git.sur5r.net Git - openldap/blob - servers/slapd/bind.c

   1 /* bind.c - decode an ldap bind operation and pass it to a backend db */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2005 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/string.h>
  32 #include <ac/socket.h>
  33
  34 #include "slap.h"
  35
  36 int
  37 do_bind(
  38     Operation   *op,
  39     SlapReply   *rs )
  40 {
  41         BerElement *ber = op->o_ber;
  42         ber_int_t version;
  43         ber_tag_t method;
  44         struct berval mech = BER_BVNULL;
  45         struct berval dn = BER_BVNULL;
  46         ber_tag_t tag;
  47         Backend *be = NULL;
  48
  49         Debug( LDAP_DEBUG_TRACE, "do_bind\n", 0, 0, 0 );
  50
  51         /*
  52          * Force to connection to "anonymous" until bind succeeds.
  53          */
  54         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
  55         if ( op->o_conn->c_sasl_bind_in_progress ) {
  56                 be = op->o_conn->c_authz_backend;
  57         }
  58         if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
  59                 /* log authorization identity demotion */
  60                 Statslog( LDAP_DEBUG_STATS,
  61                         "%s BIND anonymous mech=implicit ssf=0\n",
  62                         op->o_log_prefix, 0, 0, 0, 0 );
  63         }
  64         connection2anonymous( op->o_conn );
  65         if ( op->o_conn->c_sasl_bind_in_progress ) {
  66                 op->o_conn->c_authz_backend = be;
  67         }
  68         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
  69         if ( !BER_BVISNULL( &op->o_dn ) ) {
  70                 /* NOTE: temporarily wasting few bytes
  71                  * (until bind is completed), but saving
  72                  * a couple of ch_free() and ch_strdup("") */
  73                 op->o_dn.bv_val[0] = '\0';
  74                 op->o_dn.bv_len = 0;
  75         }
  76         if ( !BER_BVISNULL( &op->o_ndn ) ) {
  77                 op->o_ndn.bv_val[0] = '\0';
  78                 op->o_ndn.bv_len = 0;
  79         }
  80
  81         /*
  82          * Parse the bind request.  It looks like this:
  83          *
  84          *      BindRequest ::= SEQUENCE {
  85          *              version         INTEGER,                 -- version
  86          *              name            DistinguishedName,       -- dn
  87          *              authentication  CHOICE {
  88          *                      simple          [0] OCTET STRING -- passwd
  89          *                      krbv42ldap      [1] OCTET STRING
  90          *                      krbv42dsa       [2] OCTET STRING
  91          *                      SASL            [3] SaslCredentials
  92          *              }
  93          *      }
  94          *
  95          *      SaslCredentials ::= SEQUENCE {
  96          *              mechanism           LDAPString,
  97          *              credentials         OCTET STRING OPTIONAL
  98          *      }
  99          */
 100
 101         tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method );
 102
 103         if ( tag == LBER_ERROR ) {
 104                 Debug( LDAP_DEBUG_ANY, "bind: ber_scanf failed\n", 0, 0, 0 );
 105                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
 106                 rs->sr_err = SLAPD_DISCONNECT;
 107                 goto cleanup;
 108         }
 109
 110         op->o_protocol = version;
 111         op->orb_method = method;
 112
 113         if( op->orb_method != LDAP_AUTH_SASL ) {
 114                 tag = ber_scanf( ber, /*{*/ "m}", &op->orb_cred );
 115
 116         } else {
 117                 tag = ber_scanf( ber, "{m" /*}*/, &mech );
 118
 119                 if ( tag != LBER_ERROR ) {
 120                         ber_len_t len;
 121                         tag = ber_peek_tag( ber, &len );
 122
 123                         if ( tag == LDAP_TAG_LDAPCRED ) {
 124                                 tag = ber_scanf( ber, "m", &op->orb_cred );
 125                         } else {
 126                                 tag = LDAP_TAG_LDAPCRED;
 127                                 BER_BVZERO( &op->orb_cred );
 128                         }
 129
 130                         if ( tag != LBER_ERROR ) {
 131                                 tag = ber_scanf( ber, /*{{*/ "}}" );
 132                         }
 133                 }
 134         }
 135
 136         if ( tag == LBER_ERROR ) {
 137                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
 138                 rs->sr_err = SLAPD_DISCONNECT;
 139                 goto cleanup;
 140         }
 141
 142         if( get_ctrls( op, rs, 1 ) != LDAP_SUCCESS ) {
 143                 Debug( LDAP_DEBUG_ANY, "do_bind: get_ctrls failed\n", 0, 0, 0 );
 144                 goto cleanup;
 145         }
 146
 147         /* We use the tmpmemctx here because it speeds up normalization.
 148          * However, we must dup with regular malloc when storing any
 149          * resulting DNs in the op or conn structures.
 150          */
 151         rs->sr_err = dnPrettyNormal( NULL, &dn, &op->o_req_dn, &op->o_req_ndn,
 152                 op->o_tmpmemctx );
 153         if ( rs->sr_err != LDAP_SUCCESS ) {
 154                 Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n",
 155                         dn.bv_val, 0, 0 );
 156                 send_ldap_error( op, rs, LDAP_INVALID_DN_SYNTAX, "invalid DN" );
 157                 goto cleanup;
 158         }
 159
 160         if( op->orb_method == LDAP_AUTH_SASL ) {
 161                 Debug( LDAP_DEBUG_TRACE, "do_sasl_bind: dn (%s) mech %s\n",
 162                         op->o_req_dn.bv_val, mech.bv_val, NULL );
 163
 164         } else {
 165                 Debug( LDAP_DEBUG_TRACE,
 166                         "do_bind: version=%ld dn=\"%s\" method=%ld\n",
 167                         (unsigned long) version, op->o_req_dn.bv_val,
 168                         (unsigned long) op->orb_method );
 169         }
 170
 171         Statslog( LDAP_DEBUG_STATS, "%s BIND dn=\"%s\" method=%ld\n",
 172             op->o_log_prefix, op->o_req_dn.bv_val,
 173                 (unsigned long) op->orb_method, 0, 0 );
 174
 175         if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) {
 176                 Debug( LDAP_DEBUG_ANY, "do_bind: unknown version=%ld\n",
 177                         (unsigned long) version, 0, 0 );
 178                 send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR,
 179                         "requested protocol version not supported" );
 180                 goto cleanup;
 181
 182         } else if (!( global_allows & SLAP_ALLOW_BIND_V2 ) &&
 183                 version < LDAP_VERSION3 )
 184         {
 185                 send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR,
 186                         "historical protocol version requested, use LDAPv3 instead" );
 187                 goto cleanup;
 188         }
 189
 190         /*
 191          * we set connection version regardless of whether bind succeeds or not.
 192          */
 193         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 194         op->o_conn->c_protocol = version;
 195         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 196
 197         op->orb_tmp_mech = mech;
 198
 199         op->o_bd = frontendDB;
 200         rs->sr_err = frontendDB->be_bind( op, rs );
 201
 202 cleanup:
 203         if ( rs->sr_err == LDAP_SUCCESS ) {
 204                 if ( op->orb_method != LDAP_AUTH_SASL ) {
 205                         ber_dupbv( &op->o_conn->c_authmech, &mech );
 206                 }
 207                 op->o_conn->c_authtype = op->orb_method;
 208         }
 209
 210         if( !BER_BVISNULL( &op->o_req_dn ) ) {
 211                 slap_sl_free( op->o_req_dn.bv_val, op->o_tmpmemctx );
 212                 BER_BVZERO( &op->o_req_dn );
 213         }
 214         if( !BER_BVISNULL( &op->o_req_ndn ) ) {
 215                 slap_sl_free( op->o_req_ndn.bv_val, op->o_tmpmemctx );
 216                 BER_BVZERO( &op->o_req_ndn );
 217         }
 218
 219         return rs->sr_err;
 220 }
 221
 222 int
 223 fe_op_bind( Operation *op, SlapReply *rs )
 224 {
 225         struct berval   mech = op->orb_tmp_mech;
 226
 227         /* check for inappropriate controls */
 228         if( get_manageDSAit( op ) == SLAP_CONTROL_CRITICAL ) {
 229                 send_ldap_error( op, rs,
 230                         LDAP_UNAVAILABLE_CRITICAL_EXTENSION,
 231                         "manageDSAit control inappropriate" );
 232                 goto cleanup;
 233         }
 234
 235         /* Set the bindop for the benefit of in-directory SASL lookups */
 236         op->o_conn->c_sasl_bindop = op;
 237
 238         if ( op->orb_method == LDAP_AUTH_SASL ) {
 239                 if ( op->o_protocol < LDAP_VERSION3 ) {
 240                         Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n",
 241                                 (unsigned long)op->o_protocol, 0, 0 );
 242                         send_ldap_discon( op, rs,
 243                                 LDAP_PROTOCOL_ERROR, "SASL bind requires LDAPv3" );
 244                         rs->sr_err = SLAPD_DISCONNECT;
 245                         goto cleanup;
 246                 }
 247
 248                 if( BER_BVISNULL( &mech ) || BER_BVISEMPTY( &mech ) ) {
 249                         Debug( LDAP_DEBUG_ANY,
 250                                 "do_bind: no sasl mechanism provided\n",
 251                                 0, 0, 0 );
 252                         send_ldap_error( op, rs, LDAP_AUTH_METHOD_NOT_SUPPORTED,
 253                                 "no SASL mechanism provided" );
 254                         goto cleanup;
 255                 }
 256
 257                 /* check restrictions */
 258                 if( backend_check_restrictions( op, rs, &mech ) != LDAP_SUCCESS ) {
 259                         send_ldap_result( op, rs );
 260                         goto cleanup;
 261                 }
 262
 263                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 264                 if ( op->o_conn->c_sasl_bind_in_progress ) {
 265                         if( !bvmatch( &op->o_conn->c_sasl_bind_mech, &mech ) ) {
 266                                 /* mechanism changed between bind steps */
 267                                 slap_sasl_reset(op->o_conn);
 268                         }
 269                 } else {
 270                         ber_dupbv(&op->o_conn->c_sasl_bind_mech, &mech);
 271                 }
 272                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 273
 274                 rs->sr_err = slap_sasl_bind( op, rs );
 275
 276                 goto cleanup;
 277
 278         } else {
 279                 /* Not SASL, cancel any in-progress bind */
 280                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 281
 282                 if ( !BER_BVISNULL( &op->o_conn->c_sasl_bind_mech ) ) {
 283                         free( op->o_conn->c_sasl_bind_mech.bv_val );
 284                         BER_BVZERO( &op->o_conn->c_sasl_bind_mech );
 285                 }
 286                 op->o_conn->c_sasl_bind_in_progress = 0;
 287
 288                 slap_sasl_reset( op->o_conn );
 289                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 290         }
 291
 292         if ( op->orb_method == LDAP_AUTH_SIMPLE ) {
 293                 BER_BVSTR( &mech, "SIMPLE" );
 294                 /* accept "anonymous" binds */
 295                 if ( BER_BVISEMPTY( &op->orb_cred ) || BER_BVISEMPTY( &op->o_req_ndn ) ) {
 296                         rs->sr_err = LDAP_SUCCESS;
 297
 298                         if( !BER_BVISEMPTY( &op->orb_cred ) &&
 299                                 !( global_allows & SLAP_ALLOW_BIND_ANON_CRED ))
 300                         {
 301                                 /* cred is not empty, disallow */
 302                                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
 303
 304                         } else if ( !BER_BVISEMPTY( &op->o_req_ndn ) &&
 305                                 !( global_allows & SLAP_ALLOW_BIND_ANON_DN ))
 306                         {
 307                                 /* DN is not empty, disallow */
 308                                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 309                                 rs->sr_text =
 310                                         "unauthenticated bind (DN with no password) disallowed";
 311
 312                         } else if ( global_disallows & SLAP_DISALLOW_BIND_ANON ) {
 313                                 /* disallow */
 314                                 rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
 315                                 rs->sr_text = "anonymous bind disallowed";
 316
 317                         } else {
 318                                 backend_check_restrictions( op, rs, &mech );
 319                         }
 320
 321                         /*
 322                          * we already forced connection to "anonymous",
 323                          * just need to send success
 324                          */
 325                         send_ldap_result( op, rs );
 326                         Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n",
 327                                 op->o_protocol, 0, 0 );
 328                         goto cleanup;
 329
 330                 } else if ( global_disallows & SLAP_DISALLOW_BIND_SIMPLE ) {
 331                         /* disallow simple authentication */
 332                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 333                         rs->sr_text = "unwilling to perform simple authentication";
 334
 335                         send_ldap_result( op, rs );
 336                         Debug( LDAP_DEBUG_TRACE,
 337                                 "do_bind: v%d simple bind(%s) disallowed\n",
 338                                 op->o_protocol, op->o_req_ndn.bv_val, 0 );
 339                         goto cleanup;
 340                 }
 341
 342 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 343         } else if ( op->orb_method == LDAP_AUTH_KRBV41 ) {
 344                 if ( global_disallows & SLAP_DISALLOW_BIND_KRBV4 ) {
 345                         /* disallow krbv4 authentication */
 346                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 347                         rs->sr_text = "unwilling to perform Kerberos V4 bind";
 348
 349                         send_ldap_result( op, rs );
 350
 351                         Debug( LDAP_DEBUG_TRACE,
 352                                 "do_bind: v%d Kerberos V4 (step 1) bind refused\n",
 353                                 op->o_protocol, 0, 0 );
 354                         goto cleanup;
 355                 }
 356                 BER_BVSTR( &mech, "KRBV4" );
 357
 358         } else if ( op->orb_method == LDAP_AUTH_KRBV42 ) {
 359                 rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 360                 rs->sr_text = "Kerberos V4 (step 2) bind not supported";
 361                 send_ldap_result( op, rs );
 362
 363                 Debug( LDAP_DEBUG_TRACE,
 364                         "do_bind: v%d Kerberos V4 (step 2) bind refused\n",
 365                         op->o_protocol, 0, 0 );
 366                 goto cleanup;
 367 #endif
 368
 369         } else {
 370                 rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 371                 rs->sr_text = "unknown authentication method";
 372
 373                 send_ldap_result( op, rs );
 374                 Debug( LDAP_DEBUG_TRACE,
 375                         "do_bind: v%d unknown authentication method (%d)\n",
 376                         op->o_protocol, op->orb_method, 0 );
 377                 goto cleanup;
 378         }
 379
 380         /*
 381          * We could be serving multiple database backends.  Select the
 382          * appropriate one, or send a referral to our "referral server"
 383          * if we don't hold it.
 384          */
 385
 386         if ( (op->o_bd = select_backend( &op->o_req_ndn, 0, 0 )) == NULL ) {
 387                 /* don't return referral for bind requests */
 388                 /* noSuchObject is not allowed to be returned by bind */
 389                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
 390                 op->o_bd = frontendDB;
 391                 send_ldap_result( op, rs );
 392                 op->o_bd = NULL;
 393                 goto cleanup;
 394         }
 395
 396         /* check restrictions */
 397         if( backend_check_restrictions( op, rs, NULL ) != LDAP_SUCCESS ) {
 398                 send_ldap_result( op, rs );
 399                 goto cleanup;
 400         }
 401
 402         if( op->o_bd->be_bind ) {
 403                 op->o_conn->c_authz_cookie = NULL;
 404
 405                 rs->sr_err = (op->o_bd->be_bind)( op, rs );
 406
 407                 if ( rs->sr_err == 0 ) {
 408                         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 409
 410                         if( op->o_conn->c_authz_backend == NULL ) {
 411                                 op->o_conn->c_authz_backend = op->o_bd;
 412                         }
 413
 414                         /* be_bind returns regular/global edn */
 415                         if( !BER_BVISEMPTY( &op->orb_edn ) ) {
 416                                 op->o_conn->c_dn = op->orb_edn;
 417                         } else {
 418                                 ber_dupbv(&op->o_conn->c_dn, &op->o_req_dn);
 419                         }
 420
 421                         ber_dupbv( &op->o_conn->c_ndn, &op->o_req_ndn );
 422
 423                         if( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
 424                                 ber_len_t max = sockbuf_max_incoming_auth;
 425                                 ber_sockbuf_ctrl( op->o_conn->c_sb,
 426                                         LBER_SB_OPT_SET_MAX_INCOMING, &max );
 427                         }
 428
 429                         /* log authorization identity */
 430                         Statslog( LDAP_DEBUG_STATS,
 431                                 "%s BIND dn=\"%s\" mech=%s ssf=0\n",
 432                                 op->o_log_prefix,
 433                                 op->o_conn->c_dn.bv_val, mech.bv_val, 0, 0 );
 434
 435                         Debug( LDAP_DEBUG_TRACE,
 436                                 "do_bind: v%d bind: \"%s\" to \"%s\"\n",
 437                                 op->o_protocol, op->o_req_dn.bv_val, op->o_conn->c_dn.bv_val );
 438
 439                         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 440
 441                         /* send this here to avoid a race condition */
 442                         send_ldap_result( op, rs );
 443
 444                 } else if ( !BER_BVISNULL( &op->orb_edn ) ) {
 445                         free( op->orb_edn.bv_val );
 446                         BER_BVZERO( &op->orb_edn );
 447                 }
 448
 449         } else {
 450                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 451                         "operation not supported within naming context" );
 452         }
 453
 454 cleanup:;
 455         return rs->sr_err;
 456 }
 457