3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include "proto-slap.h"
18 #ifdef HAVE_CYRUS_SASL
28 static char *sasl_host = NULL;
29 static sasl_security_properties_t sasl_secprops;
38 Connection *conn = context;
42 if ( message == NULL ) {
48 level = LDAP_DEBUG_ANY;
51 case SASL_LOG_WARNING:
52 level = LDAP_DEBUG_TRACE;
56 level = LDAP_DEBUG_TRACE;
63 Debug( level, "SASL [conn=%d] %s: %s\n",
64 conn ? conn->c_connid: -1,
71 slap_sasl_proxy_policy(
80 if ( !authcid || *authcid ) {
81 *errstr = "empty authentication identity";
85 if ( !authzid || *authzid ) {
86 size_t len = sizeof("u:") + strlen( authcid );
87 canon = ch_malloc( len );
88 strcpy( canon, "u:" );
89 strcpy( &canon[sizeof("u:")-1], authcid );
95 *errstr = "no proxy policy";
101 slap_sasl_err2ldap( int saslerr )
107 rc = LDAP_SASL_BIND_IN_PROGRESS;
116 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
119 rc = LDAP_INVALID_CREDENTIALS;
122 rc = LDAP_INSUFFICIENT_ACCESS;
126 rc = LDAP_INAPPROPRIATE_AUTH;
138 int slap_sasl_init( void )
140 #ifdef HAVE_CYRUS_SASL
142 sasl_conn_t *server = NULL;
143 sasl_callback_t server_callbacks[] = {
144 { SASL_CB_LOG, &sasl_cb_log, NULL },
145 { SASL_CB_LIST_END, NULL, NULL }
155 ldap_pvt_sasl_mutex_new,
156 ldap_pvt_sasl_mutex_lock,
157 ldap_pvt_sasl_mutex_unlock,
158 ldap_pvt_sasl_mutex_dispose );
160 /* should provide callbacks for logging */
161 /* server name should be configurable */
162 rc = sasl_server_init( server_callbacks, "slapd" );
164 if( rc != SASL_OK ) {
165 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
170 if( sasl_host == NULL ) {
171 static char hostname[MAXHOSTNAMELEN+1];
173 if( gethostname( hostname, MAXHOSTNAMELEN ) == 0 ) {
174 hostname[MAXHOSTNAMELEN] = '\0';
175 sasl_host = hostname;
179 Debug( LDAP_DEBUG_TRACE,
180 "slap_sasl_init: %s initialized!\n",
183 /* default security properties */
184 memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
185 sasl_secprops.max_ssf = UINT_MAX;
186 sasl_secprops.maxbufsize = 65536;
187 sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
190 lutil_passwd_sasl_conn = server;
192 sasl_dispose( &server );
199 int slap_sasl_destroy( void )
201 #ifdef HAVE_CYRUS_SASL
203 sasl_dispose( &lutil_passwd_sasl_conn );
210 int slap_sasl_open( Connection *conn )
212 int sc = LDAP_SUCCESS;
214 #ifdef HAVE_CYRUS_SASL
215 sasl_conn_t *ctx = NULL;
216 sasl_callback_t session_callbacks[] = {
217 { SASL_CB_LOG, &sasl_cb_log, conn },
218 { SASL_CB_PROXY_POLICY, &slap_sasl_proxy_policy, conn },
219 { SASL_CB_LIST_END, NULL, NULL }
222 /* create new SASL context */
223 sc = sasl_server_new( "ldap", sasl_host, global_realm,
225 #ifdef LDAP_SASL_SECURITY_LAYER
233 if( sc != SASL_OK ) {
234 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
239 conn->c_sasl_context = ctx;
241 if( sc == SASL_OK ) {
242 sc = sasl_setprop( ctx,
243 SASL_SEC_PROPS, &sasl_secprops );
245 if( sc != SASL_OK ) {
246 Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
248 slap_sasl_close( conn );
253 sc = slap_sasl_err2ldap( sc );
258 int slap_sasl_external(
263 #ifdef HAVE_CYRUS_SASL
265 sasl_conn_t *ctx = conn->c_sasl_context;
266 sasl_external_properties_t extprops;
269 return LDAP_UNAVAILABLE;
272 memset( &extprops, 0L, sizeof(extprops) );
274 extprops.auth_id = auth_id;
276 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
277 (void *) &extprops );
279 if ( sc != SASL_OK ) {
287 int slap_sasl_reset( Connection *conn )
289 #ifdef HAVE_CYRUS_SASL
290 sasl_conn_t *ctx = conn->c_sasl_context;
295 /* must return "anonymous" */
299 char ** slap_sasl_mechs( Connection *conn )
303 #ifdef HAVE_CYRUS_SASL
304 sasl_conn_t *ctx = conn->c_sasl_context;
310 sc = sasl_listmech( ctx,
311 NULL, NULL, ",", NULL,
312 &mechstr, NULL, NULL );
314 if( sc != SASL_OK ) {
315 Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
320 mechs = str2charray( mechstr, "," );
329 int slap_sasl_close( Connection *conn )
331 #ifdef HAVE_CYRUS_SASL
332 sasl_conn_t *ctx = conn->c_sasl_context;
335 sasl_dispose( &ctx );
338 conn->c_sasl_context = NULL;
354 #ifdef HAVE_CYRUS_SASL
355 sasl_conn_t *ctx = conn->c_sasl_context;
356 struct berval response;
361 Debug(LDAP_DEBUG_ARGS,
362 "==> sasl_bind: dn=\"%s\" mech=%s cred->bv_len=%d\n",
363 dn, mech, cred ? cred->bv_len : 0 );
366 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
367 NULL, "SASL unavailable on this session", NULL, NULL );
371 if ( mech != NULL ) {
372 sc = sasl_server_start( ctx,
374 cred->bv_val, cred->bv_len,
375 (char **)&response.bv_val, &reslen, &errstr );
378 sc = sasl_server_step( ctx,
379 cred->bv_val, cred->bv_len,
380 (char **)&response.bv_val, &reslen, &errstr );
383 response.bv_len = reslen;
385 if ( sc == SASL_OK ) {
386 char *username = NULL;
388 sc = sasl_getprop( ctx,
389 SASL_USERNAME, (void **)&username );
391 if ( sc != SASL_OK ) {
392 Debug(LDAP_DEBUG_TRACE,
393 "slap_sasl_bind: getprop(USERNAME) failed!\n",
396 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
397 NULL, "no SASL username", NULL, NULL );
399 } else if ( username == NULL || *username == '\0' ) {
400 Debug(LDAP_DEBUG_TRACE,
401 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
404 send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
405 NULL, "no SASL username", NULL, NULL );
411 (void) sasl_getprop( ctx,
412 SASL_REALM, (void **)&realm );
414 (void) sasl_getprop( ctx,
415 SASL_SSF, (void *)&ssf );
417 Debug(LDAP_DEBUG_TRACE,
418 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
419 username ? username : "",
421 (unsigned long) ssf );
423 if( !strncasecmp( username, "anonymous", sizeof("anonyous")-1 ) &&
424 ( ( username[sizeof("anonymous")] == '\0' ) ||
425 ( username[sizeof("anonymous")] == '@' ) ) )
427 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
431 *edn = ch_malloc( sizeof( "uid= + realm=" )
432 + ( username ? strlen( username ) : 0 )
433 + ( realm ? strlen( realm ) : 0 ) );
435 strcpy( *edn, "uid=" );
436 strcat( *edn, username );
438 if( realm && *realm ) {
439 strcat( *edn, " + realm=" );
440 strcat( *edn, realm );
443 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: authzdn: \"%s\"\n",
447 send_ldap_sasl( conn, op, rc = LDAP_SUCCESS,
448 NULL, NULL, NULL, NULL, &response );
451 } else if ( sc == SASL_CONTINUE ) {
452 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
453 NULL, NULL, NULL, NULL, &response );
456 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
457 NULL, errstr, NULL, NULL );
460 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
463 send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
464 NULL, "SASL not supported", NULL, NULL );
470 char* slap_sasl_secprops( const char *in )
472 #ifdef HAVE_CYRUS_SASL
473 int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
475 return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
477 return "SASL not supported";