1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * Copyright 2002-2003 Sun Microsystems, Inc. All rights reserved.
3*0Sstevel@tonic-gate * Use is subject to license terms.
4*0Sstevel@tonic-gate */
5*0Sstevel@tonic-gate
6*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI"
7*0Sstevel@tonic-gate
8*0Sstevel@tonic-gate /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
9*0Sstevel@tonic-gate *
10*0Sstevel@tonic-gate * The contents of this file are subject to the Netscape Public License
11*0Sstevel@tonic-gate * Version 1.0 (the "NPL"); you may not use this file except in
12*0Sstevel@tonic-gate * compliance with the NPL. You may obtain a copy of the NPL at
13*0Sstevel@tonic-gate * http://www.mozilla.org/NPL/
14*0Sstevel@tonic-gate *
15*0Sstevel@tonic-gate * Software distributed under the NPL is distributed on an "AS IS" basis,
16*0Sstevel@tonic-gate * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the NPL
17*0Sstevel@tonic-gate * for the specific language governing rights and limitations under the
18*0Sstevel@tonic-gate * NPL.
19*0Sstevel@tonic-gate *
20*0Sstevel@tonic-gate * The Initial Developer of the Original Code is Netscape
21*0Sstevel@tonic-gate * Communications Corporation. Portions created by Netscape are
22*0Sstevel@tonic-gate * Copyright (C) 1998-1999 Netscape Communications Corporation. All
23*0Sstevel@tonic-gate * Rights Reserved.
24*0Sstevel@tonic-gate *
25*0Sstevel@tonic-gate * Contributor(s):
26*0Sstevel@tonic-gate */
27*0Sstevel@tonic-gate #include "ldap-int.h"
28*0Sstevel@tonic-gate
29*0Sstevel@tonic-gate /*
30*0Sstevel@tonic-gate * ldap_sasl_bind - authenticate to the ldap server. The dn, mechanism,
31*0Sstevel@tonic-gate * and credentials of the entry to which to bind are supplied. An LDAP
32*0Sstevel@tonic-gate * error code is returned and if LDAP_SUCCESS is returned *msgidp is set
33*0Sstevel@tonic-gate * to the id of the request initiated.
34*0Sstevel@tonic-gate *
35*0Sstevel@tonic-gate * Example:
36*0Sstevel@tonic-gate * struct berval creds;
37*0Sstevel@tonic-gate * LDAPControl **ctrls;
38*0Sstevel@tonic-gate * int err, msgid;
39*0Sstevel@tonic-gate * ... fill in creds with credentials ...
40*0Sstevel@tonic-gate * ... fill in ctrls with server controls ...
41*0Sstevel@tonic-gate * err = ldap_sasl_bind( ld, "cn=manager, o=university of michigan, c=us",
42*0Sstevel@tonic-gate * "mechanismname", &creds, ctrls, NULL, &msgid );
43*0Sstevel@tonic-gate */
44*0Sstevel@tonic-gate int
45*0Sstevel@tonic-gate LDAP_CALL
ldap_sasl_bind(LDAP * ld,const char * dn,const char * mechanism,const struct berval * cred,LDAPControl ** serverctrls,LDAPControl ** clientctrls,int * msgidp)46*0Sstevel@tonic-gate ldap_sasl_bind(
47*0Sstevel@tonic-gate LDAP *ld,
48*0Sstevel@tonic-gate const char *dn,
49*0Sstevel@tonic-gate const char *mechanism,
50*0Sstevel@tonic-gate const struct berval *cred,
51*0Sstevel@tonic-gate LDAPControl **serverctrls,
52*0Sstevel@tonic-gate LDAPControl **clientctrls,
53*0Sstevel@tonic-gate int *msgidp
54*0Sstevel@tonic-gate )
55*0Sstevel@tonic-gate {
56*0Sstevel@tonic-gate BerElement *ber;
57*0Sstevel@tonic-gate int rc, simple, msgid, ldapversion;
58*0Sstevel@tonic-gate
59*0Sstevel@tonic-gate /*
60*0Sstevel@tonic-gate * The ldapv3 bind request looks like this:
61*0Sstevel@tonic-gate * BindRequest ::= SEQUENCE {
62*0Sstevel@tonic-gate * version INTEGER,
63*0Sstevel@tonic-gate * name DistinguishedName, -- who
64*0Sstevel@tonic-gate * authentication CHOICE {
65*0Sstevel@tonic-gate * simple [0] OCTET STRING, -- passwd
66*0Sstevel@tonic-gate * sasl [3] SaslCredentials -- v3 only
67*0Sstevel@tonic-gate * }
68*0Sstevel@tonic-gate * }
69*0Sstevel@tonic-gate * SaslCredentials ::= SEQUENCE {
70*0Sstevel@tonic-gate * mechanism LDAPString,
71*0Sstevel@tonic-gate * credentials OCTET STRING
72*0Sstevel@tonic-gate * }
73*0Sstevel@tonic-gate * all wrapped up in an LDAPMessage sequence.
74*0Sstevel@tonic-gate */
75*0Sstevel@tonic-gate
76*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "ldap_sasl_bind\n", 0, 0, 0 );
77*0Sstevel@tonic-gate
78*0Sstevel@tonic-gate if ( msgidp == NULL ) {
79*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_PARAM_ERROR, NULL, NULL );
80*0Sstevel@tonic-gate return( LDAP_PARAM_ERROR );
81*0Sstevel@tonic-gate }
82*0Sstevel@tonic-gate
83*0Sstevel@tonic-gate simple = ( mechanism == LDAP_SASL_SIMPLE );
84*0Sstevel@tonic-gate ldapversion = NSLDAPI_LDAP_VERSION( ld );
85*0Sstevel@tonic-gate
86*0Sstevel@tonic-gate /* only ldapv3 or higher can do sasl binds */
87*0Sstevel@tonic-gate if ( !simple && ldapversion < LDAP_VERSION3 ) {
88*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
89*0Sstevel@tonic-gate return( LDAP_NOT_SUPPORTED );
90*0Sstevel@tonic-gate }
91*0Sstevel@tonic-gate
92*0Sstevel@tonic-gate LDAP_MUTEX_LOCK( ld, LDAP_MSGID_LOCK );
93*0Sstevel@tonic-gate msgid = ++ld->ld_msgid;
94*0Sstevel@tonic-gate LDAP_MUTEX_UNLOCK( ld, LDAP_MSGID_LOCK );
95*0Sstevel@tonic-gate
96*0Sstevel@tonic-gate if ( dn == NULL )
97*0Sstevel@tonic-gate dn = "";
98*0Sstevel@tonic-gate
99*0Sstevel@tonic-gate if ( ld->ld_cache_on && ld->ld_cache_bind != NULL ) {
100*0Sstevel@tonic-gate LDAP_MUTEX_LOCK( ld, LDAP_CACHE_LOCK );
101*0Sstevel@tonic-gate if ( (rc = (ld->ld_cache_bind)( ld, msgid, LDAP_REQ_BIND, dn,
102*0Sstevel@tonic-gate cred, LDAP_AUTH_SASL )) != 0 ) {
103*0Sstevel@tonic-gate *msgidp = rc;
104*0Sstevel@tonic-gate LDAP_MUTEX_UNLOCK( ld, LDAP_CACHE_LOCK );
105*0Sstevel@tonic-gate return( LDAP_SUCCESS );
106*0Sstevel@tonic-gate }
107*0Sstevel@tonic-gate LDAP_MUTEX_UNLOCK( ld, LDAP_CACHE_LOCK );
108*0Sstevel@tonic-gate }
109*0Sstevel@tonic-gate
110*0Sstevel@tonic-gate /* create a message to send */
111*0Sstevel@tonic-gate if (( rc = nsldapi_alloc_ber_with_options( ld, &ber ))
112*0Sstevel@tonic-gate != LDAP_SUCCESS ) {
113*0Sstevel@tonic-gate return( rc );
114*0Sstevel@tonic-gate }
115*0Sstevel@tonic-gate
116*0Sstevel@tonic-gate /* fill it in */
117*0Sstevel@tonic-gate if ( simple ) { /* simple bind; works in LDAPv2 or v3 */
118*0Sstevel@tonic-gate struct berval tmpcred;
119*0Sstevel@tonic-gate
120*0Sstevel@tonic-gate if ( cred == NULL ) {
121*0Sstevel@tonic-gate tmpcred.bv_val = "";
122*0Sstevel@tonic-gate tmpcred.bv_len = 0;
123*0Sstevel@tonic-gate cred = &tmpcred;
124*0Sstevel@tonic-gate }
125*0Sstevel@tonic-gate rc = ber_printf( ber, "{it{isto}", msgid, LDAP_REQ_BIND,
126*0Sstevel@tonic-gate ldapversion, dn, LDAP_AUTH_SIMPLE, cred->bv_val,
127*0Sstevel@tonic-gate (int)cred->bv_len /* XXX lossy cast */ );
128*0Sstevel@tonic-gate
129*0Sstevel@tonic-gate } else { /* SASL bind; requires LDAPv3 or better */
130*0Sstevel@tonic-gate if ( cred == NULL ) {
131*0Sstevel@tonic-gate rc = ber_printf( ber, "{it{ist{s}}", msgid,
132*0Sstevel@tonic-gate LDAP_REQ_BIND, ldapversion, dn, LDAP_AUTH_SASL,
133*0Sstevel@tonic-gate mechanism );
134*0Sstevel@tonic-gate } else {
135*0Sstevel@tonic-gate rc = ber_printf( ber, "{it{ist{so}}", msgid,
136*0Sstevel@tonic-gate LDAP_REQ_BIND, ldapversion, dn, LDAP_AUTH_SASL,
137*0Sstevel@tonic-gate mechanism, cred->bv_val,
138*0Sstevel@tonic-gate (int)cred->bv_len /* XXX lossy cast */ );
139*0Sstevel@tonic-gate }
140*0Sstevel@tonic-gate }
141*0Sstevel@tonic-gate
142*0Sstevel@tonic-gate if ( rc == -1 ) {
143*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_ENCODING_ERROR, NULL, NULL );
144*0Sstevel@tonic-gate ber_free( ber, 1 );
145*0Sstevel@tonic-gate return( LDAP_ENCODING_ERROR );
146*0Sstevel@tonic-gate }
147*0Sstevel@tonic-gate
148*0Sstevel@tonic-gate if ( (rc = nsldapi_put_controls( ld, serverctrls, 1, ber ))
149*0Sstevel@tonic-gate != LDAP_SUCCESS ) {
150*0Sstevel@tonic-gate ber_free( ber, 1 );
151*0Sstevel@tonic-gate return( rc );
152*0Sstevel@tonic-gate }
153*0Sstevel@tonic-gate
154*0Sstevel@tonic-gate /* send the message */
155*0Sstevel@tonic-gate rc = nsldapi_send_initial_request( ld, msgid, LDAP_REQ_BIND,
156*0Sstevel@tonic-gate (char *)dn, ber );
157*0Sstevel@tonic-gate *msgidp = rc;
158*0Sstevel@tonic-gate return( rc < 0 ? LDAP_GET_LDERRNO( ld, NULL, NULL ) : LDAP_SUCCESS );
159*0Sstevel@tonic-gate }
160*0Sstevel@tonic-gate
161*0Sstevel@tonic-gate /*
162*0Sstevel@tonic-gate * ldap_sasl_bind_s - bind to the ldap server using sasl authentication
163*0Sstevel@tonic-gate * The dn, mechanism, and credentials of the entry to which to bind are
164*0Sstevel@tonic-gate * supplied. LDAP_SUCCESS is returned upon success, the ldap error code
165*0Sstevel@tonic-gate * otherwise.
166*0Sstevel@tonic-gate *
167*0Sstevel@tonic-gate * Example:
168*0Sstevel@tonic-gate * struct berval creds;
169*0Sstevel@tonic-gate * ... fill in creds with credentials ...
170*0Sstevel@tonic-gate * ldap_sasl_bind_s( ld, "cn=manager, o=university of michigan, c=us",
171*0Sstevel@tonic-gate * "mechanismname", &creds )
172*0Sstevel@tonic-gate */
173*0Sstevel@tonic-gate int
174*0Sstevel@tonic-gate LDAP_CALL
ldap_sasl_bind_s(LDAP * ld,const char * dn,const char * mechanism,const struct berval * cred,LDAPControl ** serverctrls,LDAPControl ** clientctrls,struct berval ** servercredp)175*0Sstevel@tonic-gate ldap_sasl_bind_s(
176*0Sstevel@tonic-gate LDAP *ld,
177*0Sstevel@tonic-gate const char *dn,
178*0Sstevel@tonic-gate const char *mechanism,
179*0Sstevel@tonic-gate const struct berval *cred,
180*0Sstevel@tonic-gate LDAPControl **serverctrls,
181*0Sstevel@tonic-gate LDAPControl **clientctrls,
182*0Sstevel@tonic-gate struct berval **servercredp
183*0Sstevel@tonic-gate )
184*0Sstevel@tonic-gate {
185*0Sstevel@tonic-gate int err, msgid;
186*0Sstevel@tonic-gate LDAPMessage *result;
187*0Sstevel@tonic-gate
188*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "ldap_sasl_bind_s\n", 0, 0, 0 );
189*0Sstevel@tonic-gate
190*0Sstevel@tonic-gate if ( NSLDAPI_LDAP_VERSION( ld ) < LDAP_VERSION3 ) {
191*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
192*0Sstevel@tonic-gate return( LDAP_NOT_SUPPORTED );
193*0Sstevel@tonic-gate }
194*0Sstevel@tonic-gate
195*0Sstevel@tonic-gate if ( ( err = ldap_sasl_bind( ld, dn, mechanism, cred, serverctrls,
196*0Sstevel@tonic-gate clientctrls, &msgid )) != LDAP_SUCCESS )
197*0Sstevel@tonic-gate return( err );
198*0Sstevel@tonic-gate
199*0Sstevel@tonic-gate if ( ldap_result( ld, msgid, 1, (struct timeval *) 0, &result ) == -1 )
200*0Sstevel@tonic-gate return( LDAP_GET_LDERRNO( ld, NULL, NULL ) );
201*0Sstevel@tonic-gate
202*0Sstevel@tonic-gate err = ldap_parse_sasl_bind_result( ld, result, servercredp, 0 );
203*0Sstevel@tonic-gate if (err != LDAP_SUCCESS && err != LDAP_SASL_BIND_IN_PROGRESS) {
204*0Sstevel@tonic-gate ldap_msgfree( result );
205*0Sstevel@tonic-gate return( err );
206*0Sstevel@tonic-gate }
207*0Sstevel@tonic-gate
208*0Sstevel@tonic-gate return( ldap_result2error( ld, result, 1 ) );
209*0Sstevel@tonic-gate }
210*0Sstevel@tonic-gate
211*0Sstevel@tonic-gate
212*0Sstevel@tonic-gate /* returns an LDAP error code that indicates if parse succeeded or not */
213*0Sstevel@tonic-gate int
214*0Sstevel@tonic-gate LDAP_CALL
ldap_parse_sasl_bind_result(LDAP * ld,LDAPMessage * res,struct berval ** servercredp,int freeit)215*0Sstevel@tonic-gate ldap_parse_sasl_bind_result(
216*0Sstevel@tonic-gate LDAP *ld,
217*0Sstevel@tonic-gate LDAPMessage *res,
218*0Sstevel@tonic-gate struct berval **servercredp,
219*0Sstevel@tonic-gate int freeit
220*0Sstevel@tonic-gate )
221*0Sstevel@tonic-gate {
222*0Sstevel@tonic-gate BerElement ber;
223*0Sstevel@tonic-gate int rc, err;
224*0Sstevel@tonic-gate ber_int_t along;
225*0Sstevel@tonic-gate ber_len_t len;
226*0Sstevel@tonic-gate char *m, *e;
227*0Sstevel@tonic-gate
228*0Sstevel@tonic-gate LDAPDebug( LDAP_DEBUG_TRACE, "ldap_parse_sasl_bind_result\n", 0, 0, 0 );
229*0Sstevel@tonic-gate
230*0Sstevel@tonic-gate /*
231*0Sstevel@tonic-gate * the ldapv3 SASL bind response looks like this:
232*0Sstevel@tonic-gate *
233*0Sstevel@tonic-gate * BindResponse ::= [APPLICATION 1] SEQUENCE {
234*0Sstevel@tonic-gate * COMPONENTS OF LDAPResult,
235*0Sstevel@tonic-gate * serverSaslCreds [7] OCTET STRING OPTIONAL
236*0Sstevel@tonic-gate * }
237*0Sstevel@tonic-gate *
238*0Sstevel@tonic-gate * all wrapped up in an LDAPMessage sequence.
239*0Sstevel@tonic-gate */
240*0Sstevel@tonic-gate
241*0Sstevel@tonic-gate if ( !NSLDAPI_VALID_LDAP_POINTER( ld ) ||
242*0Sstevel@tonic-gate !NSLDAPI_VALID_LDAPMESSAGE_BINDRESULT_POINTER( res )) {
243*0Sstevel@tonic-gate return( LDAP_PARAM_ERROR );
244*0Sstevel@tonic-gate }
245*0Sstevel@tonic-gate
246*0Sstevel@tonic-gate /* only ldapv3 or higher can do sasl binds */
247*0Sstevel@tonic-gate if ( NSLDAPI_LDAP_VERSION( ld ) < LDAP_VERSION3 ) {
248*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
249*0Sstevel@tonic-gate return( LDAP_NOT_SUPPORTED );
250*0Sstevel@tonic-gate }
251*0Sstevel@tonic-gate
252*0Sstevel@tonic-gate if ( servercredp != NULL ) {
253*0Sstevel@tonic-gate *servercredp = NULL;
254*0Sstevel@tonic-gate }
255*0Sstevel@tonic-gate
256*0Sstevel@tonic-gate ber = *(res->lm_ber); /* struct copy */
257*0Sstevel@tonic-gate
258*0Sstevel@tonic-gate /* skip past message id, matched dn, error message ... */
259*0Sstevel@tonic-gate rc = ber_scanf( &ber, "{iaa}", &along, &m, &e );
260*0Sstevel@tonic-gate
261*0Sstevel@tonic-gate if ( rc != LBER_ERROR &&
262*0Sstevel@tonic-gate ber_peek_tag( &ber, &len ) == LDAP_TAG_SASL_RES_CREDS ) {
263*0Sstevel@tonic-gate rc = ber_get_stringal( &ber, servercredp );
264*0Sstevel@tonic-gate }
265*0Sstevel@tonic-gate
266*0Sstevel@tonic-gate if ( freeit ) {
267*0Sstevel@tonic-gate ldap_msgfree( res );
268*0Sstevel@tonic-gate }
269*0Sstevel@tonic-gate
270*0Sstevel@tonic-gate if ( rc == LBER_ERROR ) {
271*0Sstevel@tonic-gate err = LDAP_DECODING_ERROR;
272*0Sstevel@tonic-gate } else {
273*0Sstevel@tonic-gate err = (int) along;
274*0Sstevel@tonic-gate }
275*0Sstevel@tonic-gate
276*0Sstevel@tonic-gate LDAP_SET_LDERRNO( ld, err, m, e );
277*0Sstevel@tonic-gate /* this is a little kludge for the 3.0 Barracuda/hammerhead relese */
278*0Sstevel@tonic-gate /* the docs state that the return is either LDAP_DECODING_ERROR */
279*0Sstevel@tonic-gate /* or LDAP_SUCCESS. Here we match the docs... it's cleaner in 3.1 */
280*0Sstevel@tonic-gate
281*0Sstevel@tonic-gate if ( LDAP_DECODING_ERROR == err ) {
282*0Sstevel@tonic-gate return (LDAP_DECODING_ERROR);
283*0Sstevel@tonic-gate } else {
284*0Sstevel@tonic-gate return( LDAP_SUCCESS );
285*0Sstevel@tonic-gate }
286*0Sstevel@tonic-gate }
287