fix previous commit

[openldap] / servers / slapd / sasl.c

diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index 975df3755f30f02a5b1aea226faa47629982123a..87fce497a5e848222180adb68ecc90b43bb3a21c 100644 (file)
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -16,6 +16,10 @@
 #include "portable.h"
 
 #include <stdio.h>
+#ifdef HAVE_LIMITS_H
+#include <limits.h>
+#endif
+
 #include <ac/stdlib.h>
 #include <ac/string.h>
 
@@ -24,8 +28,6 @@
 
 #include "slap.h"
 
-#include <limits.h>
-
 #ifdef HAVE_CYRUS_SASL
 # ifdef HAVE_SASL_SASL_H
 #  include <sasl/sasl.h>
@@ -384,8 +386,8 @@ slap_auxprop_store(
        rc = slap_mods_check( modlist, &text, textbuf, textlen, NULL );
 
        if ( rc == LDAP_SUCCESS ) {
-               rc = slap_mods_no_update_check( modlist, &text,
-                               textbuf, textlen );
+               rc = slap_mods_no_user_mod_check( &op, modlist,
+                       &text, textbuf, textlen );
 
                if ( rc == LDAP_SUCCESS ) {
                        rc = slap_mods_opattrs( &op, modlist, modtail,
@@ -576,7 +578,7 @@ slap_sasl_authorize(
 {
        Connection *conn = (Connection *)context;
        struct propval auxvals[3];
-       struct berval authcDN, authzDN;
+       struct berval authcDN, authzDN=BER_BVNULL;
        int rc;
 
        /* Simple Binds don't support proxy authorization, ignore it */
@@ -601,17 +603,16 @@ slap_sasl_authorize(
        }
 
        AC_MEMCPY( &authcDN, auxvals[0].values[0], sizeof(authcDN) );
+       conn->c_sasl_dn = authcDN;
 
        /* Nothing to do if no authzID was given */
        if ( !auxvals[1].name || !auxvals[1].values ) {
-               conn->c_sasl_dn = authcDN;
                goto ok;
        }
        
        AC_MEMCPY( &authzDN, auxvals[1].values[0], sizeof(authzDN) );
 
        rc = slap_sasl_authorized( conn->c_sasl_bindop, &authcDN, &authzDN );
-       ch_free( authcDN.bv_val );
        if ( rc != LDAP_SUCCESS ) {
                Debug( LDAP_DEBUG_TRACE, "SASL Proxy Authorize [conn=%ld]: "
                        "proxy authorization disallowed (%d)\n",
@@ -622,18 +623,19 @@ slap_sasl_authorize(
                return SASL_NOAUTHZ;
        }
 
-       conn->c_sasl_dn = authzDN;
+       conn->c_sasl_authz_dn = authzDN;
 ok:
        if (conn->c_sasl_bindop) {
                Statslog( LDAP_DEBUG_STATS,
-                       "conn=%lu op=%lu BIND authcid=\"%s\"\n",
+                       "conn=%lu op=%lu BIND authcid=\"%s\" authzid=\"%s\"\n",
                        conn->c_connid, conn->c_sasl_bindop->o_opid, 
-                       auth_identity, 0, 0);
+                       auth_identity, requested_user, 0);
        }
 
        Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
-               " proxy authorization allowed\n",
-               (long) (conn ? conn->c_connid : -1), 0, 0 );
+               " proxy authorization allowed authzDN=\"%s\"\n",
+               (long) (conn ? conn->c_connid : -1), 
+               authzDN.bv_val ? authzDN.bv_val : "", 0 );
        return SASL_OK;
 } 
 #else
@@ -682,11 +684,11 @@ slap_sasl_authorize(
                *errstr = ldap_err2string( rc );
                return SASL_NOAUTHZ;
        }
+       conn->c_sasl_dn = authcDN;
        if( ( authzid == NULL ) || !strcmp( authcid, authzid ) ) {
                Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
                 "Using authcDN=%s\n", (long) (conn ? conn->c_connid : -1), authcDN.bv_val,0 );
 
-               conn->c_sasl_dn = authcDN;
                goto ok;
        }
 
@@ -695,13 +697,11 @@ slap_sasl_authorize(
        rc = slap_sasl_getdn( conn, NULL, &bvauthzid, realm,
                &authzDN, SLAP_GETDN_AUTHZID );
        if( rc != LDAP_SUCCESS ) {
-               ch_free( authcDN.bv_val );
                *errstr = ldap_err2string( rc );
                return SASL_NOAUTHZ;
        }
 
        rc = slap_sasl_authorized(conn->c_sasl_bindop, &authcDN, &authzDN );
-       ch_free( authcDN.bv_val );
        if( rc ) {
                Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
                        "proxy authorization disallowed (%d)\n",
@@ -711,18 +711,19 @@ slap_sasl_authorize(
                ch_free( authzDN.bv_val );
                return SASL_NOAUTHZ;
        }
-       conn->c_sasl_dn = authzDN;
+       conn->c_sasl_authz_dn = authzDN;
 
 ok:
        Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
-               " authorization allowed\n",
-               (long) (conn ? conn->c_connid : -1), 0, 0 );
+               " authorization allowed authzDN=\"%s\"\n",
+               (long) (conn ? conn->c_connid : -1),
+               authzDN.bv_val ? authzDN.bv_val : "", 0 );
 
        if (conn->c_sasl_bindop) {
                Statslog( LDAP_DEBUG_STATS,
-                       "conn=%lu op=%lu BIND authcid=\"%s\"\n",
+                       "conn=%lu op=%lu BIND authcid=\"%s\" authzid=\"%s\"\n",
                        conn->c_connid, conn->c_sasl_bindop->o_opid, 
-                       authcid, 0, 0);
+                       authcid, authzid ? authzid : "", 0);
        }
 
        *errstr = NULL;
@@ -768,7 +769,66 @@ slap_sasl_err2ldap( int saslerr )
 
        return rc;
 }
-#endif
+
+#ifdef SLAPD_SPASSWD
+
+static struct berval sasl_pwscheme = BER_BVC("{SASL}");
+
+static int chk_sasl(
+       const struct berval *sc,
+       const struct berval * passwd,
+       const struct berval * cred,
+       const char **text )
+{
+       unsigned int i;
+       int rtn;
+       void *ctx, *sconn = NULL;
+
+       for( i=0; i<cred->bv_len; i++) {
+               if(cred->bv_val[i] == '\0') {
+                       return LUTIL_PASSWD_ERR;        /* NUL character in password */
+               }
+       }
+
+       if( cred->bv_val[i] != '\0' ) {
+               return LUTIL_PASSWD_ERR;        /* cred must behave like a string */
+       }
+
+       for( i=0; i<passwd->bv_len; i++) {
+               if(passwd->bv_val[i] == '\0') {
+                       return LUTIL_PASSWD_ERR;        /* NUL character in password */
+               }
+       }
+
+       if( passwd->bv_val[i] != '\0' ) {
+               return LUTIL_PASSWD_ERR;        /* passwd must behave like a string */
+       }
+
+       rtn = LUTIL_PASSWD_ERR;
+
+       ctx = ldap_pvt_thread_pool_context();
+       ldap_pvt_thread_pool_getkey( ctx, slap_sasl_bind, &sconn, NULL );
+
+       if( sconn != NULL ) {
+               int sc;
+# if SASL_VERSION_MAJOR < 2
+               sc = sasl_checkpass( sconn,
+                       passwd->bv_val, passwd->bv_len,
+                       cred->bv_val, cred->bv_len,
+                       text );
+# else
+               sc = sasl_checkpass( sconn,
+                       passwd->bv_val, passwd->bv_len,
+                       cred->bv_val, cred->bv_len );
+# endif
+               rtn = ( sc != SASL_OK ) ? LUTIL_PASSWD_ERR : LUTIL_PASSWD_OK;
+       }
+
+       return rtn;
+}
+#endif /* SLAPD_SPASSWD */
+
+#endif /* HAVE_CYRUS_SASL */
 
 int slap_sasl_init( void )
 {
@@ -840,6 +900,10 @@ int slap_sasl_init( void )
                return -1;
        }
 
+#ifdef SLAPD_SPASSWD
+       lutil_passwd_add( &sasl_pwscheme, chk_sasl, NULL );
+#endif
+
        Debug( LDAP_DEBUG_TRACE, "slap_sasl_init: initialized!\n",
                0, 0, 0 );