3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include "proto-slap.h"
18 #ifdef HAVE_CYRUS_SASL
28 static char *sasl_host = NULL;
29 static sasl_security_properties_t sasl_secprops;
38 Connection *conn = context;
42 if ( message == NULL ) {
48 level = LDAP_DEBUG_ANY;
51 case SASL_LOG_WARNING:
52 level = LDAP_DEBUG_TRACE;
56 level = LDAP_DEBUG_TRACE;
63 Debug( level, "SASL [conn=%d] %s: %s\n",
64 conn ? conn->c_connid: -1,
72 slap_sasl_err2ldap( int saslerr )
78 rc = LDAP_SASL_BIND_IN_PROGRESS;
87 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
90 rc = LDAP_INVALID_CREDENTIALS;
93 rc = LDAP_INSUFFICIENT_ACCESS;
97 rc = LDAP_INAPPROPRIATE_AUTH;
109 int slap_sasl_init( void )
111 #ifdef HAVE_CYRUS_SASL
113 sasl_conn_t *server = NULL;
114 sasl_callback_t server_callbacks[] = {
115 { SASL_CB_LOG, &sasl_cb_log, NULL },
116 { SASL_CB_LIST_END, NULL, NULL }
126 ldap_pvt_sasl_mutex_new,
127 ldap_pvt_sasl_mutex_lock,
128 ldap_pvt_sasl_mutex_unlock,
129 ldap_pvt_sasl_mutex_dispose );
131 /* should provide callbacks for logging */
132 /* server name should be configurable */
133 rc = sasl_server_init( server_callbacks, "slapd" );
135 if( rc != SASL_OK ) {
136 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
141 if( sasl_host == NULL ) {
142 static char hostname[MAXHOSTNAMELEN+1];
144 if( gethostname( hostname, MAXHOSTNAMELEN ) == 0 ) {
145 hostname[MAXHOSTNAMELEN] = '\0';
146 sasl_host = hostname;
150 Debug( LDAP_DEBUG_TRACE,
151 "slap_sasl_init: %s initialized!\n",
154 /* default security properties */
155 memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
156 sasl_secprops.max_ssf = UINT_MAX;
157 sasl_secprops.maxbufsize = 65536;
158 sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
161 lutil_passwd_sasl_conn = server;
163 sasl_dispose( &server );
170 int slap_sasl_destroy( void )
172 #ifdef HAVE_CYRUS_SASL
174 sasl_dispose( &lutil_passwd_sasl_conn );
181 int slap_sasl_open( Connection *conn )
183 int sc = LDAP_SUCCESS;
185 #ifdef HAVE_CYRUS_SASL
186 sasl_conn_t *ctx = NULL;
187 sasl_callback_t session_callbacks[] = {
188 { SASL_CB_LOG, &sasl_cb_log, conn },
189 { SASL_CB_LIST_END, NULL, NULL }
192 /* create new SASL context */
193 sc = sasl_server_new( "ldap", sasl_host, global_realm,
195 #ifdef LDAP_SASL_SECURITY_LAYER
203 if( sc != SASL_OK ) {
204 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
209 conn->c_sasl_context = ctx;
211 if( sc == SASL_OK ) {
212 sc = sasl_setprop( ctx,
213 SASL_SEC_PROPS, &sasl_secprops );
215 if( sc != SASL_OK ) {
216 Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
218 slap_sasl_close( conn );
223 sc = slap_sasl_err2ldap( sc );
228 int slap_sasl_external(
233 #ifdef HAVE_CYRUS_SASL
235 sasl_conn_t *ctx = conn->c_sasl_context;
236 sasl_external_properties_t extprops;
239 return LDAP_UNAVAILABLE;
242 memset( &extprops, 0L, sizeof(extprops) );
244 extprops.auth_id = auth_id;
246 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
247 (void *) &extprops );
249 if ( sc != SASL_OK ) {
257 int slap_sasl_reset( Connection *conn )
259 #ifdef HAVE_CYRUS_SASL
260 sasl_conn_t *ctx = conn->c_sasl_context;
265 /* must return "anonymous" */
269 char ** slap_sasl_mechs( Connection *conn )
273 #ifdef HAVE_CYRUS_SASL
274 sasl_conn_t *ctx = conn->c_sasl_context;
280 sc = sasl_listmech( ctx,
281 NULL, NULL, ",", NULL,
282 &mechstr, NULL, NULL );
284 if( sc != SASL_OK ) {
285 Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
290 mechs = str2charray( mechstr, "," );
299 int slap_sasl_close( Connection *conn )
301 #ifdef HAVE_CYRUS_SASL
302 sasl_conn_t *ctx = conn->c_sasl_context;
305 sasl_dispose( &ctx );
308 conn->c_sasl_context = NULL;
324 #ifdef HAVE_CYRUS_SASL
325 sasl_conn_t *ctx = conn->c_sasl_context;
326 struct berval response;
331 Debug(LDAP_DEBUG_ARGS,
332 "==> sasl_bind: dn=\"%s\" mech=%s cred->bv_len=%d\n",
333 dn, mech, cred ? cred->bv_len : 0 );
336 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
337 NULL, "SASL unavailable on this session", NULL, NULL );
341 if ( mech != NULL ) {
342 sc = sasl_server_start( ctx,
344 cred->bv_val, cred->bv_len,
345 (char **)&response.bv_val, &reslen, &errstr );
348 sc = sasl_server_step( ctx,
349 cred->bv_val, cred->bv_len,
350 (char **)&response.bv_val, &reslen, &errstr );
353 response.bv_len = reslen;
355 if ( sc == SASL_OK ) {
356 char *username = NULL;
358 sc = sasl_getprop( ctx,
359 SASL_USERNAME, (void **)&username );
361 if ( sc != SASL_OK ) {
362 Debug(LDAP_DEBUG_TRACE,
363 "slap_sasl_bind: getprop(USERNAME) failed!\n",
366 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
367 NULL, "no SASL username", NULL, NULL );
369 } else if ( username == NULL || *username == '\0' ) {
370 Debug(LDAP_DEBUG_TRACE,
371 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
374 send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
375 NULL, "no SASL username", NULL, NULL );
381 (void) sasl_getprop( ctx,
382 SASL_REALM, (void **)&realm );
384 (void) sasl_getprop( ctx,
385 SASL_SSF, (void *)&ssf );
387 Debug(LDAP_DEBUG_TRACE,
388 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
389 username ? username : "",
391 (unsigned long) ssf );
393 if( !strncasecmp( username, "anonymous", sizeof("anonyous")-1 ) &&
394 ( ( username[sizeof("anonymous")] == '\0' ) ||
395 ( username[sizeof("anonymous")] == '@' ) ) )
397 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
401 *edn = ch_malloc( sizeof( "uid= + realm=" )
402 + ( username ? strlen( username ) : 0 )
403 + ( realm ? strlen( realm ) : 0 ) );
405 strcpy( *edn, "uid=" );
406 strcat( *edn, username );
408 if( realm && *realm ) {
409 strcat( *edn, " + realm=" );
410 strcat( *edn, realm );
413 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: authzdn: \"%s\"\n",
417 send_ldap_sasl( conn, op, rc = LDAP_SUCCESS,
418 NULL, NULL, NULL, NULL, &response );
421 } else if ( sc == SASL_CONTINUE ) {
422 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
423 NULL, NULL, NULL, NULL, &response );
426 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
427 NULL, errstr, NULL, NULL );
430 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
433 send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
434 NULL, "SASL not supported", NULL, NULL );
440 char* slap_sasl_secprops( const char *in )
442 #ifdef HAVE_CYRUS_SASL
443 int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
445 return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
447 return "SASL not supported";