git.sur5r.net Git - openldap/blob - libraries/libldap/sasl.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6
   7 /*
   8  *      BindRequest ::= SEQUENCE {
   9  *              version         INTEGER,
  10  *              name            DistinguishedName,       -- who
  11  *              authentication  CHOICE {
  12  *                      simple          [0] OCTET STRING -- passwd
  13 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
  14  *                      krbv42ldap      [1] OCTET STRING
  15  *                      krbv42dsa       [2] OCTET STRING
  16 #endif
  17  *                      sasl            [3] SaslCredentials     -- LDAPv3
  18  *              }
  19  *      }
  20  *
  21  *      BindResponse ::= SEQUENCE {
  22  *              COMPONENTS OF LDAPResult,
  23  *              serverSaslCreds         OCTET STRING OPTIONAL -- LDAPv3
  24  *      }
  25  *
  26  */
  27
  28 #include "portable.h"
  29
  30 #include <stdio.h>
  31
  32 #include <ac/socket.h>
  33 #include <ac/string.h>
  34 #include <ac/time.h>
  35
  36 #include "ldap-int.h"
  37
  38
  39 /*
  40  * ldap_sasl_bind - bind to the ldap server (and X.500).
  41  * The dn (usually NULL), mechanism, and credentials are provided.
  42  * The message id of the request initiated is provided upon successful
  43  * (LDAP_SUCCESS) return.
  44  *
  45  * Example:
  46  *      ldap_sasl_bind( ld, NULL, "mechanism",
  47  *              cred, NULL, NULL, &msgid )
  48  */
  49
  50 int
  51 ldap_sasl_bind(
  52         LDAP                    *ld,
  53         LDAP_CONST char *dn,
  54         LDAP_CONST char *mechanism,
  55         struct berval   *cred,
  56         LDAPControl             **sctrls,
  57         LDAPControl             **cctrls,
  58         int                             *msgidp )
  59 {
  60         BerElement      *ber;
  61         int rc;
  62
  63         Debug( LDAP_DEBUG_TRACE, "ldap_sasl_bind\n", 0, 0, 0 );
  64
  65         assert( ld != NULL );
  66         assert( LDAP_VALID( ld ) );
  67         assert( msgidp != NULL );
  68
  69         if( msgidp == NULL ) {
  70                 ld->ld_errno = LDAP_PARAM_ERROR;
  71                 return ld->ld_errno;
  72         }
  73
  74         if( mechanism == LDAP_SASL_SIMPLE ) {
  75                 if( dn == NULL && cred != NULL ) {
  76                         /* use default binddn */
  77                         dn = ld->ld_defbinddn;
  78                 }
  79
  80         } else if( ld->ld_version < LDAP_VERSION3 ) {
  81                 ld->ld_errno = LDAP_NOT_SUPPORTED;
  82                 return ld->ld_errno;
  83         }
  84
  85         if ( dn == NULL ) {
  86                 dn = "";
  87         }
  88
  89         /* create a message to send */
  90         if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
  91                 ld->ld_errno = LDAP_NO_MEMORY;
  92                 return ld->ld_errno;
  93         }
  94
  95         assert( BER_VALID( ber ) );
  96
  97         if( mechanism == LDAP_SASL_SIMPLE ) {
  98                 /* simple bind */
  99                 rc = ber_printf( ber, "{it{istO}" /*}*/,
 100                         ++ld->ld_msgid, LDAP_REQ_BIND,
 101                         ld->ld_version, dn, LDAP_AUTH_SIMPLE,
 102                         cred );
 103
 104         } else if ( cred == NULL ) {
 105                 /* SASL bind w/o creditials */
 106                 rc = ber_printf( ber, "{it{ist{s}}" /*}*/,
 107                         ++ld->ld_msgid, LDAP_REQ_BIND,
 108                         ld->ld_version, dn, LDAP_AUTH_SASL,
 109                         mechanism );
 110
 111         } else {
 112                 /* SASL bind w/ creditials */
 113                 rc = ber_printf( ber, "{it{ist{sO}}" /*}*/,
 114                         ++ld->ld_msgid, LDAP_REQ_BIND,
 115                         ld->ld_version, dn, LDAP_AUTH_SASL,
 116                         mechanism, cred );
 117         }
 118
 119         if( rc == -1 ) {
 120                 ld->ld_errno = LDAP_ENCODING_ERROR;
 121                 ber_free( ber, 1 );
 122                 return( -1 );
 123         }
 124
 125         /* Put Server Controls */
 126         if( ldap_int_put_controls( ld, sctrls, ber ) != LDAP_SUCCESS ) {
 127                 ber_free( ber, 1 );
 128                 return ld->ld_errno;
 129         }
 130
 131         if ( ber_printf( ber, /*{*/ "}" ) == -1 ) {
 132                 ld->ld_errno = LDAP_ENCODING_ERROR;
 133                 ber_free( ber, 1 );
 134                 return ld->ld_errno;
 135         }
 136
 137 #ifndef LDAP_NOCACHE
 138         if ( ld->ld_cache != NULL ) {
 139                 ldap_flush_cache( ld );
 140         }
 141 #endif /* !LDAP_NOCACHE */
 142
 143         /* send the message */
 144         *msgidp = ldap_send_initial_request( ld, LDAP_REQ_BIND, dn, ber );
 145
 146         if(*msgidp < 0)
 147                 return ld->ld_errno;
 148
 149         return LDAP_SUCCESS;
 150 }
 151
 152
 153 int
 154 ldap_sasl_bind_s(
 155         LDAP                    *ld,
 156         LDAP_CONST char *dn,
 157         LDAP_CONST char *mechanism,
 158         struct berval   *cred,
 159         LDAPControl             **sctrls,
 160         LDAPControl             **cctrls,
 161         struct berval   **servercredp )
 162 {
 163         int     rc, msgid;
 164         LDAPMessage     *result;
 165         struct berval   *scredp = NULL;
 166
 167         Debug( LDAP_DEBUG_TRACE, "ldap_sasl_bind_s\n", 0, 0, 0 );
 168
 169         /* do a quick !LDAPv3 check... ldap_sasl_bind will do the rest. */
 170         if( servercredp != NULL ) {
 171                 if (ld->ld_version < LDAP_VERSION3) {
 172                         ld->ld_errno = LDAP_NOT_SUPPORTED;
 173                         return ld->ld_errno;
 174                 }
 175                 *servercredp = NULL;
 176         }
 177
 178         rc = ldap_sasl_bind( ld, dn, mechanism, cred, sctrls, cctrls, &msgid );
 179
 180         if ( rc != LDAP_SUCCESS ) {
 181                 return( rc );
 182         }
 183
 184         if ( ldap_result( ld, msgid, 1, NULL, &result ) == -1 ) {
 185                 return( ld->ld_errno ); /* ldap_result sets ld_errno */
 186         }
 187
 188         /* parse the results */
 189         scredp = NULL;
 190         if( servercredp != NULL ) {
 191                 rc = ldap_parse_sasl_bind_result( ld, result, &scredp, 0 );
 192         }
 193
 194         if ( rc != LDAP_SUCCESS && rc != LDAP_SASL_BIND_IN_PROGRESS ) {
 195                 ldap_msgfree( result );
 196                 return( rc );
 197         }
 198
 199         rc = ldap_result2error( ld, result, 1 );
 200
 201         if ( rc != LDAP_SUCCESS && rc != LDAP_SASL_BIND_IN_PROGRESS ) {
 202                 if( servercredp != NULL ) {
 203                         *servercredp = scredp;
 204                 }
 205
 206         } else if (scredp != NULL ) {
 207                 ber_bvfree(scredp);
 208         }
 209
 210         return rc;
 211 }
 212
 213
 214 /*
 215 * Parse BindResponse:
 216 *
 217 *   BindResponse ::= [APPLICATION 1] SEQUENCE {
 218 *     COMPONENTS OF LDAPResult,
 219 *     serverSaslCreds  [7] OCTET STRING OPTIONAL }
 220 *
 221 *   LDAPResult ::= SEQUENCE {
 222 *     resultCode      ENUMERATED,
 223 *     matchedDN       LDAPDN,
 224 *     errorMessage    LDAPString,
 225 *     referral        [3] Referral OPTIONAL }
 226 */
 227
 228 int
 229 ldap_parse_sasl_bind_result(
 230         LDAP                    *ld,
 231         LDAPMessage             *res,
 232         struct berval   **servercredp,
 233         int                             freeit )
 234 {
 235         ber_int_t errcode;
 236         struct berval* scred;
 237
 238         ber_tag_t tag;
 239         BerElement      *ber;
 240
 241         Debug( LDAP_DEBUG_TRACE, "ldap_parse_sasl_bind_result\n", 0, 0, 0 );
 242
 243         assert( ld != NULL );
 244         assert( LDAP_VALID( ld ) );
 245         assert( res != NULL );
 246
 247         if ( ld == NULL || res == NULL ) {
 248                 return LDAP_PARAM_ERROR;
 249         }
 250
 251         if( servercredp != NULL ) {
 252                 if( ld->ld_version < LDAP_VERSION2 ) {
 253                         return LDAP_NOT_SUPPORTED;
 254                 }
 255                 *servercredp = NULL;
 256         }
 257
 258         if( res->lm_msgtype != LDAP_RES_BIND ) {
 259                 ld->ld_errno = LDAP_PARAM_ERROR;
 260                 return ld->ld_errno;
 261         }
 262
 263         scred = NULL;
 264
 265         if ( ld->ld_error ) {
 266                 LDAP_FREE( ld->ld_error );
 267                 ld->ld_error = NULL;
 268         }
 269         if ( ld->ld_matched ) {
 270                 LDAP_FREE( ld->ld_matched );
 271                 ld->ld_matched = NULL;
 272         }
 273
 274         /* parse results */
 275
 276         ber = ber_dup( res->lm_ber );
 277
 278         if( ber == NULL ) {
 279                 ld->ld_errno = LDAP_NO_MEMORY;
 280                 return ld->ld_errno;
 281         }
 282
 283         if ( ld->ld_version < LDAP_VERSION2 ) {
 284                 tag = ber_scanf( ber, "{ia}",
 285                         &errcode, &ld->ld_error );
 286
 287                 if( tag == LBER_ERROR ) {
 288                         ber_free( ber, 0 );
 289                         ld->ld_errno = LDAP_DECODING_ERROR;
 290                         return ld->ld_errno;
 291                 }
 292
 293         } else {
 294                 ber_len_t len;
 295
 296                 tag = ber_scanf( ber, "{iaa" /*}*/,
 297                         &errcode, &ld->ld_matched, &ld->ld_error );
 298
 299                 if( tag == LBER_ERROR ) {
 300                         ber_free( ber, 0 );
 301                         ld->ld_errno = LDAP_DECODING_ERROR;
 302                         return ld->ld_errno;
 303                 }
 304
 305                 tag = ber_peek_tag(ber, &len);
 306
 307                 if( tag == LDAP_TAG_REFERRAL ) {
 308                         /* skip 'em */
 309                         if( ber_scanf( ber, "x" ) == LBER_ERROR ) {
 310                                 ber_free( ber, 0 );
 311                                 ld->ld_errno = LDAP_DECODING_ERROR;
 312                                 return ld->ld_errno;
 313                         }
 314
 315                         tag = ber_peek_tag(ber, &len);
 316                 }
 317
 318                 if( tag == LDAP_TAG_SASL_RES_CREDS ) {
 319                         if( ber_scanf( ber, "O", &scred ) == LBER_ERROR ) {
 320                                 ber_free( ber, 0 );
 321                                 ld->ld_errno = LDAP_DECODING_ERROR;
 322                                 return ld->ld_errno;
 323                         }
 324                 }
 325         }
 326
 327         ber_free( ber, 0 );
 328
 329         if ( servercredp != NULL ) {
 330                 *servercredp = scred;
 331
 332         } else if ( scred != NULL ) {
 333                 ber_bvfree( scred );
 334         }
 335
 336         ld->ld_errno = errcode;
 337
 338         if ( freeit ) {
 339                 ldap_msgfree( res );
 340         }
 341
 342         return( ld->ld_errno );
 343 }
 344
 345 #ifdef HAVE_CYRUS_SASL
 346 /*
 347 * Various Cyrus SASL related stuff.
 348 */
 349
 350 static int sasl_setup( Sockbuf *sb, void *arg );
 351 static int sasl_remove( Sockbuf *sb );
 352 static ber_slen_t sasl_read( Sockbuf *sb, void *buf, ber_len_t len );
 353 static ber_slen_t sasl_write( Sockbuf *sb, void *buf, ber_len_t len );
 354 static int sasl_close( Sockbuf *sb );
 355
 356 static Sockbuf_IO sasl_io=
 357 {
 358 sasl_setup,
 359 sasl_remove,
 360 sasl_read,
 361 sasl_write,
 362 sasl_close
 363 };
 364
 365 #define HAS_SASL( sb ) ((sb)->sb_io==&sasl_io)
 366
 367 static char *
 368 array2str( char **a )
 369 {
 370         char *s, **v, *p;
 371         int len = 0;
 372
 373         for ( v = a; *v != NULL; v++ ) {
 374                 len += strlen( *v ) + 1; /* for a space */
 375         }
 376
 377         if ( len == 0 ) {
 378                 return NULL;
 379         }
 380
 381         s = LDAP_MALLOC ( len ); /* last space holds \0 */
 382
 383         if ( s == NULL ) {
 384                 return NULL;
 385         }
 386
 387         p = s;
 388         for ( v = a; *v != NULL; v++ ) {
 389                 int len;
 390
 391                 if ( v != a ) {
 392                         strncpy( p, " ", 1 );
 393                         ++p;
 394                 }
 395                 len = strlen( *v );
 396                 strncpy( p, *v, len );
 397                 p += len;
 398         }
 399
 400         *p = '\0';
 401
 402         return s;
 403 }
 404
 405 int ldap_pvt_sasl_init( void )
 406 {
 407         /* XXX not threadsafe */
 408         static int sasl_initialized = 0;
 409
 410         if ( sasl_initialized ) {
 411                 return 0;
 412         }
 413 #ifndef CSRIMALLOC
 414         sasl_set_alloc( ber_memalloc, ber_memcalloc, ber_memrealloc, ber_memfree );
 415 #endif /* CSRIMALLOC */
 416
 417         if ( sasl_client_init( NULL ) == SASL_OK ) {
 418                 sasl_initialized = 1;
 419                 return 0;
 420         }
 421
 422         return -1;
 423 }
 424
 425 int ldap_pvt_sasl_install( Sockbuf *sb, void *ctx_arg )
 426 {
 427         /* don't install the stuff unless security has been negotiated */
 428
 429         if ( !HAS_SASL( sb ) ) {
 430                 ber_pvt_sb_clear_io( sb );
 431                 ber_pvt_sb_set_io( sb, &sasl_io, ctx_arg );
 432         }
 433
 434         return 0;
 435 }
 436
 437 static int sasl_setup( Sockbuf *sb, void *arg )
 438 {
 439         sb->sb_iodata = arg;
 440         return 0;
 441 }
 442
 443 static int sasl_remove( Sockbuf *sb )
 444 {
 445         return 0;
 446 }
 447
 448 static ber_slen_t sasl_read( Sockbuf *sb, void *buf, ber_len_t buflen )
 449 {
 450         char *recv_tok;
 451         unsigned recv_tok_len;
 452         sasl_conn_t *conn = (sasl_conn_t *)sb->sb_iodata;
 453
 454         if ((ber_pvt_sb_io_tcp.sbi_read)( sb, buf, buflen ) != buflen ) {
 455                 return -1;
 456         }
 457
 458         if ( sasl_decode( conn, buf, buflen, &recv_tok, &recv_tok_len ) != SASL_OK ) {
 459                 return -1;
 460         }
 461
 462         if ( recv_tok_len > buflen ) {
 463                 LDAP_FREE( recv_tok );
 464                 return -1;
 465         }
 466
 467         memcpy( buf, recv_tok, recv_tok_len );
 468
 469         LDAP_FREE( recv_tok );
 470
 471         return recv_tok_len;
 472 }
 473
 474 static ber_slen_t sasl_write( Sockbuf *sb, void *buf, ber_len_t len )
 475 {
 476         char *wrapped_tok;
 477         unsigned wrapped_tok_len;
 478         sasl_conn_t *conn = (sasl_conn_t *)sb->sb_iodata;
 479
 480         if ( sasl_encode( conn, (const char *)buf, len,
 481                 &wrapped_tok, &wrapped_tok_len ) != SASL_OK ) {
 482                 return -1;
 483         }
 484
 485         if ((ber_pvt_sb_io_tcp.sbi_write)( sb, wrapped_tok, wrapped_tok_len ) != wrapped_tok_len ) {
 486                 LDAP_FREE( wrapped_tok );
 487                 return -1;
 488         }
 489
 490         LDAP_FREE( wrapped_tok );
 491
 492         return len;
 493 }
 494
 495 static int sasl_close( Sockbuf *sb )
 496 {
 497         (ber_pvt_sb_io_tcp.sbi_close)( sb );
 498 }
 499
 500 int
 501 ldap_pvt_sasl_err2ldap( int saslerr )
 502 {
 503         int rc;
 504
 505         switch (saslerr) {
 506                 case SASL_CONTINUE:
 507                         rc = LDAP_SASL_BIND_IN_PROGRESS;
 508                         break;
 509                 case SASL_OK:
 510                         rc = LDAP_SUCCESS;
 511                         break;
 512                 case SASL_FAIL:
 513                         rc = LDAP_OPERATIONS_ERROR;
 514                         break;
 515                 case SASL_NOMEM:
 516                         rc = LDAP_NO_MEMORY;
 517                         break;
 518                 case SASL_NOMECH:
 519                         rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 520                         break;
 521                 case SASL_BADAUTH:
 522                         rc = LDAP_INVALID_CREDENTIALS;
 523                         break;
 524                 case SASL_NOAUTHZ:
 525                         rc = LDAP_INSUFFICIENT_ACCESS;
 526                         break;
 527                 case SASL_TOOWEAK:
 528                 case SASL_ENCRYPT:
 529                         rc = LDAP_INAPPROPRIATE_AUTH;
 530                         break;
 531                 default:
 532                         rc = LDAP_OPERATIONS_ERROR;
 533                         break;
 534         }
 535
 536         return rc;
 537 }
 538
 539 int
 540 ldap_pvt_sasl_getmechs ( LDAP *ld, LDAP_CONST char *desired, char **pmechlist )
 541 {
 542         /* we need to query the server for supported mechs anyway */
 543         LDAPMessage *res, *e;
 544         char *attrs[] = { "supportedSASLMechanisms", NULL };
 545         char **values, *mechlist, **p;
 546         int rc;
 547
 548         rc = ldap_search_s( ld, NULL, LDAP_SCOPE_BASE,
 549                 NULL, attrs, 0, &res );
 550
 551         if ( rc != LDAP_SUCCESS ) {
 552                 return ld->ld_errno;
 553         }
 554
 555         e = ldap_first_entry( ld, res );
 556         if ( e == NULL ) {
 557                 if ( ld->ld_errno == LDAP_SUCCESS ) {
 558                         ld->ld_errno = LDAP_UNAVAILABLE;
 559                 }
 560                 return ld->ld_errno;
 561         }
 562
 563         values = ldap_get_values( ld, e, "supportedSASLMechanisms" );
 564         if ( values == NULL ) {
 565                 ld->ld_errno = LDAP_NO_SUCH_ATTRIBUTE;
 566                 ldap_msgfree( res );
 567                 return ld->ld_errno;
 568         }
 569
 570         if ( desired != NULL ) {
 571                 rc = LDAP_INAPPROPRIATE_AUTH;
 572
 573                 for ( p = values; *p != NULL; p++ ) {
 574                         if ( strcmp( *p, desired ) == 0 ) {
 575                                 rc = LDAP_SUCCESS;
 576                                 break;
 577                         }
 578                 }
 579
 580                 if ( rc == LDAP_SUCCESS ) {
 581                         /* just return this */
 582                         *pmechlist = LDAP_STRDUP( desired );
 583                         return LDAP_SUCCESS;
 584                 } else {
 585                         /* couldn't find it */
 586                         ld->ld_errno = LDAP_INAPPROPRIATE_AUTH;
 587                         return ld->ld_errno;
 588                 }
 589         }
 590
 591         mechlist = array2str( values );
 592         if ( mechlist == NULL ) {
 593                 ld->ld_errno = LDAP_NO_MEMORY;
 594                 ldap_value_free( values );
 595                 ldap_msgfree( res );
 596                 return ld->ld_errno;
 597         }
 598
 599         ldap_value_free( values );
 600         ldap_msgfree( res );
 601
 602         *pmechlist = mechlist;
 603
 604         return LDAP_SUCCESS;
 605 }
 606
 607 int
 608 ldap_pvt_sasl_bind(
 609         LDAP                    *ld,
 610         LDAP_CONST char         *dn,
 611         LDAP_CONST char         *mechanism,
 612         LDAP_CONST sasl_callback_t      *callbacks,
 613         LDAPControl             **sctrls,
 614         LDAPControl             **cctrls )
 615 {
 616         int     saslrc, rc, msgid, ssf = 0;
 617         struct berval ccred, *scred;
 618         char *mechlist = NULL;
 619         char *host;
 620         sasl_interact_t *client_interact = NULL;
 621
 622         Debug( LDAP_DEBUG_TRACE, "ldap_pvt_sasl_bind\n", 0, 0, 0 );
 623
 624         /* do a quick !LDAPv3 check... ldap_sasl_bind will do the rest. */
 625         if (ld->ld_version < LDAP_VERSION3) {
 626                 ld->ld_errno = LDAP_NOT_SUPPORTED;
 627                 return ld->ld_errno;
 628         }
 629
 630         /*
 631          * This connects to the host, side effect being that
 632          * ldap_host_connected_to() works.
 633          */
 634         rc = ldap_pvt_sasl_getmechs( ld, mechanism, &mechlist );
 635         if ( rc != LDAP_SUCCESS ) {
 636                 return ld->ld_errno;
 637         }
 638
 639         /* XXX this doesn't work with PF_LOCAL hosts */
 640         host = ldap_host_connected_to( &ld->ld_sb );
 641
 642         if ( host == NULL ) {
 643                 LDAP_FREE( mechlist );
 644                 ld->ld_errno = LDAP_UNAVAILABLE;
 645                 return ld->ld_errno;
 646         }
 647
 648         if ( ld->ld_sasl_context != NULL ) {
 649                 LDAP_FREE( mechlist );
 650                 sasl_dispose( &ld->ld_sasl_context );
 651         }
 652
 653         saslrc = sasl_client_new( "ldap", host, callbacks, 0, &ld->ld_sasl_context );
 654
 655         LDAP_FREE( host );
 656
 657         if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) {
 658                 LDAP_FREE( mechlist );
 659                 ld->ld_errno = ldap_pvt_sasl_err2ldap( rc );
 660                 sasl_dispose( &ld->ld_sasl_context );
 661                 return ld->ld_errno;
 662         }
 663
 664         ccred.bv_val = NULL;
 665         ccred.bv_len = 0;
 666
 667         saslrc = sasl_client_start( ld->ld_sasl_context,
 668                 mechlist,
 669                 NULL,
 670                 &client_interact,
 671                 &ccred.bv_val,
 672                 (unsigned int *)&ccred.bv_len,
 673                 &mechanism );
 674
 675         LDAP_FREE( mechlist );
 676
 677         if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) {
 678                 ld->ld_errno = ldap_pvt_sasl_err2ldap( saslrc );
 679                 sasl_dispose( &ld->ld_sasl_context );
 680                 return ld->ld_errno;
 681         }
 682
 683         scred = NULL;
 684
 685         do {
 686                 sasl_interact_t *client_interact = NULL;
 687
 688                 rc = ldap_sasl_bind_s( ld, dn, mechanism, &ccred, sctrls, cctrls, &scred );
 689                 if ( rc == LDAP_SUCCESS ) {
 690                         break;
 691                 } else if ( rc != LDAP_SASL_BIND_IN_PROGRESS ) {
 692                         if ( ccred.bv_val != NULL ) {
 693                                 LDAP_FREE( ccred.bv_val );
 694                         }
 695                         sasl_dispose( &ld->ld_sasl_context );
 696                         return ld->ld_errno;
 697                 }
 698
 699                 if ( ccred.bv_val != NULL ) {
 700                         LDAP_FREE( ccred.bv_val );
 701                         ccred.bv_val = NULL;
 702                 }
 703
 704                 saslrc = sasl_client_step( ld->ld_sasl_context,
 705                         (scred == NULL) ? NULL : scred->bv_val,
 706                         (scred == NULL) ? 0 : scred->bv_len,
 707                         &client_interact,
 708                         &ccred.bv_val,
 709                         (unsigned int *)&ccred.bv_len );
 710
 711                 ber_bvfree( scred );
 712
 713                 if ( (saslrc != SASL_OK) && (saslrc != SASL_CONTINUE) ) {
 714                         ld->ld_errno = ldap_pvt_sasl_err2ldap( saslrc );
 715                         sasl_dispose( &ld->ld_sasl_context );
 716                         return ld->ld_errno;
 717                 }
 718         } while ( rc == LDAP_SASL_BIND_IN_PROGRESS );
 719
 720         assert ( rc == LDAP_SUCCESS );
 721
 722         if ( sasl_getprop( ld->ld_sasl_context, SASL_SSF, (void **)&ssf )
 723                 == SASL_OK && ssf ) {
 724                 ldap_pvt_sasl_install( &ld->ld_sb, ld->ld_sasl_context );
 725         }
 726
 727         return rc;
 728 }
 729
 730 /* based on sample/sample-client.c */
 731 static int
 732 ldap_pvt_sasl_getsecret(sasl_conn_t *conn, void *context, int id, sasl_secret_t **psecret)
 733 {
 734         struct berval *passphrase = (struct berval *)context;
 735         size_t len;
 736
 737         if ( conn == NULL || psecret == NULL || id != SASL_CB_PASS ) {
 738                 return SASL_BADPARAM;
 739         }
 740
 741         len = (passphrase != NULL) ? (size_t)passphrase->bv_len: 0;
 742
 743         *psecret = (sasl_secret_t *) LDAP_MALLOC( sizeof( sasl_secret_t ) + len );
 744         if ( *psecret == NULL ) {
 745                 return SASL_NOMEM;
 746         }
 747
 748         (*psecret)->len = passphrase->bv_len;
 749
 750         if ( passphrase != NULL ) {
 751                 memcpy((*psecret)->data, passphrase->bv_val, len);
 752         }
 753
 754         return SASL_OK;
 755 }
 756
 757 static int
 758 ldap_pvt_sasl_getsimple(void *context, int id, const char **result, int *len)
 759 {
 760         const char *value = (const char *)context;
 761
 762         if ( result == NULL ) {
 763                 return SASL_BADPARAM;
 764         }
 765
 766         switch ( id ) {
 767                 case SASL_CB_USER:
 768                 case SASL_CB_AUTHNAME:
 769                         *result = value;
 770                         if ( len )
 771                                 *len = value ? strlen( value ) : 0;
 772                         break;
 773                 case SASL_CB_LANGUAGE:
 774                         *result = NULL;
 775                         if ( len )
 776                                 *len = 0;
 777                         break;
 778                 default:
 779                         return SASL_BADPARAM;
 780         }
 781
 782         return SASL_OK;
 783 }
 784
 785 /*
 786  * ldap_negotiated_sasl_bind_s - bind to the ldap server (and X.500)
 787  * using SASL authentication.
 788  *
 789  * This routine attempts to authenticate the user referred by the
 790  * authentication id using the provided password.  An optional
 791  * authorization identity may be provided.  An DN is generally not
 792  * provided [see AuthMethod].
 793  *
 794  * If the mechanism negotiated does not require a password, the
 795  * passwd field is ignored.  [A callback mechanism should really
 796  * be used].
 797  *
 798  * LDAP_SUCCESS is returned upon success, the ldap error code
 799  * otherwise.
 800  *
 801  * Examples:
 802  *      ldap_negotiated_sasl_bind_s( ld, NULL,
 803  *          "user@OPENLDAP.ORG", NULL, NULL,
 804  *              "GSSAPI", NULL, NULL, NULL );
 805  *
 806  *      ldap_negotiated_sasl_bind_s( ld, NULL,
 807  *          "manager", "cn=user,dc=openldap,dc=org", NULL,
 808  *              "DIGEST-MD5", NULL, NULL, NULL );
 809  *
 810  *      ldap_negotiated_sasl_bind_s( ld, NULL,
 811  *          "root@OPENLDAP.ORG", "u:user@OPENLDAP.ORG", NULL,
 812  *              "GSSAPI", NULL, NULL, NULL );
 813  *
 814  *      ldap_negotiated_sasl_bind_s( ld, NULL,
 815  *          "manager", "dn:cn=user,dc=openldap,dc=org", NULL,
 816  *              "DIGEST-MD5", NULL, NULL, NULL );
 817  */
 818 int
 819 ldap_negotiated_sasl_bind_s(
 820         LDAP *ld,
 821         LDAP_CONST char *dn, /* usually NULL */
 822         LDAP_CONST char *authenticationId,
 823         LDAP_CONST char *authorizationId, /* commonly NULL */
 824         LDAP_CONST char *saslMechanism,
 825         struct berval *passPhrase,
 826         LDAPControl **serverControls,
 827         LDAPControl **clientControls)
 828 {
 829         int n;
 830         sasl_callback_t callbacks[4];
 831         int rc;
 832
 833         /* SASL Authentication Identity */
 834         callbacks[n=0].id = SASL_CB_AUTHNAME;
 835         callbacks[n].proc = ldap_pvt_sasl_getsimple;
 836         callbacks[n].context = (void *)authenticationId;
 837
 838         /* SASL Authorization Identity (userid) */
 839         if( authorizationId != NULL ) {
 840                 callbacks[++n].id = SASL_CB_USER;
 841                 callbacks[n].proc = ldap_pvt_sasl_getsimple;
 842                 callbacks[n].context = (void *)authorizationId;
 843         }
 844
 845         callbacks[++n].id = SASL_CB_PASS;
 846         callbacks[n].proc = ldap_pvt_sasl_getsecret;
 847         callbacks[n].context = (void *)passPhrase;
 848
 849         callbacks[++n].id = SASL_CB_LIST_END;
 850         callbacks[n].proc = NULL;
 851         callbacks[n].context = NULL;
 852
 853         rc = ldap_pvt_sasl_bind(ld, dn, saslMechanism, callbacks,
 854                 serverControls, clientControls);
 855
 856         return rc;
 857 }
 858 #endif /* HAVE_CYRUS_SASL */