X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=clients%2Ftools%2Fldappasswd.c;h=b0cdfb6dea4f8d95883831cfb412320d78be8b8e;hb=fd4b8ba0cd8c1aedb91837d36cfaafac3a64a735;hp=be5f5d1b11f91f2da6408822be49e5c2f9027745;hpb=95eea5acccaffb85ee2ac4ffcf4cd45dbb0fc4a0;p=openldap diff --git a/clients/tools/ldappasswd.c b/clients/tools/ldappasswd.c index be5f5d1b11..b0cdfb6dea 100644 --- a/clients/tools/ldappasswd.c +++ b/clients/tools/ldappasswd.c @@ -29,33 +29,34 @@ usage(const char *s) { fprintf(stderr, "Change password of an LDAP user\n\n" -"usage: %s [options] user\n" -" user: the identity of the user, normally a DN\n" +"usage: %s [options] [user]\n" +" user: the autentication identity, commonly a DN\n" "Password change options:\n" -" -a secret\told password\n" -" -A\t\tprompt for old password\n" -" -s secret\tnew password\n" -" -S\t\tprompt for new password\n" +" -a secret old password\n" +" -A prompt for old password\n" +" -s secret new password\n" +" -S prompt for new password\n" "Common options:\n" -" -d level\tdebugging level\n" -" -C\t\tchase referrals\n" -" -D binddn\tbind DN\n" -" -h host\t\tLDAP server (default: localhost)\n" -" -I\t\tuse SASL Interactive mode\n" -" -n\t\tmake no modifications\n" -" -O secprops\tSASL security properties\n" -" -p port\t\tport on LDAP server\n" -" -Q\t\tuse SASL Quiet mode\n" -" -R realm\tSASL realm\n" -" -U user\t\tSASL authentication identity (username)\n" -" -v\t\tverbose mode\n" -" -w passwd\tbind password (for simple authentication)\n" -" -W\t\tprompt for bind password\n" -" -x\t\tSimple authentication\n" -" -X id\t\tSASL authorization identity (\"dn:\" or \"u:\")\n" -" -Y mech\t\tSASL mechanism\n" -" -Z\t\tissue Start TLS request (-ZZ to require successful response)\n" +" -d level set LDAP debugging level to `level'\n" +" -D binddn bind DN\n" +" -f file read operations from `file'\n" +" -h host LDAP server(s)\n" +" -H URI LDAP Uniform Resource Indentifier(s)\n" +" -I use SASL Interactive mode\n" +" -n show what would be done but don't actually search\n" +" -O props SASL security properties\n" +" -p port port on LDAP server\n" +" -Q use SASL Quiet mode\n" +" -R realm SASL realm\n" +" -U user SASL authentication identity (username)\n" +" -v run in verbose mode (diagnostics to standard output)\n" +" -w passwd bind passwd (for simple authentication)\n" +" -W prompt for bind passwd\n" +" -x Simple authentication\n" +" -X id SASL authorization identity (\"dn:\" or \"u:\")\n" +" -Y mech SASL mechanism\n" +" -Z Start TLS request (-ZZ to require successful response)\n" , s ); exit( EXIT_FAILURE ); @@ -67,8 +68,9 @@ main( int argc, char *argv[] ) int rc; char *prog = NULL; char *ldaphost = NULL; + char *ldapuri = NULL; - char *dn = NULL; + char *user = NULL; char *binddn = NULL; struct berval passwd = { 0, NULL }; @@ -87,7 +89,7 @@ main( int argc, char *argv[] ) int authmethod = -1; int manageDSAit = 0; #ifdef HAVE_CYRUS_SASL - unsigned sasl_flags = LUTIL_SASL_AUTOMATIC; + unsigned sasl_flags = LDAP_SASL_AUTOMATIC; char *sasl_realm = NULL; char *sasl_authc_id = NULL; char *sasl_authz_id = NULL; @@ -96,7 +98,7 @@ main( int argc, char *argv[] ) #endif int use_tls = 0; int referrals = 0; - LDAP *ld; + LDAP *ld = NULL; struct berval *bv = NULL; int id, code; @@ -105,13 +107,10 @@ main( int argc, char *argv[] ) char *retoid = NULL; struct berval *retdata = NULL; - prog = (prog = strrchr(argv[0], *LDAP_DIRSEP)) == NULL ? argv[0] : ++prog; + prog = (prog = strrchr(argv[0], *LDAP_DIRSEP)) == NULL ? argv[0] : prog + 1; - if (argc == 1) - usage (argv[0]); - - while( (i = getopt( argc, argv, - "Aa:Ss:" "Cd:D:h:InO:p:QRU:vw:WxX:Y:Z" )) != EOF ) + while( (i = getopt( argc, argv, "Aa:Ss:" + "Cd:D:h:H:InO:p:QR:U:vw:WxX:Y:Z" )) != EOF ) { switch (i) { /* Password Options */ @@ -155,18 +154,59 @@ main( int argc, char *argv[] ) break; case 'D': /* bind DN */ if( binddn != NULL ) { - fprintf( stderr, "%s: -D previously specified\n" ); + fprintf( stderr, "%s: -D previously specified\n", prog ); return EXIT_FAILURE; } binddn = strdup( optarg ); break; case 'h': /* ldap host */ + if( ldapuri != NULL ) { + fprintf( stderr, "%s: -h incompatible with -H\n", prog ); + return EXIT_FAILURE; + } if( ldaphost != NULL ) { - fprintf( stderr, "%s: -h previously specified\n" ); + fprintf( stderr, "%s: -h previously specified\n", prog ); return EXIT_FAILURE; } ldaphost = strdup( optarg ); break; + case 'H': /* ldap URI */ + if( ldaphost != NULL ) { + fprintf( stderr, "%s: -H incompatible with -h\n", prog ); + return EXIT_FAILURE; + } + if( ldapport ) { + fprintf( stderr, "%s: -H incompatible with -p\n", prog ); + return EXIT_FAILURE; + } + if( ldapuri != NULL ) { + fprintf( stderr, "%s: -H previously specified\n", prog ); + return EXIT_FAILURE; + } + ldapuri = strdup( optarg ); + break; + case 'I': +#ifdef HAVE_CYRUS_SASL + if( version == LDAP_VERSION2 ) { + fprintf( stderr, "%s: -I incompatible with version %d\n", + prog, version ); + return EXIT_FAILURE; + } + if( authmethod != -1 && authmethod != LDAP_AUTH_SASL ) { + fprintf( stderr, "%s: incompatible previous " + "authentication choice\n", + prog ); + return EXIT_FAILURE; + } + authmethod = LDAP_AUTH_SASL; + version = LDAP_VERSION3; + sasl_flags = LDAP_SASL_INTERACTIVE; + break; +#else + fprintf( stderr, "%s: was not compiled with SASL support\n", + prog ); + return( EXIT_FAILURE ); +#endif case 'k': /* kerberos bind */ #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND if( version > LDAP_VERSION2 ) { @@ -222,7 +262,7 @@ main( int argc, char *argv[] ) case 'O': #ifdef HAVE_CYRUS_SASL if( sasl_secprops != NULL ) { - fprintf( stderr, "%s: -O previously specified\n" ); + fprintf( stderr, "%s: -O previously specified\n", prog ); return EXIT_FAILURE; } if( version == LDAP_VERSION2 ) { @@ -246,7 +286,7 @@ main( int argc, char *argv[] ) break; case 'p': if( ldapport ) { - fprintf( stderr, "%s: -p previously specified\n" ); + fprintf( stderr, "%s: -p previously specified\n", prog ); return EXIT_FAILURE; } ldapport = atoi( optarg ); @@ -290,16 +330,17 @@ main( int argc, char *argv[] ) } authmethod = LDAP_AUTH_SASL; version = LDAP_VERSION3; - sasl_flags = LUTIL_SASL_QUIET; + sasl_flags = LDAP_SASL_QUIET; + break; #else - fprintf( stderr, "%s: was not compiled with SASL support\n", + fprintf( stderr, "%s: not compiled with SASL support\n", prog ); return( EXIT_FAILURE ); #endif case 'R': #ifdef HAVE_CYRUS_SASL if( sasl_realm != NULL ) { - fprintf( stderr, "%s: -R previously specified\n" ); + fprintf( stderr, "%s: -R previously specified\n", prog ); return EXIT_FAILURE; } if( version == LDAP_VERSION2 ) { @@ -317,7 +358,7 @@ main( int argc, char *argv[] ) version = LDAP_VERSION3; sasl_realm = strdup( optarg ); #else - fprintf( stderr, "%s: was not compiled with SASL support\n", + fprintf( stderr, "%s: not compiled with SASL support\n", prog ); return( EXIT_FAILURE ); #endif @@ -325,7 +366,7 @@ main( int argc, char *argv[] ) case 'U': #ifdef HAVE_CYRUS_SASL if( sasl_authc_id != NULL ) { - fprintf( stderr, "%s: -U previously specified\n" ); + fprintf( stderr, "%s: -U previously specified\n", prog ); return EXIT_FAILURE; } if( version == LDAP_VERSION2 ) { @@ -343,7 +384,7 @@ main( int argc, char *argv[] ) version = LDAP_VERSION3; sasl_authc_id = strdup( optarg ); #else - fprintf( stderr, "%s: was not compiled with SASL support\n", + fprintf( stderr, "%s: not compiled with SASL support\n", prog ); return( EXIT_FAILURE ); #endif @@ -368,7 +409,7 @@ main( int argc, char *argv[] ) case 'Y': #ifdef HAVE_CYRUS_SASL if( sasl_mech != NULL ) { - fprintf( stderr, "%s: -Y previously specified\n" ); + fprintf( stderr, "%s: -Y previously specified\n", prog ); return EXIT_FAILURE; } if( version == LDAP_VERSION2 ) { @@ -384,7 +425,7 @@ main( int argc, char *argv[] ) version = LDAP_VERSION3; sasl_mech = strdup( optarg ); #else - fprintf( stderr, "%s: was not compiled with SASL support\n", + fprintf( stderr, "%s: not compiled with SASL support\n", prog ); return( EXIT_FAILURE ); #endif @@ -400,7 +441,7 @@ main( int argc, char *argv[] ) case 'X': #ifdef HAVE_CYRUS_SASL if( sasl_authz_id != NULL ) { - fprintf( stderr, "%s: -X previously specified\n" ); + fprintf( stderr, "%s: -X previously specified\n", prog ); return EXIT_FAILURE; } if( version == LDAP_VERSION2 ) { @@ -425,7 +466,7 @@ main( int argc, char *argv[] ) case 'Z': #ifdef HAVE_TLS if( version == LDAP_VERSION2 ) { - fprintf( stderr, "%s -Z incompatible with version %d\n", + fprintf( stderr, "%s: -Z incompatible with version %d\n", prog, version ); return EXIT_FAILURE; } @@ -440,16 +481,12 @@ main( int argc, char *argv[] ) default: - fprintf( stderr, "%s: unrecongized option -%c\n", + fprintf( stderr, "%s: unrecognized option -%c\n", prog, optopt ); usage (argv[0]); } } - if( argc - optind != 1 ) { - usage( argv[0] ); - } - if (authmethod == -1) { #ifdef HAVE_CYRUS_SASL authmethod = LDAP_AUTH_SASL; @@ -458,15 +495,21 @@ main( int argc, char *argv[] ) #endif } - dn = strdup( argv[optind] ); + if( argc - optind > 1 ) { + usage( argv[0] ); + } else if ( argc - optind == 1 ) { + user = strdup( argv[optind] ); + } else { + user = NULL; + } if( want_oldpw && oldpw == NULL ) { /* prompt for old password */ char *ckoldpw; - newpw = strdup(getpassphrase("Old password: ")); + oldpw = strdup(getpassphrase("Old password: ")); ckoldpw = getpassphrase("Re-enter old password: "); - if( newpw== NULL || ckoldpw == NULL || + if( oldpw== NULL || ckoldpw == NULL || strncmp( oldpw, ckoldpw, strlen(oldpw) )) { fprintf( stderr, "passwords do not match\n" ); @@ -488,19 +531,11 @@ main( int argc, char *argv[] ) } } - if( binddn == NULL && dn != NULL ) { - binddn = dn; - dn = NULL; - - if( passwd.bv_val == NULL ) { - passwd.bv_val = oldpw; - passwd.bv_len = oldpw == NULL ? 0 : strlen( oldpw ); - } - } - if (want_bindpw && passwd.bv_val == NULL ) { /* handle bind password */ - fprintf( stderr, "Bind DN: %s\n", binddn ); + if( binddn != NULL ) { + fprintf( stderr, "Bind DN: %s\n", binddn ); + } passwd.bv_val = strdup( getpassphrase("Enter bind password: ")); passwd.bv_len = passwd.bv_val ? strlen( passwd.bv_val ) : 0; } @@ -519,9 +554,31 @@ main( int argc, char *argv[] ) #endif /* connect to server */ - if ((ld = ldap_init( ldaphost, ldapport )) == NULL) { - perror("ldap_init"); - return EXIT_FAILURE; + if( ( ldaphost != NULL || ldapport ) && ( ldapuri == NULL ) ) { + if ( verbose ) { + fprintf( stderr, "ldap_init( %s, %d )\n", + ldaphost != NULL ? ldaphost : "", + ldapport ); + } + + ld = ldap_init( ldaphost, ldapport ); + if( ld == NULL ) { + perror("ldapsearch: ldap_init"); + return EXIT_FAILURE; + } + + } else { + if ( verbose ) { + fprintf( stderr, "ldap_initialize( %s )\n", + ldapuri != NULL ? ldapuri : "" ); + } + + rc = ldap_initialize( &ld, ldapuri ); + if( rc != LDAP_SUCCESS ) { + fprintf( stderr, "Could not create LDAP session handle (%d): %s\n", + rc, ldap_err2string(rc) ); + return EXIT_FAILURE; + } } /* referrals */ @@ -566,7 +623,7 @@ main( int argc, char *argv[] ) } } - defaults = lutil_sasl_defaults( ld, sasl_flags, + defaults = lutil_sasl_defaults( ld, sasl_mech, sasl_realm, sasl_authc_id, @@ -575,14 +632,14 @@ main( int argc, char *argv[] ) rc = ldap_sasl_interactive_bind_s( ld, binddn, sasl_mech, NULL, NULL, - lutil_sasl_interact, defaults ); + sasl_flags, lutil_sasl_interact, defaults ); if( rc != LDAP_SUCCESS ) { ldap_perror( ld, "ldap_sasl_interactive_bind_s" ); return( EXIT_FAILURE ); } #else - fprintf( stderr, "%s was not compiled with SASL support\n", + fprintf( stderr, "%s: not compiled with SASL support\n", argv[0] ); return( EXIT_FAILURE ); #endif @@ -595,7 +652,7 @@ main( int argc, char *argv[] ) } } - if( dn != NULL || oldpw != NULL || newpw != NULL ) { + if( user != NULL || oldpw != NULL || newpw != NULL ) { /* build change password control */ BerElement *ber = ber_alloc_t( LBER_USE_DER ); @@ -607,10 +664,10 @@ main( int argc, char *argv[] ) ber_printf( ber, "{" /*}*/ ); - if( dn != NULL ) { + if( user != NULL ) { ber_printf( ber, "ts", - LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, dn ); - free(dn); + LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, user ); + free(user); } if( oldpw != NULL ) {