         /* Should only need to do this once at open time, but there's always
 164          * the possibility that ppolicy will get loaded later.
 165          */
 166         if (!ppolicy_cid) {
 167                 rc = slap_find_control_id(LDAP_CONTROL_PASSWORDPOLICYREQUEST,
 168                         &ppolicy_cid);
 169         }
 170         /* of course, 0 is a valid cid, but it won't be ppolicy... */
 171         if (ppolicy_cid) {
 172                 op->o_ctrlflag[ppolicy_cid] = SLAP_CONTROL_NONCRITICAL;
 173         }
 174         cb.sc_response = pam_bindcb;
 175         cb.sc_private = pi;
 176         op->o_callback = &cb;
 177         op->o_dn.bv_val[0] = 0;
 178         op->o_dn.bv_len = 0;
 179         op->o_ndn.bv_val[0] = 0;
 180         op->o_ndn.bv_len = 0;
 181         op->o_tag = LDAP_REQ_BIND;
 182         op->o_protocol = LDAP_VERSION3;
 183         op->orb_method = LDAP_AUTH_SIMPLE;
 184         op->orb_cred = pi->pwd;
 185         op->o_req_dn = pi->dn;
 186         op->o_req_ndn = pi->dn;
 187         slap_op_time( &op->o_time, &op->o_tincr );
 188         rc = op->o_bd->be_bind( op, &rs );
 189         memset(pi->pwd.bv_val,0,pi->pwd.bv_len);
 190         /* quirk: on successful bind, caller has to send result. we need
 191          * to make sure callbacks run.
 192          */
 193         if (rc == LDAP_SUCCESS)
 194                 send_ldap_result(op, &rs);
 195         switch(rs.sr_err) {
 196         case LDAP_SUCCESS: rc = NSLCD_PAM_SUCCESS; break;
 197         case LDAP_INVALID_CREDENTIALS: rc = NSLCD_PAM_AUTH_ERR; break;
 198         default: rc = NSLCD_PAM_AUTH_ERR; break;
 199         }
 200 finish:
 201         return rc;
 202 }
 203
 204 int pam_authc(nssov_info *ni,TFILE *fp,Operation *op)
 205 {
 206         int32_t tmpint32;
 207         int rc;
 208         slap_callback cb = {0};
 209         SlapReply rs = {REP_RESULT};
 210         char dnc[1024];
 211         char uidc[32];
 212         char svcc[256];
 213         char pwdc[256];
 214         struct berval sdn, dn;
 215         struct paminfo pi;
 216
 217
 218         READ_STRING_BUF2(fp,uidc,sizeof(uidc));
 219         pi.uid.bv_val = uidc;
 220         pi.uid.bv_len = tmpint32;
 221         READ_STRING_BUF2(fp,dnc,sizeof(dnc));
 222         pi.dn.bv_val = dnc;
 223         pi.dn.bv_len = tmpint32;
 224         READ_STRING_BUF2(fp,svcc,sizeof(svcc));
 225         pi.svc.bv_val = svcc;
 226         pi.svc.bv_len = tmpint32;
 227         READ_STRING_BUF2(fp,pwdc,sizeof(pwdc));
 228         pi.pwd.bv_val = pwdc;
 229         pi.pwd.bv_len = tmpint32;
 230
 231         Debug(LDAP_DEBUG_TRACE,"nssov_pam_authc(%s)\n",pi.uid.bv_val,0,0);
 232
 233         rc = pam_do_bind(ni, fp, op, &pi);
 234
 235 finish:
 236         WRITE_INT32(fp,NSLCD_VERSION);
 237         WRITE_INT32(fp,NSLCD_ACTION_PAM_AUTHC);
 238         WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
 239         WRITE_BERVAL(fp,&pi.uid);
 240         WRITE_BERVAL(fp,&pi.dn);
 241         WRITE_INT32(fp,rc);
 242         WRITE_INT32(fp,pi.authz);       /* authz */
 243         WRITE_BERVAL(fp,&pi.msg);       /* authzmsg */
 244         return 0;
 245 }
 246
 247 static struct berval grpmsg =
 248         BER_BVC("Access denied by group check");
 249 static struct berval hostmsg =
 250         BER_BVC("Access denied for this host");
 251 static struct berval svcmsg =
 252         BER_BVC("Access denied for this service");
 253 static struct berval uidmsg =
 254         BER_BVC("Access denied by UID check");
 255
 256 int pam_authz(nssov_info *ni,TFILE *fp,Operation *op)
 257 {
 258         struct berval dn, uid, svc, ruser, rhost, tty;
 259         struct berval authzmsg = BER_BVNULL;
 260         int32_t tmpint32;
 261         char dnc[1024];
 262         char uidc[32];
 263         char svcc[256];
 264         char ruserc[32];
 265         char rhostc[256];
 266         char ttyc[256];
 267         int rc = NSLCD_PAM_SUCCESS;
 268         Entry *e = NULL;
 269         Attribute *a;
 270         SlapReply rs = {REP_RESULT};
 271         slap_callback cb = {0};
 272
 273         READ_STRING_BUF2(fp,uidc,sizeof(uidc));
 274         uid.bv_val = uidc;
 275         uid.bv_len = tmpint32;
 276         READ_STRING_BUF2(fp,dnc,sizeof(dnc));
 277         dn.bv_val = dnc;
 278         dn.bv_len = tmpint32;
 279         READ_STRING_BUF2(fp,svcc,sizeof(svcc));
 280         svc.bv_val = svcc;
 281         svc.bv_len = tmpint32;
 282         READ_STRING_BUF2(fp,svcc,sizeof(ruserc));
 283         ruser.bv_val = ruserc;
 284         ruser.bv_len = tmpint32;
 285         READ_STRING_BUF2(fp,svcc,sizeof(rhostc));
 286         rhost.bv_val = rhostc;
 287         rhost.bv_len = tmpint32;
 288         READ_STRING_BUF2(fp,svcc,sizeof(ttyc));
 289         tty.bv_val = ttyc;
 290         tty.bv_len = tmpint32;
 291
 292         Debug(LDAP_DEBUG_TRACE,"nssov_pam_authz(%s)\n",dn.bv_val,0,0);
 293
 294         /* We don't do authorization if they weren't authenticated by us */
 295         if (BER_BVISEMPTY(&dn)) {
 296                 rc = NSLCD_PAM_USER_UNKNOWN;
 297                 goto finish;
 298         }
 299
 300         /* See if they have access to the host and service */
 301         if ((ni->ni_pam_opts & NI_PAM_HOSTSVC) && nssov_pam_svc_ad) {
 302                 AttributeAssertion ava = ATTRIBUTEASSERTION_INIT;
 303                 struct berval hostdn = BER_BVNULL;
 304                 struct berval odn = op->o_ndn;
 305                 op->o_dn = dn;
 306                 op->o_ndn = dn;
 307                 {
 308                         nssov_mapinfo *mi = &ni->ni_maps[NM_host];
 309                         char fbuf[1024];
 310                         struct berval filter = {sizeof(fbuf),fbuf};
 311                         SlapReply rs2 = {REP_RESULT};
 312
 313                         /* Lookup the host entry */
 314                         nssov_filter_byname(mi,0,&global_host_bv,&filter);
 315                         cb.sc_private = &hostdn;
 316                         cb.sc_response = nssov_name2dn_cb;
 317                         op->o_callback = &cb;
 318                         op->o_req_dn = mi->mi_base;
 319                         op->o_req_ndn = mi->mi_base;
 320                         op->ors_scope = mi->mi_scope;
 321                         op->ors_filterstr = filter;
 322                         op->ors_filter = str2filter_x(op, filter.bv_val);
 323                         op->ors_attrs = slap_anlist_no_attrs;
 324                         op->ors_tlimit = SLAP_NO_LIMIT;
 325                         op->ors_slimit = 2;
 326                         rc = op->o_bd->be_search(op, &rs2);
 327                         filter_free_x(op, op->ors_filter, 1);
 328
 329                         if (BER_BVISEMPTY(&hostdn) &&
 330                                 !BER_BVISEMPTY(&ni->ni_pam_defhost)) {
 331                                 filter.bv_len = sizeof(fbuf);
 332                                 filter.bv_val = fbuf;
 333                                 memset(&rs2, 0, sizeof(rs2));
 334                                 rs2.sr_type = REP_RESULT;
 335                                 nssov_filter_byname(mi,0,&ni->ni_pam_defhost,&filter);
 336                                 op->ors_filterstr = filter;
 337                                 op->ors_filter = str2filter_x(op, filter.bv_val);
 338                                 rc = op->o_bd->be_search(op, &rs2);
 339                                 filter_free_x(op, op->ors_filter, 1);
 340                         }
 341
 342                         /* no host entry, no default host -> deny */
 343                         if (BER_BVISEMPTY(&hostdn)) {
 344                                 rc = NSLCD_PAM_PERM_DENIED;
 345                                 authzmsg = hostmsg;
 346                                 goto finish;
 347                         }
 348                 }
 349
 350                 cb.sc_response = slap_null_cb;
 351                 cb.sc_private = NULL;
 352                 op->o_tag = LDAP_REQ_COMPARE;
 353                 op->o_req_dn = hostdn;
 354                 op->o_req_ndn = hostdn;
 355                 ava.aa_desc = nssov_pam_svc_ad;
 356                 ava.aa_value = svc;
 357                 op->orc_ava = &ava;
 358                 rc = op->o_bd->be_compare( op, &rs );
 359                 if ( rs.sr_err != LDAP_COMPARE_TRUE ) {
 360                         authzmsg = svcmsg;
 361                         rc = NSLCD_PAM_PERM_DENIED;
 362                         goto finish;
 363                 }
 364                 op->o_dn = odn;
 365                 op->o_ndn = odn;
 366         }
 367
 368         /* See if they're a member of the group */
 369         if ((ni->ni_pam_opts & NI_PAM_USERGRP) &&
 370                 !BER_BVISEMPTY(&ni->ni_pam_group_dn) &&
 371                 ni->ni_pam_group_ad) {
 372                 AttributeAssertion ava = ATTRIBUTEASSERTION_INIT;
 373                 op->o_callback = &cb;
 374                 cb.sc_response = slap_null_cb;
 375                 op->o_tag = LDAP_REQ_COMPARE;
 376                 op->o_req_dn = ni->ni_pam_group_dn;
 377                 op->o_req_ndn = ni->ni_pam_group_dn;
 378                 ava.aa_desc = ni->ni_pam_group_ad;
 379                 ava.aa_value = dn;
 380                 op->orc_ava = &ava;
 381                 rc = op->o_bd->be_compare( op, &rs );
 382                 if ( rs.sr_err != LDAP_COMPARE_TRUE ) {
 383                         authzmsg = grpmsg;
 384                         rc = NSLCD_PAM_PERM_DENIED;
 385                         goto finish;
 386                 }
 387         }
 388
 389         /* We need to check the user's entry for these bits */
 390         if ((ni->ni_pam_opts & (NI_PAM_USERHOST|NI_PAM_USERSVC)) ||
 391                 ni->ni_pam_template_ad ||
 392                 ni->ni_pam_min_uid || ni->ni_pam_max_uid ) {
 393                 rc = be_entry_get_rw( op, &dn, NULL, NULL, 0, &e );
 394                 if (rc != LDAP_SUCCESS) {
 395                         rc = NSLCD_PAM_USER_UNKNOWN;
 396                         goto finish;
 397                 }
 398         }
 399         if ((ni->ni_pam_opts & NI_PAM_USERHOST) && nssov_pam_host_ad) {
 400                 a = attr_find(e->e_attrs, nssov_pam_host_ad);
 401                 if (!a || value_find_ex( nssov_pam_host_ad,
 402                         SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH,
 403                         a->a_vals, &global_host_bv, op->o_tmpmemctx )) {
 404                         rc = NSLCD_PAM_PERM_DENIED;
 405                         authzmsg = hostmsg;
 406                         goto finish;
 407                 }
 408         }
 409         if ((ni->ni_pam_opts & NI_PAM_USERSVC) && nssov_pam_svc_ad) {
 410                 a = attr_find(e->e_attrs, nssov_pam_svc_ad);
 411                 if (!a || value_find_ex( nssov_pam_svc_ad,
 412                         SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH,
 413                         a->a_vals, &svc, op->o_tmpmemctx )) {
 414                         rc = NSLCD_PAM_PERM_DENIED;
 415                         authzmsg = svcmsg;
 416                         goto finish;
 417                 }
 418         }
 419
 420 /* from passwd.c */
 421 #define UIDN_KEY        2
 422
 423         if (ni->ni_pam_min_uid || ni->ni_pam_max_uid) {
 424                 int id;
 425                 char *tmp;
 426                 nssov_mapinfo *mi = &ni->ni_maps[NM_host];
 427                 a = attr_find(e->e_attrs, mi->mi_attrs[UIDN_KEY].an_desc);
 428                 if (!a) {
 429                         rc = NSLCD_PAM_PERM_DENIED;
 430                         authzmsg = uidmsg;
 431                         goto finish;
 432                 }
 433                 id = (int)strtol(a->a_vals[0].bv_val,&tmp,0);
 434                 if (a->a_vals[0].bv_val[0] == '\0' || *tmp != '\0') {
 435                         rc = NSLCD_PAM_PERM_DENIED;
 436                         authzmsg = uidmsg;
 437                         goto finish;
 438                 }
 439                 if ((ni->ni_pam_min_uid && id < ni->ni_pam_min_uid) ||
 440                         (ni->ni_pam_max_uid && id > ni->ni_pam_max_uid)) {
 441                         rc = NSLCD_PAM_PERM_DENIED;
 442                         authzmsg = uidmsg;
 443                         goto finish;
 444                 }
 445         }
 446
 447         if (ni->ni_pam_template_ad) {
 448                 a = attr_find(e->e_attrs, ni->ni_pam_template_ad);
 449                 if (a)
 450                         uid = a->a_vals[0];
 451                 else if (!BER_BVISEMPTY(&ni->ni_pam_template))
 452                         uid = ni->ni_pam_template;
 453         }
 454
 455 finish:
 456         WRITE_INT32(fp,NSLCD_VERSION);
 457         WRITE_INT32(fp,NSLCD_ACTION_PAM_AUTHZ);
 458         WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
 459         WRITE_BERVAL(fp,&uid);
 460         WRITE_BERVAL(fp,&dn);
 461         WRITE_INT32(fp,rc);
 462         WRITE_BERVAL(fp,&authzmsg);
 463         if (e) {
 464                 be_entry_release_r(op, e);
 465         }
 466         return 0;
 467 }
 468
 469 static int pam_sess(nssov_info *ni,TFILE *fp,Operation *op,int action)
 470 {
 471         struct berval dn, uid, svc, tty, rhost, ruser;
 472         int32_t tmpint32;
 473         char dnc[1024];
 474         char svcc[256];
 475         char uidc[32];
 476         char ttyc[32];
 477         char rhostc[256];
 478         char ruserc[32];
 479         slap_callback cb = {0};
 480         SlapReply rs = {REP_RESULT};
 481         char timebuf[LDAP_LUTIL_GENTIME_BUFSIZE];
 482         struct berval timestamp, bv[2], *nbv;
 483         time_t stamp;
 484         Modifications mod;
 485
 486         READ_STRING_BUF2(fp,uidc,sizeof(uidc));
 487         uid.bv_val = uidc;
 488         uid.bv_len = tmpint32;
 489         READ_STRING_BUF2(fp,dnc,sizeof(dnc));
 490         dn.bv_val = dnc;
 491         dn.bv_len = tmpint32;
 492         READ_STRING_BUF2(fp,svcc,sizeof(svcc));
 493         svc.bv_val = svcc;
 494         svc.bv_len = tmpint32;
 495         READ_STRING_BUF2(fp,ttyc,sizeof(ttyc));
 496         tty.bv_val = ttyc;
 497         tty.bv_len = tmpint32;
 498         READ_STRING_BUF2(fp,rhostc,sizeof(rhostc));
 499         rhost.bv_val = rhostc;
 500         rhost.bv_len = tmpint32;
 501         READ_STRING_BUF2(fp,ruserc,sizeof(ruserc));
 502         ruser.bv_val = ruserc;
 503         ruser.bv_len = tmpint32;
 504         READ_INT32(fp,stamp);
 505
 506         Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_%c(%s)\n",
 507                 action==NSLCD_ACTION_PAM_SESS_O ? 'o' : 'c', dn.bv_val,0);
 508
 509         if (!dn.bv_len || !ni->ni_pam_sessions) return 0;
 510
 511         {
 512                 int i, found=0;
 513                 for (i=0; !BER_BVISNULL(&ni->ni_pam_sessions[i]); i++) {
 514                         if (ni->ni_pam_sessions[i].bv_len != svc.bv_len)
 515                                 continue;
 516                         if (!strcasecmp(ni->ni_pam_sessions[i].bv_val, svc.bv_val)) {
 517                                 found = 1;
 518                                 break;
 519                         }
 520                 }
 521                 if (!found) return 0;
 522         }
 523
 524         slap_op_time( &op->o_time, &op->o_tincr );
 525         timestamp.bv_len = sizeof(timebuf);
 526         timestamp.bv_val = timebuf;
 527         if (action == NSLCD_ACTION_PAM_SESS_O )
 528                 stamp = op->o_time;
 529         slap_timestamp( &stamp, &timestamp );
 530         bv[0].bv_len = timestamp.bv_len + global_host_bv.bv_len + svc.bv_len +
 531                 tty.bv_len + ruser.bv_len + rhost.bv_len + STRLENOF("    (@)");
 532         bv[0].bv_val = op->o_tmpalloc( bv[0].bv_len+1, op->o_tmpmemctx );
 533         sprintf(bv[0].bv_val, "%s %s %s %s (%s@%s)",
 534                 timestamp.bv_val, global_host_bv.bv_val, svc.bv_val, tty.bv_val,
 535                 ruser.bv_val, rhost.bv_val);
 536
 537         mod.sml_numvals = 1;
 538         mod.sml_values = bv;
 539         BER_BVZERO(&bv[1]);
 540         attr_normalize( ad_loginStatus, bv, &nbv, op->o_tmpmemctx );
 541         mod.sml_nvalues = nbv;
 542         mod.sml_desc = ad_loginStatus;
 543         mod.sml_op = action == NSLCD_ACTION_PAM_SESS_O ? LDAP_MOD_ADD :
 544                 LDAP_MOD_DELETE;
 545         mod.sml_flags = SLAP_MOD_INTERNAL;
 546         mod.sml_next = NULL;
 547
 548         cb.sc_response = slap_null_cb;
 549         op->o_callback = &cb;
 550         op->o_tag = LDAP_REQ_MODIFY;
 551         op->o_dn = op->o_bd->be_rootdn;
 552         op->o_ndn = op->o_bd->be_rootndn;
 553         op->orm_modlist = &mod;
 554         op->orm_no_opattrs = 1;
 555         op->o_req_dn = dn;
 556         op->o_req_ndn = dn;
 557         op->o_bd->be_modify( op, &rs );
 558         if ( mod.sml_next ) {
 559                 slap_mods_free( mod.sml_next, 1 );
 560         }
 561         ber_bvarray_free_x( nbv, op->o_tmpmemctx );
 562
 563         WRITE_INT32(fp,NSLCD_VERSION);
 564         WRITE_INT32(fp,action);
 565         WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
 566         WRITE_INT32(fp,op->o_time);
 567         return 0;
 568 }
 569
 570 int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
 571 {
 572         return pam_sess(ni,fp,op,NSLCD_ACTION_PAM_SESS_O);
 573 }
 574
 575 int pam_sess_c(nssov_info *ni,TFILE *fp,Operation *op)
 576 {
 577         return pam_sess(ni,fp,op,NSLCD_ACTION_PAM_SESS_C);
 578 }
 579
 580 int pam_pwmod(nssov_info *ni,TFILE *fp,Operation *op)
 581 {
 582         struct berval npw;
 583         int32_t tmpint32;
 584         char dnc[1024];
 585         char uidc[32];
 586         char opwc[256];
 587         char npwc[256];
 588         char svcc[256];
 589         struct paminfo pi;
 590         int rc;
 591
 592         READ_STRING_BUF2(fp,uidc,sizeof(uidc));
 593         pi.uid.bv_val = uidc;
 594         pi.uid.bv_len = tmpint32;
 595         READ_STRING_BUF2(fp,dnc,sizeof(dnc));
 596         pi.dn.bv_val = dnc;
 597         pi.dn.bv_len = tmpint32;
 598         READ_STRING_BUF2(fp,svcc,sizeof(svcc));
 599         pi.svc.bv_val = svcc;
 600         pi.svc.bv_len = tmpint32;
 601         READ_STRING_BUF2(fp,opwc,sizeof(opwc));
 602         pi.pwd.bv_val = opwc;
 603         pi.pwd.bv_len = tmpint32;
 604         READ_STRING_BUF2(fp,npwc,sizeof(npwc));
 605         npw.bv_val = npwc;
 606         npw.bv_len = tmpint32;
 607
 608         Debug(LDAP_DEBUG_TRACE,"nssov_pam_pwmod(%s), %s\n",
 609                 pi.dn.bv_val,pi.uid.bv_val,0);
 610
 611         BER_BVZERO(&pi.msg);
 612
 613         /* This is a prelim check */
 614         if (BER_BVISEMPTY(&pi.dn)) {
 615                 rc = pam_do_bind(ni,fp,op,&pi);
 616                 if (rc == NSLCD_PAM_IGNORE)
 617                         rc = NSLCD_PAM_SUCCESS;
 618         } else {
 619                 BerElementBuffer berbuf;
 620                 BerElement *ber = (BerElement *)&berbuf;
 621                 struct berval bv;
 622                 SlapReply rs = {REP_RESULT};
 623                 slap_callback cb = {0};
 624
 625                 ber_init_w_nullc(ber, LBER_USE_DER);
 626                 ber_printf(ber, "{");
 627                 if (!BER_BVISEMPTY(&pi.pwd))
 628                         ber_printf(ber, "tO", LDAP_TAG_EXOP_MODIFY_PASSWD_OLD,
 629                                 &pi.pwd);
 630                 if (!BER_BVISEMPTY(&npw))
 631                         ber_printf(ber, "tO", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW,
 632                                 &npw);
 633                 ber_printf(ber, "N}");
 634                 ber_flatten2(ber, &bv, 0);
 635                 op->o_tag = LDAP_REQ_EXTENDED;
 636                 op->ore_reqoid = slap_EXOP_MODIFY_PASSWD;
 637                 op->ore_reqdata = &bv;
 638                 op->o_dn = pi.dn;
 639                 op->o_ndn = pi.dn;
 640                 op->o_callback = &cb;
 641                 op->o_conn->c_authz_backend = op->o_bd;
 642                 cb.sc_response = slap_null_cb;
 643                 op->o_bd = frontendDB;
 644                 rc = op->o_bd->be_extended(op, &rs);
 645                 if (rs.sr_text)
 646                         ber_str2bv(rs.sr_text, 0, 0, &pi.msg);
 647                 if (rc == LDAP_SUCCESS)
 648                         rc = NSLCD_PAM_SUCCESS;
 649                 else
 650                         rc = NSLCD_PAM_PERM_DENIED;
 651         }
 652         WRITE_INT32(fp,NSLCD_VERSION);
 653         WRITE_INT32(fp,NSLCD_ACTION_PAM_PWMOD);
 654         WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
 655         WRITE_BERVAL(fp,&pi.uid);
 656         WRITE_BERVAL(fp,&pi.dn);
 657         WRITE_INT32(fp,rc);
 658         WRITE_BERVAL(fp,&pi.msg);
 659         return 0;
 660 }
 661
 662 int nssov_pam_init()
 663 {
 664         int code = 0;
 665         if (!ad_loginStatus)
 666                 code = register_at( at_loginStatus, &ad_loginStatus, 0 );
 667         return code;
 668 }