3 * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
4 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
13 #include "proto-slap.h"
18 #ifdef HAVE_CYRUS_SASL
28 static char *sasl_host = NULL;
29 static sasl_security_properties_t sasl_secprops;
38 Connection *conn = context;
42 if ( message == NULL ) {
48 level = LDAP_DEBUG_ANY;
51 case SASL_LOG_WARNING:
52 level = LDAP_DEBUG_TRACE;
56 level = LDAP_DEBUG_TRACE;
63 Debug( level, "SASL [conn=%d] %s: %s\n",
64 conn ? conn->c_connid: -1,
78 Connection *conn = context;
82 if ( authcid == NULL || *authcid == '\0' ) {
83 *errstr = "empty authentication identity";
85 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
86 "empty authentication identity\n",
87 (long) (conn ? conn->c_connid : -1),
92 if ( authzid == NULL || *authzid == '\0' ||
93 strcmp( authcid, authzid ) == 0 )
96 size_t len = sizeof("u:") + strlen( authcid );
98 cuser = ch_malloc( len );
99 strcpy( cuser, "u:" );
100 strcpy( &cuser[sizeof("u:")-1], authcid );
104 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
105 "\"%s\" as \"%s\"\n",
106 (long) (conn ? conn->c_connid : -1),
112 Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
113 "\"%s\" as \"%s\" disallowed. No policy.\n",
114 (long) (conn ? conn->c_connid : -1),
117 *errstr = "no proxy policy";
123 slap_sasl_err2ldap( int saslerr )
129 rc = LDAP_SASL_BIND_IN_PROGRESS;
138 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
141 rc = LDAP_INVALID_CREDENTIALS;
144 rc = LDAP_INSUFFICIENT_ACCESS;
148 rc = LDAP_INAPPROPRIATE_AUTH;
160 int slap_sasl_init( void )
162 #ifdef HAVE_CYRUS_SASL
164 sasl_conn_t *server = NULL;
165 static sasl_callback_t server_callbacks[] = {
166 { SASL_CB_LOG, &slap_sasl_log, NULL },
167 { SASL_CB_LIST_END, NULL, NULL }
177 ldap_pvt_sasl_mutex_new,
178 ldap_pvt_sasl_mutex_lock,
179 ldap_pvt_sasl_mutex_unlock,
180 ldap_pvt_sasl_mutex_dispose );
182 /* should provide callbacks for logging */
183 /* server name should be configurable */
184 rc = sasl_server_init( server_callbacks, "slapd" );
186 if( rc != SASL_OK ) {
187 Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
192 if( sasl_host == NULL ) {
193 static char hostname[MAXHOSTNAMELEN+1];
195 if( gethostname( hostname, MAXHOSTNAMELEN ) == 0 ) {
196 hostname[MAXHOSTNAMELEN] = '\0';
197 sasl_host = hostname;
201 Debug( LDAP_DEBUG_TRACE,
202 "slap_sasl_init: %s initialized!\n",
205 /* default security properties */
206 memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
207 sasl_secprops.max_ssf = UINT_MAX;
208 sasl_secprops.maxbufsize = 65536;
209 sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
212 lutil_passwd_sasl_conn = server;
214 sasl_dispose( &server );
221 int slap_sasl_destroy( void )
223 #ifdef HAVE_CYRUS_SASL
225 sasl_dispose( &lutil_passwd_sasl_conn );
232 int slap_sasl_open( Connection *conn )
234 int sc = LDAP_SUCCESS;
236 #ifdef HAVE_CYRUS_SASL
237 sasl_conn_t *ctx = NULL;
238 sasl_callback_t *session_callbacks;
240 assert( conn->c_sasl_context == NULL );
241 assert( conn->c_sasl_extra == NULL );
244 ch_calloc( 3, sizeof(sasl_callback_t));
245 conn->c_sasl_extra = session_callbacks;
247 session_callbacks[0].id = SASL_CB_LOG;
248 session_callbacks[0].proc = &slap_sasl_log;
249 session_callbacks[0].context = conn;
251 session_callbacks[1].id = SASL_CB_PROXY_POLICY;
252 session_callbacks[1].proc = &slap_sasl_authorize;
253 session_callbacks[1].context = conn;
255 session_callbacks[2].id = SASL_CB_LIST_END;
256 session_callbacks[2].proc = NULL;
257 session_callbacks[2].context = NULL;
259 /* create new SASL context */
260 sc = sasl_server_new( "ldap", sasl_host, global_realm,
262 #ifdef LDAP_SASL_SECURITY_LAYER
270 if( sc != SASL_OK ) {
271 Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
276 conn->c_sasl_context = ctx;
278 if( sc == SASL_OK ) {
279 sc = sasl_setprop( ctx,
280 SASL_SEC_PROPS, &sasl_secprops );
282 if( sc != SASL_OK ) {
283 Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
285 slap_sasl_close( conn );
290 sc = slap_sasl_err2ldap( sc );
295 int slap_sasl_external(
300 #ifdef HAVE_CYRUS_SASL
302 sasl_conn_t *ctx = conn->c_sasl_context;
303 sasl_external_properties_t extprops;
306 return LDAP_UNAVAILABLE;
309 memset( &extprops, 0L, sizeof(extprops) );
311 extprops.auth_id = auth_id;
313 sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
314 (void *) &extprops );
316 if ( sc != SASL_OK ) {
324 int slap_sasl_reset( Connection *conn )
326 #ifdef HAVE_CYRUS_SASL
327 sasl_conn_t *ctx = conn->c_sasl_context;
332 /* must return "anonymous" */
336 char ** slap_sasl_mechs( Connection *conn )
340 #ifdef HAVE_CYRUS_SASL
341 sasl_conn_t *ctx = conn->c_sasl_context;
347 sc = sasl_listmech( ctx,
348 NULL, NULL, ",", NULL,
349 &mechstr, NULL, NULL );
351 if( sc != SASL_OK ) {
352 Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
357 mechs = str2charray( mechstr, "," );
366 int slap_sasl_close( Connection *conn )
368 #ifdef HAVE_CYRUS_SASL
369 sasl_conn_t *ctx = conn->c_sasl_context;
372 sasl_dispose( &ctx );
375 conn->c_sasl_context = NULL;
377 free( conn->c_sasl_extra );
378 conn->c_sasl_extra = NULL;
395 #ifdef HAVE_CYRUS_SASL
396 sasl_conn_t *ctx = conn->c_sasl_context;
397 struct berval response;
402 Debug(LDAP_DEBUG_ARGS,
403 "==> sasl_bind: dn=\"%s\" mech=%s cred->bv_len=%d\n",
404 dn, mech ? mech : "<continuing>", cred ? cred->bv_len : 0 );
407 send_ldap_result( conn, op, LDAP_UNAVAILABLE,
408 NULL, "SASL unavailable on this session", NULL, NULL );
412 if ( mech != NULL ) {
413 sc = sasl_server_start( ctx,
415 cred->bv_val, cred->bv_len,
416 (char **)&response.bv_val, &reslen, &errstr );
419 sc = sasl_server_step( ctx,
420 cred->bv_val, cred->bv_len,
421 (char **)&response.bv_val, &reslen, &errstr );
424 response.bv_len = reslen;
426 if ( sc == SASL_OK ) {
427 char *username = NULL;
429 sc = sasl_getprop( ctx,
430 SASL_USERNAME, (void **)&username );
432 if ( sc != SASL_OK ) {
433 Debug(LDAP_DEBUG_TRACE,
434 "slap_sasl_bind: getprop(USERNAME) failed!\n",
437 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
438 NULL, "no SASL username", NULL, NULL );
440 } else if ( username == NULL || *username == '\0' ) {
441 Debug(LDAP_DEBUG_TRACE,
442 "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
445 send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
446 NULL, "no SASL username", NULL, NULL );
450 sasl_ssf_t *ssf = NULL;
452 (void) sasl_getprop( ctx,
453 SASL_REALM, (void **)&realm );
455 (void) sasl_getprop( ctx,
456 SASL_SSF, (void *)&ssf );
458 Debug(LDAP_DEBUG_TRACE,
459 "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
460 username ? username : "",
462 (unsigned long) ( ssf ? *ssf : 0 ) );
464 if( !strncasecmp( username, "anonymous", sizeof("anonyous")-1 ) &&
465 ( ( username[sizeof("anonymous")] == '\0' ) ||
466 ( username[sizeof("anonymous")] == '@' ) ) )
468 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
472 *edn = ch_malloc( sizeof( "uid= + realm=" )
473 + ( username ? strlen( username ) : 0 )
474 + ( realm ? strlen( realm ) : 0 ) );
476 strcpy( *edn, "uid=" );
477 strcat( *edn, username );
479 if( realm && *realm ) {
480 strcat( *edn, " + realm=" );
481 strcat( *edn, realm );
484 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: authzdn: \"%s\"\n",
488 send_ldap_sasl( conn, op, rc = LDAP_SUCCESS,
489 NULL, NULL, NULL, NULL,
490 response.bv_len ? &response : NULL );
493 } else if ( sc == SASL_CONTINUE ) {
494 send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
495 NULL, NULL, NULL, NULL, &response );
498 send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
499 NULL, errstr, NULL, NULL );
502 Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
505 send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
506 NULL, "SASL not supported", NULL, NULL );
512 char* slap_sasl_secprops( const char *in )
514 #ifdef HAVE_CYRUS_SASL
515 int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );
517 return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
519 return "SASL not supported";