git.sur5r.net Git - openldap/blob - servers/slapd/bind.c

   1 /* bind.c - decode an ldap bind operation and pass it to a backend db */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2005 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/string.h>
  32 #include <ac/socket.h>
  33
  34 #include "slap.h"
  35
  36 int
  37 do_bind(
  38     Operation   *op,
  39     SlapReply   *rs )
  40 {
  41         BerElement *ber = op->o_ber;
  42         ber_int_t version;
  43         ber_tag_t method;
  44         struct berval mech = BER_BVNULL;
  45         struct berval dn = BER_BVNULL;
  46         ber_tag_t tag;
  47         Backend *be = NULL;
  48
  49         Debug( LDAP_DEBUG_TRACE, "do_bind\n", 0, 0, 0 );
  50
  51         /*
  52          * Force to connection to "anonymous" until bind succeeds.
  53          */
  54         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
  55         if ( op->o_conn->c_sasl_bind_in_progress ) {
  56                 be = op->o_conn->c_authz_backend;
  57         }
  58         if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
  59                 /* log authorization identity demotion */
  60                 Statslog( LDAP_DEBUG_STATS,
  61                         "%s BIND anonymous mech=implicit ssf=0\n",
  62                         op->o_log_prefix, 0, 0, 0, 0 );
  63         }
  64         connection2anonymous( op->o_conn );
  65         if ( op->o_conn->c_sasl_bind_in_progress ) {
  66                 op->o_conn->c_authz_backend = be;
  67         }
  68         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
  69         if ( !BER_BVISNULL( &op->o_dn ) ) {
  70                 /* NOTE: temporarily wasting few bytes
  71                  * (until bind is completed), but saving
  72                  * a couple of ch_free() and ch_strdup("") */
  73                 op->o_dn.bv_val[0] = '\0';
  74                 op->o_dn.bv_len = 0;
  75         }
  76         if ( !BER_BVISNULL( &op->o_ndn ) ) {
  77                 op->o_ndn.bv_val[0] = '\0';
  78                 op->o_ndn.bv_len = 0;
  79         }
  80
  81         /*
  82          * Parse the bind request.  It looks like this:
  83          *
  84          *      BindRequest ::= SEQUENCE {
  85          *              version         INTEGER,                 -- version
  86          *              name            DistinguishedName,       -- dn
  87          *              authentication  CHOICE {
  88          *                      simple          [0] OCTET STRING -- passwd
  89          *                      krbv42ldap      [1] OCTET STRING
  90          *                      krbv42dsa       [2] OCTET STRING
  91          *                      SASL            [3] SaslCredentials
  92          *              }
  93          *      }
  94          *
  95          *      SaslCredentials ::= SEQUENCE {
  96          *              mechanism           LDAPString,
  97          *              credentials         OCTET STRING OPTIONAL
  98          *      }
  99          */
 100
 101         tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method );
 102
 103         if ( tag == LBER_ERROR ) {
 104                 Debug( LDAP_DEBUG_ANY, "bind: ber_scanf failed\n", 0, 0, 0 );
 105                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
 106                 rs->sr_err = SLAPD_DISCONNECT;
 107                 goto cleanup;
 108         }
 109
 110         op->o_protocol = version;
 111         op->orb_method = method;
 112
 113         if( op->orb_method != LDAP_AUTH_SASL ) {
 114                 tag = ber_scanf( ber, /*{*/ "m}", &op->orb_cred );
 115
 116         } else {
 117                 tag = ber_scanf( ber, "{m" /*}*/, &mech );
 118
 119                 if ( tag != LBER_ERROR ) {
 120                         ber_len_t len;
 121                         tag = ber_peek_tag( ber, &len );
 122
 123                         if ( tag == LDAP_TAG_LDAPCRED ) {
 124                                 tag = ber_scanf( ber, "m", &op->orb_cred );
 125                         } else {
 126                                 tag = LDAP_TAG_LDAPCRED;
 127                                 BER_BVZERO( &op->orb_cred );
 128                         }
 129
 130                         if ( tag != LBER_ERROR ) {
 131                                 tag = ber_scanf( ber, /*{{*/ "}}" );
 132                         }
 133                 }
 134         }
 135
 136         if ( tag == LBER_ERROR ) {
 137                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
 138                 rs->sr_err = SLAPD_DISCONNECT;
 139                 goto cleanup;
 140         }
 141
 142         if( get_ctrls( op, rs, 1 ) != LDAP_SUCCESS ) {
 143                 Debug( LDAP_DEBUG_ANY, "do_bind: get_ctrls failed\n", 0, 0, 0 );
 144                 goto cleanup;
 145         }
 146
 147         /* We use the tmpmemctx here because it speeds up normalization.
 148          * However, we must dup with regular malloc when storing any
 149          * resulting DNs in the op or conn structures.
 150          */
 151         rs->sr_err = dnPrettyNormal( NULL, &dn, &op->o_req_dn, &op->o_req_ndn,
 152                 op->o_tmpmemctx );
 153         if ( rs->sr_err != LDAP_SUCCESS ) {
 154                 Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n",
 155                         dn.bv_val, 0, 0 );
 156                 send_ldap_error( op, rs, LDAP_INVALID_DN_SYNTAX, "invalid DN" );
 157                 goto cleanup;
 158         }
 159
 160         if( op->orb_method == LDAP_AUTH_SASL ) {
 161                 Debug( LDAP_DEBUG_TRACE, "do_sasl_bind: dn (%s) mech %s\n",
 162                         op->o_req_dn.bv_val, mech.bv_val, NULL );
 163
 164         } else {
 165                 Debug( LDAP_DEBUG_TRACE,
 166                         "do_bind: version=%ld dn=\"%s\" method=%ld\n",
 167                         (unsigned long) version, op->o_req_dn.bv_val,
 168                         (unsigned long) op->orb_method );
 169         }
 170
 171         Statslog( LDAP_DEBUG_STATS, "%s BIND dn=\"%s\" method=%ld\n",
 172             op->o_log_prefix, op->o_req_dn.bv_val,
 173                 (unsigned long) op->orb_method, 0, 0 );
 174
 175         if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) {
 176                 Debug( LDAP_DEBUG_ANY, "do_bind: unknown version=%ld\n",
 177                         (unsigned long) version, 0, 0 );
 178                 send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR,
 179                         "requested protocol version not supported" );
 180                 goto cleanup;
 181
 182         } else if (!( global_allows & SLAP_ALLOW_BIND_V2 ) &&
 183                 version < LDAP_VERSION3 )
 184         {
 185                 send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR,
 186                         "historical protocol version requested, use LDAPv3 instead" );
 187                 goto cleanup;
 188         }
 189
 190         /*
 191          * we set connection version regardless of whether bind succeeds or not.
 192          */
 193         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 194         op->o_conn->c_protocol = version;
 195         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 196
 197         op->orb_tmp_mech = mech;
 198
 199         op->o_bd = frontendDB;
 200         rs->sr_err = frontendDB->be_bind( op, rs );
 201
 202 cleanup:
 203         if ( rs->sr_err == LDAP_SUCCESS ) {
 204                 if ( op->orb_method != LDAP_AUTH_SASL ) {
 205                         ber_dupbv( &op->o_conn->c_authmech, &mech );
 206                 }
 207                 op->o_conn->c_authtype = op->orb_method;
 208         }
 209
 210         op->o_conn->c_sasl_bindop = NULL;
 211
 212         if( !BER_BVISNULL( &op->o_req_dn ) ) {
 213                 slap_sl_free( op->o_req_dn.bv_val, op->o_tmpmemctx );
 214                 BER_BVZERO( &op->o_req_dn );
 215         }
 216         if( !BER_BVISNULL( &op->o_req_ndn ) ) {
 217                 slap_sl_free( op->o_req_ndn.bv_val, op->o_tmpmemctx );
 218                 BER_BVZERO( &op->o_req_ndn );
 219         }
 220
 221         return rs->sr_err;
 222 }
 223
 224 int
 225 fe_op_bind( Operation *op, SlapReply *rs )
 226 {
 227         struct berval   mech = op->orb_tmp_mech;
 228
 229         /* check for inappropriate controls */
 230         if( get_manageDSAit( op ) == SLAP_CONTROL_CRITICAL ) {
 231                 send_ldap_error( op, rs,
 232                         LDAP_UNAVAILABLE_CRITICAL_EXTENSION,
 233                         "manageDSAit control inappropriate" );
 234                 goto cleanup;
 235         }
 236
 237         /* Set the bindop for the benefit of in-directory SASL lookups */
 238         op->o_conn->c_sasl_bindop = op;
 239
 240         if ( op->orb_method == LDAP_AUTH_SASL ) {
 241                 if ( op->o_protocol < LDAP_VERSION3 ) {
 242                         Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n",
 243                                 (unsigned long)op->o_protocol, 0, 0 );
 244                         send_ldap_discon( op, rs,
 245                                 LDAP_PROTOCOL_ERROR, "SASL bind requires LDAPv3" );
 246                         rs->sr_err = SLAPD_DISCONNECT;
 247                         goto cleanup;
 248                 }
 249
 250                 if( BER_BVISNULL( &mech ) || BER_BVISEMPTY( &mech ) ) {
 251                         Debug( LDAP_DEBUG_ANY,
 252                                 "do_bind: no sasl mechanism provided\n",
 253                                 0, 0, 0 );
 254                         send_ldap_error( op, rs, LDAP_AUTH_METHOD_NOT_SUPPORTED,
 255                                 "no SASL mechanism provided" );
 256                         goto cleanup;
 257                 }
 258
 259                 /* check restrictions */
 260                 if( backend_check_restrictions( op, rs, &mech ) != LDAP_SUCCESS ) {
 261                         send_ldap_result( op, rs );
 262                         goto cleanup;
 263                 }
 264
 265                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 266                 if ( op->o_conn->c_sasl_bind_in_progress ) {
 267                         if( !bvmatch( &op->o_conn->c_sasl_bind_mech, &mech ) ) {
 268                                 /* mechanism changed between bind steps */
 269                                 slap_sasl_reset(op->o_conn);
 270                         }
 271                 } else {
 272                         ber_dupbv(&op->o_conn->c_sasl_bind_mech, &mech);
 273                 }
 274                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 275
 276                 rs->sr_err = slap_sasl_bind( op, rs );
 277
 278                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 279                 if( rs->sr_err == LDAP_SUCCESS ) {
 280                         ber_dupbv(&op->o_conn->c_dn, &op->orb_edn);
 281                         if( !BER_BVISEMPTY( &op->orb_edn ) ) {
 282                                 /* edn is always normalized already */
 283                                 ber_dupbv( &op->o_conn->c_ndn, &op->o_conn->c_dn );
 284                         }
 285                         op->o_tmpfree( op->orb_edn.bv_val, op->o_tmpmemctx );
 286                         BER_BVZERO( &op->orb_edn );
 287                         op->o_conn->c_authmech = op->o_conn->c_sasl_bind_mech;
 288                         BER_BVZERO( &op->o_conn->c_sasl_bind_mech );
 289
 290                         op->o_conn->c_sasl_ssf = op->orb_ssf;
 291                         if( op->orb_ssf > op->o_conn->c_ssf ) {
 292                                 op->o_conn->c_ssf = op->orb_ssf;
 293                         }
 294
 295                         if( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
 296                                 ber_len_t max = sockbuf_max_incoming_auth;
 297                                 ber_sockbuf_ctrl( op->o_conn->c_sb,
 298                                         LBER_SB_OPT_SET_MAX_INCOMING, &max );
 299                         }
 300
 301                         /* log authorization identity */
 302                         Statslog( LDAP_DEBUG_STATS,
 303                                 "%s BIND dn=\"%s\" mech=%s ssf=%d\n",
 304                                 op->o_log_prefix,
 305                                 BER_BVISNULL( &op->o_conn->c_dn ) ? "<empty>" : op->o_conn->c_dn.bv_val,
 306                                 op->o_conn->c_authmech.bv_val, op->orb_ssf, 0 );
 307
 308                         Debug( LDAP_DEBUG_TRACE,
 309                                 "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n",
 310                                 op->o_conn->c_authmech.bv_val,
 311                                 BER_BVISNULL( &op->o_conn->c_dn ) ? "<empty>" : op->o_conn->c_dn.bv_val,
 312                                 op->orb_ssf );
 313
 314                 } else if ( rs->sr_err != LDAP_SASL_BIND_IN_PROGRESS ) {
 315                         if ( !BER_BVISNULL( &op->o_conn->c_sasl_bind_mech ) ) {
 316                                 free( op->o_conn->c_sasl_bind_mech.bv_val );
 317                                 BER_BVZERO( &op->o_conn->c_sasl_bind_mech );
 318                         }
 319                 }
 320
 321                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 322
 323                 goto cleanup;
 324
 325         } else {
 326                 /* Not SASL, cancel any in-progress bind */
 327                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 328
 329                 if ( !BER_BVISNULL( &op->o_conn->c_sasl_bind_mech ) ) {
 330                         free( op->o_conn->c_sasl_bind_mech.bv_val );
 331                         BER_BVZERO( &op->o_conn->c_sasl_bind_mech );
 332                 }
 333                 op->o_conn->c_sasl_bind_in_progress = 0;
 334
 335                 slap_sasl_reset( op->o_conn );
 336                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 337         }
 338
 339         if ( op->orb_method == LDAP_AUTH_SIMPLE ) {
 340                 BER_BVSTR( &mech, "SIMPLE" );
 341                 /* accept "anonymous" binds */
 342                 if ( BER_BVISEMPTY( &op->orb_cred ) || BER_BVISEMPTY( &op->o_req_ndn ) ) {
 343                         rs->sr_err = LDAP_SUCCESS;
 344
 345                         if( !BER_BVISEMPTY( &op->orb_cred ) &&
 346                                 !( global_allows & SLAP_ALLOW_BIND_ANON_CRED ))
 347                         {
 348                                 /* cred is not empty, disallow */
 349                                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
 350
 351                         } else if ( !BER_BVISEMPTY( &op->o_req_ndn ) &&
 352                                 !( global_allows & SLAP_ALLOW_BIND_ANON_DN ))
 353                         {
 354                                 /* DN is not empty, disallow */
 355                                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 356                                 rs->sr_text =
 357                                         "unauthenticated bind (DN with no password) disallowed";
 358
 359                         } else if ( global_disallows & SLAP_DISALLOW_BIND_ANON ) {
 360                                 /* disallow */
 361                                 rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
 362                                 rs->sr_text = "anonymous bind disallowed";
 363
 364                         } else {
 365                                 backend_check_restrictions( op, rs, &mech );
 366                         }
 367
 368                         /*
 369                          * we already forced connection to "anonymous",
 370                          * just need to send success
 371                          */
 372                         send_ldap_result( op, rs );
 373                         Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n",
 374                                 op->o_protocol, 0, 0 );
 375                         goto cleanup;
 376
 377                 } else if ( global_disallows & SLAP_DISALLOW_BIND_SIMPLE ) {
 378                         /* disallow simple authentication */
 379                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 380                         rs->sr_text = "unwilling to perform simple authentication";
 381
 382                         send_ldap_result( op, rs );
 383                         Debug( LDAP_DEBUG_TRACE,
 384                                 "do_bind: v%d simple bind(%s) disallowed\n",
 385                                 op->o_protocol, op->o_req_ndn.bv_val, 0 );
 386                         goto cleanup;
 387                 }
 388
 389 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 390         } else if ( op->orb_method == LDAP_AUTH_KRBV41 ) {
 391                 if ( global_disallows & SLAP_DISALLOW_BIND_KRBV4 ) {
 392                         /* disallow krbv4 authentication */
 393                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 394                         rs->sr_text = "unwilling to perform Kerberos V4 bind";
 395
 396                         send_ldap_result( op, rs );
 397
 398                         Debug( LDAP_DEBUG_TRACE,
 399                                 "do_bind: v%d Kerberos V4 (step 1) bind refused\n",
 400                                 op->o_protocol, 0, 0 );
 401                         goto cleanup;
 402                 }
 403                 BER_BVSTR( &mech, "KRBV4" );
 404
 405         } else if ( op->orb_method == LDAP_AUTH_KRBV42 ) {
 406                 rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 407                 rs->sr_text = "Kerberos V4 (step 2) bind not supported";
 408                 send_ldap_result( op, rs );
 409
 410                 Debug( LDAP_DEBUG_TRACE,
 411                         "do_bind: v%d Kerberos V4 (step 2) bind refused\n",
 412                         op->o_protocol, 0, 0 );
 413                 goto cleanup;
 414 #endif
 415
 416         } else {
 417                 rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 418                 rs->sr_text = "unknown authentication method";
 419
 420                 send_ldap_result( op, rs );
 421                 Debug( LDAP_DEBUG_TRACE,
 422                         "do_bind: v%d unknown authentication method (%d)\n",
 423                         op->o_protocol, op->orb_method, 0 );
 424                 goto cleanup;
 425         }
 426
 427         /*
 428          * We could be serving multiple database backends.  Select the
 429          * appropriate one, or send a referral to our "referral server"
 430          * if we don't hold it.
 431          */
 432
 433         if ( (op->o_bd = select_backend( &op->o_req_ndn, 0, 0 )) == NULL ) {
 434                 /* don't return referral for bind requests */
 435                 /* noSuchObject is not allowed to be returned by bind */
 436                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
 437                 op->o_bd = frontendDB;
 438                 send_ldap_result( op, rs );
 439                 op->o_bd = NULL;
 440                 goto cleanup;
 441         }
 442
 443         /* check restrictions */
 444         if( backend_check_restrictions( op, rs, NULL ) != LDAP_SUCCESS ) {
 445                 send_ldap_result( op, rs );
 446                 goto cleanup;
 447         }
 448
 449         if( op->o_bd->be_bind ) {
 450                 op->o_conn->c_authz_cookie = NULL;
 451
 452                 rs->sr_err = (op->o_bd->be_bind)( op, rs );
 453
 454                 if ( rs->sr_err == 0 ) {
 455                         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 456
 457                         if( op->o_conn->c_authz_backend == NULL ) {
 458                                 op->o_conn->c_authz_backend = op->o_bd;
 459                         }
 460
 461                         /* be_bind returns regular/global edn */
 462                         if( !BER_BVISEMPTY( &op->orb_edn ) ) {
 463                                 op->o_conn->c_dn = op->orb_edn;
 464                         } else {
 465                                 ber_dupbv(&op->o_conn->c_dn, &op->o_req_dn);
 466                         }
 467
 468                         ber_dupbv( &op->o_conn->c_ndn, &op->o_req_ndn );
 469
 470                         if( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
 471                                 ber_len_t max = sockbuf_max_incoming_auth;
 472                                 ber_sockbuf_ctrl( op->o_conn->c_sb,
 473                                         LBER_SB_OPT_SET_MAX_INCOMING, &max );
 474                         }
 475
 476                         /* log authorization identity */
 477                         Statslog( LDAP_DEBUG_STATS,
 478                                 "%s BIND dn=\"%s\" mech=%s ssf=0\n",
 479                                 op->o_log_prefix,
 480                                 op->o_conn->c_dn.bv_val, mech.bv_val, 0, 0 );
 481
 482                         Debug( LDAP_DEBUG_TRACE,
 483                                 "do_bind: v%d bind: \"%s\" to \"%s\"\n",
 484                                 op->o_protocol, op->o_req_dn.bv_val, op->o_conn->c_dn.bv_val );
 485
 486                         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 487
 488                         /* send this here to avoid a race condition */
 489                         send_ldap_result( op, rs );
 490
 491                 } else if ( !BER_BVISNULL( &op->orb_edn ) ) {
 492                         free( op->orb_edn.bv_val );
 493                         BER_BVZERO( &op->orb_edn );
 494                 }
 495
 496         } else {
 497                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 498                         "operation not supported within naming context" );
 499         }
 500
 501 cleanup:;
 502         return rs->sr_err;
 503 }
 504