2 * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved.
3 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
6 * Copyright (c) 1993 Regents of the University of Michigan.
13 * BindRequest ::= SEQUENCE {
15 * name DistinguishedName, -- who
16 * authentication CHOICE {
17 * simple [0] OCTET STRING -- passwd
19 * krbv42ldap [1] OCTET STRING
20 * krbv42dsa [2] OCTET STRING
22 * sasl [3] SaslCredentials -- LDAPv3
26 * BindResponse ::= SEQUENCE {
27 * COMPONENTS OF LDAPResult,
28 * serverSaslCreds OCTET STRING OPTIONAL -- LDAPv3
38 #include <ac/stdlib.h>
41 #include <ac/socket.h>
42 #include <ac/string.h>
49 * ldap_kerberos_bind1 - initiate a bind to the ldap server using
50 * kerberos authentication. The dn is supplied. It is assumed the user
51 * already has a valid ticket granting ticket. The msgid of the
52 * request is returned on success (suitable for passing to ldap_result()),
53 * -1 is returned if there's trouble.
56 * ldap_kerberos_bind1( ld, "cn=manager, o=university of michigan, c=us" )
59 ldap_kerberos_bind1( LDAP *ld, LDAP_CONST char *dn )
64 #ifdef STR_TRANSLATION
65 int str_translation_on;
66 #endif /* STR_TRANSLATION */
68 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1\n", 0, 0, 0 );
73 if ( (cred = ldap_get_kerberosv4_credentials( ld, dn, "ldapserver",
74 &credlen )) == NULL ) {
75 return( -1 ); /* ld_errno should already be set */
78 /* create a message to send */
79 if ( (ber = ldap_alloc_ber_with_options( ld )) == NULLBER ) {
84 #ifdef STR_TRANSLATION
85 if (( str_translation_on = (( ber->ber_options &
86 LBER_TRANSLATE_STRINGS ) != 0 ))) { /* turn translation off */
87 ber->ber_options &= ~LBER_TRANSLATE_STRINGS;
89 #endif /* STR_TRANSLATION */
92 rc = ber_printf( ber, "{it{isto}}", ++ld->ld_msgid, LDAP_REQ_BIND,
93 ld->ld_version, dn, LDAP_AUTH_KRBV41, cred, credlen );
95 #ifdef STR_TRANSLATION
96 if ( str_translation_on ) { /* restore translation */
97 ber->ber_options |= LBER_TRANSLATE_STRINGS;
99 #endif /* STR_TRANSLATION */
104 ld->ld_errno = LDAP_ENCODING_ERROR;
111 if ( ld->ld_cache != NULL ) {
112 ldap_flush_cache( ld );
114 #endif /* !LDAP_NOCACHE */
116 /* send the message */
117 return ( ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber ));
121 ldap_kerberos_bind1_s( LDAP *ld, LDAP_CONST char *dn )
126 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1_s\n", 0, 0, 0 );
128 /* initiate the bind */
129 if ( (msgid = ldap_kerberos_bind1( ld, dn )) == -1 )
130 return( ld->ld_errno );
132 /* wait for a result */
133 if ( ldap_result( ld, ld->ld_msgid, 1, (struct timeval *) 0, &res )
135 return( ld->ld_errno ); /* ldap_result sets ld_errno */
138 return( ldap_result2error( ld, res, 1 ) );
142 * ldap_kerberos_bind2 - initiate a bind to the X.500 server using
143 * kerberos authentication. The dn is supplied. It is assumed the user
144 * already has a valid ticket granting ticket. The msgid of the
145 * request is returned on success (suitable for passing to ldap_result()),
146 * -1 is returned if there's trouble.
149 * ldap_kerberos_bind2( ld, "cn=manager, o=university of michigan, c=us" )
152 ldap_kerberos_bind2( LDAP *ld, LDAP_CONST char *dn )
157 #ifdef STR_TRANSLATION
158 int str_translation_on;
159 #endif /* STR_TRANSLATION */
161 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2\n", 0, 0, 0 );
166 if ( (cred = ldap_get_kerberosv4_credentials( ld, dn, "x500dsa", &credlen ))
168 return( -1 ); /* ld_errno should already be set */
171 /* create a message to send */
172 if ( (ber = ldap_alloc_ber_with_options( ld )) == NULLBER ) {
177 #ifdef STR_TRANSLATION
178 if (( str_translation_on = (( ber->ber_options &
179 LBER_TRANSLATE_STRINGS ) != 0 ))) { /* turn translation off */
180 ber->ber_options &= ~LBER_TRANSLATE_STRINGS;
182 #endif /* STR_TRANSLATION */
185 rc = ber_printf( ber, "{it{isto}}", ++ld->ld_msgid, LDAP_REQ_BIND,
186 ld->ld_version, dn, LDAP_AUTH_KRBV42, cred, credlen );
189 #ifdef STR_TRANSLATION
190 if ( str_translation_on ) { /* restore translation */
191 ber->ber_options |= LBER_TRANSLATE_STRINGS;
193 #endif /* STR_TRANSLATION */
199 ld->ld_errno = LDAP_ENCODING_ERROR;
203 /* send the message */
204 return ( ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber ));
207 /* synchronous bind to DSA using kerberos */
209 ldap_kerberos_bind2_s( LDAP *ld, LDAP_CONST char *dn )
214 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2_s\n", 0, 0, 0 );
216 /* initiate the bind */
217 if ( (msgid = ldap_kerberos_bind2( ld, dn )) == -1 )
218 return( ld->ld_errno );
220 /* wait for a result */
221 if ( ldap_result( ld, ld->ld_msgid, 1, (struct timeval *) 0, &res )
223 return( ld->ld_errno ); /* ldap_result sets ld_errno */
226 return( ldap_result2error( ld, res, 1 ) );
229 /* synchronous bind to ldap and DSA using kerberos */
231 ldap_kerberos_bind_s( LDAP *ld, LDAP_CONST char *dn )
235 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind_s\n", 0, 0, 0 );
237 if ( (err = ldap_kerberos_bind1_s( ld, dn )) != LDAP_SUCCESS )
240 return( ldap_kerberos_bind2_s( ld, dn ) );
246 * ldap_get_kerberosv4_credentials - obtain kerberos v4 credentials for ldap.
247 * The dn of the entry to which to bind is supplied. It's assumed the
248 * user already has a tgt.
252 ldap_get_kerberosv4_credentials(
254 LDAP_CONST char *who,
255 LDAP_CONST char *service,
260 char realm[REALM_SZ], *cred, *krbinstance;
262 Debug( LDAP_DEBUG_TRACE, "ldap_get_kerberosv4_credentials\n", 0, 0, 0 );
264 if ( (err = krb_get_tf_realm( tkt_string(), realm )) != KSUCCESS ) {
266 fprintf( stderr, "krb_get_tf_realm failed (%s)\n",
268 #endif /* LDAP_LIBUI */
269 ld->ld_errno = LDAP_INVALID_CREDENTIALS;
273 krbinstance = ld->ld_defconn->lconn_krbinstance;
275 if ( (err = krb_mk_req( &ktxt, service, krbinstance, realm, 0 ))
278 fprintf( stderr, "krb_mk_req failed (%s)\n", krb_err_txt[err] );
279 #endif /* LDAP_LIBUI */
280 ld->ld_errno = LDAP_INVALID_CREDENTIALS;
284 if ( ( cred = LDAP_MALLOC( ktxt.length )) == NULL ) {
285 ld->ld_errno = LDAP_NO_MEMORY;
290 memcpy( cred, ktxt.dat, ktxt.length );
295 #endif /* !AUTHMAN */
296 #endif /* HAVE_KERBEROS */