3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include "proto-slap.h"
18 #ifdef HAVE_CYRUS_SASL
28 static char *sasl_host = NULL;
29 static sasl_security_properties_t sasl_secprops;
38 Connection *conn = context;
42 if ( message == NULL ) {
48 level = LDAP_DEBUG_ANY;
51 case SASL_LOG_WARNING:
52 level = LDAP_DEBUG_TRACE;
56 level = LDAP_DEBUG_TRACE;
63 Debug( level, "SASL [conn=%d] %s: %s\n",
64 conn ? conn->c_connid: -1,
78 Connection *conn = context;
81 if ( authcid == NULL || *authcid == '\0' ) {
82 *errstr = "empty authentication identity";
84 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
85 "empty authentication identity\n",
86 (long) (conn ? conn->c_connid : -1),
91 if ( authzid == NULL || *authzid == '\0' ||
92 strcmp( authcid, authzid ) == 0 )
94 size_t len = sizeof("u:") + strlen( authcid );
95 canon = ch_malloc( len );
96 strcpy( canon, "u:" );
97 strcpy( &canon[sizeof("u:")-1], authcid );
101 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
102 "\"%s\" as \"%s\"\n",
103 (long) (conn ? conn->c_connid : -1),
108 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
109 "\"%s\" as \"%s\" disallowed. No policy.\n",
110 (long) (conn ? conn->c_connid : -1),
113 *errstr = "no proxy policy";
119 slap_sasl_err2ldap( int saslerr )
125 rc = LDAP_SASL_BIND_IN_PROGRESS;
134 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
137 rc = LDAP_INVALID_CREDENTIALS;
140 rc = LDAP_INSUFFICIENT_ACCESS;
144 rc = LDAP_INAPPROPRIATE_AUTH;
156 int slap_sasl_init( void )
158 #ifdef HAVE_CYRUS_SASL
160 sasl_conn_t *server = NULL;
161 static sasl_callback_t server_callbacks[] = {
162 { SASL_CB_LOG, &sasl_cb_log, NULL },
163 { SASL_CB_LIST_END, NULL, NULL }
173 ldap_pvt_sasl_mutex_new,
174 ldap_pvt_sasl_mutex_lock,
175 ldap_pvt_sasl_mutex_unlock,
176 ldap_pvt_sasl_mutex_dispose );
178 /* should provide callbacks for logging */
179 /* server name should be configurable */
180 rc = sasl_server_init( server_callbacks, "slapd" );
182 if( rc != SASL_OK ) {
183 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
188 if( sasl_host == NULL ) {
189 static char hostname[MAXHOSTNAMELEN+1];
191 if( gethostname( hostname, MAXHOSTNAMELEN ) == 0 ) {
192 hostname[MAXHOSTNAMELEN] = '\0';
193 sasl_host = hostname;
197 Debug( LDAP_DEBUG_TRACE,
198 "slap_sasl_init: %s initialized!\n",
201 /* default security properties */
202 memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
203 sasl_secprops.max_ssf = UINT_MAX;
204 sasl_secprops.maxbufsize = 65536;
205 sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
208 lutil_passwd_sasl_conn = server;
210 sasl_dispose( &server );
217 int slap_sasl_destroy( void )
219 #ifdef HAVE_CYRUS_SASL
221 sasl_dispose( &lutil_passwd_sasl_conn );
228 int slap_sasl_open( Connection *conn )
230 int sc = LDAP_SUCCESS;
232 #ifdef HAVE_CYRUS_SASL
233 sasl_conn_t *ctx = NULL;
234 sasl_callback_t *session_callbacks =
235 ch_calloc( 3, sizeof(sasl_callback_t));
237 session_callbacks[0].id = SASL_CB_LOG;
238 session_callbacks[0].proc = &sasl_cb_log;
239 session_callbacks[0].context = conn;
241 session_callbacks[1].id = SASL_CB_PROXY_POLICY;
242 session_callbacks[1].proc = &slap_sasl_authorize;
243 session_callbacks[1].context = conn;
245 session_callbacks[2].id = SASL_CB_LIST_END;
246 session_callbacks[2].proc = NULL;
247 session_callbacks[2].context = NULL;
249 /* create new SASL context */
250 sc = sasl_server_new( "ldap", sasl_host, global_realm,
252 #ifdef LDAP_SASL_SECURITY_LAYER
260 if( sc != SASL_OK ) {
261 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
266 conn->c_sasl_context = ctx;
268 if( sc == SASL_OK ) {
269 sc = sasl_setprop( ctx,
270 SASL_SEC_PROPS, &sasl_secprops );
272 if( sc != SASL_OK ) {
273 Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
275 slap_sasl_close( conn );
280 sc = slap_sasl_err2ldap( sc );
285 int slap_sasl_external(
290 #ifdef HAVE_CYRUS_SASL
292 sasl_conn_t *ctx = conn->c_sasl_context;
293 sasl_external_properties_t extprops;
296 return LDAP_UNAVAILABLE;
299 memset( &extprops, 0L, sizeof(extprops) );
301 extprops.auth_id = auth_id;
303 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
304 (void *) &extprops );
306 if ( sc != SASL_OK ) {
314 int slap_sasl_reset( Connection *conn )
316 #ifdef HAVE_CYRUS_SASL
317 sasl_conn_t *ctx = conn->c_sasl_context;
322 /* must return "anonymous" */
326 char ** slap_sasl_mechs( Connection *conn )
330 #ifdef HAVE_CYRUS_SASL
331 sasl_conn_t *ctx = conn->c_sasl_context;
337 sc = sasl_listmech( ctx,
338 NULL, NULL, ",", NULL,
339 &mechstr, NULL, NULL );
341 if( sc != SASL_OK ) {
342 Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
347 mechs = str2charray( mechstr, "," );
356 int slap_sasl_close( Connection *conn )
358 #ifdef HAVE_CYRUS_SASL
359 sasl_conn_t *ctx = conn->c_sasl_context;
362 sasl_dispose( &ctx );
365 conn->c_sasl_context = NULL;
381 #ifdef HAVE_CYRUS_SASL
382 sasl_conn_t *ctx = conn->c_sasl_context;
383 struct berval response;
388 Debug(LDAP_DEBUG_ARGS,
389 "==> sasl_bind: dn=\"%s\" mech=%s cred->bv_len=%d\n",
390 dn, mech, cred ? cred->bv_len : 0 );
393 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
394 NULL, "SASL unavailable on this session", NULL, NULL );
398 if ( mech != NULL ) {
399 sc = sasl_server_start( ctx,
401 cred->bv_val, cred->bv_len,
402 (char **)&response.bv_val, &reslen, &errstr );
405 sc = sasl_server_step( ctx,
406 cred->bv_val, cred->bv_len,
407 (char **)&response.bv_val, &reslen, &errstr );
410 response.bv_len = reslen;
412 if ( sc == SASL_OK ) {
413 char *username = NULL;
415 sc = sasl_getprop( ctx,
416 SASL_USERNAME, (void **)&username );
418 if ( sc != SASL_OK ) {
419 Debug(LDAP_DEBUG_TRACE,
420 "slap_sasl_bind: getprop(USERNAME) failed!\n",
423 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
424 NULL, "no SASL username", NULL, NULL );
426 } else if ( username == NULL || *username == '\0' ) {
427 Debug(LDAP_DEBUG_TRACE,
428 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
431 send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
432 NULL, "no SASL username", NULL, NULL );
436 sasl_ssf_t *ssf = NULL;
438 (void) sasl_getprop( ctx,
439 SASL_REALM, (void **)&realm );
441 (void) sasl_getprop( ctx,
442 SASL_SSF, (void *)&ssf );
444 Debug(LDAP_DEBUG_TRACE,
445 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
446 username ? username : "",
448 (unsigned long) ( ssf ? *ssf : 0 ) );
450 if( !strncasecmp( username, "anonymous", sizeof("anonyous")-1 ) &&
451 ( ( username[sizeof("anonymous")] == '\0' ) ||
452 ( username[sizeof("anonymous")] == '@' ) ) )
454 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
458 *edn = ch_malloc( sizeof( "uid= + realm=" )
459 + ( username ? strlen( username ) : 0 )
460 + ( realm ? strlen( realm ) : 0 ) );
462 strcpy( *edn, "uid=" );
463 strcat( *edn, username );
465 if( realm && *realm ) {
466 strcat( *edn, " + realm=" );
467 strcat( *edn, realm );
470 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: authzdn: \"%s\"\n",
474 send_ldap_sasl( conn, op, rc = LDAP_SUCCESS,
475 NULL, NULL, NULL, NULL, &response );
478 } else if ( sc == SASL_CONTINUE ) {
479 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
480 NULL, NULL, NULL, NULL, &response );
483 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
484 NULL, errstr, NULL, NULL );
487 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
490 send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
491 NULL, "SASL not supported", NULL, NULL );
497 char* slap_sasl_secprops( const char *in )
499 #ifdef HAVE_CYRUS_SASL
500 int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
502 return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
504 return "SASL not supported";