xref: /netbsd-src/external/bsd/openldap/dist/servers/slapd/slapauth.c (revision 549b59ed3ccf0d36d3097190a0db27b770f3a839)
1 /*	$NetBSD: slapauth.c,v 1.3 2021/08/14 16:14:58 christos Exp $	*/
2 
3 /* $OpenLDAP$ */
4 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5  *
6  * Copyright 2004-2021 The OpenLDAP Foundation.
7  * Portions Copyright 2004 Pierangelo Masarati.
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted only as authorized by the OpenLDAP
12  * Public License.
13  *
14  * A copy of this license is available in file LICENSE in the
15  * top-level directory of the distribution or, alternatively, at
16  * <http://www.OpenLDAP.org/license.html>.
17  */
18 /* ACKNOWLEDGEMENTS:
19  * This work was initially developed by Pierangelo Masarati for inclusion
20  * in OpenLDAP Software.
21  */
22 
23 #include <sys/cdefs.h>
24 __RCSID("$NetBSD: slapauth.c,v 1.3 2021/08/14 16:14:58 christos Exp $");
25 
26 #include "portable.h"
27 
28 #include <stdio.h>
29 
30 #include <ac/stdlib.h>
31 
32 #include <ac/ctype.h>
33 #include <ac/string.h>
34 #include <ac/socket.h>
35 #include <ac/unistd.h>
36 
37 #include <lber.h>
38 #include <ldif.h>
39 #include <lutil.h>
40 
41 #include "slapcommon.h"
42 
43 static int
do_check(Connection * c,Operation * op,struct berval * id)44 do_check( Connection *c, Operation *op, struct berval *id )
45 {
46 	struct berval	authcdn;
47 	int		rc;
48 
49 	rc = slap_sasl_getdn( c, op, id, realm, &authcdn, SLAP_GETDN_AUTHCID );
50 	if ( rc != LDAP_SUCCESS ) {
51 		fprintf( stderr, "ID: <%s> check failed %d (%s)\n",
52 				id->bv_val, rc,
53 				ldap_err2string( rc ) );
54 		rc = 1;
55 
56 	} else {
57 		if ( !BER_BVISNULL( &authzID ) ) {
58 			rc = slap_sasl_authorized( op, &authcdn, &authzID );
59 
60 			fprintf( stderr,
61 					"ID:      <%s>\n"
62 					"authcDN: <%s>\n"
63 					"authzDN: <%s>\n"
64 					"authorization %s\n",
65 					id->bv_val,
66 					authcdn.bv_val,
67 					authzID.bv_val,
68 					rc == LDAP_SUCCESS ? "OK" : "failed" );
69 
70 		} else {
71 			fprintf( stderr, "ID: <%s> check succeeded\n"
72 					"authcID:     <%s>\n",
73 					id->bv_val,
74 					authcdn.bv_val );
75 			op->o_tmpfree( authcdn.bv_val, op->o_tmpmemctx );
76 		}
77 		rc = 0;
78 	}
79 
80 	return rc;
81 }
82 
83 int
slapauth(int argc,char ** argv)84 slapauth( int argc, char **argv )
85 {
86 	int			rc = EXIT_SUCCESS;
87 	const char		*progname = "slapauth";
88 	Connection		conn = {0};
89 	OperationBuffer	opbuf;
90 	Operation		*op;
91 	void			*thrctx;
92 
93 	slap_tool_init( progname, SLAPAUTH, argc, argv );
94 
95 	argv = &argv[ optind ];
96 	argc -= optind;
97 
98 	thrctx = ldap_pvt_thread_pool_context();
99 	connection_fake_init( &conn, &opbuf, thrctx );
100 	op = &opbuf.ob_op;
101 
102 	conn.c_sasl_bind_mech = mech;
103 
104 	if ( !BER_BVISNULL( &authzID ) ) {
105 		struct berval	authzdn;
106 
107 		rc = slap_sasl_getdn( &conn, op, &authzID, NULL, &authzdn,
108 				SLAP_GETDN_AUTHZID );
109 		if ( rc != LDAP_SUCCESS ) {
110 			fprintf( stderr, "authzID: <%s> check failed %d (%s)\n",
111 					authzID.bv_val, rc,
112 					ldap_err2string( rc ) );
113 			rc = 1;
114 			BER_BVZERO( &authzID );
115 			goto destroy;
116 		}
117 
118 		authzID = authzdn;
119 	}
120 
121 
122 	if ( !BER_BVISNULL( &authcID ) ) {
123 		if ( !BER_BVISNULL( &authzID ) || argc == 0 ) {
124 			rc = do_check( &conn, op, &authcID );
125 			goto destroy;
126 		}
127 
128 		for ( ; argc--; argv++ ) {
129 			struct berval	authzdn;
130 
131 			ber_str2bv( argv[ 0 ], 0, 0, &authzID );
132 
133 			rc = slap_sasl_getdn( &conn, op, &authzID, NULL, &authzdn,
134 					SLAP_GETDN_AUTHZID );
135 			if ( rc != LDAP_SUCCESS ) {
136 				fprintf( stderr, "authzID: <%s> check failed %d (%s)\n",
137 						authzID.bv_val, rc,
138 						ldap_err2string( rc ) );
139 				rc = -1;
140 				BER_BVZERO( &authzID );
141 				if ( !continuemode ) {
142 					goto destroy;
143 				}
144 			}
145 
146 			authzID = authzdn;
147 
148 			rc = do_check( &conn, op, &authcID );
149 
150 			op->o_tmpfree( authzID.bv_val, op->o_tmpmemctx );
151 			BER_BVZERO( &authzID );
152 
153 			if ( rc && !continuemode ) {
154 				goto destroy;
155 			}
156 		}
157 
158 		goto destroy;
159 	}
160 
161 	for ( ; argc--; argv++ ) {
162 		struct berval	id;
163 
164 		ber_str2bv( argv[ 0 ], 0, 0, &id );
165 
166 		rc = do_check( &conn, op, &id );
167 
168 		if ( rc && !continuemode ) {
169 			goto destroy;
170 		}
171 	}
172 
173 destroy:;
174 	if ( !BER_BVISNULL( &authzID ) ) {
175 		op->o_tmpfree( authzID.bv_val, op->o_tmpmemctx );
176 	}
177 	if ( slap_tool_destroy())
178 		rc = EXIT_FAILURE;
179 
180 	return rc;
181 }
182 
183