2 * Copyright (c) 1993 Regents of the University of Michigan.
11 static char copyright[] = "@(#) Copyright (c) 1993 Regents of the University of Michigan.\nAll rights reserved.\n";
20 #include <ac/socket.h>
21 #include <ac/string.h>
28 * ldap_kerberos_bind1 - initiate a bind to the ldap server using
29 * kerberos authentication. The dn is supplied. It is assumed the user
30 * already has a valid ticket granting ticket. The msgid of the
31 * request is returned on success (suitable for passing to ldap_result()),
32 * -1 is returned if there's trouble.
35 * ldap_kerberos_bind1( ld, "cn=manager, o=university of michigan, c=us" )
38 ldap_kerberos_bind1( LDAP *ld, char *dn )
43 char *ldap_get_kerberosv4_credentials();
44 #ifdef STR_TRANSLATION
45 int str_translation_on;
46 #endif /* STR_TRANSLATION */
49 * The bind request looks like this:
50 * BindRequest ::= SEQUENCE {
52 * name DistinguishedName,
53 * authentication CHOICE {
54 * krbv42ldap [1] OCTET STRING
55 * krbv42dsa [2] OCTET STRING
58 * all wrapped up in an LDAPMessage sequence.
61 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1\n", 0, 0, 0 );
66 if ( (cred = ldap_get_kerberosv4_credentials( ld, dn, "ldapserver",
67 &credlen )) == NULL ) {
68 return( -1 ); /* ld_errno should already be set */
71 /* create a message to send */
72 if ( (ber = ldap_alloc_ber_with_options( ld )) == NULLBER ) {
77 #ifdef STR_TRANSLATION
78 if (( str_translation_on = (( ber->ber_options &
79 LBER_TRANSLATE_STRINGS ) != 0 ))) { /* turn translation off */
80 ber->ber_options &= ~LBER_TRANSLATE_STRINGS;
82 #endif /* STR_TRANSLATION */
85 rc = ber_printf( ber, "{it{isto}}", ++ld->ld_msgid, LDAP_REQ_BIND,
86 ld->ld_version, dn, LDAP_AUTH_KRBV41, cred, credlen );
88 #ifdef STR_TRANSLATION
89 if ( str_translation_on ) { /* restore translation */
90 ber->ber_options |= LBER_TRANSLATE_STRINGS;
92 #endif /* STR_TRANSLATION */
97 ld->ld_errno = LDAP_ENCODING_ERROR;
104 if ( ld->ld_cache != NULL ) {
105 ldap_flush_cache( ld );
107 #endif /* !LDAP_NOCACHE */
109 /* send the message */
110 return ( ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber ));
114 ldap_kerberos_bind1_s( LDAP *ld, char *dn )
119 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1_s\n", 0, 0, 0 );
121 /* initiate the bind */
122 if ( (msgid = ldap_kerberos_bind1( ld, dn )) == -1 )
123 return( ld->ld_errno );
125 /* wait for a result */
126 if ( ldap_result( ld, ld->ld_msgid, 1, (struct timeval *) 0, &res )
128 return( ld->ld_errno ); /* ldap_result sets ld_errno */
131 return( ldap_result2error( ld, res, 1 ) );
135 * ldap_kerberos_bind2 - initiate a bind to the X.500 server using
136 * kerberos authentication. The dn is supplied. It is assumed the user
137 * already has a valid ticket granting ticket. The msgid of the
138 * request is returned on success (suitable for passing to ldap_result()),
139 * -1 is returned if there's trouble.
142 * ldap_kerberos_bind2( ld, "cn=manager, o=university of michigan, c=us" )
145 ldap_kerberos_bind2( LDAP *ld, char *dn )
150 char *ldap_get_kerberosv4_credentials();
151 #ifdef STR_TRANSLATION
152 int str_translation_on;
153 #endif /* STR_TRANSLATION */
155 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2\n", 0, 0, 0 );
160 if ( (cred = ldap_get_kerberosv4_credentials( ld, dn, "x500dsa", &credlen ))
162 return( -1 ); /* ld_errno should already be set */
165 /* create a message to send */
166 if ( (ber = ldap_alloc_ber_with_options( ld )) == NULLBER ) {
171 #ifdef STR_TRANSLATION
172 if (( str_translation_on = (( ber->ber_options &
173 LBER_TRANSLATE_STRINGS ) != 0 ))) { /* turn translation off */
174 ber->ber_options &= ~LBER_TRANSLATE_STRINGS;
176 #endif /* STR_TRANSLATION */
179 rc = ber_printf( ber, "{it{isto}}", ++ld->ld_msgid, LDAP_REQ_BIND,
180 ld->ld_version, dn, LDAP_AUTH_KRBV42, cred, credlen );
183 #ifdef STR_TRANSLATION
184 if ( str_translation_on ) { /* restore translation */
185 ber->ber_options |= LBER_TRANSLATE_STRINGS;
187 #endif /* STR_TRANSLATION */
193 ld->ld_errno = LDAP_ENCODING_ERROR;
197 /* send the message */
198 return ( ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber ));
201 /* synchronous bind to DSA using kerberos */
203 ldap_kerberos_bind2_s( LDAP *ld, char *dn )
208 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2_s\n", 0, 0, 0 );
210 /* initiate the bind */
211 if ( (msgid = ldap_kerberos_bind2( ld, dn )) == -1 )
212 return( ld->ld_errno );
214 /* wait for a result */
215 if ( ldap_result( ld, ld->ld_msgid, 1, (struct timeval *) 0, &res )
217 return( ld->ld_errno ); /* ldap_result sets ld_errno */
220 return( ldap_result2error( ld, res, 1 ) );
223 /* synchronous bind to ldap and DSA using kerberos */
225 ldap_kerberos_bind_s( LDAP *ld, char *dn )
229 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind_s\n", 0, 0, 0 );
231 if ( (err = ldap_kerberos_bind1_s( ld, dn )) != LDAP_SUCCESS )
234 return( ldap_kerberos_bind2_s( ld, dn ) );
240 * ldap_get_kerberosv4_credentials - obtain kerberos v4 credentials for ldap.
241 * The dn of the entry to which to bind is supplied. It's assumed the
242 * user already has a tgt.
246 ldap_get_kerberosv4_credentials( LDAP *ld, char *who, char *service, int *len )
250 char realm[REALM_SZ], *cred, *krbinstance;
252 Debug( LDAP_DEBUG_TRACE, "ldap_get_kerberosv4_credentials\n", 0, 0, 0 );
254 if ( (err = krb_get_tf_realm( tkt_string(), realm )) != KSUCCESS ) {
256 fprintf( stderr, "krb_get_tf_realm failed (%s)\n",
258 #endif /* LDAP_LIBUI */
259 ld->ld_errno = LDAP_INVALID_CREDENTIALS;
263 #ifdef LDAP_REFERRALS
264 krbinstance = ld->ld_defconn->lconn_krbinstance;
265 #else /* LDAP_REFERRALS */
266 krbinstance = ld->ld_host;
267 #endif /* LDAP_REFERRALS */
269 if ( (err = krb_mk_req( &ktxt, service, krbinstance, realm, 0 ))
272 fprintf( stderr, "krb_mk_req failed (%s)\n", krb_err_txt[err] );
273 #endif /* LDAP_LIBUI */
274 ld->ld_errno = LDAP_INVALID_CREDENTIALS;
278 if ( ( cred = malloc( ktxt.length )) == NULL ) {
279 ld->ld_errno = LDAP_NO_MEMORY;
284 memcpy( cred, ktxt.dat, ktxt.length );
289 #endif /* !AUTHMAN */
290 #endif /* HAVE_KERBEROS */