2 * Copyright (c) 2000, Mark Adamson, Carnegie Mellon. All rights reserved.
3 * This software is not subject to any license of Carnegie Mellon University.
5 * Redistribution and use in source and binary forms are permitted without
6 * restriction or fee of any kind as long as this notice is preserved.
8 * The name "Carnegie Mellon" must not be used to endorse or promote
9 * products derived from this software without prior written permission.
17 #include <ac/stdlib.h>
18 #include <ac/string.h>
22 #ifdef HAVE_CYRUS_SASL
25 #ifdef HAVE_SASL_SASL_H
26 #include <sasl/sasl.h>
33 #define SASLREGEX_REPLACE 10
35 typedef struct sasl_uri {
41 typedef struct sasl_regexp {
42 char *sr_match; /* regexp match pattern */
43 SaslUri_t sr_replace; /* regexp replace pattern */
44 regex_t sr_workspace; /* workspace for regexp engine */
45 regmatch_t sr_strings[SASLREGEX_REPLACE]; /* strings matching $1,$2 ... */
46 int sr_dn_offset[SASLREGEX_REPLACE+2]; /* offsets of $1,$2... in *replace */
47 int sr_fi_offset[SASLREGEX_REPLACE+2]; /* offsets of $1,$2... in *replace */
50 static int nSaslRegexp = 0;
51 static SaslRegexp_t *SaslRegexp = NULL;
53 /* What SASL proxy authorization policies are allowed? */
54 #define SASL_AUTHZ_NONE 0
55 #define SASL_AUTHZ_FROM 1
56 #define SASL_AUTHZ_TO 2
58 static int authz_policy = SASL_AUTHZ_NONE;
60 int slap_sasl_setpolicy( const char *arg )
62 int rc = LDAP_SUCCESS;
64 if ( strcasecmp( arg, "none" ) == 0 )
65 authz_policy = SASL_AUTHZ_NONE;
66 else if ( strcasecmp( arg, "from" ) == 0 )
67 authz_policy = SASL_AUTHZ_FROM;
68 else if ( strcasecmp( arg, "to" ) == 0 )
69 authz_policy = SASL_AUTHZ_TO;
70 else if ( strcasecmp( arg, "both" ) == 0 )
71 authz_policy = SASL_AUTHZ_FROM | SASL_AUTHZ_TO;
77 /* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
79 static int slap_parseURI( struct berval *uri,
80 struct berval *searchbase, int *scope, Filter **filter,
87 assert( uri != NULL && uri->bv_val != NULL );
88 searchbase->bv_val = NULL;
89 searchbase->bv_len = 0;
99 LDAP_LOG( TRANSPORT, ENTRY,
100 "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
102 Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
105 /* If it does not look like a URI, assume it is a DN */
106 if( !strncasecmp( uri->bv_val, "dn:", sizeof("dn:")-1 ) ) {
107 bv.bv_val = uri->bv_val + sizeof("dn:")-1;
108 bv.bv_val += strspn( bv.bv_val, " " );
110 is_dn: bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val);
111 rc = dnNormalize2( NULL, &bv, searchbase );
112 if (rc == LDAP_SUCCESS) {
113 *scope = LDAP_SCOPE_BASE;
118 rc = ldap_url_parse( uri->bv_val, &ludp );
119 if ( rc == LDAP_URL_ERR_BADSCHEME ) {
120 bv.bv_val = uri->bv_val;
124 if ( rc != LDAP_URL_SUCCESS ) {
125 return( LDAP_PROTOCOL_ERROR );
128 if ( ludp->lud_host && *ludp->lud_host ) {
129 /* host part should be empty */
130 return( LDAP_PROTOCOL_ERROR );
134 *scope = ludp->lud_scope;
136 /* Grab the filter */
137 if ( ludp->lud_filter ) {
138 *filter = str2filter( ludp->lud_filter );
139 if ( *filter == NULL )
140 rc = LDAP_PROTOCOL_ERROR;
142 ber_str2bv( ludp->lud_filter, 0, 1, fstr );
145 /* Grab the searchbase */
146 if ( rc == LDAP_URL_SUCCESS ) {
147 bv.bv_val = ludp->lud_dn;
148 bv.bv_len = strlen( bv.bv_val );
149 rc = dnNormalize2( NULL, &bv, searchbase );
152 ldap_free_urldesc( ludp );
157 static int slap_sasl_rx_off(char *rep, int *off)
162 /* Precompile replace pattern. Find the $<n> placeholders */
165 for ( c = rep; *c; c++ ) {
166 if ( *c == '\\' && c[1] ) {
171 if ( n == SASLREGEX_REPLACE ) {
173 LDAP_LOG( TRANSPORT, ERR,
174 "slap_sasl_regexp_config: \"%s\" has too many $n "
175 "placeholders (max %d)\n", rep, SASLREGEX_REPLACE, 0 );
177 Debug( LDAP_DEBUG_ANY,
178 "SASL replace pattern %s has too many $n "
179 "placeholders (max %d)\n",
180 rep, SASLREGEX_REPLACE, 0 );
183 return( LDAP_OPERATIONS_ERROR );
190 /* Final placeholder, after the last $n */
194 return( LDAP_SUCCESS );
196 #endif /* HAVE_CYRUS_SASL */
198 int slap_sasl_regexp_config( const char *match, const char *replace )
200 #ifdef HAVE_CYRUS_SASL
204 struct berval bv, nbv;
207 SaslRegexp = (SaslRegexp_t *) ch_realloc( (char *) SaslRegexp,
208 (nSaslRegexp + 1) * sizeof(SaslRegexp_t) );
209 reg = &( SaslRegexp[nSaslRegexp] );
210 ber_str2bv( match, 0, 0, &bv );
211 rc = dnNormalize2( NULL, &bv, &nbv );
214 LDAP_LOG( TRANSPORT, ERR,
215 "slap_sasl_regexp_config: \"%s\" could not be normalized.\n",
218 Debug( LDAP_DEBUG_ANY,
219 "SASL match pattern %s could not be normalized.\n",
224 reg->sr_match = nbv.bv_val;
226 ber_str2bv( replace, 0, 0, &bv );
227 rc = slap_parseURI( &bv, ®->sr_replace.dn, ®->sr_replace.scope,
228 &filter, ®->sr_replace.filter );
229 if ( filter ) filter_free( filter );
232 LDAP_LOG( TRANSPORT, ERR,
233 "slap_sasl_regexp_config: \"%s\" could not be parsed.\n",
236 Debug( LDAP_DEBUG_ANY,
237 "SASL replace pattern %s could not be parsed.\n",
243 /* Precompile matching pattern */
244 rc = regcomp( ®->sr_workspace, reg->sr_match, REG_EXTENDED|REG_ICASE );
247 LDAP_LOG( TRANSPORT, ERR,
248 "slap_sasl_regexp_config: \"%s\" could not be compiled.\n",
249 reg->sr_match, 0, 0 );
251 Debug( LDAP_DEBUG_ANY,
252 "SASL match pattern %s could not be compiled by regexp engine\n",
253 reg->sr_match, 0, 0 );
256 return( LDAP_OPERATIONS_ERROR );
259 rc = slap_sasl_rx_off( reg->sr_replace.dn.bv_val, reg->sr_dn_offset );
260 if ( rc != LDAP_SUCCESS ) return rc;
262 if (reg->sr_replace.filter.bv_val ) {
263 rc = slap_sasl_rx_off( reg->sr_replace.filter.bv_val, reg->sr_fi_offset );
264 if ( rc != LDAP_SUCCESS ) return rc;
269 return( LDAP_SUCCESS );
273 #ifdef HAVE_CYRUS_SASL
275 /* Perform replacement on regexp matches */
276 static void slap_sasl_rx_exp( char *rep, int *off, regmatch_t *str,
277 char *saslname, struct berval *out )
279 int i, n, len, insert;
281 /* Get the total length of the final URI */
285 while( off[n] >= 0 ) {
286 /* Len of next section from replacement string (x,y,z above) */
287 len += off[n] - off[n-1] - 2;
291 /* Len of string from saslname that matched next $i (b,d above) */
292 i = rep[ off[n] + 1 ] - '0';
293 len += str[i].rm_eo - str[i].rm_so;
296 out->bv_val = ch_malloc( len + 1 );
299 /* Fill in URI with replace string, replacing $i as we go */
302 while( off[n] >= 0) {
303 /* Paste in next section from replacement string (x,y,z above) */
304 len = off[n] - off[n-1] - 2;
305 strncpy( out->bv_val+insert, rep + off[n-1] + 2, len);
310 /* Paste in string from saslname that matched next $i (b,d above) */
311 i = rep[ off[n] + 1 ] - '0';
312 len = str[i].rm_eo - str[i].rm_so;
313 strncpy( out->bv_val+insert, saslname + str[i].rm_so, len );
319 out->bv_val[insert] = '\0';
322 /* Take the passed in SASL name and attempt to convert it into an
323 LDAP URI to find the matching LDAP entry, using the pattern matching
324 strings given in the saslregexp config file directive(s) */
326 static int slap_sasl_regexp( struct berval *in, SaslUri_t *out )
328 char *saslname = in->bv_val;
329 char *scope[] = { "base", "one", "sub" };
333 memset( out, 0, sizeof( *out ) );
336 LDAP_LOG( TRANSPORT, ENTRY,
337 "slap_sasl_regexp: converting SASL name %s\n", saslname, 0, 0 );
339 Debug( LDAP_DEBUG_TRACE, "slap_sasl_regexp: converting SASL name %s\n",
343 if (( saslname == NULL ) || ( nSaslRegexp == 0 ))
346 /* Match the normalized SASL name to the saslregexp patterns */
347 for( reg = SaslRegexp,i=0; i<nSaslRegexp; i++,reg++ ) {
348 if ( regexec( ®->sr_workspace, saslname, SASLREGEX_REPLACE,
349 reg->sr_strings, 0) == 0 )
353 if( i >= nSaslRegexp )
357 * The match pattern may have been of the form "a(b.*)c(d.*)e" and the
358 * replace pattern of the form "x$1y$2z". The returned string needs
359 * to replace the $1,$2 with the strings that matched (b.*) and (d.*)
361 slap_sasl_rx_exp( reg->sr_replace.dn.bv_val, reg->sr_dn_offset,
362 reg->sr_strings, saslname, &out->dn );
364 if ( reg->sr_replace.filter.bv_val )
365 slap_sasl_rx_exp( reg->sr_replace.filter.bv_val,
366 reg->sr_fi_offset, reg->sr_strings, saslname, &out->filter );
368 out->scope = reg->sr_replace.scope;
371 LDAP_LOG( TRANSPORT, ENTRY,
372 "slap_sasl_regexp: converted SASL name to ldap:///%s??%s?%s\n",
373 out->dn.bv_val, scope[out->scope], out->filter.bv_val ?
374 out->filter.bv_val : "" );
376 Debug( LDAP_DEBUG_TRACE,
377 "slap_sasl_regexp: converted SASL name to ldap:///%s??%s?%s\n",
378 out->dn.bv_val, scope[out->scope], out->filter.bv_val ?
379 out->filter.bv_val : "" );
385 /* Two empty callback functions to avoid sending results */
386 static void sasl_sc_r( Connection *conn, Operation *o, ber_tag_t tag,
387 ber_int_t msgid, ber_int_t err, const char *matched,
388 const char *text, BerVarray ref, const char *resoid,
389 struct berval *resdata, struct berval *sasldata, LDAPControl **c)
393 static void sasl_sc_s( Connection *conn, Operation *o, ber_int_t err,
394 const char *matched, const char *text, BerVarray refs, LDAPControl **c,
399 /* This callback actually does some work...*/
400 static int sasl_sc_sasl2dn( BackendDB *be, Connection *conn, Operation *o,
401 Entry *e, AttributeName *an, int ao, LDAPControl **c)
403 struct berval *ndn = o->o_callback->sc_private;
405 /* We only want to be called once */
411 LDAP_LOG( TRANSPORT, DETAIL1,
412 "slap_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 );
414 Debug( LDAP_DEBUG_TRACE,
415 "slap_sasl2dn: search DN returned more than 1 entry\n", 0,0,0 );
420 ber_dupbv(ndn, &e->e_nname);
425 * Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTH")
426 * return the LDAP DN to which it matches. The SASL regexp rules in the config
427 * file turn the SASL name into an LDAP URI. If the URI is just a DN (or a
428 * search with scope=base), just return the URI (or its searchbase). Otherwise
429 * an internal search must be done, and if that search returns exactly one
430 * entry, return the DN of that one entry.
433 void slap_sasl2dn( Connection *conn, struct berval *saslname, struct berval *dn )
438 slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_sasl2dn, NULL};
443 LDAP_LOG( TRANSPORT, ENTRY,
444 "slap_sasl2dn: converting SASL name %s to DN.\n", saslname->bv_val, 0, 0 );
446 Debug( LDAP_DEBUG_TRACE, "==>slap_sasl2dn: "
447 "converting SASL name %s to a DN\n", saslname->bv_val, 0,0 );
454 /* Convert the SASL name into a minimal URI */
455 if( !slap_sasl_regexp( saslname, &uri ) )
458 if ( uri.filter.bv_val )
459 filter = str2filter( uri.filter.bv_val );
461 /* Must do an internal search */
463 be = select_backend( &uri.dn, 0, 1 );
465 /* Massive shortcut: search scope == base */
466 if( uri.scope == LDAP_SCOPE_BASE ) {
469 uri.dn.bv_val = NULL;
474 LDAP_LOG( TRANSPORT, DETAIL1,
475 "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
476 uri.dn.bv_val, uri.scope, 0 );
478 Debug( LDAP_DEBUG_TRACE,
479 "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
480 uri.dn.bv_val, uri.scope, 0 );
483 if(( be == NULL ) || ( be->be_search == NULL)) {
486 suffix_alias( be, &uri.dn );
488 op.o_tag = LDAP_REQ_SEARCH;
489 op.o_protocol = LDAP_VERSION3;
490 op.o_ndn = *saslname;
492 op.o_time = slap_get_time();
494 (*be->be_search)( be, NULL, &op, NULL, &uri.dn,
495 uri.scope, LDAP_DEREF_NEVER, 1, 0,
496 filter, NULL, NULL, 1 );
500 conn->c_authz_backend = be;
502 if( uri.dn.bv_len ) ch_free( uri.dn.bv_val );
503 if( uri.filter.bv_len ) ch_free( uri.filter.bv_val );
504 if( filter ) filter_free( filter );
507 LDAP_LOG( TRANSPORT, ENTRY,
508 "slap_sasl2dn: Converted SASL name to %s\n",
509 dn->bv_len ? dn->bv_val : "<nothing>", 0, 0 );
511 Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n",
512 dn->bv_len ? dn->bv_val : "<nothing>", 0, 0 );
518 typedef struct smatch_info {
523 static int sasl_sc_smatch( BackendDB *be, Connection *conn, Operation *o,
524 Entry *e, AttributeName *an, int ao, LDAPControl **c)
526 smatch_info *sm = o->o_callback->sc_private;
528 if (dn_match(sm->dn, &e->e_nname)) {
530 return -1; /* short-circuit the search */
537 * Map a SASL regexp rule to a DN. If the rule is just a DN or a scope=base
538 * URI, just strcmp the rule (or its searchbase) to the *assertDN. Otherwise,
539 * the rule must be used as an internal search for entries. If that search
540 * returns the *assertDN entry, the match is successful.
542 * The assertDN should not have the dn: prefix
546 int slap_sasl_match( struct berval *rule, struct berval *assertDN, struct berval *authc )
548 struct berval searchbase = {0, NULL};
554 slap_callback cb = { sasl_sc_r, sasl_sc_s, sasl_sc_smatch, NULL };
558 LDAP_LOG( TRANSPORT, ENTRY,
559 "slap_sasl_match: comparing DN %s to rule %s\n",
560 assertDN->bv_val, rule->bv_val,0 );
562 Debug( LDAP_DEBUG_TRACE,
563 "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val, 0 );
566 rc = slap_parseURI( rule, &searchbase, &scope, &filter, NULL );
567 if( rc != LDAP_SUCCESS )
570 /* Massive shortcut: search scope == base */
571 if( scope == LDAP_SCOPE_BASE ) {
572 rc = regcomp(®, searchbase.bv_val,
573 REG_EXTENDED|REG_ICASE|REG_NOSUB);
575 rc = regexec(®, assertDN->bv_val, 0, NULL, 0);
581 rc = LDAP_INAPPROPRIATE_AUTH;
585 /* Must run an internal search. */
588 LDAP_LOG( TRANSPORT, DETAIL1,
589 "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
590 searchbase.bv_val, scope,0 );
592 Debug( LDAP_DEBUG_TRACE,
593 "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
594 searchbase.bv_val, scope, 0 );
597 be = select_backend( &searchbase, 0, 1 );
598 if(( be == NULL ) || ( be->be_search == NULL)) {
599 rc = LDAP_INAPPROPRIATE_AUTH;
602 suffix_alias( be, &searchbase );
608 op.o_tag = LDAP_REQ_SEARCH;
609 op.o_protocol = LDAP_VERSION3;
612 op.o_time = slap_get_time();
614 (*be->be_search)( be, /*conn=*/NULL, &op, /*base=*/NULL, &searchbase,
615 scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL,
616 /*attrs=*/NULL, /*attrsonly=*/0 );
621 rc = LDAP_INAPPROPRIATE_AUTH;
624 if( searchbase.bv_len ) ch_free( searchbase.bv_val );
625 if( filter ) filter_free( filter );
627 LDAP_LOG( TRANSPORT, ENTRY,
628 "slap_sasl_match: comparison returned %d\n", rc, 0, 0 );
630 Debug( LDAP_DEBUG_TRACE,
631 "<===slap_sasl_match: comparison returned %d\n", rc, 0, 0);
639 * This function answers the question, "Can this ID authorize to that ID?",
640 * based on authorization rules. The rules are stored in the *searchDN, in the
641 * attribute named by *attr. If any of those rules map to the *assertDN, the
642 * authorization is approved.
644 * The DNs should not have the dn: prefix
647 slap_sasl_check_authz(struct berval *searchDN, struct berval *assertDN, AttributeDescription *ad, struct berval *authc)
653 LDAP_LOG( TRANSPORT, ENTRY,
654 "slap_sasl_check_authz: does %s match %s rule in %s?\n",
655 assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
657 Debug( LDAP_DEBUG_TRACE,
658 "==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
659 assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
662 rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN, ad, &vals );
663 if( rc != LDAP_SUCCESS )
666 /* Check if the *assertDN matches any **vals */
667 for( i=0; vals[i].bv_val != NULL; i++ ) {
668 rc = slap_sasl_match( &vals[i], assertDN, authc );
669 if ( rc == LDAP_SUCCESS )
672 rc = LDAP_INAPPROPRIATE_AUTH;
675 if( vals ) ber_bvarray_free( vals );
678 LDAP_LOG( TRANSPORT, RESULTS,
679 "slap_sasl_check_authz: %s check returning %s\n",
680 ad->ad_cname.bv_val, rc, 0 );
682 Debug( LDAP_DEBUG_TRACE,
683 "<==slap_sasl_check_authz: %s check returning %d\n", ad->ad_cname.bv_val, rc, 0);
688 #endif /* HAVE_CYRUS_SASL */
691 /* Check if a bind can SASL authorize to another identity.
692 * The DNs should not have the dn: prefix
695 int slap_sasl_authorized( struct berval *authcDN, struct berval *authzDN )
697 int rc = LDAP_INAPPROPRIATE_AUTH;
699 #ifdef HAVE_CYRUS_SASL
700 /* User binding as anonymous */
701 if ( authzDN == NULL ) {
707 LDAP_LOG( TRANSPORT, ENTRY,
708 "slap_sasl_authorized: can %s become %s?\n",
709 authcDN->bv_val, authzDN->bv_val, 0 );
711 Debug( LDAP_DEBUG_TRACE,
712 "==>slap_sasl_authorized: can %s become %s?\n", authcDN->bv_val, authzDN->bv_val, 0 );
715 /* If person is authorizing to self, succeed */
716 if ( dn_match( authcDN, authzDN ) ) {
721 /* Check source rules */
722 if( authz_policy & SASL_AUTHZ_TO ) {
723 rc = slap_sasl_check_authz( authcDN, authzDN,
724 slap_schema.si_ad_saslAuthzTo, authcDN );
725 if( rc == LDAP_SUCCESS ) {
730 /* Check destination rules */
731 if( authz_policy & SASL_AUTHZ_FROM ) {
732 rc = slap_sasl_check_authz( authzDN, authcDN,
733 slap_schema.si_ad_saslAuthzFrom, authcDN );
734 if( rc == LDAP_SUCCESS ) {
739 rc = LDAP_INAPPROPRIATE_AUTH;
745 LDAP_LOG( TRANSPORT, RESULTS, "slap_sasl_authorized: return %d\n", rc,0,0 );
747 Debug( LDAP_DEBUG_TRACE,
748 "<== slap_sasl_authorized: return %d\n", rc, 0, 0 );