3 * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
7 * Copyright (c) 1993 Regents of the University of Michigan.
14 * BindRequest ::= SEQUENCE {
16 * name DistinguishedName, -- who
17 * authentication CHOICE {
18 * simple [0] OCTET STRING -- passwd
19 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
20 * krbv42ldap [1] OCTET STRING
21 * krbv42dsa [2] OCTET STRING
23 * sasl [3] SaslCredentials -- LDAPv3
27 * BindResponse ::= SEQUENCE {
28 * COMPONENTS OF LDAPResult,
29 * serverSaslCreds OCTET STRING OPTIONAL -- LDAPv3
36 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
39 #include <ac/stdlib.h>
42 #include <ac/socket.h>
43 #include <ac/string.h>
49 * ldap_kerberos_bind1 - initiate a bind to the ldap server using
50 * kerberos authentication. The dn is supplied. It is assumed the user
51 * already has a valid ticket granting ticket. The msgid of the
52 * request is returned on success (suitable for passing to ldap_result()),
53 * -1 is returned if there's trouble.
56 * ldap_kerberos_bind1( ld, "cn=manager, o=university of michigan, c=us" )
59 ldap_kerberos_bind1( LDAP *ld, LDAP_CONST char *dn )
67 LDAP_LOG ( OPERATION, ENTRY, "ldap_kerberos_bind1\n", 0, 0, 0 );
69 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1\n", 0, 0, 0 );
72 if( ld->ld_version > LDAP_VERSION2 ) {
73 ld->ld_errno = LDAP_NOT_SUPPORTED;
80 if ( (cred = ldap_get_kerberosv4_credentials( ld, dn, "ldapserver",
81 &credlen )) == NULL ) {
82 return( -1 ); /* ld_errno should already be set */
85 /* create a message to send */
86 if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
92 rc = ber_printf( ber, "{it{istoN}N}", ++ld->ld_msgid, LDAP_REQ_BIND,
93 ld->ld_version, dn, LDAP_AUTH_KRBV41, cred, credlen );
98 ld->ld_errno = LDAP_ENCODING_ERROR;
105 if ( ld->ld_cache != NULL ) {
106 ldap_flush_cache( ld );
108 #endif /* !LDAP_NOCACHE */
110 /* send the message */
111 return ( ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber ));
115 ldap_kerberos_bind1_s( LDAP *ld, LDAP_CONST char *dn )
121 LDAP_LOG ( OPERATION, ENTRY, "ldap_kerberos_bind1_s\n", 0, 0, 0 );
123 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1_s\n", 0, 0, 0 );
126 /* initiate the bind */
127 if ( (msgid = ldap_kerberos_bind1( ld, dn )) == -1 )
128 return( ld->ld_errno );
130 /* wait for a result */
131 if ( ldap_result( ld, ld->ld_msgid, 1, (struct timeval *) 0, &res )
133 return( ld->ld_errno ); /* ldap_result sets ld_errno */
136 return( ldap_result2error( ld, res, 1 ) );
140 * ldap_kerberos_bind2 - initiate a bind to the X.500 server using
141 * kerberos authentication. The dn is supplied. It is assumed the user
142 * already has a valid ticket granting ticket. The msgid of the
143 * request is returned on success (suitable for passing to ldap_result()),
144 * -1 is returned if there's trouble.
147 * ldap_kerberos_bind2( ld, "cn=manager, o=university of michigan, c=us" )
150 ldap_kerberos_bind2( LDAP *ld, LDAP_CONST char *dn )
158 LDAP_LOG ( OPERATION, ENTRY, "ldap_kerberos_bind2\n", 0, 0, 0 );
160 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2\n", 0, 0, 0 );
163 if( ld->ld_version > LDAP_VERSION2 ) {
164 ld->ld_errno = LDAP_NOT_SUPPORTED;
171 if ( (cred = ldap_get_kerberosv4_credentials( ld, dn, "x500dsa", &credlen ))
173 return( -1 ); /* ld_errno should already be set */
176 /* create a message to send */
177 if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
183 rc = ber_printf( ber, "{it{istoN}N}", ++ld->ld_msgid, LDAP_REQ_BIND,
184 ld->ld_version, dn, LDAP_AUTH_KRBV42, cred, credlen );
191 ld->ld_errno = LDAP_ENCODING_ERROR;
195 /* send the message */
196 return ( ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber ));
199 /* synchronous bind to DSA using kerberos */
201 ldap_kerberos_bind2_s( LDAP *ld, LDAP_CONST char *dn )
207 LDAP_LOG ( OPERATION, ENTRY, "ldap_kerberos_bind2_s\n" , 0, 0, 0);
209 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2_s\n", 0, 0, 0 );
212 /* initiate the bind */
213 if ( (msgid = ldap_kerberos_bind2( ld, dn )) == -1 )
214 return( ld->ld_errno );
216 /* wait for a result */
217 if ( ldap_result( ld, ld->ld_msgid, 1, (struct timeval *) 0, &res )
219 return( ld->ld_errno ); /* ldap_result sets ld_errno */
222 return( ldap_result2error( ld, res, 1 ) );
225 /* synchronous bind to ldap and DSA using kerberos */
227 ldap_kerberos_bind_s( LDAP *ld, LDAP_CONST char *dn )
232 LDAP_LOG ( OPERATION, ENTRY, "ldap_kerberos_bind_s\n", 0, 0, 0 );
234 Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind_s\n", 0, 0, 0 );
237 if ( (err = ldap_kerberos_bind1_s( ld, dn )) != LDAP_SUCCESS )
240 return( ldap_kerberos_bind2_s( ld, dn ) );
246 * ldap_get_kerberosv4_credentials - obtain kerberos v4 credentials for ldap.
247 * The dn of the entry to which to bind is supplied. It's assumed the
248 * user already has a tgt.
252 ldap_get_kerberosv4_credentials(
254 LDAP_CONST char *who,
255 LDAP_CONST char *service,
260 char realm[REALM_SZ], *cred, *krbinstance;
263 LDAP_LOG ( OPERATION, ENTRY, "ldap_get_kerberosv4_credentials\n", 0, 0, 0 );
265 Debug( LDAP_DEBUG_TRACE, "ldap_get_kerberosv4_credentials\n", 0, 0, 0 );
268 if ( (err = krb_get_tf_realm( tkt_string(), realm )) != KSUCCESS ) {
270 LDAP_LOG ( OPERATION, ERR,
271 "ldap_get_kerberosv4_credentials: krb_get_tf_realm failed: %s\n",
272 krb_err_txt[err], 0, 0 );
274 Debug( LDAP_DEBUG_ANY, "ldap_get_kerberosv4_credentials: "
275 "krb_get_tf_realm failed: %s\n", krb_err_txt[err], 0, 0 );
277 ld->ld_errno = LDAP_AUTH_UNKNOWN;
281 if ( ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_GET_FD, NULL ) == -1 ) {
282 /* not connected yet */
283 int rc = ldap_open_defconn( ld );
285 if( rc < 0 ) return NULL;
288 krbinstance = ld->ld_defconn->lconn_krbinstance;
290 if ( (err = krb_mk_req( &ktxt, service, krbinstance, realm, 0 ))
294 LDAP_LOG ( OPERATION, ERR,
295 "ldap_get_kerberosv4_credentials: krb_mk_req failed: %s\n",
296 krb_err_txt[err], 0, 0 );
298 Debug( LDAP_DEBUG_ANY, "ldap_get_kerberosv4_credentials: "
299 "krb_mk_req failed (%s)\n", krb_err_txt[err], 0, 0 );
301 ld->ld_errno = LDAP_AUTH_UNKNOWN;
305 if ( ( cred = LDAP_MALLOC( ktxt.length )) == NULL ) {
306 ld->ld_errno = LDAP_NO_MEMORY;
311 AC_MEMCPY( cred, ktxt.dat, ktxt.length );
316 #endif /* !AUTHMAN */
317 #endif /* LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND */