git.sur5r.net Git - openldap/blob - servers/slapd/passwd.c

   1 /* bind.c - ldbm backend bind and unbind routines */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/krb.h>
  13 #include <ac/socket.h>
  14 #include <ac/string.h>
  15 #include <ac/unistd.h>
  16
  17 #include "slap.h"
  18
  19 #include <lutil.h>
  20
  21 int passwd_extop(
  22         SLAP_EXTOP_CALLBACK_FN ext_callback,
  23         Connection *conn, Operation *op, char *oid,
  24         struct berval *reqdata,
  25         struct berval **rspdata,
  26         LDAPControl ***rspctrls,
  27         char **text )
  28 {
  29         int rc;
  30
  31         assert( oid != NULL );
  32         assert( strcmp( LDAP_EXOP_X_MODIFY_PASSWD, oid ) == 0 );
  33
  34         if( op->o_dn == NULL || op->o_dn[0] == '\0' ) {
  35                 *text = ch_strdup("only authenicated users may change passwords");
  36                 return LDAP_STRONG_AUTH_REQUIRED;
  37         }
  38
  39         if( conn->c_authz_backend != NULL &&
  40                 conn->c_authz_backend->be_extended )
  41         {
  42                 rc = conn->c_authz_backend->be_extended(
  43                         conn->c_authz_backend,
  44                         conn, op, oid, reqdata, rspdata, rspctrls, text );
  45
  46         } else {
  47                 *text = ch_strdup("operation not supported for current user");
  48                 rc = LDAP_UNWILLING_TO_PERFORM;
  49         }
  50
  51         return rc;
  52 }
  53
  54 int slap_passwd_parse( struct berval *reqdata,
  55         struct berval **id,
  56         struct berval **old,
  57         struct berval **new,
  58         char **text )
  59 {
  60         int rc = LDAP_SUCCESS;
  61         ber_tag_t tag;
  62         ber_len_t len;
  63         BerElement *ber;
  64
  65         if( reqdata == NULL ) {
  66                 return LDAP_SUCCESS;
  67         }
  68
  69         ber = ber_init( reqdata );
  70
  71         if( ber == NULL ) {
  72                 Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ber_init failed\n",
  73                         0, 0, 0 );
  74                 *text = ch_strdup("password decoding error");
  75                 return LDAP_PROTOCOL_ERROR;
  76         }
  77
  78         tag = ber_scanf( ber, "{" /*}*/ );
  79
  80         if( tag != LBER_ERROR ) {
  81                 tag = ber_peek_tag( ber, &len );
  82         }
  83
  84         if( tag == LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID ) {
  85                 if( id == NULL ) {
  86                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID not allowed.\n",
  87                                 0, 0, 0 );
  88                         *text = "user must change own password";
  89                         rc = LDAP_UNWILLING_TO_PERFORM;
  90                         goto done;
  91                 }
  92
  93                 tag = ber_scanf( ber, "O", id );
  94
  95                 if( tag == LBER_ERROR ) {
  96                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
  97                                 0, 0, 0 );
  98                         goto decoding_error;
  99                 }
 100
 101                 tag = ber_peek_tag( ber, &len);
 102         }
 103
 104         if( tag == LDAP_TAG_EXOP_X_MODIFY_PASSWD_OLD ) {
 105                 if( old == NULL ) {
 106                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD not allowed.\n",
 107                                 0, 0, 0 );
 108                         *text = "use bind to verify old password";
 109                         rc = LDAP_UNWILLING_TO_PERFORM;
 110                         goto done;
 111                 }
 112
 113                 tag = ber_scanf( ber, "O", old );
 114
 115                 if( tag == LBER_ERROR ) {
 116                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: ID parse failed.\n",
 117                                 0, 0, 0 );
 118                         goto decoding_error;
 119                 }
 120
 121                 tag = ber_peek_tag( ber, &len);
 122         }
 123
 124         if( tag == LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW ) {
 125                 if( new == NULL ) {
 126                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: NEW not allowed.\n",
 127                                 0, 0, 0 );
 128                         *text = "user specified passwords disallowed";
 129                         rc = LDAP_UNWILLING_TO_PERFORM;
 130                         goto done;
 131                 }
 132
 133                 tag = ber_scanf( ber, "O", new );
 134
 135                 if( tag == LBER_ERROR ) {
 136                         Debug( LDAP_DEBUG_TRACE, "slap_passwd_parse: OLD parse failed.\n",
 137                                 0, 0, 0 );
 138                         goto decoding_error;
 139                 }
 140
 141                 tag = ber_peek_tag( ber, &len );
 142         }
 143
 144         if( len != 0 ) {
 145 decoding_error:
 146                 Debug( LDAP_DEBUG_TRACE,
 147                         "slap_passwd_parse: decoding error, len=%ld\n",
 148                         (long) len, 0, 0 );
 149
 150                 *text = ch_strdup("data decoding error");
 151                 rc = LDAP_PROTOCOL_ERROR;
 152         }
 153
 154 done:
 155         if( rc != LDAP_SUCCESS ) {
 156                 if( id != NULL ) {
 157                         ber_bvfree( *id );
 158                         *id = NULL;
 159                 }
 160
 161                 if( old != NULL ) {
 162                         ber_bvfree( *old );
 163                         *old = NULL;
 164                 }
 165
 166                 if( new != NULL ) {
 167                         ber_bvfree( *new );
 168                         *new = NULL;
 169                 }
 170         }
 171
 172         ber_free( ber, 1 );
 173         return rc;
 174 }
 175
 176 struct berval * slap_passwd_return(
 177         struct berval           *cred )
 178 {
 179         int rc;
 180         struct berval *bv;
 181         BerElement *ber = ber_alloc_t(LBER_USE_DER);
 182
 183         assert( cred != NULL );
 184
 185         Debug( LDAP_DEBUG_TRACE, "slap_passwd_return: %ld\n",
 186                 (long) cred->bv_len, 0, 0 );
 187
 188         if( ber == NULL ) return NULL;
 189
 190         rc = ber_printf( ber, "{tO}",
 191                 LDAP_TAG_EXOP_X_MODIFY_PASSWD_GEN, cred );
 192
 193         if( rc == -1 ) {
 194                 ber_free( ber, 1 );
 195                 return NULL;
 196         }
 197
 198         (void) ber_flatten( ber, &bv );
 199
 200         ber_free( ber, 1 );
 201
 202         return bv;
 203 }
 204
 205 int
 206 slap_passwd_check(
 207         Attribute *a,
 208         struct berval *cred )
 209 {
 210         int     i;
 211         for ( i = 0; a->a_vals[i] != NULL; i++ ) {
 212                 int result;
 213
 214 #ifdef SLAPD_CRYPT
 215                 ldap_pvt_thread_mutex_lock( &crypt_mutex );
 216 #endif
 217
 218                 result = lutil_passwd( a->a_vals[i], cred, NULL );
 219
 220 #ifdef SLAPD_CRYPT
 221                 ldap_pvt_thread_mutex_unlock( &crypt_mutex );
 222 #endif
 223
 224                 return result;
 225         }
 226
 227         return( 1 );
 228 }
 229
 230 struct berval * slap_passwd_generate( void )
 231 {
 232         Debug( LDAP_DEBUG_TRACE, "slap_passwd_generate\n", 0, 0, 0 );
 233
 234         /*
 235          * generate passwords of only 8 characters as some getpass(3)
 236          * implementations truncate at 8 characters.
 237          */
 238         return lutil_passwd_generate( 8 );
 239 }
 240
 241 struct berval * slap_passwd_hash(
 242         struct berval * cred )
 243 {
 244         char* hash = default_passwd_hash ? default_passwd_hash : "{SSHA}";
 245
 246         struct berval *new;
 247
 248 #ifdef SLAPD_CRYPT
 249         ldap_pvt_thread_mutex_lock( &crypt_mutex );
 250 #endif
 251
 252         new = lutil_passwd_hash( cred , hash );
 253
 254 #ifdef SLAPD_CRYPT
 255         ldap_pvt_thread_mutex_unlock( &crypt_mutex );
 256 #endif
 257
 258         return new;
 259 }