09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "ap_provider.h"

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "httpd.h"

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_config.h"

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "ap_provider.h"

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_core.h"

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_log.h"

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_protocol.h"

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_request.h"

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "util_ldap.h"

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "mod_auth.h"

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "apr_strings.h"

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "apr_xlate.h"

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#define APR_WANT_STRFUNC

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "apr_want.h"

64185f9824e42f21ca7b9ae6c004484215c031a7rbb#include "apr_lib.h"

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#if APR_HAVE_UNISTD_H

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include <unistd.h>

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include <ctype.h>

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#if !APR_HAS_LDAP

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#error mod_authnz_ldap requires APR-util to have LDAP support built in. To fix add --with-ldap to ./configure.

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#endif

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffieldingstatic char *default_attributes[3] = { "member", "uniqueMember", NULL };

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingtypedef struct {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_pool_t *pool; /* Pool that this config is allocated from */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#if APR_HAS_THREADS

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding apr_thread_mutex_t *lock; /* Lock for this config */

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#endif

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* These parameters are all derived from the AuthLDAPURL directive */

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding char *url; /* String representation of the URL */

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding

7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding char *host; /* Name of the LDAP server (or space separated list) */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int port; /* Port of the LDAP server */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char *basedn; /* Base DN to do all searches from */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char *attribute; /* Attribute to search for */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char **attributes; /* Array of all the attributes to return */

785be1b6298010956622771c870ab3cd8ca57a2faaron int scope; /* Scope of the search */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char *filter; /* Filter to further limit the search */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding deref_options deref; /* how to handle alias dereferening */

1b21d7b3d97def358b2e923655edeb16613a1c31gstein char *binddn; /* DN to bind to server (can be NULL) */

1b21d7b3d97def358b2e923655edeb16613a1c31gstein char *bindpw; /* Password to bind to server (can be NULL) */

1b21d7b3d97def358b2e923655edeb16613a1c31gstein

1b21d7b3d97def358b2e923655edeb16613a1c31gstein int user_is_dn; /* If true, connection->user is DN instead of userid */

1b21d7b3d97def358b2e923655edeb16613a1c31gstein char *remote_user_attribute; /* If set, connection->user is this attribute instead of userid */

1b21d7b3d97def358b2e923655edeb16613a1c31gstein int compare_dn_on_server; /* If true, will use server to do DN compare */

1b21d7b3d97def358b2e923655edeb16613a1c31gstein

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int have_ldap_url; /* Set if we have found an LDAP url */

2d71630471d1c23f0137309e3c3957c633ecbfd6rbb

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_array_header_t *groupattr; /* List of Group attributes identifying user members. Default:"member uniqueMember" */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int group_attrib_is_dn; /* If true, the group attribute is the DN, otherwise,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char **sgAttributes; /* Array of strings constructed (post-config) from subgroupattrs. Last entry is NULL. */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_array_header_t *subgroupclasses; /* List of object classes of sub-groups. Default:"groupOfNames groupOfUniqueNames" */

51af95bb51b5084e883bad250b2afa2838e9ceebfielding int maxNestingDepth; /* Maximum recursive nesting depth permitted during subgroup processing. Default: 10 */

d4f1d9c1ff112a8ab9bee31f196973761329b236rbb

7fae9cc4639013f3c04c085547256c68814aee8ftrawick int secure; /* True if SSL connections are requested */

7fae9cc4639013f3c04c085547256c68814aee8ftrawick} authn_ldap_config_t;

7fae9cc4639013f3c04c085547256c68814aee8ftrawick

7fae9cc4639013f3c04c085547256c68814aee8ftrawicktypedef struct {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char *dn; /* The saved dn from a successful search */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char *user; /* The username provided by the client */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding} authn_ldap_request_t;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#define GROUPATTR_MAX_ELTS 10

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingmodule AP_MODULE_DECLARE_DATA authnz_ldap_module;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic APR_OPTIONAL_FN_TYPE(uldap_connection_close) *util_ldap_connection_close;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic APR_OPTIONAL_FN_TYPE(uldap_connection_find) *util_ldap_connection_find;

785be1b6298010956622771c870ab3cd8ca57a2faaronstatic APR_OPTIONAL_FN_TYPE(uldap_cache_comparedn) *util_ldap_cache_comparedn;

785be1b6298010956622771c870ab3cd8ca57a2faaronstatic APR_OPTIONAL_FN_TYPE(uldap_cache_compare) *util_ldap_cache_compare;

785be1b6298010956622771c870ab3cd8ca57a2faaronstatic APR_OPTIONAL_FN_TYPE(uldap_cache_check_subgroups) *util_ldap_cache_check_subgroups;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic APR_OPTIONAL_FN_TYPE(uldap_cache_checkuserid) *util_ldap_cache_checkuserid;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic APR_OPTIONAL_FN_TYPE(uldap_cache_getuserdn) *util_ldap_cache_getuserdn;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic APR_OPTIONAL_FN_TYPE(uldap_ssl_supported) *util_ldap_ssl_supported;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic apr_hash_t *charset_conversions = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic char *to_charset = NULL; /* UTF-8 identifier derived from the charset.conv file */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaronstatic char* derive_codepage_from_lang (apr_pool_t *p, char *language)

785be1b6298010956622771c870ab3cd8ca57a2faaron{

785be1b6298010956622771c870ab3cd8ca57a2faaron int lang_len;

785be1b6298010956622771c870ab3cd8ca57a2faaron char *charset;

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (!language) /* our default codepage */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return apr_pstrdup(p, "ISO-8859-1");

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm else

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding lang_len = strlen(language);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding charset = (char*) apr_hash_get(charset_conversions, language, APR_HASH_KEY_STRING);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (!charset) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding language[2] = '\0';

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding charset = (char*) apr_hash_get(charset_conversions, language, APR_HASH_KEY_STRING);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (charset) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding charset = apr_pstrdup(p, charset);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return charset;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic apr_xlate_t* get_conv_set (request_rec *r)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char *lang_line = (char*)apr_table_get(r->headers_in, "accept-language");

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char *lang;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_xlate_t *convset;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (lang_line) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding lang_line = apr_pstrdup(r->pool, lang_line);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding for (lang = lang_line;*lang;lang++) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if ((*lang == ',') || (*lang == ';')) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *lang = '\0';

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding break;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding lang = derive_codepage_from_lang(r->pool, lang_line);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (lang && (apr_xlate_open(&convset, to_charset, lang, r->pool) == APR_SUCCESS)) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return convset;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#define FILTER_LENGTH MAX_STRING_LEN

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic void authn_ldap_build_filter(char *filtbuf,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding request_rec *r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char* sent_user,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char* sent_filter,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_config_t *sec)

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm{

785be1b6298010956622771c870ab3cd8ca57a2faaron char *p, *q, *filtbuf_end;

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick char *user, *filter;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_xlate_t *convset = NULL;

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick apr_size_t inbytes;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_size_t outbytes;

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick char *outbuf;

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick if (sent_user != NULL) {

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick user = apr_pstrdup (r->pool, sent_user);

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding else

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick return;

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (sent_filter != NULL) {

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick filter = apr_pstrdup (r->pool, sent_filter);

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick }

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames else

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames filter = sec->filter;

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames if (charset_conversions) {

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames convset = get_conv_set(r);

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames }

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames if (convset) {

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames inbytes = strlen(user);

e160b861b50a3a8dcc013b8cd3ef849fe777e52fgregames outbytes = (inbytes+1)*3;

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick outbuf = apr_pcalloc(r->pool, outbytes);

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick /* Convert the user name to UTF-8. This is only valid for LDAP v3 */

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick if (apr_xlate_conv_buffer(convset, user, &inbytes, outbuf, &outbytes) == APR_SUCCESS) {

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick user = apr_pstrdup(r->pool, outbuf);

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick }

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick }

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick /*

eae32ab3fb398ca408bc2d45b22adf1b67a75471rbb apr_snprintf(filtbuf, FILTER_LENGTH, "(&(%s)(%s=", filter, sec->attribute);

066877f1a045103acfdd376d48cdd473c33f409bdougm

eae32ab3fb398ca408bc2d45b22adf1b67a75471rbb /*

066877f1a045103acfdd376d48cdd473c33f409bdougm filtbuf_end = filtbuf + FILTER_LENGTH - 1;

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick#if APR_HAS_MICROSOFT_LDAPSDK

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick for (p = user, q=filtbuf + strlen(filtbuf);

785be1b6298010956622771c870ab3cd8ca57a2faaron *p && q < filtbuf_end; ) {

785be1b6298010956622771c870ab3cd8ca57a2faaron if (strchr("*()\\", *p) != NULL) {

066877f1a045103acfdd376d48cdd473c33f409bdougm if ( q + 3 >= filtbuf_end)

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick break; /* Don't write part of escape sequence if we can't write all of it */

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick *q++ = '\\';

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick switch ( *p++ )

74b39333600dee3260355ad3a06e36ef6c61c8f1dreid {

74b39333600dee3260355ad3a06e36ef6c61c8f1dreid case '*':

74b39333600dee3260355ad3a06e36ef6c61c8f1dreid *q++ = '2';

74b39333600dee3260355ad3a06e36ef6c61c8f1dreid *q++ = 'a';

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick break;

066877f1a045103acfdd376d48cdd473c33f409bdougm case '(':

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick *q++ = '2';

d17890657bc529b3f9db20e5546511182b829565dreid *q++ = '8';

d17890657bc529b3f9db20e5546511182b829565dreid break;

d17890657bc529b3f9db20e5546511182b829565dreid case ')':

d17890657bc529b3f9db20e5546511182b829565dreid *q++ = '2';

d17890657bc529b3f9db20e5546511182b829565dreid *q++ = '9';

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick break;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding case '\\':

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *q++ = '5';

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *q++ = 'c';

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding break;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron else

785be1b6298010956622771c870ab3cd8ca57a2faaron *q++ = *p++;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#else

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding for (p = user, q=filtbuf + strlen(filtbuf);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *p && q < filtbuf_end; *q++ = *p++) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (strchr("*()\\", *p) != NULL) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *q++ = '\\';

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (q >= filtbuf_end) {

785be1b6298010956622771c870ab3cd8ca57a2faaron break;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *q = '\0';

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /*

785be1b6298010956622771c870ab3cd8ca57a2faaron if (q + 2 <= filtbuf_end)

785be1b6298010956622771c870ab3cd8ca57a2faaron strcat(filtbuf, "))");

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic void *create_authnz_ldap_dir_config(apr_pool_t *p, char *d)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_config_t *sec =

785be1b6298010956622771c870ab3cd8ca57a2faaron (authn_ldap_config_t *)apr_pcalloc(p, sizeof(authn_ldap_config_t));

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->pool = p;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#if APR_HAS_THREADS

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_thread_mutex_create(&sec->lock, APR_THREAD_MUTEX_DEFAULT, p);

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm sec->groupattr = apr_array_make(p, GROUPATTR_MAX_ELTS,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sizeof(struct mod_auth_ldap_groupattr_entry_t));

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->subgroupclasses = apr_array_make(p, GROUPATTR_MAX_ELTS,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sizeof(struct mod_auth_ldap_groupattr_entry_t));

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->have_ldap_url = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->url = "";

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->host = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->binddn = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->bindpw = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->deref = always;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->group_attrib_is_dn = 1;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->secure = -1; /*Initialize to unset*/

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->maxNestingDepth = 10;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->sgAttributes = apr_pcalloc(p, sizeof (char *) * GROUPATTR_MAX_ELTS + 1);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->user_is_dn = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->remote_user_attribute = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->compare_dn_on_server = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return sec;

785be1b6298010956622771c870ab3cd8ca57a2faaron}

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaronstatic apr_status_t authnz_ldap_cleanup_connection_close(void *param)

785be1b6298010956622771c870ab3cd8ca57a2faaron{

785be1b6298010956622771c870ab3cd8ca57a2faaron util_ldap_connection_t *ldc = param;

785be1b6298010956622771c870ab3cd8ca57a2faaron util_ldap_connection_close(ldc);

785be1b6298010956622771c870ab3cd8ca57a2faaron return APR_SUCCESS;

785be1b6298010956622771c870ab3cd8ca57a2faaron}

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaronstatic authn_status authn_ldap_check_password(request_rec *r, const char *user,

785be1b6298010956622771c870ab3cd8ca57a2faaron const char *password)

785be1b6298010956622771c870ab3cd8ca57a2faaron{

785be1b6298010956622771c870ab3cd8ca57a2faaron int failures = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char **vals = NULL;

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm char filtbuf[FILTER_LENGTH];

785be1b6298010956622771c870ab3cd8ca57a2faaron authn_ldap_config_t *sec =

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (authn_ldap_config_t *)ap_get_module_config(r->per_dir_config, &authnz_ldap_module);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_connection_t *ldc = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int result = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int remote_user_attribute_set = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char *dn = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_request_t *req =

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (authn_ldap_request_t *)apr_pcalloc(r->pool, sizeof(authn_ldap_request_t));

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_set_module_config(r->request_config, &authnz_ldap_module, req);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /*

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (!sec->have_ldap_url) {

a7ed9c525f9460187f327cea953bf90ecf1bdc51gstein return AUTH_GENERAL_ERROR;

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick }

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstart_over:

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick /* There is a good AuthLDAPURL, right? */

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick if (sec->host) {

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick ldc = util_ldap_connection_find(r, sec->host, sec->port,

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick sec->binddn, sec->bindpw, sec->deref,

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick sec->secure);

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding else {

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "[%" APR_PID_T_FMT "] auth_ldap authenticate: no sec->host - weird...?", getpid());

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTH_GENERAL_ERROR;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authenticate: using URL %s", getpid(), sec->url);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Get the password that the client sent */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (password == NULL) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authenticate: no password specified", getpid());

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_connection_close(ldc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTH_GENERAL_ERROR;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (user == NULL) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authenticate: no user specified", getpid());

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm util_ldap_connection_close(ldc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTH_GENERAL_ERROR;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* build the username filter */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_build_filter(filtbuf, r, user, NULL, sec);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* do the user search */

a7ed9c525f9460187f327cea953bf90ecf1bdc51gstein result = util_ldap_cache_checkuserid(r, ldc, sec->url, sec->basedn, sec->scope,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->attributes, filtbuf, password, &dn, &vals);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding util_ldap_connection_close(ldc);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* sanity check - if server is down, retry it up to 5 times */

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm if (AP_LDAP_IS_SERVER_DOWN(result)) {

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick if (failures++ <= 5) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding goto start_over;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick }

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick /* handle bind failure */

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick if (result != LDAP_SUCCESS) {

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick "[%" APR_PID_T_FMT "] auth_ldap authenticate: "

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick "user %s authentication failed; URI %s [%s][%s]",

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick getpid(), user, r->uri, ldc->reason, ldap_err2string(result));

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick return (LDAP_NO_SUCH_OBJECT == result) ? AUTH_USER_NOT_FOUND

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick#ifdef LDAP_SECURITY_ERROR

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick : (LDAP_SECURITY_ERROR(result)) ? AUTH_DENIED

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#else

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding : (LDAP_INAPPROPRIATE_AUTH == result) ? AUTH_DENIED

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding : (LDAP_INVALID_CREDENTIALS == result) ? AUTH_DENIED

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#ifdef LDAP_INSUFFICIENT_ACCESS

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding : (LDAP_INSUFFICIENT_ACCESS == result) ? AUTH_DENIED

8f8ec0957334f50b7ac11359f90490ee467258eedreid#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#ifdef LDAP_INSUFFICIENT_RIGHTS

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding : (LDAP_INSUFFICIENT_RIGHTS == result) ? AUTH_DENIED

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#endif

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding : AUTH_GENERAL_ERROR;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* mark the user and DN */

785be1b6298010956622771c870ab3cd8ca57a2faaron req->dn = apr_pstrdup(r->pool, dn);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding req->user = apr_pstrdup(r->pool, user);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (sec->user_is_dn) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding r->user = req->dn;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf /* add environment variables */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (sec->attributes && vals) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_table_t *e = r->subprocess_env;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf int i = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding while (sec->attributes[i]) {

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick char *str = apr_pstrcat(r->pool, AUTHN_PREFIX, sec->attributes[i], NULL);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int j = sizeof(AUTHN_PREFIX)-1; /* string length of "AUTHENTICATE_", excluding the trailing NIL */

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick while (str[j]) {

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick str[j] = apr_toupper(str[j]);

785be1b6298010956622771c870ab3cd8ca57a2faaron j++;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf apr_table_setn(e, str, vals[i]);

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick

6b38fca3ec543a0f72efd5683e91a0b30fc752d1trawick /* handle remote_user_attribute, if set */

785be1b6298010956622771c870ab3cd8ca57a2faaron if (sec->remote_user_attribute &&

785be1b6298010956622771c870ab3cd8ca57a2faaron !strcmp(sec->remote_user_attribute, sec->attributes[i])) {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf r->user = (char *)apr_pstrdup(r->pool, vals[i]);

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf remote_user_attribute_set = 1;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf i++;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf /* sanity check */

785be1b6298010956622771c870ab3cd8ca57a2faaron if (sec->remote_user_attribute && !remote_user_attribute_set) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "[%" APR_PID_T_FMT "] auth_ldap authenticate: "

785be1b6298010956622771c870ab3cd8ca57a2faaron "REMOTE_USER was to be set with attribute '%s', "

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf "but this attribute was not requested for in the "

066877f1a045103acfdd376d48cdd473c33f409bdougm "LDAP query for the user. REMOTE_USER will fall "

785be1b6298010956622771c870ab3cd8ca57a2faaron "back to username or DN as appropriate.", getpid(),

785be1b6298010956622771c870ab3cd8ca57a2faaron sec->remote_user_attribute);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "[%" APR_PID_T_FMT "] auth_ldap authenticate: accepting %s", getpid(), user);

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTH_GRANTED;

785be1b6298010956622771c870ab3cd8ca57a2faaron}

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaronstatic authz_status ldapuser_check_authorization(request_rec *r,

785be1b6298010956622771c870ab3cd8ca57a2faaron const char *require_args)

785be1b6298010956622771c870ab3cd8ca57a2faaron{

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf int result = 0;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf authn_ldap_request_t *req =

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf (authn_ldap_request_t *)ap_get_module_config(r->request_config, &authnz_ldap_module);

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf authn_ldap_config_t *sec =

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf (authn_ldap_config_t *)ap_get_module_config(r->per_dir_config, &authnz_ldap_module);

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf util_ldap_connection_t *ldc = NULL;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

066877f1a045103acfdd376d48cdd473c33f409bdougm const char *t;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char *w;

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron char filtbuf[FILTER_LENGTH];

785be1b6298010956622771c870ab3cd8ca57a2faaron const char *dn = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char **vals = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaron if (!sec->have_ldap_url) {

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTHZ_DENIED;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf if (sec->host) {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf ldc = util_ldap_connection_find(r, sec->host, sec->port,

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf sec->binddn, sec->bindpw, sec->deref,

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf sec->secure);

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf apr_pool_cleanup_register(r->pool, ldc,

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf authnz_ldap_cleanup_connection_close,

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_pool_cleanup_null);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron else {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf "[%" APR_PID_T_FMT "] auth_ldap authorize: no sec->host - weird...?", getpid());

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf return AUTHZ_DENIED;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf }

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf /*

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* Check that we have a userid to start with */

785be1b6298010956622771c870ab3cd8ca57a2faaron if ((!r->user) || (strlen(r->user) == 0)) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "ldap authorize: Userid is blank, AuthType=%s",

785be1b6298010956622771c870ab3cd8ca57a2faaron r->ap_auth_type);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if(!req) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf "ldap authorize: Creating LDAP req structure");

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

785be1b6298010956622771c870ab3cd8ca57a2faaron /* Build the username filter */

785be1b6298010956622771c870ab3cd8ca57a2faaron authn_ldap_build_filter(filtbuf, r, r->user, NULL, sec);

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf /* Search for the user DN */

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf result = util_ldap_cache_getuserdn(r, ldc, sec->url, sec->basedn,

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf sec->scope, sec->attributes, filtbuf, &dn, &vals);

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf /* Search failed, log error and return failure */

785be1b6298010956622771c870ab3cd8ca57a2faaron if(result != LDAP_SUCCESS) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "auth_ldap authorise: User DN not found, %s", ldc->reason);

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTHZ_DENIED;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron req = (authn_ldap_request_t *)apr_pcalloc(r->pool,

785be1b6298010956622771c870ab3cd8ca57a2faaron sizeof(authn_ldap_request_t));

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_set_module_config(r->request_config, &authnz_ldap_module, req);

785be1b6298010956622771c870ab3cd8ca57a2faaron req->dn = apr_pstrdup(r->pool, dn);

785be1b6298010956622771c870ab3cd8ca57a2faaron req->user = r->user;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if (req->dn == NULL || strlen(req->dn) == 0) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "[%" APR_PID_T_FMT "] auth_ldap authorize: "

785be1b6298010956622771c870ab3cd8ca57a2faaron "require user: user's DN has not been defined; failing authorization",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding getpid());

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_DENIED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

ebc18d48bea83ee5ed7a1b4e30007e5192539829wrowe /*

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding result = util_ldap_cache_compare(r, ldc, sec->url, req->dn, sec->attribute, require_args);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding switch(result) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding case LDAP_COMPARE_TRUE: {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authorize: "

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "require user: authorization successful", getpid());

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_GRANTED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding default: {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authorize: require user: "

785be1b6298010956622771c870ab3cd8ca57a2faaron "authorization failed [%s][%s]", getpid(),

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ldc->reason, ldap_err2string(result));

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaron /*

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm t = require_args;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding while ((w = ap_getword_conf(r->pool, &t)) && w[0]) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding result = util_ldap_cache_compare(r, ldc, sec->url, req->dn, sec->attribute, w);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding switch(result) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding case LDAP_COMPARE_TRUE: {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "[%" APR_PID_T_FMT "] auth_ldap authorize: "

785be1b6298010956622771c870ab3cd8ca57a2faaron "require user: authorization successful", getpid());

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTHZ_GRANTED;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron default: {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "[%" APR_PID_T_FMT "] auth_ldap authorize: "

785be1b6298010956622771c870ab3cd8ca57a2faaron "require user: authorization failed [%s][%s]",

785be1b6298010956622771c870ab3cd8ca57a2faaron getpid(), ldc->reason, ldap_err2string(result));

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "[%" APR_PID_T_FMT "] auth_ldap authorize user: authorization denied for user %s to %s",

785be1b6298010956622771c870ab3cd8ca57a2faaron getpid(), r->user, r->uri);

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_DENIED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic authz_status ldapgroup_check_authorization(request_rec *r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char *require_args)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int result = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_request_t *req =

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (authn_ldap_request_t *)ap_get_module_config(r->request_config, &authnz_ldap_module);

785be1b6298010956622771c870ab3cd8ca57a2faaron authn_ldap_config_t *sec =

785be1b6298010956622771c870ab3cd8ca57a2faaron (authn_ldap_config_t *)ap_get_module_config(r->per_dir_config, &authnz_ldap_module);

785be1b6298010956622771c870ab3cd8ca57a2faaron

900127764fb985c340ee4979cac97146a330c694trawick util_ldap_connection_t *ldc = NULL;

785be1b6298010956622771c870ab3cd8ca57a2faaron

900127764fb985c340ee4979cac97146a330c694trawick const char *t;

900127764fb985c340ee4979cac97146a330c694trawick

900127764fb985c340ee4979cac97146a330c694trawick char filtbuf[FILTER_LENGTH];

785be1b6298010956622771c870ab3cd8ca57a2faaron const char *dn = NULL;

785be1b6298010956622771c870ab3cd8ca57a2faaron const char **vals = NULL;

785be1b6298010956622771c870ab3cd8ca57a2faaron struct mod_auth_ldap_groupattr_entry_t *ent;

785be1b6298010956622771c870ab3cd8ca57a2faaron int i;

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if (!sec->have_ldap_url) {

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTHZ_DENIED;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if (sec->host) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc = util_ldap_connection_find(r, sec->host, sec->port,

785be1b6298010956622771c870ab3cd8ca57a2faaron sec->binddn, sec->bindpw, sec->deref,

785be1b6298010956622771c870ab3cd8ca57a2faaron sec->secure);

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_pool_cleanup_register(r->pool, ldc,

785be1b6298010956622771c870ab3cd8ca57a2faaron authnz_ldap_cleanup_connection_close,

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_pool_cleanup_null);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron else {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "[%" APR_PID_T_FMT "] auth_ldap authorize: no sec->host - weird...?", getpid());

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTHZ_DENIED;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /*

785be1b6298010956622771c870ab3cd8ca57a2faaron if (sec->groupattr->nelts == 0) {

785be1b6298010956622771c870ab3cd8ca57a2faaron struct mod_auth_ldap_groupattr_entry_t *grp;

785be1b6298010956622771c870ab3cd8ca57a2faaron#if APR_HAS_THREADS

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_thread_mutex_lock(sec->lock);

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron grp = apr_array_push(sec->groupattr);

785be1b6298010956622771c870ab3cd8ca57a2faaron grp->name = "member";

785be1b6298010956622771c870ab3cd8ca57a2faaron grp = apr_array_push(sec->groupattr);

785be1b6298010956622771c870ab3cd8ca57a2faaron grp->name = "uniqueMember";

785be1b6298010956622771c870ab3cd8ca57a2faaron#if APR_HAS_THREADS

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_thread_mutex_unlock(sec->lock);

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /*

785be1b6298010956622771c870ab3cd8ca57a2faaron if (sec->subgroupclasses->nelts == 0) {

785be1b6298010956622771c870ab3cd8ca57a2faaron struct mod_auth_ldap_groupattr_entry_t *grp;

785be1b6298010956622771c870ab3cd8ca57a2faaron#if APR_HAS_THREADS

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_thread_mutex_lock(sec->lock);

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

785be1b6298010956622771c870ab3cd8ca57a2faaron grp = apr_array_push(sec->subgroupclasses);

785be1b6298010956622771c870ab3cd8ca57a2faaron grp->name = "groupOfNames";

785be1b6298010956622771c870ab3cd8ca57a2faaron grp = apr_array_push(sec->subgroupclasses);

785be1b6298010956622771c870ab3cd8ca57a2faaron grp->name = "groupOfUniqueNames";

785be1b6298010956622771c870ab3cd8ca57a2faaron#if APR_HAS_THREADS

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_thread_mutex_unlock(sec->lock);

785be1b6298010956622771c870ab3cd8ca57a2faaron#endif

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick /*

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* Check that we have a userid to start with */

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick if ((!r->user) || (strlen(r->user) == 0)) {

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

066877f1a045103acfdd376d48cdd473c33f409bdougm "ldap authorize: Userid is blank, AuthType=%s",

785be1b6298010956622771c870ab3cd8ca57a2faaron r->ap_auth_type);

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick }

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick if(!req) {

8a261a9f7d18d1e862d63f68e93f288d3e1f0d94trawick ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "ldap authorize: Creating LDAP req structure");

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron /* Build the username filter */

785be1b6298010956622771c870ab3cd8ca57a2faaron authn_ldap_build_filter(filtbuf, r, r->user, NULL, sec);

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Search for the user DN */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding result = util_ldap_cache_getuserdn(r, ldc, sec->url, sec->basedn,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->scope, sec->attributes, filtbuf, &dn, &vals);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Search failed, log error and return failure */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if(result != LDAP_SUCCESS) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "auth_ldap authorise: User DN not found, %s", ldc->reason);

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf return AUTHZ_DENIED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding req = (authn_ldap_request_t *)apr_pcalloc(r->pool,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sizeof(authn_ldap_request_t));

bbbf8f0e622ad5a37ccf70f35660fc755575278arbb ap_set_module_config(r->request_config, &authnz_ldap_module, req);

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm req->dn = apr_pstrdup(r->pool, dn);

066877f1a045103acfdd376d48cdd473c33f409bdougm req->user = r->user;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ent = (struct mod_auth_ldap_groupattr_entry_t *) sec->groupattr->elts;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (sec->group_attrib_is_dn) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (req->dn == NULL || strlen(req->dn) == 0) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authorize: require group: "

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "user's DN has not been defined; failing authorization for user %s",

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf getpid(), r->user);

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf return AUTHZ_DENIED;

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf }

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf }

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf else {

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf if (req->user == NULL || strlen(req->user) == 0) {

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf /* We weren't called in the authentication phase, so we didn't have a

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf req->user = r->user;

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf }

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf }

91583d2e9c0550f539ea6f4dedf051979ad1ad88fanf

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding t = require_args;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick "[%" APR_PID_T_FMT "] auth_ldap authorize: require group: "

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf "testing for group membership in \"%s\"",

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick getpid(), t);

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf for (i = 0; i < sec->groupattr->nelts; i++) {

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick "[%" APR_PID_T_FMT "] auth_ldap authorize: require group: "

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick "testing for %s: %s (%s)", getpid(),

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ent[i].name, sec->group_attrib_is_dn ? req->dn : req->user, t);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

0db1b9810f06c0e3c537e0e0dfbc30160c308526trawick result = util_ldap_cache_compare(r, ldc, sec->url, t, ent[i].name,

0db1b9810f06c0e3c537e0e0dfbc30160c308526trawick sec->group_attrib_is_dn ? req->dn : req->user);

0db1b9810f06c0e3c537e0e0dfbc30160c308526trawick switch(result) {

0db1b9810f06c0e3c537e0e0dfbc30160c308526trawick case LDAP_COMPARE_TRUE: {

0db1b9810f06c0e3c537e0e0dfbc30160c308526trawick ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

0db1b9810f06c0e3c537e0e0dfbc30160c308526trawick "[%" APR_PID_T_FMT "] auth_ldap authorize: require group: "

0db1b9810f06c0e3c537e0e0dfbc30160c308526trawick "authorization successful (attribute %s) [%s][%d - %s]",

644be6f54749d2d9950d2c4d2ac448f7af016d26martin getpid(), ent[i].name, ldc->reason, result, ldap_err2string(result));

644be6f54749d2d9950d2c4d2ac448f7af016d26martin return AUTHZ_GRANTED;

644be6f54749d2d9950d2c4d2ac448f7af016d26martin }

644be6f54749d2d9950d2c4d2ac448f7af016d26martin case LDAP_COMPARE_FALSE: {

644be6f54749d2d9950d2c4d2ac448f7af016d26martin ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

644be6f54749d2d9950d2c4d2ac448f7af016d26martin "[%" APR_PID_T_FMT "] auth_ldap authorise: require group \"%s\": "

644be6f54749d2d9950d2c4d2ac448f7af016d26martin "failed [%s][%d - %s], checking sub-groups",

644be6f54749d2d9950d2c4d2ac448f7af016d26martin getpid(), t, ldc->reason, result, ldap_err2string(result));

644be6f54749d2d9950d2c4d2ac448f7af016d26martin

0db1b9810f06c0e3c537e0e0dfbc30160c308526trawick result = util_ldap_cache_check_subgroups(r, ldc, sec->url, t, ent[i].name,

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick sec->group_attrib_is_dn ? req->dn : req->user,

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick sec->sgAttributes[0] ? sec->sgAttributes : default_attributes,

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick sec->subgroupclasses,

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick 0, sec->maxNestingDepth);

71715c646d5231de578431f8961e711764b899d3fanf if(result == LDAP_COMPARE_TRUE) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "[%" APR_PID_T_FMT "] auth_ldap authorise: require group (sub-group): "

785be1b6298010956622771c870ab3cd8ca57a2faaron "authorisation successful (attribute %s) [%s][%d - %s]",

785be1b6298010956622771c870ab3cd8ca57a2faaron getpid(), ent[i].name, ldc->reason, result, ldap_err2string(result));

785be1b6298010956622771c870ab3cd8ca57a2faaron return OK;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron else {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick "[%" APR_PID_T_FMT "] auth_ldap authorise: require group (sub-group) \"%s\": "

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick "authorisation failed [%s][%d - %s]",

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick getpid(), t, ldc->reason, result, ldap_err2string(result));

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick }

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick break;

3c48210f662a2ab8ed90708989e04c09aae33cb2trawick }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding default: {

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf "[%" APR_PID_T_FMT "] auth_ldap authorize: require group \"%s\": "

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf "authorization failed [%s][%d - %s]",

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf getpid(), t, ldc->reason, result, ldap_err2string(result));

5e4791fd54c10fdd77ca81bee8ac8398f16d6d6astoddard }

785be1b6298010956622771c870ab3cd8ca57a2faaron }

3926b3b7716683a1241c1ff6f8dd2f9c5073665afanf }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authorize group: authorization denied for user %s to %s",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding getpid(), r->user, r->uri);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_DENIED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic authz_status ldapdn_check_authorization(request_rec *r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char *require_args)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{

785be1b6298010956622771c870ab3cd8ca57a2faaron int result = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_request_t *req =

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (authn_ldap_request_t *)ap_get_module_config(r->request_config, &authnz_ldap_module);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_config_t *sec =

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (authn_ldap_config_t *)ap_get_module_config(r->per_dir_config, &authnz_ldap_module);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaron util_ldap_connection_t *ldc = NULL;

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron const char *t;

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron char filtbuf[FILTER_LENGTH];

785be1b6298010956622771c870ab3cd8ca57a2faaron const char *dn = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char **vals = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (!sec->have_ldap_url) {

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTHZ_DENIED;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if (sec->host) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc = util_ldap_connection_find(r, sec->host, sec->port,

785be1b6298010956622771c870ab3cd8ca57a2faaron sec->binddn, sec->bindpw, sec->deref,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->secure);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_pool_cleanup_register(r->pool, ldc,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authnz_ldap_cleanup_connection_close,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding apr_pool_cleanup_null);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding else {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authorize: no sec->host - weird...?", getpid());

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_DENIED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /*

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Check that we have a userid to start with */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if ((!r->user) || (strlen(r->user) == 0)) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "ldap authorize: Userid is blank, AuthType=%s",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding r->ap_auth_type);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if(!req) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "ldap authorize: Creating LDAP req structure");

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Build the username filter */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_build_filter(filtbuf, r, r->user, NULL, sec);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Search for the user DN */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding result = util_ldap_cache_getuserdn(r, ldc, sec->url, sec->basedn,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->scope, sec->attributes, filtbuf, &dn, &vals);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Search failed, log error and return failure */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if(result != LDAP_SUCCESS) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "auth_ldap authorise: User DN not found, %s", ldc->reason);

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTHZ_DENIED;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding req = (authn_ldap_request_t *)apr_pcalloc(r->pool,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sizeof(authn_ldap_request_t));

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_set_module_config(r->request_config, &authnz_ldap_module, req);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding req->dn = apr_pstrdup(r->pool, dn);

785be1b6298010956622771c870ab3cd8ca57a2faaron req->user = r->user;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding t = require_args;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (req->dn == NULL || strlen(req->dn) == 0) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authorize: "

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "require dn: user's DN has not been defined; failing authorization",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding getpid());

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_DENIED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding result = util_ldap_cache_comparedn(r, ldc, sec->url, req->dn, t, sec->compare_dn_on_server);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding switch(result) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding case LDAP_COMPARE_TRUE: {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authorize: "

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "require dn: authorization successful", getpid());

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_GRANTED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding default: {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

dad234382d8424e1c5a30af2838e172aec9d6d1bdreid "[%" APR_PID_T_FMT "] auth_ldap authorize: "

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "require dn \"%s\": LDAP error [%s][%s]",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding getpid(), t, ldc->reason, ldap_err2string(result));

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

e6cc28a5eb3371ba0c38e941855e71ff0054f50erbb

e6cc28a5eb3371ba0c38e941855e71ff0054f50erbb ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authorize dn: authorization denied for user %s to %s",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding getpid(), r->user, r->uri);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_DENIED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic authz_status ldapattribute_check_authorization(request_rec *r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char *require_args)

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding int result = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_request_t *req =

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (authn_ldap_request_t *)ap_get_module_config(r->request_config, &authnz_ldap_module);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_config_t *sec =

785be1b6298010956622771c870ab3cd8ca57a2faaron (authn_ldap_config_t *)ap_get_module_config(r->per_dir_config, &authnz_ldap_module);

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron util_ldap_connection_t *ldc = NULL;

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron const char *t;

785be1b6298010956622771c870ab3cd8ca57a2faaron char *w, *value;

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char filtbuf[FILTER_LENGTH];

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char *dn = NULL;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding const char **vals = NULL;

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if (!sec->have_ldap_url) {

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTHZ_DENIED;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

785be1b6298010956622771c870ab3cd8ca57a2faaron if (sec->host) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ldc = util_ldap_connection_find(r, sec->host, sec->port,

785be1b6298010956622771c870ab3cd8ca57a2faaron sec->binddn, sec->bindpw, sec->deref,

785be1b6298010956622771c870ab3cd8ca57a2faaron sec->secure);

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_pool_cleanup_register(r->pool, ldc,

785be1b6298010956622771c870ab3cd8ca57a2faaron authnz_ldap_cleanup_connection_close,

785be1b6298010956622771c870ab3cd8ca57a2faaron apr_pool_cleanup_null);

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron else {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "[%" APR_PID_T_FMT "] auth_ldap authorize: no sec->host - weird...?", getpid());

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_DENIED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /*

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Check that we have a userid to start with */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if ((!r->user) || (strlen(r->user) == 0)) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "ldap authorize: Userid is blank, AuthType=%s",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding r->ap_auth_type);

dad234382d8424e1c5a30af2838e172aec9d6d1bdreid }

382fa07a63096c4a1aabfed36433ea5ac9c40ad0trawick

e6cc28a5eb3371ba0c38e941855e71ff0054f50erbb if(!req) {

e6cc28a5eb3371ba0c38e941855e71ff0054f50erbb ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "ldap authorize: Creating LDAP req structure");

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Build the username filter */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_build_filter(filtbuf, r, r->user, NULL, sec);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Search for the user DN */

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding result = util_ldap_cache_getuserdn(r, ldc, sec->url, sec->basedn,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->scope, sec->attributes, filtbuf, &dn, &vals);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding /* Search failed, log error and return failure */

785be1b6298010956622771c870ab3cd8ca57a2faaron if(result != LDAP_SUCCESS) {

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

785be1b6298010956622771c870ab3cd8ca57a2faaron "auth_ldap authorise: User DN not found, %s", ldc->reason);

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTHZ_DENIED;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding req = (authn_ldap_request_t *)apr_pcalloc(r->pool,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sizeof(authn_ldap_request_t));

785be1b6298010956622771c870ab3cd8ca57a2faaron ap_set_module_config(r->request_config, &authnz_ldap_module, req);

785be1b6298010956622771c870ab3cd8ca57a2faaron req->dn = apr_pstrdup(r->pool, dn);

785be1b6298010956622771c870ab3cd8ca57a2faaron req->user = r->user;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (req->dn == NULL || strlen(req->dn) == 0) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "[%" APR_PID_T_FMT "] auth_ldap authorize: "

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "require ldap-attribute: user's DN has not been defined; failing authorization",

51af95bb51b5084e883bad250b2afa2838e9ceebfielding getpid());

785be1b6298010956622771c870ab3cd8ca57a2faaron return AUTHZ_DENIED;

785be1b6298010956622771c870ab3cd8ca57a2faaron }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding t = require_args;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding while (t[0]) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding w = ap_getword(r->pool, &t, '=');

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding value = ap_getword_conf(r->pool, &t);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm "[%" APR_PID_T_FMT "] auth_ldap authorize: checking attribute"

785be1b6298010956622771c870ab3cd8ca57a2faaron " %s has value %s", getpid(), w, value);

785be1b6298010956622771c870ab3cd8ca57a2faaron result = util_ldap_cache_compare(r, ldc, sec->url, req->dn, w, value);

785be1b6298010956622771c870ab3cd8ca57a2faaron switch(result) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding case LDAP_COMPARE_TRUE: {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding 0, r, "[%" APR_PID_T_FMT "] auth_ldap authorize: "

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "require attribute: authorization successful",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding getpid());

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_GRANTED;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding default: {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding 0, r, "[%" APR_PID_T_FMT "] auth_ldap authorize: "

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding "require attribute: authorization failed [%s][%s]",

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding getpid(), ldc->reason, ldap_err2string(result));

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding }

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

8f8ec0957334f50b7ac11359f90490ee467258eedreid "[%" APR_PID_T_FMT "] auth_ldap authorize attribute: authorization denied for user %s to %s",

382fa07a63096c4a1aabfed36433ea5ac9c40ad0trawick getpid(), r->user, r->uri);

1ccd992d37d62c8cb2056126f2234f64ec189bfddougm

17f3ba69f65182426ad4e568bb2d6f192ccd2ed5trawick return AUTHZ_DENIED;

e6cc28a5eb3371ba0c38e941855e71ff0054f50erbb}

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

785be1b6298010956622771c870ab3cd8ca57a2faaronstatic authz_status ldapfilter_check_authorization(request_rec *r,

785be1b6298010956622771c870ab3cd8ca57a2faaron const char *require_args)

785be1b6298010956622771c870ab3cd8ca57a2faaron{

785be1b6298010956622771c870ab3cd8ca57a2faaron int result = 0;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding authn_ldap_request_t *req =

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding (authn_ldap_request_t *)ap_get_module_config(r->request_config, &authnz_ldap_module);

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf authn_ldap_config_t *sec =

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf (authn_ldap_config_t *)ap_get_module_config(r->per_dir_config, &authnz_ldap_module);

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

066877f1a045103acfdd376d48cdd473c33f409bdougm util_ldap_connection_t *ldc = NULL;

e6cc28a5eb3371ba0c38e941855e71ff0054f50erbb const char *t;

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding char filtbuf[FILTER_LENGTH];

785be1b6298010956622771c870ab3cd8ca57a2faaron const char *dn = NULL;

785be1b6298010956622771c870ab3cd8ca57a2faaron const char **vals = NULL;

785be1b6298010956622771c870ab3cd8ca57a2faaron

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding if (!sec->have_ldap_url) {

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding return AUTHZ_DENIED;

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf }

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf if (sec->host) {

b88f887ed5554d9050d97f9a56a89ae62bdbd906fanf ldc = util_ldap_connection_find(r, sec->host, sec->port,

09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding sec->binddn, sec->bindpw, sec->deref,

sec->secure);

apr_pool_cleanup_register(r->pool, ldc,

authnz_ldap_cleanup_connection_close,

apr_pool_cleanup_null);

}

else {

ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

"[%" APR_PID_T_FMT "] auth_ldap authorize: no sec->host - weird...?", getpid());

return AUTHZ_DENIED;

}

/*

/* Check that we have a userid to start with */

if ((!r->user) || (strlen(r->user) == 0)) {

ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

"ldap authorize: Userid is blank, AuthType=%s",

r->ap_auth_type);

}

if(!req) {

ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

"ldap authorize: Creating LDAP req structure");

/* Build the username filter */

authn_ldap_build_filter(filtbuf, r, r->user, NULL, sec);

/* Search for the user DN */

result = util_ldap_cache_getuserdn(r, ldc, sec->url, sec->basedn,

sec->scope, sec->attributes, filtbuf, &dn, &vals);

/* Search failed, log error and return failure */

if(result != LDAP_SUCCESS) {

ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

"auth_ldap authorise: User DN not found, %s", ldc->reason);

return AUTHZ_DENIED;

}

req = (authn_ldap_request_t *)apr_pcalloc(r->pool,

sizeof(authn_ldap_request_t));

ap_set_module_config(r->request_config, &authnz_ldap_module, req);

req->dn = apr_pstrdup(r->pool, dn);

req->user = r->user;

}

if (req->dn == NULL || strlen(req->dn) == 0) {

ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

"[%" APR_PID_T_FMT "] auth_ldap authorize: "

"require ldap-filter: user's DN has not been defined; failing authorization",

getpid());

return AUTHZ_DENIED;

}

t = require_args;

if (t[0]) {

ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

"[%" APR_PID_T_FMT "] auth_ldap authorize: checking filter %s",

getpid(), t);

/* Build the username filter */

authn_ldap_build_filter(filtbuf, r, req->user, t, sec);

/* Search for the user DN */

result = util_ldap_cache_getuserdn(r, ldc, sec->url, sec->basedn,

sec->scope, sec->attributes, filtbuf, &dn, &vals);

/* Make sure that the filtered search returned the correct user dn */

if (result == LDAP_SUCCESS) {

ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

"[%" APR_PID_T_FMT "] auth_ldap authorize: checking dn match %s",

getpid(), dn);

result = util_ldap_cache_comparedn(r, ldc, sec->url, req->dn, dn,

sec->compare_dn_on_server);

}

switch(result) {

case LDAP_COMPARE_TRUE: {

ap_log_rerror(APLOG_MARK, APLOG_DEBUG,

0, r, "[%" APR_PID_T_FMT "] auth_ldap authorize: "

"require ldap-filter: authorization "

"successful", getpid());

return AUTHZ_GRANTED;

}

case LDAP_FILTER_ERROR: {

ap_log_rerror(APLOG_MARK, APLOG_DEBUG,

0, r, "[%" APR_PID_T_FMT "] auth_ldap authorize: "

"require ldap-filter: %s authorization "

"failed [%s][%s]", getpid(),

filtbuf, ldc->reason, ldap_err2string(result));

break;

}

default: {

ap_log_rerror(APLOG_MARK, APLOG_DEBUG,

0, r, "[%" APR_PID_T_FMT "] auth_ldap authorize: "

"require ldap-filter: authorization "

"failed [%s][%s]", getpid(),

ldc->reason, ldap_err2string(result));

}

}

}

ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

"[%" APR_PID_T_FMT "] auth_ldap authorize filter: authorization denied for user %s to %s",

getpid(), r->user, r->uri);

return AUTHZ_DENIED;

}

static const char *mod_auth_ldap_parse_url(cmd_parms *cmd,

void *config,

const char *url,

const char *mode)

{

int rc;

apr_ldap_url_desc_t *urld;

apr_ldap_err_t *result;

authn_ldap_config_t *sec = config;

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

cmd->server, "[%" APR_PID_T_FMT "] auth_ldap url parse: `%s'", getpid(), url);

rc = apr_ldap_url_parse(cmd->pool, url, &(urld), &(result));

if (rc != APR_SUCCESS) {

return result->reason;

}

sec->url = apr_pstrdup(cmd->pool, url);

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

cmd->server, "[%" APR_PID_T_FMT "] auth_ldap url parse: Host: %s", getpid(), urld->lud_host);

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

cmd->server, "[%" APR_PID_T_FMT "] auth_ldap url parse: Port: %d", getpid(), urld->lud_port);

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

cmd->server, "[%" APR_PID_T_FMT "] auth_ldap url parse: DN: %s", getpid(), urld->lud_dn);

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

cmd->server, "[%" APR_PID_T_FMT "] auth_ldap url parse: attrib: %s", getpid(), urld->lud_attrs? urld->lud_attrs[0] : "(null)");

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

cmd->server, "[%" APR_PID_T_FMT "] auth_ldap url parse: scope: %s", getpid(),

(urld->lud_scope == LDAP_SCOPE_SUBTREE? "subtree" :

urld->lud_scope == LDAP_SCOPE_BASE? "base" :

urld->lud_scope == LDAP_SCOPE_ONELEVEL? "onelevel" : "unknown"));

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

cmd->server, "[%" APR_PID_T_FMT "] auth_ldap url parse: filter: %s", getpid(), urld->lud_filter);

/* Set all the values, or at least some sane defaults */

if (sec->host) {

sec->host = apr_pstrcat(cmd->pool, urld->lud_host, " ", sec->host, NULL);

}

else {

sec->host = urld->lud_host? apr_pstrdup(cmd->pool, urld->lud_host) : "localhost";

}

sec->basedn = urld->lud_dn? apr_pstrdup(cmd->pool, urld->lud_dn) : "";

if (urld->lud_attrs && urld->lud_attrs[0]) {

int i = 1;

while (urld->lud_attrs[i]) {

i++;

}

sec->attributes = apr_pcalloc(cmd->pool, sizeof(char *) * (i+1));

i = 0;

while (urld->lud_attrs[i]) {

sec->attributes[i] = apr_pstrdup(cmd->pool, urld->lud_attrs[i]);

i++;

}

sec->attribute = sec->attributes[0];

}

else {

sec->attribute = "uid";

}

sec->scope = urld->lud_scope == LDAP_SCOPE_ONELEVEL ?

LDAP_SCOPE_ONELEVEL : LDAP_SCOPE_SUBTREE;

if (urld->lud_filter) {

if (urld->lud_filter[0] == '(') {

/*

sec->filter = apr_pstrdup(cmd->pool, urld->lud_filter+1);

sec->filter[strlen(sec->filter)-1] = '\0';

}

else {

sec->filter = apr_pstrdup(cmd->pool, urld->lud_filter);

}

}

else {

sec->filter = "objectclass=*";

}

if (mode) {

if (0 == strcasecmp("NONE", mode)) {

sec->secure = APR_LDAP_NONE;

}

else if (0 == strcasecmp("SSL", mode)) {

sec->secure = APR_LDAP_SSL;

}

else if (0 == strcasecmp("TLS", mode) || 0 == strcasecmp("STARTTLS", mode)) {

sec->secure = APR_LDAP_STARTTLS;

}

else {

return "Invalid LDAP connection mode setting: must be one of NONE, "

"SSL, or TLS/STARTTLS";

}

}

/* "ldaps" indicates secure ldap connections desired

if (strncasecmp(url, "ldaps", 5) == 0)

{

sec->secure = APR_LDAP_SSL;

sec->port = urld->lud_port? urld->lud_port : LDAPS_PORT;

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, cmd->server,

"LDAP: auth_ldap using SSL connections");

}

else

{

sec->port = urld->lud_port? urld->lud_port : LDAP_PORT;

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, cmd->server,

"LDAP: auth_ldap not using SSL connections");

}

sec->have_ldap_url = 1;

return NULL;

}

static const char *mod_auth_ldap_set_deref(cmd_parms *cmd, void *config, const char *arg)

{

authn_ldap_config_t *sec = config;

if (strcmp(arg, "never") == 0 || strcasecmp(arg, "off") == 0) {

sec->deref = never;

}

else if (strcmp(arg, "searching") == 0) {

sec->deref = searching;

}

else if (strcmp(arg, "finding") == 0) {

sec->deref = finding;

}

else if (strcmp(arg, "always") == 0 || strcasecmp(arg, "on") == 0) {

sec->deref = always;

}

else {

return "Unrecognized value for AuthLDAPAliasDereference directive";

}

return NULL;

}

static const char *mod_auth_ldap_add_subgroup_attribute(cmd_parms *cmd, void *config, const char *arg)

{

int i = 0;

authn_ldap_config_t *sec = config;