git.sur5r.net Git - openldap/blob - servers/slapd/sasl.c

   1 /* $OpenLDAP$ */
   2 /*
   3  * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
   4  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   5  */
   6
   7 #include "portable.h"
   8
   9 #include <ac/stdlib.h>
  10 #include <stdio.h>
  11
  12 #include "slap.h"
  13 #include "proto-slap.h"
  14
  15 #include <lber.h>
  16 #include <ldap_log.h>
  17
  18 #ifdef HAVE_CYRUS_SASL
  19 #include <limits.h>
  20 #include <sasl.h>
  21
  22 #include <ldap_pvt.h>
  23
  24 #ifdef SLAPD_SPASSWD
  25 #include <lutil.h>
  26 #endif
  27
  28 static char *sasl_host = NULL;
  29 static sasl_security_properties_t sasl_secprops;
  30
  31
  32 static int
  33 slap_sasl_log(
  34         void *context,
  35         int priority,
  36         const char *message)
  37 {
  38         Connection *conn = context;
  39         int level;
  40         const char * label;
  41
  42         if ( message == NULL ) {
  43                 return SASL_BADPARAM;
  44         }
  45
  46         switch (priority) {
  47         case SASL_LOG_ERR:
  48                 level = LDAP_DEBUG_ANY;
  49                 label = "Error";
  50                 break;
  51         case SASL_LOG_WARNING:
  52                 level = LDAP_DEBUG_TRACE;
  53                 label = "Warning";
  54                 break;
  55         case SASL_LOG_INFO:
  56                 level = LDAP_DEBUG_TRACE;
  57                 label = "Info";
  58                 break;
  59         default:
  60                 return SASL_BADPARAM;
  61         }
  62
  63         Debug( level, "SASL [conn=%d] %s: %s\n",
  64                 conn ? conn->c_connid: -1,
  65                 label, message );
  66
  67         return SASL_OK;
  68 }
  69
  70 static int
  71 slap_sasl_authorize(
  72         void *context,
  73         const char *authcid,
  74         const char *authzid,
  75         const char **user,
  76         const char **errstr)
  77 {
  78         Connection *conn = context;
  79
  80         *user = NULL;
  81
  82         if ( authcid == NULL || *authcid == '\0' ) {
  83                 *errstr = "empty authentication identity";
  84
  85                 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
  86                         "empty authentication identity\n",
  87                         (long) (conn ? conn->c_connid : -1),
  88                         0, 0 );
  89                 return SASL_BADAUTH;
  90         }
  91
  92         if ( authzid == NULL || *authzid == '\0' ||
  93                 strcmp( authcid, authzid ) == 0 )
  94         {
  95                 char* cuser;
  96                 size_t len = sizeof("u:") + strlen( authcid );
  97
  98                 cuser = ch_malloc( len );
  99                 strcpy( cuser, "u:" );
 100                 strcpy( &cuser[sizeof("u:")-1], authcid );
 101
 102                 *user = cuser;
 103
 104                 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 105                         "\"%s\" as \"%s\"\n",
 106                         (long) (conn ? conn->c_connid : -1),
 107                         authcid, cuser );
 108
 109                 return SASL_OK;
 110         }
 111
 112         Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
 113                 "\"%s\" as \"%s\" disallowed. No policy.\n",
 114                 (long) (conn ? conn->c_connid : -1),
 115                 authcid, authzid );
 116
 117         *errstr = "no proxy policy";
 118     return SASL_NOAUTHZ;
 119 }
 120
 121
 122 static int
 123 slap_sasl_err2ldap( int saslerr )
 124 {
 125         int rc;
 126
 127         switch (saslerr) {
 128                 case SASL_CONTINUE:
 129                         rc = LDAP_SASL_BIND_IN_PROGRESS;
 130                         break;
 131                 case SASL_FAIL:
 132                         rc = LDAP_OTHER;
 133                         break;
 134                 case SASL_NOMEM:
 135                         rc = LDAP_OTHER;
 136                         break;
 137                 case SASL_NOMECH:
 138                         rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 139                         break;
 140                 case SASL_BADAUTH:
 141                         rc = LDAP_INVALID_CREDENTIALS;
 142                         break;
 143                 case SASL_NOAUTHZ:
 144                         rc = LDAP_INSUFFICIENT_ACCESS;
 145                         break;
 146                 case SASL_TOOWEAK:
 147                 case SASL_ENCRYPT:
 148                         rc = LDAP_INAPPROPRIATE_AUTH;
 149                         break;
 150                 default:
 151                         rc = LDAP_OTHER;
 152                         break;
 153         }
 154
 155         return rc;
 156 }
 157 #endif
 158
 159
 160 int slap_sasl_init( void )
 161 {
 162 #ifdef HAVE_CYRUS_SASL
 163         int rc;
 164         sasl_conn_t *server = NULL;
 165         static sasl_callback_t server_callbacks[] = {
 166                 { SASL_CB_LOG, &slap_sasl_log, NULL },
 167                 { SASL_CB_LIST_END, NULL, NULL }
 168         };
 169
 170         sasl_set_alloc(
 171                 ch_malloc,
 172                 ch_calloc,
 173                 ch_realloc,
 174                 ch_free );
 175
 176         sasl_set_mutex(
 177                 ldap_pvt_sasl_mutex_new,
 178                 ldap_pvt_sasl_mutex_lock,
 179                 ldap_pvt_sasl_mutex_unlock,
 180                 ldap_pvt_sasl_mutex_dispose );
 181
 182         /* should provide callbacks for logging */
 183         /* server name should be configurable */
 184         rc = sasl_server_init( server_callbacks, "slapd" );
 185
 186         if( rc != SASL_OK ) {
 187                 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
 188                         0, 0, 0 );
 189                 return -1;
 190         }
 191
 192         if( sasl_host == NULL ) {
 193                 static char hostname[MAXHOSTNAMELEN+1];
 194
 195                 if( gethostname( hostname, MAXHOSTNAMELEN ) == 0 ) {
 196                         hostname[MAXHOSTNAMELEN] = '\0';
 197                         sasl_host = hostname;
 198                 }
 199         }
 200
 201         Debug( LDAP_DEBUG_TRACE,
 202                 "slap_sasl_init: %s initialized!\n",
 203                 sasl_host, 0, 0 );
 204
 205         /* default security properties */
 206         memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
 207     sasl_secprops.max_ssf = UINT_MAX;
 208     sasl_secprops.maxbufsize = 65536;
 209     sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
 210
 211 #ifdef SLAPD_SPASSWD
 212         lutil_passwd_sasl_conn = server;
 213 #else
 214         sasl_dispose( &server );
 215 #endif
 216
 217 #endif
 218         return 0;
 219 }
 220
 221 int slap_sasl_destroy( void )
 222 {
 223 #ifdef HAVE_CYRUS_SASL
 224 #ifdef SLAPD_SPASSWD
 225         sasl_dispose( &lutil_passwd_sasl_conn );
 226 #endif
 227         sasl_done();
 228 #endif
 229         return 0;
 230 }
 231
 232 int slap_sasl_open( Connection *conn )
 233 {
 234         int sc = LDAP_SUCCESS;
 235
 236 #ifdef HAVE_CYRUS_SASL
 237         sasl_conn_t *ctx = NULL;
 238         sasl_callback_t *session_callbacks;
 239
 240         assert( conn->c_sasl_context == NULL );
 241         assert( conn->c_sasl_extra == NULL );
 242
 243         session_callbacks =
 244                 ch_calloc( 3, sizeof(sasl_callback_t));
 245         conn->c_sasl_extra = session_callbacks;
 246
 247         session_callbacks[0].id = SASL_CB_LOG;
 248         session_callbacks[0].proc = &slap_sasl_log;
 249         session_callbacks[0].context = conn;
 250
 251         session_callbacks[1].id = SASL_CB_PROXY_POLICY;
 252         session_callbacks[1].proc = &slap_sasl_authorize;
 253         session_callbacks[1].context = conn;
 254
 255         session_callbacks[2].id = SASL_CB_LIST_END;
 256         session_callbacks[2].proc = NULL;
 257         session_callbacks[2].context = NULL;
 258
 259         /* create new SASL context */
 260         sc = sasl_server_new( "ldap", sasl_host, global_realm,
 261                 session_callbacks,
 262 #ifdef LDAP_SASL_SECURITY_LAYER
 263                 SASL_SECURITY_LAYER,
 264 #else
 265                 0,
 266 #endif
 267                 &ctx );
 268
 269
 270         if( sc != SASL_OK ) {
 271                 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
 272                         sc, 0, 0 );
 273                 return -1;
 274         }
 275
 276         conn->c_sasl_context = ctx;
 277
 278         if( sc == SASL_OK ) {
 279                 sc = sasl_setprop( ctx,
 280                         SASL_SEC_PROPS, &sasl_secprops );
 281
 282                 if( sc != SASL_OK ) {
 283                         Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
 284                                 sc, 0, 0 );
 285                         slap_sasl_close( conn );
 286                         return -1;
 287                 }
 288         }
 289
 290         sc = slap_sasl_err2ldap( sc );
 291 #endif
 292         return sc;
 293 }
 294
 295 int slap_sasl_external(
 296         Connection *conn,
 297         unsigned ssf,
 298         char *auth_id )
 299 {
 300 #ifdef HAVE_CYRUS_SASL
 301         int sc;
 302         sasl_conn_t *ctx = conn->c_sasl_context;
 303         sasl_external_properties_t extprops;
 304
 305         if ( ctx == NULL ) {
 306                 return LDAP_UNAVAILABLE;
 307         }
 308
 309         memset( &extprops, 0L, sizeof(extprops) );
 310         extprops.ssf = ssf;
 311         extprops.auth_id = auth_id;
 312
 313         sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
 314                 (void *) &extprops );
 315
 316         if ( sc != SASL_OK ) {
 317                 return LDAP_OTHER;
 318         }
 319 #endif
 320
 321         return LDAP_SUCCESS;
 322 }
 323
 324 int slap_sasl_reset( Connection *conn )
 325 {
 326 #ifdef HAVE_CYRUS_SASL
 327         sasl_conn_t *ctx = conn->c_sasl_context;
 328
 329         if( ctx != NULL ) {
 330         }
 331 #endif
 332         /* must return "anonymous" */
 333         return LDAP_SUCCESS;
 334 }
 335
 336 char ** slap_sasl_mechs( Connection *conn )
 337 {
 338         char **mechs = NULL;
 339
 340 #ifdef HAVE_CYRUS_SASL
 341         sasl_conn_t *ctx = conn->c_sasl_context;
 342
 343         if( ctx != NULL ) {
 344                 int sc;
 345                 char *mechstr;
 346
 347                 sc = sasl_listmech( ctx,
 348                         NULL, NULL, ",", NULL,
 349                         &mechstr, NULL, NULL );
 350
 351                 if( sc != SASL_OK ) {
 352                         Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
 353                                 sc, 0, 0 );
 354                         return NULL;
 355                 }
 356
 357                 mechs = str2charray( mechstr, "," );
 358
 359                 ch_free( mechstr );
 360         }
 361 #endif
 362
 363         return mechs;
 364 }
 365
 366 int slap_sasl_close( Connection *conn )
 367 {
 368 #ifdef HAVE_CYRUS_SASL
 369         sasl_conn_t *ctx = conn->c_sasl_context;
 370
 371         if( ctx != NULL ) {
 372                 sasl_dispose( &ctx );
 373         }
 374
 375         conn->c_sasl_context = NULL;
 376
 377         free( conn->c_sasl_extra );
 378         conn->c_sasl_extra = NULL;
 379 #endif
 380
 381         return LDAP_SUCCESS;
 382 }
 383
 384 int slap_sasl_bind(
 385     Connection          *conn,
 386     Operation           *op,
 387     const char          *dn,
 388     const char          *ndn,
 389     const char          *mech,
 390     struct berval       *cred,
 391         char                            **edn )
 392 {
 393         int rc = 1;
 394
 395 #ifdef HAVE_CYRUS_SASL
 396         sasl_conn_t *ctx = conn->c_sasl_context;
 397         struct berval response;
 398         unsigned reslen;
 399         const char *errstr;
 400         int sc;
 401
 402         Debug(LDAP_DEBUG_ARGS,
 403                 "==> sasl_bind: dn=\"%s\" mech=%s cred->bv_len=%d\n",
 404                 dn, mech ? mech : "<continuing>", cred ? cred->bv_len : 0 );
 405
 406         if( ctx == NULL ) {
 407                 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
 408                         NULL, "SASL unavailable on this session", NULL, NULL );
 409                 return rc;
 410         }
 411
 412         if ( mech != NULL ) {
 413                 sc = sasl_server_start( ctx,
 414                         mech,
 415                         cred->bv_val, cred->bv_len,
 416                         (char **)&response.bv_val, &reslen, &errstr );
 417
 418         } else {
 419                 sc = sasl_server_step( ctx,
 420                         cred->bv_val, cred->bv_len,
 421                         (char **)&response.bv_val, &reslen, &errstr );
 422         }
 423
 424         response.bv_len = reslen;
 425
 426         if ( sc == SASL_OK ) {
 427                 char *username = NULL;
 428
 429                 sc = sasl_getprop( ctx,
 430                         SASL_USERNAME, (void **)&username );
 431
 432                 if ( sc != SASL_OK ) {
 433                         Debug(LDAP_DEBUG_TRACE,
 434                                 "slap_sasl_bind: getprop(USERNAME) failed!\n",
 435                                 0, 0, 0);
 436
 437                         send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
 438                                 NULL, "no SASL username", NULL, NULL );
 439
 440                 } else if ( username == NULL || *username == '\0' ) {
 441                         Debug(LDAP_DEBUG_TRACE,
 442                                 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
 443                                 0, 0, 0);
 444
 445                         send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
 446                                 NULL, "no SASL username", NULL, NULL );
 447
 448                 } else {
 449                         char *realm = NULL;
 450                         sasl_ssf_t *ssf = NULL;
 451
 452                         (void) sasl_getprop( ctx,
 453                                 SASL_REALM, (void **)&realm );
 454
 455                         (void) sasl_getprop( ctx,
 456                                 SASL_SSF, (void *)&ssf );
 457
 458                         Debug(LDAP_DEBUG_TRACE,
 459                                 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
 460                                 username ? username : "",
 461                                 realm ? realm : "",
 462                                 (unsigned long) ( ssf ? *ssf : 0 ) );
 463
 464                         if( !strncasecmp( username, "anonymous", sizeof("anonyous")-1 ) &&
 465                                 ( ( username[sizeof("anonymous")] == '\0' ) ||
 466                                   ( username[sizeof("anonymous")] == '@' ) ) )
 467                         {
 468                                 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
 469                                         0, 0, 0);
 470
 471                         } else {
 472                                 *edn = ch_malloc( sizeof( "uid= + realm=" )
 473                                         + ( username ? strlen( username ) : 0 )
 474                                         + ( realm ? strlen( realm ) : 0 ) );
 475
 476                                 strcpy( *edn, "uid=" );
 477                                 strcat( *edn, username );
 478
 479                                 if( realm && *realm ) {
 480                                         strcat( *edn, " + realm=" );
 481                                         strcat( *edn, realm );
 482                                 }
 483
 484                                 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: authzdn: \"%s\"\n",
 485                                         *edn, 0, 0);
 486                         }
 487
 488                         send_ldap_sasl( conn, op, rc = LDAP_SUCCESS,
 489                                 NULL, NULL, NULL, NULL,
 490                                 response.bv_len ? &response : NULL );
 491                 }
 492
 493         } else if ( sc == SASL_CONTINUE ) {
 494                 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
 495                         NULL, NULL, NULL, NULL,  &response );
 496
 497         } else {
 498                 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
 499                         NULL, errstr, NULL, NULL );
 500         }
 501
 502         Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
 503
 504 #else
 505         send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
 506                 NULL, "SASL not supported", NULL, NULL );
 507 #endif
 508
 509         return rc;
 510 }
 511
 512 char* slap_sasl_secprops( const char *in )
 513 {
 514 #ifdef HAVE_CYRUS_SASL
 515         int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
 516
 517         return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
 518 #else
 519         return "SASL not supported";
 520 #endif
 521 }
 522