From 2231d5e64eb0647f1eea6f0fbb2c8dd7440c748d Mon Sep 17 00:00:00 2001 From: Mark Adamson Date: Thu, 30 Nov 2000 22:00:15 +0000 Subject: [PATCH] Make SASL authorization work for NULL, "u:", and "dn:" authz strings. --- servers/slapd/proto-slap.h | 6 +- servers/slapd/sasl.c | 275 ++++++++++++++++++++----------------- servers/slapd/saslauthz.c | 80 +++++------ servers/slapd/slap.h | 5 + 4 files changed, 190 insertions(+), 176 deletions(-) diff --git a/servers/slapd/proto-slap.h b/servers/slapd/proto-slap.h index 9c48bf6889..110b27fcf2 100644 --- a/servers/slapd/proto-slap.h +++ b/servers/slapd/proto-slap.h @@ -572,10 +572,10 @@ LDAP_SLAPD_F (int) slap_sasl_bind LDAP_P(( /* * saslauthz.c */ +LDAP_SLAPD_F (char *) slap_sasl2dn LDAP_P(( char *saslname )); LDAP_SLAPD_F (int) slap_sasl_authorized LDAP_P(( - Connection *conn, - const char *authcid, - const char *authzid )); + char *authcid, + char *authzid )); LDAP_SLAPD_F (int) slap_sasl_regexp_config LDAP_P(( const char *match, const char *replace )); diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c index b6fe4624bd..aa06f29b5d 100644 --- a/servers/slapd/sasl.c +++ b/servers/slapd/sasl.c @@ -66,6 +66,116 @@ slap_sasl_log( return SASL_OK; } + +/* Take any sort of identity string and return a DN with the "dn:" prefix. The + string returned in *dnptr is in its own allocated memory, and must be free'd + by the calling process. + -Mark Adamson, Carnegie Mellon +*/ + +int slap_sasl_getdn( Connection *conn, char *id, char **dnptr, int flags ) +{ + char *c, *c1, *dn=NULL; + int rc, len, len1; + sasl_conn_t *ctx; + + + Debug( LDAP_DEBUG_ARGS, "slap_sasl_getdn: id=%s\n", + id?(*id?id:""):"NULL",0,0 ); + + /* Blatantly anonymous ID */ + len = strlen( "anonymous" ); + if( id && !strncasecmp( id, "anonymous", len) && + ( id[len] == '\0' || id[len] == '@' ) ) { + *dnptr = NULL; + return( LDAP_SUCCESS ); + } + ctx = conn->c_sasl_context; + dn = ch_strdup( id ); + len = strlen( id ); + + /* An authcID will need to be prefixed with u: */ + if( flags & FLAG_GETDN_AUTHCID ) { + dn = ch_realloc( dn, len+3 ); + memmove( dn+2, dn, len+1 ); + dn[0] = 'u'; + dn[1] = ':'; + len += 2; + } + + /* An authzID must be properly prefixed */ + if( flags & FLAG_GETDN_AUTHZID && strncasecmp( dn, "u:", 2 ) && + strncasecmp( dn, "dn:", 3 ) ) { + ch_free( dn ); + *dnptr = NULL; + return( LDAP_INAPPROPRIATE_AUTH ); + } + + /* Username strings */ + len1 = strlen( ",cn=authzid" ); + if( !strncasecmp( dn, "u:", 2 ) ) { + len += strlen( "dn:uid=" ) + len1; + + /* Figure out how much data we have for the dn */ + rc = sasl_getprop( ctx, SASL_REALM, (void **)&c ); + if( rc != SASL_OK ) { + Debug(LDAP_DEBUG_TRACE, + "getdn: getprop(REALM) failed!\n", 0,0,0); + ch_free( dn ); + *dnptr = NULL; + return( LDAP_OPERATIONS_ERROR ); + } + if( c ) { + len += strlen( c ) + strlen(",cn=" ); + } + if( conn->c_sasl_bind_mech ) { + len += strlen( conn->c_sasl_bind_mech ) + strlen( ",cn=mech" ); + } + + /* Build the new dn */ + c1 = dn; + dn = ch_malloc( len ); + len = sprintf( dn, "dn:uid=%s", c1+2 ); + ch_free( c1 ); + + if( c ) { + len += sprintf( dn+len, ",cn=%s", c ); + } + if( conn->c_sasl_bind_mech ) { + len += sprintf( dn+len, ",cn=%s", conn->c_sasl_bind_mech ); + } + strcpy( dn+len, ",cn=authzid" ); + len += len1; + Debug( LDAP_DEBUG_TRACE, "getdn: u:id converted to %s\n", dn,0,0 ); + } + + /* DN strings that are a cn=authzid identity to run through regexp */ + if( !strncasecmp( dn, "dn:", 3) && ( ( flags & FLAG_GETDN_FINAL ) == 0 ) ) { + c1 = slap_sasl2dn( dn + 3 ); + if( c1 ) { + ch_free( dn ); + dn = c1; + /* Reaffix the dn: prefix if it was removed */ + if( strncasecmp( dn, "dn:", 3) ) { + c1 = dn; + dn = ch_malloc( strlen( c1 ) + 4 ); + sprintf( dn, "dn:%s", c1 ); + ch_free( c1 ); + } + Debug( LDAP_DEBUG_TRACE, "getdn: dn:id converted to %s\n", dn,0,0 ); + } + } + + if( ( flags & FLAG_GETDN_FINAL ) == 0 ) { + dn_normalize( dn ); + } + + *dnptr = dn; + return( LDAP_SUCCESS ); +} + + + static int slap_sasl_authorize( void *context, @@ -74,61 +184,47 @@ slap_sasl_authorize( const char **user, const char **errstr) { - char *cuser; + char *authcDN, *authzDN; int rc; Connection *conn = context; *user = NULL; - if ( authcid == NULL || *authcid == '\0' ) { - *errstr = "empty authentication identity"; - - Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: " - "empty authentication identity\n", - (long) (conn ? conn->c_connid : -1), - 0, 0 ); - return SASL_BADAUTH; - } - Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: " "authcid=\"%s\" authzid=\"%s\"\n", (long) (conn ? conn->c_connid : -1), authcid ? authcid : "", authzid ? authzid : "" ); - if ( authzid == NULL || *authzid == '\0' || - ( authzid[0] == 'u' && authzid[1] == ':' && - strcmp( authcid, &authzid[2] ) == 0 ) || - strcmp( authcid, authzid ) == 0 ) - { - /* authzid is: - * empty - * u:authcid - * authcid - */ - - size_t len = sizeof("u:") + strlen( authcid ); - - cuser = ch_malloc( len ); - strcpy( cuser, "u:" ); - strcpy( &cuser[sizeof("u:")-1], authcid ); - - *user = cuser; - + /* Convert the identities to DN's. If no authzid was given, client will + be bound as the DN matching their username */ + rc = slap_sasl_getdn( conn, (char *)authcid, &authcDN, FLAG_GETDN_AUTHCID ); + if( rc != LDAP_SUCCESS ) { + *errstr = ldap_err2string( rc ); + return SASL_NOAUTHZ; + } + if( ( authzid == NULL ) || !strcmp( authcid,authzid ) ) { Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: " - "\"%s\" as \"%s\"\n", - (long) (conn ? conn->c_connid : -1), - authcid, cuser ); - + "Using authcDN=%s\n", (long) (conn ? conn->c_connid : -1), authcDN,0 ); + *user = authcDN; + *errstr = NULL; return SASL_OK; } + rc = slap_sasl_getdn( conn, (char *)authzid, &authzDN, FLAG_GETDN_AUTHZID ); + if( rc != LDAP_SUCCESS ) { + ch_free( authcDN ); + *errstr = ldap_err2string( rc ); + return SASL_NOAUTHZ; + } - rc = slap_sasl_authorized( conn, authcid, authzid ); + rc = slap_sasl_authorized( authcDN, authzDN ); if( rc ) { Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: " " authorization disallowed (%d)\n", (long) (conn ? conn->c_connid : -1), rc, 0 ); *errstr = "not authorized"; + ch_free( authcDN ); + ch_free( authzDN ); return SASL_NOAUTHZ; } @@ -136,10 +232,9 @@ slap_sasl_authorize( " authorization allowed\n", (long) (conn ? conn->c_connid : -1), 0, 0 ); - cuser = ch_strdup( authzid ); - dn_normalize( cuser ); + ch_free( authcDN ); + *user = authzDN; *errstr = NULL; - *user = cuser; return SASL_OK; } @@ -442,100 +537,13 @@ int slap_sasl_bind( send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ), NULL, "no SASL username", NULL, NULL ); - } else if ( username == NULL || *username == '\0' ) { - Debug(LDAP_DEBUG_TRACE, - "slap_sasl_bind: getprop(USERNAME) returned NULL!\n", - 0, 0, 0); - - send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS, - NULL, "no SASL username", NULL, NULL ); - } else { - char *realm = NULL; - sasl_ssf_t *ssf = NULL; - - (void) sasl_getprop( ctx, - SASL_REALM, (void **)&realm ); - - (void) sasl_getprop( ctx, - SASL_SSF, (void *)&ssf ); - - Debug(LDAP_DEBUG_TRACE, - "slap_sasl_bind: username=\"%s\" realm=\"%s\" ssf=%lu\n", - username ? username : "", - realm ? realm : "", - (unsigned long) ( ssf ? *ssf : 0 ) ); - - rc = LDAP_SUCCESS; - - if( username == NULL || ( - !strncasecmp( username, "anonymous", sizeof("anonymous")-1 ) && - ( username[sizeof("anonymous")-1] == '\0' || - username[sizeof("anonymous")-1] == '@' ) ) ) - { - Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: anonymous\n", - 0, 0, 0); - - } else if ( username[0] == 'u' && username[1] == ':' - && username[2] != '\0' ) - { - *edn = ch_malloc( sizeof( "uid=,cn=" ) - + strlen( &username[2] ) - + ( realm ? strlen( realm ) : 0 ) ); - - strcpy( *edn, "uid=" ); - strcat( *edn, &username[2] ); - - if( realm && *realm ) { - strcat( *edn, ",cn=" ); - strcat( *edn, realm ); - } - - if( dn_normalize( *edn ) == NULL ) { - Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: " - "authzid (\"%s\") to authzdn failed: \"%s\"\n", - username, *edn, 0); - ch_free( *edn ); - *edn = NULL; - rc = LDAP_INAPPROPRIATE_AUTH; - errstr = "could not form a valid DN from authzid"; - - } else { - Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: " - "authzdn: \"%s\"\n", - *edn, 0, 0); - } - - } else if ( username[0] == 'd' && username[1] == 'n' - && username[2] != ':' && username[3] != '\0' ) - { - *edn = ch_strdup( &username[3] ); - - if( dn_normalize( *edn ) == NULL ) { - Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: " - "authzid (\"%s\") to authzdn failed: \"%s\"\n", - username, *edn, 0); - - ch_free( *edn ); - *edn = NULL; - rc = LDAP_INAPPROPRIATE_AUTH; - errstr = "could not form a valid DN from authzid"; - - } else { - Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: " - "authzdn: \"%s\"\n", - *edn, 0, 0); - } - - } else { - Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: " - "authzid (\"%s\") inappropriate form\n", - username, 0, 0); - rc = LDAP_INAPPROPRIATE_AUTH; - errstr = "inappropriate authorization identity form"; - } + rc = slap_sasl_getdn( conn, username, edn, FLAG_GETDN_FINAL ); if( rc == LDAP_SUCCESS ) { + int i; + sasl_ssf_t *ssf = NULL; + (void) sasl_getprop( ctx, SASL_SSF, (void *)&ssf ); *ssfp = ssf ? *ssf : 0; if( *ssfp ) { @@ -544,6 +552,15 @@ int slap_sasl_bind( ldap_pvt_thread_mutex_unlock( &conn->c_mutex ); } + /* Store the authorization DN as a subjectDN */ + if ( *edn ) { + i = 2; + do { + i++; + (*edn)[i-3] = (*edn)[i]; + } while( (*edn)[i] ); + } + send_ldap_sasl( conn, op, rc, NULL, NULL, NULL, NULL, response.bv_len ? &response : NULL ); diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c index e4bcdb7c0e..392c1caad9 100644 --- a/servers/slapd/saslauthz.c +++ b/servers/slapd/saslauthz.c @@ -45,6 +45,14 @@ int slap_parseURI( char *uri, char **searchbase, int *scope, Filter **filter ) Debug( LDAP_DEBUG_TRACE, "slap_parseURI: parsing %s\n", uri, 0, 0 ); /* If it does not look like a URI, assume it is a DN */ + if( !strncasecmp( uri, "dn:", 3 ) ) { + uri += 3; + uri += strspn( uri, " " ); + *searchbase = ch_strdup( uri ); + dn_normalize( *searchbase ); + *scope = LDAP_SCOPE_BASE; + return( LDAP_SUCCESS ); + } if( strncasecmp( uri, "ldap://", 7 ) ) { *searchbase = ch_strdup( uri ); dn_normalize( *searchbase ); @@ -251,7 +259,7 @@ char *slap_sasl_regexp( char *saslname ) /* - * Given a SASL name (e.g. "UID=name+cn=REALM,cn=MECH,cn=AUTHZ") + * Given a SASL name (e.g. "UID=name,cn=REALM,cn=MECH,cn=AUTHZID") * return the LDAP DN to which it matches. The SASL regexp rules in the config * file turn the SASL name into an LDAP URI. If the URI is just a DN (or a * search with scope=base), just return the URI (or its searchbase). Otherwise @@ -259,7 +267,6 @@ char *slap_sasl_regexp( char *saslname ) * entry, return the DN of that one entry. */ -static char *slap_sasl2dn( char *saslname ) { char *uri=NULL, *searchbase=NULL, *DN=NULL; @@ -346,6 +353,8 @@ FINISHED: * URI, just strcmp the rule (or its searchbase) to the *assertDN. Otherwise, * the rule must be used as an internal search for entries. If that search * returns the *assertDN entry, the match is successful. + * + * The assertDN should not have the dn: prefix */ static @@ -358,6 +367,7 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc ) Connection *conn=NULL; LDAP *client=NULL; LDAPMessage *res=NULL, *msg; + regex_t reg; Debug( LDAP_DEBUG_TRACE, @@ -370,7 +380,12 @@ int slap_sasl_match( char *rule, char *assertDN, char *authc ) /* Massive shortcut: search scope == base */ if( scope == LDAP_SCOPE_BASE ) { dn_normalize( searchbase ); - if( strcmp( searchbase, assertDN ) == 0 ) + rc = regcomp(®, searchbase, REG_EXTENDED|REG_ICASE|REG_NOSUB); + if ( rc == 0 ) { + rc = regexec(®, assertDN, 0, NULL, 0); + regfree( ® ); + } + if ( rc == 0 ) rc = LDAP_SUCCESS; else rc = LDAP_INAPPROPRIATE_AUTH; @@ -440,6 +455,8 @@ CONCLUDED: * based on authorization rules. The rules are stored in the *searchDN, in the * attribute named by *attr. If any of those rules map to the *assertDN, the * authorization is approved. + * + * DN's passed in should have a dn: prefix */ static int @@ -458,13 +475,13 @@ slap_sasl_check_authz(char *searchDN, char *assertDN, char *attr, char *authc) if( rc != LDAP_SUCCESS ) goto COMPLETE; - rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN, ad, &vals ); + rc = backend_attribute( NULL, NULL, NULL, NULL, searchDN+3, ad, &vals ); if( rc != LDAP_SUCCESS ) goto COMPLETE; /* Check if the *assertDN matches any **vals */ for( i=0; vals[i] != NULL; i++ ) { - rc = slap_sasl_match( vals[i]->bv_val, assertDN, authc ); + rc = slap_sasl_match( vals[i]->bv_val, assertDN+3, authc ); if ( rc == LDAP_SUCCESS ) goto COMPLETE; } @@ -487,50 +504,28 @@ COMPLETE: -/* Check if a bind can SASL authorize to another identity. */ +/* Check if a bind can SASL authorize to another identity. + Accepts authorization DN's with "dn:" prefix */ -int slap_sasl_authorized( Connection *conn, - const char *authcid, const char *authzid ) +int slap_sasl_authorized( char *authcDN, char *authzDN ) { int rc; - char *saslname=NULL,*authcDN=NULL,*realm=NULL, *authzDN=NULL; #ifdef HAVE_CYRUS_SASL - Debug( LDAP_DEBUG_TRACE, - "==>slap_sasl_authorized: can %s become %s?\n", authcid, authzid, 0 ); - - /* Create a complete SASL name for the SASL regexp patterns */ - - sasl_getprop( conn->c_sasl_context, SASL_REALM, (void **)&realm ); - - /* Allocate space */ - rc = strlen("uid=,cn=,cn=,cn=AUTHZ "); - if ( realm ) rc += strlen( realm ); - if ( authcid ) rc += strlen( authcid ); - rc += strlen( conn->c_sasl_bind_mech ); - saslname = ch_malloc( rc ); - - /* Build the SASL name with whatever we have, and normalize it */ - saslname[0] = '\0'; - rc = 0; - if ( authcid ) - rc += sprintf( saslname+rc, "%sUID=%s", rc?",":"", authcid); - if ( realm ) - rc += sprintf( saslname+rc, "%sCN=%s", rc?",":"", realm); - if ( conn->c_sasl_bind_mech ) - rc += sprintf( saslname+rc, "%sCN=%s", rc?",":"", - conn->c_sasl_bind_mech); - sprintf( saslname+rc, "%sCN=AUTHZ", rc?",":""); - dn_normalize( saslname ); - - authcDN = slap_sasl2dn( saslname ); - if( authcDN == NULL ) + /* User binding as anonymous */ + if ( authzDN == NULL ) { + rc = LDAP_SUCCESS; goto DONE; + } - /* Normalize the name given by the clientside of the connection */ - authzDN = ch_strdup( authzid ); - dn_normalize( authzDN ); + Debug( LDAP_DEBUG_TRACE, + "==>slap_sasl_authorized: can %s become %s?\n", authcDN, authzDN, 0 ); + /* If person is authorizing to self, succeed */ + if ( !strcmp( authcDN, authzDN ) ) { + rc = LDAP_SUCCESS; + goto DONE; + } /* Check source rules */ rc = slap_sasl_check_authz( authcDN, authzDN, SASL_AUTHZ_SOURCE_ATTR, @@ -548,9 +543,6 @@ int slap_sasl_authorized( Connection *conn, rc = LDAP_INAPPROPRIATE_AUTH; DONE: - if( saslname ) ch_free( saslname ); - if( authcDN ) ch_free( authcDN ); - if( authzDN ) ch_free( authzDN ); Debug( LDAP_DEBUG_TRACE, "<== slap_sasl_authorized: return %d\n",rc,0,0 ); return( rc ); } diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h index 1dc3bba6b0..bd63be3280 100644 --- a/servers/slapd/slap.h +++ b/servers/slapd/slap.h @@ -1202,6 +1202,11 @@ typedef struct sasl_regexp { int offset[SASLREGEX_REPLACE+2]; /* offsets of $1,$2... in *replace */ } SaslRegexp_t; +/* Flags for telling slap_sasl_getdn() what type of identity is being passed */ +#define FLAG_GETDN_FINAL 1 +#define FLAG_GETDN_AUTHCID 2 +#define FLAG_GETDN_AUTHZID 4 + LDAP_END_DECL -- 2.39.5