3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include "proto-slap.h"
18 #ifdef HAVE_CYRUS_SASL
28 static sasl_security_properties_t sasl_secprops;
37 Connection *conn = context;
41 if ( message == NULL ) {
47 level = LDAP_DEBUG_ANY;
50 case SASL_LOG_WARNING:
51 level = LDAP_DEBUG_TRACE;
55 level = LDAP_DEBUG_TRACE;
62 Debug( level, "SASL [conn=%d] %s: %s\n",
63 conn ? conn->c_connid: -1,
79 Connection *conn = context;
83 if ( authcid == NULL || *authcid == '\0' ) {
84 *errstr = "empty authentication identity";
86 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
87 "empty authentication identity\n",
88 (long) (conn ? conn->c_connid : -1),
93 Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
94 "authcid=\"%s\" authzid=\"%s\"\n",
95 (long) (conn ? conn->c_connid : -1),
96 authcid ? authcid : "<empty>",
97 authzid ? authzid : "<empty>" );
99 if ( authzid == NULL || *authzid == '\0' ||
100 strcmp( authcid, authzid ) == 0 )
102 size_t len = sizeof("u:") + strlen( authcid );
104 cuser = ch_malloc( len );
105 strcpy( cuser, "u:" );
106 strcpy( &cuser[sizeof("u:")-1], authcid );
110 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
111 "\"%s\" as \"%s\"\n",
112 (long) (conn ? conn->c_connid : -1),
118 rc = slap_sasl_authorized( conn, authcid, authzid );
119 Debug( LDAP_DEBUG_TRACE, "SASL Authorization returned %d\n", rc,0,0);
121 *errstr = "not authorized";
125 cuser = ch_strdup( authzid );
126 dn_normalize( cuser );
134 slap_sasl_err2ldap( int saslerr )
140 rc = LDAP_SASL_BIND_IN_PROGRESS;
149 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
152 rc = LDAP_INVALID_CREDENTIALS;
155 rc = LDAP_INSUFFICIENT_ACCESS;
159 rc = LDAP_INAPPROPRIATE_AUTH;
171 int slap_sasl_init( void )
173 #ifdef HAVE_CYRUS_SASL
175 sasl_conn_t *server = NULL;
176 static sasl_callback_t server_callbacks[] = {
177 { SASL_CB_LOG, &slap_sasl_log, NULL },
178 { SASL_CB_LIST_END, NULL, NULL }
188 ldap_pvt_sasl_mutex_new,
189 ldap_pvt_sasl_mutex_lock,
190 ldap_pvt_sasl_mutex_unlock,
191 ldap_pvt_sasl_mutex_dispose );
193 /* should provide callbacks for logging */
194 /* server name should be configurable */
195 rc = sasl_server_init( server_callbacks, "slapd" );
197 if( rc != SASL_OK ) {
198 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
203 Debug( LDAP_DEBUG_TRACE, "slap_sasl_init: initialized!\n",
206 /* default security properties */
207 memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
208 sasl_secprops.max_ssf = INT_MAX;
209 sasl_secprops.maxbufsize = 65536;
210 sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
212 sasl_dispose( &server );
218 int slap_sasl_destroy( void )
220 #ifdef HAVE_CYRUS_SASL
226 int slap_sasl_open( Connection *conn )
228 int sc = LDAP_SUCCESS;
230 #ifdef HAVE_CYRUS_SASL
231 sasl_conn_t *ctx = NULL;
232 sasl_callback_t *session_callbacks;
234 assert( conn->c_sasl_context == NULL );
235 assert( conn->c_sasl_extra == NULL );
237 conn->c_sasl_layers = 0;
240 ch_calloc( 3, sizeof(sasl_callback_t));
241 conn->c_sasl_extra = session_callbacks;
243 session_callbacks[0].id = SASL_CB_LOG;
244 session_callbacks[0].proc = &slap_sasl_log;
245 session_callbacks[0].context = conn;
247 session_callbacks[1].id = SASL_CB_PROXY_POLICY;
248 session_callbacks[1].proc = &slap_sasl_authorize;
249 session_callbacks[1].context = conn;
251 session_callbacks[2].id = SASL_CB_LIST_END;
252 session_callbacks[2].proc = NULL;
253 session_callbacks[2].context = NULL;
255 if( global_host == NULL ) {
256 global_host = ldap_pvt_get_fqdn( NULL );
259 /* create new SASL context */
260 sc = sasl_server_new( "ldap", global_host, global_realm,
261 session_callbacks, SASL_SECURITY_LAYER, &ctx );
263 if( sc != SASL_OK ) {
264 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
269 conn->c_sasl_context = ctx;
271 if( sc == SASL_OK ) {
272 sc = sasl_setprop( ctx,
273 SASL_SEC_PROPS, &sasl_secprops );
275 if( sc != SASL_OK ) {
276 Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
278 slap_sasl_close( conn );
283 sc = slap_sasl_err2ldap( sc );
288 int slap_sasl_external(
291 const char *auth_id )
293 #ifdef HAVE_CYRUS_SASL
295 sasl_conn_t *ctx = conn->c_sasl_context;
296 sasl_external_properties_t extprops;
299 return LDAP_UNAVAILABLE;
302 memset( &extprops, '\0', sizeof(extprops) );
304 extprops.auth_id = (char *) auth_id;
306 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
307 (void *) &extprops );
309 if ( sc != SASL_OK ) {
317 int slap_sasl_reset( Connection *conn )
319 #ifdef HAVE_CYRUS_SASL
320 sasl_conn_t *ctx = conn->c_sasl_context;
325 /* must return "anonymous" */
329 char ** slap_sasl_mechs( Connection *conn )
333 #ifdef HAVE_CYRUS_SASL
334 sasl_conn_t *ctx = conn->c_sasl_context;
340 sc = sasl_listmech( ctx,
341 NULL, NULL, ",", NULL,
342 &mechstr, NULL, NULL );
344 if( sc != SASL_OK ) {
345 Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
350 mechs = str2charray( mechstr, "," );
359 int slap_sasl_close( Connection *conn )
361 #ifdef HAVE_CYRUS_SASL
362 sasl_conn_t *ctx = conn->c_sasl_context;
365 sasl_dispose( &ctx );
368 conn->c_sasl_context = NULL;
370 free( conn->c_sasl_extra );
371 conn->c_sasl_extra = NULL;
388 #ifdef HAVE_CYRUS_SASL
389 sasl_conn_t *ctx = conn->c_sasl_context;
390 struct berval response;
395 Debug(LDAP_DEBUG_ARGS,
396 "==> sasl_bind: dn=\"%s\" mech=%s datalen=%d\n", dn,
397 conn->c_sasl_bind_in_progress ? "<continuing>":conn->c_sasl_bind_mech,
398 cred ? cred->bv_len : 0 );
401 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
402 NULL, "SASL unavailable on this session", NULL, NULL );
406 if ( !conn->c_sasl_bind_in_progress ) {
407 sc = sasl_server_start( ctx,
408 conn->c_sasl_bind_mech,
409 cred->bv_val, cred->bv_len,
410 (char **)&response.bv_val, &reslen, &errstr );
413 sc = sasl_server_step( ctx,
414 cred->bv_val, cred->bv_len,
415 (char **)&response.bv_val, &reslen, &errstr );
418 response.bv_len = reslen;
420 if ( sc == SASL_OK ) {
421 char *username = NULL;
423 sc = sasl_getprop( ctx,
424 SASL_USERNAME, (void **)&username );
426 if ( sc != SASL_OK ) {
427 Debug(LDAP_DEBUG_TRACE,
428 "slap_sasl_bind: getprop(USERNAME) failed!\n",
431 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
432 NULL, "no SASL username", NULL, NULL );
434 } else if ( username == NULL || *username == '\0' ) {
435 Debug(LDAP_DEBUG_TRACE,
436 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
439 send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
440 NULL, "no SASL username", NULL, NULL );
444 sasl_ssf_t *ssf = NULL;
446 (void) sasl_getprop( ctx,
447 SASL_REALM, (void **)&realm );
449 (void) sasl_getprop( ctx,
450 SASL_SSF, (void *)&ssf );
452 Debug(LDAP_DEBUG_TRACE,
453 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
454 username ? username : "",
456 (unsigned long) ( ssf ? *ssf : 0 ) );
458 *ssfp = ssf ? *ssf : 0;
462 if( username == NULL || (
463 !strncasecmp( username, "anonymous", sizeof("anonymous")-1 ) &&
464 ( username[sizeof("anonymous")-1] == '\0' ||
465 username[sizeof("anonymous")-1] == '@' ) ) )
467 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
470 } else if ( username[0] == 'u' && username[1] == ':'
471 && username[2] != '\0'
472 && strpbrk( &username[2], "+=,;\"\\ \t") == NULL )
474 *edn = ch_malloc( sizeof( "uid= + realm=" )
475 + strlen( &username[2] )
476 + ( realm ? strlen( realm ) : 0 ) );
478 strcpy( *edn, "uid=" );
479 strcat( *edn, &username[2] );
481 if( realm && *realm ) {
482 strcat( *edn, " + realm=" );
483 strcat( *edn, realm );
486 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: authzdn: \"%s\"\n",
491 if( rc == LDAP_SUCCESS ) {
492 send_ldap_sasl( conn, op, rc,
493 NULL, NULL, NULL, NULL,
494 response.bv_len ? &response : NULL );
497 send_ldap_result( conn, op, rc,
498 NULL, errstr, NULL, NULL );
502 } else if ( sc == SASL_CONTINUE ) {
503 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
504 NULL, NULL, NULL, NULL, &response );
507 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
508 NULL, errstr, NULL, NULL );
511 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
514 send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
515 NULL, "SASL not supported", NULL, NULL );
521 char* slap_sasl_secprops( const char *in )
523 #ifdef HAVE_CYRUS_SASL
524 int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
526 return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
528 return "SASL not supported";