ldapdb.c

/* $OpenLDAP: pkg/ldap/contrib/ldapsasl/ldapdb.c,v 1.1.2.7 2003/11/29 22:10:03 hyc Exp $ */
/* SASL LDAP auxprop+canonuser implementation
 * Copyright (C) 2002-2007 Howard Chu, All rights reserved. <hyc@symas.com>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted only as authorized by the OpenLDAP
 * Public License.
 *
 * A copy of this license is available in the file LICENSE in the
 * top-level directory of the distribution or, alternatively, at
 * <http://www.OpenLDAP.org/license.html>.
 */

#include <config.h>

#include <stdio.h>
#include <ctype.h>

#include "sasl.h"
#include "saslutil.h"
#include "saslplug.h"

#include "plugin_common.h"

#define LDAP_DEPRECATED 1
#include <ldap.h>

static char ldapdb[] = "ldapdb";

typedef struct ldapctx {
	int inited;		/* Have we already read the config? */
	const char *uri;	/* URI of LDAP server */
	struct berval id;	/* SASL authcid to bind as */
	struct berval pw;	/* password for bind */
	struct berval mech;	/* SASL mech */
	int use_tls;		/* Issue StartTLS request? */
	struct berval canon;	/* Use attr in user entry for canonical name */
} ldapctx;

static ldapctx ldapdb_ctx;

static int ldapdb_interact(LDAP *ld, unsigned flags __attribute__((unused)),
	void *def, void *inter)
{
	sasl_interact_t *in = inter;
	ldapctx *ctx = def;
	struct berval p;

	for (;in->id != SASL_CB_LIST_END;in++)
	{
		p.bv_val = NULL;
		switch(in->id)
		{
			case SASL_CB_GETREALM:
				ldap_get_option(ld, LDAP_OPT_X_SASL_REALM, &p.bv_val);
				if (p.bv_val) p.bv_len = strlen(p.bv_val);
				break;		
			case SASL_CB_AUTHNAME:
				p = ctx->id;
				break;
			case SASL_CB_PASS:
				p = ctx->pw;
				break;
		}
		if (p.bv_val)
		{
			in->result = p.bv_val;
			in->len = p.bv_len;
		}
	}
	return LDAP_SUCCESS;
}

typedef struct connparm {
	LDAP *ld;
	LDAPControl c;
	LDAPControl *ctrl[2];
	struct berval *dn;
} connparm;

static int ldapdb_connect(ldapctx *ctx, sasl_server_params_t *sparams,
	const char *user, unsigned ulen, connparm *cp)
{
    int i, rc;
    char *authzid;

    if((i=ldap_initialize(&cp->ld, ctx->uri))) {
	cp->ld = NULL;
	return i;
    }

    authzid = sparams->utils->malloc(ulen + sizeof("u:"));
    if (!authzid) {
    	return LDAP_NO_MEMORY;
    } 
    strcpy(authzid, "u:");
    strcpy(authzid+2, user);
    cp->c.ldctl_oid = LDAP_CONTROL_PROXY_AUTHZ;
    cp->c.ldctl_value.bv_val = authzid;
    cp->c.ldctl_value.bv_len = ulen + 2;
    cp->c.ldctl_iscritical = 1;

    i = LDAP_VERSION3;
    rc = ldap_set_option(cp->ld, LDAP_OPT_PROTOCOL_VERSION, &i);
    if (rc != 0) {
        sparams->utils->free(authzid);
        return rc;
    }

    /* If TLS is set and it fails, continue or bail out as requested */
    if (ctx->use_tls && (i=ldap_start_tls_s(cp->ld, NULL, NULL)) != LDAP_SUCCESS
    	&& ctx->use_tls > 1) {
    	sparams->utils->free(authzid);
	return i;
    }

    i = ldap_sasl_interactive_bind_s(cp->ld, NULL, ctx->mech.bv_val, NULL,
    	NULL, LDAP_SASL_QUIET, ldapdb_interact, ctx);
    if (i != LDAP_SUCCESS) {
    	sparams->utils->free(authzid);
	return i;
    }
    
    cp->ctrl[0] = &cp->c;
    cp->ctrl[1] = NULL;
    i = ldap_whoami_s(cp->ld, &cp->dn, cp->ctrl, NULL);
    if (i == LDAP_SUCCESS && cp->dn) {
    	if (!cp->dn->bv_val || strncmp(cp->dn->bv_val, "dn:", 3)) {
	    ber_bvfree(cp->dn);
	    cp->dn = NULL;
	    i = LDAP_INVALID_SYNTAX;
	} else {
    	    cp->c.ldctl_value = *(cp->dn);
	}
    }
    sparams->utils->free(authzid);
    return i;
}

static int ldapdb_auxprop_lookup(void *glob_context,
				  sasl_server_params_t *sparams,
				  unsigned flags,
				  const char *user,
				  unsigned ulen)
{
    ldapctx *ctx = glob_context;
    connparm cp;
    int ret, i, n, *aindx;
    int result;
    int j;
    const struct propval *pr;
    struct berval **bvals;
    LDAPMessage *msg, *res;
    char **attrs = NULL;
    
    if(!ctx || !sparams || !user) return SASL_BADPARAM;

    pr = sparams->utils->prop_get(sparams->propctx);
    if (!pr) return SASL_FAIL;

    /* count how many attrs to fetch */
    for(i = 0, n = 0; pr[i].name; i++) {
	if(pr[i].name[0] == '*' && (flags & SASL_AUXPROP_AUTHZID))
	    continue;
	if(pr[i].values && !(flags & SASL_AUXPROP_OVERRIDE))
	    continue;
	n++;
    }

    /* nothing to do, bail out */
    if (!n) return SASL_OK;

    /* alloc an array of attr names for search, and index to the props */
    attrs = sparams->utils->malloc((n+1)*sizeof(char *)*2);
    if (!attrs) {
	return SASL_NOMEM;
    }

    aindx = (int *)(attrs + n + 1);

    /* copy attr list */
    for (i=0, n=0; pr[i].name; i++) {
	if(pr[i].name[0] == '*' && (flags & SASL_AUXPROP_AUTHZID))
	    continue;
	if(pr[i].values && !(flags & SASL_AUXPROP_OVERRIDE))
	    continue;
    	attrs[n] = (char *)pr[i].name;
	if (pr[i].name[0] == '*') attrs[n]++;
	aindx[n] = i;
	n++;
    }
    attrs[n] = NULL;

    if ((ret = ldapdb_connect(ctx, sparams, user, ulen, &cp)) != LDAP_SUCCESS) {
	goto process_ldap_error;
    }

    ret = ldap_search_ext_s(cp.ld, cp.dn->bv_val+3, LDAP_SCOPE_BASE,
    	"(objectclass=*)", attrs, 0, cp.ctrl, NULL, NULL, 1, &res);
    ber_bvfree(cp.dn);

    if (ret != LDAP_SUCCESS) {
	goto process_ldap_error;
    }

    /* Assume no user by default */
    ret = LDAP_NO_SUCH_OBJECT;

    for (msg = ldap_first_message(cp.ld, res);
         msg;
         msg = ldap_next_message(cp.ld, msg)) {
    	if (ldap_msgtype(msg) != LDAP_RES_SEARCH_ENTRY) continue;

	/* Presence of a search result response indicates that the user exists */
	ret = LDAP_SUCCESS;

        for (i = 0; i < n; i++) {
	    bvals = ldap_get_values_len(cp.ld, msg, attrs[i]);
	    if (!bvals) continue;

	    if (pr[aindx[i]].values) {
	    	sparams->utils->prop_erase(sparams->propctx, pr[aindx[i]].name);
	    }

            for ( j = 0; bvals[j] != NULL; j++ ) {
	        sparams->utils->prop_set(sparams->propctx,
                                         pr[aindx[i]].name,
				         bvals[j]->bv_val,
                                         bvals[j]->bv_len);
            }
	    ber_bvecfree(bvals);
	}
    }
    ldap_msgfree(res);

 process_ldap_error:
    switch (ret) {
	case LDAP_SUCCESS:
            result = SASL_OK;
            break;

	case LDAP_NO_SUCH_OBJECT:
            result = SASL_NOUSER;
            break;

        case LDAP_NO_MEMORY:
            result = SASL_NOMEM;
            break;

	case LDAP_SERVER_DOWN:
	case LDAP_BUSY:
	case LDAP_UNAVAILABLE:
	case LDAP_CONNECT_ERROR:
	    result = SASL_UNAVAIL;
	    break;

#if defined(LDAP_PROXY_AUTHZ_FAILURE)
	case LDAP_PROXY_AUTHZ_FAILURE:
#elif defined(LDAP_X_PROXY_AUTHZ_FAILURE)
	case LDAP_X_PROXY_AUTHZ_FAILURE:
#endif
	case LDAP_INAPPROPRIATE_AUTH:
	case LDAP_INVALID_CREDENTIALS:
	case LDAP_INSUFFICIENT_ACCESS:
	    result = SASL_BADAUTH;
	    break;

        default:
            result = SASL_FAIL;
            break;
    }

    if(attrs) sparams->utils->free(attrs);
    if(cp.ld) ldap_unbind_ext(cp.ld, NULL, NULL);

    return result;
}

static int ldapdb_auxprop_store(void *glob_context,
				  sasl_server_params_t *sparams,
				  struct propctx *prctx,
				  const char *user,
				  unsigned ulen)
{
    ldapctx *ctx = glob_context;
    connparm cp;
    const struct propval *pr;
    int i, n;
    LDAPMod **mods;

    /* just checking if we are enabled */
    if (!prctx) return SASL_OK;

    if (!sparams || !user) return SASL_BADPARAM;

    pr = sparams->utils->prop_get(prctx);
    if (!pr) return SASL_BADPARAM;

    for (n=0; pr[n].name; n++);
    if (!n) return SASL_BADPARAM;

    mods = sparams->utils->malloc((n+1) * sizeof(LDAPMod*) + n * sizeof(LDAPMod));
    if (!mods) return SASL_NOMEM;

    if((i=ldapdb_connect(ctx, sparams, user, ulen, &cp)) == 0) {

	for (i=0; i<n; i++) {
	    mods[i] = (LDAPMod *)((char *)(mods+n+1) + i * sizeof(LDAPMod));
	    mods[i]->mod_op = LDAP_MOD_REPLACE;
	    mods[i]->mod_type = (char *)pr[i].name;
	    mods[i]->mod_values = (char **)pr[i].values;
	}
	mods[i] = NULL;

	i = ldap_modify_ext_s(cp.ld, cp.dn->bv_val+3, mods, cp.ctrl, NULL);
	ber_bvfree(cp.dn);
    }

    sparams->utils->free(mods);

    if (i) {
    	sparams->utils->seterror(sparams->utils->conn, 0, "%s",
	    ldap_err2string(i));
	if (i == LDAP_NO_MEMORY) i = SASL_NOMEM;
	else i = SASL_FAIL;
    }
    if(cp.ld) ldap_unbind_ext(cp.ld, NULL, NULL);
    return i;
}

static int
ldapdb_canon_server(void *glob_context,
		    sasl_server_params_t *sparams,
		    const char *user,
		    unsigned ulen,
		    unsigned flags __attribute__((unused)),
		    char *out,
		    unsigned out_max,
		    unsigned *out_ulen)
{
    ldapctx *ctx = glob_context;
    connparm cp;
    struct berval **bvals;
    LDAPMessage *msg, *res;
    char *rdn, *attrs[2];
    unsigned len;
    int ret;
    
    if(!ctx || !sparams || !user) return SASL_BADPARAM;

    /* If no canon attribute was configured, we can't do anything */
    if(!ctx->canon.bv_val) return SASL_BADPARAM;

    /* Trim whitespace */
    while(isspace(*(unsigned char *)user)) {
	user++;
	ulen--;
    }
    while(isspace((unsigned char)user[ulen-1])) {
    	ulen--;
    }
    
    if (!ulen) {
    	sparams->utils->seterror(sparams->utils->conn, 0,
	    "All-whitespace username.");
	return SASL_FAIL;
    }

    ret = ldapdb_connect(ctx, sparams, user, ulen, &cp);
    if ( ret ) goto done;

    /* See if the RDN uses the canon attr. If so, just use the RDN
     * value, we don't need to do a search.
     */
    rdn = cp.dn->bv_val+3;
    if (!strncasecmp(ctx->canon.bv_val, rdn, ctx->canon.bv_len) &&
    	rdn[ctx->canon.bv_len] == '=') {
	char *comma;
	rdn += ctx->canon.bv_len + 1;
	comma = strchr(rdn, ',');
	if ( comma )
	    len = comma - rdn;
	else 
	    len = cp.dn->bv_len - (rdn - cp.dn->bv_val);
	if ( len > out_max )
	    len = out_max;
	memcpy(out, rdn, len);
	out[len] = '\0';
	*out_ulen = len;
	ret = SASL_OK;
	ber_bvfree(cp.dn);
	goto done;
    }

    /* Have to read the user's entry */
    attrs[0] = ctx->canon.bv_val;
    attrs[1] = NULL;
    ret = ldap_search_ext_s(cp.ld, cp.dn->bv_val+3, LDAP_SCOPE_BASE,
    	"(objectclass=*)", attrs, 0, cp.ctrl, NULL, NULL, 1, &res);
    ber_bvfree(cp.dn);

    if (ret != LDAP_SUCCESS) goto done;

    for(msg=ldap_first_message(cp.ld, res); msg; msg=ldap_next_message(cp.ld, msg))
    {
    	if (ldap_msgtype(msg) != LDAP_RES_SEARCH_ENTRY) continue;
	bvals = ldap_get_values_len(cp.ld, msg, attrs[0]);
	if (!bvals) continue;
	len = bvals[0]->bv_len;
	if ( len > out_max )
	    len = out_max;
	memcpy(out, bvals[0]->bv_val, len);
	out[len] = '\0';
	*out_ulen = len;
	ber_bvecfree(bvals);
    }
    ldap_msgfree(res);

 done:
    if(cp.ld) ldap_unbind_ext(cp.ld, NULL, NULL);
    if (ret) {
    	sparams->utils->seterror(sparams->utils->conn, 0, "%s",
	    ldap_err2string(ret));
	if (ret == LDAP_NO_MEMORY) ret = SASL_NOMEM;
	else ret = SASL_FAIL;
    }
    return ret;
}

static int
ldapdb_canon_client(void *glob_context __attribute__((unused)),
		    sasl_client_params_t *cparams,
		    const char *user,
		    unsigned ulen,
		    unsigned flags __attribute__((unused)),
		    char *out,
		    unsigned out_max,
		    unsigned *out_ulen)
{
    if(!cparams || !user) return SASL_BADPARAM;

    /* Trim whitespace */
    while(isspace(*(unsigned char *)user)) {
	user++;
	ulen--;
    }
    while(isspace((unsigned char)user[ulen-1])) {
    	ulen--;
    }
    
    if (!ulen) {
    	cparams->utils->seterror(cparams->utils->conn, 0,
	    "All-whitespace username.");
	return SASL_FAIL;
    }

    if (ulen > out_max) return SASL_BUFOVER;

    memcpy(out, user, ulen);
    out[ulen] = '\0';
    *out_ulen = ulen;
    return SASL_OK;
}

static int
ldapdb_config(const sasl_utils_t *utils)
{
    ldapctx *p = &ldapdb_ctx;
    const char *s;
    unsigned len;

    if(p->inited) return SASL_OK;

    utils->getopt(utils->getopt_context, ldapdb, "ldapdb_uri", &p->uri, NULL);
    if(!p->uri) return SASL_BADPARAM;

    utils->getopt(utils->getopt_context, ldapdb, "ldapdb_id",
    	(const char **)&p->id.bv_val, &len);
    p->id.bv_len = len;
    utils->getopt(utils->getopt_context, ldapdb, "ldapdb_pw",
    	(const char **)&p->pw.bv_val, &len);
    p->pw.bv_len = len;
    utils->getopt(utils->getopt_context, ldapdb, "ldapdb_mech",
    	(const char **)&p->mech.bv_val, &len);
    p->mech.bv_len = len;
    utils->getopt(utils->getopt_context, ldapdb, "ldapdb_starttls", &s, NULL);
    if (s)
    {
    	if (!strcasecmp(s, "demand")) p->use_tls = 2;
	else if (!strcasecmp(s, "try")) p->use_tls = 1;
    }
    utils->getopt(utils->getopt_context, ldapdb, "ldapdb_rc", &s, &len);
    if (s)
    {
    	char *str = utils->malloc(sizeof("LDAPRC=")+len);
	if (!str) return SASL_NOMEM;
	strcpy( str, "LDAPRC=" );
	strcpy( str + sizeof("LDAPRC=")-1, s );
	if (putenv(str))
	{
	    utils->free(str);
	    return SASL_NOMEM;
	}
    }
    utils->getopt(utils->getopt_context, ldapdb, "ldapdb_canon_attr",
	(const char **)&p->canon.bv_val, &len);
    p->canon.bv_len = len;
    p->inited = 1;

    return SASL_OK;
}

static sasl_auxprop_plug_t ldapdb_auxprop_plugin = {
    0,				/* Features */
    0,				/* spare */
    &ldapdb_ctx,		/* glob_context */
    NULL,	/* auxprop_free */
    ldapdb_auxprop_lookup,	/* auxprop_lookup */
    ldapdb,			/* name */
    ldapdb_auxprop_store	/* auxprop store */
};

int ldapdb_auxprop_plug_init(const sasl_utils_t *utils,
                             int max_version,
                             int *out_version,
                             sasl_auxprop_plug_t **plug,
                             const char *plugname __attribute__((unused))) 
{
    int rc;

    if(!out_version || !plug) return SASL_BADPARAM;

    if(max_version < SASL_AUXPROP_PLUG_VERSION) return SASL_BADVERS;
    
    rc = ldapdb_config(utils);

    *out_version = SASL_AUXPROP_PLUG_VERSION;

    *plug = &ldapdb_auxprop_plugin;

    return rc;
}

static sasl_canonuser_plug_t ldapdb_canonuser_plugin = {
	0,	/* features */
	0,	/* spare */
	&ldapdb_ctx,	/* glob_context */
	ldapdb,	/* name */
	NULL,	/* canon_user_free */
	ldapdb_canon_server,	/* canon_user_server */
	ldapdb_canon_client,	/* canon_user_client */
	NULL,
	NULL,
	NULL
};

int ldapdb_canonuser_plug_init(const sasl_utils_t *utils,
                             int max_version,
                             int *out_version,
                             sasl_canonuser_plug_t **plug,
                             const char *plugname __attribute__((unused))) 
{
    int rc;

    if(!out_version || !plug) return SASL_BADPARAM;

    if(max_version < SASL_CANONUSER_PLUG_VERSION) return SASL_BADVERS;
    
    rc = ldapdb_config(utils);

    *out_version = SASL_CANONUSER_PLUG_VERSION;

    *plug = &ldapdb_canonuser_plugin;

    return rc;
}