2 * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
3 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
6 * Copyright (c) 2000, Mark Adamson, Carnegie Mellon. All rights reserved.
7 * This software is not subject to any license of Carnegie Mellon University.
9 * Redistribution and use in source and binary forms are permitted without
10 * restriction or fee of any kind as long as this notice is preserved.
12 * The name "Carnegie Mellon" must not be used to endorse or promote
13 * products derived from this software without prior written permission.
21 #include <ac/stdlib.h>
22 #include <ac/string.h>
26 #ifdef HAVE_CYRUS_SASL
29 #ifdef HAVE_SASL_SASL_H
30 #include <sasl/sasl.h>
37 #define SASLREGEX_REPLACE 10
39 typedef struct sasl_uri {
45 typedef struct sasl_regexp {
46 char *sr_match; /* regexp match pattern */
47 SaslUri_t sr_replace; /* regexp replace pattern */
48 regex_t sr_workspace; /* workspace for regexp engine */
49 regmatch_t sr_strings[SASLREGEX_REPLACE]; /* strings matching $1,$2 ... */
50 int sr_dn_offset[SASLREGEX_REPLACE+2]; /* offsets of $1,$2... in *replace */
51 int sr_fi_offset[SASLREGEX_REPLACE+2]; /* offsets of $1,$2... in *replace */
54 static int nSaslRegexp = 0;
55 static SaslRegexp_t *SaslRegexp = NULL;
57 /* What SASL proxy authorization policies are allowed? */
58 #define SASL_AUTHZ_NONE 0
59 #define SASL_AUTHZ_FROM 1
60 #define SASL_AUTHZ_TO 2
62 static int authz_policy = SASL_AUTHZ_NONE;
64 int slap_sasl_setpolicy( const char *arg )
66 int rc = LDAP_SUCCESS;
68 if ( strcasecmp( arg, "none" ) == 0 )
69 authz_policy = SASL_AUTHZ_NONE;
70 else if ( strcasecmp( arg, "from" ) == 0 )
71 authz_policy = SASL_AUTHZ_FROM;
72 else if ( strcasecmp( arg, "to" ) == 0 )
73 authz_policy = SASL_AUTHZ_TO;
74 else if ( strcasecmp( arg, "both" ) == 0 )
75 authz_policy = SASL_AUTHZ_FROM | SASL_AUTHZ_TO;
81 /* URI format: ldap://<host>/<base>[?[<attrs>][?[<scope>][?[<filter>]]]] */
83 static int slap_parseURI( struct berval *uri,
84 struct berval *searchbase, int *scope, Filter **filter,
91 assert( uri != NULL && uri->bv_val != NULL );
92 searchbase->bv_val = NULL;
93 searchbase->bv_len = 0;
103 LDAP_LOG( TRANSPORT, ENTRY,
104 "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
106 Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri->bv_val, 0, 0 );
109 /* If it does not look like a URI, assume it is a DN */
110 if( !strncasecmp( uri->bv_val, "dn:", sizeof("dn:")-1 ) ) {
111 bv.bv_val = uri->bv_val + sizeof("dn:")-1;
112 bv.bv_val += strspn( bv.bv_val, " " );
114 is_dn: bv.bv_len = uri->bv_len - (bv.bv_val - uri->bv_val);
115 rc = dnNormalize2( NULL, &bv, searchbase );
116 if (rc == LDAP_SUCCESS) {
117 *scope = LDAP_SCOPE_BASE;
122 rc = ldap_url_parse( uri->bv_val, &ludp );
123 if ( rc == LDAP_URL_ERR_BADSCHEME ) {
124 bv.bv_val = uri->bv_val;
128 if ( rc != LDAP_URL_SUCCESS ) {
129 return( LDAP_PROTOCOL_ERROR );
132 if ( ludp->lud_host && *ludp->lud_host ) {
133 /* host part should be empty */
134 return( LDAP_PROTOCOL_ERROR );
138 *scope = ludp->lud_scope;
140 /* Grab the filter */
141 if ( ludp->lud_filter ) {
142 *filter = str2filter( ludp->lud_filter );
143 if ( *filter == NULL )
144 rc = LDAP_PROTOCOL_ERROR;
146 ber_str2bv( ludp->lud_filter, 0, 1, fstr );
149 /* Grab the searchbase */
150 if ( rc == LDAP_URL_SUCCESS ) {
151 bv.bv_val = ludp->lud_dn;
152 bv.bv_len = strlen( bv.bv_val );
153 rc = dnNormalize2( NULL, &bv, searchbase );
156 ldap_free_urldesc( ludp );
161 static int slap_sasl_rx_off(char *rep, int *off)
166 /* Precompile replace pattern. Find the $<n> placeholders */
169 for ( c = rep; *c; c++ ) {
170 if ( *c == '\\' && c[1] ) {
175 if ( n == SASLREGEX_REPLACE ) {
177 LDAP_LOG( TRANSPORT, ERR,
178 "slap_sasl_regexp_config: \"%s\" has too many $n "
179 "placeholders (max %d)\n", rep, SASLREGEX_REPLACE, 0 );
181 Debug( LDAP_DEBUG_ANY,
182 "SASL replace pattern %s has too many $n "
183 "placeholders (max %d)\n",
184 rep, SASLREGEX_REPLACE, 0 );
187 return( LDAP_OPERATIONS_ERROR );
194 /* Final placeholder, after the last $n */
198 return( LDAP_SUCCESS );
201 int slap_sasl_regexp_config( const char *match, const char *replace )
206 struct berval bv, nbv;
209 SaslRegexp = (SaslRegexp_t *) ch_realloc( (char *) SaslRegexp,
210 (nSaslRegexp + 1) * sizeof(SaslRegexp_t) );
211 reg = &( SaslRegexp[nSaslRegexp] );
212 ber_str2bv( match, 0, 0, &bv );
213 rc = dnNormalize2( NULL, &bv, &nbv );
216 LDAP_LOG( TRANSPORT, ERR,
217 "slap_sasl_regexp_config: \"%s\" could not be normalized.\n",
220 Debug( LDAP_DEBUG_ANY,
221 "SASL match pattern %s could not be normalized.\n",
226 reg->sr_match = nbv.bv_val;
228 ber_str2bv( replace, 0, 0, &bv );
229 rc = slap_parseURI( &bv, ®->sr_replace.dn, ®->sr_replace.scope,
230 &filter, ®->sr_replace.filter );
231 if ( filter ) filter_free( filter );
234 LDAP_LOG( TRANSPORT, ERR,
235 "slap_sasl_regexp_config: \"%s\" could not be parsed.\n",
238 Debug( LDAP_DEBUG_ANY,
239 "SASL replace pattern %s could not be parsed.\n",
245 /* Precompile matching pattern */
246 rc = regcomp( ®->sr_workspace, reg->sr_match, REG_EXTENDED|REG_ICASE );
249 LDAP_LOG( TRANSPORT, ERR,
250 "slap_sasl_regexp_config: \"%s\" could not be compiled.\n",
251 reg->sr_match, 0, 0 );
253 Debug( LDAP_DEBUG_ANY,
254 "SASL match pattern %s could not be compiled by regexp engine\n",
255 reg->sr_match, 0, 0 );
258 return( LDAP_OPERATIONS_ERROR );
261 rc = slap_sasl_rx_off( reg->sr_replace.dn.bv_val, reg->sr_dn_offset );
262 if ( rc != LDAP_SUCCESS ) return rc;
264 if (reg->sr_replace.filter.bv_val ) {
265 rc = slap_sasl_rx_off( reg->sr_replace.filter.bv_val, reg->sr_fi_offset );
266 if ( rc != LDAP_SUCCESS ) return rc;
270 return( LDAP_SUCCESS );
274 /* Perform replacement on regexp matches */
275 static void slap_sasl_rx_exp( char *rep, int *off, regmatch_t *str,
276 char *saslname, struct berval *out )
278 int i, n, len, insert;
280 /* Get the total length of the final URI */
284 while( off[n] >= 0 ) {
285 /* Len of next section from replacement string (x,y,z above) */
286 len += off[n] - off[n-1] - 2;
290 /* Len of string from saslname that matched next $i (b,d above) */
291 i = rep[ off[n] + 1 ] - '0';
292 len += str[i].rm_eo - str[i].rm_so;
295 out->bv_val = ch_malloc( len + 1 );
298 /* Fill in URI with replace string, replacing $i as we go */
301 while( off[n] >= 0) {
302 /* Paste in next section from replacement string (x,y,z above) */
303 len = off[n] - off[n-1] - 2;
304 strncpy( out->bv_val+insert, rep + off[n-1] + 2, len);
309 /* Paste in string from saslname that matched next $i (b,d above) */
310 i = rep[ off[n] + 1 ] - '0';
311 len = str[i].rm_eo - str[i].rm_so;
312 strncpy( out->bv_val+insert, saslname + str[i].rm_so, len );
318 out->bv_val[insert] = '\0';
321 /* Take the passed in SASL name and attempt to convert it into an
322 LDAP URI to find the matching LDAP entry, using the pattern matching
323 strings given in the saslregexp config file directive(s) */
325 static int slap_sasl_regexp( struct berval *in, SaslUri_t *out )
327 char *saslname = in->bv_val;
328 char *scope[] = { "base", "one", "sub" };
332 memset( out, 0, sizeof( *out ) );
335 LDAP_LOG( TRANSPORT, ENTRY,
336 "slap_sasl_regexp: converting SASL name %s\n", saslname, 0, 0 );
338 Debug( LDAP_DEBUG_TRACE, "slap_sasl_regexp: converting SASL name %s\n",
342 if (( saslname == NULL ) || ( nSaslRegexp == 0 ))
345 /* Match the normalized SASL name to the saslregexp patterns */
346 for( reg = SaslRegexp,i=0; i<nSaslRegexp; i++,reg++ ) {
347 if ( regexec( ®->sr_workspace, saslname, SASLREGEX_REPLACE,
348 reg->sr_strings, 0) == 0 )
352 if( i >= nSaslRegexp )
356 * The match pattern may have been of the form "a(b.*)c(d.*)e" and the
357 * replace pattern of the form "x$1y$2z". The returned string needs
358 * to replace the $1,$2 with the strings that matched (b.*) and (d.*)
360 slap_sasl_rx_exp( reg->sr_replace.dn.bv_val, reg->sr_dn_offset,
361 reg->sr_strings, saslname, &out->dn );
363 if ( reg->sr_replace.filter.bv_val )
364 slap_sasl_rx_exp( reg->sr_replace.filter.bv_val,
365 reg->sr_fi_offset, reg->sr_strings, saslname, &out->filter );
367 out->scope = reg->sr_replace.scope;
370 LDAP_LOG( TRANSPORT, ENTRY,
371 "slap_sasl_regexp: converted SASL name to ldap:///%s??%s?%s\n",
372 out->dn.bv_val, scope[out->scope], out->filter.bv_val ?
373 out->filter.bv_val : "" );
375 Debug( LDAP_DEBUG_TRACE,
376 "slap_sasl_regexp: converted SASL name to ldap:///%s??%s?%s\n",
377 out->dn.bv_val, scope[out->scope], out->filter.bv_val ?
378 out->filter.bv_val : "" );
384 /* Two empty callback functions to avoid sending results */
385 static void sasl_sc_r( Connection *conn, Operation *o, ber_tag_t tag,
386 ber_int_t msgid, ber_int_t err, const char *matched,
387 const char *text, BerVarray ref, const char *resoid,
388 struct berval *resdata, struct berval *sasldata, LDAPControl **c)
392 static void sasl_sc_s( Connection *conn, Operation *o, ber_int_t err,
393 const char *matched, const char *text, BerVarray refs, LDAPControl **c,
398 /* This callback actually does some work...*/
399 static int sasl_sc_sasl2dn( BackendDB *be, Connection *conn, Operation *o,
400 Entry *e, AttributeName *an, int ao, LDAPControl **c)
402 struct berval *ndn = o->o_callback->sc_private;
404 /* We only want to be called once */
410 LDAP_LOG( TRANSPORT, DETAIL1,
411 "slap_sasl2dn: search DN returned more than 1 entry\n", 0, 0, 0 );
413 Debug( LDAP_DEBUG_TRACE,
414 "slap_sasl2dn: search DN returned more than 1 entry\n", 0,0,0 );
419 ber_dupbv(ndn, &e->e_nname);
424 * Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTH")
425 * return the LDAP DN to which it matches. The SASL regexp rules in the config
426 * file turn the SASL name into an LDAP URI. If the URI is just a DN (or a
427 * search with scope=base), just return the URI (or its searchbase). Otherwise
428 * an internal search must be done, and if that search returns exactly one
429 * entry, return the DN of that one entry.
432 void slap_sasl2dn( Connection *conn, struct berval *saslname, struct berval *dn )
437 slap_callback cb = {sasl_sc_r, sasl_sc_s, sasl_sc_sasl2dn, NULL};
442 LDAP_LOG( TRANSPORT, ENTRY,
443 "slap_sasl2dn: converting SASL name %s to DN.\n", saslname->bv_val, 0, 0 );
445 Debug( LDAP_DEBUG_TRACE, "==>slap_sasl2dn: "
446 "converting SASL name %s to a DN\n", saslname->bv_val, 0,0 );
453 /* Convert the SASL name into a minimal URI */
454 if( !slap_sasl_regexp( saslname, &uri ) )
457 if ( uri.filter.bv_val )
458 filter = str2filter( uri.filter.bv_val );
460 /* Must do an internal search */
462 be = select_backend( &uri.dn, 0, 1 );
464 /* Massive shortcut: search scope == base */
465 if( uri.scope == LDAP_SCOPE_BASE ) {
468 uri.dn.bv_val = NULL;
473 LDAP_LOG( TRANSPORT, DETAIL1,
474 "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
475 uri.dn.bv_val, uri.scope, 0 );
477 Debug( LDAP_DEBUG_TRACE,
478 "slap_sasl2dn: performing internal search (base=%s, scope=%d)\n",
479 uri.dn.bv_val, uri.scope, 0 );
482 if(( be == NULL ) || ( be->be_search == NULL)) {
485 suffix_alias( be, &uri.dn );
487 op.o_tag = LDAP_REQ_SEARCH;
488 op.o_protocol = LDAP_VERSION3;
489 op.o_ndn = *saslname;
491 op.o_time = slap_get_time();
492 op.o_do_not_cache = 1;
494 (*be->be_search)( be, conn, &op, NULL, &uri.dn,
495 uri.scope, LDAP_DEREF_NEVER, 1, 0,
496 filter, NULL, NULL, 1 );
500 conn->c_authz_backend = be;
502 if( uri.dn.bv_len ) ch_free( uri.dn.bv_val );
503 if( uri.filter.bv_len ) ch_free( uri.filter.bv_val );
504 if( filter ) filter_free( filter );
507 LDAP_LOG( TRANSPORT, ENTRY,
508 "slap_sasl2dn: Converted SASL name to %s\n",
509 dn->bv_len ? dn->bv_val : "<nothing>", 0, 0 );
511 Debug( LDAP_DEBUG_TRACE, "<==slap_sasl2dn: Converted SASL name to %s\n",
512 dn->bv_len ? dn->bv_val : "<nothing>", 0, 0 );
518 typedef struct smatch_info {
523 static int sasl_sc_smatch( BackendDB *be, Connection *conn, Operation *o,
524 Entry *e, AttributeName *an, int ao, LDAPControl **c)
526 smatch_info *sm = o->o_callback->sc_private;
528 if (dn_match(sm->dn, &e->e_nname)) {
530 return -1; /* short-circuit the search */
537 * Map a SASL regexp rule to a DN. If the rule is just a DN or a scope=base
538 * URI, just strcmp the rule (or its searchbase) to the *assertDN. Otherwise,
539 * the rule must be used as an internal search for entries. If that search
540 * returns the *assertDN entry, the match is successful.
542 * The assertDN should not have the dn: prefix
546 int slap_sasl_match(Connection *conn, struct berval *rule, struct berval *assertDN, struct berval *authc )
548 struct berval searchbase = {0, NULL};
554 slap_callback cb = { sasl_sc_r, sasl_sc_s, sasl_sc_smatch, NULL };
558 LDAP_LOG( TRANSPORT, ENTRY,
559 "slap_sasl_match: comparing DN %s to rule %s\n",
560 assertDN->bv_val, rule->bv_val,0 );
562 Debug( LDAP_DEBUG_TRACE,
563 "===>slap_sasl_match: comparing DN %s to rule %s\n", assertDN->bv_val, rule->bv_val, 0 );
566 rc = slap_parseURI( rule, &searchbase, &scope, &filter, NULL );
567 if( rc != LDAP_SUCCESS )
570 /* Massive shortcut: search scope == base */
571 if( scope == LDAP_SCOPE_BASE ) {
572 rc = regcomp(®, searchbase.bv_val,
573 REG_EXTENDED|REG_ICASE|REG_NOSUB);
575 rc = regexec(®, assertDN->bv_val, 0, NULL, 0);
581 rc = LDAP_INAPPROPRIATE_AUTH;
585 /* Must run an internal search. */
588 LDAP_LOG( TRANSPORT, DETAIL1,
589 "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
590 searchbase.bv_val, scope,0 );
592 Debug( LDAP_DEBUG_TRACE,
593 "slap_sasl_match: performing internal search (base=%s, scope=%d)\n",
594 searchbase.bv_val, scope, 0 );
597 be = select_backend( &searchbase, 0, 1 );
598 if(( be == NULL ) || ( be->be_search == NULL)) {
599 rc = LDAP_INAPPROPRIATE_AUTH;
602 suffix_alias( be, &searchbase );
608 op.o_tag = LDAP_REQ_SEARCH;
609 op.o_protocol = LDAP_VERSION3;
612 op.o_time = slap_get_time();
613 op.o_do_not_cache = 1;
615 (*be->be_search)( be, conn, &op, /*base=*/NULL, &searchbase,
616 scope, /*deref=*/1, /*sizelimit=*/0, /*time=*/0, filter, /*fstr=*/NULL,
617 /*attrs=*/NULL, /*attrsonly=*/0 );
622 rc = LDAP_INAPPROPRIATE_AUTH;
625 if( searchbase.bv_len ) ch_free( searchbase.bv_val );
626 if( filter ) filter_free( filter );
628 LDAP_LOG( TRANSPORT, ENTRY,
629 "slap_sasl_match: comparison returned %d\n", rc, 0, 0 );
631 Debug( LDAP_DEBUG_TRACE,
632 "<===slap_sasl_match: comparison returned %d\n", rc, 0, 0);
640 * This function answers the question, "Can this ID authorize to that ID?",
641 * based on authorization rules. The rules are stored in the *searchDN, in the
642 * attribute named by *attr. If any of those rules map to the *assertDN, the
643 * authorization is approved.
645 * The DNs should not have the dn: prefix
648 slap_sasl_check_authz( Connection *conn,
649 struct berval *searchDN,
650 struct berval *assertDN,
651 AttributeDescription *ad,
652 struct berval *authc )
658 LDAP_LOG( TRANSPORT, ENTRY,
659 "slap_sasl_check_authz: does %s match %s rule in %s?\n",
660 assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
662 Debug( LDAP_DEBUG_TRACE,
663 "==>slap_sasl_check_authz: does %s match %s rule in %s?\n",
664 assertDN->bv_val, ad->ad_cname.bv_val, searchDN->bv_val);
667 rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN, ad, &vals );
668 if( rc != LDAP_SUCCESS )
671 /* Check if the *assertDN matches any **vals */
672 for( i=0; vals[i].bv_val != NULL; i++ ) {
673 rc = slap_sasl_match( conn, &vals[i], assertDN, authc );
674 if ( rc == LDAP_SUCCESS )
677 rc = LDAP_INAPPROPRIATE_AUTH;
680 if( vals ) ber_bvarray_free( vals );
683 LDAP_LOG( TRANSPORT, RESULTS,
684 "slap_sasl_check_authz: %s check returning %s\n",
685 ad->ad_cname.bv_val, rc, 0 );
687 Debug( LDAP_DEBUG_TRACE,
688 "<==slap_sasl_check_authz: %s check returning %d\n", ad->ad_cname.bv_val, rc, 0);
693 #endif /* HAVE_CYRUS_SASL */
696 /* Check if a bind can SASL authorize to another identity.
697 * The DNs should not have the dn: prefix
700 int slap_sasl_authorized( Connection *conn,
701 struct berval *authcDN, struct berval *authzDN )
703 int rc = LDAP_INAPPROPRIATE_AUTH;
705 #ifdef HAVE_CYRUS_SASL
706 /* User binding as anonymous */
707 if ( authzDN == NULL ) {
713 LDAP_LOG( TRANSPORT, ENTRY,
714 "slap_sasl_authorized: can %s become %s?\n",
715 authcDN->bv_val, authzDN->bv_val, 0 );
717 Debug( LDAP_DEBUG_TRACE,
718 "==>slap_sasl_authorized: can %s become %s?\n", authcDN->bv_val, authzDN->bv_val, 0 );
721 /* If person is authorizing to self, succeed */
722 if ( dn_match( authcDN, authzDN ) ) {
727 /* Check source rules */
728 if( authz_policy & SASL_AUTHZ_TO ) {
729 rc = slap_sasl_check_authz( conn, authcDN, authzDN,
730 slap_schema.si_ad_saslAuthzTo, authcDN );
731 if( rc == LDAP_SUCCESS ) {
736 /* Check destination rules */
737 if( authz_policy & SASL_AUTHZ_FROM ) {
738 rc = slap_sasl_check_authz( conn, authzDN, authcDN,
739 slap_schema.si_ad_saslAuthzFrom, authcDN );
740 if( rc == LDAP_SUCCESS ) {
745 rc = LDAP_INAPPROPRIATE_AUTH;
751 LDAP_LOG( TRANSPORT, RESULTS, "slap_sasl_authorized: return %d\n", rc,0,0 );
753 Debug( LDAP_DEBUG_TRACE,
754 "<== slap_sasl_authorized: return %d\n", rc, 0, 0 );