+/* $OpenLDAP$ */
/*
- * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved.
+ * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
* COPYING RESTRICTIONS APPLY, see COPYRIGHT file
*/
/* Portions
* kbind.c
*/
+/*
+ * BindRequest ::= SEQUENCE {
+ * version INTEGER,
+ * name DistinguishedName, -- who
+ * authentication CHOICE {
+ * simple [0] OCTET STRING -- passwd
+#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
+ * krbv42ldap [1] OCTET STRING
+ * krbv42dsa [2] OCTET STRING
+#endif
+ * sasl [3] SaslCredentials -- LDAPv3
+ * }
+ * }
+ *
+ * BindResponse ::= SEQUENCE {
+ * COMPONENTS OF LDAPResult,
+ * serverSaslCreds OCTET STRING OPTIONAL -- LDAPv3
+ * }
+ *
+ */
+
#include "portable.h"
-#ifdef HAVE_KERBEROS
+#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
#include <stdio.h>
#include <ac/stdlib.h>
{
BerElement *ber;
char *cred;
- int rc, credlen;
-#ifdef STR_TRANSLATION
- int str_translation_on;
-#endif /* STR_TRANSLATION */
-
- /*
- * The bind request looks like this:
- * BindRequest ::= SEQUENCE {
- * version INTEGER,
- * name DistinguishedName,
- * authentication CHOICE {
- * krbv42ldap [1] OCTET STRING
- * krbv42dsa [2] OCTET STRING
- * }
- * }
- * all wrapped up in an LDAPMessage sequence.
- */
+ int rc;
+ ber_len_t credlen;
Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind1\n", 0, 0, 0 );
+ if( ld->ld_version > LDAP_VERSION2 ) {
+ ld->ld_errno = LDAP_NOT_SUPPORTED;
+ return -1;
+ }
+
if ( dn == NULL )
dn = "";
}
/* create a message to send */
- if ( (ber = ldap_alloc_ber_with_options( ld )) == NULLBER ) {
+ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
LDAP_FREE( cred );
return( -1 );
}
-#ifdef STR_TRANSLATION
- if (( str_translation_on = (( ber->ber_options &
- LBER_TRANSLATE_STRINGS ) != 0 ))) { /* turn translation off */
- ber->ber_options &= ~LBER_TRANSLATE_STRINGS;
- }
-#endif /* STR_TRANSLATION */
-
/* fill it in */
- rc = ber_printf( ber, "{it{isto}}", ++ld->ld_msgid, LDAP_REQ_BIND,
+ rc = ber_printf( ber, "{it{istoN}N}", ++ld->ld_msgid, LDAP_REQ_BIND,
ld->ld_version, dn, LDAP_AUTH_KRBV41, cred, credlen );
-#ifdef STR_TRANSLATION
- if ( str_translation_on ) { /* restore translation */
- ber->ber_options |= LBER_TRANSLATE_STRINGS;
- }
-#endif /* STR_TRANSLATION */
-
if ( rc == -1 ) {
LDAP_FREE( cred );
ber_free( ber, 1 );
{
BerElement *ber;
char *cred;
- int rc, credlen;
-#ifdef STR_TRANSLATION
- int str_translation_on;
-#endif /* STR_TRANSLATION */
+ int rc;
+ ber_len_t credlen;
Debug( LDAP_DEBUG_TRACE, "ldap_kerberos_bind2\n", 0, 0, 0 );
+ if( ld->ld_version > LDAP_VERSION2 ) {
+ ld->ld_errno = LDAP_NOT_SUPPORTED;
+ return -1;
+ }
+
if ( dn == NULL )
dn = "";
}
/* create a message to send */
- if ( (ber = ldap_alloc_ber_with_options( ld )) == NULLBER ) {
+ if ( (ber = ldap_alloc_ber_with_options( ld )) == NULL ) {
LDAP_FREE( cred );
return( -1 );
}
-#ifdef STR_TRANSLATION
- if (( str_translation_on = (( ber->ber_options &
- LBER_TRANSLATE_STRINGS ) != 0 ))) { /* turn translation off */
- ber->ber_options &= ~LBER_TRANSLATE_STRINGS;
- }
-#endif /* STR_TRANSLATION */
-
/* fill it in */
- rc = ber_printf( ber, "{it{isto}}", ++ld->ld_msgid, LDAP_REQ_BIND,
+ rc = ber_printf( ber, "{it{istoN}N}", ++ld->ld_msgid, LDAP_REQ_BIND,
ld->ld_version, dn, LDAP_AUTH_KRBV42, cred, credlen );
-#ifdef STR_TRANSLATION
- if ( str_translation_on ) { /* restore translation */
- ber->ber_options |= LBER_TRANSLATE_STRINGS;
- }
-#endif /* STR_TRANSLATION */
-
LDAP_FREE( cred );
if ( rc == -1 ) {
LDAP *ld,
LDAP_CONST char *who,
LDAP_CONST char *service,
- int *len )
+ ber_len_t *len )
{
KTEXT_ST ktxt;
int err;
Debug( LDAP_DEBUG_TRACE, "ldap_get_kerberosv4_credentials\n", 0, 0, 0 );
if ( (err = krb_get_tf_realm( tkt_string(), realm )) != KSUCCESS ) {
-#ifdef LDAP_LIBUI
- fprintf( stderr, "krb_get_tf_realm failed (%s)\n",
- krb_err_txt[err] );
-#endif /* LDAP_LIBUI */
- ld->ld_errno = LDAP_INVALID_CREDENTIALS;
+ Debug( LDAP_DEBUG_ANY, "ldap_get_kerberosv4_credentials: "
+ "krb_get_tf_realm failed: %s\n", krb_err_txt[err], 0, 0 );
+ ld->ld_errno = LDAP_AUTH_UNKNOWN;
return( NULL );
}
+ if ( ber_sockbuf_ctrl( ld->ld_sb, LBER_SB_OPT_GET_FD, NULL ) == -1 ) {
+ /* not connected yet */
+ int rc = ldap_open_defconn( ld );
+
+ if( rc < 0 ) return NULL;
+ }
+
krbinstance = ld->ld_defconn->lconn_krbinstance;
if ( (err = krb_mk_req( &ktxt, service, krbinstance, realm, 0 ))
- != KSUCCESS ) {
-#ifdef LDAP_LIBUI
- fprintf( stderr, "krb_mk_req failed (%s)\n", krb_err_txt[err] );
-#endif /* LDAP_LIBUI */
- ld->ld_errno = LDAP_INVALID_CREDENTIALS;
+ != KSUCCESS )
+ {
+ Debug( LDAP_DEBUG_ANY, "ldap_get_kerberosv4_credentials: "
+ "krb_mk_req failed (%s)\n", krb_err_txt[err], 0, 0 );
+ ld->ld_errno = LDAP_AUTH_UNKNOWN;
return( NULL );
}
}
*len = ktxt.length;
- memcpy( cred, ktxt.dat, ktxt.length );
+ AC_MEMCPY( cred, ktxt.dat, ktxt.length );
return( cred );
}
#endif /* !AUTHMAN */
-#endif /* HAVE_KERBEROS */
+#endif /* LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND */