1 /*
2 * Copyright 2002-2003 Sun Microsystems, Inc. All rights reserved.
3 * Use is subject to license terms.
4 */
5
6 #pragma ident "%Z%%M% %I% %E% SMI"
7
8 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
9 *
10 * The contents of this file are subject to the Netscape Public License
11 * Version 1.0 (the "NPL"); you may not use this file except in
12 * compliance with the NPL. You may obtain a copy of the NPL at
13 * http://www.mozilla.org/NPL/
14 *
15 * Software distributed under the NPL is distributed on an "AS IS" basis,
16 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the NPL
17 * for the specific language governing rights and limitations under the
18 * NPL.
19 *
20 * The Initial Developer of the Original Code is Netscape
21 * Communications Corporation. Portions created by Netscape are
22 * Copyright (C) 1998-1999 Netscape Communications Corporation. All
23 * Rights Reserved.
24 *
25 * Contributor(s):
26 */
27 #include "ldap-int.h"
28
29 /*
30 * ldap_sasl_bind - authenticate to the ldap server. The dn, mechanism,
31 * and credentials of the entry to which to bind are supplied. An LDAP
32 * error code is returned and if LDAP_SUCCESS is returned *msgidp is set
33 * to the id of the request initiated.
34 *
35 * Example:
36 * struct berval creds;
37 * LDAPControl **ctrls;
38 * int err, msgid;
39 * ... fill in creds with credentials ...
40 * ... fill in ctrls with server controls ...
41 * err = ldap_sasl_bind( ld, "cn=manager, o=university of michigan, c=us",
42 * "mechanismname", &creds, ctrls, NULL, &msgid );
43 */
44 int
45 LDAP_CALL
ldap_sasl_bind(LDAP * ld,const char * dn,const char * mechanism,const struct berval * cred,LDAPControl ** serverctrls,LDAPControl ** clientctrls,int * msgidp)46 ldap_sasl_bind(
47 LDAP *ld,
48 const char *dn,
49 const char *mechanism,
50 const struct berval *cred,
51 LDAPControl **serverctrls,
52 LDAPControl **clientctrls,
53 int *msgidp
54 )
55 {
56 BerElement *ber;
57 int rc, simple, msgid, ldapversion;
58
59 /*
60 * The ldapv3 bind request looks like this:
61 * BindRequest ::= SEQUENCE {
62 * version INTEGER,
63 * name DistinguishedName, -- who
64 * authentication CHOICE {
65 * simple [0] OCTET STRING, -- passwd
66 * sasl [3] SaslCredentials -- v3 only
67 * }
68 * }
69 * SaslCredentials ::= SEQUENCE {
70 * mechanism LDAPString,
71 * credentials OCTET STRING
72 * }
73 * all wrapped up in an LDAPMessage sequence.
74 */
75
76 LDAPDebug( LDAP_DEBUG_TRACE, "ldap_sasl_bind\n", 0, 0, 0 );
77
78 if ( msgidp == NULL ) {
79 LDAP_SET_LDERRNO( ld, LDAP_PARAM_ERROR, NULL, NULL );
80 return( LDAP_PARAM_ERROR );
81 }
82
83 simple = ( mechanism == LDAP_SASL_SIMPLE );
84 ldapversion = NSLDAPI_LDAP_VERSION( ld );
85
86 /* only ldapv3 or higher can do sasl binds */
87 if ( !simple && ldapversion < LDAP_VERSION3 ) {
88 LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
89 return( LDAP_NOT_SUPPORTED );
90 }
91
92 LDAP_MUTEX_LOCK( ld, LDAP_MSGID_LOCK );
93 msgid = ++ld->ld_msgid;
94 LDAP_MUTEX_UNLOCK( ld, LDAP_MSGID_LOCK );
95
96 if ( dn == NULL )
97 dn = "";
98
99 if ( ld->ld_cache_on && ld->ld_cache_bind != NULL ) {
100 LDAP_MUTEX_LOCK( ld, LDAP_CACHE_LOCK );
101 if ( (rc = (ld->ld_cache_bind)( ld, msgid, LDAP_REQ_BIND, dn,
102 cred, LDAP_AUTH_SASL )) != 0 ) {
103 *msgidp = rc;
104 LDAP_MUTEX_UNLOCK( ld, LDAP_CACHE_LOCK );
105 return( LDAP_SUCCESS );
106 }
107 LDAP_MUTEX_UNLOCK( ld, LDAP_CACHE_LOCK );
108 }
109
110 /* create a message to send */
111 if (( rc = nsldapi_alloc_ber_with_options( ld, &ber ))
112 != LDAP_SUCCESS ) {
113 return( rc );
114 }
115
116 /* fill it in */
117 if ( simple ) { /* simple bind; works in LDAPv2 or v3 */
118 struct berval tmpcred;
119
120 if ( cred == NULL ) {
121 tmpcred.bv_val = "";
122 tmpcred.bv_len = 0;
123 cred = &tmpcred;
124 }
125 rc = ber_printf( ber, "{it{isto}", msgid, LDAP_REQ_BIND,
126 ldapversion, dn, LDAP_AUTH_SIMPLE, cred->bv_val,
127 (int)cred->bv_len /* XXX lossy cast */ );
128
129 } else { /* SASL bind; requires LDAPv3 or better */
130 if ( cred == NULL ) {
131 rc = ber_printf( ber, "{it{ist{s}}", msgid,
132 LDAP_REQ_BIND, ldapversion, dn, LDAP_AUTH_SASL,
133 mechanism );
134 } else {
135 rc = ber_printf( ber, "{it{ist{so}}", msgid,
136 LDAP_REQ_BIND, ldapversion, dn, LDAP_AUTH_SASL,
137 mechanism, cred->bv_val,
138 (int)cred->bv_len /* XXX lossy cast */ );
139 }
140 }
141
142 if ( rc == -1 ) {
143 LDAP_SET_LDERRNO( ld, LDAP_ENCODING_ERROR, NULL, NULL );
144 ber_free( ber, 1 );
145 return( LDAP_ENCODING_ERROR );
146 }
147
148 if ( (rc = nsldapi_put_controls( ld, serverctrls, 1, ber ))
149 != LDAP_SUCCESS ) {
150 ber_free( ber, 1 );
151 return( rc );
152 }
153
154 /* send the message */
155 rc = nsldapi_send_initial_request( ld, msgid, LDAP_REQ_BIND,
156 (char *)dn, ber );
157 *msgidp = rc;
158 return( rc < 0 ? LDAP_GET_LDERRNO( ld, NULL, NULL ) : LDAP_SUCCESS );
159 }
160
161 /*
162 * ldap_sasl_bind_s - bind to the ldap server using sasl authentication
163 * The dn, mechanism, and credentials of the entry to which to bind are
164 * supplied. LDAP_SUCCESS is returned upon success, the ldap error code
165 * otherwise.
166 *
167 * Example:
168 * struct berval creds;
169 * ... fill in creds with credentials ...
170 * ldap_sasl_bind_s( ld, "cn=manager, o=university of michigan, c=us",
171 * "mechanismname", &creds )
172 */
173 int
174 LDAP_CALL
ldap_sasl_bind_s(LDAP * ld,const char * dn,const char * mechanism,const struct berval * cred,LDAPControl ** serverctrls,LDAPControl ** clientctrls,struct berval ** servercredp)175 ldap_sasl_bind_s(
176 LDAP *ld,
177 const char *dn,
178 const char *mechanism,
179 const struct berval *cred,
180 LDAPControl **serverctrls,
181 LDAPControl **clientctrls,
182 struct berval **servercredp
183 )
184 {
185 int err, msgid;
186 LDAPMessage *result;
187
188 LDAPDebug( LDAP_DEBUG_TRACE, "ldap_sasl_bind_s\n", 0, 0, 0 );
189
190 if ( NSLDAPI_LDAP_VERSION( ld ) < LDAP_VERSION3 ) {
191 LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
192 return( LDAP_NOT_SUPPORTED );
193 }
194
195 if ( ( err = ldap_sasl_bind( ld, dn, mechanism, cred, serverctrls,
196 clientctrls, &msgid )) != LDAP_SUCCESS )
197 return( err );
198
199 if ( ldap_result( ld, msgid, 1, (struct timeval *) 0, &result ) == -1 )
200 return( LDAP_GET_LDERRNO( ld, NULL, NULL ) );
201
202 err = ldap_parse_sasl_bind_result( ld, result, servercredp, 0 );
203 if (err != LDAP_SUCCESS && err != LDAP_SASL_BIND_IN_PROGRESS) {
204 ldap_msgfree( result );
205 return( err );
206 }
207
208 return( ldap_result2error( ld, result, 1 ) );
209 }
210
211
212 /* returns an LDAP error code that indicates if parse succeeded or not */
213 int
214 LDAP_CALL
ldap_parse_sasl_bind_result(LDAP * ld,LDAPMessage * res,struct berval ** servercredp,int freeit)215 ldap_parse_sasl_bind_result(
216 LDAP *ld,
217 LDAPMessage *res,
218 struct berval **servercredp,
219 int freeit
220 )
221 {
222 BerElement ber;
223 int rc, err;
224 ber_int_t along;
225 ber_len_t len;
226 char *m, *e;
227
228 LDAPDebug( LDAP_DEBUG_TRACE, "ldap_parse_sasl_bind_result\n", 0, 0, 0 );
229
230 /*
231 * the ldapv3 SASL bind response looks like this:
232 *
233 * BindResponse ::= [APPLICATION 1] SEQUENCE {
234 * COMPONENTS OF LDAPResult,
235 * serverSaslCreds [7] OCTET STRING OPTIONAL
236 * }
237 *
238 * all wrapped up in an LDAPMessage sequence.
239 */
240
241 if ( !NSLDAPI_VALID_LDAP_POINTER( ld ) ||
242 !NSLDAPI_VALID_LDAPMESSAGE_BINDRESULT_POINTER( res )) {
243 return( LDAP_PARAM_ERROR );
244 }
245
246 /* only ldapv3 or higher can do sasl binds */
247 if ( NSLDAPI_LDAP_VERSION( ld ) < LDAP_VERSION3 ) {
248 LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
249 return( LDAP_NOT_SUPPORTED );
250 }
251
252 if ( servercredp != NULL ) {
253 *servercredp = NULL;
254 }
255
256 ber = *(res->lm_ber); /* struct copy */
257
258 /* skip past message id, matched dn, error message ... */
259 rc = ber_scanf( &ber, "{iaa}", &along, &m, &e );
260
261 if ( rc != LBER_ERROR &&
262 ber_peek_tag( &ber, &len ) == LDAP_TAG_SASL_RES_CREDS ) {
263 rc = ber_get_stringal( &ber, servercredp );
264 }
265
266 if ( freeit ) {
267 ldap_msgfree( res );
268 }
269
270 if ( rc == LBER_ERROR ) {
271 err = LDAP_DECODING_ERROR;
272 } else {
273 err = (int) along;
274 }
275
276 LDAP_SET_LDERRNO( ld, err, m, e );
277 /* this is a little kludge for the 3.0 Barracuda/hammerhead relese */
278 /* the docs state that the return is either LDAP_DECODING_ERROR */
279 /* or LDAP_SUCCESS. Here we match the docs... it's cleaner in 3.1 */
280
281 if ( LDAP_DECODING_ERROR == err ) {
282 return (LDAP_DECODING_ERROR);
283 } else {
284 return( LDAP_SUCCESS );
285 }
286 }
287