3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include "proto-slap.h"
18 #ifdef HAVE_CYRUS_SASL
28 static sasl_security_properties_t sasl_secprops;
37 Connection *conn = context;
41 if ( message == NULL ) {
47 level = LDAP_DEBUG_ANY;
50 case SASL_LOG_WARNING:
51 level = LDAP_DEBUG_TRACE;
55 level = LDAP_DEBUG_TRACE;
62 Debug( level, "SASL [conn=%d] %s: %s\n",
63 conn ? conn->c_connid: -1,
79 Connection *conn = context;
83 if ( authcid == NULL || *authcid == '\0' ) {
84 *errstr = "empty authentication identity";
86 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
87 "empty authentication identity\n",
88 (long) (conn ? conn->c_connid : -1),
93 Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
94 "authcid=\"%s\" authzid=\"%s\"\n",
95 (long) (conn ? conn->c_connid : -1),
96 authcid ? authcid : "<empty>",
97 authzid ? authzid : "<empty>" );
99 if ( authzid == NULL || *authzid == '\0' ||
100 ( authzid[0] == 'u' && authzid[1] == ':' &&
101 strcmp( authcid, &authzid[2] ) == 0 ) ||
102 strcmp( authcid, authzid ) == 0 )
110 size_t len = sizeof("u:") + strlen( authcid );
112 cuser = ch_malloc( len );
113 strcpy( cuser, "u:" );
114 strcpy( &cuser[sizeof("u:")-1], authcid );
118 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
119 "\"%s\" as \"%s\"\n",
120 (long) (conn ? conn->c_connid : -1),
126 rc = slap_sasl_authorized( conn, authcid, authzid );
128 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
129 " authorization disallowed (%d)\n",
130 (long) (conn ? conn->c_connid : -1), rc, 0 );
131 *errstr = "not authorized";
135 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
136 " authorization allowed\n",
137 (long) (conn ? conn->c_connid : -1), 0, 0 );
139 cuser = ch_strdup( authzid );
140 dn_normalize( cuser );
148 slap_sasl_err2ldap( int saslerr )
154 rc = LDAP_SASL_BIND_IN_PROGRESS;
163 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
166 rc = LDAP_INVALID_CREDENTIALS;
169 rc = LDAP_INSUFFICIENT_ACCESS;
173 rc = LDAP_INAPPROPRIATE_AUTH;
185 int slap_sasl_init( void )
187 #ifdef HAVE_CYRUS_SASL
189 static sasl_callback_t server_callbacks[] = {
190 { SASL_CB_LOG, &slap_sasl_log, NULL },
191 { SASL_CB_LIST_END, NULL, NULL }
201 ldap_pvt_sasl_mutex_new,
202 ldap_pvt_sasl_mutex_lock,
203 ldap_pvt_sasl_mutex_unlock,
204 ldap_pvt_sasl_mutex_dispose );
206 /* should provide callbacks for logging */
207 /* server name should be configurable */
208 rc = sasl_server_init( server_callbacks, "slapd" );
210 if( rc != SASL_OK ) {
211 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
216 Debug( LDAP_DEBUG_TRACE, "slap_sasl_init: initialized!\n",
219 /* default security properties */
220 memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
221 sasl_secprops.max_ssf = INT_MAX;
222 sasl_secprops.maxbufsize = 65536;
223 sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
229 int slap_sasl_destroy( void )
231 #ifdef HAVE_CYRUS_SASL
237 int slap_sasl_open( Connection *conn )
239 int sc = LDAP_SUCCESS;
241 #ifdef HAVE_CYRUS_SASL
242 sasl_conn_t *ctx = NULL;
243 sasl_callback_t *session_callbacks;
245 assert( conn->c_sasl_context == NULL );
246 assert( conn->c_sasl_extra == NULL );
248 conn->c_sasl_layers = 0;
251 ch_calloc( 3, sizeof(sasl_callback_t));
252 conn->c_sasl_extra = session_callbacks;
254 session_callbacks[0].id = SASL_CB_LOG;
255 session_callbacks[0].proc = &slap_sasl_log;
256 session_callbacks[0].context = conn;
258 session_callbacks[1].id = SASL_CB_PROXY_POLICY;
259 session_callbacks[1].proc = &slap_sasl_authorize;
260 session_callbacks[1].context = conn;
262 session_callbacks[2].id = SASL_CB_LIST_END;
263 session_callbacks[2].proc = NULL;
264 session_callbacks[2].context = NULL;
266 if( global_host == NULL ) {
267 global_host = ldap_pvt_get_fqdn( NULL );
270 /* create new SASL context */
271 sc = sasl_server_new( "ldap", global_host, global_realm,
272 session_callbacks, SASL_SECURITY_LAYER, &ctx );
274 if( sc != SASL_OK ) {
275 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
280 conn->c_sasl_context = ctx;
282 if( sc == SASL_OK ) {
283 sc = sasl_setprop( ctx,
284 SASL_SEC_PROPS, &sasl_secprops );
286 if( sc != SASL_OK ) {
287 Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
289 slap_sasl_close( conn );
294 sc = slap_sasl_err2ldap( sc );
299 int slap_sasl_external(
302 const char *auth_id )
304 #ifdef HAVE_CYRUS_SASL
306 sasl_conn_t *ctx = conn->c_sasl_context;
307 sasl_external_properties_t extprops;
310 return LDAP_UNAVAILABLE;
313 memset( &extprops, '\0', sizeof(extprops) );
315 extprops.auth_id = (char *) auth_id;
317 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
318 (void *) &extprops );
320 if ( sc != SASL_OK ) {
328 int slap_sasl_reset( Connection *conn )
330 #ifdef HAVE_CYRUS_SASL
331 sasl_conn_t *ctx = conn->c_sasl_context;
336 /* must return "anonymous" */
340 char ** slap_sasl_mechs( Connection *conn )
344 #ifdef HAVE_CYRUS_SASL
345 sasl_conn_t *ctx = conn->c_sasl_context;
351 sc = sasl_listmech( ctx,
352 NULL, NULL, ",", NULL,
353 &mechstr, NULL, NULL );
355 if( sc != SASL_OK ) {
356 Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
361 mechs = str2charray( mechstr, "," );
370 int slap_sasl_close( Connection *conn )
372 #ifdef HAVE_CYRUS_SASL
373 sasl_conn_t *ctx = conn->c_sasl_context;
376 sasl_dispose( &ctx );
379 conn->c_sasl_context = NULL;
381 free( conn->c_sasl_extra );
382 conn->c_sasl_extra = NULL;
399 #ifdef HAVE_CYRUS_SASL
400 sasl_conn_t *ctx = conn->c_sasl_context;
401 struct berval response;
406 Debug(LDAP_DEBUG_ARGS,
407 "==> sasl_bind: dn=\"%s\" mech=%s datalen=%d\n", dn,
408 conn->c_sasl_bind_in_progress ? "<continuing>":conn->c_sasl_bind_mech,
409 cred ? cred->bv_len : 0 );
412 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
413 NULL, "SASL unavailable on this session", NULL, NULL );
417 if ( !conn->c_sasl_bind_in_progress ) {
418 sc = sasl_server_start( ctx,
419 conn->c_sasl_bind_mech,
420 cred->bv_val, cred->bv_len,
421 (char **)&response.bv_val, &reslen, &errstr );
424 sc = sasl_server_step( ctx,
425 cred->bv_val, cred->bv_len,
426 (char **)&response.bv_val, &reslen, &errstr );
429 response.bv_len = reslen;
431 if ( sc == SASL_OK ) {
432 char *username = NULL;
434 sc = sasl_getprop( ctx,
435 SASL_USERNAME, (void **)&username );
437 if ( sc != SASL_OK ) {
438 Debug(LDAP_DEBUG_TRACE,
439 "slap_sasl_bind: getprop(USERNAME) failed!\n",
442 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
443 NULL, "no SASL username", NULL, NULL );
445 } else if ( username == NULL || *username == '\0' ) {
446 Debug(LDAP_DEBUG_TRACE,
447 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
450 send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
451 NULL, "no SASL username", NULL, NULL );
455 sasl_ssf_t *ssf = NULL;
457 (void) sasl_getprop( ctx,
458 SASL_REALM, (void **)&realm );
460 (void) sasl_getprop( ctx,
461 SASL_SSF, (void *)&ssf );
463 Debug(LDAP_DEBUG_TRACE,
464 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
465 username ? username : "",
467 (unsigned long) ( ssf ? *ssf : 0 ) );
471 if( username == NULL || (
472 !strncasecmp( username, "anonymous", sizeof("anonymous")-1 ) &&
473 ( username[sizeof("anonymous")-1] == '\0' ||
474 username[sizeof("anonymous")-1] == '@' ) ) )
476 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
479 } else if ( username[0] == 'u' && username[1] == ':'
480 && username[2] != '\0' )
482 *edn = ch_malloc( sizeof( "uid=,cn=" )
483 + strlen( &username[2] )
484 + ( realm ? strlen( realm ) : 0 ) );
486 strcpy( *edn, "uid=" );
487 strcat( *edn, &username[2] );
489 if( realm && *realm ) {
490 strcat( *edn, ",cn=" );
491 strcat( *edn, realm );
494 if( dn_normalize( *edn ) == NULL ) {
495 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
496 "authzid (\"%s\") to authzdn failed: \"%s\"\n",
500 rc = LDAP_INAPPROPRIATE_AUTH;
501 errstr = "could not form a valid DN from authzid";
504 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
509 } else if ( username[0] == 'd' && username[1] == 'n'
510 && username[2] != ':' && username[3] != '\0' )
512 *edn = ch_strdup( &username[3] );
514 if( dn_normalize( *edn ) == NULL ) {
515 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
516 "authzid (\"%s\") to authzdn failed: \"%s\"\n",
521 rc = LDAP_INAPPROPRIATE_AUTH;
522 errstr = "could not form a valid DN from authzid";
525 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
531 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
532 "authzid (\"%s\") inappropriate form\n",
534 rc = LDAP_INAPPROPRIATE_AUTH;
535 errstr = "inappropriate authorization identity form";
538 if( rc == LDAP_SUCCESS ) {
539 *ssfp = ssf ? *ssf : 0;
542 ldap_pvt_thread_mutex_lock( &conn->c_mutex );
543 conn->c_sasl_layers++;
544 ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
547 send_ldap_sasl( conn, op, rc,
548 NULL, NULL, NULL, NULL,
549 response.bv_len ? &response : NULL );
552 send_ldap_result( conn, op, rc,
553 NULL, errstr, NULL, NULL );
557 } else if ( sc == SASL_CONTINUE ) {
558 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
559 NULL, NULL, NULL, NULL, &response );
562 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
563 NULL, errstr, NULL, NULL );
566 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
569 send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
570 NULL, "SASL not supported", NULL, NULL );
576 char* slap_sasl_secprops( const char *in )
578 #ifdef HAVE_CYRUS_SASL
579 int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
581 return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
583 return "SASL not supported";