1N/A/*
1N/A * Copyright 2002-2003 Sun Microsystems, Inc. All rights reserved.
1N/A * Use is subject to license terms.
1N/A */
1N/A
1N/A#pragma ident "%Z%%M% %I% %E% SMI"
1N/A
1N/A/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*-
1N/A *
1N/A * The contents of this file are subject to the Netscape Public License
1N/A * Version 1.0 (the "NPL"); you may not use this file except in
1N/A * compliance with the NPL. You may obtain a copy of the NPL at
1N/A * http://www.mozilla.org/NPL/
1N/A *
1N/A * Software distributed under the NPL is distributed on an "AS IS" basis,
1N/A * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the NPL
1N/A * for the specific language governing rights and limitations under the
1N/A * NPL.
1N/A *
1N/A * The Initial Developer of the Original Code is Netscape
1N/A * Communications Corporation. Portions created by Netscape are
1N/A * Copyright (C) 1998-1999 Netscape Communications Corporation. All
1N/A * Rights Reserved.
1N/A *
1N/A * Contributor(s):
1N/A */
1N/A#include "ldap-int.h"
1N/A
1N/A/*
1N/A * ldap_sasl_bind - authenticate to the ldap server. The dn, mechanism,
1N/A * and credentials of the entry to which to bind are supplied. An LDAP
1N/A * error code is returned and if LDAP_SUCCESS is returned *msgidp is set
1N/A * to the id of the request initiated.
1N/A *
1N/A * Example:
1N/A * struct berval creds;
1N/A * LDAPControl **ctrls;
1N/A * int err, msgid;
1N/A * ... fill in creds with credentials ...
1N/A * ... fill in ctrls with server controls ...
1N/A * err = ldap_sasl_bind( ld, "cn=manager, o=university of michigan, c=us",
1N/A * "mechanismname", &creds, ctrls, NULL, &msgid );
1N/A */
1N/Aint
1N/ALDAP_CALL
1N/Aldap_sasl_bind(
1N/A LDAP *ld,
1N/A const char *dn,
1N/A const char *mechanism,
1N/A const struct berval *cred,
1N/A LDAPControl **serverctrls,
1N/A LDAPControl **clientctrls,
1N/A int *msgidp
1N/A)
1N/A{
1N/A BerElement *ber;
1N/A int rc, simple, msgid, ldapversion;
1N/A
1N/A /*
1N/A * The ldapv3 bind request looks like this:
1N/A * BindRequest ::= SEQUENCE {
1N/A * version INTEGER,
1N/A * name DistinguishedName, -- who
1N/A * authentication CHOICE {
1N/A * simple [0] OCTET STRING, -- passwd
1N/A * sasl [3] SaslCredentials -- v3 only
1N/A * }
1N/A * }
1N/A * SaslCredentials ::= SEQUENCE {
1N/A * mechanism LDAPString,
1N/A * credentials OCTET STRING
1N/A * }
1N/A * all wrapped up in an LDAPMessage sequence.
1N/A */
1N/A
1N/A LDAPDebug( LDAP_DEBUG_TRACE, "ldap_sasl_bind\n", 0, 0, 0 );
1N/A
1N/A if ( msgidp == NULL ) {
1N/A LDAP_SET_LDERRNO( ld, LDAP_PARAM_ERROR, NULL, NULL );
1N/A return( LDAP_PARAM_ERROR );
1N/A }
1N/A
1N/A simple = ( mechanism == LDAP_SASL_SIMPLE );
1N/A ldapversion = NSLDAPI_LDAP_VERSION( ld );
1N/A
1N/A /* only ldapv3 or higher can do sasl binds */
1N/A if ( !simple && ldapversion < LDAP_VERSION3 ) {
1N/A LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
1N/A return( LDAP_NOT_SUPPORTED );
1N/A }
1N/A
1N/A LDAP_MUTEX_LOCK( ld, LDAP_MSGID_LOCK );
1N/A msgid = ++ld->ld_msgid;
1N/A LDAP_MUTEX_UNLOCK( ld, LDAP_MSGID_LOCK );
1N/A
1N/A if ( dn == NULL )
1N/A dn = "";
1N/A
1N/A if ( ld->ld_cache_on && ld->ld_cache_bind != NULL ) {
1N/A LDAP_MUTEX_LOCK( ld, LDAP_CACHE_LOCK );
1N/A if ( (rc = (ld->ld_cache_bind)( ld, msgid, LDAP_REQ_BIND, dn,
1N/A cred, LDAP_AUTH_SASL )) != 0 ) {
1N/A *msgidp = rc;
1N/A LDAP_MUTEX_UNLOCK( ld, LDAP_CACHE_LOCK );
1N/A return( LDAP_SUCCESS );
1N/A }
1N/A LDAP_MUTEX_UNLOCK( ld, LDAP_CACHE_LOCK );
1N/A }
1N/A
1N/A /* create a message to send */
1N/A if (( rc = nsldapi_alloc_ber_with_options( ld, &ber ))
1N/A != LDAP_SUCCESS ) {
1N/A return( rc );
1N/A }
1N/A
1N/A /* fill it in */
1N/A if ( simple ) { /* simple bind; works in LDAPv2 or v3 */
1N/A struct berval tmpcred;
1N/A
1N/A if ( cred == NULL ) {
1N/A tmpcred.bv_val = "";
1N/A tmpcred.bv_len = 0;
1N/A cred = &tmpcred;
1N/A }
1N/A rc = ber_printf( ber, "{it{isto}", msgid, LDAP_REQ_BIND,
1N/A ldapversion, dn, LDAP_AUTH_SIMPLE, cred->bv_val,
1N/A (int)cred->bv_len /* XXX lossy cast */ );
1N/A
1N/A } else { /* SASL bind; requires LDAPv3 or better */
1N/A if ( cred == NULL ) {
1N/A rc = ber_printf( ber, "{it{ist{s}}", msgid,
1N/A LDAP_REQ_BIND, ldapversion, dn, LDAP_AUTH_SASL,
1N/A mechanism );
1N/A } else {
1N/A rc = ber_printf( ber, "{it{ist{so}}", msgid,
1N/A LDAP_REQ_BIND, ldapversion, dn, LDAP_AUTH_SASL,
1N/A mechanism, cred->bv_val,
1N/A (int)cred->bv_len /* XXX lossy cast */ );
1N/A }
1N/A }
1N/A
1N/A if ( rc == -1 ) {
1N/A LDAP_SET_LDERRNO( ld, LDAP_ENCODING_ERROR, NULL, NULL );
1N/A ber_free( ber, 1 );
1N/A return( LDAP_ENCODING_ERROR );
1N/A }
1N/A
1N/A if ( (rc = nsldapi_put_controls( ld, serverctrls, 1, ber ))
1N/A != LDAP_SUCCESS ) {
1N/A ber_free( ber, 1 );
1N/A return( rc );
1N/A }
1N/A
1N/A /* send the message */
1N/A rc = nsldapi_send_initial_request( ld, msgid, LDAP_REQ_BIND,
1N/A (char *)dn, ber );
1N/A *msgidp = rc;
1N/A return( rc < 0 ? LDAP_GET_LDERRNO( ld, NULL, NULL ) : LDAP_SUCCESS );
1N/A}
1N/A
1N/A/*
1N/A * ldap_sasl_bind_s - bind to the ldap server using sasl authentication
1N/A * The dn, mechanism, and credentials of the entry to which to bind are
1N/A * supplied. LDAP_SUCCESS is returned upon success, the ldap error code
1N/A * otherwise.
1N/A *
1N/A * Example:
1N/A * struct berval creds;
1N/A * ... fill in creds with credentials ...
1N/A * ldap_sasl_bind_s( ld, "cn=manager, o=university of michigan, c=us",
1N/A * "mechanismname", &creds )
1N/A */
1N/Aint
1N/ALDAP_CALL
1N/Aldap_sasl_bind_s(
1N/A LDAP *ld,
1N/A const char *dn,
1N/A const char *mechanism,
1N/A const struct berval *cred,
1N/A LDAPControl **serverctrls,
1N/A LDAPControl **clientctrls,
1N/A struct berval **servercredp
1N/A)
1N/A{
1N/A int err, msgid;
1N/A LDAPMessage *result;
1N/A
1N/A LDAPDebug( LDAP_DEBUG_TRACE, "ldap_sasl_bind_s\n", 0, 0, 0 );
1N/A
1N/A if ( NSLDAPI_LDAP_VERSION( ld ) < LDAP_VERSION3 ) {
1N/A LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
1N/A return( LDAP_NOT_SUPPORTED );
1N/A }
1N/A
1N/A if ( ( err = ldap_sasl_bind( ld, dn, mechanism, cred, serverctrls,
1N/A clientctrls, &msgid )) != LDAP_SUCCESS )
1N/A return( err );
1N/A
1N/A if ( ldap_result( ld, msgid, 1, (struct timeval *) 0, &result ) == -1 )
1N/A return( LDAP_GET_LDERRNO( ld, NULL, NULL ) );
1N/A
1N/A err = ldap_parse_sasl_bind_result( ld, result, servercredp, 0 );
1N/A if (err != LDAP_SUCCESS && err != LDAP_SASL_BIND_IN_PROGRESS) {
1N/A ldap_msgfree( result );
1N/A return( err );
1N/A }
1N/A
1N/A return( ldap_result2error( ld, result, 1 ) );
1N/A}
1N/A
1N/A
1N/A/* returns an LDAP error code that indicates if parse succeeded or not */
1N/Aint
1N/ALDAP_CALL
1N/Aldap_parse_sasl_bind_result(
1N/A LDAP *ld,
1N/A LDAPMessage *res,
1N/A struct berval **servercredp,
1N/A int freeit
1N/A)
1N/A{
1N/A BerElement ber;
1N/A int rc, err;
1N/A ber_int_t along;
1N/A ber_len_t len;
1N/A char *m, *e;
1N/A
1N/A LDAPDebug( LDAP_DEBUG_TRACE, "ldap_parse_sasl_bind_result\n", 0, 0, 0 );
1N/A
1N/A /*
1N/A * the ldapv3 SASL bind response looks like this:
1N/A *
1N/A * BindResponse ::= [APPLICATION 1] SEQUENCE {
1N/A * COMPONENTS OF LDAPResult,
1N/A * serverSaslCreds [7] OCTET STRING OPTIONAL
1N/A * }
1N/A *
1N/A * all wrapped up in an LDAPMessage sequence.
1N/A */
1N/A
1N/A if ( !NSLDAPI_VALID_LDAP_POINTER( ld ) ||
1N/A !NSLDAPI_VALID_LDAPMESSAGE_BINDRESULT_POINTER( res )) {
1N/A return( LDAP_PARAM_ERROR );
1N/A }
1N/A
1N/A /* only ldapv3 or higher can do sasl binds */
1N/A if ( NSLDAPI_LDAP_VERSION( ld ) < LDAP_VERSION3 ) {
1N/A LDAP_SET_LDERRNO( ld, LDAP_NOT_SUPPORTED, NULL, NULL );
1N/A return( LDAP_NOT_SUPPORTED );
1N/A }
1N/A
1N/A if ( servercredp != NULL ) {
1N/A *servercredp = NULL;
1N/A }
1N/A
1N/A ber = *(res->lm_ber); /* struct copy */
1N/A
1N/A /* skip past message id, matched dn, error message ... */
1N/A rc = ber_scanf( &ber, "{iaa}", &along, &m, &e );
1N/A
1N/A if ( rc != LBER_ERROR &&
1N/A ber_peek_tag( &ber, &len ) == LDAP_TAG_SASL_RES_CREDS ) {
1N/A rc = ber_get_stringal( &ber, servercredp );
1N/A }
1N/A
1N/A if ( freeit ) {
1N/A ldap_msgfree( res );
1N/A }
1N/A
1N/A if ( rc == LBER_ERROR ) {
1N/A err = LDAP_DECODING_ERROR;
1N/A } else {
1N/A err = (int) along;
1N/A }
1N/A
1N/A LDAP_SET_LDERRNO( ld, err, m, e );
1N/A /* this is a little kludge for the 3.0 Barracuda/hammerhead relese */
1N/A /* the docs state that the return is either LDAP_DECODING_ERROR */
1N/A /* or LDAP_SUCCESS. Here we match the docs... it's cleaner in 3.1 */
1N/A
1N/A if ( LDAP_DECODING_ERROR == err ) {
1N/A return (LDAP_DECODING_ERROR);
1N/A } else {
1N/A return( LDAP_SUCCESS );
1N/A }
1N/A}