git.sur5r.net Git - openldap/blob - servers/slapd/bind.c

   1 /* bind.c - decode an ldap bind operation and pass it to a backend db */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2007 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/string.h>
  32 #include <ac/socket.h>
  33
  34 #include "slap.h"
  35
  36 int
  37 do_bind(
  38     Operation   *op,
  39     SlapReply   *rs )
  40 {
  41         BerElement *ber = op->o_ber;
  42         ber_int_t version;
  43         ber_tag_t method;
  44         struct berval mech = BER_BVNULL;
  45         struct berval dn = BER_BVNULL;
  46         ber_tag_t tag;
  47         Backend *be = NULL;
  48
  49         Debug( LDAP_DEBUG_TRACE, "do_bind\n", 0, 0, 0 );
  50
  51         /*
  52          * Force to connection to "anonymous" until bind succeeds.
  53          */
  54         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
  55         if ( op->o_conn->c_sasl_bind_in_progress ) {
  56                 be = op->o_conn->c_authz_backend;
  57         }
  58         if ( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
  59                 /* log authorization identity demotion */
  60                 Statslog( LDAP_DEBUG_STATS,
  61                         "%s BIND anonymous mech=implicit ssf=0\n",
  62                         op->o_log_prefix, 0, 0, 0, 0 );
  63         }
  64         connection2anonymous( op->o_conn );
  65         if ( op->o_conn->c_sasl_bind_in_progress ) {
  66                 op->o_conn->c_authz_backend = be;
  67         }
  68         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
  69         if ( !BER_BVISNULL( &op->o_dn ) ) {
  70                 /* NOTE: temporarily wasting few bytes
  71                  * (until bind is completed), but saving
  72                  * a couple of ch_free() and ch_strdup("") */
  73                 op->o_dn.bv_val[0] = '\0';
  74                 op->o_dn.bv_len = 0;
  75         }
  76         if ( !BER_BVISNULL( &op->o_ndn ) ) {
  77                 op->o_ndn.bv_val[0] = '\0';
  78                 op->o_ndn.bv_len = 0;
  79         }
  80
  81         /*
  82          * Parse the bind request.  It looks like this:
  83          *
  84          *      BindRequest ::= SEQUENCE {
  85          *              version         INTEGER,                 -- version
  86          *              name            DistinguishedName,       -- dn
  87          *              authentication  CHOICE {
  88          *                      simple          [0] OCTET STRING -- passwd
  89          *                      krbv42ldap      [1] OCTET STRING -- OBSOLETE
  90          *                      krbv42dsa       [2] OCTET STRING -- OBSOLETE
  91          *                      SASL            [3] SaslCredentials
  92          *              }
  93          *      }
  94          *
  95          *      SaslCredentials ::= SEQUENCE {
  96          *              mechanism           LDAPString,
  97          *              credentials         OCTET STRING OPTIONAL
  98          *      }
  99          */
 100
 101         tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method );
 102
 103         if ( tag == LBER_ERROR ) {
 104                 Debug( LDAP_DEBUG_ANY, "bind: ber_scanf failed\n", 0, 0, 0 );
 105                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
 106                 rs->sr_err = SLAPD_DISCONNECT;
 107                 goto cleanup;
 108         }
 109
 110         op->o_protocol = version;
 111         op->orb_method = method;
 112
 113         if( op->orb_method != LDAP_AUTH_SASL ) {
 114                 tag = ber_scanf( ber, /*{*/ "m}", &op->orb_cred );
 115
 116         } else {
 117                 tag = ber_scanf( ber, "{m" /*}*/, &mech );
 118
 119                 if ( tag != LBER_ERROR ) {
 120                         ber_len_t len;
 121                         tag = ber_peek_tag( ber, &len );
 122
 123                         if ( tag == LDAP_TAG_LDAPCRED ) {
 124                                 tag = ber_scanf( ber, "m", &op->orb_cred );
 125                         } else {
 126                                 tag = LDAP_TAG_LDAPCRED;
 127                                 BER_BVZERO( &op->orb_cred );
 128                         }
 129
 130                         if ( tag != LBER_ERROR ) {
 131                                 tag = ber_scanf( ber, /*{{*/ "}}" );
 132                         }
 133                 }
 134         }
 135
 136         if ( tag == LBER_ERROR ) {
 137                 send_ldap_discon( op, rs, LDAP_PROTOCOL_ERROR, "decoding error" );
 138                 rs->sr_err = SLAPD_DISCONNECT;
 139                 goto cleanup;
 140         }
 141
 142         if( get_ctrls( op, rs, 1 ) != LDAP_SUCCESS ) {
 143                 Debug( LDAP_DEBUG_ANY, "do_bind: get_ctrls failed\n", 0, 0, 0 );
 144                 goto cleanup;
 145         }
 146
 147         /* We use the tmpmemctx here because it speeds up normalization.
 148          * However, we must dup with regular malloc when storing any
 149          * resulting DNs in the op or conn structures.
 150          */
 151         rs->sr_err = dnPrettyNormal( NULL, &dn, &op->o_req_dn, &op->o_req_ndn,
 152                 op->o_tmpmemctx );
 153         if ( rs->sr_err != LDAP_SUCCESS ) {
 154                 Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n",
 155                         dn.bv_val, 0, 0 );
 156                 send_ldap_error( op, rs, LDAP_INVALID_DN_SYNTAX, "invalid DN" );
 157                 goto cleanup;
 158         }
 159
 160         if( op->orb_method == LDAP_AUTH_SASL ) {
 161                 Debug( LDAP_DEBUG_TRACE, "do_sasl_bind: dn (%s) mech %s\n",
 162                         op->o_req_dn.bv_val, mech.bv_val, NULL );
 163
 164         } else {
 165                 Debug( LDAP_DEBUG_TRACE,
 166                         "do_bind: version=%ld dn=\"%s\" method=%ld\n",
 167                         (unsigned long) version, op->o_req_dn.bv_val,
 168                         (unsigned long) op->orb_method );
 169         }
 170
 171         Statslog( LDAP_DEBUG_STATS, "%s BIND dn=\"%s\" method=%ld\n",
 172             op->o_log_prefix, op->o_req_dn.bv_val,
 173                 (unsigned long) op->orb_method, 0, 0 );
 174
 175         if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) {
 176                 Debug( LDAP_DEBUG_ANY, "do_bind: unknown version=%ld\n",
 177                         (unsigned long) version, 0, 0 );
 178                 send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR,
 179                         "requested protocol version not supported" );
 180                 goto cleanup;
 181
 182         } else if (!( global_allows & SLAP_ALLOW_BIND_V2 ) &&
 183                 version < LDAP_VERSION3 )
 184         {
 185                 send_ldap_error( op, rs, LDAP_PROTOCOL_ERROR,
 186                         "historical protocol version requested, use LDAPv3 instead" );
 187                 goto cleanup;
 188         }
 189
 190         /*
 191          * we set connection version regardless of whether bind succeeds or not.
 192          */
 193         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 194         op->o_conn->c_protocol = version;
 195         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 196
 197         op->orb_tmp_mech = mech;
 198
 199         op->o_bd = frontendDB;
 200         rs->sr_err = frontendDB->be_bind( op, rs );
 201
 202 cleanup:
 203         if ( rs->sr_err == LDAP_SUCCESS ) {
 204                 if ( op->orb_method != LDAP_AUTH_SASL ) {
 205                         ber_dupbv( &op->o_conn->c_authmech, &mech );
 206                 }
 207                 op->o_conn->c_authtype = op->orb_method;
 208         }
 209
 210         if( !BER_BVISNULL( &op->o_req_dn ) ) {
 211                 slap_sl_free( op->o_req_dn.bv_val, op->o_tmpmemctx );
 212                 BER_BVZERO( &op->o_req_dn );
 213         }
 214         if( !BER_BVISNULL( &op->o_req_ndn ) ) {
 215                 slap_sl_free( op->o_req_ndn.bv_val, op->o_tmpmemctx );
 216                 BER_BVZERO( &op->o_req_ndn );
 217         }
 218
 219         return rs->sr_err;
 220 }
 221
 222 int
 223 fe_op_bind( Operation *op, SlapReply *rs )
 224 {
 225         BackendDB       *bd = op->o_bd;
 226
 227         /* check for inappropriate controls */
 228         if( get_manageDSAit( op ) == SLAP_CONTROL_CRITICAL ) {
 229                 send_ldap_error( op, rs,
 230                         LDAP_UNAVAILABLE_CRITICAL_EXTENSION,
 231                         "manageDSAit control inappropriate" );
 232                 goto cleanup;
 233         }
 234
 235         if ( op->orb_method == LDAP_AUTH_SASL ) {
 236                 if ( op->o_protocol < LDAP_VERSION3 ) {
 237                         Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n",
 238                                 (unsigned long)op->o_protocol, 0, 0 );
 239                         send_ldap_discon( op, rs,
 240                                 LDAP_PROTOCOL_ERROR, "SASL bind requires LDAPv3" );
 241                         rs->sr_err = SLAPD_DISCONNECT;
 242                         goto cleanup;
 243                 }
 244
 245                 if( BER_BVISNULL( &op->orb_tmp_mech ) || BER_BVISEMPTY( &op->orb_tmp_mech ) ) {
 246                         Debug( LDAP_DEBUG_ANY,
 247                                 "do_bind: no sasl mechanism provided\n",
 248                                 0, 0, 0 );
 249                         send_ldap_error( op, rs, LDAP_AUTH_METHOD_NOT_SUPPORTED,
 250                                 "no SASL mechanism provided" );
 251                         goto cleanup;
 252                 }
 253
 254                 /* check restrictions */
 255                 if( backend_check_restrictions( op, rs, &op->orb_tmp_mech ) != LDAP_SUCCESS ) {
 256                         send_ldap_result( op, rs );
 257                         goto cleanup;
 258                 }
 259
 260                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 261                 if ( op->o_conn->c_sasl_bind_in_progress ) {
 262                         if( !bvmatch( &op->o_conn->c_sasl_bind_mech, &op->orb_tmp_mech ) ) {
 263                                 /* mechanism changed between bind steps */
 264                                 slap_sasl_reset(op->o_conn);
 265                         }
 266                 } else {
 267                         ber_dupbv(&op->o_conn->c_sasl_bind_mech, &op->orb_tmp_mech);
 268                 }
 269
 270                 /* Set the bindop for the benefit of in-directory SASL lookups */
 271                 op->o_conn->c_sasl_bindop = op;
 272
 273                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 274
 275                 rs->sr_err = slap_sasl_bind( op, rs );
 276
 277                 goto cleanup;
 278
 279         } else {
 280                 /* Not SASL, cancel any in-progress bind */
 281                 ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 282
 283                 if ( !BER_BVISNULL( &op->o_conn->c_sasl_bind_mech ) ) {
 284                         free( op->o_conn->c_sasl_bind_mech.bv_val );
 285                         BER_BVZERO( &op->o_conn->c_sasl_bind_mech );
 286                 }
 287                 op->o_conn->c_sasl_bind_in_progress = 0;
 288
 289                 slap_sasl_reset( op->o_conn );
 290                 ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 291         }
 292
 293         if ( op->orb_method == LDAP_AUTH_SIMPLE ) {
 294                 BER_BVSTR( &op->orb_tmp_mech, "SIMPLE" );
 295                 /* accept "anonymous" binds */
 296                 if ( BER_BVISEMPTY( &op->orb_cred ) || BER_BVISEMPTY( &op->o_req_ndn ) ) {
 297                         rs->sr_err = LDAP_SUCCESS;
 298
 299                         if( !BER_BVISEMPTY( &op->orb_cred ) &&
 300                                 !( global_allows & SLAP_ALLOW_BIND_ANON_CRED ))
 301                         {
 302                                 /* cred is not empty, disallow */
 303                                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
 304
 305                         } else if ( !BER_BVISEMPTY( &op->o_req_ndn ) &&
 306                                 !( global_allows & SLAP_ALLOW_BIND_ANON_DN ))
 307                         {
 308                                 /* DN is not empty, disallow */
 309                                 rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 310                                 rs->sr_text =
 311                                         "unauthenticated bind (DN with no password) disallowed";
 312
 313                         } else if ( global_disallows & SLAP_DISALLOW_BIND_ANON ) {
 314                                 /* disallow */
 315                                 rs->sr_err = LDAP_INAPPROPRIATE_AUTH;
 316                                 rs->sr_text = "anonymous bind disallowed";
 317
 318                         } else {
 319                                 backend_check_restrictions( op, rs, &op->orb_tmp_mech );
 320                         }
 321
 322                         /*
 323                          * we already forced connection to "anonymous",
 324                          * just need to send success
 325                          */
 326                         send_ldap_result( op, rs );
 327                         Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n",
 328                                 op->o_protocol, 0, 0 );
 329                         goto cleanup;
 330
 331                 } else if ( global_disallows & SLAP_DISALLOW_BIND_SIMPLE ) {
 332                         /* disallow simple authentication */
 333                         rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
 334                         rs->sr_text = "unwilling to perform simple authentication";
 335
 336                         send_ldap_result( op, rs );
 337                         Debug( LDAP_DEBUG_TRACE,
 338                                 "do_bind: v%d simple bind(%s) disallowed\n",
 339                                 op->o_protocol, op->o_req_ndn.bv_val, 0 );
 340                         goto cleanup;
 341                 }
 342
 343         } else {
 344                 rs->sr_err = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 345                 rs->sr_text = "unknown authentication method";
 346
 347                 send_ldap_result( op, rs );
 348                 Debug( LDAP_DEBUG_TRACE,
 349                         "do_bind: v%d unknown authentication method (%d)\n",
 350                         op->o_protocol, op->orb_method, 0 );
 351                 goto cleanup;
 352         }
 353
 354         /*
 355          * We could be serving multiple database backends.  Select the
 356          * appropriate one, or send a referral to our "referral server"
 357          * if we don't hold it.
 358          */
 359
 360         if ( (op->o_bd = select_backend( &op->o_req_ndn, 0, 0 )) == NULL ) {
 361                 /* don't return referral for bind requests */
 362                 /* noSuchObject is not allowed to be returned by bind */
 363                 rs->sr_err = LDAP_INVALID_CREDENTIALS;
 364                 op->o_bd = bd;
 365                 send_ldap_result( op, rs );
 366                 goto cleanup;
 367         }
 368
 369         /* check restrictions */
 370         if( backend_check_restrictions( op, rs, NULL ) != LDAP_SUCCESS ) {
 371                 send_ldap_result( op, rs );
 372                 goto cleanup;
 373         }
 374
 375         if( op->o_bd->be_bind ) {
 376                 op->o_conn->c_authz_cookie = NULL;
 377
 378                 rs->sr_err = (op->o_bd->be_bind)( op, rs );
 379
 380                 if ( rs->sr_err == 0 ) {
 381                         (void)fe_op_bind_success( op, rs );
 382
 383                 } else if ( !BER_BVISNULL( &op->orb_edn ) ) {
 384                         free( op->orb_edn.bv_val );
 385                         BER_BVZERO( &op->orb_edn );
 386                 }
 387
 388         } else {
 389                 send_ldap_error( op, rs, LDAP_UNWILLING_TO_PERFORM,
 390                         "operation not supported within naming context" );
 391         }
 392
 393 cleanup:;
 394         op->o_bd = bd;
 395         return rs->sr_err;
 396 }
 397
 398 int
 399 fe_op_bind_success( Operation *op, SlapReply *rs )
 400 {
 401         ldap_pvt_thread_mutex_lock( &op->o_conn->c_mutex );
 402
 403         if( op->o_conn->c_authz_backend == NULL ) {
 404                 op->o_conn->c_authz_backend = op->o_bd;
 405         }
 406
 407         /* be_bind returns regular/global edn */
 408         if( !BER_BVISEMPTY( &op->orb_edn ) ) {
 409                 op->o_conn->c_dn = op->orb_edn;
 410         } else {
 411                 ber_dupbv(&op->o_conn->c_dn, &op->o_req_dn);
 412         }
 413
 414         ber_dupbv( &op->o_conn->c_ndn, &op->o_req_ndn );
 415
 416         if( !BER_BVISEMPTY( &op->o_conn->c_dn ) ) {
 417                 ber_len_t max = sockbuf_max_incoming_auth;
 418                 ber_sockbuf_ctrl( op->o_conn->c_sb,
 419                         LBER_SB_OPT_SET_MAX_INCOMING, &max );
 420         }
 421
 422         /* log authorization identity */
 423         Statslog( LDAP_DEBUG_STATS,
 424                 "%s BIND dn=\"%s\" mech=%s ssf=0\n",
 425                 op->o_log_prefix,
 426                 op->o_conn->c_dn.bv_val, op->orb_tmp_mech.bv_val, 0, 0 );
 427
 428         Debug( LDAP_DEBUG_TRACE,
 429                 "do_bind: v%d bind: \"%s\" to \"%s\"\n",
 430                 op->o_protocol, op->o_req_dn.bv_val, op->o_conn->c_dn.bv_val );
 431
 432         ldap_pvt_thread_mutex_unlock( &op->o_conn->c_mutex );
 433
 434         /* send this here to avoid a race condition */
 435         send_ldap_result( op, rs );
 436
 437         return LDAP_SUCCESS;
 438 }