update for new backend types

[openldap] / servers / slapd / sasl.c

diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index ec28ea3cb3c5faf29e8dd2780a9edc34c2effe6a..5aac28e25ef01ef0fc8af6d02ca0709a7146eff2 100644 (file)
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -163,6 +163,8 @@ typedef struct lookup_info {
 
 static slap_response sasl_ap_lookup;
 
+static struct berval sc_cleartext = BER_BVC("{CLEARTEXT}");
+
 static int
 sasl_ap_lookup( Operation *op, SlapReply *rs )
 {
@@ -210,6 +212,34 @@ sasl_ap_lookup( Operation *op, SlapReply *rs )
                        sl->list[i].name );
                }
                for ( bv = a->a_vals; bv->bv_val; bv++ ) {
+                       /* ITS#3846 don't give hashed passwords to SASL */
+                       if ( ad == slap_schema.si_ad_userPassword &&
+                               bv->bv_val[0] == '{' ) {
+                               rc = lutil_passwd_scheme( bv->bv_val );
+                               if ( rc ) {
+                                       /* If it's not a recognized scheme, just assume it's
+                                        * a cleartext password that happened to include brackets.
+                                        *
+                                        * If it's a recognized scheme, skip this value, unless the
+                                        * scheme is {CLEARTEXT}. In that case, skip over the
+                                        * scheme name and use the remainder. If there is nothing
+                                        * past the scheme name, skip this value.
+                                        */
+#ifdef SLAPD_CLEARTEXT
+                                       if ( !strncasecmp( bv->bv_val, sc_cleartext.bv_val,
+                                               sc_cleartext.bv_len )) {
+                                               struct berval cbv;
+                                               cbv.bv_len = bv->bv_len - sc_cleartext.bv_len;
+                                               if ( cbv.bv_len ) {
+                                                       cbv.bv_val = bv->bv_val + sc_cleartext.bv_len;
+                                                       sl->sparams->utils->prop_set( sl->sparams->propctx,
+                                                               sl->list[i].name, cbv.bv_val, cbv.bv_len );
+                                               }
+                                       }
+#endif
+                                       continue;
+                               }
+                       }
                        sl->sparams->utils->prop_set( sl->sparams->propctx,
                                sl->list[i].name, bv->bv_val, bv->bv_len );
                }
@@ -579,7 +609,7 @@ slap_sasl_authorize(
 {
        Connection *conn = (Connection *)context;
        struct propval auxvals[3];
-       struct berval authcDN, authzDN=BER_BVNULL;
+       struct berval authcDN, authzDN = BER_BVNULL;
        int rc;
 
        /* Simple Binds don't support proxy authorization, ignore it */
@@ -624,7 +654,17 @@ slap_sasl_authorize(
                return SASL_NOAUTHZ;
        }
 
-       conn->c_sasl_authz_dn = authzDN;
+       /* FIXME: we need yet another dup because slap_sasl_getdn()
+        * is using the bind operation slab */
+       if ( conn->c_sasl_bindop ) {
+               ber_dupbv( &conn->c_sasl_authz_dn, &authzDN );
+               slap_sl_free( authzDN.bv_val,
+                               conn->c_sasl_bindop->o_tmpmemctx );
+
+       } else {
+               conn->c_sasl_authz_dn = authzDN;
+       }
+
 ok:
        if (conn->c_sasl_bindop) {
                Statslog( LDAP_DEBUG_STATS,
@@ -648,7 +688,7 @@ slap_sasl_authorize(
        const char **user,
        const char **errstr)
 {
-       struct berval authcDN, authzDN;
+       struct berval authcDN, authzDN = BER_BVNULL;
        int rc;
        Connection *conn = context;
        char *realm;
@@ -702,7 +742,7 @@ slap_sasl_authorize(
                return SASL_NOAUTHZ;
        }
 
-       rc = slap_sasl_authorized(conn->c_sasl_bindop, &authcDN, &authzDN );
+       rc = slap_sasl_authorized( conn->c_sasl_bindop, &authcDN, &authzDN );
        if( rc ) {
                Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
                        "proxy authorization disallowed (%d)\n",
@@ -712,7 +752,17 @@ slap_sasl_authorize(
                ch_free( authzDN.bv_val );
                return SASL_NOAUTHZ;
        }
-       conn->c_sasl_authz_dn = authzDN;
+
+       /* FIXME: we need yet another dup because slap_sasl_getdn()
+        * is using the bind operation slab */
+       if ( conn->c_sasl_bindop ) {
+               ber_dupbv( &conn->c_sasl_authz_dn, &authzDN );
+               slap_sl_free( authzDN.bv_val,
+                               conn->c_sasl_bindop->o_tmpmemctx );
+
+       } else {
+               conn->c_sasl_authz_dn = authzDN;
+       }
 
 ok:
        Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
@@ -720,7 +770,7 @@ ok:
                (long) (conn ? conn->c_connid : -1),
                authzDN.bv_val ? authzDN.bv_val : "", 0 );
 
-       if (conn->c_sasl_bindop) {
+       if ( conn->c_sasl_bindop ) {
                Statslog( LDAP_DEBUG_STATS,
                        "conn=%lu op=%lu BIND authcid=\"%s\" authzid=\"%s\"\n",
                        conn->c_connid, conn->c_sasl_bindop->o_opid, 
@@ -1492,8 +1542,8 @@ int slap_sasl_getdn( Connection *conn, Operation *op, struct berval *id,
        int rc, is_dn = SET_NONE, do_norm = 1;
        struct berval dn2, *mech;
 
-       assert( conn );
-       assert( id );
+       assert( conn != NULL );
+       assert( id != NULL );
 
        Debug( LDAP_DEBUG_ARGS, "slap_sasl_getdn: conn %lu id=%s [len=%lu]\n", 
                conn->c_connid,
@@ -1504,6 +1554,7 @@ int slap_sasl_getdn( Connection *conn, Operation *op, struct berval *id,
        if ( !op ) {
                op = conn->c_sasl_bindop;
        }
+       assert( op != NULL );
 
        BER_BVZERO( dn );
 
@@ -1617,13 +1668,16 @@ int slap_sasl_getdn( Connection *conn, Operation *op, struct berval *id,
                irdn++;
                DN[ irdn ] = NULL;
 
-               rc = ldap_dn2bv_x( DN, dn, LDAP_DN_FORMAT_LDAPV3, op->o_tmpmemctx );
+               rc = ldap_dn2bv_x( DN, dn, LDAP_DN_FORMAT_LDAPV3,
+                               op->o_tmpmemctx );
                if ( rc != LDAP_SUCCESS ) {
                        BER_BVZERO( dn );
                        return rc;
                }
 
-               Debug( LDAP_DEBUG_TRACE, "slap_sasl_getdn: u:id converted to %s\n", dn->bv_val,0,0 );
+               Debug( LDAP_DEBUG_TRACE,
+                       "slap_sasl_getdn: u:id converted to %s\n",
+                       dn->bv_val, 0, 0 );
 
        } else {
                
@@ -1653,7 +1707,8 @@ int slap_sasl_getdn( Connection *conn, Operation *op, struct berval *id,
        if( !BER_BVISNULL( &dn2 ) ) {
                slap_sl_free( dn->bv_val, op->o_tmpmemctx );
                *dn = dn2;
-               Debug( LDAP_DEBUG_TRACE, "getdn: dn:id converted to %s\n",
+               Debug( LDAP_DEBUG_TRACE,
+                       "slap_sasl_getdn: dn:id converted to %s\n",
                        dn->bv_val, 0, 0 );
        }