1 /*
2  * Copyright 2002-2003 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 #pragma ident	"%Z%%M%	%I%	%E% SMI"
7 
8 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
9  *
10  * The contents of this file are subject to the Netscape Public License
11  * Version 1.0 (the "NPL"); you may not use this file except in
12  * compliance with the NPL.  You may obtain a copy of the NPL at
13  * http://www.mozilla.org/NPL/
14  *
15  * Software distributed under the NPL is distributed on an "AS IS" basis,
16  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the NPL
17  * for the specific language governing rights and limitations under the
18  * NPL.
19  *
20  * The Initial Developer of the Original Code is Netscape
21  * Communications Corporation. Portions created by Netscape are
22  * Copyright (C) 1998-1999 Netscape Communications Corporation. All
23  * Rights Reserved.
24  *
25  * Contributor(s):
26  */
27 #include "ldap-int.h"
28 
29 /*
30  * ldap_sasl_bind - authenticate to the ldap server.  The dn, mechanism,
31  * and credentials of the entry to which to bind are supplied. An LDAP
32  * error code is returned and if LDAP_SUCCESS is returned *msgidp is set
33  * to the id of the request initiated.
34  *
35  * Example:
36  *	struct berval	creds;
37  *	LDAPControl	**ctrls;
38  *	int		err, msgid;
39  *	... fill in creds with credentials ...
40  *	... fill in ctrls with server controls ...
41  *	err = ldap_sasl_bind( ld, "cn=manager, o=university of michigan, c=us",
42  *	    "mechanismname", &creds, ctrls, NULL, &msgid );
43  */
44 int
45 LDAP_CALL
ldap_sasl_bind(LDAP * ld,const char * dn,const char * mechanism,const struct berval * cred,LDAPControl ** serverctrls,LDAPControl ** clientctrls,int * msgidp)46 ldap_sasl_bind(
47     LDAP		*ld,
48     const char		*dn,
49     const char		*mechanism,
50     const struct berval	*cred,
51     LDAPControl		**serverctrls,
52     LDAPControl		**clientctrls,
53     int			*msgidp
54 )
55 {
56 	BerElement	*ber;
57 	int		rc, simple, msgid, ldapversion;
58 
59 	/*
60 	 * The ldapv3 bind request looks like this:
61 	 *	BindRequest ::= SEQUENCE {
62 	 *		version		INTEGER,
63 	 *		name		DistinguishedName,	 -- who
64 	 *		authentication	CHOICE {
65 	 *			simple		[0] OCTET STRING, -- passwd
66 	 *			sasl		[3] SaslCredentials -- v3 only
67 	 *		}
68 	 *	}
69 	 *	SaslCredentials ::= SEQUENCE {
70 	 *		mechanism	LDAPString,
71 	 * 		credentials	OCTET STRING
72 	 *	}
73 	 * all wrapped up in an LDAPMessage sequence.
74 	 */
75 
76 	LDAPDebug( LDAP_DEBUG_TRACE, "ldap_sasl_bind\n", 0, 0, 0 );
77 
78 	if ( msgidp == NULL ) {
79 		LDAP_SET_LDERRNO( ld, LDAP_PARAM_ERROR, NULL, NULL );
80                 return( LDAP_PARAM_ERROR );
81 	}
82 
83 	simple = ( mechanism == LDAP_SASL_SIMPLE );
84 	ldapversion = NSLDAPI_LDAP_VERSION( ld );
85 
86 	/* only ldapv3 or higher can do sasl binds */
87 	if ( !simple && ldapversion < LDAP_VERSION3 ) {
88 		LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
89 		return( LDAP_NOT_SUPPORTED );
90 	}
91 
92 	LDAP_MUTEX_LOCK( ld, LDAP_MSGID_LOCK );
93 	msgid = ++ld->ld_msgid;
94 	LDAP_MUTEX_UNLOCK( ld, LDAP_MSGID_LOCK );
95 
96 	if ( dn == NULL )
97 		dn = "";
98 
99 	if ( ld->ld_cache_on && ld->ld_cache_bind != NULL ) {
100 		LDAP_MUTEX_LOCK( ld, LDAP_CACHE_LOCK );
101 		if ( (rc = (ld->ld_cache_bind)( ld, msgid, LDAP_REQ_BIND, dn,
102 		    cred, LDAP_AUTH_SASL )) != 0 ) {
103 			*msgidp = rc;
104 			LDAP_MUTEX_UNLOCK( ld, LDAP_CACHE_LOCK );
105 			return( LDAP_SUCCESS );
106 		}
107 		LDAP_MUTEX_UNLOCK( ld, LDAP_CACHE_LOCK );
108 	}
109 
110 	/* create a message to send */
111 	if (( rc = nsldapi_alloc_ber_with_options( ld, &ber ))
112 	    != LDAP_SUCCESS ) {
113 		return( rc );
114 	}
115 
116 	/* fill it in */
117 	if ( simple ) {		/* simple bind; works in LDAPv2 or v3 */
118 		struct berval	tmpcred;
119 
120 		if ( cred == NULL ) {
121 			tmpcred.bv_val = "";
122 			tmpcred.bv_len = 0;
123 			cred = &tmpcred;
124 		}
125 		rc = ber_printf( ber, "{it{isto}", msgid, LDAP_REQ_BIND,
126 		    ldapversion, dn, LDAP_AUTH_SIMPLE, cred->bv_val,
127 		    (int)cred->bv_len /* XXX lossy cast */ );
128 
129 	} else {		/* SASL bind; requires LDAPv3 or better */
130 		if ( cred == NULL ) {
131 			rc = ber_printf( ber, "{it{ist{s}}", msgid,
132 			    LDAP_REQ_BIND, ldapversion, dn, LDAP_AUTH_SASL,
133 			    mechanism );
134 		} else {
135 			rc = ber_printf( ber, "{it{ist{so}}", msgid,
136 			    LDAP_REQ_BIND, ldapversion, dn, LDAP_AUTH_SASL,
137 			    mechanism, cred->bv_val,
138 			    (int)cred->bv_len /* XXX lossy cast */ );
139 		}
140 	}
141 
142 	if ( rc == -1 ) {
143 		LDAP_SET_LDERRNO( ld, LDAP_ENCODING_ERROR, NULL, NULL );
144 		ber_free( ber, 1 );
145 		return( LDAP_ENCODING_ERROR );
146 	}
147 
148 	if ( (rc = nsldapi_put_controls( ld, serverctrls, 1, ber ))
149 	    != LDAP_SUCCESS ) {
150 		ber_free( ber, 1 );
151 		return( rc );
152 	}
153 
154 	/* send the message */
155 	rc = nsldapi_send_initial_request( ld, msgid, LDAP_REQ_BIND,
156 		(char *)dn, ber );
157 	*msgidp = rc;
158 	return( rc < 0 ? LDAP_GET_LDERRNO( ld, NULL, NULL ) : LDAP_SUCCESS );
159 }
160 
161 /*
162  * ldap_sasl_bind_s - bind to the ldap server using sasl authentication
163  * The dn, mechanism, and credentials of the entry to which to bind are
164  * supplied.  LDAP_SUCCESS is returned upon success, the ldap error code
165  * otherwise.
166  *
167  * Example:
168  *	struct berval	creds;
169  *	... fill in creds with credentials ...
170  *	ldap_sasl_bind_s( ld, "cn=manager, o=university of michigan, c=us",
171  *	    "mechanismname", &creds )
172  */
173 int
174 LDAP_CALL
ldap_sasl_bind_s(LDAP * ld,const char * dn,const char * mechanism,const struct berval * cred,LDAPControl ** serverctrls,LDAPControl ** clientctrls,struct berval ** servercredp)175 ldap_sasl_bind_s(
176     LDAP		*ld,
177     const char		*dn,
178     const char		*mechanism,
179     const struct berval	*cred,
180     LDAPControl		**serverctrls,
181     LDAPControl		**clientctrls,
182     struct berval	**servercredp
183 )
184 {
185 	int		err, msgid;
186 	LDAPMessage	*result;
187 
188 	LDAPDebug( LDAP_DEBUG_TRACE, "ldap_sasl_bind_s\n", 0, 0, 0 );
189 
190 	if ( NSLDAPI_LDAP_VERSION( ld ) < LDAP_VERSION3 ) {
191 		LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
192 		return( LDAP_NOT_SUPPORTED );
193 	}
194 
195 	if ( ( err = ldap_sasl_bind( ld, dn, mechanism, cred, serverctrls,
196 	    clientctrls, &msgid )) != LDAP_SUCCESS )
197 		return( err );
198 
199 	if ( ldap_result( ld, msgid, 1, (struct timeval *) 0, &result ) == -1 )
200 		return( LDAP_GET_LDERRNO( ld, NULL, NULL ) );
201 
202 	err = ldap_parse_sasl_bind_result( ld, result, servercredp, 0 );
203 	if (err != LDAP_SUCCESS  && err != LDAP_SASL_BIND_IN_PROGRESS) {
204 		ldap_msgfree( result );
205 		return( err );
206 	}
207 
208 	return( ldap_result2error( ld, result, 1 ) );
209 }
210 
211 
212 /* returns an LDAP error code that indicates if parse succeeded or not */
213 int
214 LDAP_CALL
ldap_parse_sasl_bind_result(LDAP * ld,LDAPMessage * res,struct berval ** servercredp,int freeit)215 ldap_parse_sasl_bind_result(
216     LDAP		*ld,
217     LDAPMessage		*res,
218     struct berval	**servercredp,
219     int			freeit
220 )
221 {
222 	BerElement	ber;
223 	int		rc, err;
224 	ber_int_t	along;
225 	ber_len_t	len;
226 	char		*m, *e;
227 
228 	LDAPDebug( LDAP_DEBUG_TRACE, "ldap_parse_sasl_bind_result\n", 0, 0, 0 );
229 
230 	/*
231 	 * the ldapv3 SASL bind response looks like this:
232 	 *
233 	 *	BindResponse ::= [APPLICATION 1] SEQUENCE {
234 	 *		COMPONENTS OF LDAPResult,
235 	 *		serverSaslCreds [7] OCTET STRING OPTIONAL
236 	 *	}
237 	 *
238 	 * all wrapped up in an LDAPMessage sequence.
239 	 */
240 
241 	if ( !NSLDAPI_VALID_LDAP_POINTER( ld ) ||
242 	    !NSLDAPI_VALID_LDAPMESSAGE_BINDRESULT_POINTER( res )) {
243 		return( LDAP_PARAM_ERROR );
244 	}
245 
246 	/* only ldapv3 or higher can do sasl binds */
247 	if ( NSLDAPI_LDAP_VERSION( ld ) < LDAP_VERSION3 ) {
248 		LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
249 		return( LDAP_NOT_SUPPORTED );
250 	}
251 
252 	if ( servercredp != NULL ) {
253 		*servercredp = NULL;
254 	}
255 
256 	ber = *(res->lm_ber);	/* struct copy */
257 
258 	/* skip past message id, matched dn, error message ... */
259 	rc = ber_scanf( &ber, "{iaa}", &along, &m, &e );
260 
261 	if ( rc != LBER_ERROR &&
262 	    ber_peek_tag( &ber, &len ) == LDAP_TAG_SASL_RES_CREDS ) {
263 		rc = ber_get_stringal( &ber, servercredp );
264 	}
265 
266 	if ( freeit ) {
267 		ldap_msgfree( res );
268 	}
269 
270 	if ( rc == LBER_ERROR ) {
271 		err = LDAP_DECODING_ERROR;
272 	} else {
273 		err = (int) along;
274 	}
275 
276 	LDAP_SET_LDERRNO( ld, err, m, e );
277 	/* this is a little kludge for the 3.0 Barracuda/hammerhead relese */
278 	/* the docs state that the return is either LDAP_DECODING_ERROR */
279 	/* or LDAP_SUCCESS.  Here we match the docs...  it's cleaner in 3.1 */
280 
281 	if ( LDAP_DECODING_ERROR == err ) {
282 		return (LDAP_DECODING_ERROR);
283 	} else {
284 		return( LDAP_SUCCESS );
285 	}
286 }
287