Make SASL authorization work for NULL, "u:", and "dn:" authz strings.

diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h
index 9c48bf6889db5132c7c0c1cfd46c9c73062e1c69..110b27fcf2798202455adad90c6880633239867b 100644 (file)
--- a/servers/slapd/proto-slap.h
+++ b/servers/slapd/proto-slap.h
@@ -572,10 +572,10 @@ LDAP_SLAPD_F (int) slap_sasl_bind LDAP_P((
 /*
  * saslauthz.c
  */
+LDAP_SLAPD_F (char *) slap_sasl2dn LDAP_P((    char *saslname ));
 LDAP_SLAPD_F (int) slap_sasl_authorized LDAP_P((
-       Connection *conn,
-       const char *authcid,
-       const char *authzid ));
+       char *authcid,
+       char *authzid ));
 LDAP_SLAPD_F (int) slap_sasl_regexp_config LDAP_P((
        const char *match, const char *replace ));
 

diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index b6fe4624bd873e822930ea301435d19f8bcb7f00..aa06f29b5d4680984ff17cb5a059de4cfd309ca6 100644 (file)
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -66,6 +66,116 @@ slap_sasl_log(
        return SASL_OK;
 }
 
+
+/* Take any sort of identity string and return a DN with the "dn:" prefix. The
+   string returned in *dnptr is in its own allocated memory, and must be free'd 
+   by the calling process.
+   -Mark Adamson, Carnegie Mellon
+*/
+
+int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags )
+{
+       char *c, *c1, *dn=NULL;
+       int rc, len, len1;
+       sasl_conn_t *ctx;
+
+
+       Debug( LDAP_DEBUG_ARGS, "slap_sasl_getdn: id=%s\n", 
+      id?(*id?id:"<empty>"):"NULL",0,0 );
+
+       /* Blatantly anonymous ID */
+       len = strlen( "anonymous" );
+       if( id && !strncasecmp( id, "anonymous", len) && 
+               ( id[len] == '\0' || id[len] == '@' ) ) {
+               *dnptr = NULL;
+               return( LDAP_SUCCESS );
+       }
+       ctx = conn->c_sasl_context;
+       dn = ch_strdup( id );
+       len = strlen( id );
+
+       /* An authcID will need to be prefixed with u: */
+       if( flags & FLAG_GETDN_AUTHCID ) {
+               dn = ch_realloc( dn, len+3 );
+               memmove( dn+2, dn, len+1 );
+               dn[0] = 'u';
+               dn[1] = ':';
+               len += 2;
+       }
+
+       /* An authzID must be properly prefixed */
+       if( flags & FLAG_GETDN_AUTHZID && strncasecmp( dn, "u:", 2 ) &&
+         strncasecmp( dn, "dn:", 3 ) ) {
+               ch_free( dn );
+               *dnptr = NULL;
+               return( LDAP_INAPPROPRIATE_AUTH );
+       }
+
+       /* Username strings */
+       len1  = strlen( ",cn=authzid" );
+       if( !strncasecmp( dn, "u:", 2 ) ) {
+               len += strlen( "dn:uid=" ) + len1;
+
+               /* Figure out how much data we have for the dn */
+               rc = sasl_getprop( ctx, SASL_REALM, (void **)&c );
+               if( rc != SASL_OK ) {
+                       Debug(LDAP_DEBUG_TRACE,
+                               "getdn: getprop(REALM) failed!\n", 0,0,0);
+                       ch_free( dn );
+                       *dnptr = NULL;
+                       return( LDAP_OPERATIONS_ERROR );
+               }
+               if( c ) {
+                       len += strlen( c ) + strlen(",cn=" );
+               }
+               if( conn->c_sasl_bind_mech ) {
+                       len += strlen( conn->c_sasl_bind_mech ) + strlen( ",cn=mech" );
+               }
+
+               /* Build the new dn */
+               c1 = dn;
+               dn = ch_malloc( len );
+               len = sprintf( dn, "dn:uid=%s", c1+2 );
+               ch_free( c1 );
+
+               if( c ) {
+                       len += sprintf( dn+len, ",cn=%s", c );
+               }
+               if( conn->c_sasl_bind_mech ) {
+                       len += sprintf( dn+len, ",cn=%s", conn->c_sasl_bind_mech );
+               }
+               strcpy( dn+len, ",cn=authzid" );
+               len += len1;
+               Debug( LDAP_DEBUG_TRACE, "getdn: u:id converted to %s\n", dn,0,0 );
+       }
+
+       /* DN strings that are a cn=authzid identity to run through regexp */
+       if( !strncasecmp( dn, "dn:", 3) && ( ( flags & FLAG_GETDN_FINAL ) == 0 ) ) {
+               c1 = slap_sasl2dn( dn + 3 );
+               if( c1 ) {
+                       ch_free( dn );
+                       dn = c1;
+                       /* Reaffix the dn: prefix if it was removed */
+                       if( strncasecmp( dn, "dn:", 3) ) {
+                               c1 = dn;
+                               dn = ch_malloc( strlen( c1 ) + 4 );
+                               sprintf( dn, "dn:%s", c1 );
+                               ch_free( c1 );
+                       }
+                       Debug( LDAP_DEBUG_TRACE, "getdn: dn:id converted to %s\n", dn,0,0 );
+               }
+       }
+
+       if( ( flags & FLAG_GETDN_FINAL ) == 0 )  {
+               dn_normalize( dn );
+       }
+
+       *dnptr = dn;
+       return( LDAP_SUCCESS );
+}
+
+
+
 static int
 slap_sasl_authorize(
        void *context,
@@ -74,61 +184,47 @@ slap_sasl_authorize(
        const char **user,
        const char **errstr)
 {
-       char *cuser;
+       char *authcDN, *authzDN;
        int rc;
        Connection *conn = context;
 
        *user = NULL;
 
-       if ( authcid == NULL || *authcid == '\0' ) {
-               *errstr = "empty authentication identity";
-
-               Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
-                       "empty authentication identity\n",
-                       (long) (conn ? conn->c_connid : -1),
-                       0, 0 );
-               return SASL_BADAUTH;
-       }
-
        Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
                "authcid=\"%s\" authzid=\"%s\"\n",
                (long) (conn ? conn->c_connid : -1),
                authcid ? authcid : "<empty>",
                authzid ? authzid : "<empty>" );
 
-       if ( authzid == NULL || *authzid == '\0' ||
-               ( authzid[0] == 'u' && authzid[1] == ':' &&
-                       strcmp( authcid, &authzid[2] ) == 0 ) ||
-               strcmp( authcid, authzid ) == 0 )
-       {
-               /* authzid is:
-                *              empty
-                *              u:authcid
-                *              authcid
-                */
-       
-               size_t len = sizeof("u:") + strlen( authcid );
-
-               cuser = ch_malloc( len );
-               strcpy( cuser, "u:" );
-               strcpy( &cuser[sizeof("u:")-1], authcid );
-
-               *user = cuser;
-
+       /* Convert the identities to DN's. If no authzid was given, client will
+          be bound as the DN matching their username */
+       rc = slap_sasl_getdn( conn, (char *)authcid, &authcDN, FLAG_GETDN_AUTHCID );
+       if( rc != LDAP_SUCCESS ) {
+               *errstr = ldap_err2string( rc );
+               return SASL_NOAUTHZ;
+       }
+       if( ( authzid == NULL ) || !strcmp( authcid,authzid ) ) {
                Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
-                       "\"%s\" as \"%s\"\n", 
-                       (long) (conn ? conn->c_connid : -1),
-                       authcid, cuser );
-
+                "Using authcDN=%s\n", (long) (conn ? conn->c_connid : -1), authcDN,0 );
+               *user = authcDN;
+               *errstr = NULL;
                return SASL_OK;
        }
+       rc = slap_sasl_getdn( conn, (char *)authzid, &authzDN, FLAG_GETDN_AUTHZID );
+       if( rc != LDAP_SUCCESS ) {
+               ch_free( authcDN );
+               *errstr = ldap_err2string( rc );
+               return SASL_NOAUTHZ;
+       }
 
-       rc = slap_sasl_authorized( conn, authcid, authzid );
+       rc = slap_sasl_authorized( authcDN, authzDN );
        if( rc ) {
                Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
                        " authorization disallowed (%d)\n",
                        (long) (conn ? conn->c_connid : -1), rc, 0 );
                *errstr = "not authorized";
+               ch_free( authcDN );
+               ch_free( authzDN );
                return SASL_NOAUTHZ;
        }
 
@@ -136,10 +232,9 @@ slap_sasl_authorize(
                " authorization allowed\n",
                (long) (conn ? conn->c_connid : -1), 0, 0 );
 
-       cuser = ch_strdup( authzid );
-       dn_normalize( cuser );
+       ch_free( authcDN );
+       *user = authzDN;
        *errstr = NULL;
-       *user = cuser;
        return SASL_OK;
 }
 
@@ -442,100 +537,13 @@ int slap_sasl_bind(
                        send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
                                NULL, "no SASL username", NULL, NULL );
 
-               } else if ( username == NULL || *username == '\0' ) {
-                       Debug(LDAP_DEBUG_TRACE,
-                               "slap_sasl_bind: getprop(USERNAME) returned NULL!\n",
-                               0, 0, 0);
-
-                       send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
-                               NULL, "no SASL username", NULL, NULL );
-
                } else {
-                       char *realm = NULL;
-                       sasl_ssf_t *ssf = NULL;
-
-                       (void) sasl_getprop( ctx,
-                               SASL_REALM, (void **)&realm );
-
-                       (void) sasl_getprop( ctx,
-                               SASL_SSF, (void *)&ssf );
-
-                       Debug(LDAP_DEBUG_TRACE,
-                               "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n",
-                               username ? username : "",
-                               realm ? realm : "",
-                               (unsigned long) ( ssf ? *ssf : 0 ) );
-
-                       rc = LDAP_SUCCESS;
-
-                       if( username == NULL || (
-                               !strncasecmp( username, "anonymous", sizeof("anonymous")-1 ) &&
-                               ( username[sizeof("anonymous")-1] == '\0' ||
-                                 username[sizeof("anonymous")-1] == '@' ) ) )
-                       {
-                               Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n",
-                                       0, 0, 0);
-
-                       } else if ( username[0] == 'u' && username[1] == ':'
-                               && username[2] != '\0' )
-                       {
-                               *edn = ch_malloc( sizeof( "uid=,cn=" )
-                                       + strlen( &username[2] )
-                                       + ( realm ? strlen( realm ) : 0 ) );
-
-                               strcpy( *edn, "uid=" );
-                               strcat( *edn, &username[2] );
-
-                               if( realm && *realm ) {
-                                       strcat( *edn, ",cn=" );
-                                       strcat( *edn, realm );
-                               }
-
-                               if( dn_normalize( *edn ) == NULL ) {
-                                       Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
-                                               "authzid (\"%s\") to authzdn failed: \"%s\"\n",
-                                               username, *edn, 0);
-                                       ch_free( *edn );
-                                       *edn = NULL;
-                                       rc = LDAP_INAPPROPRIATE_AUTH;
-                                       errstr = "could not form a valid DN from authzid";
-
-                               }  else {
-                                       Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
-                                               "authzdn: \"%s\"\n",
-                                               *edn, 0, 0);
-                               }
-
-                       } else if ( username[0] == 'd' && username[1] == 'n'
-                               && username[2] != ':' && username[3] != '\0' )
-                       {
-                               *edn = ch_strdup( &username[3] );
-
-                               if( dn_normalize( *edn ) == NULL ) {
-                                       Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
-                                               "authzid (\"%s\") to authzdn failed: \"%s\"\n",
-                                               username, *edn, 0);
-
-                                       ch_free( *edn );
-                                       *edn = NULL;
-                                       rc = LDAP_INAPPROPRIATE_AUTH;
-                                       errstr = "could not form a valid DN from authzid";
-
-                               }  else {
-                                       Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
-                                               "authzdn: \"%s\"\n",
-                                               *edn, 0, 0);
-                               }
-
-                       } else {
-                               Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: "
-                                       "authzid (\"%s\") inappropriate form\n",
-                                       username, 0, 0);
-                               rc = LDAP_INAPPROPRIATE_AUTH;
-                               errstr = "inappropriate authorization identity form";
-                       }
+                       rc = slap_sasl_getdn( conn, username, edn, FLAG_GETDN_FINAL );
 
                        if( rc == LDAP_SUCCESS ) {
+                               int i;
+                               sasl_ssf_t *ssf = NULL;
+                               (void) sasl_getprop( ctx, SASL_SSF, (void *)&ssf );
                                *ssfp = ssf ? *ssf : 0;
 
                                if( *ssfp ) {
@@ -544,6 +552,15 @@ int slap_sasl_bind(
                                        ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
                                }
 
+                               /* Store the authorization DN as a subjectDN */
+                               if ( *edn ) {
+                                       i = 2;
+                                       do {
+                                               i++;
+                                               (*edn)[i-3] = (*edn)[i];
+                                       } while( (*edn)[i] );
+                               }
+
                                send_ldap_sasl( conn, op, rc,
                                        NULL, NULL, NULL, NULL,
                                        response.bv_len ? &response : NULL );

diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index e4bcdb7c0e58d8e90f394e287159857a6e9475d6..392c1caad9bf51c51b5a2a4a57b14f6b14224a0a 100644 (file)
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -45,6 +45,14 @@ int slap_parseURI( char *uri, char **searchbase, int *scope, Filter **filter )
        Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri, 0, 0 );
 
        /* If it does not look like a URI, assume it is a DN */
+       if( !strncasecmp( uri, "dn:", 3 ) ) {
+               uri += 3;
+               uri += strspn( uri, " " );
+               *searchbase = ch_strdup( uri );
+               dn_normalize( *searchbase );
+               *scope = LDAP_SCOPE_BASE;
+               return( LDAP_SUCCESS );
+       }
        if( strncasecmp( uri, "ldap://", 7 ) ) {
                *searchbase = ch_strdup( uri );
                dn_normalize( *searchbase );
@@ -251,7 +259,7 @@ char *slap_sasl_regexp( char *saslname )
 
 
 /*
- * Given a SASL name (e.g. "UID=name+cn=REALM,cn=MECH,cn=AUTHZ")
+ * Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTHZID")
  * return the LDAP DN to which it matches. The SASL regexp rules in the config
  * file turn the SASL name into an LDAP URI. If the URI is just a DN (or a
  * search with scope=base), just return the URI (or its searchbase). Otherwise
@@ -259,7 +267,6 @@ char *slap_sasl_regexp( char *saslname )
  * entry, return the DN of that one entry.
  */
 
-static
 char *slap_sasl2dn( char *saslname )
 {
        char *uri=NULL, *searchbase=NULL, *DN=NULL;
@@ -346,6 +353,8 @@ FINISHED:
  * URI, just strcmp the rule (or its searchbase) to the *assertDN. Otherwise,
  * the rule must be used as an internal search for entries. If that search
  * returns the *assertDN entry, the match is successful.
+ *
+ * The assertDN should not have the dn: prefix
  */
 
 static
@@ -358,6 +367,7 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc )
        Connection *conn=NULL;
        LDAP *client=NULL;
        LDAPMessage *res=NULL, *msg;
+       regex_t reg;
 
 
        Debug( LDAP_DEBUG_TRACE,
@@ -370,7 +380,12 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc )
        /* Massive shortcut: search scope == base */
        if( scope == LDAP_SCOPE_BASE ) {
                dn_normalize( searchbase );
-               if( strcmp( searchbase, assertDN ) == 0 )
+               rc = regcomp(&reg, searchbase, REG_EXTENDED|REG_ICASE|REG_NOSUB);
+               if ( rc == 0 ) {
+                       rc = regexec(&reg, assertDN, 0, NULL, 0);
+                       regfree( &reg );
+               }
+               if ( rc == 0 )
                        rc = LDAP_SUCCESS;
                else
                        rc = LDAP_INAPPROPRIATE_AUTH;
@@ -440,6 +455,8 @@ CONCLUDED:
  * based on authorization rules. The rules are stored in the *searchDN, in the
  * attribute named by *attr. If any of those rules map to the *assertDN, the
  * authorization is approved.
+ *
+ * DN's passed in should have a dn: prefix
  */
 
 static int
@@ -458,13 +475,13 @@ slap_sasl_check_authz(char *searchDN, char *assertDN, char *attr, char *authc)
        if( rc != LDAP_SUCCESS )
                goto COMPLETE;
 
-       rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN, ad, &vals );
+       rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN+3, ad, &vals );
        if( rc != LDAP_SUCCESS )
                goto COMPLETE;
 
        /* Check if the *assertDN matches any **vals */
        for( i=0; vals[i] != NULL; i++ ) {
-               rc = slap_sasl_match( vals[i]->bv_val, assertDN, authc );
+               rc = slap_sasl_match( vals[i]->bv_val, assertDN+3, authc );
                if ( rc == LDAP_SUCCESS )
                        goto COMPLETE;
        }
@@ -487,50 +504,28 @@ COMPLETE:
 
 
 
-/* Check if a bind can SASL authorize to another identity. */
+/* Check if a bind can SASL authorize to another identity.
+   Accepts authorization DN's with "dn:" prefix */
 
-int slap_sasl_authorized( Connection *conn,
-       const char *authcid, const char *authzid )
+int slap_sasl_authorized( char *authcDN, char *authzDN )
 {
        int rc;
-       char *saslname=NULL,*authcDN=NULL,*realm=NULL, *authzDN=NULL;
 
 #ifdef HAVE_CYRUS_SASL
-       Debug( LDAP_DEBUG_TRACE,
-          "==>slap_sasl_authorized: can %s become %s?\n", authcid, authzid, 0 );
-
-       /* Create a complete SASL name for the SASL regexp patterns */
-
-       sasl_getprop( conn->c_sasl_context, SASL_REALM, (void **)&realm );
-
-       /* Allocate space */
-       rc = strlen("uid=,cn=,cn=,cn=AUTHZ ");
-       if ( realm ) rc += strlen( realm );
-       if ( authcid ) rc += strlen( authcid );
-       rc += strlen( conn->c_sasl_bind_mech );
-       saslname = ch_malloc( rc );
-
-       /* Build the SASL name with whatever we have, and normalize it */
-       saslname[0] = '\0';
-       rc = 0;
-       if ( authcid )
-               rc += sprintf( saslname+rc, "%sUID=%s", rc?",":"", authcid);
-       if ( realm )
-               rc += sprintf( saslname+rc, "%sCN=%s", rc?",":"", realm);
-       if ( conn->c_sasl_bind_mech )
-               rc += sprintf( saslname+rc, "%sCN=%s", rc?",":"",
-                  conn->c_sasl_bind_mech);
-       sprintf( saslname+rc, "%sCN=AUTHZ", rc?",":"");
-       dn_normalize( saslname );
-
-       authcDN = slap_sasl2dn( saslname );
-       if( authcDN == NULL )
+       /* User binding as anonymous */
+       if ( authzDN == NULL ) {
+               rc = LDAP_SUCCESS;
                goto DONE;
+       }
 
-       /* Normalize the name given by the clientside of the connection */
-       authzDN = ch_strdup( authzid );
-       dn_normalize( authzDN );
+       Debug( LDAP_DEBUG_TRACE,
+          "==>slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN, 0 );
 
+       /* If person is authorizing to self, succeed */
+       if ( !strcmp( authcDN, authzDN ) ) {
+               rc = LDAP_SUCCESS;
+               goto DONE;
+       }
 
        /* Check source rules */
        rc = slap_sasl_check_authz( authcDN, authzDN, SASL_AUTHZ_SOURCE_ATTR,
@@ -548,9 +543,6 @@ int slap_sasl_authorized( Connection *conn,
        rc = LDAP_INAPPROPRIATE_AUTH;
 
 DONE:
-       if( saslname ) ch_free( saslname );
-       if( authcDN ) ch_free( authcDN );
-       if( authzDN ) ch_free( authzDN );
        Debug( LDAP_DEBUG_TRACE, "<== slap_sasl_authorized: return %d\n",rc,0,0 );
        return( rc );
 }

diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h
index 1dc3bba6b047b882b20128e6d13defff233ab675..bd63be328049c1b884c2fed62af75868547cee01 100644 (file)
--- a/servers/slapd/slap.h
+++ b/servers/slapd/slap.h
@@ -1202,6 +1202,11 @@ typedef struct sasl_regexp {
   int offset[SASLREGEX_REPLACE+2];        /* offsets of $1,$2... in *replace */
 } SaslRegexp_t;
 
+/* Flags for telling slap_sasl_getdn() what type of identity is being passed */
+#define FLAG_GETDN_FINAL   1
+#define FLAG_GETDN_AUTHCID 2
+#define FLAG_GETDN_AUTHZID 4
+
 
 LDAP_END_DECL