INTERNET-DRAFT Michael P. Armijo
-<draft-ietf-ldapext-locate-03.txt> Levon Esibov
-July, 2000 Paul Leach
-Expires: January, 2001 Microsoft Corporation
+<draft-ietf-ldapext-locate-04.txt> Levon Esibov
+August, 2000 Paul Leach
+Expires: February, 2001 Microsoft Corporation
R.L. Morgan
University of Washington
http://www.ietf.org/shadow.html.
Distribution of this memo is unlimited. It is filed as <draft-
- ietf-ldapext-locate-03.txt>, and expires on January 14, 2001.
+ ietf-ldapext-locate-04.txt>, and expires on February 25, 2001.
Please send comments to the authors.
DNs cannot be converted into a domain name. Converted DNs result
in a fully qualified domain name.
- The output domain name is initially empty. For each RDN component
- of the DN, beginning with the rightmost and working left, if the
- attribute type is "DC", then the attribute value is used as a domain
- name component (label).
- The first such value becomes the most significant (i.e., rightmost)
- domain name component, and successive values occupy less significant
- positions (i.e., extending leftward), in order. If the attribute
- type is not "DC", then processing stops. If the final RDN component
- of the DN is not of type "DC" then the DN cannot be converted to a
- domain name.
+ The output domain name is initially empty. The DN is processed in
+ right-to-left order (i.e., beginning with the first RDN in the
+ sequence of RDNs). An RDN is able to be converted if it (1)
+ consists of a single AttributeTypeAndValue; (2) the attribute type
+ is "DC"; and (3) the attribute value is non-null. If it can be
+ converted, the attribute value is used as a domain name component
+ (label). The first such value becomes the rightmost (i.e., most
+ significant) domain name component, and successive converted RDN
+ values extend to the left. If an RDN cannot be converted,
+ processing stops. If the output domain name is empty when
+ processing stops, the DN cannot be converted into a domain name.
For DN:
_<Service>._<Proto>.<Domain>
where <Service> is always "ldap", and <Proto> is a protocol that can
- be either "udp" or "tcp". "_ldap._tcp" applies to services
- compatible with LDAPv2 [7] or LDAPv3 [1]. "_ldap._udp"
- applies to services compatible with CLDAP [8]. <Domain> is
- the domain name formed by converting the DN of a naming context
- mastered by the LDAP Server into a domain name using the algorithm in
- Section 3. Note that "ldap" is the symbolic name for the LDAP service
- in Assigned Numbers[6], as required by [5].
+ be either "udp" or "tcp". <Domain> is the domain name formed by
+ converting the DN of a naming context mastered by the LDAP Server
+ into a domain name using the algorithm in Section 3. Note that
+ "ldap" is the symbolic name for the LDAP service in Assigned
+ Numbers[6], as required by [5].
Presence of such records enables clients to find the LDAP servers
using standard DNS query [4]. A client (or server) seeking an LDAP
server for a particular DN converts that DN to a domain name using
- the algorithm of Section 2, does a SRV record query using the DNS
+ the algorithm of Section 3, does a SRV record query using the DNS
name formed as described in the preceding paragraph, and interprets
the response as described in [5] to determine a host (or hosts) to
contact. As an example, a client that searches for an LDAP server
5. Security Considerations
+ DNS responses can typically be easily spoofed. Clients using this
+ location method SHOULD ensure, via use of strong security
+ mechanisms, that the LDAP server they contact is the one they
+ intended to contact. See [7] for more information on security
+ threats and security mechanisms.
+
This document describes a method that uses DNS SRV records to
discover LDAP servers. All security considerations related to DNS
SRV records are inherited by this document. See the security
- considerations section in [6] for more details.
+ considerations section in [5] for more details.
6. References
[6] Reynolds, J. and J. Postel, "Assigned Numbers", STD 2, RFC
1700, October 1994.
- [7] Yeong, W., Howes, T. and Kille, S., "Lightweight Directory Access
- Protocol", RFC 1777, March 1995
-
- [8] Young, A., "Connection-less Lightweight Directory Access Protocol",
- RFC 1798, June 1995
+ [7] Wahl, M., Alvestrand, H., Hodges, J. and Morgan, R.,
+ "Authentication Methods for LDAP", RFC 2829, May 2000.
7. Authors' Addresses
EMail: rlmorgan@washington.edu
URI: http://staff.washington.edu/rlmorgan/
- Expires January, 2001
+ Expires February 25, 2001
assumed that you already have a valid ticket granting ticket. This option
only has effect if
. B ldapdelete
-is compiled with KERBEROS defined.
+is compiled with Kerberos support.
.TP
.B \-K
-Same as \-k, but only does step 1 of the kerberos bind. This is useful
+Same as \-k, but only does step 1 of the Kerberos bind. This is useful
when connecting to a slapd and there is no x500dsa.hostname principal
-registered with your kerberos servers.
+registered with your Kerberos servers.
.TP
.B \-C
Automatically chase referrals.
[\c
.BR \-c ]
[\c
+.BR \-C ]
+[\c
.BR \-r ]
[\c
.BR \-n ]
.B \-k
Use Kerberos authentication instead of simple authentication. It is
assumed that you already have a valid ticket granting ticket. You must
-compile with KERBEROS defined for this option to have any effect.
+compile with Kerberos support for this option to have any effect.
.TP
.B \-K
-Same as \-k, but only does step 1 of the kerberos bind. This is useful
+Same as \-k, but only does step 1 of the Kerberos bind. This is useful
when connecting to a slapd and there is no x500dsa.hostname principal
-registered with your kerberos servers.
+registered with your Kerberos servers.
.TP
.B \-F
Force application of all changes regardless of the contents of input
Use Kerberos authentication instead of simple authentication. It is
assumed that you already have a valid ticket granting ticket.
.B ldapmodrdn
-must be compiled with KERBEROS defined for this option to have effect.
+must be compiled with Kerberos support for this option to have effect.
.TP
.B \-K
-Same as \-k, but only does step 1 of the kerberos bind. This is useful
+Same as \-k, but only does step 1 of the Kerberos bind. This is useful
when connecting to a slapd and there is no x500dsa.hostname principal
-registered with your kerberos servers.
+registered with your Kerberos servers.
.TP
.B \-C
Automatically chase referrals.
Use Kerberos authentication instead of simple authentication. It is
assumed that you already have a valid ticket granting ticket.
.B ldapsearch
-must be compiled with Kerberos for this option to have any effect.
+must be compiled with Kerberos support for this option to have any effect.
.TP
.B \-K
Same as \-k, but only does step 1 of the Kerberos bind. This is useful
directives be used instead.
.RE
.TP
+.B disallow <features>
+Specify a set of features (separated by white space) to disallow.
+.B bind_v2
+disables acceptance of LDAPv2 bind requests.
+.B bind_anon
+disables acceptance of anonymous bind requests.
+.B bind_anon_cred
+disables anonymous bind creditials are not empty (e.g. when
+DN is empty).
+.B bind_anon_dn
+disables anonymous bind when DN is not empty.
+.TP
.B idletimeout <integer>
Specify the number of seconds to wait before forcibly closing
an idle client connections. A idletimeout of 0 disables this
cannot find a local database to handle a request.
If specified multiple times, each url is provided.
.TP
+.B require <conditions>
+Specify a set of conditions (separated by white space) to require.
+The directive may be specified globally and/or per-database.
+.B bind
+requires bind operation prior to directory operations.
+.B LDAPv3
+requires session to be using LDAP version 3.
+.B authc
+requires authentication prior to directory operations.
+.B SASL
+requires SASL authentication prior to directory operations.
+.B strong
+requires strong authentication prior to directory operations.
+Currently
+.B SASL
+and
+.B strong
+conditions are currently same.
+.B none
+may be used to require no conditions (useful for clearly globally
+set conditions within a particular database).
+.TP
+.B sasl-host <fqdn>
+Used to specify the fully qualified domain name used for SASL processing.
+.TP
.B sasl-realm <string>
Used to specify Cyrus SASL realm.
.TP
.B schemacheck { on | off }
Turn schema checking on or off. The default is on.
.TP
+.B security <factors>
+Specify a set of factors (separated by white space) to require.
+An integer value is associated with each factor and is roughly
+equivalent of the encryption key length to require. A value
+of 112 is equivalent to 3DES, 128 to Blowfish, etc..
+The directive may be specified globally and/or per-database.
+.B ssf=<n>
+specifies the overall security strength factor.
+.B transport=<n>
+specifies the transport security strength factor.
+.B tls=<n>
+specifies the TLS security strength factor.
+.B sasl=<n>
+specifies the SASL security strength factor.
+.B update_ssf=<n>
+specifies the overall security strength factor to require for
+directory updates.
+.B update_transport=<n>
+specifies the transport security strength factor to require for
+directory updates.
+.B update_tls=<n>
+specifies the TLS security strength factor to require for
+directory updates.
+.B update_sasl=<n>
+specifies the SASL security strength factor to require for
+directory updates.
+Note that the
+.B transport
+factor is measure of security provided by the underlying transport,
+e.g. ldapi:// (and eventually IPSEC). It is not normally used.
+.TP
.B sizelimit <integer>
Specify the maximum number of entries to return from a search operation.
The default size limit is 500.
}
}
+ if ( b->a_authz.sai_ssf ) {
+ Debug( LDAP_DEBUG_ACL, "<= check a_authz.sai_ssf: %ud\n",
+ b->a_authz.sai_ssf, 0, 0 );
+
+ if ( b->a_authz.sai_ssf > op->o_ssf ) {
+ continue;
+ }
+ }
+
+ if ( b->a_authz.sai_transport_ssf ) {
+ Debug( LDAP_DEBUG_ACL,
+ "<= check a_authz.sai_transport_ssf: %ud\n",
+ b->a_authz.sai_transport_ssf, 0, 0 );
+
+ if ( b->a_authz.sai_transport_ssf > op->o_transport_ssf ) {
+ continue;
+ }
+ }
+
+ if ( b->a_authz.sai_tls_ssf ) {
+ Debug( LDAP_DEBUG_ACL,
+ "<= check a_authz.sai_tls_ssf: %ud\n",
+ b->a_authz.sai_tls_ssf, 0, 0 );
+
+ if ( b->a_authz.sai_tls_ssf > op->o_tls_ssf ) {
+ continue;
+ }
+ }
+
+ if ( b->a_authz.sai_sasl_ssf ) {
+ Debug( LDAP_DEBUG_ACL,
+ "<= check a_authz.sai_sasl_ssf: %ud\n",
+ b->a_authz.sai_sasl_ssf, 0, 0 );
+
+ if ( b->a_authz.sai_sasl_ssf > op->o_sasl_ssf ) {
+ continue;
+ }
+ }
+
#ifdef SLAPD_ACI_ENABLED
if ( b->a_aci_at != NULL ) {
Attribute *at;
}
#endif /* SLAPD_ACI_ENABLED */
+ if ( strcasecmp( left, "ssf" ) == 0 ) {
+ if( b->a_authz.sai_ssf ) {
+ fprintf( stderr,
+ "%s: line %d: ssf attribute already specified.\n",
+ fname, lineno );
+ acl_usage();
+ }
+
+ if ( right == NULL || *right == '\0' ) {
+ fprintf( stderr,
+ "%s: line %d: no ssf is defined\n",
+ fname, lineno );
+ acl_usage();
+ }
+
+ b->a_authz.sai_ssf = atoi( right );
+
+ if( !b->a_authz.sai_ssf ) {
+ fprintf( stderr,
+ "%s: line %d: invalid ssf value (%s)\n",
+ fname, lineno, right );
+ acl_usage();
+ }
+ continue;
+ }
+
+ if ( strcasecmp( left, "transport_ssf" ) == 0 ) {
+ if( b->a_authz.sai_transport_ssf ) {
+ fprintf( stderr,
+ "%s: line %d: transport_ssf attribute already specified.\n",
+ fname, lineno );
+ acl_usage();
+ }
+
+ if ( right == NULL || *right == '\0' ) {
+ fprintf( stderr,
+ "%s: line %d: no transport_ssf is defined\n",
+ fname, lineno );
+ acl_usage();
+ }
+
+ b->a_authz.sai_transport_ssf = atoi( right );
+
+ if( !b->a_authz.sai_transport_ssf ) {
+ fprintf( stderr,
+ "%s: line %d: invalid transport_ssf value (%s)\n",
+ fname, lineno, right );
+ acl_usage();
+ }
+ continue;
+ }
+
+ if ( strcasecmp( left, "tls_ssf" ) == 0 ) {
+ if( b->a_authz.sai_tls_ssf ) {
+ fprintf( stderr,
+ "%s: line %d: tls_ssf attribute already specified.\n",
+ fname, lineno );
+ acl_usage();
+ }
+
+ if ( right == NULL || *right == '\0' ) {
+ fprintf( stderr,
+ "%s: line %d: no tls_ssf is defined\n",
+ fname, lineno );
+ acl_usage();
+ }
+
+ b->a_authz.sai_tls_ssf = atoi( right );
+
+ if( !b->a_authz.sai_tls_ssf ) {
+ fprintf( stderr,
+ "%s: line %d: invalid tls_ssf value (%s)\n",
+ fname, lineno, right );
+ acl_usage();
+ }
+ continue;
+ }
+
+ if ( strcasecmp( left, "sasl_ssf" ) == 0 ) {
+ if( b->a_authz.sai_sasl_ssf ) {
+ fprintf( stderr,
+ "%s: line %d: sasl_ssf attribute already specified.\n",
+ fname, lineno );
+ acl_usage();
+ }
+
+ if ( right == NULL || *right == '\0' ) {
+ fprintf( stderr,
+ "%s: line %d: no sasl_ssf is defined\n",
+ fname, lineno );
+ acl_usage();
+ }
+
+ b->a_authz.sai_sasl_ssf = atoi( right );
+
+ if( !b->a_authz.sai_sasl_ssf ) {
+ fprintf( stderr,
+ "%s: line %d: invalid sasl_ssf value (%s)\n",
+ fname, lineno, right );
+ acl_usage();
+ }
+ continue;
+ }
+
if( right != NULL ) {
/* unsplit */
right[-1] = '=';
#ifdef SLAPD_ACI_ENABLED
"\t[aci=<attrname>]\n"
#endif
+ "\t[ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>]\n"
"<access> ::= [self]{<level>|<priv>}\n"
"<level> ::= none | auth | compare | search | read | write\n"
"<priv> ::= {=|+|-}{w|r|s|c|x}+\n"
}
#endif
+ /* Security Strength Factors */
+ if ( b->a_authz.sai_ssf ) {
+ fprintf( stderr, " ssf=%ud",
+ b->a_authz.sai_ssf );
+ }
+ if ( b->a_authz.sai_transport_ssf ) {
+ fprintf( stderr, " transport_ssf=%ud",
+ b->a_authz.sai_transport_ssf );
+ }
+ if ( b->a_authz.sai_tls_ssf ) {
+ fprintf( stderr, " tls_ssf=%ud",
+ b->a_authz.sai_tls_ssf );
+ }
+ if ( b->a_authz.sai_sasl_ssf ) {
+ fprintf( stderr, " sasl_ssf=%ud",
+ b->a_authz.sai_sasl_ssf );
+ }
+
fprintf( stderr, " %s%s",
b->a_dn_self ? "self" : "",
accessmask2str( b->a_access_mask, maskbuf ) );
goto done;
}
- /* make sure this backend recongizes critical controls */
- rc = backend_check_controls( be, conn, op, &text ) ;
+ /* check restrictions */
+ rc = backend_check_restrictions( be, conn, op, NULL, &text ) ;
if( rc != LDAP_SUCCESS ) {
send_ldap_result( conn, op, rc,
NULL, text, NULL, NULL );
goto done;
}
- if ( global_readonly || be->be_readonly ) {
- Debug( LDAP_DEBUG_ANY, "do_add: database is read-only\n",
- 0, 0, 0 );
- send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
- NULL, "directory is read-only", NULL, NULL );
- goto done;
- }
-
/*
* do the add if 1 && (2 || 3)
* 1) there is an add function implemented in this backend;
#ifdef SLAPD_TCL
#include "back-tcl/external.h"
#endif
-#ifdef SLAPD_NTDOMAIN
-#include "back-domain/external.h"
-#endif
#ifdef SLAPD_SQL
#include "back-sql/external.h"
#endif
+#ifdef SLAPD_PRIVATE
+#include "private/external.h"
+#endif
static BackendInfo binfo[] = {
#if defined(SLAPD_DNSSRV) && !defined(SLAPD_DNSSRV_DYNAMIC)
#if defined(SLAPD_TCL) && !defined(SLAPD_TCL_DYNAMIC)
{"tcl", tcl_back_initialize},
#endif
-#if defined(SLAPD_NTDOMAIN) && !defined(SLAPD_NTDOMAIN_DYNAMIC)
- {"ntdom", domain_back_initialize},
-#endif
#if defined(SLAPD_SQL) && !defined(SLAPD_SQL_DYNAMIC)
{"sql", sql_back_initialize},
+#endif
+ /* for any private backend */
+#if defined(SLAPD_PRIVATE) && !defined(SLAPD_PRIVATE_DYNAMIC)
+ {"private", private_back_initialize},
#endif
{NULL}
};
be->be_timelimit = deftime;
be->be_dfltaccess = global_default_access;
+ be->be_restrictops = global_restrictops;
+ be->be_requires = global_requires;
+
/* assign a default depth limit for alias deref */
be->be_max_deref_depth = SLAPD_DEFAULT_MAXDEREFDEPTH;
- be->be_realm = global_realm != NULL
- ? ch_strdup( global_realm ) : NULL;
-
if(bi->bi_db_init) {
rc = bi->bi_db_init( be );
}
return 0;
}
-int
+static int
backend_check_controls(
Backend *be,
Connection *conn,
return LDAP_SUCCESS;
}
+int
+backend_check_restrictions(
+ Backend *be,
+ Connection *conn,
+ Operation *op,
+ const char *extoid,
+ const char **text )
+{
+ int rc;
+ slap_mask_t restrictops;
+ slap_mask_t requires;
+ slap_mask_t opflag;
+ slap_ssf_set_t *ssf;
+ int updateop = 0;
+
+ if( be ) {
+ rc = backend_check_controls( be, conn, op, text );
+
+ if( rc != LDAP_SUCCESS ) {
+ return rc;
+ }
+
+ restrictops = be->be_restrictops;
+ requires = be->be_requires;
+ ssf = &be->be_ssf_set;
+
+ } else {
+ restrictops = global_restrictops;
+ requires = global_requires;
+ ssf = &global_ssf_set;
+ }
+
+ switch( op->o_tag ) {
+ case LDAP_REQ_ADD:
+ opflag = SLAP_RESTRICT_OP_ADD;
+ updateop++;
+ break;
+ case LDAP_REQ_BIND:
+ opflag = SLAP_RESTRICT_OP_BIND;
+ break;
+ case LDAP_REQ_COMPARE:
+ opflag = SLAP_RESTRICT_OP_COMPARE;
+ break;
+ case LDAP_REQ_DELETE:
+ updateop++;
+ opflag = SLAP_RESTRICT_OP_DELETE;
+ break;
+ case LDAP_REQ_EXTENDED:
+ opflag = SLAP_RESTRICT_OP_EXTENDED;
+ break;
+ case LDAP_REQ_MODIFY:
+ updateop++;
+ opflag = SLAP_RESTRICT_OP_MODIFY;
+ break;
+ case LDAP_REQ_RENAME:
+ updateop++;
+ opflag = SLAP_RESTRICT_OP_RENAME;
+ break;
+ case LDAP_REQ_SEARCH:
+ opflag = SLAP_RESTRICT_OP_SEARCH;
+ break;
+ case LDAP_REQ_UNBIND:
+ opflag = 0;
+ break;
+ default:
+ *text = "restrict operations internal error";
+ return LDAP_OTHER;
+ }
+
+ if (( extoid == NULL || strcmp( extoid, LDAP_EXOP_START_TLS ) ) ) {
+ /* these checks don't apply to StartTLS */
+
+ if( op->o_tag == LDAP_REQ_EXTENDED ) {
+ /* threat other extended operations as update ops */
+ updateop++;
+ }
+
+ if( op->o_ssf < ssf->sss_ssf ) {
+ *text = "confidentiality required";
+ return LDAP_CONFIDENTIALITY_REQUIRED;
+ }
+ if( op->o_transport_ssf < ssf->sss_transport ) {
+ *text = "transport confidentiality required";
+ return LDAP_CONFIDENTIALITY_REQUIRED;
+ }
+ if( op->o_tls_ssf < ssf->sss_tls ) {
+ *text = "TLS confidentiality required";
+ return LDAP_CONFIDENTIALITY_REQUIRED;
+ }
+ if( op->o_sasl_ssf < ssf->sss_sasl ) {
+ *text = "SASL confidentiality required";
+ return LDAP_CONFIDENTIALITY_REQUIRED;
+ }
+
+ if( updateop ) {
+ if( op->o_ssf < ssf->sss_update_ssf ) {
+ *text = "update confidentiality required";
+ return LDAP_CONFIDENTIALITY_REQUIRED;
+ }
+ if( op->o_transport_ssf < ssf->sss_update_transport ) {
+ *text = "transport update confidentiality required";
+ return LDAP_CONFIDENTIALITY_REQUIRED;
+ }
+ if( op->o_tls_ssf < ssf->sss_update_tls ) {
+ *text = "TLS update confidentiality required";
+ return LDAP_CONFIDENTIALITY_REQUIRED;
+ }
+ if( op->o_sasl_ssf < ssf->sss_update_sasl ) {
+ *text = "SASL update confidentiality required";
+ return LDAP_CONFIDENTIALITY_REQUIRED;
+ }
+ }
+ }
+
+ if (( extoid == NULL || strcmp( extoid, LDAP_EXOP_START_TLS ) )
+ || op->o_tag == LDAP_REQ_BIND )
+ {
+ /* these checks don't apply to StartTLS or Bind */
+
+ if( requires & SLAP_REQUIRE_STRONG ) {
+ /* should check mechanism */
+ if( op->o_authmech == NULL ||
+ op->o_dn == NULL || *op->o_dn == '\0' )
+ {
+ *text = "strong authentication required";
+ return LDAP_STRONG_AUTH_REQUIRED;
+ }
+ }
+
+ if( requires & SLAP_REQUIRE_SASL ) {
+ if( op->o_authmech == NULL ||
+ op->o_dn == NULL || *op->o_dn == '\0' )
+ {
+ *text = "SASL authentication required";
+ return LDAP_STRONG_AUTH_REQUIRED;
+ }
+ }
+
+ if( requires & SLAP_REQUIRE_AUTHC ) {
+ if( op->o_dn == NULL || *op->o_dn == '\0' ) {
+ *text = "authentication required";
+ return LDAP_UNWILLING_TO_PERFORM;
+ }
+ }
+
+ if( requires & SLAP_REQUIRE_BIND ) {
+ int version;
+ ldap_pvt_thread_mutex_lock( &conn->c_mutex );
+ version = conn->c_protocol;
+ ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
+
+ if( !version ) {
+ /* no bind has occurred */
+ *text = "BIND required";
+ return LDAP_OPERATIONS_ERROR;
+ }
+ }
+
+ if( requires & SLAP_REQUIRE_LDAP_V3 ) {
+ if( op->o_protocol < LDAP_VERSION3 ) {
+ /* no bind has occurred */
+ *text = "operation restricted to LDAPv3 clients";
+ return LDAP_OPERATIONS_ERROR;
+ }
+ }
+ }
+
+ if( restrictops & opflag ) {
+ if( restrictops == SLAP_RESTRICT_OP_READS ) {
+ *text = "read operations restricted";
+ } else {
+ *text = "operation restricted";
+ }
+ return LDAP_UNWILLING_TO_PERFORM;
+ }
+
+ return LDAP_SUCCESS;
+}
+
int backend_check_referrals(
Backend *be,
Connection *conn,
* Force to connection to "anonymous" until bind succeeds.
*/
+ if ( conn->c_authmech != NULL ) {
+ free( conn->c_authmech );
+ conn->c_authmech = NULL;
+ }
+
if ( conn->c_cdn != NULL ) {
free( conn->c_cdn );
conn->c_cdn = NULL;
send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR,
NULL, "requested protocol version not supported", NULL, NULL );
goto cleanup;
+
+ } else if (( global_disallows & SLAP_DISALLOW_BIND_V2 ) &&
+ version < LDAP_VERSION3 )
+ {
+ send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR,
+ NULL, "requested protocol version not allowed", NULL, NULL );
+ goto cleanup;
}
/* we set connection version regardless of whether bind succeeds
conn->c_dn = edn;
conn->c_authmech = mech;
if( ssf ) conn->c_sasl_layers++;
+ conn->c_sasl_ssf = ssf;
+ if( ssf > conn->c_ssf ) {
+ conn->c_ssf = ssf;
+ }
ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
} else if ( rc == LDAP_SASL_BIND_IN_PROGRESS ) {
/* accept "anonymous" binds */
if ( cred.bv_len == 0 || ndn == NULL || *ndn == '\0' ) {
+ rc = LDAP_SUCCESS;
+ text = NULL;
+
+ if( cred.bv_len &&
+ ( global_disallows & SLAP_DISALLOW_BIND_ANON_CRED ))
+ {
+ /* cred is not empty, disallow */
+ rc = LDAP_INVALID_CREDENTIALS;
+
+ } else if ( ndn != NULL && *ndn != '\0' &&
+ ( global_disallows & SLAP_DISALLOW_BIND_ANON_DN ))
+ {
+ /* DN is not empty, disallow */
+ rc = LDAP_UNWILLING_TO_PERFORM;
+ text = "unwilling to allow anonymous bind with non-empty DN";
+
+ } else if ( global_disallows & SLAP_DISALLOW_BIND_ANON ) {
+ /* disallow */
+ rc = LDAP_UNWILLING_TO_PERFORM;
+ text = "anonymous bind disallowed";
+ }
+
/*
* we already forced connection to "anonymous",
* just need to send success
*/
- send_ldap_result( conn, op, LDAP_SUCCESS,
- NULL, NULL, NULL, NULL );
+ send_ldap_result( conn, op, rc,
+ NULL, text, NULL, NULL );
Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n",
version, 0, 0 );
goto cleanup;
goto cleanup;
}
- conn->c_authz_backend = be;
-
- /* make sure this backend recongizes critical controls */
- rc = backend_check_controls( be, conn, op, &text ) ;
-
+ /* check restrictions */
+ rc = backend_check_restrictions( be, conn, op, NULL, &text ) ;
if( rc != LDAP_SUCCESS ) {
send_ldap_result( conn, op, rc,
NULL, text, NULL, NULL );
goto cleanup;
}
+ conn->c_authz_backend = be;
+
if ( be->be_bind ) {
int ret;
/* alias suffix */
goto cleanup;
}
- /* make sure this backend recongizes critical controls */
- rc = backend_check_controls( be, conn, op, &text ) ;
+ /* check restrictions */
+ rc = backend_check_restrictions( be, conn, op, NULL, &text ) ;
if( rc != LDAP_SUCCESS ) {
send_ldap_result( conn, op, rc,
NULL, text, NULL, NULL );
#include "ldap_pvt.h"
#include "slap.h"
-#define MAXARGS 100
+#define MAXARGS 128
/*
* defaults for various global variables
int deftime = SLAPD_DEFAULT_TIMELIMIT;
AccessControl *global_acl = NULL;
slap_access_t global_default_access = ACL_READ;
-int global_readonly = 0;
+slap_mask_t global_restrictops = 0;
+slap_mask_t global_disallows = 0;
+slap_mask_t global_requires = 0;
+slap_ssf_set_t global_ssf_set;
char *replogfile;
int global_lastmod = ON;
int global_idletimeout = 0;
+char *global_host = NULL;
char *global_realm = NULL;
char *ldap_srvtab = "";
char *default_passwd_hash;
default_passwd_hash = ch_strdup( cargv[1] );
}
+ /* set SASL host */
+ } else if ( strcasecmp( cargv[0], "sasl-host" ) == 0 ) {
+ if ( cargc < 2 ) {
+ Debug( LDAP_DEBUG_ANY,
+ "%s: line %d: missing host in \"sasl-host <host>\" line\n",
+ fname, lineno, 0 );
+ return( 1 );
+ }
+
+ if ( global_host != NULL ) {
+ Debug( LDAP_DEBUG_ANY,
+ "%s: line %d: already set sasl-host!\n",
+ fname, lineno, 0 );
+ return 1;
+
+ } else {
+ global_host = ch_strdup( cargv[1] );
+ }
+
/* set SASL realm */
} else if ( strcasecmp( cargv[0], "sasl-realm" ) == 0 ) {
if ( cargc < 2 ) {
fname, lineno, 0 );
return( 1 );
}
- if ( be != NULL ) {
- be->be_realm = ch_strdup( cargv[1] );
- } else if ( global_realm != NULL ) {
+ if ( global_realm != NULL ) {
Debug( LDAP_DEBUG_ANY,
- "%s: line %d: already set global realm!\n",
+ "%s: line %d: already set sasl-realm!\n",
fname, lineno, 0 );
return 1;
return( 1 );
}
if ( be == NULL ) {
- global_readonly = (strcasecmp( cargv[1], "on" ) == 0);
+ if ( strcasecmp( cargv[1], "on" ) == 0 ) {
+ global_restrictops |= SLAP_RESTRICT_OP_WRITES;
+ } else {
+ global_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
+ }
} else {
if ( strcasecmp( cargv[1], "on" ) == 0 ) {
- be->be_readonly = 1;
+ be->be_restrictops |= SLAP_RESTRICT_OP_WRITES;
} else {
- be->be_readonly = 0;
+ be->be_restrictops &= ~SLAP_RESTRICT_OP_WRITES;
}
}
+
+ /* disallow these features */
+ } else if ( strcasecmp( cargv[0], "disallows" ) == 0 ||
+ strcasecmp( cargv[0], "disallow" ) == 0 )
+ {
+ slap_mask_t disallows;
+
+ if ( be != NULL ) {
+ Debug( LDAP_DEBUG_ANY,
+"%s: line %d: disallow line must appear prior to database definitions\n",
+ fname, lineno, 0 );
+ }
+
+ if ( cargc < 2 ) {
+ Debug( LDAP_DEBUG_ANY,
+ "%s: line %d: missing feature(s) in \"disallows <features>\" line\n",
+ fname, lineno, 0 );
+ return( 1 );
+ }
+
+ disallows = 0;
+
+ for( i=1; i < cargc; i++ ) {
+ if( strcasecmp( cargv[i], "bind_v2" ) == 0 ) {
+ disallows |= SLAP_DISALLOW_BIND_V2;
+
+ } else if( strcasecmp( cargv[i], "bind_anon_cred" ) == 0 ) {
+ disallows |= SLAP_DISALLOW_BIND_ANON_CRED;
+
+ } else if( strcasecmp( cargv[i], "bind_anon_dn" ) == 0 ) {
+ disallows |= SLAP_DISALLOW_BIND_ANON_DN;
+
+ } else if( strcasecmp( cargv[i], "none" ) != 0 ) {
+ Debug( LDAP_DEBUG_ANY,
+ "%s: line %d: unknown feature %s in \"disallow <features>\" line\n",
+ fname, lineno, cargv[i] );
+ return( 1 );
+ }
+ }
+
+ global_disallows = disallows;
+
+ /* require these features */
+ } else if ( strcasecmp( cargv[0], "requires" ) == 0 ||
+ strcasecmp( cargv[0], "require" ) == 0 )
+ {
+ slap_mask_t requires;
+
+ if ( cargc < 2 ) {
+ Debug( LDAP_DEBUG_ANY,
+ "%s: line %d: missing feature(s) in \"require <features>\" line\n",
+ fname, lineno, 0 );
+ return( 1 );
+ }
+
+ requires = 0;
+
+ for( i=1; i < cargc; i++ ) {
+ if( strcasecmp( cargv[i], "bind" ) == 0 ) {
+ requires |= SLAP_REQUIRE_BIND;
+
+ } else if( strcasecmp( cargv[i], "LDAPv3" ) == 0 ) {
+ requires |= SLAP_REQUIRE_LDAP_V3;
+
+ } else if( strcasecmp( cargv[i], "authc" ) == 0 ) {
+ requires |= SLAP_REQUIRE_AUTHC;
+
+ } else if( strcasecmp( cargv[i], "SASL" ) == 0 ) {
+ requires |= SLAP_REQUIRE_SASL;
+
+ } else if( strcasecmp( cargv[i], "strong" ) == 0 ) {
+ requires |= SLAP_REQUIRE_STRONG;
+
+ } else if( strcasecmp( cargv[i], "none" ) != 0 ) {
+ Debug( LDAP_DEBUG_ANY,
+ "%s: line %d: unknown feature %s in \"require <features>\" line\n",
+ fname, lineno, cargv[i] );
+ return( 1 );
+ }
+ }
+
+ if ( be == NULL ) {
+ global_requires = requires;
+ } else {
+ be->be_requires = requires;
+ }
+
+ /* required security factors */
+ } else if ( strcasecmp( cargv[0], "security" ) == 0 ) {
+ slap_ssf_set_t *set;
+
+ if ( cargc < 2 ) {
+ Debug( LDAP_DEBUG_ANY,
+ "%s: line %d: missing factor(s) in \"security <factors>\" line\n",
+ fname, lineno, 0 );
+ return( 1 );
+ }
+
+ if ( be == NULL ) {
+ set = &global_ssf_set;
+ } else {
+ set = &be->be_ssf_set;
+ }
+
+ for( i=1; i < cargc; i++ ) {
+ if( strncasecmp( cargv[i], "ssf=",
+ sizeof("ssf") ) == 0 )
+ {
+ set->sss_ssf =
+ atoi( &cargv[i][sizeof("ssf")] );
+
+ } else if( strncasecmp( cargv[i], "transport=",
+ sizeof("transport") ) == 0 )
+ {
+ set->sss_transport =
+ atoi( &cargv[i][sizeof("transport")] );
+
+ } else if( strncasecmp( cargv[i], "tls=",
+ sizeof("tls") ) == 0 )
+ {
+ set->sss_tls =
+ atoi( &cargv[i][sizeof("tls")] );
+
+ } else if( strncasecmp( cargv[i], "sasl=",
+ sizeof("sasl") ) == 0 )
+ {
+ set->sss_sasl =
+ atoi( &cargv[i][sizeof("sasl")] );
+
+ } else if( strncasecmp( cargv[i], "update_ssf=",
+ sizeof("update_ssf") ) == 0 )
+ {
+ set->sss_update_ssf =
+ atoi( &cargv[i][sizeof("update_ssf")] );
+
+ } else if( strncasecmp( cargv[i], "update_transport=",
+ sizeof("update_transport") ) == 0 )
+ {
+ set->sss_update_transport =
+ atoi( &cargv[i][sizeof("update_transport")] );
+
+ } else if( strncasecmp( cargv[i], "update_tls=",
+ sizeof("update_tls") ) == 0 )
+ {
+ set->sss_update_tls =
+ atoi( &cargv[i][sizeof("update_tls")] );
+
+ } else if( strncasecmp( cargv[i], "update_sasl=",
+ sizeof("update_sasl") ) == 0 )
+ {
+ set->sss_update_sasl =
+ atoi( &cargv[i][sizeof("update_sasl")] );
+
+ } else {
+ Debug( LDAP_DEBUG_ANY,
+ "%s: line %d: unknown factor %s in \"security <factors>\" line\n",
+ fname, lineno, cargv[i] );
+ return( 1 );
+ }
+ }
+
+
/* where to send clients when we don't hold it */
} else if ( strcasecmp( cargv[0], "referral" ) == 0 ) {
if ( cargc < 2 ) {
fname, lineno, 0 );
return( 1 );
}
- ldap_syslog = atoi( cargv[1] );
+
+ ldap_syslog = 0;
+
+ for( i=1; i < cargc; i++ ) {
+ ldap_syslog += atoi( cargv[1] );
+ }
/* list of replicas of the data in this backend (master only) */
} else if ( strcasecmp( cargv[0], "replica" ) == 0 ) {
c->c_n_read = 0;
c->c_n_write = 0;
- /* assume LDAPv3 until bind */
- c->c_protocol = LDAP_VERSION3;
+ /* set to zero until bind, implies LDAP_VERSION3 */
+ c->c_protocol = 0;
c->c_activitytime = c->c_starttime = slap_get_time();
c->c_conn_state = SLAP_C_INACTIVE;
c->c_struct_state = SLAP_C_USED;
+ c->c_ssf = c->c_transport_ssf = ssf;
+ c->c_tls_ssf = 0;
+
#ifdef HAVE_TLS
if ( use_tls ) {
c->c_is_tls = 1;
c->c_needs_tls_accept = 0;
}
#endif
+
slap_sasl_open( c );
slap_sasl_external( c, ssf, authid );
/* connections_mutex and c_mutex are locked */
connection_closing( c );
+#if 0
/* Drain input before close, to allow SSL error codes
* to propagate to client. */
FD_ZERO(&rfd);
ber_sockbuf_ctrl( c->c_sb, LBER_SB_OPT_DRAIN,
NULL);
}
+#endif
connection_close( c );
} else if ( rc == 0 ) {
void *ssl;
- slap_ssf_t ssf;
char *authid;
c->c_needs_tls_accept = 0;
/* we need to let SASL know */
ssl = (void *)ldap_pvt_tls_sb_handle( c->c_sb );
- ssf = (slap_ssf_t) ldap_pvt_tls_get_strength( ssl );
+
+ c->c_tls_ssf = (slap_ssf_t) ldap_pvt_tls_get_strength( ssl );
+ if( c->c_tls_ssf > c->c_ssf ) {
+ c->c_ssf = c->c_tls_ssf;
+ }
+
authid = (char *)ldap_pvt_tls_get_peer( ssl );
- slap_sasl_external( c, ssf, authid );
+ slap_sasl_external( c, c->c_tls_ssf, authid );
}
connection_return( c );
ldap_pvt_thread_mutex_unlock( &connections_mutex );
arg->co_op->o_ndn = ch_strdup( arg->co_op->o_dn );
(void) dn_normalize( arg->co_op->o_ndn );
- arg->co_op->o_protocol = conn->c_protocol;
+ arg->co_op->o_protocol = conn->c_protocol
+ ? conn->c_protocol : LDAP_VERSION3;
arg->co_op->o_connid = conn->c_connid;
arg->co_op->o_authtype = conn->c_authtype;
goto cleanup;
}
- /* make sure this backend recongizes critical controls */
- rc = backend_check_controls( be, conn, op, &text ) ;
+ /* check restrictions */
+ rc = backend_check_restrictions( be, conn, op, NULL, &text ) ;
if( rc != LDAP_SUCCESS ) {
send_ldap_result( conn, op, rc,
NULL, text, NULL, NULL );
goto cleanup;
}
- if ( global_readonly || be->be_readonly ) {
- Debug( LDAP_DEBUG_ANY, "do_delete: database is read-only\n",
- 0, 0, 0 );
- send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
- NULL, "directory is read-only", NULL, NULL );
- goto cleanup;
- }
-
/* deref suffix alias if appropriate */
ndn = suffix_alias( be, ndn );
out->bv_val = (char *) ch_malloc( ( in->bv_len * 3 ) + 1 );
out->bv_len = 0;
-#undef NIBBLE
-#undef ESCAPE_LO
-#undef ESCAPE_HI
-#define NIBBLE(c) ((c)&0x0f)
-#define ESCAPE_LO(c) ( NIBBLE(c) + ( NIBBLE(c) < 10 ? '0' : 'A' - 10 ) )
-#define ESCAPE_HI(c) ( ESCAPE_LO((c)>>4) )
-
for( i=0; i < in->bv_len ; i++ ) {
if( FILTER_ESCAPE(in->bv_val[i]) ) {
- out->bv_val[out->bv_len++] = '\\';
- out->bv_val[out->bv_len++] = ESCAPE_HI( in->bv_val[i] );
- out->bv_val[out->bv_len++] = ESCAPE_LO( in->bv_val[i] );
+ out->bv_val[out->bv_len++] = SLAP_ESCAPE_CHAR;
+ out->bv_val[out->bv_len++] = SLAP_ESCAPE_HI( in->bv_val[i] );
+ out->bv_val[out->bv_len++] = SLAP_ESCAPE_LO( in->bv_val[i] );
} else {
out->bv_val[out->bv_len++] = in->bv_val[i];
}
out->bv_val[out->bv_len] = '\0';
return LDAP_SUCCESS;
}
-
-
goto cleanup;
}
- /* make sure this backend recongizes critical controls */
- rc = backend_check_controls( be, conn, op, &text ) ;
+ /* check restrictions */
+ rc = backend_check_restrictions( be, conn, op, NULL, &text ) ;
if( rc != LDAP_SUCCESS ) {
send_ldap_result( conn, op, rc,
NULL, text, NULL, NULL );
goto cleanup;
}
- if ( global_readonly || be->be_readonly ) {
- Debug( LDAP_DEBUG_ANY, "do_modify: database is read-only\n",
- 0, 0, 0 );
- send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
- NULL, "directory is read-only", NULL, NULL );
- goto cleanup;
- }
-
/* deref suffix alias if appropriate */
ndn = suffix_alias( be, ndn );
goto cleanup;
}
- /* make sure this backend recongizes critical controls */
- rc = backend_check_controls( be, conn, op, &text ) ;
+ /* check restrictions */
+ rc = backend_check_restrictions( be, conn, op, NULL, &text ) ;
if( rc != LDAP_SUCCESS ) {
send_ldap_result( conn, op, rc,
NULL, text, NULL, NULL );
goto cleanup;
}
- if ( global_readonly || be->be_readonly ) {
- Debug( LDAP_DEBUG_ANY, "do_modrdn: database is read-only\n",
- 0, 0, 0 );
- send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
- NULL, "database is read-only", NULL, NULL );
- goto cleanup;
- }
-
/* Make sure that the entry being changed and the newSuperior are in
* the same backend, otherwise we return an error.
*/
return LDAP_STRONG_AUTH_REQUIRED;
}
- if( conn->c_authz_backend != NULL && conn->c_authz_backend->be_extended )
- {
- if( global_readonly || conn->c_authz_backend->be_readonly ) {
+ if( conn->c_authz_backend != NULL && conn->c_authz_backend->be_extended ) {
+ if( conn->c_authz_backend->be_restrictops & SLAP_RESTRICT_OP_MODIFY ) {
*text = "authorization database is read only";
rc = LDAP_UNWILLING_TO_PERFORM;
LDAP_SLAPD_F (int) backend_unbind LDAP_P((Connection *conn, Operation *op));
-LDAP_SLAPD_F( int ) backend_check_controls LDAP_P((
+LDAP_SLAPD_F( int ) backend_check_restrictions LDAP_P((
Backend *be,
Connection *conn,
Operation *op,
+ const char *extoid,
const char **text ));
LDAP_SLAPD_F( int ) backend_check_referrals LDAP_P((
* Other...
*/
+LDAP_SLAPD_F (slap_mask_t) global_restrictops;
+LDAP_SLAPD_F (slap_mask_t) global_disallows;
+LDAP_SLAPD_F (slap_mask_t) global_requires;
+LDAP_SLAPD_F (slap_ssf_set_t) global_ssf_set;
+
LDAP_SLAPD_F (struct berval **) default_referral;
LDAP_SLAPD_F (char *) replogfile;
LDAP_SLAPD_F (const char) Versionstr[];
LDAP_SLAPD_F (int) deftime;
LDAP_SLAPD_F (int) g_argc;
LDAP_SLAPD_F (slap_access_t) global_default_access;
-LDAP_SLAPD_F (int) global_readonly;
LDAP_SLAPD_F (int) global_lastmod;
LDAP_SLAPD_F (int) global_idletimeout;
LDAP_SLAPD_F (int) global_schemacheck;
+LDAP_SLAPD_F (char) *global_host;
LDAP_SLAPD_F (char) *global_realm;
LDAP_SLAPD_F (char) *default_passwd_hash;
LDAP_SLAPD_F (int) lber_debug;
#include <lutil.h>
#endif
-static char *sasl_host = NULL;
static sasl_security_properties_t sasl_secprops;
return -1;
}
- if( sasl_host == NULL ) {
- sasl_host = ldap_pvt_get_fqdn( NULL );
- }
-
- Debug( LDAP_DEBUG_TRACE,
- "slap_sasl_init: %s initialized!\n",
- sasl_host, 0, 0 );
+ Debug( LDAP_DEBUG_TRACE, "slap_sasl_init: initialized!\n",
+ 0, 0, 0 );
/* default security properties */
memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
session_callbacks[2].proc = NULL;
session_callbacks[2].context = NULL;
+ if( global_host == NULL ) {
+ global_host = ldap_pvt_get_fqdn( NULL );
+ }
+
/* create new SASL context */
- sc = sasl_server_new( "ldap", sasl_host, global_realm,
+ sc = sasl_server_new( "ldap", global_host, global_realm,
session_callbacks, SASL_SECURITY_LAYER, &ctx );
if( sc != SASL_OK ) {
struct mrule_defs_rec {
char * mrd_desc;
- unsigned mrd_usage;
+ slap_mask_t mrd_usage;
slap_mr_convert_func * mrd_convert;
slap_mr_normalize_func * mrd_normalize;
slap_mr_match_func * mrd_match;
static int
objectClassMatch(
int *matchp,
- unsigned flags,
+ slap_mask_t flags,
Syntax *syntax,
MatchingRule *mr,
struct berval *value,
static int
structuralObjectClassMatch(
int *matchp,
- unsigned flags,
+ slap_mask_t flags,
Syntax *syntax,
MatchingRule *mr,
struct berval *value,
goto return_results;
}
- /* make sure this backend recongizes critical controls */
- rc = backend_check_controls( be, conn, op, &text ) ;
+ /* check restrictions */
+ rc = backend_check_restrictions( be, conn, op, NULL, &text ) ;
if( rc != LDAP_SUCCESS ) {
send_ldap_result( conn, op, rc,
NULL, text, NULL, NULL );
#define ASCII_ALPHA(c) ( ASCII_LOWER(c) || ASCII_UPPER(c) )
#define ASCII_DIGIT(c) ( (c) >= '0' && (c) <= '9' )
#define ASCII_ALNUM(c) ( ASCII_ALPHA(c) || ASCII_DIGIT(c) )
-
#define ASCII_PRINTABLE(c) ( (c) >= ' ' && (c) <= '~' )
-#define FILTER_ESCAPE(c) ( (c) == '\\' || (c) == '(' || (c) == ')' || !ASCII_PRINTABLE(c) )
+
+#define SLAP_NIBBLE(c) ((c)&0x0f)
+#define SLAP_ESCAPE_CHAR ('\\')
+#define SLAP_ESCAPE_LO(c) ( "0123456789ABCDEF"[SLAP_NIBBLE(c)] )
+#define SLAP_ESCAPE_HI(c) ( SLAP_ESCAPE_LO((c)>>4) )
+
+#define FILTER_ESCAPE(c) ( (c) == '*' || (c) == '\\' \
+ || (c) == '(' || (c) == ')' || !ASCII_PRINTABLE(c) )
#define DN_SEPARATOR(c) ((c) == ',' || (c) == ';')
#define RDN_SEPARATOR(c) ((c) == ',' || (c) == ';' || (c) == '+')
LDAP_SLAPD_F (int) slap_debug;
-typedef unsigned slap_ssf_t;
typedef unsigned long slap_mask_t;
+/* Security Strength Factor */
+typedef unsigned slap_ssf_t;
+
+typedef struct slap_ssf_set {
+ slap_ssf_t sss_ssf;
+ slap_ssf_t sss_transport;
+ slap_ssf_t sss_tls;
+ slap_ssf_t sss_sasl;
+ slap_ssf_t sss_update_ssf;
+ slap_ssf_t sss_update_transport;
+ slap_ssf_t sss_update_tls;
+ slap_ssf_t sss_update_sasl;
+} slap_ssf_set_t;
/*
* Index types
ACL_STYLE_EXACT = ACL_STYLE_BASE
} slap_style_t;
+typedef struct slap_authz_info {
+ ber_tag_t sai_method; /* LDAP_AUTH_* from <ldap.h> */
+ char * sai_mech; /* SASL Mechanism */
+ char * sai_dn; /* DN for reporting purposes */
+ char * sai_ndn; /* Normalized DN */
+
+ /* Security Strength Factors */
+ slap_ssf_t sai_ssf; /* Overall SSF */
+ slap_ssf_t sai_transport_ssf; /* Transport SSF */
+ slap_ssf_t sai_tls_ssf; /* TLS SSF */
+ slap_ssf_t sai_sasl_ssf; /* SASL SSF */
+} AuthorizationInformation;
/* the "by" part */
typedef struct slap_access {
slap_mask_t a_access_mask;
+ AuthorizationInformation a_authz;
+#define a_dn_pat a_authz.sai_dn
+
slap_style_t a_dn_style;
- char *a_dn_pat;
AttributeDescription *a_dn_at;
int a_dn_self;
#define be_sync bd_info->bi_tool_sync
#endif
+ slap_mask_t be_restrictops; /* restriction operations */
+#define SLAP_RESTRICT_OP_ADD 0x0001U
+#define SLAP_RESTRICT_OP_BIND 0x0002U
+#define SLAP_RESTRICT_OP_COMPARE 0x0004U
+#define SLAP_RESTRICT_OP_DELETE 0x0008U
+#define SLAP_RESTRICT_OP_EXTENDED 0x0010U
+#define SLAP_RESTRICT_OP_MODIFY 0x0020U
+#define SLAP_RESTRICT_OP_RENAME 0x0040U
+#define SLAP_RESTRICT_OP_SEARCH 0x0080U
+
+#define SLAP_RESTRICT_OP_READS \
+ ( SLAP_RESTRICT_OP_COMPARE \
+ | SLAP_RESTRICT_OP_SEARCH )
+#define SLAP_RESTRICT_OP_WRITES \
+ ( SLAP_RESTRICT_OP_ADD \
+ | SLAP_RESTRICT_OP_DELETE \
+ | SLAP_RESTRICT_OP_MODIFY \
+ | SLAP_RESTRICT_OP_RENAME )
+
+#define SLAP_DISALLOW_BIND_V2 0x0001U /* LDAPv2 bind */
+#define SLAP_DISALLOW_BIND_ANON 0x0002U /* no anonymous */
+#define SLAP_DISALLOW_BIND_ANON_CRED \
+ 0x0004U /* cred should be empty */
+#define SLAP_DISALLOW_BIND_ANON_DN \
+ 0x0008U /* dn should be empty */
+
+ slap_mask_t be_requires; /* pre-operation requirements */
+#define SLAP_REQUIRE_BIND 0x0001U /* bind before op */
+#define SLAP_REQUIRE_LDAP_V3 0x0002U /* LDAPv3 before op */
+#define SLAP_REQUIRE_AUTHC 0x0004U /* authentication before op */
+#define SLAP_REQUIRE_SASL 0x0008U /* SASL before op */
+#define SLAP_REQUIRE_STRONG 0x0010U /* strong authentication before op */
+
+
+ /* Required Security Strength Factor */
+ slap_ssf_set_t be_ssf_set;
+
/* these should be renamed from be_ to bd_ */
char **be_suffix; /* the DN suffixes of data in this backend */
char **be_nsuffix; /* the normalized DN suffixes in this backend */
char *be_root_dn; /* the magic "root" dn for this db */
char *be_root_ndn; /* the magic "root" normalized dn for this db */
struct berval be_root_pw; /* the magic "root" password for this db */
- int be_readonly; /* 1 => db is in "read only" mode */
unsigned int be_max_deref_depth; /* limit for depth of an alias deref */
int be_sizelimit; /* size limit for this backend */
int be_timelimit; /* time limit for this backend */
void *bi_private; /* anything the backend type needs */
};
-typedef struct slap_authz_info {
- unsigned sai_ssf; /* Security Strength Factor */
- ber_tag_t sai_method; /* LDAP_AUTH_* from <ldap.h> */
- char * sai_mech; /* SASL Mechanism */
- char * sai_dn; /* DN for reporting purposes */
- char * sai_ndn; /* Normalized DN */
-} AuthorizationInformation;
-
#define c_authtype c_authz.sai_method
#define c_authmech c_authz.sai_mech
#define c_dn c_authz.sai_dn
+#define c_ssf c_authz.sai_ssf
+#define c_transport_ssf c_authz.sai_transport_ssf
+#define c_tls_ssf c_authz.sai_tls_ssf
+#define c_sasl_ssf c_authz.sai_sasl_ssf
#define o_authtype o_authz.sai_method
#define o_authmech o_authz.sai_mech
#define o_dn o_authz.sai_dn
#define o_ndn o_authz.sai_ndn
+#define o_ssf o_authz.sai_ssf
+#define o_transport_ssf o_authz.sai_transport_ssf
+#define o_tls_ssf o_authz.sai_tls_ssf
+#define o_sasl_ssf o_authz.sai_sasl_ssf
/*
* represents an operation pending from an ldap client
goto done;
}
+ /* can't start TLS if there are other op's around */
+ if (( conn->c_ops != NULL &&
+ (conn->c_ops != op || op->o_next != NULL)) ||
+ ( conn->c_pending_ops != NULL))
+ {
+ *text = "cannot start TLS when operations our outstanding";
+ rc = LDAP_OPERATIONS_ERROR;
+ goto done;
+ }
+
/* fail if TLS could not be initialized */
if (ldap_pvt_tls_get_option(NULL, LDAP_OPT_X_TLS_CERT, &ctx) != 0
|| ctx == NULL)
goto done;
}
- /* can't start TLS if there are other op's around */
- if (( conn->c_ops != NULL &&
- (conn->c_ops != op || op->o_next != NULL)) ||
- ( conn->c_pending_ops != NULL))
- {
- *text = "cannot start TLS when operations our outstanding";
- rc = LDAP_OPERATIONS_ERROR;
- goto done;
- }
-
conn->c_is_tls = 1;
conn->c_needs_tls_accept = 1;
projects / openldap / commitdiff