X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Fback-ldbm%2Fbind.c;h=dce317876a1ff38e561713b5a045f244f8f78f0c;hb=4a107089d82ecdaca788fc6ecdef34d3d4fc19df;hp=cb59ab034932097ccd3498da14cf669b4cedfe57;hpb=b2ec7af3310845f2ceadb23475b808a62bd92a6d;p=openldap diff --git a/servers/slapd/back-ldbm/bind.c b/servers/slapd/back-ldbm/bind.c index cb59ab0349..dce317876a 100644 --- a/servers/slapd/back-ldbm/bind.c +++ b/servers/slapd/back-ldbm/bind.c @@ -1,4 +1,18 @@ /* bind.c - ldbm backend bind and unbind routines */ +/* $OpenLDAP$ */ +/* This work is part of OpenLDAP Software . + * + * Copyright 1998-2005 The OpenLDAP Foundation. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. + * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . + */ #include "portable.h" @@ -13,253 +27,170 @@ #include "back-ldbm.h" #include "proto-back-ldbm.h" -#ifdef SLAPD_SHA1 -#include -#endif /* SLAPD_SHA1 */ - -#ifdef SLAPD_MD5 -#include -#endif /* SLAPD_MD5 */ - -#include - -#ifdef HAVE_KERBEROS -extern int krbv4_ldap_auth(); -#endif - -#ifdef SLAPD_CRYPT -pthread_mutex_t crypt_mutex; - -static int -crypted_value_find( - struct berval **vals, - struct berval *v, - int syntax, - int normalize, - struct berval *cred -) -{ - int i; - for ( i = 0; vals[i] != NULL; i++ ) { - if ( syntax != SYNTAX_BIN && strncasecmp( "{CRYPT}", - vals[i]->bv_val, (sizeof("{CRYPT}") - 1 ) ) == 0 ) { - char *userpassword = vals[i]->bv_val + sizeof("{CRYPT}") - 1; - pthread_mutex_lock( &crypt_mutex ); - if (strcmp(userpassword, crypt(cred->bv_val, - userpassword)) == 0) { - pthread_mutex_unlock( &crypt_mutex ); - return ( 0 ); - } - pthread_mutex_unlock( &crypt_mutex ); -#ifdef SLAPD_MD5 - } else if ( syntax != SYNTAX_BIN && strncasecmp( "{MD5}", - vals[i]->bv_val, (sizeof("{MD5}") - 1 ) ) == 0 ) { - ldap_MD5_CTX MD5context; - unsigned char MD5digest[20]; - char base64digest[29]; /* ceiling(sizeof(input)/3) * 4 + 1 */ - - char *userpassword = vals[i]->bv_val + sizeof("{MD5}") - 1; - - ldap_MD5Init(&MD5context); - ldap_MD5Update(&MD5context, - (unsigned char *) cred->bv_val, - strlen(cred->bv_val)); - ldap_MD5Final(MD5digest, &MD5context); - - if (b64_ntop(MD5digest, sizeof(MD5digest), - base64digest, sizeof(base64digest)) < 0) - { - return ( 1 ); - } - - if (strcmp(userpassword, base64digest) == 0) { - return ( 0 ); - } -#endif /* SLAPD_MD5 */ -#ifdef SLAPD_SHA1 - } else if ( syntax != SYNTAX_BIN && strncasecmp( "{SHA}", - vals[i]->bv_val, (sizeof("{SHA}") - 1 ) ) == 0 ) { - ldap_SHA1_CTX SHA1context; - unsigned char SHA1digest[20]; - char base64digest[29]; /* ceiling(sizeof(input)/3) * 4 + 1 */ - - char *userpassword = vals[i]->bv_val + sizeof("{SHA}") - 1; - - ldap_SHA1Init(&SHA1context); - ldap_SHA1Update(&SHA1context, - (unsigned char *) cred->bv_val, - strlen(cred->bv_val)); - ldap_SHA1Final(SHA1digest, &SHA1context); - - if (b64_ntop(SHA1digest, sizeof(SHA1digest), - base64digest, sizeof(base64digest)) < 0) - { - return ( 1 ); - } - - if (strcmp(userpassword, base64digest) == 0) { - return ( 0 ); - } -#endif /* SLAPD_SHA1 */ - } else { - if ( value_cmp( vals[i], v, syntax, normalize ) == 0 ) { - return( 0 ); - } - } - } - - return( 1 ); -} -#endif /* SLAPD_CRYPT */ - int ldbm_back_bind( - Backend *be, - Connection *conn, Operation *op, - char *dn, - int method, - struct berval *cred -) + SlapReply *rs ) { - struct ldbminfo *li = (struct ldbminfo *) be->be_private; + struct ldbminfo *li = (struct ldbminfo *) op->o_bd->be_private; Entry *e; Attribute *a; int rc; - char *matched; -#ifdef HAVE_KERBEROS + Entry *matched; +#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND char krbname[MAX_K_NAME_SZ + 1]; + AttributeDescription *krbattr = slap_schema.si_ad_krbName; AUTH_DAT ad; #endif - Debug(LDAP_DEBUG_ARGS, "==> ldbm_back_bind: dn: %s\n", dn, 0, 0); + AttributeDescription *password = slap_schema.si_ad_userPassword; + + Debug(LDAP_DEBUG_ARGS, + "==> ldbm_back_bind: dn: %s\n", op->o_req_dn.bv_val, 0, 0); + + if ( op->oq_bind.rb_method == LDAP_AUTH_SIMPLE && be_isroot_pw( op ) ) { + ber_dupbv( &op->oq_bind.rb_edn, be_root_dn( op->o_bd ) ); + /* front end will send result */ + return LDAP_SUCCESS; + } + + /* grab giant lock for reading */ + ldap_pvt_thread_rdwr_rlock(&li->li_giant_rwlock); /* get entry with reader lock */ - if ( (e = dn2entry_r( be, dn, &matched )) == NULL ) { - /* allow noauth binds */ - if ( method == LDAP_AUTH_SIMPLE && cred->bv_len == 0 ) { - /* - * bind successful, but return 1 so we don't - * authorize based on noauth credentials - */ - send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL ); - rc = 1; - } else if ( be_isroot_pw( be, dn, cred ) ) { - /* front end will send result */ - rc = 0; - } else { - send_ldap_result( conn, op, LDAP_NO_SUCH_OBJECT, matched, NULL ); - rc = 1; + if ( (e = dn2entry_r( op->o_bd, &op->o_req_ndn, &matched )) == NULL ) { + if( matched != NULL ) { + cache_return_entry_r( &li->li_cache, matched ); } - if ( matched != NULL ) { - free( matched ); - } - return( rc ); + ldap_pvt_thread_rdwr_runlock(&li->li_giant_rwlock); + + /* allow noauth binds */ + rc = 1; + rs->sr_err = LDAP_INVALID_CREDENTIALS; + send_ldap_result( op, rs ); + return rs->sr_err; } /* check for deleted */ +#ifdef LDBM_SUBENTRIES + if ( is_entry_subentry( e ) ) { + /* entry is an subentry, don't allow bind */ + Debug( LDAP_DEBUG_TRACE, + "entry is subentry\n", 0, 0, 0 ); + rc = LDAP_INVALID_CREDENTIALS; + goto return_results; + } +#endif - switch ( method ) { - case LDAP_AUTH_SIMPLE: - if ( cred->bv_len == 0 ) { - send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL ); + if ( is_entry_alias( e ) ) { + /* entry is an alias, don't allow bind */ + Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0, 0, 0 ); - /* stop front end from sending result */ - rc = 1; - goto return_results; - } else if ( be_isroot_pw( be, dn, cred ) ) { - /* front end will send result */ - rc = 0; - goto return_results; - } +#if 1 + rc = LDAP_INVALID_CREDENTIALS; +#else + rs->sr_text = "entry is alias"; + rc = LDAP_ALIAS_PROBLEM; +#endif + goto return_results; + } - if ( (a = attr_find( e->e_attrs, "userpassword" )) == NULL ) { - if ( be_isroot_pw( be, dn, cred ) ) { - /* front end will send result */ - rc = 0; - goto return_results; - } - send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH, - NULL, NULL ); - rc = 1; + if ( is_entry_referral( e ) ) { + /* entry is a referral, don't allow bind */ + Debug( LDAP_DEBUG_TRACE, "entry is referral\n", 0, 0, 0 ); + + rc = LDAP_INVALID_CREDENTIALS; + goto return_results; + } + + switch ( op->oq_bind.rb_method ) { + case LDAP_AUTH_SIMPLE: + if ( (a = attr_find( e->e_attrs, password )) == NULL ) { + /* stop front end from sending result */ + rc = LDAP_INVALID_CREDENTIALS; goto return_results; } -#ifdef SLAPD_CRYPT - if ( crypted_value_find( a->a_vals, cred, a->a_syntax, 0, cred ) != 0 ) -#else - if ( value_find( a->a_vals, cred, a->a_syntax, 0 ) != 0 ) -#endif + if ( slap_passwd_check( op, e, a, &op->oq_bind.rb_cred, + &rs->sr_text ) != 0 ) { - if ( be_isroot_pw( be, dn, cred ) ) { - /* front end will send result */ - rc = 0; - goto return_results; - } - send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS, - NULL, NULL ); - rc = 1; + /* failure; stop front end from sending result */ + rc = LDAP_INVALID_CREDENTIALS; goto return_results; } + rc = 0; break; -#ifdef HAVE_KERBEROS +#ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND case LDAP_AUTH_KRBV41: - if ( krbv4_ldap_auth( be, cred, &ad ) != LDAP_SUCCESS ) { - send_ldap_result( conn, op, LDAP_INVALID_CREDENTIALS, - NULL, NULL ); - rc = 0; + if ( krbv4_ldap_auth( op->o_bd, &op->oq_bind.rb_cred, &ad ) + != LDAP_SUCCESS ) + { + rc = LDAP_INVALID_CREDENTIALS; goto return_results; } + + if ( ! access_allowed( op, e, + krbattr, NULL, ACL_AUTH, NULL ) ) + { + rc = LDAP_INSUFFICIENT_ACCESS; + goto return_results; + } + sprintf( krbname, "%s%s%s@%s", ad.pname, *ad.pinst ? "." : "", ad.pinst, ad.prealm ); - if ( (a = attr_find( e->e_attrs, "krbname" )) == NULL ) { + + if ( (a = attr_find( e->e_attrs, krbattr )) == NULL ) { /* - * no krbName values present: check against DN + * no krbname values present: check against DN */ - if ( strcasecmp( dn, krbname ) == 0 ) { - rc = 0; /* XXX wild ass guess */ + if ( strcasecmp( op->o_req_dn.bv_val, krbname ) == 0 ) { + rc = 0; break; } - send_ldap_result( conn, op, LDAP_INAPPROPRIATE_AUTH, - NULL, NULL ); - rc = 1; + rc = LDAP_INAPPROPRIATE_AUTH; goto return_results; - } else { /* look for krbName match */ + + } else { /* look for krbname match */ struct berval krbval; krbval.bv_val = krbname; krbval.bv_len = strlen( krbname ); - if ( value_find( a->a_vals, &krbval, a->a_syntax, 3 ) != 0 ) { - send_ldap_result( conn, op, - LDAP_INVALID_CREDENTIALS, NULL, NULL ); - rc = 1; + if ( value_find( a->a_desc, a->a_vals, &krbval ) != 0 ) { + rc = LDAP_INVALID_CREDENTIALS; goto return_results; } } + rc = 0; break; - - case LDAP_AUTH_KRBV42: - send_ldap_result( conn, op, LDAP_SUCCESS, NULL, NULL ); - /* stop front end from sending result */ - rc = 1; - goto return_results; #endif default: - send_ldap_result( conn, op, LDAP_STRONG_AUTH_NOT_SUPPORTED, - NULL, "auth method not supported" ); - rc = 1; + assert( 0 ); /* should not be reachable */ + rs->sr_text = "authentication method not supported"; + rc = LDAP_STRONG_AUTH_NOT_SUPPORTED; goto return_results; } + ber_dupbv( &op->oq_bind.rb_edn, &e->e_name ); + return_results:; /* free entry and reader lock */ cache_return_entry_r( &li->li_cache, e ); + ldap_pvt_thread_rdwr_runlock(&li->li_giant_rwlock); + + if ( rc ) { + rs->sr_err = rc; + send_ldap_result( op, rs ); + if ( rs->sr_ref ) { + ber_bvarray_free( rs->sr_ref ); + rs->sr_ref = NULL; + } + } - /* front end with send result on success (rc==0) */ + /* front end will send result on success (rc==0) */ return( rc ); }