git.sur5r.net Git - openldap/blob - contrib/slapd-modules/nssov/pam.c

   1 /* pam.c - pam processing routines */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 2009 by Howard Chu, Symas Corp.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in the file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15
  16 #include "nssov.h"
  17
  18 #include <security/pam_modules.h>
  19
  20 static int pam_nullcb(
  21         Operation *op, SlapReply *rs)
  22 {
  23         return LDAP_SUCCESS;
  24 }
  25
  26 int pam_authc(nssov_info *ni,TFILE *fp,Operation *op)
  27 {
  28         int32_t tmpint32;
  29         int rc;
  30         slap_callback cb = {0};
  31         SlapReply rs = {REP_RESULT};
  32         char uidc[32];
  33         char svcc[256];
  34         char pwdc[256];
  35         struct berval uid, svc, pwd, sdn, dn;
  36         int hlen;
  37
  38         READ_STRING_BUF2(fp,uidc,sizeof(uidc));
  39         uid.bv_val = uidc;
  40         uid.bv_len = tmpint32;
  41         READ_STRING_BUF2(fp,svcc,sizeof(svcc));
  42         svc.bv_val = svcc;
  43         svc.bv_len = tmpint32;
  44         READ_STRING_BUF2(fp,pwdc,sizeof(pwdc));
  45         pwd.bv_val = pwdc;
  46         pwd.bv_len = tmpint32;
  47
  48         Debug(LDAP_DEBUG_TRACE,"nssov_pam_authc(%s)\n",uid.bv_val,0,0);
  49
  50         if (!isvalidusername(&uid)) {
  51                 Debug(LDAP_DEBUG_ANY,"nssov_pam_authc(%s): invalid user name\n",uid.bv_val,0,0);
  52                 rc = PAM_USER_UNKNOWN;
  53                 goto finish;
  54         }
  55
  56         /* Why didn't we make this a berval? */
  57         hlen = strlen(global_host);
  58
  59         /* First try this form, to allow service-dependent mappings */
  60         /* cn=<service>+uid=<user>,cn=<host>,cn=pam,cn=auth */
  61         sdn.bv_len = uid.bv_len + svc.bv_len + hlen + STRLENOF( "cn=+uid=,cn=,cn=pam,cn=auth" );
  62         sdn.bv_val = op->o_tmpalloc( sdn.bv_len + 1, op->o_tmpmemctx );
  63         sprintf(sdn.bv_val, "cn=%s+uid=%s,cn=%s,cn=pam,cn=auth", svcc, uidc, global_host);
  64         BER_BVZERO(&dn);
  65         slap_sasl2dn(op, &sdn, &dn, 0);
  66         op->o_tmpfree( sdn.bv_val, op->o_tmpmemctx );
  67
  68         /* If no luck, do a basic uid search */
  69         if (BER_BVISEMPTY(&dn)) {
  70                 if (!nssov_uid2dn(op, ni, &uid, &dn)) {
  71                         rc = PAM_USER_UNKNOWN;
  72                         goto finish;
  73                 }
  74                 sdn = dn;
  75                 dnNormalize( 0, NULL, NULL, &sdn, &dn, op->o_tmpmemctx );
  76         }
  77         BER_BVZERO(&sdn);
  78
  79         /* TODO: add ppolicy control */
  80         cb.sc_response = pam_nullcb;
  81         op->o_callback = &cb;
  82         op->o_dn.bv_val[0] = 0;
  83         op->o_dn.bv_len = 0;
  84         op->o_ndn.bv_val[0] = 0;
  85         op->o_ndn.bv_len = 0;
  86         op->o_tag = LDAP_REQ_BIND;
  87         op->o_protocol = LDAP_VERSION3;
  88         op->orb_method = LDAP_AUTH_SIMPLE;
  89         op->orb_cred = pwd;
  90         op->o_req_dn = dn;
  91         op->o_req_ndn = dn;
  92         slap_op_time( &op->o_time, &op->o_tincr );
  93         op->o_bd->be_bind( op, &rs );
  94         memset(pwd.bv_val,0,pwd.bv_len);
  95         switch(rs.sr_err) {
  96         case LDAP_SUCCESS: rc = PAM_SUCCESS; break;
  97         case LDAP_INVALID_CREDENTIALS: rc = PAM_AUTH_ERR; break;
  98         default: rc = PAM_AUTH_ERR; break;
  99         }
 100
 101 finish:
 102         WRITE_INT32(fp,NSLCD_VERSION);
 103         WRITE_INT32(fp,NSLCD_ACTION_PAM_AUTHC);
 104         WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
 105         WRITE_INT32(fp,rc);
 106         WRITE_INT32(fp,PAM_SUCCESS);    /* authz */
 107         WRITE_BERVAL(fp,&dn);
 108         WRITE_BERVAL(fp,&sdn);          /* authzmsg */
 109         WRITE_BERVAL(fp,&sdn);          /* tmpluser */
 110         return 0;
 111 }
 112
 113 int pam_authz(nssov_info *ni,TFILE *fp,Operation *op)
 114 {
 115         struct berval dn, svc;
 116         struct berval authzmsg = BER_BVNULL;
 117         int32_t tmpint32;
 118         char dnc[1024];
 119         char svcc[256];
 120
 121         READ_STRING_BUF2(fp,dnc,sizeof(dnc));
 122         dn.bv_val = dnc;
 123         dn.bv_len = tmpint32;
 124         READ_STRING_BUF2(fp,svcc,sizeof(svcc));
 125         svc.bv_val = svcc;
 126         svc.bv_len = tmpint32;
 127
 128         Debug(LDAP_DEBUG_TRACE,"nssov_pam_authz(%s)\n",dn.bv_val,0,0);
 129
 130         WRITE_INT32(fp,NSLCD_VERSION);
 131         WRITE_INT32(fp,NSLCD_ACTION_PAM_AUTHZ);
 132         WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
 133         WRITE_INT32(fp,PAM_SUCCESS);
 134         WRITE_BERVAL(fp,&authzmsg);
 135         return 0;
 136 }
 137
 138 int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
 139 {
 140         struct berval dn, svc;
 141         int32_t tmpint32;
 142         char dnc[1024];
 143         char svcc[256];
 144
 145         READ_STRING_BUF2(fp,dnc,sizeof(dnc));
 146         dn.bv_val = dnc;
 147         dn.bv_len = tmpint32;
 148         READ_STRING_BUF2(fp,svcc,sizeof(svcc));
 149         svc.bv_val = svcc;
 150         svc.bv_len = tmpint32;
 151
 152         Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_o(%s)\n",dn.bv_val,0,0);
 153
 154         WRITE_INT32(fp,NSLCD_VERSION);
 155         WRITE_INT32(fp,NSLCD_ACTION_PAM_SESS_O);
 156         WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
 157         return 0;
 158 }
 159
 160 int pam_sess_c(nssov_info *ni,TFILE *fp,Operation *op)
 161 {
 162         struct berval dn, svc;
 163         int32_t tmpint32;
 164         char dnc[1024];
 165         char svcc[256];
 166
 167         READ_STRING_BUF2(fp,dnc,sizeof(dnc));
 168         dn.bv_val = dnc;
 169         dn.bv_len = tmpint32;
 170         READ_STRING_BUF2(fp,svcc,sizeof(svcc));
 171         svc.bv_val = svcc;
 172         svc.bv_len = tmpint32;
 173
 174         Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_c(%s)\n",dn.bv_val,0,0);
 175
 176         WRITE_INT32(fp,NSLCD_VERSION);
 177         WRITE_INT32(fp,NSLCD_ACTION_PAM_SESS_C);
 178         WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
 179         return 0;
 180 }
 181
 182 int pam_pwmod(nssov_info *ni,TFILE *fp,Operation *op)
 183 {
 184         struct berval dn, uid, opw, npw;
 185         int32_t tmpint32;
 186         char dnc[1024];
 187         char uidc[256];
 188         char opwc[256];
 189         char npwc[256];
 190
 191         READ_STRING_BUF2(fp,dnc,sizeof(dnc));
 192         dn.bv_val = dnc;
 193         dn.bv_len = tmpint32;
 194         READ_STRING_BUF2(fp,uidc,sizeof(uidc));
 195         uid.bv_val = uidc;
 196         uid.bv_len = tmpint32;
 197         READ_STRING_BUF2(fp,opwc,sizeof(opwc));
 198         opw.bv_val = opwc;
 199         opw.bv_len = tmpint32;
 200         READ_STRING_BUF2(fp,npwc,sizeof(npwc));
 201         npw.bv_val = npwc;
 202         npw.bv_len = tmpint32;
 203
 204         Debug(LDAP_DEBUG_TRACE,"nssov_pam_pwmod(%s), %s\n",dn.bv_val,uid.bv_val,0);
 205
 206         BER_BVZERO(&npw);
 207         WRITE_INT32(fp,NSLCD_VERSION);
 208         WRITE_INT32(fp,NSLCD_ACTION_PAM_PWMOD);
 209         WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
 210         WRITE_INT32(fp,PAM_SUCCESS);
 211         WRITE_BERVAL(fp,&npw);
 212         return 0;
 213 }