1 /* bind.c - bdb2 backend bind and unbind routines */
10 #include <ac/string.h>
11 #include <ac/unistd.h>
14 #include "back-bdb2.h"
15 #include "proto-back-bdb2.h"
20 extern int bdb2i_krbv4_ldap_auth();
33 for ( i = 0; vals[i] != NULL; i++ ) {
34 if ( syntax != SYNTAX_BIN ) {
38 ldap_pvt_thread_mutex_lock( &crypt_mutex );
41 result = lutil_passwd(
43 (char*) vals[i]->bv_val,
47 ldap_pvt_thread_mutex_unlock( &crypt_mutex );
53 if ( value_cmp( vals[i], v, syntax, normalize ) == 0 ) {
63 bdb2i_back_bind_internal(
74 struct ldbminfo *li = (struct ldbminfo *) be->be_private;
80 char krbname[MAX_K_NAME_SZ + 1];
84 Debug(LDAP_DEBUG_ARGS, "==> bdb2_back_bind: dn: %s\n", dn, 0, 0);
88 /* get entry with reader lock */
89 if ( (e = bdb2i_dn2entry_r( be, dn, &matched )) == NULL ) {
90 char *matched_dn = NULL;
91 struct berval **refs = NULL;
93 if ( matched != NULL ) {
94 matched_dn = ch_strdup( matched->e_dn );
95 refs = is_entry_referral( matched )
96 ? get_entry_referrals( be, conn, op, matched )
98 bdb2i_cache_return_entry_r( &li->li_cache, matched );
100 refs = default_referral;
103 /* allow noauth binds */
105 if ( method == LDAP_AUTH_SIMPLE ) {
106 if( cred->bv_len == 0 ) {
108 send_ldap_result( conn, op, LDAP_SUCCESS,
109 NULL, NULL, NULL, NULL );
111 } else if ( be_isroot_pw( be, dn, cred ) ) {
112 /* front end will send result */
113 *edn = ch_strdup( be_root_dn( be ) );
117 send_ldap_result( conn, op, LDAP_REFERRAL,
118 matched_dn, NULL, refs, NULL );
121 } else if ( method == LDAP_AUTH_SASL ) {
122 if( mech != NULL && strcasecmp(mech,"DIGEST-MD5") == 0 ) {
123 /* insert DIGEST calls here */
124 send_ldap_result( conn, op, LDAP_AUTH_METHOD_NOT_SUPPORTED,
125 NULL, NULL, NULL, NULL );
128 send_ldap_result( conn, op, LDAP_AUTH_METHOD_NOT_SUPPORTED,
129 NULL, NULL, NULL, NULL );
133 send_ldap_result( conn, op, LDAP_REFERRAL,
134 matched_dn, NULL, refs, NULL );
138 if ( matched != NULL ) {
139 ber_bvecfree( refs );
145 *edn = ch_strdup( e->e_dn );
147 /* check for deleted */
149 if ( ! access_allowed( be, conn, op, e,
150 "entry", NULL, ACL_AUTH ) )
152 send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
153 NULL, NULL, NULL, NULL );
158 if ( is_entry_alias( e ) ) {
159 /* entry is a alias, don't allow bind */
160 Debug( LDAP_DEBUG_TRACE, "entry is referral\n", 0,
163 send_ldap_result( conn, op, LDAP_ALIAS_PROBLEM,
164 NULL, NULL, NULL, NULL );
171 if ( is_entry_referral( e ) ) {
172 /* entry is a referral, don't allow bind */
173 struct berval **refs = get_entry_referrals( be,
176 Debug( LDAP_DEBUG_TRACE, "entry is referral\n", 0,
179 send_ldap_result( conn, op, LDAP_REFERRAL,
180 e->e_dn, NULL, refs, NULL );
182 ber_bvecfree( refs );
189 case LDAP_AUTH_SIMPLE:
190 if ( cred->bv_len == 0 ) {
191 send_ldap_result( conn, op, LDAP_SUCCESS,
192 NULL, NULL, NULL, NULL );
194 /* stop front end from sending result */
199 /* check for root dn/passwd */
200 if ( be_isroot_pw( be, dn, cred ) ) {
201 /* front end will send result */
202 if( *edn != NULL ) free( *edn );
203 *edn = ch_strdup( be_root_dn( be ) );
208 if ( ! access_allowed( be, conn, op, e,
209 "userpassword", NULL, ACL_AUTH ) )
211 send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
212 NULL, NULL, NULL, NULL);
217 if ( (a = attr_find( e->e_attrs, "userpassword" )) == NULL ) {
218 send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
219 NULL, NULL, NULL, NULL);
221 /* stop front end from sending result */
226 if ( crypted_value_find( a->a_vals, cred, a->a_syntax, 0, cred ) != 0 )
228 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
229 NULL, NULL, NULL, NULL);
230 /* stop front end from sending result */
238 case LDAP_AUTH_KRBV41:
239 if ( bdb2i_krbv4_ldap_auth( be, cred, &ad ) != LDAP_SUCCESS ) {
240 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
241 NULL, NULL, NULL, NULL);
246 if ( ! access_allowed( be, conn, op, e,
247 "krbname", NULL, ACL_AUTH ) )
249 send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
250 NULL, NULL, NULL, NULL);
255 sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "."
256 : "", ad.pinst, ad.prealm );
258 if ( (a = attr_find( e->e_attrs, "krbname" )) == NULL ) {
260 * no krbName values present: check against DN
262 if ( strcasecmp( dn, krbname ) == 0 ) {
263 rc = 0; /* XXX wild ass guess */
266 send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
267 NULL, NULL, NULL, NULL);
270 } else { /* look for krbName match */
271 struct berval krbval;
273 krbval.bv_val = krbname;
274 krbval.bv_len = strlen( krbname );
276 if ( value_find( a->a_vals, &krbval, a->a_syntax, 3 ) != 0 ) {
277 send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
278 NULL, NULL, NULL, NULL);
286 case LDAP_AUTH_KRBV42:
287 send_ldap_result( conn, op, LDAP_SUCCESS,
288 NULL, NULL, NULL, NULL );
289 /* stop front end from sending result */
295 /* insert sasl code here */
298 send_ldap_result( conn, op, LDAP_STRONG_AUTH_NOT_SUPPORTED,
299 NULL, "auth method not supported", NULL, NULL );
305 /* free entry and reader lock */
306 bdb2i_cache_return_entry_r( &li->li_cache, e );
308 /* front end with send result on success (rc==0) */
326 struct ldbminfo *li = (struct ldbminfo *) be->be_private;
327 struct timeval time1;
330 bdb2i_start_timing( be->bd_info, &time1 );
332 if ( bdb2i_enter_backend_r( &lock ) != 0 ) {
333 send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
334 NULL, NULL, NULL, NULL );
338 ret = bdb2i_back_bind_internal( be, conn, op, dn, method, mech, cred, edn );
340 (void) bdb2i_leave_backend_r( lock );
342 bdb2i_stop_timing( be->bd_info, time1, "BIND", conn, op );