git.sur5r.net Git - openldap/blob - servers/slapd/back-ldbm/bind.c

   1 /* bind.c - ldbm backend bind and unbind routines */
   2
   3 #include "portable.h"
   4
   5 #include <stdio.h>
   6
   7 #include <ac/krb.h>
   8 #include <ac/socket.h>
   9 #include <ac/string.h>
  10 #include <ac/unistd.h>
  11
  12 #include "slap.h"
  13 #include "back-ldbm.h"
  14 #include "proto-back-ldbm.h"
  15
  16 #include <lutil.h>
  17
  18 #ifdef HAVE_KERBEROS
  19 extern int      krbv4_ldap_auth();
  20 #endif
  21
  22 static int
  23 crypted_value_find(
  24         struct berval       **vals,
  25         struct berval       *v,
  26         int                 syntax,
  27         int                 normalize,
  28         struct berval           *cred
  29 )
  30 {
  31         int     i;
  32         for ( i = 0; vals[i] != NULL; i++ ) {
  33                 if ( syntax != SYNTAX_BIN ) {
  34                         int result;
  35
  36 #ifdef SLAPD_CRYPT
  37                         ldap_pvt_thread_mutex_lock( &crypt_mutex );
  38 #endif
  39
  40                         result = lutil_passwd(
  41                                 (char*) cred->bv_val,
  42                                 (char*) vals[i]->bv_val,
  43                                 NULL );
  44
  45 #ifdef SLAPD_CRYPT
  46                         ldap_pvt_thread_mutex_unlock( &crypt_mutex );
  47 #endif
  48
  49                         return result;
  50
  51                 } else {
  52                 if ( value_cmp( vals[i], v, syntax, normalize ) == 0 ) {
  53                         return( 0 );
  54                 }
  55         }
  56         }
  57
  58         return( 1 );
  59 }
  60
  61 int
  62 ldbm_back_bind(
  63     Backend             *be,
  64     Connection          *conn,
  65     Operation           *op,
  66     char                *dn,
  67     int                 method,
  68         char            *mech,
  69     struct berval       *cred,
  70         char**  edn
  71 )
  72 {
  73         struct ldbminfo *li = (struct ldbminfo *) be->be_private;
  74         Entry           *e;
  75         Attribute       *a;
  76         int             rc;
  77         char            *matched;
  78 #ifdef HAVE_KERBEROS
  79         char            krbname[MAX_K_NAME_SZ + 1];
  80         AUTH_DAT        ad;
  81 #endif
  82
  83         Debug(LDAP_DEBUG_ARGS, "==> ldbm_back_bind: dn: %s\n", dn, 0, 0);
  84
  85         *edn = NULL;
  86
  87         /* get entry with reader lock */
  88         if ( (e = dn2entry_r( be, dn, &matched )) == NULL ) {
  89                 /* allow noauth binds */
  90                 rc = 1;
  91                 if ( method == LDAP_AUTH_SIMPLE ) {
  92                         if( cred->bv_len == 0 ) {
  93                                 /* SUCCESS */
  94                                 send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL );
  95
  96                         } else if ( be_isroot_pw( be, dn, cred ) ) {
  97                                 *edn = ch_strdup( be_root_dn( be ) );
  98                                 rc = 0; /* front end will send result */
  99
 100                         } else {
 101                                 send_ldap_result( conn, op,
 102                                         LDAP_NO_SUCH_OBJECT, matched, NULL );
 103                         }
 104
 105                 } else if ( method == LDAP_AUTH_SASL ) {
 106                         if( mech != NULL && strcasecmp(mech,"DIGEST-MD5") == 0 ) {
 107                                 /* insert DIGEST calls here */
 108                                 send_ldap_result( conn, op,
 109                                         LDAP_AUTH_METHOD_NOT_SUPPORTED, NULL, NULL );
 110
 111                         } else {
 112                                 send_ldap_result( conn, op,
 113                                         LDAP_AUTH_METHOD_NOT_SUPPORTED, NULL, NULL );
 114                         }
 115
 116                 } else {
 117                         send_ldap_result( conn, op, LDAP_NO_SUCH_OBJECT, matched, NULL );
 118                 }
 119
 120                 if ( matched != NULL ) {
 121                         free( matched );
 122                 }
 123                 return( rc );
 124         }
 125
 126         *edn = ch_strdup( e->e_dn );
 127
 128         /* check for deleted */
 129
 130         if ( ! access_allowed( be, conn, op, e,
 131                 "entry", NULL, ACL_AUTH ) )
 132         {
 133                 send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS, "", "" );
 134                 rc = 1;
 135                 goto return_results;
 136         }
 137
 138         switch ( method ) {
 139         case LDAP_AUTH_SIMPLE:
 140                 if ( cred->bv_len == 0 ) {
 141                         send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL );
 142
 143                         /* stop front end from sending result */
 144                         rc = 1;
 145                         goto return_results;
 146                 }
 147
 148                 /* check for root dn/passwd */
 149                 if ( be_isroot_pw( be, dn, cred ) ) {
 150                         /* front end will send result */
 151                         if(*edn != NULL) free( *edn );
 152                         *edn = ch_strdup( be_root_dn( be ) );
 153                         rc = 0;
 154                         goto return_results;
 155                 }
 156
 157                 if ( ! access_allowed( be, conn, op, e,
 158                         "userpassword", NULL, ACL_AUTH ) )
 159                 {
 160                         send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS, "", "" );
 161                         rc = 1;
 162                         goto return_results;
 163                 }
 164
 165                 if ( (a = attr_find( e->e_attrs, "userpassword" )) == NULL ) {
 166                         send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
 167                             NULL, NULL );
 168
 169                         /* stop front end from sending result */
 170                         rc = 1;
 171                         goto return_results;
 172                 }
 173
 174                 if ( crypted_value_find( a->a_vals, cred, a->a_syntax, 0, cred ) != 0 )
 175                 {
 176                         send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
 177                                 NULL, NULL );
 178                         /* stop front end from sending result */
 179                         rc = 1;
 180                         goto return_results;
 181                 }
 182
 183                 rc = 0;
 184                 break;
 185
 186 #ifdef HAVE_KERBEROS
 187         case LDAP_AUTH_KRBV41:
 188                 if ( ! access_allowed( be, conn, op, e,
 189                         "krbname", NULL, ACL_AUTH ) )
 190                 {
 191                         send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS, "", "" );
 192                         rc = 1;
 193                         goto return_results;
 194                 }
 195
 196                 if ( krbv4_ldap_auth( be, cred, &ad ) != LDAP_SUCCESS ) {
 197                         send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS,
 198                             NULL, NULL );
 199                         rc = 1;
 200                         goto return_results;
 201                 }
 202
 203                 if ( ! access_allowed( be, conn, op, e,
 204                         "krbname", NULL, ACL_AUTH ) )
 205                 {
 206                         send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS, "", "" );
 207                         rc = 1;
 208                         goto return_results;
 209                 }
 210
 211                 sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "."
 212                     : "", ad.pinst, ad.prealm );
 213
 214
 215                 if ( (a = attr_find( e->e_attrs, "krbname" )) == NULL ) {
 216                         /*
 217                          * no krbName values present:  check against DN
 218                          */
 219                         if ( strcasecmp( dn, krbname ) == 0 ) {
 220                                 rc = 0;
 221                                 break;
 222                         }
 223                         send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH,
 224                             NULL, NULL );
 225                         rc = 1;
 226                         goto return_results;
 227
 228                 } else {        /* look for krbName match */
 229                         struct berval   krbval;
 230
 231                         krbval.bv_val = krbname;
 232                         krbval.bv_len = strlen( krbname );
 233
 234                         if ( value_find( a->a_vals, &krbval, a->a_syntax, 3 ) != 0 ) {
 235                                 send_ldap_result( conn, op,
 236                                     LDAP_INVALID_CREDENTIALS, NULL, NULL );
 237                                 rc = 1;
 238                                 goto return_results;
 239                         }
 240                 }
 241                 rc = 0;
 242                 break;
 243
 244         case LDAP_AUTH_KRBV42:
 245                 send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL );
 246                 /* stop front end from sending result */
 247                 rc = 1;
 248                 goto return_results;
 249 #endif
 250
 251         case LDAP_AUTH_SASL:
 252                 /* insert SASL code here */
 253
 254         default:
 255                 send_ldap_result( conn, op, LDAP_STRONG_AUTH_NOT_SUPPORTED,
 256                     NULL, "auth method not supported" );
 257                 rc = 1;
 258                 goto return_results;
 259         }
 260
 261 return_results:;
 262         /* free entry and reader lock */
 263         cache_return_entry_r( &li->li_cache, e );
 264
 265         /* front end with send result on success (rc==0) */
 266         return( rc );
 267 }
 268