3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
7 * Copyright (c) 1993 Regents of the University of Michigan.
14 * BindRequest ::= SEQUENCE {
16 * name DistinguishedName, -- who
17 * authentication CHOICE {
18 * simple [0] OCTET STRING -- passwd
19 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
20 * krbv42ldap [1] OCTET STRING
21 * krbv42dsa [2] OCTET STRING
23 * sasl [3] SaslCredentials -- LDAPv3
27 * BindResponse ::= SEQUENCE {
28 * COMPONENTS OF LDAPResult,
29 * serverSaslCreds OCTET STRING OPTIONAL -- LDAPv3
36 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
39 #include <ac/stdlib.h>
42 #include <ac/socket.h>
43 #include <ac/string.h>
50 * ldap_kerberos_bind1 - initiate a bind to the ldap server using
51 * kerberos authentication. The dn is supplied. It is assumed the user
52 * already has a valid ticket granting ticket. The msgid of the
53 * request is returned on success (suitable for passing to ldap_result()),
54 * -1 is returned if there's trouble.
57 * ldap_kerberos_bind1( ld, "cn=manager, o=university of michigan, c=us" )
60 ldap_kerberos_bind1( LDAP *ld, LDAP_CONST char *dn )
66 #ifdef STR_TRANSLATION
67 int str_translation_on;
68 #endif /* STR_TRANSLATION */
70 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1\n", 0, 0, 0 );
75 if ( (cred = ldap_get_kerberosv4_credentials( ld, dn, "ldapserver",
76 &credlen )) == NULL ) {
77 return( -1 ); /* ld_errno should already be set */
80 /* create a message to send */
81 if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
86 #ifdef STR_TRANSLATION
87 if (( str_translation_on = (( ber->ber_options &
88 LBER_TRANSLATE_STRINGS ) != 0 ))) { /* turn translation off */
89 ber->ber_options &= ~LBER_TRANSLATE_STRINGS;
91 #endif /* STR_TRANSLATION */
94 rc = ber_printf( ber, "{it{isto}}", ++ld->ld_msgid, LDAP_REQ_BIND,
95 ld->ld_version, dn, LDAP_AUTH_KRBV41, cred, credlen );
97 #ifdef STR_TRANSLATION
98 if ( str_translation_on ) { /* restore translation */
99 ber->ber_options |= LBER_TRANSLATE_STRINGS;
101 #endif /* STR_TRANSLATION */
106 ld->ld_errno = LDAP_ENCODING_ERROR;
113 if ( ld->ld_cache != NULL ) {
114 ldap_flush_cache( ld );
116 #endif /* !LDAP_NOCACHE */
118 /* send the message */
119 return ( ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber ));
123 ldap_kerberos_bind1_s( LDAP *ld, LDAP_CONST char *dn )
128 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1_s\n", 0, 0, 0 );
130 /* initiate the bind */
131 if ( (msgid = ldap_kerberos_bind1( ld, dn )) == -1 )
132 return( ld->ld_errno );
134 /* wait for a result */
135 if ( ldap_result( ld, ld->ld_msgid, 1, (struct timeval *) 0, &res )
137 return( ld->ld_errno ); /* ldap_result sets ld_errno */
140 return( ldap_result2error( ld, res, 1 ) );
144 * ldap_kerberos_bind2 - initiate a bind to the X.500 server using
145 * kerberos authentication. The dn is supplied. It is assumed the user
146 * already has a valid ticket granting ticket. The msgid of the
147 * request is returned on success (suitable for passing to ldap_result()),
148 * -1 is returned if there's trouble.
151 * ldap_kerberos_bind2( ld, "cn=manager, o=university of michigan, c=us" )
154 ldap_kerberos_bind2( LDAP *ld, LDAP_CONST char *dn )
160 #ifdef STR_TRANSLATION
161 int str_translation_on;
162 #endif /* STR_TRANSLATION */
164 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2\n", 0, 0, 0 );
169 if ( (cred = ldap_get_kerberosv4_credentials( ld, dn, "x500dsa", &credlen ))
171 return( -1 ); /* ld_errno should already be set */
174 /* create a message to send */
175 if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
180 #ifdef STR_TRANSLATION
181 if (( str_translation_on = (( ber->ber_options &
182 LBER_TRANSLATE_STRINGS ) != 0 ))) { /* turn translation off */
183 ber->ber_options &= ~LBER_TRANSLATE_STRINGS;
185 #endif /* STR_TRANSLATION */
188 rc = ber_printf( ber, "{it{isto}}", ++ld->ld_msgid, LDAP_REQ_BIND,
189 ld->ld_version, dn, LDAP_AUTH_KRBV42, cred, credlen );
192 #ifdef STR_TRANSLATION
193 if ( str_translation_on ) { /* restore translation */
194 ber->ber_options |= LBER_TRANSLATE_STRINGS;
196 #endif /* STR_TRANSLATION */
202 ld->ld_errno = LDAP_ENCODING_ERROR;
206 /* send the message */
207 return ( ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber ));
210 /* synchronous bind to DSA using kerberos */
212 ldap_kerberos_bind2_s( LDAP *ld, LDAP_CONST char *dn )
217 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2_s\n", 0, 0, 0 );
219 /* initiate the bind */
220 if ( (msgid = ldap_kerberos_bind2( ld, dn )) == -1 )
221 return( ld->ld_errno );
223 /* wait for a result */
224 if ( ldap_result( ld, ld->ld_msgid, 1, (struct timeval *) 0, &res )
226 return( ld->ld_errno ); /* ldap_result sets ld_errno */
229 return( ldap_result2error( ld, res, 1 ) );
232 /* synchronous bind to ldap and DSA using kerberos */
234 ldap_kerberos_bind_s( LDAP *ld, LDAP_CONST char *dn )
238 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind_s\n", 0, 0, 0 );
240 if ( (err = ldap_kerberos_bind1_s( ld, dn )) != LDAP_SUCCESS )
243 return( ldap_kerberos_bind2_s( ld, dn ) );
249 * ldap_get_kerberosv4_credentials - obtain kerberos v4 credentials for ldap.
250 * The dn of the entry to which to bind is supplied. It's assumed the
251 * user already has a tgt.
255 ldap_get_kerberosv4_credentials(
257 LDAP_CONST char *who,
258 LDAP_CONST char *service,
263 char realm[REALM_SZ], *cred, *krbinstance;
265 Debug( LDAP_DEBUG_TRACE, "ldap_get_kerberosv4_credentials\n", 0, 0, 0 );
267 if ( (err = krb_get_tf_realm( tkt_string(), realm )) != KSUCCESS ) {
269 fprintf( stderr, "krb_get_tf_realm failed (%s)\n",
271 #endif /* LDAP_LIBUI */
272 ld->ld_errno = LDAP_AUTH_UNKNOWN;
276 if( ! ber_pvt_sb_in_use( &ld->ld_sb ) ) {
277 /* not connected yet */
278 int rc = ldap_open_defconn( ld );
280 if( rc < 0 ) return NULL;
283 krbinstance = ld->ld_defconn->lconn_krbinstance;
285 if ( (err = krb_mk_req( &ktxt, service, krbinstance, realm, 0 ))
288 fprintf( stderr, "krb_mk_req failed (%s)\n", krb_err_txt[err] );
289 #endif /* LDAP_LIBUI */
290 ld->ld_errno = LDAP_AUTH_UNKNOWN;
294 if ( ( cred = LDAP_MALLOC( ktxt.length )) == NULL ) {
295 ld->ld_errno = LDAP_NO_MEMORY;
300 memcpy( cred, ktxt.dat, ktxt.length );
305 #endif /* !AUTHMAN */
306 #endif /* LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND */