const char *fname, int lineno )
{
/* set SASL proxy authorization policy */
- if ( strcasecmp( cargv[0], "sasl-authz-policy" ) == 0 ) {
+ if ( !strcasecmp( cargv[0], "authz-policy" ) ||
+ !strcasecmp( cargv[0], "sasl-authz-policy" ))
+ {
if ( cargc != 2 ) {
#ifdef NEW_LOGGING
LDAP_LOG( CONFIG, CRIT,
"%s: line %d: missing policy in"
- " \"
sasl-authz-policy <policy>\" line\n",
- fname, lineno, 0 );
+ " \"
%s <policy>\" line\n",
+ cargv[0], fname, lineno );
#else
Debug( LDAP_DEBUG_ANY,
"%s: line %d: missing policy in"
- " \"
sasl-authz-policy <policy>\" line\n",
- fname, lineno, 0 );
+ " \"
%s <policy>\" line\n",
+ cargv[0], fname, lineno );
#endif
return( 1 );
}
if ( slap_sasl_setpolicy( cargv[1] ) ) {
#ifdef NEW_LOGGING
- LDAP_LOG( CONFIG, CRIT,
- "%s: line %d: unable "
- "to parse value \"%s\" "
- "in \"sasl-authz-policy "
- "<policy>\" line.\n",
- fname, lineno, cargv[1] );
+ LDAP_LOG( CONFIG, CRIT, "%s: line %d: "
+ "unable to parse value \"%s\" in \"authz-policy "
+ "<policy>\" line.\n",
+ fname, lineno, cargv[1] );
#else
- Debug( LDAP_DEBUG_ANY,
- "%s: line %d: unable "
- "to parse value \"%s\" "
- "in \"sasl-authz-policy "
- "<policy>\" line\n",
- fname, lineno, cargv[1] );
+ Debug( LDAP_DEBUG_ANY, "%s: line %d: "
+ "unable to parse value \"%s\" in \"authz-policy "
+ "<policy>\" line.\n",
+ fname, lineno, cargv[1] );
#endif
return( 1 );
}
- } else if ( !strcasecmp( cargv[0], "sasl-regexp" )
- || !strcasecmp( cargv[0], "saslregexp" ) )
+ } else if ( !strcasecmp( cargv[0], "authz-regexp" ) ||
+ !strcasecmp( cargv[0], "sasl-regexp" ) ||
+ !strcasecmp( cargv[0], "saslregexp" ) )
{
int rc;
if ( cargc != 3 ) {
#ifdef NEW_LOGGING
LDAP_LOG( CONFIG, CRIT,
"%s: line %d: need 2 args in "
- "\"saslregexp <match> <replace>\"\n",
+ "\"authz-regexp <match> <replace>\"\n",
fname, lineno, 0 );
#else
Debug( LDAP_DEBUG_ANY,
"%s: line %d: need 2 args in "
- "\"saslregexp <match> <replace>\"\n",
+ "\"authz-regexp <match> <replace>\"\n",
fname, lineno, 0 );
#endif
#if SASL_VERSION_MAJOR >= 2
static const char *slap_propnames[] = {
- "*slapConn", "*authcDN", "*authzDN", NULL };
+ "*slapConn", "*slapAuthcDN", "*slapAuthzDN", NULL };
static Filter generic_filter = { LDAP_FILTER_PRESENT };
static struct berval generic_filterstr = BER_BVC("(objectclass=*)");
#define PROP_CONN 0
#define PROP_AUTHC 1
#define PROP_AUTHZ 2
+#define PROP_COUNT 3 /* Number of properties we used */
typedef struct lookup_info {
- int last;
int flags;
const struct propval *list;
sasl_server_params_t *sparams;
} lookup_info;
-static slap_response sasl_ap_lookup, sasl_cb_checkpass;
+static slap_response sasl_ap_lookup;
static int
sasl_ap_lookup( Operation *op, SlapReply *rs )
if (rs->sr_type != REP_SEARCH) return 0;
- for( i = 0; i < sl->last; i++ ) {
+ for( i = 0; sl->list[i].name; i++ ) {
const char *name = sl->list[i].name;
if ( name[0] == '*' ) {
if ( sl->flags & SASL_AUXPROP_AUTHZID ) continue;
+ /* Skip our private properties */
+ if ( !strcmp( name, slap_propnames[0] )) {
+ i += PROP_COUNT-1;
+ continue;
+ }
name++;
} else if ( !(sl->flags & SASL_AUXPROP_AUTHZID ) )
continue;
sl.flags = flags;
/* Find our DN and conn first */
- for( i = 0, sl.last = 0; sl.list[i].name; i++ ) {
+ for( i = 0; sl.list[i].name; i++ ) {
if ( sl.list[i].name[0] == '*' ) {
if ( !strcmp( sl.list[i].name, slap_propnames[PROP_CONN] ) ) {
if ( sl.list[i].values && sl.list[i].values[0] )
AC_MEMCPY( &conn, sl.list[i].values[0], sizeof( conn ) );
- if ( !sl.last ) sl.last = i;
+ continue;
}
if ( (flags & SASL_AUXPROP_AUTHZID) &&
!strcmp( sl.list[i].name, slap_propnames[PROP_AUTHZ] ) ) {
if ( sl.list[i].values && sl.list[i].values[0] )
AC_MEMCPY( &op.o_req_ndn, sl.list[i].values[0], sizeof( struct berval ) );
- if ( !sl.last ) sl.last = i;
break;
}
if ( !strcmp( sl.list[i].name, slap_propnames[PROP_AUTHC] ) ) {
- if ( !sl.last ) sl.last = i;
if ( sl.list[i].values && sl.list[i].values[0] ) {
AC_MEMCPY( &op.o_req_ndn, sl.list[i].values[0], sizeof( struct berval ) );
if ( !(flags & SASL_AUXPROP_AUTHZID) )
}
/* Now see what else needs to be fetched */
- for( i = 0; i < sl.last; i++ ) {
+ for( i = 0; sl.list[i].name; i++ ) {
const char *name = sl.list[i].name;
if ( name[0] == '*' ) {
if ( flags & SASL_AUXPROP_AUTHZID ) continue;
+ /* Skip our private properties */
+ if ( !strcmp( name, slap_propnames[0] )) {
+ i += PROP_COUNT-1;
+ continue;
+ }
name++;
} else if ( !(flags & SASL_AUXPROP_AUTHZID ) )
continue;
if ( !(flags & SASL_AUXPROP_OVERRIDE) ) continue;
}
doit = 1;
+ break;
}
if (doit) {
for (j=0; j<pr[i].nvalues; j++) {
ber_str2bv( pr[i].values[j], 0, 1, &mod->sml_values[j]);
}
- mod->sml_values[j].bv_val = NULL;
- mod->sml_values[j].bv_len = 0;
+ BER_BVZERO( &mod->sml_values[j] );
mod->sml_nvalues = NULL;
mod->sml_desc = NULL;
*modtail = mod;
return SASL_OK;
}
-typedef struct checkpass_info {
- int rc;
- struct berval cred;
-} checkpass_info;
-
-static int
-sasl_cb_checkpass( Operation *op, SlapReply *rs )
-{
- slap_callback *tmp = op->o_callback;
- checkpass_info *ci = tmp->sc_private;
- Attribute *a;
- struct berval *bv;
-
- if (rs->sr_type != REP_SEARCH) return 0;
-
- ci->rc = SASL_NOVERIFY;
-
- a = attr_find( rs->sr_entry->e_attrs, slap_schema.si_ad_userPassword );
- if ( !a ) return 0;
- if ( ! access_allowed( op, rs->sr_entry, slap_schema.si_ad_userPassword,
- NULL, ACL_AUTH, NULL ) )
- {
- return 0;
- }
-
- for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
- if ( !lutil_passwd( bv, &ci->cred, NULL, &rs->sr_text ) ) {
- ci->rc = SASL_OK;
- break;
- }
- }
- return 0;
-}
-
-static int
-slap_sasl_checkpass(
- sasl_conn_t *sconn,
- void *context,
- const char *username,
- const char *pass,
- unsigned passlen,
- struct propctx *propctx)
-{
- Connection *conn = (Connection *)context;
- Operation op = {0};
- int rc;
- checkpass_info ci;
-
- ci.rc = SASL_NOUSER;
-
- /* SASL will fallback to its own mechanisms if we don't
- * find an answer here.
- */
-
- rc = slap_sasl_getdn( conn, NULL, (char *)username, 0, NULL, &op.o_req_ndn,
- SLAP_GETDN_AUTHCID );
- if ( rc != LDAP_SUCCESS ) {
- sasl_seterror( sconn, 0, ldap_err2string( rc ) );
- return SASL_NOUSER;
- }
-
- if ( op.o_req_ndn.bv_len == 0 ) {
- sasl_seterror( sconn, 0,
- "No password is associated with the Root DSE" );
- if ( op.o_req_ndn.bv_val != NULL ) {
- ch_free( op.o_req_ndn.bv_val );
- }
- return SASL_NOUSER;
- }
-
- op.o_bd = select_backend( &op.o_req_ndn, 0, 1 );
- if ( op.o_bd && op.o_bd->be_search ) {
- slap_callback cb = { NULL, sasl_cb_checkpass, NULL, NULL };
- SlapReply rs = {REP_RESULT};
-
- ci.cred.bv_val = (char *)pass;
- ci.cred.bv_len = passlen;
-
- cb.sc_private = &ci;
- op.o_tag = LDAP_REQ_SEARCH;
- op.o_protocol = LDAP_VERSION3;
- op.o_ndn = conn->c_ndn;
- op.o_callback = &cb;
- op.o_time = slap_get_time();
- op.o_do_not_cache = 1;
- op.o_is_auth_check = 1;
- op.o_threadctx = conn->c_sasl_bindop->o_threadctx;
- op.o_tmpmemctx = conn->c_sasl_bindop->o_tmpmemctx;
- op.o_tmpmfuncs = conn->c_sasl_bindop->o_tmpmfuncs;
- op.o_conn = conn;
- op.o_connid = conn->c_connid;
- op.o_req_dn = op.o_req_ndn;
- op.ors_scope = LDAP_SCOPE_BASE;
- op.ors_deref = LDAP_DEREF_NEVER;
- op.ors_slimit = 1;
- op.ors_filter = &generic_filter;
- op.ors_filterstr = generic_filterstr;
-
- op.o_bd->be_search( &op, &rs );
- }
- if ( ci.rc != SASL_OK ) {
- sasl_seterror( sconn, 0,
- ldap_err2string( LDAP_INVALID_CREDENTIALS ) );
- }
-
- ch_free( op.o_req_ndn.bv_val );
-
- return ci.rc;
-}
-
/* Convert a SASL authcid or authzid into a DN. Store the DN in an
* auxiliary property, so that we can refer to it in sasl_authorize
* without interfering with anything else. Also, the SASL username
struct berval dn;
int rc, which;
const char *names[2];
+ struct berval bvin;
*out_len = 0;
if ( !rc ) goto done;
}
- rc = slap_sasl_getdn( conn, NULL, (char *)in, inlen, (char *)user_realm, &dn,
+ bvin.bv_val = (char *)in;
+ bvin.bv_len = inlen;
+ rc = slap_sasl_getdn( conn, NULL, &bvin, (char *)user_realm, &dn,
(flags & SASL_CU_AUTHID) ? SLAP_GETDN_AUTHCID : SLAP_GETDN_AUTHZID );
if ( rc != LDAP_SUCCESS ) {
sasl_seterror( sconn, 0, ldap_err2string( rc ) );
#endif
if ( conn->c_sasl_dn.bv_val ) {
ch_free( conn->c_sasl_dn.bv_val );
- conn->c_sasl_dn.bv_val = NULL;
- conn->c_sasl_dn.bv_len = 0;
+ BER_BVZERO( &conn->c_sasl_dn );
}
/* Skip PROP_CONN */
int rc;
Connection *conn = context;
char *realm;
+ struct berval bvauthcid, bvauthzid;
*user = NULL;
if ( conn->c_sasl_dn.bv_val ) {
ch_free( conn->c_sasl_dn.bv_val );
- conn->c_sasl_dn.bv_val = NULL;
- conn->c_sasl_dn.bv_len = 0;
+ BER_BVZERO( &conn->c_sasl_dn );
}
#ifdef NEW_LOGGING
/* Convert the identities to DN's. If no authzid was given, client will
be bound as the DN matching their username */
- rc = slap_sasl_getdn( conn, NULL, (char *)authcid, 0, realm,
+ bvauthcid.bv_val = authcid;
+ bvauthcid.bv_len = authcid ? strlen( authcid ) : 0;
+ rc = slap_sasl_getdn( conn, NULL, &bvauthcid, realm,
&authcDN, SLAP_GETDN_AUTHCID );
if( rc != LDAP_SUCCESS ) {
*errstr = ldap_err2string( rc );
return SASL_NOAUTHZ;
}
- if( ( authzid == NULL ) || !strcmp( authcid,authzid ) ) {
+ if( ( authzid == NULL ) || !strcmp( authcid, authzid ) ) {
#ifdef NEW_LOGGING
LDAP_LOG( TRANSPORT, ENTRY,
"slap_sasl_authorize: conn %d Using authcDN=%s\n",
conn->c_sasl_dn = authcDN;
goto ok;
}
- rc = slap_sasl_getdn( conn, NULL, (char *)authzid, 0, realm,
+
+ bvauthzid.bv_val = authzid;
+ bvauthzid.bv_len = authzid ? strlen( authzid ) : 0;
+ rc = slap_sasl_getdn( conn, NULL, &bvauthzid, realm,
&authzDN, SLAP_GETDN_AUTHZID );
if( rc != LDAP_SUCCESS ) {
ch_free( authcDN.bv_val );
session_callbacks[cb].id = SASL_CB_CANON_USER;
session_callbacks[cb].proc = &slap_sasl_canonicalize;
session_callbacks[cb++].context = conn;
-
- /* XXXX: this should be conditional */
- session_callbacks[cb].id = SASL_CB_SERVER_USERDB_CHECKPASS;
- session_callbacks[cb].proc = &slap_sasl_checkpass;
- session_callbacks[cb++].context = conn;
#endif
session_callbacks[cb].id = SASL_CB_LIST_END;
if( ctx == NULL ) return -1;
ctx->sc_external_ssf = 0;
- ctx->sc_external_id.bv_len = 0;
- ctx->sc_external_id.bv_val = NULL;
+ BER_BVZERO( &ctx->sc_external_id );
conn->c_sasl_authctx = ctx;
#endif
ctx->sc_external_ssf = ssf;
if( auth_id ) {
ctx->sc_external_id = *auth_id;
- auth_id->bv_len = 0;
- auth_id->bv_val = NULL;
+ BER_BVZERO( auth_id );
} else {
- ctx->sc_external_id.bv_len = 0;
- ctx->sc_external_id.bv_val = NULL;
+ BER_BVZERO( &ctx->sc_external_id );
}
#endif
if( ctx ) {
if( ctx->sc_external_id.bv_val ) {
free( ctx->sc_external_id.bv_val );
- ctx->sc_external_id.bv_val = NULL;
+ BER_BVZERO( &ctx->sc_external_id );
}
free( ctx );
conn->c_sasl_authctx = NULL;
sasl_ssf_t *ssf = NULL;
op->orb_edn = op->o_conn->c_sasl_dn;
- op->o_conn->c_sasl_dn.bv_val = NULL;
- op->o_conn->c_sasl_dn.bv_len = 0;
+ BER_BVZERO( &op->o_conn->c_sasl_dn );
op->o_conn->c_sasl_done = 1;
rs->sr_err = LDAP_SUCCESS;
int
slap_sasl_setpass( Operation *op, SlapReply *rs )
{
- struct berval id = { 0, NULL }; /* needs to come from connection */
- struct berval new = { 0, NULL };
- struct berval old = { 0, NULL };
+ struct berval id = BER_BVNULL; /* needs to come from connection */
+ struct berval new = BER_BVNULL;
+ struct berval old = BER_BVNULL;
assert( ber_bvcmp( &slap_EXOP_MODIFY_PASSWD, &op->ore_reqoid ) == 0 );
#define SET_DN 1
#define SET_U 2
-int slap_sasl_getdn( Connection *conn, Operation *op, char *id, int len,
+int slap_sasl_getdn( Connection *conn, Operation *op, struct berval *id,
char *user_realm, struct berval *dn, int flags )
{
int rc, is_dn = SET_NONE, do_norm = 1;
struct berval dn2, *mech;
assert( conn );
+ assert( id );
#ifdef NEW_LOGGING
LDAP_LOG( TRANSPORT, ENTRY,
"slap_sasl_getdn: conn %d id=%s [len=%d]\n",
- conn->c_connid, id ? (*id ? id : "<empty>") : "NULL", len );
+ conn->c_connid,
+ BER_BVISNULL( id ) ? "NULL" : ( BER_BVISEMPTY( id ) ? "<empty>" : id->bv_val ),
+ BER_BVISNULL( id ) ? 0 : ( BER_BVISEMPTY( id ) ? 0 : id->bv_len ) );
#else
- Debug( LDAP_DEBUG_ARGS, "slap_sasl_getdn: id=%s [len=%d]\n",
- id ? ( *id ? id : "<empty>" ) : "NULL", len, 0 );
+ Debug( LDAP_DEBUG_ARGS, "slap_sasl_getdn: conn %d id=%s [len=%d]\n",
+ conn->c_connid,
+ BER_BVISNULL( id ) ? "NULL" : ( BER_BVISEMPTY( id ) ? "<empty>" : id->bv_val ),
+ BER_BVISNULL( id ) ? 0 : ( BER_BVISEMPTY( id ) ? 0 : id->bv_len ) );
#endif
if ( !op ) {
op = conn->c_sasl_bindop;
}
- dn->bv_val = NULL;
- dn->bv_len = 0;
-
- if ( id ) {
- if ( len == 0 ) len = strlen( id );
+ BER_BVZERO( dn );
+ if ( !BER_BVISNULL( id ) ) {
/* Blatantly anonymous ID */
- if ( len == sizeof("anonymous") - 1 &&
- !strcasecmp( id, "anonymous" ) ) {
+ static struct berval bv_anonymous = BER_BVC( "anonymous" );
+
+ if ( ber_bvstrcasecmp( id, &bv_anonymous ) == 0 ) {
return( LDAP_SUCCESS );
}
+
} else {
- len = 0;
+ /* FIXME: if empty, should we stop? */
+ BER_BVSTR( id, "" );
}
- if ( conn->c_sasl_bind_mech.bv_len ) {
+ if ( !BER_BVISEMPTY( &conn->c_sasl_bind_mech ) ) {
mech = &conn->c_sasl_bind_mech;
} else {
mech = &conn->c_authmech;
if( flags & SLAP_GETDN_AUTHCID ) {
if( bvmatch( mech, &ext_bv )) {
/* EXTERNAL DNs are already normalized */
+ assert( !BER_BVISNULL( id ) );
+
do_norm = 0;
is_dn = SET_DN;
- ber_str2bv_x( id, len, 1, dn, op->o_tmpmemctx );
+ ber_dupbv_x( dn, id, op->o_tmpmemctx );
} else {
/* convert to u:<username> form */
is_dn = SET_U;
- dn->bv_val = id;
- dn->bv_len = len;
+ *dn = *id;
}
}
+
if( is_dn == SET_NONE ) {
- if( !strncasecmp( id, "u:", sizeof("u:")-1 )) {
+ if( !strncasecmp( id->bv_val, "u:", STRLENOF( "u:" ) ) ) {
is_dn = SET_U;
- dn->bv_val = id+2;
- dn->bv_len = len-2;
- } else if ( !strncasecmp( id, "dn:", sizeof("dn:")-1) ) {
+ dn->bv_val = id->bv_val + STRLENOF( "u:" );
+ dn->bv_len = id->bv_len - STRLENOF( "u:" );
+
+ } else if ( !strncasecmp( id->bv_val, "dn:", STRLENOF( "dn:" ) ) ) {
is_dn = SET_DN;
- dn->bv_val = id+3;
- dn->bv_len = len-3;
+ dn->bv_val = id->bv_val + STRLENOF( "dn:" );
+ dn->bv_len = id->bv_len - STRLENOF( "dn:" );
}
}
/* No other possibilities from here */
if( is_dn == SET_NONE ) {
- dn->bv_val = NULL;
- dn->bv_len = 0;
+ BER_BVZERO( dn );
return( LDAP_INAPPROPRIATE_AUTH );
}
/* Username strings */
if( is_dn == SET_U ) {
char *p;
- struct berval realm = { 0, NULL }, c1 = *dn;
+ struct berval realm = BER_BVNULL, c1 = *dn;
+ ber_len_t len;
- len = dn->bv_len + sizeof("uid=")-1 + sizeof(",cn=auth")-1;
+ len = dn->bv_len + STRLENOF( "uid=" ) + STRLENOF( ",cn=auth" );
if( user_realm && *user_realm ) {
- realm.bv_val = user_realm;
- realm.bv_len = strlen( user_realm );
- len += realm.bv_len + sizeof(",cn=") - 1;
+ ber_str2bv( user_realm, 0, 0, &realm );
+ len += realm.bv_len + STRLENOF( ",cn=" );
}
if( mech->bv_len ) {
- len += mech->bv_len + sizeof(",cn=")-1;
+ len += mech->bv_len + STRLENOF( ",cn=" );
}
/* Build the new dn */
- dn->bv_val = sl_malloc( len+1, op->o_tmpmemctx );
+ dn->bv_val = sl_malloc( len + 1, op->o_tmpmemctx );
if( dn->bv_val == NULL ) {
#ifdef NEW_LOGGING
LDAP_LOG( TRANSPORT, ERR,
sl_free( dn->bv_val, op->o_tmpmemctx );
if ( rc != LDAP_SUCCESS ) {
- dn->bv_val = NULL;
- dn->bv_len = 0;
+ BER_BVZERO( dn );
return rc;
}
*dn = dn2;
/* Run thru regexp */
slap_sasl2dn( op, dn, &dn2, flags );
- if( dn2.bv_val ) {
+ if( !BER_BVISNULL( &dn2 ) ) {
sl_free( dn->bv_val, op->o_tmpmemctx );
*dn = dn2;
#ifdef NEW_LOGGING
projects / openldap / blobdiff