sasl.c 39.3 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
/* $OpenLDAP$ */
/*
 * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
 * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
 */

#include "portable.h"

#include <stdio.h>
#include <ac/stdlib.h>
#include <ac/string.h>

#include <lber.h>
#include <ldap_log.h>

#include "slap.h"

#ifdef HAVE_CYRUS_SASL
#include <limits.h>

#ifdef HAVE_SASL_SASL_H
#include <sasl/sasl.h>
#else
#include <sasl.h>
#endif

#include <lutil.h>
Kurt Zeilenga's avatar
Kurt Zeilenga committed
28
#if SASL_VERSION_MAJOR >= 2
29
#include <sasl/saslplug.h>
30
31
32
33
34
#define	SASL_CONST const
#else
#define	SASL_CONST
#endif

Kurt Zeilenga's avatar
Kurt Zeilenga committed
35
36
#include "ldap_pvt.h"
#include "lber_pvt.h"
37
38
39
40
41
42
43

/* Flags for telling slap_sasl_getdn() what type of identity is being passed */
#define FLAG_GETDN_AUTHCID 2
#define FLAG_GETDN_AUTHZID 4

static sasl_security_properties_t sasl_secprops;

Kurt Zeilenga's avatar
Kurt Zeilenga committed
44
45
46
47
48
49
50
int slap_sasl_config( int cargc, char **cargv, char *line,
	const char *fname, int lineno )
{
		/* set SASL proxy authorization policy */
		if ( strcasecmp( cargv[0], "sasl-authz-policy" ) == 0 ) {
			if ( cargc != 2 ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
51
				LDAP_LOG( CONFIG, CRIT,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
52
					   "%s: line %d: missing policy in \"sasl-authz-policy <policy>\" line\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
53
					   fname, lineno, 0 );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
54
55
56
57
58
59
60
61
62
63
#else
				Debug( LDAP_DEBUG_ANY,
	    "%s: line %d: missing policy in \"sasl-authz-policy <policy>\" line\n",
				    fname, lineno, 0 );
#endif

				return( 1 );
			}
			if ( slap_sasl_setpolicy( cargv[1] ) ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
64
				LDAP_LOG( CONFIG, CRIT,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
65
66
67
68
					   "%s: line %d: unable "
					   "to parse value \"%s\" "
					   "in \"sasl-authz-policy "
					   "<policy>\" line.\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
69
					   fname, lineno, cargv[1] );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
#else
				Debug( LDAP_DEBUG_ANY,
				    	"%s: line %d: unable "
					"to parse value \"%s\" "
					"in \"sasl-authz-policy "
					"<policy>\" line\n",
    					fname, lineno, cargv[1] );
#endif
				return( 1 );
			}
			

		/* set SASL host */
		} else if ( strcasecmp( cargv[0], "sasl-host" ) == 0 ) {
			if ( cargc < 2 ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
86
				LDAP_LOG( CONFIG, CRIT,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
87
					   "%s: line %d: missing host in \"sasl-host <host>\" line\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
88
					   fname, lineno, 0 );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
89
90
91
92
93
94
95
96
97
98
99
#else
				Debug( LDAP_DEBUG_ANY,
	    "%s: line %d: missing host in \"sasl-host <host>\" line\n",
				    fname, lineno, 0 );
#endif

				return( 1 );
			}

			if ( global_host != NULL ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
100
				LDAP_LOG( CONFIG, CRIT,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
101
					   "%s: line %d: already set sasl-host!\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
102
					   fname, lineno, 0 );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
#else
				Debug( LDAP_DEBUG_ANY,
					"%s: line %d: already set sasl-host!\n",
					fname, lineno, 0 );
#endif

				return 1;

			} else {
				global_host = ch_strdup( cargv[1] );
			}

		/* set SASL realm */
		} else if ( strcasecmp( cargv[0], "sasl-realm" ) == 0 ) {
			if ( cargc < 2 ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
119
				LDAP_LOG( CONFIG, CRIT,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
120
					   "%s: line %d: missing realm in \"sasl-realm <realm>\" line.\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
121
					   fname, lineno, 0 );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
122
123
124
125
126
127
128
129
130
131
132
#else
				Debug( LDAP_DEBUG_ANY,
	    "%s: line %d: missing realm in \"sasl-realm <realm>\" line\n",
				    fname, lineno, 0 );
#endif

				return( 1 );
			}

			if ( global_realm != NULL ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
133
				LDAP_LOG( CONFIG, CRIT,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
134
					   "%s: line %d: already set sasl-realm!\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
135
					   fname, lineno, 0 );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
#else
				Debug( LDAP_DEBUG_ANY,
					"%s: line %d: already set sasl-realm!\n",
					fname, lineno, 0 );
#endif

				return 1;

			} else {
				global_realm = ch_strdup( cargv[1] );
			}

		} else if ( !strcasecmp( cargv[0], "sasl-regexp" ) 
			|| !strcasecmp( cargv[0], "saslregexp" ) )
		{
			int rc;
			if ( cargc != 3 ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
154
				LDAP_LOG( CONFIG, CRIT,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
155
156
					   "%s: line %d: need 2 args in "
					   "\"saslregexp <match> <replace>\"\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
157
					   fname, lineno, 0 );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
#else
				Debug( LDAP_DEBUG_ANY, 
				"%s: line %d: need 2 args in \"saslregexp <match> <replace>\"\n",
				    fname, lineno, 0 );
#endif

				return( 1 );
			}
			rc = slap_sasl_regexp_config( cargv[1], cargv[2] );
			if ( rc ) {
				return rc;
			}

		/* SASL security properties */
		} else if ( strcasecmp( cargv[0], "sasl-secprops" ) == 0 ) {
			char *txt;

			if ( cargc < 2 ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
177
				LDAP_LOG( CONFIG, CRIT,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
178
179
					   "%s: line %d: missing flags in "
					   "\"sasl-secprops <properties>\" line\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
180
					   fname, lineno, 0 );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
181
182
183
184
185
186
187
188
189
190
191
192
#else
				Debug( LDAP_DEBUG_ANY,
	    "%s: line %d: missing flags in \"sasl-secprops <properties>\" line\n",
				    fname, lineno, 0 );
#endif

				return 1;
			}

			txt = slap_sasl_secprops( cargv[1] );
			if ( txt != NULL ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
193
				LDAP_LOG( CONFIG, CRIT,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
194
					   "%s: line %d sasl-secprops: %s\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
195
					   fname, lineno, txt );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
196
197
198
199
200
201
202
203
204
205
206
207
208
#else
				Debug( LDAP_DEBUG_ANY,
	    "%s: line %d: sasl-secprops: %s\n",
				    fname, lineno, txt );
#endif

				return 1;
			}
	    }

	    return LDAP_SUCCESS;
}

209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
static int
slap_sasl_log(
	void *context,
	int priority,
	const char *message) 
{
	Connection *conn = context;
	int level;
	const char * label;

	if ( message == NULL ) {
		return SASL_BADPARAM;
	}

	switch (priority) {
#if SASL_VERSION_MAJOR >= 2
	case SASL_LOG_NONE:
		level = LDAP_DEBUG_NONE;
		label = "None";
		break;
	case SASL_LOG_ERR:
		level = LDAP_DEBUG_ANY;
		label = "Error";
		break;
	case SASL_LOG_FAIL:
		level = LDAP_DEBUG_ANY;
		label = "Failure";
		break;
	case SASL_LOG_WARN:
		level = LDAP_DEBUG_TRACE;
		label = "Warning";
		break;
	case SASL_LOG_NOTE:
		level = LDAP_DEBUG_TRACE;
		label = "Notice";
		break;
	case SASL_LOG_DEBUG:
		level = LDAP_DEBUG_TRACE;
		label = "Debug";
		break;
	case SASL_LOG_TRACE:
		level = LDAP_DEBUG_TRACE;
		label = "Trace";
		break;
	case SASL_LOG_PASS:
		level = LDAP_DEBUG_TRACE;
		label = "Password Trace";
		break;
#else
	case SASL_LOG_ERR:
		level = LDAP_DEBUG_ANY;
		label = "Error";
		break;
	case SASL_LOG_WARNING:
		level = LDAP_DEBUG_TRACE;
		label = "Warning";
		break;
	case SASL_LOG_INFO:
		level = LDAP_DEBUG_TRACE;
		label = "Info";
		break;
#endif
	default:
		return SASL_BADPARAM;
	}

#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
276
277
	LDAP_LOG( TRANSPORT, ENTRY, 
		"SASL [conn=%ld] %s: %s\n", conn ? conn->c_connid : -1, label, message);
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
#else
	Debug( level, "SASL [conn=%ld] %s: %s\n",
		conn ? conn->c_connid: -1,
		label, message );
#endif


	return SASL_OK;
}


/* Take any sort of identity string and return a DN with the "dn:" prefix. The
   string returned in *dn is in its own allocated memory, and must be free'd 
   by the calling process.
   -Mark Adamson, Carnegie Mellon
Kurt Zeilenga's avatar
Kurt Zeilenga committed
293
294
295
296

   The "dn:" prefix is no longer used anywhere inside slapd. It is only used
   on strings passed in directly from SASL.
   -Howard Chu, Symas Corp.
297
298
299
300
301
*/

#define	SET_DN	1
#define	SET_U	2

Kurt Zeilenga's avatar
Kurt Zeilenga committed
302
static struct berval ext_bv = BER_BVC( "EXTERNAL" );
303

Kurt Zeilenga's avatar
Kurt Zeilenga committed
304
int slap_sasl_getdn( Connection *conn, char *id, int len,
305
306
307
	char *user_realm, struct berval *dn, int flags )
{
	char *c1;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
308
	int rc, is_dn = 0, do_norm = 1;
309
310
311
312
	sasl_conn_t *ctx;
	struct berval dn2;

#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
313
	LDAP_LOG( TRANSPORT, ENTRY, 
314
		"slap_sasl_getdn: conn %d id=%s\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
315
		conn ? conn->c_connid : -1, id ? (*id ? id : "<empty>") : "NULL", 0 );
316
317
318
319
320
321
322
323
#else
	Debug( LDAP_DEBUG_ARGS, "slap_sasl_getdn: id=%s\n", 
      id?(*id?id:"<empty>"):"NULL",0,0 );
#endif

	dn->bv_val = NULL;
	dn->bv_len = 0;

324
325
326
327
328
329
330
331
332
333
	if ( id ) {
		if ( len == 0 ) len = strlen( id );

		/* Blatantly anonymous ID */
		if ( len == sizeof("anonymous") - 1 &&
			!strcasecmp( id, "anonymous" ) ) {
			return( LDAP_SUCCESS );
		}
	} else {
		len = 0;
334
	}
335

336
337
	ctx = conn->c_sasl_context;

338
339
340
341
342
	/* An authcID needs to be converted to authzID form. Set the
	 * values directly into *dn; they will be normalized later. (and
	 * normalizing always makes a new copy.) An ID from a TLS certificate
	 * is already normalized, so copy it and skip normalization.
	 */
343
	if( flags & FLAG_GETDN_AUTHCID ) {
344
#ifdef HAVE_TLS
Kurt Zeilenga's avatar
Kurt Zeilenga committed
345
346
347
348
		if( conn->c_is_tls &&
			conn->c_sasl_bind_mech.bv_len == ext_bv.bv_len &&
			strcasecmp( ext_bv.bv_val, conn->c_sasl_bind_mech.bv_val ) == 0 )
		{
Kurt Zeilenga's avatar
Kurt Zeilenga committed
349
			/* X.509 DN is already normalized */
Kurt Zeilenga's avatar
Kurt Zeilenga committed
350
			do_norm = 0;
351
			is_dn = SET_DN;
352
			ber_str2bv( id, len, 1, dn );
353

354
355
356
		} else
#endif
		{
357
358
			/* convert to u:<username> form */
			is_dn = SET_U;
359
360
			dn->bv_val = id;
			dn->bv_len = len;
361
362
363
364
365
		}
	}
	if( !is_dn ) {
		if( !strncasecmp( id, "u:", sizeof("u:")-1 )) {
			is_dn = SET_U;
366
367
			dn->bv_val = id+2;
			dn->bv_len = len-2;
368
369
		} else if ( !strncasecmp( id, "dn:", sizeof("dn:")-1) ) {
			is_dn = SET_DN;
370
371
			dn->bv_val = id+3;
			dn->bv_len = len-3;
372
373
374
		}
	}

375
376
	/* No other possibilities from here */
	if( !is_dn ) {
377
378
379
380
381
382
383
		dn->bv_val = NULL;
		dn->bv_len = 0;
		return( LDAP_INAPPROPRIATE_AUTH );
	}

	/* Username strings */
	if( is_dn == SET_U ) {
384
		char *p, *realm;
385
386
		len = dn->bv_len + sizeof("uid=")-1 + sizeof(",cn=auth")-1;

387
		/* username may have embedded realm name */
Kurt Zeilenga's avatar
Kurt Zeilenga committed
388
		if( ( realm = strchr( dn->bv_val, '@') ) ) {
389
390
391
			*realm++ = '\0';
			len += sizeof(",cn=")-2;
		} else if( user_realm && *user_realm ) {
392
393
394
395
396
397
398
399
400
 			len += strlen( user_realm ) + sizeof(",cn=")-1;
		}

		if( conn->c_sasl_bind_mech.bv_len ) {
			len += conn->c_sasl_bind_mech.bv_len + sizeof(",cn=")-1;
		}

		/* Build the new dn */
		c1 = dn->bv_val;
401
402
403
404
405
406
407
408
409
410
411
		dn->bv_val = SLAP_MALLOC( len+1 );
		if( dn->bv_val == NULL ) {
#ifdef NEW_LOGGING
			LDAP_LOG( TRANSPORT, ERR, 
				"slap_sasl_getdn: SLAP_MALLOC failed", 0, 0, 0 );
#else
			Debug( LDAP_DEBUG_ANY, 
				"slap_sasl_getdn: SLAP_MALLOC failed", 0, 0, 0 );
#endif
			return LDAP_OTHER;
		}
Kurt Zeilenga's avatar
Kurt Zeilenga committed
412
413
		p = lutil_strcopy( dn->bv_val, "uid=" );
		p = lutil_strncopy( p, c1, dn->bv_len );
414

415
416
		if( realm ) {
			int rlen = dn->bv_len - ( realm - c1 );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
417
418
			p = lutil_strcopy( p, ",cn=" );
			p = lutil_strncopy( p, realm, rlen );
419
420
			realm[-1] = '@';
		} else if( user_realm && *user_realm ) {
Kurt Zeilenga's avatar
Kurt Zeilenga committed
421
422
			p = lutil_strcopy( p, ",cn=" );
			p = lutil_strcopy( p, user_realm );
423
		}
424

425
		if( conn->c_sasl_bind_mech.bv_len ) {
Kurt Zeilenga's avatar
Kurt Zeilenga committed
426
427
			p = lutil_strcopy( p, ",cn=" );
			p = lutil_strcopy( p, conn->c_sasl_bind_mech.bv_val );
428
		}
Kurt Zeilenga's avatar
Kurt Zeilenga committed
429
		p = lutil_strcopy( p, ",cn=auth" );
430
431
432
		dn->bv_len = p - dn->bv_val;

#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
433
434
		LDAP_LOG( TRANSPORT, ENTRY, 
			"slap_sasl_getdn: u:id converted to %s.\n", dn->bv_val, 0, 0 );
435
436
437
438
439
#else
		Debug( LDAP_DEBUG_TRACE, "getdn: u:id converted to %s\n", dn->bv_val,0,0 );
#endif
	}

440
441
442
443
444
445
	/* All strings are in DN form now. Normalize if needed. */
	if ( do_norm ) {
		rc = dnNormalize2( NULL, dn, &dn2 );

		/* User DNs were constructed above and must be freed now */
		if ( is_dn == SET_U )
446
			ch_free( dn->bv_val );
447
448
449
450
451
452
453
454
455
456
457
458
459
460

		if ( rc != LDAP_SUCCESS ) {
			dn->bv_val = NULL;
			dn->bv_len = 0;
			return rc;
		}
		*dn = dn2;
	}

	/* Run thru regexp */
	slap_sasl2dn( conn, dn, &dn2 );
	if( dn2.bv_val ) {
		ch_free( dn->bv_val );
		*dn = dn2;
461
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
462
463
		LDAP_LOG( TRANSPORT, ENTRY, 
			"slap_sasl_getdn: dn:id converted to %s.\n", dn->bv_val, 0, 0 );
464
#else
465
466
		Debug( LDAP_DEBUG_TRACE, "getdn: dn:id converted to %s\n",
			dn->bv_val, 0, 0 );
467
#endif
468
469
470
471
472
473
	}

	return( LDAP_SUCCESS );
}

#if SASL_VERSION_MAJOR >= 2
Kurt Zeilenga's avatar
Kurt Zeilenga committed
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
static const char *slap_propnames[] = {
	"*slapConn", "*authcDN", "*authzDN", NULL };

static Filter *generic_filter;

#define	PROP_CONN	0
#define	PROP_AUTHC	1
#define	PROP_AUTHZ	2

typedef struct lookup_info {
	int last;
	int flags;
	const struct propval *list;
	sasl_server_params_t *sparams;
} lookup_info;

static int
sasl_ap_lookup(
	BackendDB *be,
	Connection *conn,
	Operation *op,
	Entry *e,
	AttributeName *an,
	int attrsonly,
	LDAPControl **ctrls )
{
	BerVarray bv;
	AttributeDescription *ad;
	Attribute *a;
	const char *text;
	int rc, i;
	slap_callback *tmp = op->o_callback;
	lookup_info *sl = tmp->sc_private;

	for( i = 0; i < sl->last; i++ ) {
		const char *name = sl->list[i].name;

		if ( name[0] == '*' ) {
			if ( sl->flags & SASL_AUXPROP_AUTHZID ) continue;
			name++;
		} else if ( !(sl->flags & SASL_AUXPROP_AUTHZID ) )
			continue;

		if ( sl->list[i].values ) {
			if ( !(sl->flags & SASL_AUXPROP_OVERRIDE) ) continue;
		}
		ad = NULL;
		rc = slap_str2ad( name, &ad, &text );
		if ( rc != LDAP_SUCCESS ) {
#ifdef NEW_LOGGING
			LDAP_LOG( TRANSPORT, DETAIL1, 
				"slap_auxprop: str2ad(%s): %s\n", name, text, 0 );
#else
			Debug( LDAP_DEBUG_TRACE,
				"slap_auxprop: str2ad(%s): %s\n", name, text, 0 );
#endif
			continue;
		}
		a = attr_find( e->e_attrs, ad );
		if ( !a ) continue;
		if ( ! access_allowed( be, conn, op, e, ad, NULL, ACL_AUTH, NULL ) )
			continue;
		if ( sl->list[i].values && ( sl->flags & SASL_AUXPROP_OVERRIDE ) )
			sl->sparams->utils->prop_erase( sl->sparams->propctx, sl->list[i].name );
		for ( bv = a->a_vals; bv->bv_val; bv++ ) {
			sl->sparams->utils->prop_set( sl->sparams->propctx, sl->list[i].name,
				bv->bv_val, bv->bv_len );
		}
	}
	return LDAP_SUCCESS;
}
545
546
547
548
549
550
551
552
553

static void
slap_auxprop_lookup(
	void *glob_context,
	sasl_server_params_t *sparams,
	unsigned flags,
	const char *user,
	unsigned ulen)
{
Kurt Zeilenga's avatar
Kurt Zeilenga committed
554
	int rc, i, doit=0;
555
	struct berval dn;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
	Connection *conn = NULL;
	lookup_info sl;

	sl.list = sparams->utils->prop_get( sparams->propctx );
	sl.sparams = sparams;
	sl.flags = flags;

	/* Find our DN and conn first */
	for( i = 0, sl.last = 0; sl.list[i].name; i++ ) {
		if ( sl.list[i].name[0] == '*' ) {
			if ( !strcmp( sl.list[i].name, slap_propnames[PROP_CONN] ) ) {
				if ( sl.list[i].values && sl.list[i].values[0] )
					AC_MEMCPY( &conn, sl.list[i].values[0], sizeof( conn ) );
				if ( !sl.last ) sl.last = i;
			}
571
			if ( (flags & SASL_AUXPROP_AUTHZID) &&
Kurt Zeilenga's avatar
Kurt Zeilenga committed
572
573
574
575
576
				!strcmp( sl.list[i].name, slap_propnames[PROP_AUTHZ] ) ) {

				if ( sl.list[i].values && sl.list[i].values[0] )
					AC_MEMCPY( &dn, sl.list[i].values[0], sizeof( dn ) );
				if ( !sl.last ) sl.last = i;
577
578
				break;
			}
Kurt Zeilenga's avatar
Kurt Zeilenga committed
579
580
581
582
			if ( !strcmp( sl.list[i].name, slap_propnames[PROP_AUTHC] ) ) {
				if ( !sl.last ) sl.last = i;
				if ( sl.list[i].values && sl.list[i].values[0] ) {
					AC_MEMCPY( &dn, sl.list[i].values[0], sizeof( dn ) );
583
584
585
586
					if ( !(flags & SASL_AUXPROP_AUTHZID) )
						break;
				}
			}
587
588
589
		}
	}

Kurt Zeilenga's avatar
Kurt Zeilenga committed
590
591
592
	/* Now see what else needs to be fetched */
	for( i = 0; i < sl.last; i++ ) {
		const char *name = sl.list[i].name;
593
594
595
596
597
598
599

		if ( name[0] == '*' ) {
			if ( flags & SASL_AUXPROP_AUTHZID ) continue;
			name++;
		} else if ( !(flags & SASL_AUXPROP_AUTHZID ) )
			continue;

Kurt Zeilenga's avatar
Kurt Zeilenga committed
600
		if ( sl.list[i].values ) {
601
602
			if ( !(flags & SASL_AUXPROP_OVERRIDE) ) continue;
		}
Kurt Zeilenga's avatar
Kurt Zeilenga committed
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
		doit = 1;
	}

	if (doit) {
		Backend *be;
		Operation op = {0};
		slap_callback cb = { slap_cb_null_response,
			slap_cb_null_sresult, sasl_ap_lookup, NULL };

		cb.sc_private = &sl;

		be = select_backend( &dn, 0, 1 );

		if ( be && be->be_search ) {
			op.o_tag = LDAP_REQ_SEARCH;
			op.o_protocol = LDAP_VERSION3;
			op.o_ndn = conn->c_ndn;
			op.o_callback = &cb;
			op.o_time = slap_get_time();
			op.o_do_not_cache = 1;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
623
			op.o_threadctx = conn->c_sasl_bindop->o_threadctx;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
624
625
626
627

			(*be->be_search)( be, conn, &op, NULL, &dn,
				LDAP_SCOPE_BASE, LDAP_DEREF_NEVER, 1, 0,
				generic_filter, NULL, NULL, 0 );
628
		}
629
	}
630
}
631

632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
static sasl_auxprop_plug_t slap_auxprop_plugin = {
	0,	/* Features */
	0,	/* spare */
	NULL,	/* glob_context */
	NULL,	/* auxprop_free */
	slap_auxprop_lookup,
	"slapd",	/* name */
	NULL	/* spare */
};

static int
slap_auxprop_init(
	const sasl_utils_t *utils,
	int max_version,
	int *out_version,
	sasl_auxprop_plug_t **plug,
	const char *plugname)
{
	if ( !out_version | !plug ) return SASL_BADPARAM;

	if ( max_version < SASL_AUXPROP_PLUG_VERSION ) return SASL_BADVERS;

	*out_version = SASL_AUXPROP_PLUG_VERSION;
	*plug = &slap_auxprop_plugin;
	return SASL_OK;
657
658
}

Kurt Zeilenga's avatar
Kurt Zeilenga committed
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
typedef struct checkpass_info {
	int rc;
	struct berval cred;
} checkpass_info;

static int
sasl_cb_checkpass(
	BackendDB *be,
	Connection *conn,
	Operation *op,
	Entry *e,
	AttributeName *an,
	int attrsonly,
	LDAPControl **ctrls )
{
	slap_callback *tmp = op->o_callback;
	checkpass_info *ci = tmp->sc_private;
	Attribute *a;
	struct berval *bv;
	
	ci->rc = SASL_NOVERIFY;

	a = attr_find( e->e_attrs, slap_schema.si_ad_userPassword );
	if ( !a ) return 0;
	if ( ! access_allowed( be, conn, op, e, slap_schema.si_ad_userPassword,
		NULL, ACL_AUTH, NULL ) ) return 0;

	for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) {
		if ( !lutil_passwd( bv, &ci->cred, NULL ) ) {
			ci->rc = SASL_OK;
			break;
		}
	}
	return 0;
}

695
696
697
698
699
700
701
702
703
704
static int
slap_sasl_checkpass(
	sasl_conn_t *sconn,
	void *context,
	const char *username,
	const char *pass,
	unsigned passlen,
	struct propctx *propctx)
{
	Connection *conn = (Connection *)context;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
705
	struct berval dn;
706
	int rc;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
707
708
	Backend *be;
	checkpass_info ci;
709

Kurt Zeilenga's avatar
Kurt Zeilenga committed
710
	ci.rc = SASL_NOUSER;
711

Kurt Zeilenga's avatar
Kurt Zeilenga committed
712
713
714
	/* SASL will fallback to its own mechanisms if we don't
	 * find an answer here.
	 */
715

Kurt Zeilenga's avatar
Kurt Zeilenga committed
716
717
	rc = slap_sasl_getdn( conn, (char *)username, 0, NULL, &dn,
		FLAG_GETDN_AUTHCID );
718
719
720
721
722
723
724
725
726
727
728
729
730
731
	if ( rc != LDAP_SUCCESS ) {
		sasl_seterror( sconn, 0, ldap_err2string( rc ) );
		return SASL_NOUSER;
	}

	if ( dn.bv_len == 0 ) {
		sasl_seterror( sconn, 0,
			"No password is associated with the Root DSE" );
		if ( dn.bv_val != NULL ) {
			ch_free( dn.bv_val );
		}
		return SASL_NOUSER;
	}

Kurt Zeilenga's avatar
Kurt Zeilenga committed
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
	be = select_backend( &dn, 0, 1 );
	if ( be && be->be_search ) {
		Operation op = {0};
		slap_callback cb = { slap_cb_null_response,
			slap_cb_null_sresult, sasl_cb_checkpass, NULL };

		ci.cred.bv_val = (char *)pass;
		ci.cred.bv_len = passlen;

		cb.sc_private = &ci;
		op.o_tag = LDAP_REQ_SEARCH;
		op.o_protocol = LDAP_VERSION3;
		op.o_ndn = conn->c_ndn;
		op.o_callback = &cb;
		op.o_time = slap_get_time();
		op.o_do_not_cache = 1;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
748
		op.o_threadctx = conn->c_sasl_bindop->o_threadctx;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
749
750
751
752

		(*be->be_search)( be, conn, &op, NULL, &dn,
			LDAP_SCOPE_BASE, LDAP_DEREF_NEVER, 1, 0,
			generic_filter, NULL, NULL, 0 );
753
	}
Kurt Zeilenga's avatar
Kurt Zeilenga committed
754
	if ( ci.rc != SASL_OK ) {
755
756
757
758
759
760
		sasl_seterror( sconn, 0,
			ldap_err2string( LDAP_INVALID_CREDENTIALS ) );
	}

	ch_free( dn.bv_val );

Kurt Zeilenga's avatar
Kurt Zeilenga committed
761
	return ci.rc;
762
763
}

764
765
766
767
768
769
/* Convert a SASL authcid or authzid into a DN. Store the DN in an
 * auxiliary property, so that we can refer to it in sasl_authorize
 * without interfering with anything else. Also, the SASL username
 * buffer is constrained to 256 characters, and our DNs could be
 * much longer (totally arbitrary length)...
 */
770
771
772
773
774
775
776
777
778
779
780
781
782
static int
slap_sasl_canonicalize(
	sasl_conn_t *sconn,
	void *context,
	const char *in,
	unsigned inlen,
	unsigned flags,
	const char *user_realm,
	char *out,
	unsigned out_max,
	unsigned *out_len)
{
	Connection *conn = (Connection *)context;
783
784
	struct propctx *props = sasl_auxprop_getctx( sconn );
	struct propval auxvals[3];
785
	struct berval dn;
786
787
	int rc, which;
	const char *names[2];
788
789
790
791

	*out_len = 0;

#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
792
	LDAP_LOG( TRANSPORT, ENTRY, 
793
		"slap_sasl_canonicalize: conn %d %s=\"%s\"\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
794
795
		conn ? conn->c_connid : -1,
		(flags & SASL_CU_AUTHID) ? "authcid" : "authzid", in ? in : "<empty>");
796
797
798
799
#else
	Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: "
		"%s=\"%s\"\n",
			conn ? conn->c_connid : -1,
800
			(flags & SASL_CU_AUTHID) ? "authcid" : "authzid",
801
802
803
			in ? in : "<empty>" );
#endif

804
805
806
807
808
809
810
811
812
813
814
815
	/* If name is too big, just truncate. We don't care, we're
	 * using DNs, not the usernames.
	 */
	if ( inlen > out_max )
		inlen = out_max-1;

	/* See if we need to add request, can only do it once */
	prop_getnames( props, slap_propnames, auxvals );
	if ( !auxvals[0].name )
		prop_request( props, slap_propnames );

	if ( flags & SASL_CU_AUTHID )
Kurt Zeilenga's avatar
Kurt Zeilenga committed
816
		which = PROP_AUTHC;
817
	else
Kurt Zeilenga's avatar
Kurt Zeilenga committed
818
		which = PROP_AUTHZ;
819

Kurt Zeilenga's avatar
Kurt Zeilenga committed
820
821
822
823
824
825
826
	/* Need to store the Connection for auxprop_lookup */
	if ( !auxvals[PROP_CONN].values ) {
		names[0] = slap_propnames[PROP_CONN];
		names[1] = NULL;
		prop_set( props, names[0], (char *)&conn, sizeof( conn ) );
	}
		
827
828
829
830
	/* Already been here? */
	if ( auxvals[which].values )
		goto done;

831
832
833
834
835
836
837
838
839
840
	/* Normally we require an authzID to have a u: or dn: prefix.
	 * However, SASL frequently gives us an authzID that is just
	 * an exact copy of the authcID, without a prefix. We need to
	 * detect and allow this condition. If SASL calls canonicalize
	 * with SASL_CU_AUTHID|SASL_CU_AUTHZID this is a no-brainer.
	 * But if it's broken into two calls, we need to remember the
	 * authcID so that we can compare the authzID later. We store
	 * the authcID temporarily in conn->c_sasl_dn. We necessarily
	 * finish Canonicalizing before Authorizing, so there is no
	 * conflict with slap_sasl_authorize's use of this temp var.
841
842
843
844
	 *
	 * The SASL EXTERNAL mech is backwards from all the other mechs,
	 * it does authzID before the authcID. If we see that authzID
	 * has already been done, don't do anything special with authcID.
845
	 */
846
	if ( flags == SASL_CU_AUTHID && !auxvals[PROP_AUTHZ].values ) {
Kurt Zeilenga's avatar
Kurt Zeilenga committed
847
		conn->c_sasl_dn.bv_val = (char *) in;
848
849
850
851
852
	} else if ( flags == SASL_CU_AUTHZID && conn->c_sasl_dn.bv_val ) {
		rc = strcmp( in, conn->c_sasl_dn.bv_val );
		conn->c_sasl_dn.bv_val = NULL;
		/* They were equal, no work needed */
		if ( !rc ) goto done;
853
854
	}

Kurt Zeilenga's avatar
Kurt Zeilenga committed
855
	rc = slap_sasl_getdn( conn, (char *)in, inlen, (char *)user_realm, &dn,
856
		(flags & SASL_CU_AUTHID) ? FLAG_GETDN_AUTHCID : FLAG_GETDN_AUTHZID );
857
858
859
860
861
	if ( rc != LDAP_SUCCESS ) {
		sasl_seterror( sconn, 0, ldap_err2string( rc ) );
		return SASL_NOAUTHZ;
	}		

862
863
	names[0] = slap_propnames[which];
	names[1] = NULL;
864

865
866
	prop_set( props, names[0], (char *)&dn, sizeof( dn ) );
		
867
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
868
	LDAP_LOG( TRANSPORT, ENTRY, 
869
		"slap_sasl_canonicalize: conn %d %s=\"%s\"\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
870
		conn ? conn->c_connid : -1, names[0]+1, dn.bv_val );
871
872
873
874
#else
	Debug( LDAP_DEBUG_ARGS, "SASL Canonicalize [conn=%ld]: "
		"%s=\"%s\"\n",
			conn ? conn->c_connid : -1,
875
			names[0]+1, dn.bv_val );
876
#endif
877
878
879
880
done:	AC_MEMCPY( out, in, inlen );
	out[inlen] = '\0';

	*out_len = inlen;
881
882
883
884
885
886
887
888
889
890
891
892
893
894

	return SASL_OK;
}

static int
slap_sasl_authorize(
	sasl_conn_t *sconn,
	void *context,
	char *requested_user,
	unsigned rlen,
	char *auth_identity,
	unsigned alen,
	const char *def_realm,
	unsigned urlen,
895
	struct propctx *props)
896
897
{
	Connection *conn = (Connection *)context;
898
	struct propval auxvals[3];
899
	struct berval authcDN, authzDN;
900
	int rc;
901
902

#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
903
	LDAP_LOG( TRANSPORT, ENTRY, 
904
		"slap_sasl_authorize: conn %d authcid=\"%s\" authzid=\"%s\"\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
905
		conn ? conn->c_connid : -1, auth_identity, requested_user);
906
907
908
909
910
#else
	Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
		"authcid=\"%s\" authzid=\"%s\"\n",
		conn ? conn->c_connid : -1, auth_identity, requested_user );
#endif
Kurt Zeilenga's avatar
Kurt Zeilenga committed
911
912
913
914
915
	if ( conn->c_sasl_dn.bv_val ) {
		ch_free( conn->c_sasl_dn.bv_val );
		conn->c_sasl_dn.bv_val = NULL;
		conn->c_sasl_dn.bv_len = 0;
	}
916

Kurt Zeilenga's avatar
Kurt Zeilenga committed
917
918
	/* Skip PROP_CONN */
	prop_getnames( props, slap_propnames+1, auxvals );
919
	
Kurt Zeilenga's avatar
Kurt Zeilenga committed
920
921
	AC_MEMCPY( &authcDN, auxvals[0].values[0], sizeof(authcDN) );

922
	/* Nothing to do if no authzID was given */
Kurt Zeilenga's avatar
Kurt Zeilenga committed
923
924
	if ( !auxvals[1].name || !auxvals[1].values ) {
		conn->c_sasl_dn = authcDN;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
925
		goto ok;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
926
	}
927
928
	
	AC_MEMCPY( &authzDN, auxvals[1].values[0], sizeof(authzDN) );
929

Kurt Zeilenga's avatar
Kurt Zeilenga committed
930
	rc = slap_sasl_authorized( conn, &authcDN, &authzDN );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
931
	ch_free( authcDN.bv_val );
932
933
	if ( rc != LDAP_SUCCESS ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
934
935
936
		LDAP_LOG( TRANSPORT, INFO, 
			"slap_sasl_authorize: conn %ld  authorization disallowed (%d)\n",
			(long)(conn ? conn->c_connid : -1), rc, 0 );
937
938
939
940
941
942
943
#else
		Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
			" authorization disallowed (%d)\n",
			(long) (conn ? conn->c_connid : -1), rc, 0 );
#endif

		sasl_seterror( sconn, 0, "not authorized" );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
944
		ch_free( authzDN.bv_val );
945
946
947
		return SASL_NOAUTHZ;
	}

Kurt Zeilenga's avatar
Kurt Zeilenga committed
948
	conn->c_sasl_dn = authzDN;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
949
950
951
952
953
954
955
ok:
	if (conn->c_sasl_bindop) {
		Statslog( LDAP_DEBUG_STATS,
	    		"conn=%lu op=%lu BIND authcid=\"%s\"\n",
	    		conn->c_connid, conn->c_sasl_bindop->o_opid, 
			auth_identity, 0, 0);
	}
Kurt Zeilenga's avatar
Kurt Zeilenga committed
956

957
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
958
959
960
	LDAP_LOG( TRANSPORT, ENTRY, 
		"slap_sasl_authorize: conn %d authorization allowed\n",
		(long)(conn ? conn->c_connid : -1), 0, 0 );
961
962
963
964
965
966
967
968
969
970
971
#else
	Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
		" authorization allowed\n",
		(long) (conn ? conn->c_connid : -1), 0, 0 );
#endif
	return SASL_OK;
} 
#else
static int
slap_sasl_authorize(
	void *context,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
972
973
	char *authcid,
	char *authzid,
974
975
976
977
	const char **user,
	const char **errstr)
{
	struct berval authcDN, authzDN;
978
	int rc;
979
	Connection *conn = context;
980
	char *realm;
981
982

	*user = NULL;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
983
984
985
986
987
	if ( conn->c_sasl_dn.bv_val ) {
		ch_free( conn->c_sasl_dn.bv_val );
		conn->c_sasl_dn.bv_val = NULL;
		conn->c_sasl_dn.bv_len = 0;
	}
988
989

#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
990
991
992
993
	LDAP_LOG( TRANSPORT, ENTRY, 
		"slap_sasl_authorize: conn %d	 authcid=\"%s\" authzid=\"%s\"\n",
		conn ? conn->c_connid : -1, authcid ? authcid : "<empty>",
		authzid ? authzid : "<empty>" );
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
#else
	Debug( LDAP_DEBUG_ARGS, "SASL Authorize [conn=%ld]: "
		"authcid=\"%s\" authzid=\"%s\"\n",
		(long) (conn ? conn->c_connid : -1),
		authcid ? authcid : "<empty>",
		authzid ? authzid : "<empty>" );
#endif

	/* Figure out how much data we have for the dn */
	rc = sasl_getprop( conn->c_sasl_context, SASL_REALM, (void **)&realm );
	if( rc != SASL_OK && rc != SASL_NOTDONE ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1006
1007
		LDAP_LOG( TRANSPORT, ERR,
			"slap_sasl_authorize: getprop(REALM) failed.\n", 0, 0, 0 );
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
#else
		Debug(LDAP_DEBUG_TRACE,
			"authorize: getprop(REALM) failed!\n", 0,0,0);
#endif
		*errstr = "Could not extract realm";
		return SASL_NOAUTHZ;
	}

	/* Convert the identities to DN's. If no authzid was given, client will
	   be bound as the DN matching their username */
1018
	rc = slap_sasl_getdn( conn, (char *)authcid, 0, realm, &authcDN, FLAG_GETDN_AUTHCID );
1019
1020
1021
1022
1023
1024
	if( rc != LDAP_SUCCESS ) {
		*errstr = ldap_err2string( rc );
		return SASL_NOAUTHZ;
	}
	if( ( authzid == NULL ) || !strcmp( authcid,authzid ) ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1025
1026
1027
		LDAP_LOG( TRANSPORT, ENTRY, 
			"slap_sasl_authorize: conn %d  Using authcDN=%s\n",
			conn ? conn->c_connid : -1, authcDN.bv_val, 0 );
1028
1029
1030
1031
1032
#else
		Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
		 "Using authcDN=%s\n", (long) (conn ? conn->c_connid : -1), authcDN.bv_val,0 );
#endif

Kurt Zeilenga's avatar
Kurt Zeilenga committed
1033
		conn->c_sasl_dn = authcDN;
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1034
		goto ok;
1035
	}
1036
	rc = slap_sasl_getdn( conn, (char *)authzid, 0, realm, &authzDN, FLAG_GETDN_AUTHZID );
1037
1038
1039
1040
1041
1042
	if( rc != LDAP_SUCCESS ) {
		ch_free( authcDN.bv_val );
		*errstr = ldap_err2string( rc );
		return SASL_NOAUTHZ;
	}

Kurt Zeilenga's avatar
Kurt Zeilenga committed
1043
	rc = slap_sasl_authorized(conn, &authcDN, &authzDN );
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1044
	ch_free( authcDN.bv_val );
1045
1046
	if( rc ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1047
1048
1049
		LDAP_LOG( TRANSPORT, INFO, 
			"slap_sasl_authorize: conn %ld  authorization disallowed (%d)\n",
			(long)(conn ? conn->c_connid : -1), rc, 0 );
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
#else
		Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
			" authorization disallowed (%d)\n",
			(long) (conn ? conn->c_connid : -1), rc, 0 );
#endif

		*errstr = "not authorized";
		ch_free( authzDN.bv_val );
		return SASL_NOAUTHZ;
	}
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1060
	conn->c_sasl_dn = authzDN;
1061

Kurt Zeilenga's avatar
Kurt Zeilenga committed
1062
ok:
1063
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1064
1065
1066
	LDAP_LOG( TRANSPORT, RESULTS, 
		"slap_sasl_authorize: conn %d authorization allowed\n",
	   (long)(conn ? conn->c_connid : -1 ), 0, 0 );
1067
1068
1069
1070
1071
1072
#else
	Debug( LDAP_DEBUG_TRACE, "SASL Authorize [conn=%ld]: "
		" authorization allowed\n",
		(long) (conn ? conn->c_connid : -1), 0, 0 );
#endif

Kurt Zeilenga's avatar
Kurt Zeilenga committed
1073
1074
	if (conn->c_sasl_bindop) {
		Statslog( LDAP_DEBUG_STATS,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1075
1076
1077
			"conn=%lu op=%lu BIND authcid=\"%s\"\n",
			conn->c_connid, conn->c_sasl_bindop->o_opid, 
			authcid, 0, 0);
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1078
1079
	}

1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
	*errstr = NULL;
	return SASL_OK;
}
#endif /* SASL_VERSION_MAJOR >= 2 */

static int
slap_sasl_err2ldap( int saslerr )
{
	int rc;

	switch (saslerr) {
		case SASL_CONTINUE:
			rc = LDAP_SASL_BIND_IN_PROGRESS;
			break;
		case SASL_FAIL:
			rc = LDAP_OTHER;
			break;
		case SASL_NOMEM:
			rc = LDAP_OTHER;
			break;
		case SASL_NOMECH:
			rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
			break;
		case SASL_BADAUTH:
			rc = LDAP_INVALID_CREDENTIALS;
			break;
		case SASL_NOAUTHZ:
			rc = LDAP_INSUFFICIENT_ACCESS;
			break;
		case SASL_TOOWEAK:
		case SASL_ENCRYPT:
			rc = LDAP_INAPPROPRIATE_AUTH;
			break;
		default:
			rc = LDAP_OTHER;
			break;
	}

	return rc;
}
#endif


int slap_sasl_init( void )
{
#ifdef HAVE_CYRUS_SASL
	int rc;
	static sasl_callback_t server_callbacks[] = {
		{ SASL_CB_LOG, &slap_sasl_log, NULL },
		{ SASL_CB_LIST_END, NULL, NULL }
	};

Kurt Zeilenga's avatar
Kurt Zeilenga committed
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
#ifdef HAVE_SASL_VERSION
#define SASL_BUILD_VERSION ((SASL_VERSION_MAJOR << 24) |\
	(SASL_VERSION_MINOR << 16) | SASL_VERSION_STEP)

	sasl_version( NULL, &rc );
	if ( ((rc >> 16) != ((SASL_VERSION_MAJOR << 8)|SASL_VERSION_MINOR)) ||
		(rc & 0xffff) < SASL_VERSION_STEP) {

#ifdef NEW_LOGGING
		LDAP_LOG( TRANSPORT, INFO,
		"slap_sasl_init: SASL version mismatch, got %x, wanted %x.\n",
			rc, SASL_BUILD_VERSION, 0 );
#else
		Debug( LDAP_DEBUG_ANY,
		"slap_sasl_init: SASL version mismatch, got %x, wanted %x.\n",
			rc, SASL_BUILD_VERSION, 0 );
#endif
		return -1;
	}
#endif
1152
1153
1154

	/* SASL 2 does its own memory management internally */
#if SASL_VERSION_MAJOR < 2
1155
	sasl_set_alloc(
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1156
1157
1158
1159
		ber_memalloc,
		ber_memcalloc,
		ber_memrealloc,
		ber_memfree ); 
1160
#endif
1161
1162
1163
1164
1165
1166
1167

	sasl_set_mutex(
		ldap_pvt_sasl_mutex_new,
		ldap_pvt_sasl_mutex_lock,
		ldap_pvt_sasl_mutex_unlock,
		ldap_pvt_sasl_mutex_dispose );

1168
1169
1170
#if SASL_VERSION_MAJOR >= 2
	sasl_auxprop_add_plugin( "slapd", slap_auxprop_init );
#endif
1171
1172
1173
1174
1175
1176
	/* should provide callbacks for logging */
	/* server name should be configurable */
	rc = sasl_server_init( server_callbacks, "slapd" );

	if( rc != SASL_OK ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1177
		LDAP_LOG( TRANSPORT, INFO, "slap_sasl_init: init failed.\n", 0, 0, 0 );
1178
1179
1180
1181
#else
		Debug( LDAP_DEBUG_ANY, "sasl_server_init failed\n",
			0, 0, 0 );
#endif
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1182
1183
1184
1185
#if SASL_VERSION_MAJOR < 2
		/* A no-op used to make sure we linked with Cyrus 1.5 */
		sasl_client_auth( NULL, NULL, NULL, 0, NULL, NULL );
#endif
1186
1187
1188
1189
1190

		return -1;
	}

#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1191
	LDAP_LOG( TRANSPORT, INFO, "slap_sasl_init: initialized!\n", 0, 0, 0 );
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
#else
	Debug( LDAP_DEBUG_TRACE, "slap_sasl_init: initialized!\n",
		0, 0, 0 );
#endif


	/* default security properties */
	memset( &sasl_secprops, '\0', sizeof(sasl_secprops) );
	sasl_secprops.max_ssf = INT_MAX;
	sasl_secprops.maxbufsize = 65536;
	sasl_secprops.security_flags = SASL_SEC_NOPLAINTEXT|SASL_SEC_NOANONYMOUS;
#endif

	return 0;
}

int slap_sasl_destroy( void )
{
#ifdef HAVE_CYRUS_SASL
	sasl_done();
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1212
1213
1214
#endif
#if SASL_VERSION_MAJOR >= 2
	filter_free( generic_filter );
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
#endif
	free( global_host );
	global_host = NULL;

	return 0;
}

int slap_sasl_open( Connection *conn )
{
	int cb, sc = LDAP_SUCCESS;
#if SASL_VERSION_MAJOR >= 2
	char *ipremoteport = NULL, *iplocalport = NULL;
#endif

#ifdef HAVE_CYRUS_SASL
	sasl_conn_t *ctx = NULL;
	sasl_callback_t *session_callbacks;

	assert( conn->c_sasl_context == NULL );
	assert( conn->c_sasl_extra == NULL );

	conn->c_sasl_layers = 0;

	session_callbacks =
#if SASL_VERSION_MAJOR >= 2
1240
		SLAP_CALLOC( 5, sizeof(sasl_callback_t));
1241
#else
1242
		SLAP_CALLOC( 3, sizeof(sasl_callback_t));
1243
#endif
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
	if( session_callbacks == NULL ) {
#ifdef NEW_LOGGING
			LDAP_LOG( TRANSPORT, ERR, 
				"slap_sasl_open: SLAP_MALLOC failed", 0, 0, 0 );
#else
			Debug( LDAP_DEBUG_ANY, 
				"slap_sasl_open: SLAP_MALLOC failed", 0, 0, 0 );
#endif
			return -1;
	}
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
	conn->c_sasl_extra = session_callbacks;

	session_callbacks[cb=0].id = SASL_CB_LOG;
	session_callbacks[cb].proc = &slap_sasl_log;
	session_callbacks[cb++].context = conn;

	session_callbacks[cb].id = SASL_CB_PROXY_POLICY;
	session_callbacks[cb].proc = &slap_sasl_authorize;
	session_callbacks[cb++].context = conn;

#if SASL_VERSION_MAJOR >= 2
	session_callbacks[cb].id = SASL_CB_CANON_USER;
	session_callbacks[cb].proc = &slap_sasl_canonicalize;
	session_callbacks[cb++].context = conn;

	/* XXXX: this should be conditional */
	session_callbacks[cb].id = SASL_CB_SERVER_USERDB_CHECKPASS;
	session_callbacks[cb].proc = &slap_sasl_checkpass;
	session_callbacks[cb++].context = conn;
#endif

	session_callbacks[cb].id = SASL_CB_LIST_END;
	session_callbacks[cb].proc = NULL;
	session_callbacks[cb++].context = NULL;

	if( global_host == NULL ) {
		global_host = ldap_pvt_get_fqdn( NULL );
	}

	/* create new SASL context */
#if SASL_VERSION_MAJOR >= 2
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1285
1286
1287
	if ( generic_filter == NULL ) {
		generic_filter = str2filter( "(objectclass=*)" );
	}
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
	if ( conn->c_sock_name.bv_len != 0 &&
	     strncmp( conn->c_sock_name.bv_val, "IP=", 3 ) == 0) {
		char *p;

		iplocalport = ch_strdup( conn->c_sock_name.bv_val + 3 );
		/* Convert IPv6 addresses to address;port syntax. */
		p = strrchr( iplocalport, ' ' );
		/* Convert IPv4 addresses to address;port syntax. */
		if ( p == NULL ) p = strchr( iplocalport, ':' );
		if ( p != NULL ) {
			*p = ';';
		}
	}
	if ( conn->c_peer_name.bv_len != 0 &&
	     strncmp( conn->c_peer_name.bv_val, "IP=", 3 ) == 0) {
		char *p;

		ipremoteport = ch_strdup( conn->c_peer_name.bv_val + 3 );
		/* Convert IPv6 addresses to address;port syntax. */
		p = strrchr( ipremoteport, ' ' );
		/* Convert IPv4 addresses to address;port syntax. */
		if ( p == NULL ) p = strchr( ipremoteport, ':' );
		if ( p != NULL ) {
			*p = ';';
		}
	}
	sc = sasl_server_new( "ldap", global_host, global_realm,
1315
		iplocalport, ipremoteport, session_callbacks, SASL_SUCCESS_DATA, &ctx );
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
	if ( iplocalport != NULL ) {
		ch_free( iplocalport );
	}
	if ( ipremoteport != NULL ) {
		ch_free( ipremoteport );
	}
#else
	sc = sasl_server_new( "ldap", global_host, global_realm,
		session_callbacks, SASL_SECURITY_LAYER, &ctx );
#endif

	if( sc != SASL_OK ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1329
1330
		LDAP_LOG( TRANSPORT, ERR, 
			"slap_sasl_open: sasl_server_new failed: %d\n", sc, 0, 0 );
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
#else
		Debug( LDAP_DEBUG_ANY, "sasl_server_new failed: %d\n",
			sc, 0, 0 );
#endif

		return -1;
	}

	conn->c_sasl_context = ctx;

	if( sc == SASL_OK ) {
		sc = sasl_setprop( ctx,
			SASL_SEC_PROPS, &sasl_secprops );

		if( sc != SASL_OK ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1347
1348
			LDAP_LOG( TRANSPORT, ERR, 
				"slap_sasl_open: sasl_setprop failed: %d \n", sc, 0, 0 );
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
#else
			Debug( LDAP_DEBUG_ANY, "sasl_setprop failed: %d\n",
				sc, 0, 0 );
#endif

			slap_sasl_close( conn );
			return -1;
		}
	}

	sc = slap_sasl_err2ldap( sc );
#endif
	return sc;
}

int slap_sasl_external(
	Connection *conn,
	slap_ssf_t ssf,
	const char *auth_id )
{
#if SASL_VERSION_MAJOR >= 2
	int sc;
	sasl_conn_t *ctx = conn->c_sasl_context;

	if ( ctx == NULL ) {
		return LDAP_UNAVAILABLE;
	}

	sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL, &ssf );

	if ( sc != SASL_OK ) {
		return LDAP_OTHER;
	}

	sc = sasl_setprop( ctx, SASL_AUTH_EXTERNAL, auth_id );

	if ( sc != SASL_OK ) {
		return LDAP_OTHER;
	}

#elif defined(HAVE_CYRUS_SASL)
	int sc;
	sasl_conn_t *ctx = conn->c_sasl_context;
	sasl_external_properties_t extprops;

	if ( ctx == NULL ) {
		return LDAP_UNAVAILABLE;
	}

	memset( &extprops, '\0', sizeof(extprops) );
	extprops.ssf = ssf;
	extprops.auth_id = (char *) auth_id;

	sc = sasl_setprop( ctx, SASL_SSF_EXTERNAL,
		(void *) &extprops );

	if ( sc != SASL_OK ) {
		return LDAP_OTHER;
	}
#endif

	return LDAP_SUCCESS;
}

int slap_sasl_reset( Connection *conn )
{
#ifdef HAVE_CYRUS_SASL
	sasl_conn_t *ctx = conn->c_sasl_context;

	if( ctx != NULL ) {
	}
#endif
	/* must return "anonymous" */
	return LDAP_SUCCESS;
}

char ** slap_sasl_mechs( Connection *conn )
{
	char **mechs = NULL;

#ifdef HAVE_CYRUS_SASL
	sasl_conn_t *ctx = conn->c_sasl_context;

	if( ctx != NULL ) {
		int sc;
		SASL_CONST char *mechstr;

		sc = sasl_listmech( ctx,
			NULL, NULL, ",", NULL,
			&mechstr, NULL, NULL );

		if( sc != SASL_OK ) {
#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1442
1443
			LDAP_LOG( TRANSPORT, ERR, 
				"slap_sasl_mechs: sasl_listmech failed: %d\n", sc, 0, 0 );
1444
1445
1446
1447
1448
1449
1450
1451
#else
			Debug( LDAP_DEBUG_ANY, "slap_sasl_listmech failed: %d\n",
				sc, 0, 0 );
#endif

			return NULL;
		}

Kurt Zeilenga's avatar
Kurt Zeilenga committed
1452
		mechs = ldap_str2charray( mechstr, "," );
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499

#if SASL_VERSION_MAJOR < 2
		ch_free( mechstr );
#endif
	}
#endif

	return mechs;
}

int slap_sasl_close( Connection *conn )
{
#ifdef HAVE_CYRUS_SASL
	sasl_conn_t *ctx = conn->c_sasl_context;

	if( ctx != NULL ) {
		sasl_dispose( &ctx );
	}

	conn->c_sasl_context = NULL;

	free( conn->c_sasl_extra );
	conn->c_sasl_extra = NULL;
#endif

	return LDAP_SUCCESS;
}

int slap_sasl_bind(
    Connection		*conn,
    Operation		*op,  
    struct berval	*dn,  
    struct berval	*ndn,
    struct berval	*cred,
	struct berval			*edn,
	slap_ssf_t		*ssfp )
{
	int rc = 1;

#ifdef HAVE_CYRUS_SASL
	sasl_conn_t *ctx = conn->c_sasl_context;
	struct berval response;
	unsigned reslen = 0;
	const char *errstr = NULL;
	int sc;

#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1500
1501
	LDAP_LOG( TRANSPORT, ENTRY, 
		"sasl_bind: dn=\"%s\" mech=%s datalen=%ld\n",
1502
		dn->bv_len ? dn->bv_val : "",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1503
1504
1505
		conn->c_sasl_bind_in_progress ? "<continuing>" : 
		conn->c_sasl_bind_mech.bv_val,
		cred ? cred->bv_len : 0 );
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
#else
	Debug(LDAP_DEBUG_ARGS,
		"==> sasl_bind: dn=\"%s\" mech=%s datalen=%ld\n",
		dn->bv_len ? dn->bv_val : "",
		conn->c_sasl_bind_in_progress ? "<continuing>":conn->c_sasl_bind_mech.bv_val,
		cred ? cred->bv_len : 0 );
#endif


	if( ctx == NULL ) {
		send_ldap_result( conn, op, LDAP_UNAVAILABLE,
			NULL, "SASL unavailable on this session", NULL, NULL );
		return rc;
	}

#if SASL_VERSION_MAJOR >= 2
#define	START( ctx, mech, cred, clen, resp, rlen, err ) \
	sasl_server_start( ctx, mech, cred, clen, resp, rlen )
#define	STEP( ctx, cred, clen, resp, rlen, err ) \
	sasl_server_step( ctx, cred, clen, resp, rlen )
#else
#define	START( ctx, mech, cred, clen, resp, rlen, err ) \
	sasl_server_start( ctx, mech, cred, clen, resp, rlen, err )
#define	STEP( ctx, cred, clen, resp, rlen, err ) \
	sasl_server_step( ctx, cred, clen, resp, rlen, err )
#endif

	if ( !conn->c_sasl_bind_in_progress ) {
		sc = START( ctx,
			conn->c_sasl_bind_mech.bv_val,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1536
			cred->bv_val, cred->bv_len,
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
			(SASL_CONST char **)&response.bv_val, &reslen, &errstr );

	} else {
		sc = STEP( ctx,
			cred->bv_val, cred->bv_len,
			(SASL_CONST char **)&response.bv_val, &reslen, &errstr );
	}

	response.bv_len = reslen;

	if ( sc == SASL_OK ) {
1548
1549
		sasl_ssf_t *ssf = NULL;

Kurt Zeilenga's avatar
Kurt Zeilenga committed
1550
1551
1552
		*edn = conn->c_sasl_dn;
		conn->c_sasl_dn.bv_val = NULL;
		conn->c_sasl_dn.bv_len = 0;
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567

		rc = LDAP_SUCCESS;

		(void) sasl_getprop( ctx, SASL_SSF, (void *)&ssf );
		*ssfp = ssf ? *ssf : 0;

		if( *ssfp ) {
			ldap_pvt_thread_mutex_lock( &conn->c_mutex );
			conn->c_sasl_layers++;
			ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
		}

		send_ldap_sasl( conn, op, rc,
			NULL, NULL, NULL, NULL,
			response.bv_len ? &response : NULL );
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587

	} else if ( sc == SASL_CONTINUE ) {
		send_ldap_sasl( conn, op, rc = LDAP_SASL_BIND_IN_PROGRESS,
			NULL, NULL, NULL, NULL, &response );

	} else {
#if SASL_VERSION_MAJOR >= 2
		errstr = sasl_errdetail( ctx );
#endif
		send_ldap_result( conn, op, rc = slap_sasl_err2ldap( sc ),
			NULL, errstr, NULL, NULL );
	}

#if SASL_VERSION_MAJOR < 2
	if( response.bv_len ) {
		ch_free( response.bv_val );
	}
#endif

#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1588
	LDAP_LOG( TRANSPORT, RESULTS, "slap_sasl_bind: rc=%d\n", rc, 0, 0 );
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
#else
	Debug(LDAP_DEBUG_TRACE, "<== slap_sasl_bind: rc=%d\n", rc, 0, 0);
#endif


#else
	send_ldap_result( conn, op, rc = LDAP_UNAVAILABLE,
		NULL, "SASL not supported", NULL, NULL );
#endif

	return rc;
}

char* slap_sasl_secprops( const char *in )
{
#ifdef HAVE_CYRUS_SASL
	int rc = ldap_pvt_sasl_secprops( in, &sasl_secprops );

	return rc == LDAP_SUCCESS ? NULL : "Invalid security properties";
#else
	return "SASL not supported";
#endif
}
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642

#ifdef HAVE_CYRUS_SASL
int
slap_sasl_setpass(
	Connection      *conn,
	Operation       *op,
	const char      *reqoid,
	struct berval   *reqdata,
	char            **rspoid,
	struct berval   **rspdata,
	LDAPControl     *** rspctrls,
	const char      **text )
{
	int rc;
	struct berval id = { 0, NULL };	/* needs to come from connection */
	struct berval new = { 0, NULL };
	struct berval old = { 0, NULL };

	assert( reqoid != NULL );
	assert( strcmp( LDAP_EXOP_MODIFY_PASSWD, reqoid ) == 0 );

	rc = sasl_getprop( conn->c_sasl_context, SASL_USERNAME,
		(SASL_CONST void **)&id.bv_val );

	if( rc != SASL_OK ) {
		*text = "unable to retrieve SASL username";
		rc = LDAP_OTHER;
		goto done;
	}

#ifdef NEW_LOGGING
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1643
	LDAP_LOG( BACKEND, ENTRY,
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1644
		"slap_sasl_setpass: \"%s\"\n",
Kurt Zeilenga's avatar
Kurt Zeilenga committed
1645
		id.bv_val ? id.bv_val : "", 0, 0);