1 /* bind.c - bdb2 backend bind and unbind routines */
10 #include <ac/string.h>
11 #include <ac/unistd.h>
14 #include "back-bdb2.h"
15 #include "proto-back-bdb2.h"
20 extern int bdb2i_krbv4_ldap_auth();
33 for ( i = 0; vals[i] != NULL; i++ ) {
34 if ( syntax != SYNTAX_BIN ) {
38 ldap_pvt_thread_mutex_lock( &crypt_mutex );
41 result = lutil_passwd(
43 (char*) vals[i]->bv_val,
47 ldap_pvt_thread_mutex_unlock( &crypt_mutex );
53 if ( value_cmp( vals[i], v, syntax, normalize ) == 0 ) {
63 bdb2i_back_bind_internal(
74 struct ldbminfo *li = (struct ldbminfo *) be->be_private;
80 char krbname[MAX_K_NAME_SZ + 1];
84 Debug(LDAP_DEBUG_ARGS, "==> bdb2_back_bind: dn: %s\n", dn, 0, 0);
88 /* get entry with reader lock */
89 if ( (e = bdb2i_dn2entry_r( be, dn, &matched )) == NULL ) {
90 char *matched_dn = NULL;
91 struct berval **refs = NULL;
93 if ( matched != NULL ) {
94 matched_dn = ch_strdup( matched->e_dn );
95 refs = is_entry_referral( matched )
96 ? get_entry_referrals( be, conn, op, matched )
98 bdb2i_cache_return_entry_r( &li->li_cache, matched );
100 refs = default_referral;
103 /* allow noauth binds */
105 if ( method == LDAP_AUTH_SIMPLE ) {
106 if( cred->bv_len == 0 ) {
108 send_ldap_result( conn, op, LDAP_SUCCESS,
109 NULL, NULL, NULL, NULL );
111 } else if ( be_isroot_pw( be, dn, cred ) ) {
112 /* front end will send result */
113 *edn = ch_strdup( be_root_dn( be ) );
116 } else if ( refs != NULL ) {
117 send_ldap_result( conn, op, LDAP_REFERRAL,
118 matched_dn, NULL, refs, NULL );
121 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
122 NULL, NULL, NULL, NULL );
125 } else if ( method == LDAP_AUTH_SASL ) {
126 if( mech != NULL && strcasecmp(mech,"DIGEST-MD5") == 0 ) {
127 /* insert DIGEST calls here */
128 send_ldap_result( conn, op, LDAP_AUTH_METHOD_NOT_SUPPORTED,
129 NULL, NULL, NULL, NULL );
132 send_ldap_result( conn, op, LDAP_AUTH_METHOD_NOT_SUPPORTED,
133 NULL, NULL, NULL, NULL );
136 } else if ( refs != NULL ) {
137 send_ldap_result( conn, op, LDAP_REFERRAL,
138 matched_dn, NULL, refs, NULL );
141 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
142 NULL, NULL, NULL, NULL );
145 if ( matched != NULL ) {
146 ber_bvecfree( refs );
152 *edn = ch_strdup( e->e_dn );
154 /* check for deleted */
156 if ( ! access_allowed( be, conn, op, e,
157 "entry", NULL, ACL_AUTH ) )
159 send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
160 NULL, NULL, NULL, NULL );
165 if ( is_entry_alias( e ) ) {
166 /* entry is a alias, don't allow bind */
167 Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0,
170 send_ldap_result( conn, op, LDAP_ALIAS_PROBLEM,
171 NULL, NULL, NULL, NULL );
178 if ( is_entry_referral( e ) ) {
179 /* entry is a referral, don't allow bind */
180 struct berval **refs = get_entry_referrals( be,
183 Debug( LDAP_DEBUG_TRACE, "entry is referral\n", 0,
187 send_ldap_result( conn, op, LDAP_REFERRAL,
188 e->e_dn, NULL, refs, NULL );
190 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
191 NULL, NULL, NULL, NULL );
194 ber_bvecfree( refs );
201 case LDAP_AUTH_SIMPLE:
202 if ( cred->bv_len == 0 ) {
203 send_ldap_result( conn, op, LDAP_SUCCESS,
204 NULL, NULL, NULL, NULL );
206 /* stop front end from sending result */
211 /* check for root dn/passwd */
212 if ( be_isroot_pw( be, dn, cred ) ) {
213 /* front end will send result */
214 if( *edn != NULL ) free( *edn );
215 *edn = ch_strdup( be_root_dn( be ) );
220 if ( ! access_allowed( be, conn, op, e,
221 "userpassword", NULL, ACL_AUTH ) )
223 send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
224 NULL, NULL, NULL, NULL);
229 if ( (a = attr_find( e->e_attrs, "userpassword" )) == NULL ) {
230 send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
231 NULL, NULL, NULL, NULL);
233 /* stop front end from sending result */
238 if ( crypted_value_find( a->a_vals, cred, a->a_syntax, 0, cred ) != 0 )
240 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
241 NULL, NULL, NULL, NULL);
242 /* stop front end from sending result */
250 case LDAP_AUTH_KRBV41:
251 if ( bdb2i_krbv4_ldap_auth( be, cred, &ad ) != LDAP_SUCCESS ) {
252 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
253 NULL, NULL, NULL, NULL);
258 if ( ! access_allowed( be, conn, op, e,
259 "krbname", NULL, ACL_AUTH ) )
261 send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
262 NULL, NULL, NULL, NULL);
267 sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "."
268 : "", ad.pinst, ad.prealm );
270 if ( (a = attr_find( e->e_attrs, "krbname" )) == NULL ) {
272 * no krbName values present: check against DN
274 if ( strcasecmp( dn, krbname ) == 0 ) {
275 rc = 0; /* XXX wild ass guess */
278 send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
279 NULL, NULL, NULL, NULL);
282 } else { /* look for krbName match */
283 struct berval krbval;
285 krbval.bv_val = krbname;
286 krbval.bv_len = strlen( krbname );
288 if ( value_find( a->a_vals, &krbval, a->a_syntax, 3 ) != 0 ) {
289 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
290 NULL, NULL, NULL, NULL);
298 case LDAP_AUTH_KRBV42:
299 send_ldap_result( conn, op, LDAP_SUCCESS,
300 NULL, NULL, NULL, NULL );
301 /* stop front end from sending result */
307 /* insert sasl code here */
310 send_ldap_result( conn, op, LDAP_STRONG_AUTH_NOT_SUPPORTED,
311 NULL, "auth method not supported", NULL, NULL );
317 /* free entry and reader lock */
318 bdb2i_cache_return_entry_r( &li->li_cache, e );
320 /* front end with send result on success (rc==0) */
339 struct ldbminfo *li = (struct ldbminfo *) be->be_private;
340 struct timeval time1;
343 bdb2i_start_timing( be->bd_info, &time1 );
345 if ( bdb2i_enter_backend_r( &lock ) != 0 ) {
346 send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
347 NULL, NULL, NULL, NULL );
351 ret = bdb2i_back_bind_internal( be, conn, op, ndn, method, mech, cred, edn );
353 (void) bdb2i_leave_backend_r( lock );
355 bdb2i_stop_timing( be->bd_info, time1, "BIND", conn, op );