1 /* bind.c - decode an ldap bind operation and pass it to a backend db */
4 * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved.
5 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
9 * Copyright (c) 1995 Regents of the University of Michigan.
10 * All rights reserved.
12 * Redistribution and use in source and binary forms are permitted
13 * provided that this notice is preserved and that due credit is given
14 * to the University of Michigan at Ann Arbor. The name of the University
15 * may not be used to endorse or promote products derived from this
16 * software without specific prior written permission. This software
17 * is provided ``as is'' without express or implied warranty.
21 #include "slapi_common.h"
25 #include <ac/string.h>
26 #include <ac/socket.h>
38 BerElement *ber = op->o_ber;
41 struct berval mech = { 0, NULL };
42 struct berval dn = { 0, NULL };
43 struct berval pdn = { 0, NULL };
44 struct berval ndn = { 0, NULL };
45 struct berval edn = { 0, NULL };
47 int rc = LDAP_SUCCESS;
49 struct berval cred = { 0, NULL };
52 Slapi_PBlock *pb = op->o_pb;
55 LDAP_LOG( OPERATION, ENTRY, "do_bind: conn %d\n", conn->c_connid, 0, 0 );
57 Debug( LDAP_DEBUG_TRACE, "do_bind\n", 0, 0, 0 );
61 * Force to connection to "anonymous" until bind succeeds.
63 ldap_pvt_thread_mutex_lock( &conn->c_mutex );
64 if ( conn->c_sasl_bind_in_progress ) be = conn->c_authz_backend;
66 /* log authorization identity demotion */
67 if ( conn->c_dn.bv_len ) {
68 Statslog( LDAP_DEBUG_STATS,
69 "conn=%lu op=%lu AUTHZ anonymous mech=implicit ssf=0",
70 op->o_connid, op->o_opid, 0, 0, 0 );
73 connection2anonymous( conn );
74 if ( conn->c_sasl_bind_in_progress ) conn->c_authz_backend = be;
75 ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
77 if ( op->o_dn.bv_val != NULL ) {
78 free( op->o_dn.bv_val );
79 op->o_dn.bv_val = ch_strdup( "" );
83 if ( op->o_ndn.bv_val != NULL ) {
84 free( op->o_ndn.bv_val );
85 op->o_ndn.bv_val = ch_strdup( "" );
90 * Parse the bind request. It looks like this:
92 * BindRequest ::= SEQUENCE {
93 * version INTEGER, -- version
94 * name DistinguishedName, -- dn
95 * authentication CHOICE {
96 * simple [0] OCTET STRING -- passwd
97 * krbv42ldap [1] OCTET STRING
98 * krbv42dsa [2] OCTET STRING
99 * SASL [3] SaslCredentials
103 * SaslCredentials ::= SEQUENCE {
104 * mechanism LDAPString,
105 * credentials OCTET STRING OPTIONAL
109 tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method );
111 if ( tag == LBER_ERROR ) {
113 LDAP_LOG( OPERATION, ERR,
114 "do_bind: conn %d ber_scanf failed\n", conn->c_connid, 0, 0 );
116 Debug( LDAP_DEBUG_ANY, "bind: ber_scanf failed\n", 0, 0, 0 );
118 send_ldap_disconnect( conn, op,
119 LDAP_PROTOCOL_ERROR, "decoding error" );
124 op->o_protocol = version;
126 if( method != LDAP_AUTH_SASL ) {
127 tag = ber_scanf( ber, /*{*/ "m}", &cred );
130 tag = ber_scanf( ber, "{o" /*}*/, &mech );
132 if ( tag != LBER_ERROR ) {
134 tag = ber_peek_tag( ber, &len );
136 if ( tag == LDAP_TAG_LDAPCRED ) {
137 tag = ber_scanf( ber, "m", &cred );
139 tag = LDAP_TAG_LDAPCRED;
144 if ( tag != LBER_ERROR ) {
145 tag = ber_scanf( ber, /*{{*/ "}}" );
150 if ( tag == LBER_ERROR ) {
151 send_ldap_disconnect( conn, op,
154 rc = SLAPD_DISCONNECT;
158 if( (rc = get_ctrls( conn, op, 1 )) != LDAP_SUCCESS ) {
160 LDAP_LOG( OPERATION, INFO,
161 "do_bind: conn %d get_ctrls failed\n", conn->c_connid, 0, 0 );
163 Debug( LDAP_DEBUG_ANY, "do_bind: get_ctrls failed\n", 0, 0, 0 );
168 rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn );
169 if ( rc != LDAP_SUCCESS ) {
171 LDAP_LOG( OPERATION, INFO,
172 "do_bind: conn %d invalid dn (%s)\n",
173 conn->c_connid, dn.bv_val, 0 );
175 Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n",
178 send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL,
179 "invalid DN", NULL, NULL );
183 if( method == LDAP_AUTH_SASL ) {
185 LDAP_LOG( OPERATION, DETAIL1,
186 "do_sasl_bind: conn %d dn (%s) mech %s\n",
187 conn->c_connid, pdn.bv_val, mech.bv_val );
189 Debug( LDAP_DEBUG_TRACE, "do_sasl_bind: dn (%s) mech %s\n",
190 pdn.bv_val, mech.bv_val, NULL );
195 LDAP_LOG( OPERATION, DETAIL1,
196 "do_bind: version=%ld dn=\"%s\" method=%ld\n",
197 (unsigned long) version, pdn.bv_val, (unsigned long)method );
199 Debug( LDAP_DEBUG_TRACE,
200 "do_bind: version=%ld dn=\"%s\" method=%ld\n",
201 (unsigned long) version,
202 pdn.bv_val, (unsigned long) method );
206 Statslog( LDAP_DEBUG_STATS, "conn=%lu op=%lu BIND dn=\"%s\" method=%ld\n",
207 op->o_connid, op->o_opid, pdn.bv_val, (unsigned long) method, 0 );
209 if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) {
211 LDAP_LOG( OPERATION, INFO,
212 "do_bind: conn %d unknown version = %ld\n",
213 conn->c_connid, (unsigned long)version, 0 );
215 Debug( LDAP_DEBUG_ANY, "do_bind: unknown version=%ld\n",
216 (unsigned long) version, 0, 0 );
218 send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR,
219 NULL, "requested protocol version not supported", NULL, NULL );
222 } else if (!( global_allows & SLAP_ALLOW_BIND_V2 ) &&
223 version < LDAP_VERSION3 )
225 send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR,
226 NULL, "requested protocol version not allowed", NULL, NULL );
230 /* we set connection version regardless of whether bind succeeds
233 ldap_pvt_thread_mutex_lock( &conn->c_mutex );
234 conn->c_protocol = version;
235 ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
237 /* check for inappropriate controls */
238 if( get_manageDSAit( op ) == SLAP_CRITICAL_CONTROL ) {
239 send_ldap_result( conn, op,
240 rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION,
241 NULL, "manageDSAit control inappropriate",
246 /* Set the bindop for the benefit of in-directory SASL lookups */
247 conn->c_sasl_bindop = op;
249 if ( method == LDAP_AUTH_SASL ) {
252 if ( version < LDAP_VERSION3 ) {
254 LDAP_LOG( OPERATION, INFO,
255 "do_bind: conn %d sasl with LDAPv%ld\n",
256 conn->c_connid, (unsigned long)version , 0 );
258 Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n",
259 (unsigned long) version, 0, 0 );
261 send_ldap_disconnect( conn, op,
262 LDAP_PROTOCOL_ERROR, "SASL bind requires LDAPv3" );
263 rc = SLAPD_DISCONNECT;
267 if( mech.bv_len == 0 ) {
269 LDAP_LOG( OPERATION, INFO,
270 "do_bind: conn %d no SASL mechanism provided\n",
271 conn->c_connid, 0, 0 );
273 Debug( LDAP_DEBUG_ANY,
274 "do_bind: no sasl mechanism provided\n",
277 send_ldap_result( conn, op, rc = LDAP_AUTH_METHOD_NOT_SUPPORTED,
278 NULL, "no SASL mechanism provided", NULL, NULL );
282 /* check restrictions */
283 rc = backend_check_restrictions( NULL, conn, op, &mech, &text );
284 if( rc != LDAP_SUCCESS ) {
285 send_ldap_result( conn, op, rc,
286 NULL, text, NULL, NULL );
290 ldap_pvt_thread_mutex_lock( &conn->c_mutex );
291 if ( conn->c_sasl_bind_in_progress ) {
292 if( !bvmatch( &conn->c_sasl_bind_mech, &mech ) ) {
293 /* mechanism changed between bind steps */
294 slap_sasl_reset(conn);
297 conn->c_sasl_bind_mech = mech;
301 ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
303 rc = slap_sasl_bind( conn, op,
307 ldap_pvt_thread_mutex_lock( &conn->c_mutex );
308 if( rc == LDAP_SUCCESS ) {
310 if( edn.bv_len != 0 ) {
311 /* edn is always normalized already */
312 ber_dupbv( &conn->c_ndn, &conn->c_dn );
314 conn->c_authmech = conn->c_sasl_bind_mech;
315 conn->c_sasl_bind_mech.bv_val = NULL;
316 conn->c_sasl_bind_mech.bv_len = 0;
317 conn->c_sasl_bind_in_progress = 0;
319 conn->c_sasl_ssf = ssf;
320 if( ssf > conn->c_ssf ) {
324 if( conn->c_dn.bv_len != 0 ) {
325 ber_len_t max = sockbuf_max_incoming_auth;
326 ber_sockbuf_ctrl( conn->c_sb,
327 LBER_SB_OPT_SET_MAX_INCOMING, &max );
330 /* log authorization identity */
331 Statslog( LDAP_DEBUG_STATS,
332 "conn=%lu op=%lu AUTHZ dn=\"%s\" mech=%s ssf=%d\n",
333 op->o_connid, op->o_opid,
334 conn->c_dn.bv_val, conn->c_authmech.bv_val, ssf );
337 LDAP_LOG( OPERATION, DETAIL1,
338 "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n",
339 conn->c_authmech.bv_val, conn->c_dn.bv_val, ssf );
341 Debug( LDAP_DEBUG_TRACE,
342 "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n",
343 conn->c_authmech.bv_val, conn->c_dn.bv_val, ssf );
346 } else if ( rc == LDAP_SASL_BIND_IN_PROGRESS ) {
347 conn->c_sasl_bind_in_progress = 1;
350 if ( conn->c_sasl_bind_mech.bv_val ) {
351 free( conn->c_sasl_bind_mech.bv_val );
352 conn->c_sasl_bind_mech.bv_val = NULL;
353 conn->c_sasl_bind_mech.bv_len = 0;
355 conn->c_sasl_bind_in_progress = 0;
357 ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
362 /* Not SASL, cancel any in-progress bind */
363 ldap_pvt_thread_mutex_lock( &conn->c_mutex );
365 if ( conn->c_sasl_bind_mech.bv_val != NULL ) {
366 free(conn->c_sasl_bind_mech.bv_val);
367 conn->c_sasl_bind_mech.bv_val = NULL;
368 conn->c_sasl_bind_mech.bv_len = 0;
370 conn->c_sasl_bind_in_progress = 0;
372 slap_sasl_reset( conn );
373 ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
376 if ( method == LDAP_AUTH_SIMPLE ) {
377 /* accept "anonymous" binds */
378 if ( cred.bv_len == 0 || ndn.bv_len == 0 ) {
383 !( global_allows & SLAP_ALLOW_BIND_ANON_CRED ))
385 /* cred is not empty, disallow */
386 rc = LDAP_INVALID_CREDENTIALS;
388 } else if ( ndn.bv_len &&
389 !( global_allows & SLAP_ALLOW_BIND_ANON_DN ))
391 /* DN is not empty, disallow */
392 rc = LDAP_UNWILLING_TO_PERFORM;
393 text = "unwilling to allow anonymous bind with non-empty DN";
395 } else if ( global_disallows & SLAP_DISALLOW_BIND_ANON ) {
397 rc = LDAP_INAPPROPRIATE_AUTH;
398 text = "anonymous bind disallowed";
401 rc = backend_check_restrictions( NULL, conn, op,
406 * we already forced connection to "anonymous",
407 * just need to send success
409 send_ldap_result( conn, op, rc,
410 NULL, text, NULL, NULL );
412 LDAP_LOG( OPERATION, DETAIL1,
413 "do_bind: conn %d v%d anonymous bind\n",
414 conn->c_connid, version , 0 );
416 Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n",
421 } else if ( global_disallows & SLAP_DISALLOW_BIND_SIMPLE ) {
422 /* disallow simple authentication */
423 rc = LDAP_UNWILLING_TO_PERFORM;
424 text = "unwilling to perform simple authentication";
426 send_ldap_result( conn, op, rc,
427 NULL, text, NULL, NULL );
429 LDAP_LOG( OPERATION, INFO,
430 "do_bind: conn %d v%d simple bind(%s) disallowed\n",
431 conn->c_connid, version, ndn.bv_val );
433 Debug( LDAP_DEBUG_TRACE,
434 "do_bind: v%d simple bind(%s) disallowed\n",
435 version, ndn.bv_val, 0 );
439 } else if (( global_disallows & SLAP_DISALLOW_BIND_SIMPLE_UNPROTECTED )
440 && ( op->o_ssf <= 1 ))
442 rc = LDAP_CONFIDENTIALITY_REQUIRED;
443 text = "unwilling to perform simple authentication "
444 "without confidentilty protection";
446 send_ldap_result( conn, op, rc,
447 NULL, text, NULL, NULL );
450 LDAP_LOG( OPERATION, INFO, "do_bind: conn %d "
451 "v%d unprotected simple bind(%s) disallowed\n",
452 conn->c_connid, version, ndn.bv_val );
454 Debug( LDAP_DEBUG_TRACE,
455 "do_bind: v%d unprotected simple bind(%s) disallowed\n",
456 version, ndn.bv_val, 0 );
461 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
462 } else if ( method == LDAP_AUTH_KRBV41 || method == LDAP_AUTH_KRBV42 ) {
463 if ( global_disallows & SLAP_DISALLOW_BIND_KRBV4 ) {
464 /* disallow simple authentication */
465 rc = LDAP_UNWILLING_TO_PERFORM;
466 text = "unwilling to perform Kerberos V4 bind";
468 send_ldap_result( conn, op, rc,
469 NULL, text, NULL, NULL );
471 LDAP_LOG( OPERATION, DETAIL1,
472 "do_bind: conn %d v%d Kerberos V4 bind\n",
473 conn->c_connid, version , 0 );
475 Debug( LDAP_DEBUG_TRACE, "do_bind: v%d Kerberos V4 bind\n",
483 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
484 text = "unknown authentication method";
486 send_ldap_result( conn, op, rc,
487 NULL, text, NULL, NULL );
489 LDAP_LOG( OPERATION, INFO,
490 "do_bind: conn %ld v%d unknown authentication method (%ld)\n",
491 conn->c_connid, version, method );
493 Debug( LDAP_DEBUG_TRACE,
494 "do_bind: v%d unknown authentication method (%ld)\n",
495 version, method, 0 );
501 * We could be serving multiple database backends. Select the
502 * appropriate one, or send a referral to our "referral server"
503 * if we don't hold it.
506 if ( (be = select_backend( &ndn, 0, 0 )) == NULL ) {
507 if ( default_referral ) {
508 BerVarray ref = referral_rewrite( default_referral,
509 NULL, &pdn, LDAP_SCOPE_DEFAULT );
511 send_ldap_result( conn, op, rc = LDAP_REFERRAL,
512 NULL, NULL, ref ? ref : default_referral, NULL );
514 ber_bvarray_free( ref );
517 /* noSuchObject is not allowed to be returned by bind */
518 send_ldap_result( conn, op, rc = LDAP_INVALID_CREDENTIALS,
519 NULL, NULL, NULL, NULL );
525 /* check restrictions */
526 rc = backend_check_restrictions( be, conn, op, NULL, &text );
527 if( rc != LDAP_SUCCESS ) {
528 send_ldap_result( conn, op, rc,
529 NULL, text, NULL, NULL );
533 #if defined( LDAP_SLAPI )
534 slapi_pblock_set( pb, SLAPI_BACKEND, (void *)be );
535 slapi_pblock_set( pb, SLAPI_CONNECTION, (void *)conn );
536 slapi_pblock_set( pb, SLAPI_OPERATION, (void *)op );
537 slapi_pblock_set( pb, SLAPI_BIND_TARGET, (void *)dn.bv_val );
538 slapi_pblock_set( pb, SLAPI_BIND_METHOD, (void *)method );
539 slapi_pblock_set( pb, SLAPI_MANAGEDSAIT, (void *)(1) );
541 rc = doPluginFNs( be, SLAPI_PLUGIN_PRE_BIND_FN, pb );
542 if ( rc != 0 && rc != LDAP_OTHER ) {
544 * either there is no preOp (bind) plugins
545 * or a plugin failed. Just log it
547 * FIXME: is this correct?
550 LDAP_LOG( OPERATION, INFO, "do_bind: Bind preOps failed\n",
553 Debug(LDAP_DEBUG_TRACE, "do_bind: Bind preOps failed.\n",
557 #endif /* defined( LDAP_SLAPI ) */
562 /* deref suffix alias if appropriate */
563 suffix_alias( be, &ndn );
565 ret = (*be->be_bind)( be, conn, op,
566 &pdn, &ndn, method, &cred, &edn );
569 ldap_pvt_thread_mutex_lock( &conn->c_mutex );
571 if( conn->c_authz_backend == NULL ) {
572 conn->c_authz_backend = be;
587 if( conn->c_dn.bv_len != 0 ) {
588 ber_len_t max = sockbuf_max_incoming_auth;
589 ber_sockbuf_ctrl( conn->c_sb,
590 LBER_SB_OPT_SET_MAX_INCOMING, &max );
593 /* log authorization identity */
594 Statslog( LDAP_DEBUG_STATS,
595 "conn=%lu op=%lu AUTHZ dn=\"%s\" mech=simple ssf=0\n",
596 op->o_connid, op->o_opid,
597 conn->c_dn.bv_val, conn->c_authmech.bv_val, 0 );
600 LDAP_LOG( OPERATION, DETAIL1,
601 "do_bind: v%d bind: \"%s\" to \"%s\" \n",
602 version, conn->c_dn.bv_val, conn->c_dn.bv_val );
604 Debug( LDAP_DEBUG_TRACE,
605 "do_bind: v%d bind: \"%s\" to \"%s\"\n",
606 version, dn.bv_val, conn->c_dn.bv_val );
609 ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
611 /* send this here to avoid a race condition */
612 send_ldap_result( conn, op, LDAP_SUCCESS,
613 NULL, NULL, NULL, NULL );
615 } else if (edn.bv_val != NULL) {
620 send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
621 NULL, "operation not supported within namingContext",
625 #if defined( LDAP_SLAPI )
626 rc = doPluginFNs( be, SLAPI_PLUGIN_POST_BIND_FN, pb );
627 if ( rc != 0 && rc != LDAP_OTHER ) {
629 * either there is no pretOp (bind) plugins
630 * or a plugin failed. Just log it
632 * FIXME: is this correct?
635 LDAP_LOG( OPERATION, INFO, "do_bind: Bind postOps failed\n",
638 Debug(LDAP_DEBUG_TRACE, "do_bind: Bind postOps failed.\n",
642 #endif /* defined( LDAP_SLAPI ) */
645 conn->c_sasl_bindop = NULL;
647 if( pdn.bv_val != NULL ) {
650 if( ndn.bv_val != NULL ) {
653 if ( mech.bv_val != NULL ) {