3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include "proto-slap.h"
18 #ifdef HAVE_CYRUS_SASL
28 static char *sasl_host = NULL;
29 static sasl_security_properties_t sasl_secprops;
32 slap_sasl_err2ldap( int saslerr )
38 rc = LDAP_SASL_BIND_IN_PROGRESS;
47 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
50 rc = LDAP_INVALID_CREDENTIALS;
53 rc = LDAP_INSUFFICIENT_ACCESS;
57 rc = LDAP_INAPPROPRIATE_AUTH;
69 int slap_sasl_init( void )
71 #ifdef HAVE_CYRUS_SASL
73 sasl_conn_t *server = NULL;
74 static sasl_callback_t server_callbacks[] = {
75 { SASL_CB_LIST_END, NULL, NULL }
85 ldap_pvt_sasl_mutex_new,
86 ldap_pvt_sasl_mutex_lock,
87 ldap_pvt_sasl_mutex_unlock,
88 ldap_pvt_sasl_mutex_dispose );
90 /* should provide callbacks for logging */
91 /* server name should be configurable */
92 rc = sasl_server_init( server_callbacks, "slapd" );
95 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
100 if( sasl_host == NULL ) {
101 static char hostname[MAXHOSTNAMELEN+1];
103 if( gethostname( hostname, MAXHOSTNAMELEN ) == 0 ) {
104 hostname[MAXHOSTNAMELEN] = '\0';
105 sasl_host = hostname;
109 Debug( LDAP_DEBUG_TRACE,
110 "slap_sasl_init: %s initialized!\n",
113 /* default security properties */
114 memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
115 sasl_secprops.max_ssf = UINT_MAX;
116 sasl_secprops.maxbufsize = 65536;
117 sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
120 lutil_passwd_sasl_conn = server;
122 sasl_dispose( &server );
129 int slap_sasl_destroy( void )
131 #ifdef HAVE_CYRUS_SASL
133 sasl_dispose( &lutil_passwd_sasl_conn );
140 int slap_sasl_open( Connection *conn )
142 int sc = LDAP_SUCCESS;
144 #ifdef HAVE_CYRUS_SASL
145 sasl_conn_t *ctx = NULL;
147 /* create new SASL context */
148 sc = sasl_server_new( "ldap", sasl_host, global_realm, NULL,
149 #ifdef LDAP_SASL_SECURITY_LAYER
157 if( sc != SASL_OK ) {
158 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
163 conn->c_sasl_context = ctx;
165 if( sc == SASL_OK ) {
166 sc = sasl_setprop( ctx,
167 SASL_SEC_PROPS, &sasl_secprops );
169 if( sc != SASL_OK ) {
170 Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
172 slap_sasl_close( conn );
177 sc = slap_sasl_err2ldap( sc );
182 int slap_sasl_external(
187 #ifdef HAVE_CYRUS_SASL
189 sasl_conn_t *ctx = conn->c_sasl_context;
190 sasl_external_properties_t extprops;
193 return LDAP_UNAVAILABLE;
196 memset( &extprops, 0L, sizeof(extprops) );
198 extprops.auth_id = auth_id;
200 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
201 (void *) &extprops );
203 if ( sc != SASL_OK ) {
211 int slap_sasl_reset( Connection *conn )
213 #ifdef HAVE_CYRUS_SASL
214 sasl_conn_t *ctx = conn->c_sasl_context;
219 /* must return "anonymous" */
223 char ** slap_sasl_mechs( Connection *conn )
227 #ifdef HAVE_CYRUS_SASL
228 sasl_conn_t *ctx = conn->c_sasl_context;
234 sc = sasl_listmech( ctx,
235 NULL, NULL, ",", NULL,
236 &mechstr, NULL, NULL );
238 if( sc != SASL_OK ) {
239 Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
244 mechs = str2charray( mechstr, "," );
253 int slap_sasl_close( Connection *conn )
255 #ifdef HAVE_CYRUS_SASL
256 sasl_conn_t *ctx = conn->c_sasl_context;
259 sasl_dispose( &ctx );
262 conn->c_sasl_context = NULL;
278 #ifdef HAVE_CYRUS_SASL
279 sasl_conn_t *ctx = conn->c_sasl_context;
280 struct berval response;
285 Debug(LDAP_DEBUG_ARGS,
286 "==> sasl_bind: dn=\"%s\" mech=%s cred->bv_len=%d\n",
287 dn, mech, cred ? cred->bv_len : 0 );
290 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
291 NULL, "SASL unavailable on this session", NULL, NULL );
295 if ( mech != NULL ) {
296 sc = sasl_server_start( ctx,
298 cred->bv_val, cred->bv_len,
299 (char **)&response.bv_val, &reslen, &errstr );
302 sc = sasl_server_step( ctx,
303 cred->bv_val, cred->bv_len,
304 (char **)&response.bv_val, &reslen, &errstr );
307 response.bv_len = reslen;
309 if ( sc == SASL_OK ) {
310 char *username = NULL;
312 sc = sasl_getprop( ctx,
313 SASL_USERNAME, (void **)&username );
315 if ( sc != SASL_OK ) {
316 Debug(LDAP_DEBUG_TRACE,
317 "slap_sasl_bind: getprop(USERNAME) failed!\n",
320 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
321 NULL, "no SASL username", NULL, NULL );
323 } else if ( username == NULL || *username == '\0' ) {
324 Debug(LDAP_DEBUG_TRACE,
325 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
328 send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
329 NULL, "no SASL username", NULL, NULL );
335 (void) sasl_getprop( ctx,
336 SASL_REALM, (void **)&realm );
338 (void) sasl_getprop( ctx,
339 SASL_SSF, (void *)&ssf );
341 Debug(LDAP_DEBUG_TRACE,
342 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
343 username ? username : "",
345 (unsigned long) ssf );
347 if( !strncasecmp( username, "anonymous", sizeof("anonyous")-1 ) &&
348 ( ( username[sizeof("anonymous")] == '\0' ) ||
349 ( username[sizeof("anonymous")] == '@' ) ) )
351 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
355 *edn = ch_malloc( sizeof( "uid= + realm=" )
356 + ( username ? strlen( username ) : 0 )
357 + ( realm ? strlen( realm ) : 0 ) );
359 strcpy( *edn, "uid=" );
360 strcat( *edn, username );
362 if( realm && *realm ) {
363 strcat( *edn, " + realm=" );
364 strcat( *edn, realm );
367 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: authzdn: \"%s\"\n",
371 send_ldap_sasl( conn, op, rc = LDAP_SUCCESS,
372 NULL, NULL, NULL, NULL, &response );
375 } else if ( sc == SASL_CONTINUE ) {
376 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
377 NULL, NULL, NULL, NULL, &response );
380 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
381 NULL, errstr, NULL, NULL );
384 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
387 send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
388 NULL, "SASL not supported", NULL, NULL );
394 char* slap_sasl_secprops( const char *in )
396 #ifdef HAVE_CYRUS_SASL
397 int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
399 return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
401 return "SASL not supported";