1 /* bind.c - ldbm backend bind and unbind routines */
4 * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
5 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include <ac/socket.h>
14 #include <ac/string.h>
15 #include <ac/unistd.h>
22 Connection *conn, Operation *op,
24 struct berval *reqdata,
26 struct berval **rspdata,
27 LDAPControl ***rspctrls,
33 assert( reqoid != NULL );
34 assert( strcmp( LDAP_EXOP_MODIFY_PASSWD, reqoid ) == 0 );
36 if( op->o_dn.bv_len == 0 ) {
37 *text = "only authenticated users may change passwords";
38 return LDAP_STRONG_AUTH_REQUIRED;
41 if( conn->c_authz_backend != NULL && conn->c_authz_backend->be_extended ) {
42 if( conn->c_authz_backend->be_restrictops & SLAP_RESTRICT_OP_MODIFY ) {
43 *text = "authorization database is read only";
44 rc = LDAP_UNWILLING_TO_PERFORM;
46 } else if( conn->c_authz_backend->be_update_ndn.bv_len ) {
47 /* we SHOULD return a referral in this case */
48 *refs = referral_rewrite( conn->c_authz_backend->be_update_refs,
49 NULL, NULL, LDAP_SCOPE_DEFAULT );
53 rc = conn->c_authz_backend->be_extended(
54 conn->c_authz_backend, conn, op,
56 rspoid, rspdata, rspctrls,
61 *text = "operation not supported for current user";
62 rc = LDAP_UNWILLING_TO_PERFORM;
68 int slap_passwd_parse( struct berval *reqdata,
70 struct berval *oldpass,
71 struct berval *newpass,
74 int rc = LDAP_SUCCESS;
78 BerElement *ber = (BerElement *)berbuf;
80 if( reqdata == NULL ) {
84 /* ber_init2 uses reqdata directly, doesn't allocate new buffers */
85 ber_init2( ber, reqdata, 0 );
87 tag = ber_scanf( ber, "{" /*}*/ );
89 if( tag != LBER_ERROR ) {
90 tag = ber_peek_tag( ber, &len );
93 if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_ID ) {
96 LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
97 "slap_passwd_parse: ID not allowed.\n"));
99 Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID not allowed.\n",
103 *text = "user must change own password";
104 rc = LDAP_UNWILLING_TO_PERFORM;
108 tag = ber_scanf( ber, "m", id );
110 if( tag == LBER_ERROR ) {
112 LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
113 "slap_passwd_parse: ID parse failed.\n"));
115 Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
122 tag = ber_peek_tag( ber, &len);
125 if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_OLD ) {
126 if( oldpass == NULL ) {
128 LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
129 "slap_passwd_parse: OLD not allowed.\n" ));
131 Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD not allowed.\n",
135 *text = "use bind to verify old password";
136 rc = LDAP_UNWILLING_TO_PERFORM;
140 tag = ber_scanf( ber, "m", oldpass );
142 if( tag == LBER_ERROR ) {
144 LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
145 "slap_passwd_parse: ID parse failed.\n" ));
147 Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
154 tag = ber_peek_tag( ber, &len);
157 if( tag == LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ) {
158 if( newpass == NULL ) {
160 LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
161 "slap_passwd_parse: NEW not allowed.\n" ));
163 Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: NEW not allowed.\n",
167 *text = "user specified passwords disallowed";
168 rc = LDAP_UNWILLING_TO_PERFORM;
172 tag = ber_scanf( ber, "m", newpass );
174 if( tag == LBER_ERROR ) {
176 LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
177 "slap_passwd_parse: OLD parse failed.\n"));
179 Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD parse failed.\n",
186 tag = ber_peek_tag( ber, &len );
192 LDAP_LOG(( "operation", LDAP_LEVEL_ERR,
193 "slap_passwd_parse: decoding error, len=%ld\n", (long)len ));
195 Debug( LDAP_DEBUG_TRACE,
196 "slap_passwd_parse: decoding error, len=%ld\n",
201 *text = "data decoding error";
202 rc = LDAP_PROTOCOL_ERROR;
209 struct berval * slap_passwd_return(
210 struct berval *cred )
213 struct berval *bv = NULL;
215 /* opaque structure, size unknown but smaller than berbuf */
216 BerElement *ber = (BerElement *)berbuf;
218 assert( cred != NULL );
221 LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
222 "slap_passwd_return: %ld\n",(long)cred->bv_len ));
224 Debug( LDAP_DEBUG_TRACE, "slap_passwd_return: %ld\n",
225 (long) cred->bv_len, 0, 0 );
228 ber_init_w_nullc( ber, LBER_USE_DER );
230 rc = ber_printf( ber, "{tON}",
231 LDAP_TAG_EXOP_MODIFY_PASSWD_GEN, cred );
234 (void) ber_flatten( ber, &bv );
246 struct berval *cred )
251 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
252 ldap_pvt_thread_mutex_lock( &passwd_mutex );
254 lutil_passwd_sasl_conn = conn->c_sasl_context;
258 for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
259 if( !lutil_passwd( bv, cred, NULL ) ) {
265 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
267 lutil_passwd_sasl_conn = NULL;
269 ldap_pvt_thread_mutex_unlock( &passwd_mutex );
276 slap_passwd_generate( struct berval *pass )
280 LDAP_LOG(( "operation", LDAP_LEVEL_ENTRY,
281 "slap_passwd_generate: begin\n" ));
283 Debug( LDAP_DEBUG_TRACE, "slap_passwd_generate\n", 0, 0, 0 );
286 * generate passwords of only 8 characters as some getpass(3)
287 * implementations truncate at 8 characters.
289 tmp = lutil_passwd_generate( 8 );
301 struct berval * cred,
302 struct berval * new )
305 #ifdef LUTIL_SHA1_BYTES
306 char* hash = default_passwd_hash ? default_passwd_hash : "{SSHA}";
308 char* hash = default_passwd_hash ? default_passwd_hash : "{SMD5}";
312 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
313 ldap_pvt_thread_mutex_lock( &passwd_mutex );
316 tmp = lutil_passwd_hash( cred , hash );
317 assert( tmp != NULL );
319 #if defined( SLAPD_CRYPT ) || defined( SLAPD_SPASSWD )
320 ldap_pvt_thread_mutex_unlock( &passwd_mutex );