3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include "proto-slap.h"
18 #ifdef HAVE_CYRUS_SASL
28 static sasl_security_properties_t sasl_secprops;
37 Connection *conn = context;
41 if ( message == NULL ) {
47 level = LDAP_DEBUG_ANY;
50 case SASL_LOG_WARNING:
51 level = LDAP_DEBUG_TRACE;
55 level = LDAP_DEBUG_TRACE;
62 Debug( level, "SASL [conn=%d] %s: %s\n",
63 conn ? conn->c_connid: -1,
77 Connection *conn = context;
81 if ( authcid == NULL || *authcid == '\0' ) {
82 *errstr = "empty authentication identity";
84 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
85 "empty authentication identity\n",
86 (long) (conn ? conn->c_connid : -1),
91 Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
92 "authcid=\"%s\" authzid=\"%s\"\n",
93 (long) (conn ? conn->c_connid : -1),
94 authcid ? authcid : "<empty>",
95 authcid ? authcid : "<empty>" );
97 if ( authzid == NULL || *authzid == '\0' ||
98 strcmp( authcid, authzid ) == 0 )
101 size_t len = sizeof("u:") + strlen( authcid );
103 cuser = ch_malloc( len );
104 strcpy( cuser, "u:" );
105 strcpy( &cuser[sizeof("u:")-1], authcid );
109 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
110 "\"%s\" as \"%s\"\n",
111 (long) (conn ? conn->c_connid : -1),
117 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
118 "\"%s\" as \"%s\" disallowed. No policy.\n",
119 (long) (conn ? conn->c_connid : -1),
122 *errstr = "no proxy policy";
128 slap_sasl_err2ldap( int saslerr )
134 rc = LDAP_SASL_BIND_IN_PROGRESS;
143 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
146 rc = LDAP_INVALID_CREDENTIALS;
149 rc = LDAP_INSUFFICIENT_ACCESS;
153 rc = LDAP_INAPPROPRIATE_AUTH;
165 int slap_sasl_init( void )
167 #ifdef HAVE_CYRUS_SASL
169 sasl_conn_t *server = NULL;
170 static sasl_callback_t server_callbacks[] = {
171 { SASL_CB_LOG, &slap_sasl_log, NULL },
172 { SASL_CB_LIST_END, NULL, NULL }
182 ldap_pvt_sasl_mutex_new,
183 ldap_pvt_sasl_mutex_lock,
184 ldap_pvt_sasl_mutex_unlock,
185 ldap_pvt_sasl_mutex_dispose );
187 /* should provide callbacks for logging */
188 /* server name should be configurable */
189 rc = sasl_server_init( server_callbacks, "slapd" );
191 if( rc != SASL_OK ) {
192 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
197 Debug( LDAP_DEBUG_TRACE, "slap_sasl_init: initialized!\n",
200 /* default security properties */
201 memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
202 sasl_secprops.max_ssf = INT_MAX;
203 sasl_secprops.maxbufsize = 65536;
204 sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
206 sasl_dispose( &server );
212 int slap_sasl_destroy( void )
214 #ifdef HAVE_CYRUS_SASL
220 int slap_sasl_open( Connection *conn )
222 int sc = LDAP_SUCCESS;
224 #ifdef HAVE_CYRUS_SASL
225 sasl_conn_t *ctx = NULL;
226 sasl_callback_t *session_callbacks;
228 assert( conn->c_sasl_context == NULL );
229 assert( conn->c_sasl_extra == NULL );
231 conn->c_sasl_layers = 0;
234 ch_calloc( 3, sizeof(sasl_callback_t));
235 conn->c_sasl_extra = session_callbacks;
237 session_callbacks[0].id = SASL_CB_LOG;
238 session_callbacks[0].proc = &slap_sasl_log;
239 session_callbacks[0].context = conn;
241 session_callbacks[1].id = SASL_CB_PROXY_POLICY;
242 session_callbacks[1].proc = &slap_sasl_authorize;
243 session_callbacks[1].context = conn;
245 session_callbacks[2].id = SASL_CB_LIST_END;
246 session_callbacks[2].proc = NULL;
247 session_callbacks[2].context = NULL;
249 if( global_host == NULL ) {
250 global_host = ldap_pvt_get_fqdn( NULL );
253 /* create new SASL context */
254 sc = sasl_server_new( "ldap", global_host, global_realm,
255 session_callbacks, SASL_SECURITY_LAYER, &ctx );
257 if( sc != SASL_OK ) {
258 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
263 conn->c_sasl_context = ctx;
265 if( sc == SASL_OK ) {
266 sc = sasl_setprop( ctx,
267 SASL_SEC_PROPS, &sasl_secprops );
269 if( sc != SASL_OK ) {
270 Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
272 slap_sasl_close( conn );
277 sc = slap_sasl_err2ldap( sc );
282 int slap_sasl_external(
287 #ifdef HAVE_CYRUS_SASL
289 sasl_conn_t *ctx = conn->c_sasl_context;
290 sasl_external_properties_t extprops;
293 return LDAP_UNAVAILABLE;
296 memset( &extprops, '\0', sizeof(extprops) );
298 extprops.auth_id = auth_id;
300 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
301 (void *) &extprops );
303 if ( sc != SASL_OK ) {
311 int slap_sasl_reset( Connection *conn )
313 #ifdef HAVE_CYRUS_SASL
314 sasl_conn_t *ctx = conn->c_sasl_context;
319 /* must return "anonymous" */
323 char ** slap_sasl_mechs( Connection *conn )
327 #ifdef HAVE_CYRUS_SASL
328 sasl_conn_t *ctx = conn->c_sasl_context;
334 sc = sasl_listmech( ctx,
335 NULL, NULL, ",", NULL,
336 &mechstr, NULL, NULL );
338 if( sc != SASL_OK ) {
339 Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
344 mechs = str2charray( mechstr, "," );
353 int slap_sasl_close( Connection *conn )
355 #ifdef HAVE_CYRUS_SASL
356 sasl_conn_t *ctx = conn->c_sasl_context;
359 sasl_dispose( &ctx );
362 conn->c_sasl_context = NULL;
364 free( conn->c_sasl_extra );
365 conn->c_sasl_extra = NULL;
383 #ifdef HAVE_CYRUS_SASL
384 sasl_conn_t *ctx = conn->c_sasl_context;
385 struct berval response;
390 Debug(LDAP_DEBUG_ARGS,
391 "==> sasl_bind: dn=\"%s\" mech=%s datalen=%d\n",
392 dn, mech ? mech : "<continuing>", cred ? cred->bv_len : 0 );
395 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
396 NULL, "SASL unavailable on this session", NULL, NULL );
400 if ( mech != NULL ) {
401 sc = sasl_server_start( ctx,
403 cred->bv_val, cred->bv_len,
404 (char **)&response.bv_val, &reslen, &errstr );
407 sc = sasl_server_step( ctx,
408 cred->bv_val, cred->bv_len,
409 (char **)&response.bv_val, &reslen, &errstr );
412 response.bv_len = reslen;
414 if ( sc == SASL_OK ) {
415 char *username = NULL;
417 sc = sasl_getprop( ctx,
418 SASL_USERNAME, (void **)&username );
420 if ( sc != SASL_OK ) {
421 Debug(LDAP_DEBUG_TRACE,
422 "slap_sasl_bind: getprop(USERNAME) failed!\n",
425 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
426 NULL, "no SASL username", NULL, NULL );
428 } else if ( username == NULL || *username == '\0' ) {
429 Debug(LDAP_DEBUG_TRACE,
430 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
433 send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
434 NULL, "no SASL username", NULL, NULL );
438 sasl_ssf_t *ssf = NULL;
440 (void) sasl_getprop( ctx,
441 SASL_REALM, (void **)&realm );
443 (void) sasl_getprop( ctx,
444 SASL_SSF, (void *)&ssf );
446 Debug(LDAP_DEBUG_TRACE,
447 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
448 username ? username : "",
450 (unsigned long) ( ssf ? *ssf : 0 ) );
452 *ssfp = ssf ? *ssf : 0;
456 if( username == NULL || (
457 !strncasecmp( username, "anonymous", sizeof("anonymous")-1 ) &&
458 ( username[sizeof("anonymous")-1] == '\0' ||
459 username[sizeof("anonymous")-1] == '@' ) ) )
461 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
464 } else if ( username[0] == 'u' && username[1] == ':'
465 && username[2] != '\0'
466 && strpbrk( &username[2], "+=,;\"\\ \t") == NULL )
468 *edn = ch_malloc( sizeof( "uid= + realm=" )
469 + strlen( &username[2] )
470 + ( realm ? strlen( realm ) : 0 ) );
472 strcpy( *edn, "uid=" );
473 strcat( *edn, &username[2] );
475 if( realm && *realm ) {
476 strcat( *edn, " + realm=" );
477 strcat( *edn, realm );
480 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: authzdn: \"%s\"\n",
484 rc = LDAP_INAPPROPRIATE_AUTH;
485 errstr = "authorization disallowed";
486 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: %s\n",
490 if( rc == LDAP_SUCCESS ) {
491 send_ldap_sasl( conn, op, rc,
492 NULL, NULL, NULL, NULL,
493 response.bv_len ? &response : NULL );
496 send_ldap_result( conn, op, rc,
497 NULL, errstr, NULL, NULL );
501 } else if ( sc == SASL_CONTINUE ) {
502 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
503 NULL, NULL, NULL, NULL, &response );
506 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
507 NULL, errstr, NULL, NULL );
510 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
513 send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
514 NULL, "SASL not supported", NULL, NULL );
520 char* slap_sasl_secprops( const char *in )
522 #ifdef HAVE_CYRUS_SASL
523 int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
525 return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
527 return "SASL not supported";