db-ldap.h revision 964c86de7158ccafdfe665853579d71232e2634e
8c294c1cd4d721818a59684cf7f2b36123f79163Stephen Gallagher#ifndef DB_LDAP_H
8c294c1cd4d721818a59684cf7f2b36123f79163Stephen Gallagher#define DB_LDAP_H
8c294c1cd4d721818a59684cf7f2b36123f79163Stephen Gallagher
8c294c1cd4d721818a59684cf7f2b36123f79163Stephen Gallagher/* Functions like ldap_bind() have been deprecated in OpenLDAP 2.3
8c294c1cd4d721818a59684cf7f2b36123f79163Stephen Gallagher This define enables them until the code here can be refactored */
c252d148fa8ab50aaaa8bbae7beb4d208025171dNikolai Kondrashov#define LDAP_DEPRECATED 1
9542512d7be40f2000298c86d3d2b728f4f0f65aStephen Gallagher
9542512d7be40f2000298c86d3d2b728f4f0f65aStephen Gallagher/* Maximum number of pending requests before delaying new requests. */
9542512d7be40f2000298c86d3d2b728f4f0f65aStephen Gallagher#define DB_LDAP_MAX_PENDING_REQUESTS 8
c6e39e15178675d0779e0ae855245774a09b4eb5Nikolai Kondrashov/* If LDAP connection is down, fail requests after waiting for this long. */
c6e39e15178675d0779e0ae855245774a09b4eb5Nikolai Kondrashov#define DB_LDAP_REQUEST_DISCONNECT_TIMEOUT_SECS 4
c6e39e15178675d0779e0ae855245774a09b4eb5Nikolai Kondrashov/* If request is still in queue after this many seconds and other requests
c6e39e15178675d0779e0ae855245774a09b4eb5Nikolai Kondrashov have been replied, assume the request was lost and abort it. */
c6e39e15178675d0779e0ae855245774a09b4eb5Nikolai Kondrashov#define DB_LDAP_REQUEST_LOST_TIMEOUT_SECS 60
fd5a4eacd56700ffb08a73121aeacdc806cb0132Sumit Bose/* If server disconnects us, don't reconnect if no requests have been sent
8b1f525acd20f36c836e827de3c251088961c5d9Stephen Gallagher for this many seconds. */
8b1f525acd20f36c836e827de3c251088961c5d9Stephen Gallagher#define DB_LDAP_IDLE_RECONNECT_SECS 60
8b1f525acd20f36c836e827de3c251088961c5d9Stephen Gallagher
8b1f525acd20f36c836e827de3c251088961c5d9Stephen Gallagher#include <ldap.h>
8b1f525acd20f36c836e827de3c251088961c5d9Stephen Gallagher
84ae5edab16ad6be5e3be956cb6fa031c1428eb5Stephen Gallagherstruct auth_request;
9d453f1e8b28983b363b44c49b7cd701a994fd97Nikolai Kondrashovstruct ldap_connection;
428db8a58c0c149d5efccc6d788f70916c1d34d7Jakub Hrozekstruct ldap_request;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
df4cc3a83c5d6700b6a09ff96cb4a6b1949b1aa9Stephen Gallaghertypedef void db_search_callback_t(struct ldap_connection *conn,
df4cc3a83c5d6700b6a09ff96cb4a6b1949b1aa9Stephen Gallagher struct ldap_request *request,
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher LDAPMessage *res);
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagherstruct ldap_settings {
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *hosts;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *uris;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *dn;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *dnpass;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher bool auth_bind;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *auth_bind_userdn;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher bool tls;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher bool sasl_bind;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *sasl_mech;
8a5e793a0576250da80371e53aa3e7eba15cdb63Sumit Bose const char *sasl_realm;
8a5e793a0576250da80371e53aa3e7eba15cdb63Sumit Bose const char *sasl_authz_id;
8a5e793a0576250da80371e53aa3e7eba15cdb63Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose const char *tls_ca_cert_file;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose const char *tls_ca_cert_dir;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose const char *tls_cert_file;
af4ffe1001adcc0a96897e426d26444f07af9aa1Benjamin Franzke const char *tls_key_file;
af4ffe1001adcc0a96897e426d26444f07af9aa1Benjamin Franzke const char *tls_cipher_suite;
af4ffe1001adcc0a96897e426d26444f07af9aa1Benjamin Franzke const char *tls_require_cert;
f3c85d900c4663854cc7bbae7d9f77867ed1f69bSumit Bose
f3c85d900c4663854cc7bbae7d9f77867ed1f69bSumit Bose const char *deref;
f3c85d900c4663854cc7bbae7d9f77867ed1f69bSumit Bose const char *scope;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *base;
2a552e43581c74f51205c7141ec9f6e9542509f8Stephen Gallagher unsigned int ldap_version;
2a552e43581c74f51205c7141ec9f6e9542509f8Stephen Gallagher
8214510f125879c3b1d247f2ce981ee20b5375d1Jakub Hrozek const char *ldaprc_path;
1a59af8245f183f22d87d067a90197d8e2ea958dJakub Hrozek const char *debug_level;
a5bb518446d5ce565d7ba819590a009cabb0b0b4Jakub Hrozek
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *user_attrs;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *user_filter;
d921c1eba437662437847279f251a0a5d8f70127Maxim const char *pass_attrs;
2cbdd12983eb85eddb90f64cfafb24eae5b448f4Jakub Hrozek const char *pass_filter;
b9c8ce2bdd4045782c243605a1b999098bedcffcNoam Meltzer const char *iterate_attrs;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *iterate_filter;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const char *default_pass_scheme;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher bool userdb_warning_disable;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
eb2e21b764d03544d8161e9956d7f70b07b75f77Simo Sorce /* ... */
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher int ldap_deref, ldap_scope;
2a5790216f57e9bdfb2930d52860bb5300366536Jakub Hrozek uid_t uid;
5377441d7a846461c2d9a7a870cea711360a529aNikolai Kondrashov gid_t gid;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher};
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
32381402a4a9afc003782c9e2301fc59c9bda2a9Yassir Elleyenum ldap_request_type {
dbfc407eef1d9ba2469687c3ffbe7fd8bb111d94Jakub Hrozek LDAP_REQUEST_TYPE_SEARCH,
4dd615c01357b8715711aad6820ba9595d3ad377Stephen Gallagher LDAP_REQUEST_TYPE_BIND
4b6a0d0b3d42e5fdb457f47d9adfa5e66b160256Stephen Gallagher};
e124844907ed6973915e4d56f5442ecd07535a12Jakub Hrozek
5484044ea7bb632b915f706685fce509f6eacc48Jakub Hrozekstruct ldap_request {
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher enum ldap_request_type type;
b32159300fea63222d8dd9200ed634087704ea74Stephen Gallagher
b32159300fea63222d8dd9200ed634087704ea74Stephen Gallagher /* msgid for sent requests, -1 if not sent */
87d3b47abba6a40fcf809c85a2b138bc1013d9c5Jakub Hrozek int msgid;
bc13c352ba9c2877f1e9bc62e55ad60fc000a55dJakub Hrozek /* timestamp when request was created */
bc13c352ba9c2877f1e9bc62e55ad60fc000a55dJakub Hrozek time_t create_time;
bc13c352ba9c2877f1e9bc62e55ad60fc000a55dJakub Hrozek
bc13c352ba9c2877f1e9bc62e55ad60fc000a55dJakub Hrozek db_search_callback_t *callback;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher struct auth_request *auth_request;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher /* If expect_one_reply=TRUE, this contains the first LDAP entry.
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher If another one comes, we'll return an error. */
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher LDAPMessage *first_entry;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
054b5d4bb98973698f74d66b14ccd14394b53f10Lukas Slebodnik unsigned int expect_one_reply:1;
054b5d4bb98973698f74d66b14ccd14394b53f10Lukas Slebodnik};
a3d176d116ceccd6a7547c128fab5df5cdd2c2b6Michal Zidek
a3d176d116ceccd6a7547c128fab5df5cdd2c2b6Michal Zidekstruct ldap_request_search {
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher struct ldap_request request;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
4f6931e854c698dcb1c09f99eb330ce2fb97e7c6Lukas Slebodnik const char *base;
4dd615c01357b8715711aad6820ba9595d3ad377Stephen Gallagher const char *filter;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher char **attributes; /* points to pass_attr_names / user_attr_names */
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher};
558998ce664055a75595371118f818084d8f2b23Jan Cholasta
558998ce664055a75595371118f818084d8f2b23Jan Cholastastruct ldap_request_bind {
9a3e40dc49c1e38bf58e45be5adff37615f3910bJan Cholasta struct ldap_request request;
9a3e40dc49c1e38bf58e45be5adff37615f3910bJan Cholasta
558998ce664055a75595371118f818084d8f2b23Jan Cholasta const char *dn;
558998ce664055a75595371118f818084d8f2b23Jan Cholasta};
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagherenum ldap_connection_state {
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher /* Not connected */
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher LDAP_CONN_STATE_DISCONNECTED,
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher /* Binding - either to default dn or doing auth bind */
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher LDAP_CONN_STATE_BINDING,
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher /* Bound to auth dn */
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher LDAP_CONN_STATE_BOUND_AUTH,
c737e1444fb186e349e59bfa9dac4995b720b4b1Jan Zeleny /* Bound to default dn */
f1828234a850dd28465425248a83a993f262918fPavel Březina LDAP_CONN_STATE_BOUND_DEFAULT
6ea6ec5cb7d9985e2730fb9d4657624d10aed4d8Nick Guay};
b69cb1787209e85cc246eb9a944242689bfe0c46Pavel Březina
b69cb1787209e85cc246eb9a944242689bfe0c46Pavel Březinastruct ldap_connection {
b69cb1787209e85cc246eb9a944242689bfe0c46Pavel Březina struct ldap_connection *next;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher pool_t pool;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher int refcount;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher char *config_path;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher struct ldap_settings set;
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
1746e8b8399da2a7a8da4aace186f66055ccfec1Jakub Hrozek LDAP *ld;
1746e8b8399da2a7a8da4aace186f66055ccfec1Jakub Hrozek enum ldap_connection_state conn_state;
1746e8b8399da2a7a8da4aace186f66055ccfec1Jakub Hrozek int default_bind_msgid;
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina int fd;
2827b0d03f7b6bafa504d22a5d7ca39cbda048b3Pavel Březina struct io *io;
9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek struct timeout *to;
9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek
9e80079370ff3b943832adc3c5ef430e64be0a0cJakub Hrozek /* Request queue contains sent requests at tail (msgid != -1) and
e7311aec8d691e5427317442387af1bc8fff3742Jan Cholasta queued requests at head (msgid == -1). */
e7311aec8d691e5427317442387af1bc8fff3742Jan Cholasta struct aqueue *request_queue;
e7311aec8d691e5427317442387af1bc8fff3742Jan Cholasta ARRAY_DEFINE(request_array, struct ldap_request *);
cb4d5b588e704114b7090678752d33512baa718eJakub Hrozek /* Number of messages in queue with msgid != -1 */
cb4d5b588e704114b7090678752d33512baa718eJakub Hrozek unsigned int pending_count;
cb4d5b588e704114b7090678752d33512baa718eJakub Hrozek
19d3aba12c70528708be9440aca66038a291f29eYassir Elley /* Timestamp when we last received a reply */
19d3aba12c70528708be9440aca66038a291f29eYassir Elley time_t last_reply_stamp;
19d3aba12c70528708be9440aca66038a291f29eYassir Elley
f3a25949de81f80c136bb073e4a8f504b080c20cJakub Hrozek char **pass_attr_names, **user_attr_names, **iterate_attr_names;
f3a25949de81f80c136bb073e4a8f504b080c20cJakub Hrozek struct hash_table *pass_attr_map, *user_attr_map, *iterate_attr_map;
f3a25949de81f80c136bb073e4a8f504b080c20cJakub Hrozek bool userdb_used;
45726939a48e605b0166521f94300ae04981a3a7Sumit Bose};
45726939a48e605b0166521f94300ae04981a3a7Sumit Bose
3be9e26dcd169d44ae105f1b8a0674464c700b77Sumit Bose/* Send/queue request */
5484044ea7bb632b915f706685fce509f6eacc48Jakub Hrozekvoid db_ldap_request(struct ldap_connection *conn,
5484044ea7bb632b915f706685fce509f6eacc48Jakub Hrozek struct ldap_request *request);
3be9e26dcd169d44ae105f1b8a0674464c700b77Sumit Bose
3be9e26dcd169d44ae105f1b8a0674464c700b77Sumit Bosevoid db_ldap_set_attrs(struct ldap_connection *conn, const char *attrlist,
45726939a48e605b0166521f94300ae04981a3a7Sumit Bose char ***attr_names_r, struct hash_table *attr_map,
5484044ea7bb632b915f706685fce509f6eacc48Jakub Hrozek const char *skip_attr);
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
b9e5bd09a5ff7009537a18914dbebcf10498f592Sumit Bosestruct ldap_connection *db_ldap_init(const char *config_path, bool userdb);
b9e5bd09a5ff7009537a18914dbebcf10498f592Sumit Bosevoid db_ldap_unref(struct ldap_connection **conn);
b9e5bd09a5ff7009537a18914dbebcf10498f592Sumit Bose
b9e5bd09a5ff7009537a18914dbebcf10498f592Sumit Bosevoid db_ldap_check_userdb_warning(struct ldap_connection *conn);
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagherint db_ldap_connect(struct ldap_connection *conn);
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
36ccdecd053a9ad88dce86b8c84770dc2aa11d21Simo Sorcevoid db_ldap_enable_input(struct ldap_connection *conn, bool enable);
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagherstruct var_expand_table *
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagherdb_ldap_value_get_var_expand_table(struct auth_request *auth_request);
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagherconst char *ldap_escape(const char *str,
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher const struct auth_request *auth_request);
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagherconst char *ldap_get_error(struct ldap_connection *conn);
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagherstruct db_ldap_result_iterate_context *
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagherdb_ldap_result_iterate_init(struct ldap_connection *conn, LDAPMessage *entry,
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagher struct auth_request *auth_request,
effcbdb12c7ef892f1fd92a745cb33a08ca4ba30Stephen Gallagher struct hash_table *attr_map);
551aa6c36797ed720487f5974dcadabf19e6ff9fStephen Gallagherbool db_ldap_result_iterate_next(struct db_ldap_result_iterate_context *ctx,
69aaef8719c5cf33ed1c4090fa313ba281bf8a02Jakub Hrozek const char **name_r,
4dd615c01357b8715711aad6820ba9595d3ad377Stephen Gallagher const char *const **values_r);
fe60346714a73ac3987f786731389320633dd245Pavel Březina
a6098862048d4bb469130b9ff21be3020d6f2c54Sumit Bose#endif
2d257ccf620ce1b611f89cec8f0a94c88c2f2881Sumit Bose