1 /* $NetBSD: lastbind.c,v 1.1.1.1 2014/05/28 09:58:27 tron Exp $ */ 2 3 /* lastbind.c - Record timestamp of the last successful bind to entries */ 4 /* $OpenLDAP$ */ 5 /* 6 * Copyright 2009 Jonathan Clarke <jonathan@phillipoux.net>. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted only as authorized by the OpenLDAP 11 * Public License. 12 * 13 * A copy of this license is available in the file LICENSE in the 14 * top-level directory of the distribution or, alternatively, at 15 * <http://www.OpenLDAP.org/license.html>. 16 */ 17 /* ACKNOWLEDGEMENTS: 18 * This work is loosely derived from the ppolicy overlay. 19 */ 20 21 #include "portable.h" 22 23 /* 24 * This file implements an overlay that stores the timestamp of the 25 * last successful bind operation in a directory entry. 26 * 27 * Optimization: to avoid performing a write on each bind, 28 * a precision for this timestamp may be configured, causing it to 29 * only be updated if it is older than a given number of seconds. 30 */ 31 32 #ifdef SLAPD_OVER_LASTBIND 33 34 #include <ldap.h> 35 #include "lutil.h" 36 #include "slap.h" 37 #include <ac/errno.h> 38 #include <ac/time.h> 39 #include <ac/string.h> 40 #include <ac/ctype.h> 41 #include "config.h" 42 43 /* Per-instance configuration information */ 44 typedef struct lastbind_info { 45 /* precision to update timestamp in authTimestamp attribute */ 46 int timestamp_precision; 47 } lastbind_info; 48 49 /* Operational attributes */ 50 static AttributeDescription *ad_authTimestamp; 51 52 /* This is the definition used by ISODE, as supplied to us in 53 * ITS#6238 Followup #9 54 */ 55 static struct schema_info { 56 char *def; 57 AttributeDescription **ad; 58 } lastBind_OpSchema[] = { 59 { "( 1.3.6.1.4.1.453.16.2.188 " 60 "NAME 'authTimestamp' " 61 "DESC 'last successful authentication using any method/mech' " 62 "EQUALITY generalizedTimeMatch " 63 "ORDERING generalizedTimeOrderingMatch " 64 "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 " 65 "SINGLE-VALUE NO-USER-MODIFICATION USAGE dsaOperation )", 66 &ad_authTimestamp}, 67 { NULL, NULL } 68 }; 69 70 /* configuration attribute and objectclass */ 71 static ConfigTable lastbindcfg[] = { 72 { "lastbind-precision", "seconds", 2, 2, 0, 73 ARG_INT|ARG_OFFSET, 74 (void *)offsetof(lastbind_info, timestamp_precision), 75 "( OLcfgAt:5.1 " 76 "NAME 'olcLastBindPrecision' " 77 "DESC 'Precision of authTimestamp attribute' " 78 "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL }, 79 { NULL, NULL, 0, 0, 0, ARG_IGNORED } 80 }; 81 82 static ConfigOCs lastbindocs[] = { 83 { "( OLcfgOc:5.1 " 84 "NAME 'olcLastBindConfig' " 85 "DESC 'Last Bind configuration' " 86 "SUP olcOverlayConfig " 87 "MAY ( olcLastBindPrecision ) )", 88 Cft_Overlay, lastbindcfg, NULL, NULL }, 89 { NULL, 0, NULL } 90 }; 91 92 static time_t 93 parse_time( char *atm ) 94 { 95 struct lutil_tm tm; 96 struct lutil_timet tt; 97 time_t ret = (time_t)-1; 98 99 if ( lutil_parsetime( atm, &tm ) == 0) { 100 lutil_tm2time( &tm, &tt ); 101 ret = tt.tt_sec; 102 } 103 return ret; 104 } 105 106 static int 107 lastbind_bind_response( Operation *op, SlapReply *rs ) 108 { 109 Modifications *mod = NULL; 110 BackendInfo *bi = op->o_bd->bd_info; 111 Entry *e; 112 int rc; 113 114 /* we're only interested if the bind was successful */ 115 if ( rs->sr_err != LDAP_SUCCESS ) 116 return SLAP_CB_CONTINUE; 117 118 rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &e ); 119 op->o_bd->bd_info = bi; 120 121 if ( rc != LDAP_SUCCESS ) { 122 return SLAP_CB_CONTINUE; 123 } 124 125 { 126 lastbind_info *lbi = (lastbind_info *) op->o_callback->sc_private; 127 128 time_t now, bindtime = (time_t)-1; 129 Attribute *a; 130 Modifications *m; 131 char nowstr[ LDAP_LUTIL_GENTIME_BUFSIZE ]; 132 struct berval timestamp; 133 134 /* get the current time */ 135 now = slap_get_time(); 136 137 /* get authTimestamp attribute, if it exists */ 138 if ((a = attr_find( e->e_attrs, ad_authTimestamp)) != NULL) { 139 bindtime = parse_time( a->a_nvals[0].bv_val ); 140 141 if (bindtime != (time_t)-1) { 142 /* if the recorded bind time is within our precision, we're done 143 * it doesn't need to be updated (save a write for nothing) */ 144 if ((now - bindtime) < lbi->timestamp_precision) { 145 goto done; 146 } 147 } 148 } 149 150 /* update the authTimestamp in the user's entry with the current time */ 151 timestamp.bv_val = nowstr; 152 timestamp.bv_len = sizeof(nowstr); 153 slap_timestamp( &now, ×tamp ); 154 155 m = ch_calloc( sizeof(Modifications), 1 ); 156 m->sml_op = LDAP_MOD_REPLACE; 157 m->sml_flags = 0; 158 m->sml_type = ad_authTimestamp->ad_cname; 159 m->sml_desc = ad_authTimestamp; 160 m->sml_numvals = 1; 161 m->sml_values = ch_calloc( sizeof(struct berval), 2 ); 162 m->sml_nvalues = ch_calloc( sizeof(struct berval), 2 ); 163 164 ber_dupbv( &m->sml_values[0], ×tamp ); 165 ber_dupbv( &m->sml_nvalues[0], ×tamp ); 166 m->sml_next = mod; 167 mod = m; 168 } 169 170 done: 171 be_entry_release_r( op, e ); 172 173 /* perform the update, if necessary */ 174 if ( mod ) { 175 Operation op2 = *op; 176 SlapReply r2 = { REP_RESULT }; 177 slap_callback cb = { NULL, slap_null_cb, NULL, NULL }; 178 179 /* This is a DSA-specific opattr, it never gets replicated. */ 180 op2.o_tag = LDAP_REQ_MODIFY; 181 op2.o_callback = &cb; 182 op2.orm_modlist = mod; 183 op2.o_dn = op->o_bd->be_rootdn; 184 op2.o_ndn = op->o_bd->be_rootndn; 185 op2.o_dont_replicate = 1; 186 rc = op->o_bd->be_modify( &op2, &r2 ); 187 slap_mods_free( mod, 1 ); 188 } 189 190 op->o_bd->bd_info = bi; 191 return SLAP_CB_CONTINUE; 192 } 193 194 static int 195 lastbind_bind( Operation *op, SlapReply *rs ) 196 { 197 slap_callback *cb; 198 slap_overinst *on = (slap_overinst *) op->o_bd->bd_info; 199 200 /* setup a callback to intercept result of this bind operation 201 * and pass along the lastbind_info struct */ 202 cb = op->o_tmpcalloc( sizeof(slap_callback), 1, op->o_tmpmemctx ); 203 cb->sc_response = lastbind_bind_response; 204 cb->sc_next = op->o_callback->sc_next; 205 cb->sc_private = on->on_bi.bi_private; 206 op->o_callback->sc_next = cb; 207 208 return SLAP_CB_CONTINUE; 209 } 210 211 static int 212 lastbind_db_init( 213 BackendDB *be, 214 ConfigReply *cr 215 ) 216 { 217 slap_overinst *on = (slap_overinst *) be->bd_info; 218 219 /* initialize private structure to store configuration */ 220 on->on_bi.bi_private = ch_calloc( 1, sizeof(lastbind_info) ); 221 222 return 0; 223 } 224 225 static int 226 lastbind_db_close( 227 BackendDB *be, 228 ConfigReply *cr 229 ) 230 { 231 slap_overinst *on = (slap_overinst *) be->bd_info; 232 lastbind_info *lbi = (lastbind_info *) on->on_bi.bi_private; 233 234 /* free private structure to store configuration */ 235 free( lbi ); 236 237 return 0; 238 } 239 240 static slap_overinst lastbind; 241 242 int lastbind_initialize() 243 { 244 int i, code; 245 246 /* register operational schema for this overlay (authTimestamp attribute) */ 247 for (i=0; lastBind_OpSchema[i].def; i++) { 248 code = register_at( lastBind_OpSchema[i].def, lastBind_OpSchema[i].ad, 0 ); 249 if ( code ) { 250 Debug( LDAP_DEBUG_ANY, 251 "lastbind_initialize: register_at failed\n", 0, 0, 0 ); 252 return code; 253 } 254 } 255 256 ad_authTimestamp->ad_type->sat_flags |= SLAP_AT_MANAGEABLE; 257 258 lastbind.on_bi.bi_type = "lastbind"; 259 lastbind.on_bi.bi_db_init = lastbind_db_init; 260 lastbind.on_bi.bi_db_close = lastbind_db_close; 261 lastbind.on_bi.bi_op_bind = lastbind_bind; 262 263 /* register configuration directives */ 264 lastbind.on_bi.bi_cf_ocs = lastbindocs; 265 code = config_register_schema( lastbindcfg, lastbindocs ); 266 if ( code ) return code; 267 268 return overlay_register( &lastbind ); 269 } 270 271 #if SLAPD_OVER_LASTBIND == SLAPD_MOD_DYNAMIC 272 int init_module(int argc, char *argv[]) { 273 return lastbind_initialize(); 274 } 275 #endif 276 277 #endif /* defined(SLAPD_OVER_LASTBIND) */ 278