3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include "proto-slap.h"
18 #ifdef HAVE_CYRUS_SASL
28 static char *sasl_host = NULL;
29 static sasl_security_properties_t sasl_secprops;
38 Connection *conn = context;
42 if ( message == NULL ) {
48 level = LDAP_DEBUG_ANY;
51 case SASL_LOG_WARNING:
52 level = LDAP_DEBUG_TRACE;
56 level = LDAP_DEBUG_TRACE;
63 Debug( level, "SASL [conn=%d] %s: %s\n",
64 conn ? conn->c_connid: -1,
78 Connection *conn = context;
82 if ( authcid == NULL || *authcid == '\0' ) {
83 *errstr = "empty authentication identity";
85 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
86 "empty authentication identity\n",
87 (long) (conn ? conn->c_connid : -1),
92 Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
93 "authcid=\"%s\" authzid=\"%s\"\n",
94 (long) (conn ? conn->c_connid : -1),
95 authcid ? authcid : "<empty>",
96 authcid ? authcid : "<empty>" );
98 if ( authzid == NULL || *authzid == '\0' ||
99 strcmp( authcid, authzid ) == 0 )
102 size_t len = sizeof("u:") + strlen( authcid );
104 cuser = ch_malloc( len );
105 strcpy( cuser, "u:" );
106 strcpy( &cuser[sizeof("u:")-1], authcid );
110 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
111 "\"%s\" as \"%s\"\n",
112 (long) (conn ? conn->c_connid : -1),
118 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
119 "\"%s\" as \"%s\" disallowed. No policy.\n",
120 (long) (conn ? conn->c_connid : -1),
123 *errstr = "no proxy policy";
129 slap_sasl_err2ldap( int saslerr )
135 rc = LDAP_SASL_BIND_IN_PROGRESS;
144 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
147 rc = LDAP_INVALID_CREDENTIALS;
150 rc = LDAP_INSUFFICIENT_ACCESS;
154 rc = LDAP_INAPPROPRIATE_AUTH;
166 int slap_sasl_init( void )
168 #ifdef HAVE_CYRUS_SASL
170 sasl_conn_t *server = NULL;
171 static sasl_callback_t server_callbacks[] = {
172 { SASL_CB_LOG, &slap_sasl_log, NULL },
173 { SASL_CB_LIST_END, NULL, NULL }
183 ldap_pvt_sasl_mutex_new,
184 ldap_pvt_sasl_mutex_lock,
185 ldap_pvt_sasl_mutex_unlock,
186 ldap_pvt_sasl_mutex_dispose );
188 /* should provide callbacks for logging */
189 /* server name should be configurable */
190 rc = sasl_server_init( server_callbacks, "slapd" );
192 if( rc != SASL_OK ) {
193 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
198 if( sasl_host == NULL ) {
199 static char hostname[MAXHOSTNAMELEN+1];
201 if( gethostname( hostname, MAXHOSTNAMELEN ) == 0 ) {
202 hostname[MAXHOSTNAMELEN] = '\0';
203 sasl_host = hostname;
207 Debug( LDAP_DEBUG_TRACE,
208 "slap_sasl_init: %s initialized!\n",
211 /* default security properties */
212 memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
213 sasl_secprops.max_ssf = UINT_MAX;
214 sasl_secprops.maxbufsize = 65536;
215 sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
218 lutil_passwd_sasl_conn = server;
220 sasl_dispose( &server );
227 int slap_sasl_destroy( void )
229 #ifdef HAVE_CYRUS_SASL
231 sasl_dispose( &lutil_passwd_sasl_conn );
238 int slap_sasl_open( Connection *conn )
240 int sc = LDAP_SUCCESS;
242 #ifdef HAVE_CYRUS_SASL
243 sasl_conn_t *ctx = NULL;
244 sasl_callback_t *session_callbacks;
246 assert( conn->c_sasl_context == NULL );
247 assert( conn->c_sasl_extra == NULL );
249 conn->c_sasl_layers = 0;
252 ch_calloc( 3, sizeof(sasl_callback_t));
253 conn->c_sasl_extra = session_callbacks;
255 session_callbacks[0].id = SASL_CB_LOG;
256 session_callbacks[0].proc = &slap_sasl_log;
257 session_callbacks[0].context = conn;
259 session_callbacks[1].id = SASL_CB_PROXY_POLICY;
260 session_callbacks[1].proc = &slap_sasl_authorize;
261 session_callbacks[1].context = conn;
263 session_callbacks[2].id = SASL_CB_LIST_END;
264 session_callbacks[2].proc = NULL;
265 session_callbacks[2].context = NULL;
267 /* create new SASL context */
268 sc = sasl_server_new( "ldap", sasl_host, global_realm,
269 session_callbacks, SASL_SECURITY_LAYER, &ctx );
271 if( sc != SASL_OK ) {
272 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
277 conn->c_sasl_context = ctx;
279 if( sc == SASL_OK ) {
280 sc = sasl_setprop( ctx,
281 SASL_SEC_PROPS, &sasl_secprops );
283 if( sc != SASL_OK ) {
284 Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
286 slap_sasl_close( conn );
291 sc = slap_sasl_err2ldap( sc );
296 int slap_sasl_external(
301 #ifdef HAVE_CYRUS_SASL
303 sasl_conn_t *ctx = conn->c_sasl_context;
304 sasl_external_properties_t extprops;
307 return LDAP_UNAVAILABLE;
310 memset( &extprops, 0L, sizeof(extprops) );
312 extprops.auth_id = auth_id;
314 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
315 (void *) &extprops );
317 if ( sc != SASL_OK ) {
325 int slap_sasl_reset( Connection *conn )
327 #ifdef HAVE_CYRUS_SASL
328 sasl_conn_t *ctx = conn->c_sasl_context;
333 /* must return "anonymous" */
337 char ** slap_sasl_mechs( Connection *conn )
341 #ifdef HAVE_CYRUS_SASL
342 sasl_conn_t *ctx = conn->c_sasl_context;
348 sc = sasl_listmech( ctx,
349 NULL, NULL, ",", NULL,
350 &mechstr, NULL, NULL );
352 if( sc != SASL_OK ) {
353 Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
358 mechs = str2charray( mechstr, "," );
367 int slap_sasl_close( Connection *conn )
369 #ifdef HAVE_CYRUS_SASL
370 sasl_conn_t *ctx = conn->c_sasl_context;
373 sasl_dispose( &ctx );
376 conn->c_sasl_context = NULL;
378 free( conn->c_sasl_extra );
379 conn->c_sasl_extra = NULL;
393 unsigned long *ssfp )
397 #ifdef HAVE_CYRUS_SASL
398 sasl_conn_t *ctx = conn->c_sasl_context;
399 struct berval response;
404 Debug(LDAP_DEBUG_ARGS,
405 "==> sasl_bind: dn=\"%s\" mech=%s datalen=%d\n",
406 dn, mech ? mech : "<continuing>", cred ? cred->bv_len : 0 );
409 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
410 NULL, "SASL unavailable on this session", NULL, NULL );
414 if ( mech != NULL ) {
415 sc = sasl_server_start( ctx,
417 cred->bv_val, cred->bv_len,
418 (char **)&response.bv_val, &reslen, &errstr );
421 sc = sasl_server_step( ctx,
422 cred->bv_val, cred->bv_len,
423 (char **)&response.bv_val, &reslen, &errstr );
426 response.bv_len = reslen;
428 if ( sc == SASL_OK ) {
429 char *username = NULL;
431 sc = sasl_getprop( ctx,
432 SASL_USERNAME, (void **)&username );
434 if ( sc != SASL_OK ) {
435 Debug(LDAP_DEBUG_TRACE,
436 "slap_sasl_bind: getprop(USERNAME) failed!\n",
439 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
440 NULL, "no SASL username", NULL, NULL );
442 } else if ( username == NULL || *username == '\0' ) {
443 Debug(LDAP_DEBUG_TRACE,
444 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
447 send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
448 NULL, "no SASL username", NULL, NULL );
452 sasl_ssf_t *ssf = NULL;
454 (void) sasl_getprop( ctx,
455 SASL_REALM, (void **)&realm );
457 (void) sasl_getprop( ctx,
458 SASL_SSF, (void *)&ssf );
460 Debug(LDAP_DEBUG_TRACE,
461 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
462 username ? username : "",
464 (unsigned long) ( ssf ? *ssf : 0 ) );
466 *ssfp = ssf ? *ssf : 0;
470 if( username == NULL || (
471 !strncasecmp( username, "anonymous", sizeof("anonyous")-1 ) &&
472 ( ( username[sizeof("anonymous")] == '\0' ) ||
473 ( username[sizeof("anonymous")] == '@' ) ) ) )
475 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
478 } else if ( username[0] == 'u' && username[1] == ':'
479 && username[2] != '\0'
480 && strpbrk( &username[2], "=,;\"\\") == NULL )
482 *edn = ch_malloc( sizeof( "uid= + realm=" )
483 + strlen( &username[2] )
484 + ( realm ? strlen( realm ) : 0 ) );
486 strcpy( *edn, "uid=" );
487 strcat( *edn, &username[2] );
489 if( realm && *realm ) {
490 strcat( *edn, " + realm=" );
491 strcat( *edn, realm );
494 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: authzdn: \"%s\"\n",
498 rc = LDAP_INAPPROPRIATE_AUTH;
499 errstr = "authorization disallowed";
500 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: %s\n",
504 if( rc == LDAP_SUCCESS ) {
505 send_ldap_sasl( conn, op, rc,
506 NULL, NULL, NULL, NULL,
507 response.bv_len ? &response : NULL );
510 send_ldap_result( conn, op, rc,
511 NULL, errstr, NULL, NULL );
515 } else if ( sc == SASL_CONTINUE ) {
516 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
517 NULL, NULL, NULL, NULL, &response );
520 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
521 NULL, errstr, NULL, NULL );
524 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
527 send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
528 NULL, "SASL not supported", NULL, NULL );
534 char* slap_sasl_secprops( const char *in )
536 #ifdef HAVE_CYRUS_SASL
537 int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
539 return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
541 return "SASL not supported";