git.sur5r.net Git - openldap/blob - servers/slapd/bind.c

   1 /* bind.c - decode an ldap bind operation and pass it to a backend db */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2007 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/string.h>
  32 #include <ac/socket.h>
  33
  34 #include "slap.h"
  35
  36 int
  37 do_bind(
  38     Operation   *op,
  39     SlapReply   *rs )
  40 {
  41         BerElement *ber = op->o_ber;
  42         ber_int_t version;
  43         ber_tag_t method;
  44         struct berval mech = BER_BVNULL;
  45         struct berval dn = BER_BVNULL;
  46         ber_tag_t tag;
  47         Backend *be = NULL;
  48
  49         Debug( LDAP_DEBUG_TRACE, "do_bind\n", 0, 0, 0 );
  50
  51         /*
  52          * Force to connection to "anonymous" until bind succeeds.
  53          */
  54         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
  55         if ( op->o_conn->c_sasl_bind_in_progress ) {
  56                 be = op->o_conn->c_authz_backend;
  57         }
  58         if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
  59                 /* log authorization identity demotion */
  60                 Statslog( LDAP_DEBUG_STATS,
  61                         "%s BIND anonymous mech=implicit ssf=0\n",
  62                         op->o_log_prefix, 0, 0, 0, 0 );
  63         }
  64         connection2anonymous( op->o_conn );
  65         if ( op->o_conn->c_sasl_bind_in_progress ) {
  66                 op->o_conn->c_authz_backend = be;
  67         }
  68         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
  69         if ( !BER_BVISNULL( &op->o_dn ) ) {
  70                 /* NOTE: temporarily wasting few bytes
  71                  * (until bind is completed), but saving
  72                  * a couple of ch_free() and ch_strdup("") */
  73                 op->o_dn.bv_val[0] = '\0';
  74                 op->o_dn.bv_len = 0;
  75         }
  76         if ( !BER_BVISNULL( &op->o_ndn ) ) {
  77                 op->o_ndn.bv_val[0] = '\0';
  78                 op->o_ndn.bv_len = 0;
  79         }
  80
  81         /*
  82          * Parse the bind request.  It looks like this:
  83          *
  84          *      BindRequest ::= SEQUENCE {
  85          *              version         INTEGER,                 -- version
  86          *              name            DistinguishedName,       -- dn
  87          *              authentication  CHOICE {
  88          *                      simple          [0] OCTET STRING -- passwd
  89          *                      krbv42ldap      [1] OCTET STRING
  90          *                      krbv42dsa       [2] OCTET STRING
  91          *                      SASL            [3] SaslCredentials
  92          *              }
  93          *      }
  94          *
  95          *      SaslCredentials ::= SEQUENCE {
  96          *              mechanism           LDAPString,
  97          *              credentials         OCTET STRING OPTIONAL
  98          *      }
  99          */
 100
 101         tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method );
 102
 103         if ( tag == LBER_ERROR ) {
 104                 Debug( LDAP_DEBUG_ANY, "bind: ber_scanf failed\n", 0, 0, 0 );
 105                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
 106                 rs->sr_err = SLAPD_DISCONNECT;
 107                 goto cleanup;
 108         }
 109
 110         op->o_protocol = version;
 111         op->orb_method = method;
 112
 113         if( op->orb_method != LDAP_AUTH_SASL ) {
 114                 tag = ber_scanf( ber, /*{*/ "m}", &op->orb_cred );
 115
 116         } else {
 117                 tag = ber_scanf( ber, "{m" /*}*/, &mech );
 118
 119                 if ( tag != LBER_ERROR ) {
 120                         ber_len_t len;
 121                         tag = ber_peek_tag( ber, &len );
 122
 123                         if ( tag == LDAP_TAG_LDAPCRED ) {
 124                                 tag = ber_scanf( ber, "m", &op->orb_cred );
 125                         } else {
 126                                 tag = LDAP_TAG_LDAPCRED;
 127                                 BER_BVZERO( &op->orb_cred );
 128                         }
 129
 130                         if ( tag != LBER_ERROR ) {
 131                                 tag = ber_scanf( ber, /*{{*/ "}}" );
 132                         }
 133                 }
 134         }
 135
 136         if ( tag == LBER_ERROR ) {
 137                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
 138                 rs->sr_err = SLAPD_DISCONNECT;
 139                 goto cleanup;
 140         }
 141
 142         if( get_ctrls( op, rs, 1 ) != LDAP_SUCCESS ) {
 143                 Debug( LDAP_DEBUG_ANY, "do_bind: get_ctrls failed\n", 0, 0, 0 );
 144                 goto cleanup;
 145         }
 146
 147         /* We use the tmpmemctx here because it speeds up normalization.
 148          * However, we must dup with regular malloc when storing any
 149          * resulting DNs in the op or conn structures.
 150          */
 151         rs->sr_err = dnPrettyNormal( NULL, &dn, &op->o_req_dn, &op->o_req_ndn,
 152                 op->o_tmpmemctx );
 153         if ( rs->sr_err != LDAP_SUCCESS ) {
 154                 Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n",
 155                         dn.bv_val, 0, 0 );
 156                 send_ldap_error( op, rs, LDAP_INVALID_DN_SYNTAX, "invalid DN" );
 157                 goto cleanup;
 158         }
 159
 160         if( op->orb_method == LDAP_AUTH_SASL ) {
 161                 Debug( LDAP_DEBUG_TRACE, "do_sasl_bind: dn (%s) mech %s\n",
 162                         op->o_req_dn.bv_val, mech.bv_val, NULL );
 163
 164         } else {
 165                 Debug( LDAP_DEBUG_TRACE,
 166                         "do_bind: version=%ld dn=\"%s\" method=%ld\n",
 167                         (unsigned long) version, op->o_req_dn.bv_val,
 168                         (unsigned long) op->orb_method );
 169         }
 170
 171         Statslog( LDAP_DEBUG_STATS, "%s BIND dn=\"%s\" method=%ld\n",
 172             op->o_log_prefix, op->o_req_dn.bv_val,
 173                 (unsigned long) op->orb_method, 0, 0 );
 174
 175         if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) {
 176                 Debug( LDAP_DEBUG_ANY, "do_bind: unknown version=%ld\n",
 177                         (unsigned long) version, 0, 0 );
 178                 send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR,
 179                         "requested protocol version not supported" );
 180                 goto cleanup;
 181
 182         } else if (!( global_allows & SLAP_ALLOW_BIND_V2 ) &&
 183                 version < LDAP_VERSION3 )
 184         {
 185                 send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR,
 186                         "historical protocol version requested, use LDAPv3 instead" );
 187                 goto cleanup;
 188         }
 189
 190         /*
 191          * we set connection version regardless of whether bind succeeds or not.
 192          */
 193         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 194         op->o_conn->c_protocol = version;
 195         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 196
 197         op->orb_tmp_mech = mech;
 198
 199         op->o_bd = frontendDB;
 200         rs->sr_err = frontendDB->be_bind( op, rs );
 201
 202 cleanup:
 203         if ( rs->sr_err == LDAP_SUCCESS ) {
 204                 if ( op->orb_method != LDAP_AUTH_SASL ) {
 205                         ber_dupbv( &op->o_conn->c_authmech, &mech );
 206                 }
 207                 op->o_conn->c_authtype = op->orb_method;
 208         }
 209
 210         if( !BER_BVISNULL( &op->o_req_dn ) ) {
 211                 slap_sl_free( op->o_req_dn.bv_val, op->o_tmpmemctx );
 212                 BER_BVZERO( &op->o_req_dn );
 213         }
 214         if( !BER_BVISNULL( &op->o_req_ndn ) ) {
 215                 slap_sl_free( op->o_req_ndn.bv_val, op->o_tmpmemctx );
 216                 BER_BVZERO( &op->o_req_ndn );
 217         }
 218
 219         return rs->sr_err;
 220 }
 221
 222 int
 223 fe_op_bind( Operation *op, SlapReply *rs )
 224 {
 225         struct berval   mech = op->orb_tmp_mech;
 226         BackendDB       *bd = op->o_bd;
 227
 228         /* check for inappropriate controls */
 229         if( get_manageDSAit( op ) == SLAP_CONTROL_CRITICAL ) {
 230                 send_ldap_error( op, rs,
 231                         LDAP_UNAVAILABLE_CRITICAL_EXTENSION,
 232                         "manageDSAit control inappropriate" );
 233                 goto cleanup;
 234         }
 235
 236         if ( op->orb_method == LDAP_AUTH_SASL ) {
 237                 if ( op->o_protocol < LDAP_VERSION3 ) {
 238                         Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n",
 239                                 (unsigned long)op->o_protocol, 0, 0 );
 240                         send_ldap_discon( op, rs,
 241                                 LDAP_PROTOCOL_ERROR, "SASL bind requires LDAPv3" );
 242                         rs->sr_err = SLAPD_DISCONNECT;
 243                         goto cleanup;
 244                 }
 245
 246                 if( BER_BVISNULL( &mech ) || BER_BVISEMPTY( &mech ) ) {
 247                         Debug( LDAP_DEBUG_ANY,
 248                                 "do_bind: no sasl mechanism provided\n",
 249                                 0, 0, 0 );
 250                         send_ldap_error( op, rs, LDAP_AUTH_METHOD_NOT_SUPPORTED,
 251                                 "no SASL mechanism provided" );
 252                         goto cleanup;
 253                 }
 254
 255                 /* check restrictions */
 256                 if( backend_check_restrictions( op, rs, &mech ) != LDAP_SUCCESS ) {
 257                         send_ldap_result( op, rs );
 258                         goto cleanup;
 259                 }
 260
 261                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 262                 if ( op->o_conn->c_sasl_bind_in_progress ) {
 263                         if( !bvmatch( &op->o_conn->c_sasl_bind_mech, &mech ) ) {
 264                                 /* mechanism changed between bind steps */
 265                                 slap_sasl_reset(op->o_conn);
 266                         }
 267                 } else {
 268                         ber_dupbv(&op->o_conn->c_sasl_bind_mech, &mech);
 269                 }
 270
 271                 /* Set the bindop for the benefit of in-directory SASL lookups */
 272                 op->o_conn->c_sasl_bindop = op;
 273
 274                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 275
 276                 rs->sr_err = slap_sasl_bind( op, rs );
 277
 278                 goto cleanup;
 279
 280         } else {
 281                 /* Not SASL, cancel any in-progress bind */
 282                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 283
 284                 if ( !BER_BVISNULL( &op->o_conn->c_sasl_bind_mech ) ) {
 285                         free( op->o_conn->c_sasl_bind_mech.bv_val );
 286                         BER_BVZERO( &op->o_conn->c_sasl_bind_mech );
 287                 }
 288                 op->o_conn->c_sasl_bind_in_progress = 0;
 289
 290                 slap_sasl_reset( op->o_conn );
 291                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 292         }
 293
 294         if ( op->orb_method == LDAP_AUTH_SIMPLE ) {
 295                 BER_BVSTR( &mech, "SIMPLE" );
 296                 /* accept "anonymous" binds */
 297                 if ( BER_BVISEMPTY( &op->orb_cred ) || BER_BVISEMPTY( &op->o_req_ndn ) ) {
 298                         rs->sr_err = LDAP_SUCCESS;
 299
 300                         if( !BER_BVISEMPTY( &op->orb_cred ) &&
 301                                 !( global_allows & SLAP_ALLOW_BIND_ANON_CRED ))
 302                         {
 303                                 /* cred is not empty, disallow */
 304                                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
 305
 306                         } else if ( !BER_BVISEMPTY( &op->o_req_ndn ) &&
 307                                 !( global_allows & SLAP_ALLOW_BIND_ANON_DN ))
 308                         {
 309                                 /* DN is not empty, disallow */
 310                                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 311                                 rs->sr_text =
 312                                         "unauthenticated bind (DN with no password) disallowed";
 313
 314                         } else if ( global_disallows & SLAP_DISALLOW_BIND_ANON ) {
 315                                 /* disallow */
 316                                 rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
 317                                 rs->sr_text = "anonymous bind disallowed";
 318
 319                         } else {
 320                                 backend_check_restrictions( op, rs, &mech );
 321                         }
 322
 323                         /*
 324                          * we already forced connection to "anonymous",
 325                          * just need to send success
 326                          */
 327                         send_ldap_result( op, rs );
 328                         Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n",
 329                                 op->o_protocol, 0, 0 );
 330                         goto cleanup;
 331
 332                 } else if ( global_disallows & SLAP_DISALLOW_BIND_SIMPLE ) {
 333                         /* disallow simple authentication */
 334                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 335                         rs->sr_text = "unwilling to perform simple authentication";
 336
 337                         send_ldap_result( op, rs );
 338                         Debug( LDAP_DEBUG_TRACE,
 339                                 "do_bind: v%d simple bind(%s) disallowed\n",
 340                                 op->o_protocol, op->o_req_ndn.bv_val, 0 );
 341                         goto cleanup;
 342                 }
 343
 344 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 345         } else if ( op->orb_method == LDAP_AUTH_KRBV41 ) {
 346                 if ( global_disallows & SLAP_DISALLOW_BIND_KRBV4 ) {
 347                         /* disallow krbv4 authentication */
 348                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 349                         rs->sr_text = "unwilling to perform Kerberos V4 bind";
 350
 351                         send_ldap_result( op, rs );
 352
 353                         Debug( LDAP_DEBUG_TRACE,
 354                                 "do_bind: v%d Kerberos V4 (step 1) bind refused\n",
 355                                 op->o_protocol, 0, 0 );
 356                         goto cleanup;
 357                 }
 358                 BER_BVSTR( &mech, "KRBV4" );
 359
 360         } else if ( op->orb_method == LDAP_AUTH_KRBV42 ) {
 361                 rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 362                 rs->sr_text = "Kerberos V4 (step 2) bind not supported";
 363                 send_ldap_result( op, rs );
 364
 365                 Debug( LDAP_DEBUG_TRACE,
 366                         "do_bind: v%d Kerberos V4 (step 2) bind refused\n",
 367                         op->o_protocol, 0, 0 );
 368                 goto cleanup;
 369 #endif
 370
 371         } else {
 372                 rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 373                 rs->sr_text = "unknown authentication method";
 374
 375                 send_ldap_result( op, rs );
 376                 Debug( LDAP_DEBUG_TRACE,
 377                         "do_bind: v%d unknown authentication method (%d)\n",
 378                         op->o_protocol, op->orb_method, 0 );
 379                 goto cleanup;
 380         }
 381
 382         /*
 383          * We could be serving multiple database backends.  Select the
 384          * appropriate one.  If none, return invalid cred, not a referral.
 385          */
 386
 387         if ( (op->o_bd = select_backend( &op->o_req_ndn, 0, 0 )) == NULL ) {
 388                 /* don't return referral for bind requests */
 389                 /* noSuchObject is not allowed to be returned by bind */
 390                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
 391                 op->o_bd = bd;
 392                 send_ldap_result( op, rs );
 393                 goto cleanup;
 394         }
 395
 396         /* check restrictions */
 397         if( backend_check_restrictions( op, rs, NULL ) != LDAP_SUCCESS ) {
 398                 send_ldap_result( op, rs );
 399                 goto cleanup;
 400         }
 401
 402         if( op->o_bd->be_bind ) {
 403                 op->o_conn->c_authz_cookie = NULL;
 404
 405                 rs->sr_err = (op->o_bd->be_bind)( op, rs );
 406
 407                 if ( rs->sr_err == 0 ) {
 408                         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 409
 410                         if( op->o_conn->c_authz_backend == NULL ) {
 411                                 op->o_conn->c_authz_backend = op->o_bd;
 412                         }
 413
 414                         /* be_bind returns regular/global edn */
 415                         if( !BER_BVISEMPTY( &op->orb_edn ) ) {
 416                                 op->o_conn->c_dn = op->orb_edn;
 417                         } else {
 418                                 ber_dupbv(&op->o_conn->c_dn, &op->o_req_dn);
 419                         }
 420
 421                         ber_dupbv( &op->o_conn->c_ndn, &op->o_req_ndn );
 422
 423                         if( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
 424                                 ber_len_t max = sockbuf_max_incoming_auth;
 425                                 ber_sockbuf_ctrl( op->o_conn->c_sb,
 426                                         LBER_SB_OPT_SET_MAX_INCOMING, &max );
 427                         }
 428
 429                         /* log authorization identity */
 430                         Statslog( LDAP_DEBUG_STATS,
 431                                 "%s BIND dn=\"%s\" mech=%s ssf=0\n",
 432                                 op->o_log_prefix,
 433                                 op->o_conn->c_dn.bv_val, mech.bv_val, 0, 0 );
 434
 435                         Debug( LDAP_DEBUG_TRACE,
 436                                 "do_bind: v%d bind: \"%s\" to \"%s\"\n",
 437                                 op->o_protocol, op->o_req_dn.bv_val, op->o_conn->c_dn.bv_val );
 438
 439                         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 440
 441                         /* send this here to avoid a race condition */
 442                         send_ldap_result( op, rs );
 443
 444                 } else if ( !BER_BVISNULL( &op->orb_edn ) ) {
 445                         free( op->orb_edn.bv_val );
 446                         BER_BVZERO( &op->orb_edn );
 447                 }
 448
 449         } else {
 450                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 451                         "operation not supported within naming context" );
 452         }
 453
 454 cleanup:;
 455         op->o_bd = bd;
 456         return rs->sr_err;
 457 }
 458