1 /* bind.c - bdb2 backend bind and unbind routines */
10 #include <ac/unistd.h>
13 #include "back-bdb2.h"
14 #include "proto-back-bdb2.h"
19 extern int bdb2i_krbv4_ldap_auth();
32 for ( i = 0; vals[i] != NULL; i++ ) {
33 if ( syntax != SYNTAX_BIN ) {
37 ldap_pvt_thread_mutex_lock( &crypt_mutex );
40 result = lutil_passwd(
42 (char*) vals[i]->bv_val,
46 ldap_pvt_thread_mutex_unlock( &crypt_mutex );
52 if ( value_cmp( vals[i], v, syntax, normalize ) == 0 ) {
62 bdb2i_back_bind_internal(
73 struct ldbminfo *li = (struct ldbminfo *) be->be_private;
79 char krbname[MAX_K_NAME_SZ + 1];
83 Debug(LDAP_DEBUG_ARGS, "==> bdb2_back_bind: dn: %s\n", dn, 0, 0);
87 /* get entry with reader lock */
88 if ( (e = bdb2i_dn2entry_r( be, dn, &matched )) == NULL ) {
89 char *matched_dn = NULL;
90 struct berval **refs = NULL;
92 if ( matched != NULL ) {
93 matched_dn = ch_strdup( matched->e_dn );
94 refs = is_entry_referral( matched )
95 ? get_entry_referrals( be, conn, op, matched )
97 bdb2i_cache_return_entry_r( &li->li_cache, matched );
99 refs = default_referral;
102 /* allow noauth binds */
104 if ( method == LDAP_AUTH_SIMPLE ) {
105 if( cred->bv_len == 0 ) {
107 send_ldap_result( conn, op, LDAP_SUCCESS,
108 NULL, NULL, NULL, NULL );
110 } else if ( be_isroot_pw( be, dn, cred ) ) {
111 /* front end will send result */
112 *edn = ch_strdup( be_root_dn( be ) );
116 send_ldap_result( conn, op, LDAP_REFERRAL,
117 matched_dn, NULL, refs, NULL );
120 } else if ( method == LDAP_AUTH_SASL ) {
121 if( mech != NULL && strcasecmp(mech,"DIGEST-MD5") == 0 ) {
122 /* insert DIGEST calls here */
123 send_ldap_result( conn, op, LDAP_AUTH_METHOD_NOT_SUPPORTED,
124 NULL, NULL, NULL, NULL );
127 send_ldap_result( conn, op, LDAP_AUTH_METHOD_NOT_SUPPORTED,
128 NULL, NULL, NULL, NULL );
132 send_ldap_result( conn, op, LDAP_REFERRAL,
133 matched_dn, NULL, refs, NULL );
137 if ( matched != NULL ) {
138 ber_bvecfree( refs );
144 *edn = ch_strdup( e->e_dn );
146 /* check for deleted */
148 if ( ! access_allowed( be, conn, op, e,
149 "entry", NULL, ACL_AUTH ) )
151 send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
152 NULL, NULL, NULL, NULL );
157 if ( is_entry_alias( e ) ) {
158 /* entry is a alias, don't allow bind */
159 Debug( LDAP_DEBUG_TRACE, "entry is referral\n", 0,
162 send_ldap_result( conn, op, LDAP_ALIAS_PROBLEM,
163 NULL, NULL, NULL, NULL );
170 if ( is_entry_referral( e ) ) {
171 /* entry is a referral, don't allow bind */
172 struct berval **refs = get_entry_referrals( be,
175 Debug( LDAP_DEBUG_TRACE, "entry is referral\n", 0,
178 send_ldap_result( conn, op, LDAP_REFERRAL,
179 e->e_dn, NULL, refs, NULL );
181 ber_bvecfree( refs );
188 case LDAP_AUTH_SIMPLE:
189 if ( cred->bv_len == 0 ) {
190 send_ldap_result( conn, op, LDAP_SUCCESS,
191 NULL, NULL, NULL, NULL );
193 /* stop front end from sending result */
198 /* check for root dn/passwd */
199 if ( be_isroot_pw( be, dn, cred ) ) {
200 /* front end will send result */
201 if( *edn != NULL ) free( *edn );
202 *edn = ch_strdup( be_root_dn( be ) );
207 if ( ! access_allowed( be, conn, op, e,
208 "userpassword", NULL, ACL_AUTH ) )
210 send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
211 NULL, NULL, NULL, NULL);
216 if ( (a = attr_find( e->e_attrs, "userpassword" )) == NULL ) {
217 send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
218 NULL, NULL, NULL, NULL);
220 /* stop front end from sending result */
225 if ( crypted_value_find( a->a_vals, cred, a->a_syntax, 0, cred ) != 0 )
227 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
228 NULL, NULL, NULL, NULL);
229 /* stop front end from sending result */
237 case LDAP_AUTH_KRBV41:
238 if ( bdb2i_krbv4_ldap_auth( be, cred, &ad ) != LDAP_SUCCESS ) {
239 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
240 NULL, NULL, NULL, NULL);
245 if ( ! access_allowed( be, conn, op, e,
246 "krbname", NULL, ACL_AUTH ) )
248 send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
249 NULL, NULL, NULL, NULL);
254 sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "."
255 : "", ad.pinst, ad.prealm );
257 if ( (a = attr_find( e->e_attrs, "krbname" )) == NULL ) {
259 * no krbName values present: check against DN
261 if ( strcasecmp( dn, krbname ) == 0 ) {
262 rc = 0; /* XXX wild ass guess */
265 send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
266 NULL, NULL, NULL, NULL);
269 } else { /* look for krbName match */
270 struct berval krbval;
272 krbval.bv_val = krbname;
273 krbval.bv_len = strlen( krbname );
275 if ( value_find( a->a_vals, &krbval, a->a_syntax, 3 ) != 0 ) {
276 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
277 NULL, NULL, NULL, NULL);
285 case LDAP_AUTH_KRBV42:
286 send_ldap_result( conn, op, LDAP_SUCCESS,
287 NULL, NULL, NULL, NULL );
288 /* stop front end from sending result */
294 /* insert sasl code here */
297 send_ldap_result( conn, op, LDAP_STRONG_AUTH_NOT_SUPPORTED,
298 NULL, "auth method not supported", NULL, NULL );
304 /* free entry and reader lock */
305 bdb2i_cache_return_entry_r( &li->li_cache, e );
307 /* front end with send result on success (rc==0) */
325 struct ldbminfo *li = (struct ldbminfo *) be->be_private;
326 struct timeval time1;
329 bdb2i_start_timing( be->bd_info, &time1 );
331 if ( bdb2i_enter_backend_r( &lock ) != 0 ) {
332 send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
333 NULL, NULL, NULL, NULL );
337 ret = bdb2i_back_bind_internal( be, conn, op, dn, method, mech, cred, edn );
339 (void) bdb2i_leave_backend_r( lock );
341 bdb2i_stop_timing( be->bd_info, time1, "BIND", conn, op );