git.sur5r.net Git - openldap/blob - servers/slapd/back-bdb2/bind.c

   1 /* bind.c - bdb2 backend bind and unbind routines */
   2
   3 #include "portable.h"
   4
   5 #include <stdio.h>
   6
   7 #include <ac/krb.h>
   8 #include <ac/socket.h>
   9 #include <ac/string.h>
  10 #include <ac/unistd.h>
  11
  12 #include "slap.h"
  13 #include "back-bdb2.h"
  14 #include "proto-back-bdb2.h"
  15
  16 #include <lutil.h>
  17
  18 #ifdef HAVE_KERBEROS
  19 extern int      bdb2i_krbv4_ldap_auth();
  20 #endif
  21
  22 static int
  23 crypted_value_find(
  24         struct berval       **vals,
  25         struct berval       *v,
  26         int                 syntax,
  27         int                 normalize,
  28         struct berval           *cred
  29 )
  30 {
  31         int     i;
  32         for ( i = 0; vals[i] != NULL; i++ ) {
  33                 if ( syntax != SYNTAX_BIN ) {
  34                         int result;
  35
  36 #ifdef SLAPD_CRYPT
  37                         ldap_pvt_thread_mutex_lock( &crypt_mutex );
  38 #endif
  39
  40                         result = lutil_passwd(
  41                                 (char*) cred->bv_val,
  42                                 (char*) vals[i]->bv_val);
  43
  44 #ifdef SLAPD_CRYPT
  45                         ldap_pvt_thread_mutex_unlock( &crypt_mutex );
  46 #endif
  47
  48                         return result;
  49
  50                 } else {
  51                 if ( value_cmp( vals[i], v, syntax, normalize ) == 0 ) {
  52                         return( 0 );
  53                 }
  54         }
  55         }
  56
  57         return( 1 );
  58 }
  59
  60 static int
  61 bdb2i_back_bind_internal(
  62     BackendDB           *be,
  63     Connection          *conn,
  64     Operation           *op,
  65     char                *dn,
  66     int                 method,
  67     struct berval       *cred,
  68         char**  edn
  69 )
  70 {
  71         struct ldbminfo *li = (struct ldbminfo *) be->be_private;
  72         Entry           *e;
  73         Attribute       *a;
  74         int             rc;
  75         char            *matched;
  76 #ifdef HAVE_KERBEROS
  77         char            krbname[MAX_K_NAME_SZ + 1];
  78         AUTH_DAT        ad;
  79 #endif
  80
  81         Debug(LDAP_DEBUG_ARGS, "==> bdb2_back_bind: dn: %s\n", dn, 0, 0);
  82
  83         *edn = NULL;
  84
  85         /* get entry with reader lock */
  86         if ( (e = bdb2i_dn2entry_r( be, dn, &matched )) == NULL ) {
  87                 /* allow noauth binds */
  88                 if ( method == LDAP_AUTH_SIMPLE && cred->bv_len == 0 ) {
  89                         /*
  90                          * bind successful, but return 1 so we don't
  91                          * authorize based on noauth credentials
  92                          */
  93                         send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL );
  94                         rc = 1;
  95                 } else if ( be_isroot_pw( be, dn, cred ) ) {
  96                         /* front end will send result */
  97                         *edn = ch_strdup( be_root_dn( be ) );
  98                         rc = 0;
  99                 } else {
 100                         send_ldap_result( conn, op, LDAP_NO_SUCH_OBJECT, matched, NULL );
 101                         rc = 1;
 102                 }
 103                 if ( matched != NULL ) {
 104                         free( matched );
 105                 }
 106                 return( rc );
 107         }
 108
 109         *edn = ch_strdup( e->e_dn );
 110
 111         /* check for deleted */
 112
 113         switch ( method ) {
 114         case LDAP_AUTH_SIMPLE:
 115                 if ( cred->bv_len == 0 ) {
 116                         send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL );
 117
 118                         /* stop front end from sending result */
 119                         rc = 1;
 120                         goto return_results;
 121                 } else if ( be_isroot_pw( be, dn, cred ) ) {
 122                         /* front end will send result */
 123                         *edn = ch_strdup( be_root_dn( be ) );
 124                         rc = 0;
 125                         goto return_results;
 126                 }
 127
 128                 if ( (a = attr_find( e->e_attrs, "userpassword" )) == NULL ) {
 129                         if ( be_isroot_pw( be, dn, cred ) ) {
 130                                 /* front end will send result */
 131                                 *edn = ch_strdup( be_root_dn( be ) );
 132                                 rc = 0;
 133                                 goto return_results;
 134                         }
 135                         send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
 136                             NULL, NULL );
 137                         rc = 1;
 138                         goto return_results;
 139                 }
 140
 141                 if ( crypted_value_find( a->a_vals, cred, a->a_syntax, 0, cred ) != 0 )
 142                 {
 143                         if ( be_isroot_pw( be, dn, cred ) ) {
 144                                 /* front end will send result */
 145                                 *edn = ch_strdup( be_root_dn( be ) );
 146                                 rc = 0;
 147                                 goto return_results;
 148                         }
 149                         send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
 150                                 NULL, NULL );
 151                         rc = 1;
 152                         goto return_results;
 153                 }
 154                 rc = 0;
 155                 break;
 156
 157 #ifdef HAVE_KERBEROS
 158         case LDAP_AUTH_KRBV41:
 159                 if ( bdb2i_krbv4_ldap_auth( be, cred, &ad ) != LDAP_SUCCESS ) {
 160                         send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
 161                             NULL, NULL );
 162                         rc = 0;
 163                         goto return_results;
 164                 }
 165                 sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "."
 166                     : "", ad.pinst, ad.prealm );
 167                 if ( (a = attr_find( e->e_attrs, "krbname" )) == NULL ) {
 168                         /*
 169                          * no krbName values present:  check against DN
 170                          */
 171                         if ( strcasecmp( dn, krbname ) == 0 ) {
 172                                 rc = 0; /* XXX wild ass guess */
 173                                 break;
 174                         }
 175                         send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
 176                             NULL, NULL );
 177                         rc = 1;
 178                         goto return_results;
 179                 } else {        /* look for krbName match */
 180                         struct berval   krbval;
 181
 182                         krbval.bv_val = krbname;
 183                         krbval.bv_len = strlen( krbname );
 184
 185                         if ( value_find( a->a_vals, &krbval, a->a_syntax, 3 ) != 0 ) {
 186                                 send_ldap_result( conn, op,
 187                                     LDAP_INVALID_CREDENTIALS, NULL, NULL );
 188                                 rc = 1;
 189                                 goto return_results;
 190                         }
 191                 }
 192                 rc = 0;
 193                 break;
 194
 195         case LDAP_AUTH_KRBV42:
 196                 send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL );
 197                 /* stop front end from sending result */
 198                 rc = 1;
 199                 goto return_results;
 200 #endif
 201
 202         default:
 203                 send_ldap_result( conn, op, LDAP_STRONG_AUTH_NOT_SUPPORTED,
 204                     NULL, "auth method not supported" );
 205                 rc = 1;
 206                 goto return_results;
 207         }
 208
 209 return_results:;
 210         /* free entry and reader lock */
 211         bdb2i_cache_return_entry_r( &li->li_cache, e );
 212
 213         /* front end with send result on success (rc==0) */
 214         return( rc );
 215 }
 216
 217
 218 int
 219 bdb2_back_bind(
 220     BackendDB           *be,
 221     Connection          *conn,
 222     Operation           *op,
 223     char                *dn,
 224     int                 method,
 225     struct berval       *cred,
 226         char**  edn
 227 )
 228 {
 229         DB_LOCK         lock;
 230         struct ldbminfo *li = (struct ldbminfo *) be->be_private;
 231         struct timeval  time1;
 232         int             ret;
 233
 234         bdb2i_start_timing( be->bd_info, &time1 );
 235
 236         if ( bdb2i_enter_backend_r( get_dbenv( be ), &lock ) != 0 ) {
 237
 238                 send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR, "", "" );
 239                 return( 1 );
 240
 241         }
 242
 243         ret = bdb2i_back_bind_internal( be, conn, op, dn, method, cred, edn );
 244
 245         (void) bdb2i_leave_backend_r( get_dbenv( be ), lock );
 246
 247         bdb2i_stop_timing( be->bd_info, time1, "BIND", conn, op );
 248
 249         return( ret );
 250 }
 251
 252