2 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
4 * Copyright 1998-2006 The OpenLDAP Foundation.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted only as authorized by the OpenLDAP
11 * A copy of this license is available in the file LICENSE in the
12 * top-level directory of the distribution or, alternatively, at
13 * <http://www.OpenLDAP.org/license.html>.
15 /* Portions Copyright (c) 1993 Regents of the University of Michigan.
16 * All rights reserved.
21 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
24 #include <ac/stdlib.h>
27 #include <ac/socket.h>
28 #include <ac/string.h>
34 * BindRequest ::= SEQUENCE {
36 * name DistinguishedName, -- who
37 * authentication CHOICE {
38 * simple [0] OCTET STRING -- passwd
39 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
40 * krbv42ldap [1] OCTET STRING
41 * krbv42dsa [2] OCTET STRING
43 * sasl [3] SaslCredentials -- LDAPv3
47 * BindResponse ::= SEQUENCE {
48 * COMPONENTS OF LDAPResult,
49 * serverSaslCreds OCTET STRING OPTIONAL -- LDAPv3
55 * ldap_kerberos_bind1 - initiate a bind to the ldap server using
56 * kerberos authentication. The dn is supplied. It is assumed the user
57 * already has a valid ticket granting ticket. The msgid of the
58 * request is returned on success (suitable for passing to ldap_result()),
59 * -1 is returned if there's trouble.
62 * ldap_kerberos_bind1( ld, "cn=manager, o=university of michigan, c=us" )
65 ldap_kerberos_bind1( LDAP *ld, LDAP_CONST char *dn )
73 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1\n", 0, 0, 0 );
75 if( ld->ld_version > LDAP_VERSION2 ) {
76 ld->ld_errno = LDAP_NOT_SUPPORTED;
83 if ( (cred = ldap_get_kerberosv4_credentials( ld, dn, "ldapserver",
84 &credlen )) == NULL ) {
85 return( -1 ); /* ld_errno should already be set */
88 /* create a message to send */
89 if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
94 LDAP_NEXT_MSGID( ld, id );
96 rc = ber_printf( ber, "{it{istoN}N}", id, LDAP_REQ_BIND,
97 ld->ld_version, dn, LDAP_AUTH_KRBV41, cred, credlen );
102 ld->ld_errno = LDAP_ENCODING_ERROR;
109 /* send the message */
110 return ( ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id ));
114 ldap_kerberos_bind1_s( LDAP *ld, LDAP_CONST char *dn )
119 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1_s\n", 0, 0, 0 );
121 /* initiate the bind */
122 if ( (msgid = ldap_kerberos_bind1( ld, dn )) == -1 )
123 return( ld->ld_errno );
125 /* wait for a result */
126 if ( ldap_result( ld, msgid, LDAP_MSG_ALL, (struct timeval *) 0, &res )
128 return( ld->ld_errno ); /* ldap_result sets ld_errno */
131 return( ldap_result2error( ld, res, 1 ) );
135 * ldap_kerberos_bind2 - initiate a bind to the X.500 server using
136 * kerberos authentication. The dn is supplied. It is assumed the user
137 * already has a valid ticket granting ticket. The msgid of the
138 * request is returned on success (suitable for passing to ldap_result()),
139 * -1 is returned if there's trouble.
142 * ldap_kerberos_bind2( ld, "cn=manager, o=university of michigan, c=us" )
145 ldap_kerberos_bind2( LDAP *ld, LDAP_CONST char *dn )
153 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2\n", 0, 0, 0 );
155 if( ld->ld_version > LDAP_VERSION2 ) {
156 ld->ld_errno = LDAP_NOT_SUPPORTED;
163 if ( (cred = ldap_get_kerberosv4_credentials( ld, dn, "x500dsa", &credlen ))
165 return( -1 ); /* ld_errno should already be set */
168 /* create a message to send */
169 if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
174 LDAP_NEXT_MSGID( ld, id );
176 rc = ber_printf( ber, "{it{istoN}N}", id, LDAP_REQ_BIND,
177 ld->ld_version, dn, LDAP_AUTH_KRBV42, cred, credlen );
183 ld->ld_errno = LDAP_ENCODING_ERROR;
187 /* send the message */
188 return ( ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber, id ));
191 /* synchronous bind to DSA using kerberos */
193 ldap_kerberos_bind2_s( LDAP *ld, LDAP_CONST char *dn )
198 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2_s\n", 0, 0, 0 );
200 /* initiate the bind */
201 if ( (msgid = ldap_kerberos_bind2( ld, dn )) == -1 )
202 return( ld->ld_errno );
204 /* wait for a result */
205 if ( ldap_result( ld, msgid, LDAP_MSG_ALL, (struct timeval *) 0, &res )
207 return( ld->ld_errno ); /* ldap_result sets ld_errno */
210 return( ldap_result2error( ld, res, 1 ) );
213 /* synchronous bind to ldap and DSA using kerberos */
215 ldap_kerberos_bind_s( LDAP *ld, LDAP_CONST char *dn )
219 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind_s\n", 0, 0, 0 );
221 if ( (err = ldap_kerberos_bind1_s( ld, dn )) != LDAP_SUCCESS )
224 return( ldap_kerberos_bind2_s( ld, dn ) );
230 * ldap_get_kerberosv4_credentials - obtain kerberos v4 credentials for ldap.
231 * The dn of the entry to which to bind is supplied. It's assumed the
232 * user already has a tgt.
236 ldap_get_kerberosv4_credentials(
238 LDAP_CONST char *who,
239 LDAP_CONST char *service,
244 char realm[REALM_SZ], *cred, *krbinstance;
246 Debug( LDAP_DEBUG_TRACE, "ldap_get_kerberosv4_credentials\n", 0, 0, 0 );
248 if ( (err = krb_get_tf_realm( tkt_string(), realm )) != KSUCCESS ) {
249 Debug( LDAP_DEBUG_ANY, "ldap_get_kerberosv4_credentials: "
250 "krb_get_tf_realm failed: %s\n", krb_err_txt[err], 0, 0 );
251 ld->ld_errno = LDAP_AUTH_UNKNOWN;
256 #ifdef LDAP_R_COMPILE
257 ldap_pvt_thread_mutex_lock( &ld->ld_req_mutex );
259 if ( ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_GET_FD, NULL ) == -1 ) {
260 /* not connected yet */
261 err = ldap_open_defconn( ld );
263 #ifdef LDAP_R_COMPILE
264 ldap_pvt_thread_mutex_unlock( &ld->ld_req_mutex );
266 if ( err < 0 ) return NULL;
268 krbinstance = ld->ld_defconn->lconn_krbinstance;
270 if ( (err = krb_mk_req( &ktxt, service, krbinstance, realm, 0 ))
273 Debug( LDAP_DEBUG_ANY, "ldap_get_kerberosv4_credentials: "
274 "krb_mk_req failed (%s)\n", krb_err_txt[err], 0, 0 );
275 ld->ld_errno = LDAP_AUTH_UNKNOWN;
279 if ( ( cred = LDAP_MALLOC( ktxt.length )) == NULL ) {
280 ld->ld_errno = LDAP_NO_MEMORY;
285 AC_MEMCPY( cred, ktxt.dat, ktxt.length );
290 #endif /* !AUTHMAN */
291 #endif /* LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND */