From 863b6a6be1bf2ee96bf3bfb3121f4fa7e94756dc Mon Sep 17 00:00:00 2001 From: Kurt Zeilenga Date: Thu, 25 Aug 2005 07:01:14 +0000 Subject: [PATCH] Sync with HEAD (need to update CHANGES) --- configure.in | 35 +- contrib/slapd-modules/acl/posixgroup.c | 3 + .../draft-behera-ldap-password-policy-xx.txt | 781 +++++++++++------- doc/man/man5/slapd.access.5 | 5 +- doc/man/man5/slapo-dynlist.5 | 5 +- doc/man/man5/slapo-ppolicy.5 | 12 +- doc/man/man5/slapo-retcode.5 | 42 +- include/ldap.h | 3 +- include/ldap_pvt_thread.h | 3 + libraries/libldap/cyrus.c | 7 +- libraries/libldap/result.c | 63 +- libraries/libldap_r/tpool.c | 19 + libraries/liblutil/passwd.c | 11 +- servers/slapd/aci.c | 232 +++++- servers/slapd/acl.c | 11 +- servers/slapd/aclparse.c | 25 +- servers/slapd/ad.c | 3 + servers/slapd/attr.c | 14 +- servers/slapd/back-bdb/init.c | 9 + servers/slapd/back-bdb/search.c | 2 +- servers/slapd/back-ldap/bind.c | 18 +- servers/slapd/back-ldap/search.c | 1 + servers/slapd/back-meta/bind.c | 8 +- servers/slapd/back-meta/compare.c | 2 +- servers/slapd/back-meta/search.c | 48 +- servers/slapd/bconfig.c | 14 +- servers/slapd/oc.c | 36 +- servers/slapd/overlays/Makefile.in | 12 +- servers/slapd/overlays/overlays.c | 6 + servers/slapd/overlays/ppolicy.c | 21 +- servers/slapd/overlays/retcode.c | 31 +- servers/slapd/overlays/rwmconf.c | 2 +- servers/slapd/overlays/syncprov.c | 24 +- servers/slapd/proto-slap.h | 41 +- servers/slapd/result.c | 26 +- servers/slapd/schema_init.c | 27 +- servers/slapd/slap.h | 20 +- servers/slapd/slapi/slapi_dn.c | 10 +- servers/slapd/syntax.c | 5 +- tests/data/retcode.conf | 2 +- tests/run.in | 5 +- tests/scripts/conf.sh | 5 +- tests/scripts/defines.sh | 11 + tests/scripts/sql-test000-read | 2 +- tests/scripts/test000-rootdse | 6 +- tests/scripts/test022-ppolicy | 2 +- tests/scripts/test027-emptydn | 2 +- 47 files changed, 1142 insertions(+), 530 deletions(-) diff --git a/configure.in b/configure.in index 2764f9de4e..5bb273375c 100644 --- a/configure.in +++ b/configure.in @@ -243,8 +243,21 @@ OL_ARG_ENABLE(sql,[ --enable-sql enable sql backend no|yes|mod], dnl ---------------------------------------------------------------- dnl SLAPD Overlay Options -Overlays="accesslog denyop dyngroup dynlist glue lastmod ppolicy proxycache \ - refint retcode rwm syncprov translucent unique" +Overlays="accesslog \ + denyop \ + dyngroup \ + dynlist \ + glue \ + lastmod \ + ppolicy \ + proxycache \ + refint \ + retcode \ + rwm \ + syncprov \ + translucent \ + unique \ + valsort" AC_ARG_WITH(xxslapoverlays,[ SLAPD Overlay Options:]) @@ -280,6 +293,8 @@ OL_ARG_ENABLE(translucent,[ --enable-translucent Translucent Proxy overlay n ${ol_dflt_overlays-no}, [no yes mod]) OL_ARG_ENABLE(unique,[ --enable-unique Attribute Uniqueness overlay no|yes|mod], ${ol_dflt_overlays-no}, [no yes mod]) +OL_ARG_ENABLE(valsort,[ --enable-valsort Value Sorting overlay no|yes|mod], + ${ol_dflt_overlays-no}, [no yes mod]) dnl ---------------------------------------------------------------- @@ -521,6 +536,7 @@ BUILD_RWM=no BUILD_SYNCPROV=no BUILD_TRANSLUCENT=no BUILD_UNIQUE=no +BUILD_VALSORT=no SLAPD_STATIC_OVERLAYS= SLAPD_DYNAMIC_OVERLAYS= @@ -2726,7 +2742,7 @@ if test "$ol_enable_relay" != no ; then fi if test "$ol_enable_shell" != no ; then - if test "$ol_link_thread" != no ; then + if test "$ol_link_threads" != no ; then AC_MSG_WARN([Use of --without-threads is recommended with back-shell]) fi BUILD_SLAPD=yes @@ -2923,6 +2939,18 @@ if test "$ol_enable_unique" != no ; then AC_DEFINE_UNQUOTED(SLAPD_OVER_UNIQUE,$MFLAG,[define for Attribute Uniqueness overlay]) fi +if test "$ol_enable_valsort" != no ; then + BUILD_VALSORT=$ol_enable_valsort + if test "$ol_enable_valsort" = mod ; then + MFLAG=SLAPD_MOD_DYNAMIC + SLAPD_DYNAMIC_OVERLAYS="$SLAPD_DYNAMIC_OVERLAYS valsort.la" + else + MFLAG=SLAPD_MOD_STATIC + SLAPD_STATIC_OVERLAYS="$SLAPD_STATIC_OVERLAYS valsort.o" + fi + AC_DEFINE_UNQUOTED(SLAPD_OVER_VALSORT,$MFLAG,[define for Value Sorting overlay]) +fi + if test "$ol_enable_slurpd" != no -a "$ol_link_threads" != no -a \ $BUILD_SLAPD = yes ; then BUILD_SLURPD=yes @@ -2993,6 +3021,7 @@ dnl overlays AC_SUBST(BUILD_SYNCPROV) AC_SUBST(BUILD_TRANSLUCENT) AC_SUBST(BUILD_UNIQUE) + AC_SUBST(BUILD_VALSORT) AC_SUBST(BUILD_SLURPD) AC_SUBST(LDAP_LIBS) diff --git a/contrib/slapd-modules/acl/posixgroup.c b/contrib/slapd-modules/acl/posixgroup.c index 3f06b7fd58..f5c8f2f3f1 100644 --- a/contrib/slapd-modules/acl/posixgroup.c +++ b/contrib/slapd-modules/acl/posixgroup.c @@ -38,6 +38,7 @@ static int pg_dynacl_parse( const char *fname, int lineno, + const char *opts, slap_style_t style, const char *pattern, void **privp ) @@ -75,6 +76,8 @@ pg_dynacl_parse( goto cleanup; } + /* TODO: use opts to allow the use of different + * group objects and member attributes */ if ( pg_posixGroup == NULL ) { pg_posixGroup = oc_find( "posixGroup" ); if ( pg_posixGroup == NULL ) { diff --git a/doc/drafts/draft-behera-ldap-password-policy-xx.txt b/doc/drafts/draft-behera-ldap-password-policy-xx.txt index d9978abe04..3e61917ef2 100644 --- a/doc/drafts/draft-behera-ldap-password-policy-xx.txt +++ b/doc/drafts/draft-behera-ldap-password-policy-xx.txt @@ -1,27 +1,28 @@ + + + Network Working Group J. Sermersheim Internet-Draft Novell, Inc -Expires: April 24, 2005 L. Poitou +Expires: January 18, 2006 L. Poitou Sun Microsystems - October 24, 2004 + July 17, 2005 Password Policy for LDAP Directories - draft-behera-ldap-password-policy-08.txt + draft-behera-ldap-password-policy-09.txt Status of this Memo - This document is an Internet-Draft and is subject to all provisions - of section 3 of RFC 3667. By submitting this Internet-Draft, each - author represents that any applicable patent or other IPR claims of - which he or she is aware have been or will be disclosed, and any of - which he or she become aware will be disclosed, in accordance with - RFC 3668. + By submitting this Internet-Draft, each author represents that any + applicable patent or other IPR claims of which he or she is aware + have been or will be disclosed, and any of which he or she becomes + aware will be disclosed, in accordance with Section 6 of BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that - other groups may also distribute working documents as - Internet-Drafts. + other groups may also distribute working documents as Internet- + Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any @@ -34,11 +35,11 @@ Status of this Memo The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. - This Internet-Draft will expire on April 24, 2005. + This Internet-Draft will expire on January 18, 2006. Copyright Notice - Copyright (C) The Internet Society (2004). + Copyright (C) The Internet Society (2005). Abstract @@ -48,15 +49,15 @@ Abstract improve the security of LDAP directories and make it difficult for password cracking programs to break into directories, it is desirable to enforce a set of rules on password usage. These rules are made to + ensure that users change their passwords periodically, passwords meet -Sermersheim & Poitou Expires April 24, 2005 [Page 1] +Sermersheim & Poitou Expires January 18, 2006 [Page 1] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 - ensure that users change their passwords periodically, passwords meet construction requirements, the re-use of old password is restricted, and users are locked out after a certain number of failed attempts. @@ -66,55 +67,9 @@ Discussion Forum LDAP Extensions mailing list . Please send editorial comments directly to the authors. -Table of Contents - 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 - 2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 5 - 3. Application of password policy . . . . . . . . . . . . . . . . 6 - 4. Articles of password policy . . . . . . . . . . . . . . . . . 7 - 4.1 Password Usage Policy . . . . . . . . . . . . . . . . . . . . 7 - 4.2 Password Modification Policy . . . . . . . . . . . . . . . . . 7 - 4.3 Restriction of the Password Policy . . . . . . . . . . . . . . 10 - 5. Schema used for Password Policy . . . . . . . . . . . . . . . 11 - 5.1 The pwdPolicy Object Class . . . . . . . . . . . . . . . . . . 11 - 5.2 Attribute Types used in the pwdPolicy ObjectClass . . . . . . 11 - 5.3 Attribute Types for Password Policy State Information . . . . 16 - 6. Controls used for Password Policy . . . . . . . . . . . . . . 20 - 6.1 Request Control . . . . . . . . . . . . . . . . . . . . . . . 20 - 6.2 Response Control . . . . . . . . . . . . . . . . . . . . . . . 20 - 7. Policy Decision Points . . . . . . . . . . . . . . . . . . . . 22 - 7.1 Locked Account Check . . . . . . . . . . . . . . . . . . . . . 22 - 7.2 Password Must be Changed Now Check . . . . . . . . . . . . . . 22 - 7.3 Password Expiration Check . . . . . . . . . . . . . . . . . . 22 - 7.4 Remaining Grace AuthN Check . . . . . . . . . . . . . . . . . 22 - 7.5 Time Before Expiration Check . . . . . . . . . . . . . . . . . 23 - 7.6 Intruder Detection Check . . . . . . . . . . . . . . . . . . . 23 - 7.7 Password Too Young Check . . . . . . . . . . . . . . . . . . . 23 - 8. Server Policy Enforcement Points . . . . . . . . . . . . . . . 24 - 8.1 Password-based Authentication . . . . . . . . . . . . . . . . 24 - 8.2 Password Update Operations . . . . . . . . . . . . . . . . . . 26 - 8.3 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 29 - 9. Client Policy Enforcement Points . . . . . . . . . . . . . . . 30 - 9.1 Bind Operation . . . . . . . . . . . . . . . . . . . . . . . . 30 - 9.2 Modify Operations . . . . . . . . . . . . . . . . . . . . . . 30 - 9.3 Add Operation . . . . . . . . . . . . . . . . . . . . . . . . 31 - 9.4 Compare Operation . . . . . . . . . . . . . . . . . . . . . . 32 - 9.5 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 32 - 10. Administration of the Password Policy . . . . . . . . . . . . 33 - 11. Password Policy and Replication . . . . . . . . . . . . . . . 34 - 12. Security Considerations . . . . . . . . . . . . . . . . . . . 35 - 13. Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . 36 - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 2] - -Internet-Draft Password Policy for LDAP Directories October 2004 - 14. Normative References . . . . . . . . . . . . . . . . . . . . . 36 - Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 37 - Intellectual Property and Copyright Statements . . . . . . . . 38 @@ -154,6 +109,53 @@ Internet-Draft Password Policy for LDAP Directories October 2004 +Sermersheim & Poitou Expires January 18, 2006 [Page 2] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + +Table of Contents + + 1. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 + 2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . . 5 + 3. Application of password policy . . . . . . . . . . . . . . . . 6 + 4. Articles of password policy . . . . . . . . . . . . . . . . . 7 + 4.1 Password Usage Policy . . . . . . . . . . . . . . . . . . . . 7 + 4.2 Password Modification Policy . . . . . . . . . . . . . . . . . 7 + 4.3 Restriction of the Password Policy . . . . . . . . . . . . . . 10 + 5. Schema used for Password Policy . . . . . . . . . . . . . . . 11 + 5.1 The pwdPolicy Object Class . . . . . . . . . . . . . . . . . . 11 + 5.2 Attribute Types used in the pwdPolicy ObjectClass . . . . . . 11 + 5.3 Attribute Types for Password Policy State Information . . . . 16 + 6. Controls used for Password Policy . . . . . . . . . . . . . . 21 + 6.1 Request Control . . . . . . . . . . . . . . . . . . . . . . . 21 + 6.2 Response Control . . . . . . . . . . . . . . . . . . . . . . . 21 + 7. Policy Decision Points . . . . . . . . . . . . . . . . . . . . 23 + 7.1 Locked Account Check . . . . . . . . . . . . . . . . . . . . . 23 + 7.2 Password Must be Changed Now Check . . . . . . . . . . . . . . 23 + 7.3 Password Expiration Check . . . . . . . . . . . . . . . . . . 23 + 7.4 Remaining Grace AuthN Check . . . . . . . . . . . . . . . . . 23 + 7.5 Time Before Expiration Check . . . . . . . . . . . . . . . . . 24 + 7.6 Intruder Detection Check . . . . . . . . . . . . . . . . . . . 24 + 7.7 Password Too Young Check . . . . . . . . . . . . . . . . . . . 24 + 8. Server Policy Enforcement Points . . . . . . . . . . . . . . . 25 + 8.1 Password-based Authentication . . . . . . . . . . . . . . . . 25 + 8.2 Password Update Operations . . . . . . . . . . . . . . . . . . 27 + 8.3 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 30 + 9. Client Policy Enforcement Points . . . . . . . . . . . . . . . 31 + 9.1 Bind Operation . . . . . . . . . . . . . . . . . . . . . . . . 31 + 9.2 Modify Operations . . . . . . . . . . . . . . . . . . . . . . 32 + 9.3 Add Operation . . . . . . . . . . . . . . . . . . . . . . . . 33 + 9.4 Compare Operation . . . . . . . . . . . . . . . . . . . . . . 33 + 9.5 Other Operations . . . . . . . . . . . . . . . . . . . . . . . 34 + 10. Administration of the Password Policy . . . . . . . . . . . . 35 + 11. Password Policy and Replication . . . . . . . . . . . . . . . 36 + 12. Security Considerations . . . . . . . . . . . . . . . . . . . 37 + 13. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 38 + 14. Acknowledgement . . . . . . . . . . . . . . . . . . . . . . . 39 + 15. Normative References . . . . . . . . . . . . . . . . . . . . . 39 + Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 40 + Intellectual Property and Copyright Statements . . . . . . . . 41 @@ -163,9 +165,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 3] +Sermersheim & Poitou Expires January 18, 2006 [Page 3] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 1. Overview @@ -181,7 +183,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 other things, this policy includes: o Whether and when passwords expire. + o Whether failed bind attempts cause the account to be locked. + o If and how users are able to change their passwords. In order to achieve greater security protection and ensure @@ -217,11 +221,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - -Sermersheim & Poitou Expires April 24, 2005 [Page 4] +Sermersheim & Poitou Expires January 18, 2006 [Page 4] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 2. Conventions @@ -275,9 +277,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 5] +Sermersheim & Poitou Expires January 18, 2006 [Page 5] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 3. Application of password policy @@ -331,9 +333,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 6] +Sermersheim & Poitou Expires January 18, 2006 [Page 6] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 4. Articles of password policy @@ -353,19 +355,24 @@ Internet-Draft Password Policy for LDAP Directories October 2004 4.1.1 Password Guessing Limit In order to prevent intruders from guessing a user's password, a - mechanism exists to track the number of failed authentication - attempts, and take action when a limit is reached. This policy - consists of five parts: + mechanism exists to track the number of consecutive failed + authentication attempts, and take action when a limit is reached. + This policy consists of five parts: o A configurable limit on failed authentication attempts. + o A counter to track the number of failed authentication attempts. + o A timeframe in which the limit of consecutive failed authentication attempts must happen before action is taken. + o The action to be taken when the limit is reached. The action will either be nothing, or the account will be locked. + o An amount of time the account is locked (if it is to be locked). This can be indefinite. + 4.2 Password Modification Policy This section describes policy enforced while users are modifying @@ -377,20 +384,22 @@ Internet-Draft Password Policy for LDAP Directories October 2004 password attribute during an add or modify operation, but MAY be done by other means such as an extended operation. -4.2.1 Password Expiration, Expiration Warning, and Grace - Authentications - One of the key properties of a password is the fact that it is not - well known. If a password is frequently changed, the chances of that - user's account being broken into are minimized. -Sermersheim & Poitou Expires April 24, 2005 [Page 7] +Sermersheim & Poitou Expires January 18, 2006 [Page 7] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + + +4.2.1 Password Expiration, Expiration Warning, and Grace + Authentications + One of the key properties of a password is the fact that it is not + well known. If a password is frequently changed, the chances of that + user's account being broken into are minimized. Password policy administrators may deploy a password policy that causes passwords to expire after a given amount of time - thus @@ -404,11 +413,13 @@ Internet-Draft Password Policy for LDAP Directories October 2004 o A warning may be returned to the user sometime before his password is due to expire. If the user fails to heed this warning before the expiration time, his account will be locked. + o The user may bind to the directory a preset number of times after her password has expired. If she fails to change her password during one of her 'grace' authentications, her account will be locked. + 4.2.2 Password History When the Password Expiration policy is used, an additional mechanism @@ -431,6 +442,14 @@ Internet-Draft Password Policy for LDAP Directories October 2004 This process may be made less attractive to users by employing a minimum age for passwords. If users are forced to wait 24 hours + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 8] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + between password changes, they may be less likely to cycle through a history of 10 passwords. @@ -440,21 +459,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 are easy to guess, a password quality policy may be employed. This policy consists of two general mechanisms - ensuring that passwords conform to a defined quality criterion and ensuring that they are of - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 8] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - a minimum length. Forcing a password to comply with the quality policy may imply a variety of things including: o Disallowing trivial or well-known words make up the password. + o Forcing a certain number of digits be used. + o Disallowing anagrams of the user's name. The implementation of this policy meets with the following problems: @@ -463,19 +476,18 @@ Internet-Draft Password Policy for LDAP Directories October 2004 before being sent, the server has no way of enforcing this policy. Therefore, the onus of enforcing this policy falls upon client implementations. + o There are no specific definitions of what 'quality checking' means. This can lead to unexpected behavior in a heterogeneous environment. + 4.2.5 User Defined Passwords In some cases, it is desirable to disallow users from adding and updating their own passwords. This policy makes this functionality possible. - This implies that certain other policy, such as password expiration - is not enforced. - 4.2.6 Password Change after Reset This policy forces the user to update her password after it has been @@ -485,6 +497,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 This is needed in scenarios where a password administrator has set or reset the password to a well-known value. + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 9] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 4.2.7 Safe Modification As directories become more commonly used, it will not be unusual for @@ -496,16 +517,11 @@ Internet-Draft Password Policy for LDAP Directories October 2004 This policy forces the user to prove his identity by specifying the old password during a password modify operation. - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 9] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - {TODO: This allows a dictionary attack unless we specify that this is - also subject to intruder detection} + also subject to intruder detection. One solution is to require users + to authN prior to changing password. Another solution is to perform + intruder detection checks when the password for a non-authenticated + identity is being updated} 4.3 Restriction of the Password Policy @@ -541,23 +557,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - - - - - - - - - - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 10] +Sermersheim & Poitou Expires January 18, 2006 [Page 10] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 5. Schema used for Password Policy @@ -585,6 +587,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMustChange $ pwdAllowUserChange $ pwdSafeModify ) ) + 5.2 Attribute Types used in the pwdPolicy ObjectClass Following are the attribute types used by the pwdPolicy object class. @@ -600,27 +603,28 @@ Internet-Draft Password Policy for LDAP Directories October 2004 EQUALITY objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) + 5.2.2 pwdMinAge This attribute holds the number of seconds that must elapse between modifications to the password. If this attribute is not present, 0 seconds is assumed. - ( 1.3.6.1.4.1.42.2.27.8.1.2 - -Sermersheim & Poitou Expires April 24, 2005 [Page 11] +Sermersheim & Poitou Expires January 18, 2006 [Page 11] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + ( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.3 pwdMaxAge This attribute holds the number of seconds after which a modified @@ -636,6 +640,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.4 pwdInHistory This attribute specifies the maximum number of used passwords stored @@ -651,27 +656,28 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.5 pwdCheckQuality {TODO: Consider changing the syntax to OID. Each OID will list a quality rule (like min len, # of special characters, etc). These - rules can be specified outsid ethis document.} + rules can be specified outside this document.} {TODO: Note that even though this is meant to be a check that happens during password modification, it may also be allowed to happen during authN. This is useful for situations where the password is encrypted - when modified, but decrypted when used to authN.} - - This attribute indicates how the password quality will be verified - while being modified or added. If this attribute is not present, or -Sermersheim & Poitou Expires April 24, 2005 [Page 12] +Sermersheim & Poitou Expires January 18, 2006 [Page 12] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + when modified, but decrypted when used to authN.} + + This attribute indicates how the password quality will be verified + while being modified or added. If this attribute is not present, or if the value is '0', quality checking will not be enforced. A value of '1' indicates that the server will check the quality, and if the server is unable to check it (due to a hashed password or other @@ -685,6 +691,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.6 pwdMinLength When quality checking is enabled, this attribute holds the minimum @@ -701,6 +708,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.7 pwdExpireWarning This attribute specifies the maximum number of seconds before a @@ -714,20 +722,21 @@ Internet-Draft Password Policy for LDAP Directories October 2004 ( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 - SINGLE-VALUE ) -5.2.8 pwdGraceAuthNLimit - This attribute specifies the number of times an expired password can +Sermersheim & Poitou Expires January 18, 2006 [Page 13] + +Internet-Draft Password Policy for LDAP Directories July 2005 -Sermersheim & Poitou Expires April 24, 2005 [Page 13] - -Internet-Draft Password Policy for LDAP Directories October 2004 + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 + SINGLE-VALUE ) + +5.2.8 pwdGraceAuthNLimit + This attribute specifies the number of times an expired password can be used to authenticate. If this attribute is not present or if the value is 0, authentication will fail. @@ -737,6 +746,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.9 pwdLockout This attribute indicates, when its value is "TRUE", that the password @@ -754,6 +764,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) + 5.2.10 pwdLockoutDuration This attribute holds the number of seconds that the password cannot @@ -768,6 +779,13 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + + +Sermersheim & Poitou Expires January 18, 2006 [Page 14] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 5.2.11 pwdMaxFailure This attribute specifies the number of consecutive failed bind @@ -775,21 +793,13 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If this attribute is not present, or if the value is 0, this policy is not checked, and the value of pwdLockout will be ignored. - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 14] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - ( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.12 pwdFailureCountInterval This attribute holds the number of seconds after which the password @@ -805,6 +815,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) + 5.2.13 pwdMustChange This attribute specifies with a value of "TRUE" that users must @@ -822,6 +833,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 15] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 5.2.14 pwdAllowUserChange This attribute indicates whether users can change their own @@ -831,20 +851,12 @@ Internet-Draft Password Policy for LDAP Directories October 2004 access control mechanism. ( 1.3.6.1.4.1.42.2.27.8.1.14 - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 15] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - NAME 'pwdAllowUserChange' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) + 5.2.15 pwdSafeModify This attribute specifies whether or not the existing password must be @@ -857,6 +869,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) + 5.3 Attribute Types for Password Policy State Information Password policy state information must be maintained for each user. @@ -878,6 +891,13 @@ Internet-Draft Password Policy for LDAP Directories October 2004 (1.3.6.1.4.1.1466.115.121.1.38). The attribute type descriptor (short name) MUST be used. + + +Sermersheim & Poitou Expires January 18, 2006 [Page 16] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + For example, if the pwdPolicy object has for pwdAttribute "userPassword" then the pwdChangedTime operational attribute, in a user entry, will be: @@ -889,13 +909,6 @@ Internet-Draft Password Policy for LDAP Directories October 2004 operation, and does not specify an option, all subtypes of that policy state attribute are returned. - - -Sermersheim & Poitou Expires April 24, 2005 [Page 16] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - 5.3.2 pwdChangedTime This attribute specifies the last time the entry's password was @@ -909,8 +922,10 @@ Internet-Draft Password Policy for LDAP Directories October 2004 ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE + NO-USER-MODIFICATION USAGE directoryOperation ) + 5.3.3 pwdAccountLockedTime This attribute holds the time that the user's account was locked. A @@ -926,8 +941,19 @@ Internet-Draft Password Policy for LDAP Directories October 2004 ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE + NO-USER-MODIFICATION USAGE directoryOperation ) + + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 17] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 5.3.4 pwdFailureTime This attribute holds the timestamps of the consecutive authentication @@ -940,18 +966,10 @@ Internet-Draft Password Policy for LDAP Directories October 2004 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 + NO-USER-MODIFICATION USAGE directoryOperation ) - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 17] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - 5.3.5 pwdHistory This attribute holds a history of previously used passwords. Values @@ -984,10 +1002,20 @@ Internet-Draft Password Policy for LDAP Directories October 2004 ( 1.3.6.1.4.1.42.2.27.8.1.20 NAME 'pwdHistory' DESC 'The history of user s passwords' + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 18] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 + NO-USER-MODIFICATION USAGE directoryOperation ) + 5.3.6 pwdGraceUseTime This attribute holds the timestamps of grace authentications after a @@ -999,22 +1027,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 password has expired' EQUALITY generalizedTimeMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 18] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - + NO-USER-MODIFICATION USAGE directoryOperation ) + 5.3.7 pwdReset This attribute holds a flag to indicate (when TRUE) that the password has been updated by the password administrator and must be changed by - the user on first authentication. + the user. ( 1.3.6.1.4.1.42.2.27.8.1.22 NAME 'pwdReset' @@ -1024,6 +1045,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 SINGLE-VALUE USAGE directoryOperation ) + 5.3.8 pwdPolicySubentry This attribute points to the pwdPolicy subentry in effect for this @@ -1035,6 +1057,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE + NO-USER-MODIFICATION + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 19] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + USAGE directoryOperation ) @@ -1059,9 +1090,36 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 19] + + + + + + + + + + + + + + + + + + + + + + + + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 20] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 6. Controls used for Password Policy @@ -1072,6 +1130,8 @@ Internet-Draft Password Policy for LDAP Directories October 2004 response control contains various warnings and errors associated with password policy. + {TODO: add a note about advertisement and discovery} + 6.1 Request Control This control MAY be sent with any LDAP request message in order to @@ -1110,16 +1170,16 @@ Internet-Draft Password Policy for LDAP Directories October 2004 passwordInHistory (8) } OPTIONAL } The timeBeforeExpiration warning specifies the number of seconds - before a password will expire. The graceAuthNsRemaining warning - specifies the remaining number of times a user will be allowed to -Sermersheim & Poitou Expires April 24, 2005 [Page 20] +Sermersheim & Poitou Expires January 18, 2006 [Page 21] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + before a password will expire. The graceAuthNsRemaining warning + specifies the remaining number of times a user will be allowed to authenticate with an expired password. The passwordExpired error signifies that the password has expired and must be reset. The changeAfterReset error signifies that the password must be changed @@ -1169,11 +1229,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - -Sermersheim & Poitou Expires April 24, 2005 [Page 21] +Sermersheim & Poitou Expires January 18, 2006 [Page 22] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 7. Policy Decision Points @@ -1193,6 +1251,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 if any of these conditions are met: o The value of the pwdAccountLockedTime attribute is 000001010000Z. + o The current time is less than the value of the pwdAccountLockedTime attribute added to the value of the pwdLockoutDuration. @@ -1205,6 +1264,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 if all of these conditions are met: The pwdMustChange attribute is set to TRUE. + The pwdReset attribute is set to TRUE. Otherwise a status of false is returned. @@ -1212,9 +1272,8 @@ Internet-Draft Password Policy for LDAP Directories October 2004 7.3 Password Expiration Check A status of true is returned indicating that the password has expired - if the value of the pwdExpireWarning attribute is 0, and the current - time minus the value of pwdChangedTime is greater than the value of - the pwdMaxAge. + if the current time minus the value of pwdChangedTime is greater than + the value of the pwdMaxAge. Otherwise, a status of false is returned. @@ -1223,15 +1282,16 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If the pwdGraceUseTime attribute is present, the number of values in that attribute subtracted from the value of pwdGraceAuthNLimit is returned. Otherwise zero is returned. A positive result specifies - the number of remaining grace authentications. -Sermersheim & Poitou Expires April 24, 2005 [Page 22] +Sermersheim & Poitou Expires January 18, 2006 [Page 23] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + the number of remaining grace authentications. + 7.5 Time Before Expiration Check If the pwdExpireWarning attribute is not present a zero status is @@ -1251,6 +1311,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 returned if the following conditions are met: The pwdLockout attribute is TRUE. + The number of values in the pwdFailureTime attribute that are younger than pwdFailureCountInterval is greater or equal to the pwdMaxFailure attribute. @@ -1266,6 +1327,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 password was last updated is returned if: The value of pwdMinAge is non-zero and pwdChangedTime is present. + The value of pwdMinAge is greater than the current time minus the value of pwdChangedTime. @@ -1279,13 +1341,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 23] +Sermersheim & Poitou Expires January 18, 2006 [Page 24] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 8. Server Policy Enforcement Points @@ -1309,7 +1367,10 @@ Internet-Draft Password Policy for LDAP Directories October 2004 updates used while validating a password. Operations that validate passwords include, but are not limited to, the Bind operation where the simple choice specifies a password, and the compare operation - where the attribute being compared holds a password. + where the attribute being compared holds a password. Note that while + the compare operation does not authenticate a user to the LDAP + server, it may be used by an external application for purposes of + authentication. 8.1.1 Fail if the account is locked @@ -1320,9 +1381,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 the error: accountLocked (1) in the passwordPolicyResponse in the controls field of the message. -8.1.2 AuthN Passed Procedures +8.1.2 Validated Password Procedures - If the authentication process indicates that the password validated, + If the validation operation indicates that the password validated, these procedures are followed in order: 8.1.2.1 Policy state updates @@ -1333,17 +1394,18 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If the decision in Section 7.2 returns true, the server sends to the client a response with an appropriate successful resultCode (i.e. - success (0), compareTrue (6), etc.), and includes the - passwordPolicyResponse in the controls field of the bindResponse - message with the warning: changeAfterReset specified. -Sermersheim & Poitou Expires April 24, 2005 [Page 24] +Sermersheim & Poitou Expires January 18, 2006 [Page 25] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + success (0), compareTrue (6), etc.), and includes the + passwordPolicyResponse in the controls field of the bindResponse + message with the warning: changeAfterReset specified. + For bind, the server MUST then disallow all operations issued by this user except modify password, bind, unbind, abandon and StartTLS extended operation. @@ -1359,7 +1421,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If there are remaining grace authentications as per Section 7.4, the server adds a new value with the current time in pwdGraceUseTime. Then it sends to the client a response with an appropriate successful - resultCode (i.e. success (0), compareTrue (6), etc.), and includes + resultCode (i.e. success (0), compareTrue (6), etc.), and includes the passwordPolicyResponse in the controls field of the response message with the warning: graceAuthNsRemaining choice set to the number of grace authentications left. @@ -1382,23 +1444,24 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If the result of Section 7.5 is a positive number, the server sends to the client a response with an appropriate successful resultCode - (i.e. success (0), compareTrue (6), etc.), and includes the + (i.e. success (0), compareTrue (6), etc.), and includes the passwordPolicyResponse in the controls field of the bindResponse message with the warning: timeBeforeExiration set to the value as described above. Otherwise, the server sends a successful response, and omits the passwordPolicyResponse. -8.1.2.5 AuthN Failed Procedures - If the authentication process indicates that the password failed - validation due to invalid credentials, these procedures are followed: - -Sermersheim & Poitou Expires April 24, 2005 [Page 25] +Sermersheim & Poitou Expires January 18, 2006 [Page 26] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + + +8.1.2.5 AuthN Failed Procedures + If the authentication process indicates that the password failed + validation due to invalid credentials, these procedures are followed: 8.1.2.5.1 Policy state update @@ -1438,23 +1501,24 @@ Internet-Draft Password Policy for LDAP Directories October 2004 When the LDAP modify operation is used to modify a password, this is done by specifying both a delete action and an add or replace action, - where the delete action is first, and specifies the existing - password, and the add or replace action specifies the new password. - Other password update operations SHOULD employ a similar mechanism. - Otherwise this policy will fail. + where the delete action specifies the existing password, and the add + or replace action specifies the new password. Other password update + operations SHOULD employ a similar mechanism. Otherwise this policy + will fail. - If the existing password is not specified, the server does not - process the operation and sends the appropriate response message to - the client with the resultCode: insufficientAccessRights (50), and - includes the passwordPolicyResponse in the controls field of the - response message with the error: mustSupplyOldPassword (4). -Sermersheim & Poitou Expires April 24, 2005 [Page 26] +Sermersheim & Poitou Expires January 18, 2006 [Page 27] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + + If the existing password is not specified, the server does not + process the operation and sends the appropriate response message to + the client with the resultCode: insufficientAccessRights (50), and + includes the passwordPolicyResponse in the controls field of the + response message with the error: mustSupplyOldPassword (4). 8.2.2 Change After Reset @@ -1498,21 +1562,22 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If the value is 1, operation continues. If the value is 2, the server sends a response message to the client with the resultCode: constraintViolation (19), and includes the passwordPolicyResponse - in the controls field of the response message with the error: - insufficientPasswordQuality (5). - If the server is able to check the password quality, and the check - fails, the server sends a response message to the client with the - resultCode: constraintViolation (19), and includes the - passwordPolicyResponse in the controls field of the response -Sermersheim & Poitou Expires April 24, 2005 [Page 27] +Sermersheim & Poitou Expires January 18, 2006 [Page 28] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + in the controls field of the response message with the error: + insufficientPasswordQuality (5). + If the server is able to check the password quality, and the check + fails, the server sends a response message to the client with the + resultCode: constraintViolation (19), and includes the + passwordPolicyResponse in the controls field of the response message with the error: insufficientPasswordQuality (5). + o checks the value of the pwdMinLength attribute. If the value is non-zero, it ensures that the new password is of at least the minimum length. @@ -1529,6 +1594,7 @@ Internet-Draft Password Policy for LDAP Directories October 2004 passwordPolicyResponse in the controls field of the response message with the error: passwordTooShort (6). + 8.2.6 Invalid Reuse If pwdInHistory is present and its value is non-zero, the server @@ -1552,6 +1618,14 @@ Internet-Draft Password Policy for LDAP Directories October 2004 If the value of pwdInHistory is non-zero, the server adds the previous password (if one existed) to the pwdHistory attribute. If + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 29] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + the number of attributes held in the pwdHistory attribute exceeds the value of pwdInHistory, the server removes the oldest excess passwords. @@ -1561,15 +1635,8 @@ Internet-Draft Password Policy for LDAP Directories October 2004 set to TRUE. Otherwise, the pwdReset is removed from the user's entry if it exists. - - -Sermersheim & Poitou Expires April 24, 2005 [Page 28] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - - The pwdFailureTime, pwdGraceUseTime and pwdExpirationWarned - attributes is removed from the user's entry if they exist. + The pwdFailureTime and pwdGraceUseTime attributes is removed from the + user's entry if they exist. 8.3 Other Operations @@ -1610,18 +1677,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - - - - - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 29] +Sermersheim & Poitou Expires January 18, 2006 [Page 30] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 9. Client Policy Enforcement Points @@ -1648,38 +1706,44 @@ Internet-Draft Password Policy for LDAP Directories October 2004 failure limit has been reached and the account is locked. The user needs to retry later or contact the password administrator to reset the password. + o bindResponse.resultCode = success (0), passwordPolicyResponse.error = changeAfterReset (2): The user is binding for the first time after the password administrator set the password. In this scenario, the client SHOULD prompt the user to change his password immediately. + o bindResponse.resultCode = success (0), passwordPolicyResponse.warning = graceAuthNsRemaining: The password has expired but there are remaining grace authentications. The user needs to change it. + o bindResponse.resultCode = invalidCredentials (49), passwordPolicyResponse.error = passwordExpired (0): The password has expired and there are no more grace authentications. The user contacts the password administrator in order to have its password reset. + o bindResponse.resultCode = success (0), passwordPolicyResponse.warning = timeBeforeExpiration: The user's password will expire in n number of seconds. -9.2 Modify Operations -9.2.1 Modify Request - If the application or client encrypts the password prior to sending - it in a password modification operation (whether done through -Sermersheim & Poitou Expires April 24, 2005 [Page 30] +Sermersheim & Poitou Expires January 18, 2006 [Page 31] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 +9.2 Modify Operations + +9.2.1 Modify Request + + If the application or client encrypts the password prior to sending + it in a password modification operation (whether done through modifyRequest or another password modification mechanism), it SHOULD check the values of the pwdMinLength, and pwdCheckQuality attributes and SHOULD enforce these policies. @@ -1698,25 +1762,38 @@ Internet-Draft Password Policy for LDAP Directories October 2004 passwordPolicyResponse.error = mustSupplyOldPassword (4): The user attempted to change her password without specifying the old password but the password policy requires this. + o .resultCode = insufficientAccessRights (50), passwordPolicyResponse.error = changeAfterReset (2): The user must change her password before submitting any other LDAP requests. + o .resultCode = insufficientAccessRights (50), passwordPolicyResponse.error = passwordModNotAllowed (3): The user doesn't have sufficient rights to change his password. + o .resultCode = constraintViolation (19), passwordPolicyResponse.error = passwordTooYoung (7): It is too soon after the last password modification to change the password. + o .resultCode = constraintViolation (19), passwordPolicyResponse.error = insufficientPasswordQuality (5): The password failed quality checking. + o .resultCode = constraintViolation (19), passwordPolicyResponse.error = passwordTooShort (6): The length of the password is too short. + o .resultCode = constraintViolation (19), passwordPolicyResponse.error = passwordInHistory (8): The password has already been used; the user must choose a different one. + + +Sermersheim & Poitou Expires January 18, 2006 [Page 32] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 9.3 Add Operation If a password is specified in an addRequest, the client checks the @@ -1728,21 +1805,15 @@ Internet-Draft Password Policy for LDAP Directories October 2004 passwordPolicyResponse.error = passwordModNotAllowed (3): The user doesn't have sufficient rights to add this password. - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 31] - -Internet-Draft Password Policy for LDAP Directories October 2004 - - o addResponse.resultCode = constraintViolation (19), passwordPolicyResponse.error = insufficientPasswordQuality (5): The password failed quality checking. + o addResponse.resultCode = constraintViolation (19), passwordPolicyResponse.error = passwordTooShort (6): The length of the password is too short. + 9.4 Compare Operation When a compare operation is used to compare a password, the client @@ -1756,18 +1827,29 @@ Internet-Draft Password Policy for LDAP Directories October 2004 failure limit has been reached and the account is locked. The user needs to retry later or contact the password administrator to reset the password. + o compareResponse.resultCode = compareTrue (6), passwordPolicyResponse.warning = graceAuthNsRemaining: The password has expired but there are remaining grace authentications. The user needs to change it. + o compareResponse.resultCode = compareFalse (5), passwordPolicyResponse.error = passwordExpired (0): The password has expired and there are no more grace authentications. The user must contact the password administrator to reset the password. + o compareResponse.resultCode = compareTrue (6), passwordPolicyResponse.warning = timeBeforeExpiration: The user's password will expire in n number of seconds. + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 33] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + 9.5 Other Operations For operations other than bind, unbind, abandon or StartTLS, the @@ -1787,9 +1869,41 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 32] + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 34] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 10. Administration of the Password Policy @@ -1843,13 +1957,18 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 33] +Sermersheim & Poitou Expires January 18, 2006 [Page 35] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 11. Password Policy and Replication + {TODO: This section needs to be changed to highlight the pitfals of + replication, sugest some implementation choices to overcome those + pitfals, but remove prescriptive language relating to the update of + state information} + The pwdPolicy object defines the password policy for a portion of the DIT and MUST be replicated on all the replicas of this subtree, as any subentry would be, in order to have a consistent policy among all @@ -1870,11 +1989,11 @@ Internet-Draft Password Policy for LDAP Directories October 2004 doesn't have to be replicated to a read-only replica, since the password will never be directly modified on this server. - The pwdAccountLockedTime, pwdExpirationWarned, pwdFailureTime and - pwdGraceUseTime attributes MUST be replicated to writable replicas, - making the password policy global for all servers. When the user - entry is replicated to a read-only replica, these attributes SHOULD - NOT be replicated. This means that the number of failures, of grace + The pwdAccountLockedTime, pwdFailureTime and pwdGraceUseTime + attributes MUST be replicated to writable replicas, making the + password policy global for all servers. When the user entry is + replicated to a read-only replica, these attributes SHOULD NOT be + replicated. This means that the number of failures, of grace authentications and the locking will take place on each replicated server. For example, the effective number of failed attempts on a user password will be N x M (where N is the number of servers and M @@ -1894,14 +2013,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 - - - - - -Sermersheim & Poitou Expires April 24, 2005 [Page 34] +Sermersheim & Poitou Expires January 18, 2006 [Page 36] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 12. Security Considerations @@ -1955,38 +2069,94 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 35] +Sermersheim & Poitou Expires January 18, 2006 [Page 37] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 + + +13. IANA Considerations + + <<>> + + + + + + + + + + + + + + + + + + + + + + + -13. Acknowledgement + + + + + + + + + + + + + + + + + + + + + + + +Sermersheim & Poitou Expires January 18, 2006 [Page 38] + +Internet-Draft Password Policy for LDAP Directories July 2005 + + +14. Acknowledgement This document is based in part on prior work done by Valerie Chu from Netscape Communications Corp, published as draft-vchu-ldap-pwd-policy-00.txt (December 1998). Prasanta Behera participated in early revisions of this document. -14 Normative References +15. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. - [RFC2195] Klensin, J., Catoe, R. and P. Krumviede, "IMAP/POP - AUTHorize Extension for Simple Challenge/Response", RFC - 2195, September 1997. + [RFC2195] Klensin, J., Catoe, R., and P. Krumviede, "IMAP/POP + AUTHorize Extension for Simple Challenge/Response", + RFC 2195, September 1997. [RFC2222] Myers, J., "Simple Authentication and Security Layer (SASL)", RFC 2222, October 1997. - [RFC2251] Wahl, M., Howes, T. and S. Kille, "Lightweight Directory + [RFC2251] Wahl, M., Howes, T., and S. Kille, "Lightweight Directory Access Protocol (v3)", RFC 2251, December 1997. - [RFC2252] Wahl, M., Coulbeck, A., Howes, T. and S. Kille, + [RFC2252] Wahl, M., Coulbeck, A., Howes, T., and S. Kille, "Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions", RFC 2252, December 1997. - [RFC2829] Wahl, M., Alvestrand, H., Hodges, J. and R. Morgan, + [RFC2829] Wahl, M., Alvestrand, H., Hodges, J., and R. Morgan, "Authentication Methods for LDAP", RFC 2829, May 2000. [RFC2831] Leach, P. and C. Newman, "Using Digest Authentication as a @@ -2011,9 +2181,9 @@ Internet-Draft Password Policy for LDAP Directories October 2004 -Sermersheim & Poitou Expires April 24, 2005 [Page 36] +Sermersheim & Poitou Expires January 18, 2006 [Page 39] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 Encoding Rules (BER), Canonical Encoding Rules (CER) and @@ -2030,7 +2200,7 @@ Authors' Addresses USA Phone: +1 801 861-3088 - EMail: jimse@novell.com + Email: jimse@novell.com Ludovic Poitou @@ -2040,7 +2210,7 @@ Authors' Addresses France Phone: +33 476 188 212 - EMail: ludovic.poitou@sun.com + Email: ludovic.poitou@sun.com @@ -2067,9 +2237,9 @@ Authors' Addresses -Sermersheim & Poitou Expires April 24, 2005 [Page 37] +Sermersheim & Poitou Expires January 18, 2006 [Page 40] -Internet-Draft Password Policy for LDAP Directories October 2004 +Internet-Draft Password Policy for LDAP Directories July 2005 Intellectual Property Statement @@ -2110,7 +2280,7 @@ Disclaimer of Validity Copyright Statement - Copyright (C) The Internet Society (2004). This document is subject + Copyright (C) The Internet Society (2005). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. @@ -2123,5 +2293,6 @@ Acknowledgment -Sermersheim & Poitou Expires April 24, 2005 [Page 38] +Sermersheim & Poitou Expires January 18, 2006 [Page 41] + diff --git a/doc/man/man5/slapd.access.5 b/doc/man/man5/slapd.access.5 index 7413ee6e07..aa0cfb8b89 100644 --- a/doc/man/man5/slapd.access.5 +++ b/doc/man/man5/slapd.access.5 @@ -255,7 +255,7 @@ It can have the forms sasl_ssf= aci[=] - dynacl/name[.][=] + dynacl/name[/][.][=] .fi .LP with @@ -633,7 +633,7 @@ operational attribute is used. ACIs are experimental; they must be enabled at compile time. .LP The statement -.B dynacl/[.][=] +.B dynacl/[/][.][=] means that access checking is delegated to the admin-defined method indicated by .BR , @@ -641,6 +641,7 @@ which can be registered at run-time by means of the .B moduleload statement. The fields +.BR , .B and .B diff --git a/doc/man/man5/slapo-dynlist.5 b/doc/man/man5/slapo-dynlist.5 index c5eb9f0e38..fc0cb20d2e 100644 --- a/doc/man/man5/slapo-dynlist.5 +++ b/doc/man/man5/slapo-dynlist.5 @@ -106,5 +106,6 @@ default slapd configuration file .SH SEE ALSO .BR slapd.conf (5), .BR slapd (8). -.SH AUTHOR -Originally implemented by Pierangelo Masarati. +.SH ACKNOWLEDGEMENTS +.P +This module was written in 2004 by Pierangelo Masarati for SysNet s.n.c. diff --git a/doc/man/man5/slapo-ppolicy.5 b/doc/man/man5/slapo-ppolicy.5 index cc95469adb..7cdb3b6910 100644 --- a/doc/man/man5/slapo-ppolicy.5 +++ b/doc/man/man5/slapo-ppolicy.5 @@ -517,6 +517,7 @@ policy rules will be enforced. EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE + NO-USER-MODIFICATION USAGE directoryOperation) .RE @@ -537,6 +538,7 @@ does not exist, the user's password will not expire. EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE + NO-USER-MODIFICATION USAGE directoryOperation) .RE @@ -557,6 +559,7 @@ and may only be unlocked by an administrator. EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE + NO-USER-MODIFICATION USAGE directoryOperation) .RE @@ -590,6 +593,7 @@ will be cleansed of entries. SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch + NO-USER-MODIFICATION USAGE directoryOperation ) .RE @@ -643,6 +647,7 @@ field is in GMT format. DESC 'The history of user passwords' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 EQUALITY octetStringMatch + NO-USER-MODIFICATION USAGE directoryOperation) .RE @@ -667,6 +672,7 @@ attribute. DESC 'The timestamps of the grace login once the password has expired' SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 EQUALITY generalizedTimeMatch + NO-USER-MODIFICATION USAGE directoryOperation) .RE @@ -712,7 +718,7 @@ ppolicy_default "cn=Standard,ou=Policies,dc=example,dc=com" .LP IETF LDAP password policy proposal by P. Behera, L. Poitou and J. Sermersheim: documented in IETF document -"draft-behera-ldap-password-policy-08.txt". +"draft-behera-ldap-password-policy-09.txt". .SH BUGS The LDAP Password Policy specification is not yet an approved standard, @@ -731,8 +737,8 @@ IETF LDAP password policy proposal by P. Behera, L. Poitou and J. Sermersheim. The proposal is fully documented in the -IETF document named draft-behera-ldap-password-policy-08.txt, -written in October of 2004. +IETF document named draft-behera-ldap-password-policy-09.txt, +written in July of 2005. .P .B OpenLDAP is developed and maintained by The OpenLDAP Project (http://www.openldap.org/). diff --git a/doc/man/man5/slapo-retcode.5 b/doc/man/man5/slapo-retcode.5 index 13c006ad6f..be612cd306 100644 --- a/doc/man/man5/slapo-retcode.5 +++ b/doc/man/man5/slapo-retcode.5 @@ -28,13 +28,14 @@ Well-known response codes from standard track documents are provided in \fBretcode.conf\fP, which can be included after instantiating the overlay. .LP -In the second case, objects of the \fBerrObject\fP class, when returned -as intermediate responses of a search request, are changed into -the response dictated by their content. +In the second case, objects of classes inherited from +the \fBerrAbsObject\fP, like \fBerrObject\fP or \fBerrAuxObject\fP, +when returned as intermediate responses of a search request, are changed +into the response dictated by their content. .LP A third mode causes objects to be looked up from the underlying database -to discover if their class is \fBerrObject\fP; in that case, their content -is used to compute the corresponding response. +to discover if their class inherits from \fBerrABsObject\fP; +in that case, their content is used to compute the corresponding response. .LP The behavior is disabled by using the \fBmanageDSAit\fP control (RFC 3296); in that case, the resulting object, either present in the directory @@ -68,8 +69,8 @@ response code. .RE .TP .B retcode\-indir -Enables exploitation of in-directory stored errObjects. May result -in lots of unnecessary overhead. +Enables exploitation of in-directory stored errAbsObject. +May result in a lot of unnecessary overhead. .SH SCHEMA The following schema items are created and used by the overlay: @@ -116,14 +117,28 @@ The sleep time before the response is actually returned to the client: SINGLE-VALUE ) .RE .LP -The objectclass: +The abstract class that triggers the overlay: .RS 4 -( 1.3.6.1.4.1.4203.666.11.4.3.1 - NAME ( 'errObject' ) - SUP top STRUCTURAL +( 1.3.6.1.4.1.4203.666.11.4.3.0 + NAME ( 'errAbsObject' ) + SUP top ABSTRACT MUST ( errCode ) MAY ( cn $ description $ errOp $ errText $ errSleepTime ) ) .RE +.LP +The standalone structural objectclass for specifically created data: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.3.1 + NAME ( 'errObject' ) + SUP errAbsObject STRUCTURAL ) +.RE +.LP +The auxiliary objectclass to alter the behavior of existing objects: +.RS 4 +( 1.3.6.1.4.1.4203.666.11.4.3.2 + NAME ( 'errAuxObject' ) + SUP errAbsObject AUXILIARY ) +.RE .SH EXAMPLE .LP @@ -149,5 +164,6 @@ default slapd configuration file .SH SEE ALSO .BR slapd.conf (5), .BR slapd (8), -.SH AUTHOR -Pierangelo Masarati +.SH ACKNOWLEDGEMENTS +.P +This module was written in 2005 by Pierangelo Masarati for SysNet s.n.c. diff --git a/include/ldap.h b/include/ldap.h index 24cc7c86e5..05eb052df4 100644 --- a/include/ldap.h +++ b/include/ldap.h @@ -223,6 +223,7 @@ typedef struct ldapcontrol { #define LDAP_CONTROL_NO_SUBORDINATES "1.3.6.1.4.1.4203.666.5.11" #define LDAP_CONTROL_MANAGEDIT "1.3.6.1.4.1.4203.666.5.12" #define LDAP_CONTROL_SLURP "1.3.6.1.4.1.4203.666.5.13" +#define LDAP_CONTROL_VALSORT "1.3.6.1.4.1.4203.666.5.14" /* LDAP Duplicated Entry Control Extension *//* not implemented in slapd(8) */ #define LDAP_CONTROL_DUPENT_REQUEST "2.16.840.1.113719.1.27.101.1" @@ -244,7 +245,7 @@ typedef struct ldapcontrol { #define LDAP_CONTROL_VLVRESPONSE "2.16.840.1.113730.3.4.10" /* Password policy Controls *//* work in progress */ -/* ITS#3458: released, but not to latest draft; disabled by default */ +/* ITS#3458: released; disabled by default */ #define LDAP_CONTROL_PASSWORDPOLICYREQUEST "1.3.6.1.4.1.42.2.27.8.5.1" #define LDAP_CONTROL_PASSWORDPOLICYRESPONSE "1.3.6.1.4.1.42.2.27.8.5.1" diff --git a/include/ldap_pvt_thread.h b/include/ldap_pvt_thread.h index 1ca300bd98..79c821dd65 100644 --- a/include/ldap_pvt_thread.h +++ b/include/ldap_pvt_thread.h @@ -208,6 +208,9 @@ ldap_pvt_thread_pool_purgekey LDAP_P(( void *key )); LDAP_F( void *) ldap_pvt_thread_pool_context LDAP_P(( void )); +LDAP_F( void ) +ldap_pvt_thread_pool_context_reset LDAP_P(( void *key )); + LDAP_END_DECL #endif /* _LDAP_THREAD_H */ diff --git a/libraries/libldap/cyrus.c b/libraries/libldap/cyrus.c index 18c493688c..564cee7072 100644 --- a/libraries/libldap/cyrus.c +++ b/libraries/libldap/cyrus.c @@ -983,9 +983,10 @@ int ldap_pvt_sasl_secprops( sprops[j].key.bv_len )) continue; if ( sprops[j].ival ) { int v; - if ( props[i][sprops[j].key.bv_len] != '=' ) continue; - if ( !isdigit( props[i][sprops[j].key.bv_len+1] )) continue; - v = atoi( props[i]+sprops[j].key.bv_len+1 ); + char *next = NULL; + if ( !isdigit( props[i][sprops[j].key.bv_len] )) continue; + v = strtoul( &props[i][sprops[j].key.bv_len], &next, 10 ); + if ( next == NULL || next[ 0 ] != '\0' ) continue; switch( sprops[j].ival ) { case GOT_MINSSF: min_ssf = v; got_min_ssf++; break; diff --git a/libraries/libldap/result.c b/libraries/libldap/result.c index 2652c81f29..a4f1093bbe 100644 --- a/libraries/libldap/result.c +++ b/libraries/libldap/result.c @@ -407,7 +407,11 @@ try_read1msg( * v3ref = flag for V3 referral / search reference * 0 = not a ref, 1 = sucessfully chased ref, -1 = pass ref to application */ - int v3ref; + enum { + V3REF_NOREF = 0, + V3REF_SUCCESS = 1, + V3REF_TOAPP = -1 + } v3ref; assert( ld != NULL ); assert( lcp != NULL ); @@ -519,15 +523,16 @@ nextresp2: * This code figures out if we are going to chase a * referral / search reference, or pass it back to the application */ - v3ref = 0; /* Assume not a V3 search reference or referral */ + v3ref = V3REF_NOREF; /* Assume not a V3 search reference/referral */ if( (tag != LDAP_RES_SEARCH_ENTRY) && (ld->ld_version > LDAP_VERSION2) ) { BerElement tmpber = *ber; /* struct copy */ char **refs = NULL; - if( tag == LDAP_RES_SEARCH_REFERENCE) { + if( tag == LDAP_RES_SEARCH_REFERENCE ) { /* This is a V3 search reference */ - /* Assume we do not chase the reference, but pass it to application */ - v3ref = -1; + /* Assume we do not chase the reference, + * but pass it to application */ + v3ref = V3REF_TOAPP; if( LDAP_BOOL_GET(&ld->ld_options, LDAP_BOOL_REFERRALS) || (lr->lr_parent != NULL) ) { @@ -535,18 +540,23 @@ nextresp2: if ( ber_scanf( &tmpber, "{v}", &refs ) == LBER_ERROR ) { rc = LDAP_DECODING_ERROR; } else { - /* Note: refs arrary is freed by ldap_chase_v3referrals */ + /* Note: refs array is freed by ldap_chase_v3referrals */ refer_cnt = ldap_chase_v3referrals( ld, lr, refs, 1, &lr->lr_res_error, &hadref ); - if ( refer_cnt > 0 ) { /* sucessfully chased reference */ + if ( refer_cnt > 0 ) { + /* sucessfully chased reference */ /* If haven't got end search, set chasing referrals */ if( lr->lr_status != LDAP_REQST_COMPLETED) { lr->lr_status = LDAP_REQST_CHASINGREFS; Debug( LDAP_DEBUG_TRACE, - "read1msg: search ref chased, mark request chasing refs, id = %d\n", - lr->lr_msgid, 0, 0); + "read1msg: search ref chased, " + "mark request chasing refs, " + "id = %d\n", + lr->lr_msgid, 0, 0); } - v3ref = 1; /* We sucessfully chased the reference */ + + /* We sucessfully chased the reference */ + v3ref = V3REF_SUCCESS; } } } @@ -572,11 +582,13 @@ nextresp2: /* Check if V3 referral */ if ( ber_peek_tag( &tmpber, &len ) == LDAP_TAG_REFERRAL ) { /* We have a V3 referral, assume we cannot chase it */ - v3ref = -1; + v3ref = V3REF_TOAPP; if( LDAP_BOOL_GET(&ld->ld_options, LDAP_BOOL_REFERRALS) || (lr->lr_parent != NULL) ) { - v3ref = -1; /* Assume referral not chased and return it to app */ + /* Assume referral not chased and return it to app */ + v3ref = V3REF_TOAPP; + /* Get the referral list */ if( ber_scanf( &tmpber, "{v}", &refs) == LBER_ERROR) { rc = LDAP_DECODING_ERROR; @@ -595,7 +607,8 @@ nextresp2: "read1msg: referral chased, mark request completed, id = %d\n", lr->lr_msgid, 0, 0); if( refer_cnt > 0) { - v3ref = 1; /* Referral successfully chased */ + /* Referral successfully chased */ + v3ref = V3REF_SUCCESS; } } } @@ -617,7 +630,7 @@ nextresp2: * go through the following code. This code also chases V2 referrals * and checks if all referrals have been chased. */ - if ( (tag != LDAP_RES_SEARCH_ENTRY) && (v3ref > -1) && + if ( (tag != LDAP_RES_SEARCH_ENTRY) && (v3ref != V3REF_TOAPP) && (tag != LDAP_RES_INTERMEDIATE )) { /* For a v3 search referral/reference, only come here if already chased it */ @@ -628,7 +641,7 @@ nextresp2: char *lr_res_error = NULL; tmpber = *ber; /* struct copy */ - if ( v3ref == 1 ) { + if ( v3ref == V3REF_SUCCESS ) { /* V3 search reference or V3 referral * sucessfully chased. If this message * is a search result, then it has no more @@ -647,15 +660,31 @@ nextresp2: } else { lr->lr_res_error = lr_res_error; } + lr_res_error = NULL; } - if ( lderr != LDAP_SUCCESS ) { + switch ( lderr ) { + case LDAP_SUCCESS: + case LDAP_COMPARE_TRUE: + case LDAP_COMPARE_FALSE: + break; + + default: + if ( lr->lr_res_error == NULL + || lr->lr_res_error[ 0 ] == '\0' ) + { + break; + } + /* referrals are in error string */ refer_cnt = ldap_chase_referrals( ld, lr, &lr->lr_res_error, -1, &hadref ); lr->lr_status = LDAP_REQST_COMPLETED; Debug( LDAP_DEBUG_TRACE, - "read1msg: V2 referral chased, mark request completed, id = %d\n", lr->lr_msgid, 0, 0); + "read1msg: V2 referral chased, " + "mark request completed, id = %d\n", + lr->lr_msgid, 0, 0 ); + break; } /* save errno, message, and matched string */ diff --git a/libraries/libldap_r/tpool.c b/libraries/libldap_r/tpool.c index 04a71b645c..440b5a75e5 100644 --- a/libraries/libldap_r/tpool.c +++ b/libraries/libldap_r/tpool.c @@ -96,9 +96,15 @@ static ldap_pvt_thread_mutex_t ldap_pvt_thread_pool_mutex; static void *ldap_int_thread_pool_wrapper( void *pool ); +static ldap_pvt_thread_t ldap_int_main_tid; + +static ldap_int_thread_key_t ldap_int_main_thrctx[LDAP_MAXTHR]; + int ldap_int_thread_pool_startup ( void ) { + ldap_int_main_tid = ldap_pvt_thread_self(); + return ldap_pvt_thread_mutex_init(&ldap_pvt_thread_pool_mutex); } @@ -652,6 +658,8 @@ void *ldap_pvt_thread_pool_context( ) int i, hash; tid = ldap_pvt_thread_self(); + if ( TID_EQ( tid, ldap_int_main_tid )) + return ldap_int_main_thrctx; TID_HASH( tid, hash ); for (i = hash & (LDAP_MAXTHR-1); !TID_EQ(thread_keys[i].id, tid_zero) && @@ -660,4 +668,15 @@ void *ldap_pvt_thread_pool_context( ) return thread_keys[i].ctx; } +void ldap_pvt_thread_pool_context_reset( void *vctx ) +{ + ldap_int_thread_key_t *ctx = vctx; + int i; + + for ( i=0; ibv_val[0] == '{' ) && + ( strchr( passwd->bv_val, '}' ) > passwd->bv_val+1 )) + return 1; if( is_allowed_scheme("{CLEARTEXT}", schemes ) ) { - return (( passwd->bv_len == cred->bv_len ) && - ( passwd->bv_val[0] != '{' /*'}'*/ )) - ? memcmp( passwd->bv_val, cred->bv_val, passwd->bv_len ) + return ( passwd->bv_len == cred->bv_len ) ? + memcmp( passwd->bv_val, cred->bv_val, passwd->bv_len ) : 1; } #endif diff --git a/servers/slapd/aci.c b/servers/slapd/aci.c index bfceacf03d..6b44e80244 100644 --- a/servers/slapd/aci.c +++ b/servers/slapd/aci.c @@ -42,6 +42,34 @@ #define ACI_BUF_SIZE 1024 /* use most appropriate size */ +#ifdef SLAP_DYNACL +static +#endif /* SLAP_DYNACL */ +AttributeDescription *slap_ad_aci; + +static int +OpenLDAPaciValidate( + Syntax *syntax, + struct berval *val ); + +static int +OpenLDAPaciPretty( + Syntax *syntax, + struct berval *val, + struct berval *out, + void *ctx ); + +static int +OpenLDAPaciNormalize( + slap_mask_t use, + Syntax *syntax, + MatchingRule *mr, + struct berval *val, + struct berval *out, + void *ctx ); + +#define OpenLDAPaciMatch octetStringMatch + static int aci_list_map_rights( struct berval *list ) @@ -57,6 +85,20 @@ aci_list_map_rights( } switch ( *bv.bv_val ) { + case 'x': + /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not + * define any equivalent to the AUTH right, so I've just used + * 'x' for now. + */ + ACL_PRIV_SET(mask, ACL_PRIV_AUTH); + break; + case 'd': + /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines + * the right 'd' to mean "delete"; we hijack it to mean + * "disclose" for consistency wuith the rest of slapd. + */ + ACL_PRIV_SET(mask, ACL_PRIV_DISCLOSE); + break; case 'c': ACL_PRIV_SET(mask, ACL_PRIV_COMPARE); break; @@ -74,13 +116,6 @@ aci_list_map_rights( case 'w': ACL_PRIV_SET(mask, ACL_PRIV_WRITE); break; - case 'x': - /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not - * define any equivalent to the AUTH right, so I've just used - * 'x' for now. - */ - ACL_PRIV_SET(mask, ACL_PRIV_AUTH); - break; default: break; } @@ -239,7 +274,7 @@ aci_group_member ( const char *text; int rc; - /* format of string is "group/objectClassValue/groupAttrName" */ + /* format of string is "{group|role}/objectClassValue/groupAttrName" */ if ( acl_get_part( subj, 0, '/', &subjdn ) < 0 ) { return 0; } @@ -299,7 +334,12 @@ aci_mask( slap_access_t *deny, slap_aci_scope_t asserted_scope ) { - struct berval bv, scope, perms, type, sdn; + struct berval bv, + scope, + perms, + type, + opts, + sdn; int rc; @@ -413,6 +453,15 @@ aci_mask( sdn.bv_val = type.bv_val + type.bv_len + STRLENOF( "#" ); sdn.bv_len = aci->bv_len - ( sdn.bv_val - aci->bv_val ); + /* get the type options, if any */ + if ( acl_get_part( &type, 1, '/', &opts ) > 0 ) { + opts.bv_len = type.bv_len - ( opts.bv_val - type.bv_val ); + type.bv_len = opts.bv_val - type.bv_val - 1; + + } else { + BER_BVZERO( &opts ); + } + if ( ber_bvcmp( &aci_bv[ ACI_BV_ACCESS_ID ], &type ) == 0 ) { return dn_match( &op->o_ndn, &sdn ); @@ -459,15 +508,47 @@ aci_mask( return rc; } else if ( ber_bvcmp( &aci_bv[ ACI_BV_GROUP ], &type ) == 0 ) { - if ( aci_group_member( &sdn, &aci_bv[ ACI_BV_GROUP_CLASS ], - &aci_bv[ ACI_BV_GROUP_ATTR ], op, e, nmatch, matches ) ) + struct berval oc, + at; + + if ( BER_BVISNULL( &opts ) ) { + oc = aci_bv[ ACI_BV_GROUP_CLASS ]; + at = aci_bv[ ACI_BV_GROUP_ATTR ]; + + } else { + if ( acl_get_part( &opts, 0, '/', &oc ) < 0 ) { + assert( 0 ); + } + + if ( acl_get_part( &opts, 1, '/', &at ) < 0 ) { + at = aci_bv[ ACI_BV_GROUP_ATTR ]; + } + } + + if ( aci_group_member( &sdn, &oc, &at, op, e, nmatch, matches ) ) { return 1; } } else if ( ber_bvcmp( &aci_bv[ ACI_BV_ROLE ], &type ) == 0 ) { - if ( aci_group_member( &sdn, &aci_bv[ ACI_BV_ROLE_CLASS ], - &aci_bv[ ACI_BV_ROLE_ATTR ], op, e, nmatch, matches ) ) + struct berval oc, + at; + + if ( BER_BVISNULL( &opts ) ) { + oc = aci_bv[ ACI_BV_ROLE_CLASS ]; + at = aci_bv[ ACI_BV_ROLE_ATTR ]; + + } else { + if ( acl_get_part( &opts, 0, '/', &oc ) < 0 ) { + assert( 0 ); + } + + if ( acl_get_part( &opts, 1, '/', &at ) < 0 ) { + at = aci_bv[ ACI_BV_ROLE_ATTR ]; + } + } + + if ( aci_group_member( &sdn, &oc, &at, op, e, nmatch, matches ) ) { return 1; } @@ -481,11 +562,102 @@ aci_mask( if ( acl_match_set( &sdn, op, e, 1 ) ) { return 1; } + + } else { + /* it passed normalization! */ + assert( 0 ); } return 0; } +int +aci_init( void ) +{ + /* OpenLDAP Experimental Syntax */ + static slap_syntax_defs_rec aci_syntax_def = { + "( 1.3.6.1.4.1.4203.666.2.1 DESC 'OpenLDAP Experimental ACI' )", + SLAP_SYNTAX_HIDE, + OpenLDAPaciValidate, + OpenLDAPaciPretty + }; + static slap_mrule_defs_rec aci_mr_def = { + "( 1.3.6.1.4.1.4203.666.4.2 NAME 'OpenLDAPaciMatch' " + "SYNTAX 1.3.6.1.4.1.4203.666.2.1 )", + SLAP_MR_HIDE | SLAP_MR_EQUALITY, NULL, + NULL, OpenLDAPaciNormalize, OpenLDAPaciMatch, + NULL, NULL, + NULL + }; + static struct { + char *name; + char *desc; + slap_mask_t flags; + AttributeDescription **ad; + } aci_at = { + "OpenLDAPaci", "( 1.3.6.1.4.1.4203.666.1.5 " + "NAME 'OpenLDAPaci' " + "DESC 'OpenLDAP access control information (experimental)' " + "EQUALITY OpenLDAPaciMatch " + "SYNTAX 1.3.6.1.4.1.4203.666.2.1 " + "USAGE directoryOperation )", + SLAP_AT_HIDE, + &slap_ad_aci + }; + + LDAPAttributeType *at; + AttributeType *sat; + int rc; + const char *text; + + /* ACI syntax */ + rc = register_syntax( &aci_syntax_def ); + if ( rc != 0 ) { + return rc; + } + + /* ACI equality rule */ + rc = register_matching_rule( &aci_mr_def ); + if ( rc != 0 ) { + return rc; + } + + /* ACI attribute */ + at = ldap_str2attributetype( aci_at.desc, + &rc, &text, LDAP_SCHEMA_ALLOW_ALL ); + if ( !at ) { + Debug( LDAP_DEBUG_ANY, + "%s AttributeType load failed: %s %s\n", + aci_at.name, ldap_scherr2str( rc ), text ); + return rc; + } + + rc = at_add( at, 0, &sat, &text ); + if ( rc != LDAP_SUCCESS ) { + ldap_attributetype_free( at ); + fprintf( stderr, "iMUX_monitor_schema_init: " + "AttributeType load failed: %s %s\n", + scherr2str( rc ), text ); + return rc; + } + ldap_memfree( at ); + + rc = slap_str2ad( aci_at.name, + aci_at.ad, &text ); + if ( rc != LDAP_SUCCESS ) { + Debug( LDAP_DEBUG_ANY, + "unable to find AttributeDescription " + "\"%s\": %d (%s)\n", + aci_at.name, rc, text ); + return 1; + } + + /* install flags */ + sat->sat_flags |= aci_at.flags; + + return rc; +} + #ifdef SLAP_DYNACL /* * FIXME: there is a silly dependence that makes it difficult @@ -493,7 +665,13 @@ aci_mask( * umbrella, because sets share some helpers with ACIs. */ static int -dynacl_aci_parse( const char *fname, int lineno, slap_style_t sty, const char *right, void **privp ) +dynacl_aci_parse( + const char *fname, + int lineno, + const char *opts, + slap_style_t sty, + const char *right, + void **privp ) { AttributeDescription *ad = NULL; const char *text = NULL; @@ -514,7 +692,7 @@ dynacl_aci_parse( const char *fname, int lineno, slap_style_t sty, const char *r } } else { - ad = slap_schema.si_ad_aci; + ad = slap_ad_aci; } if ( !is_at_syntax( ad->ad_type, SLAPD_ACI_SYNTAX) ) { @@ -706,7 +884,15 @@ static slap_dynacl_t dynacl_aci = { int dynacl_aci_init( void ) { - return slap_dynacl_register( &dynacl_aci ); + int rc; + + rc = aci_init(); + + if ( rc == 0 ) { + rc = slap_dynacl_register( &dynacl_aci ); + } + + return rc; } #endif /* SLAP_DYNACL */ @@ -778,11 +964,12 @@ OpenLDAPaciValidatePerms( for ( i = 0; i < perms->bv_len; ) { switch ( perms->bv_val[ i ] ) { + case 'x': + case 'd': case 'c': case 's': case 'r': case 'w': - case 'x': break; default: @@ -1040,7 +1227,7 @@ static const struct berval *OpenLDAPacitypes[] = { NULL }; -int +static int OpenLDAPaciValidate( Syntax *syntax, struct berval *val ) @@ -1191,7 +1378,7 @@ OpenLDAPaciPrettyNormal( subject = BER_BVNULL, nsubject = BER_BVNULL; int idx, - rc, + rc = LDAP_SUCCESS, freesubject = 0, freetype = 0; char *ptr; @@ -1315,7 +1502,8 @@ OpenLDAPaciPrettyNormal( - ( ocbv.bv_val - type.bv_val ); } - if ( oc_bvfind( &ocbv ) == NULL ) { + oc = oc_bvfind( &ocbv ); + if ( oc == NULL ) { rc = LDAP_INVALID_SYNTAX; goto cleanup; } @@ -1406,7 +1594,7 @@ cleanup:; return rc; } -int +static int OpenLDAPaciPretty( Syntax *syntax, struct berval *val, @@ -1416,7 +1604,7 @@ OpenLDAPaciPretty( return OpenLDAPaciPrettyNormal( val, out, ctx, 0 ); } -int +static int OpenLDAPaciNormalize( slap_mask_t use, Syntax *syntax, diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c index a96104f84f..e89f1406b6 100644 --- a/servers/slapd/acl.c +++ b/servers/slapd/acl.c @@ -2794,19 +2794,20 @@ slap_dynacl_get( const char *name ) int acl_init( void ) { -#ifdef SLAP_DYNACL - int rc; + int rc = 0; #ifdef SLAPD_ACI_ENABLED +#ifdef SLAP_DYNACL rc = dynacl_aci_init(); +#else /* !SLAP_DYNACL */ + rc = aci_init(); +#endif /* !SLAP_DYNACL */ if ( rc != 0 ) { return rc; } #endif /* SLAPD_ACI_ENABLED */ -#endif /* SLAP_DYNACL */ - - return 0; + return rc; } int diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c index bca6db91c2..e307b550c5 100644 --- a/servers/slapd/aclparse.c +++ b/servers/slapd/aclparse.c @@ -70,7 +70,14 @@ static int check_scope( BackendDB *be, AccessControl *a ); #ifdef SLAP_DYNACL static int -slap_dynacl_config( const char *fname, int lineno, Access *b, const char *name, slap_style_t sty, const char *right ) +slap_dynacl_config( + const char *fname, + int lineno, + Access *b, + const char *name, + const char *opts, + slap_style_t sty, + const char *right ) { slap_dynacl_t *da, *tmp; int rc = 0; @@ -93,7 +100,7 @@ slap_dynacl_config( const char *fname, int lineno, Access *b, const char *name, *tmp = *da; if ( tmp->da_parse ) { - rc = ( *tmp->da_parse )( fname, lineno, sty, right, &tmp->da_private ); + rc = ( *tmp->da_parse )( fname, lineno, opts, sty, right, &tmp->da_private ); if ( rc ) { ch_free( tmp ); return rc; @@ -1490,17 +1497,23 @@ parse_acl( #ifdef SLAP_DYNACL { - char *name = NULL; + char *name = NULL, + *opts = NULL; if ( strcasecmp( left, "aci" ) == 0 ) { name = "aci"; } else if ( strncasecmp( left, "dynacl/", STRLENOF( "dynacl/" ) ) == 0 ) { name = &left[ STRLENOF( "dynacl/" ) ]; + opts = strchr( name, '/' ); + if ( opts ) { + opts[ 0 ] = '\0'; + opts++; + } } if ( name ) { - if ( slap_dynacl_config( fname, lineno, b, name, sty, right ) ) { + if ( slap_dynacl_config( fname, lineno, b, name, opts, sty, right ) ) { fprintf( stderr, "%s: line %d: " "unable to configure dynacl \"%s\"\n", fname, lineno, name ); @@ -1539,7 +1552,7 @@ parse_acl( } } else { - b->a_aci_at = slap_schema.si_ad_aci; + b->a_aci_at = slap_ad_aci; } if( !is_at_syntax( b->a_aci_at->ad_type, @@ -2122,7 +2135,7 @@ acl_usage( void ) "\t[aci[=]]\n" #endif #ifdef SLAP_DYNACL - "\t[dynacl/[.][=]]\n" + "\t[dynacl/[/][.][=]]\n" #endif /* SLAP_DYNACL */ "\t[ssf=] [transport_ssf=] [tls_ssf=] [sasl_ssf=]\n", "