source: trunk/server/source4/ldap_server/ldap_bind.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 11.0 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 LDAP server
4 Copyright (C) Stefan Metzmacher 2004
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18*/
19
20#include "includes.h"
21#include "ldap_server/ldap_server.h"
22#include "auth/auth.h"
23#include "smbd/service.h"
24#include <ldb.h>
25#include <ldb_errors.h>
26#include "dsdb/samdb/samdb.h"
27#include "auth/gensec/gensec.h"
28#include "auth/gensec/gensec_tstream.h"
29#include "param/param.h"
30#include "../lib/util/tevent_ntstatus.h"
31
32static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
33{
34 struct ldap_BindRequest *req = &call->request->r.BindRequest;
35 struct ldapsrv_reply *reply;
36 struct ldap_BindResponse *resp;
37
38 int result;
39 const char *errstr;
40 const char *nt4_domain, *nt4_account;
41
42 struct auth_session_info *session_info;
43
44 NTSTATUS status;
45
46 DEBUG(10, ("BindSimple dn: %s\n",req->dn));
47
48 status = crack_auto_name_to_nt4_name(call, call->conn->connection->event.ctx, call->conn->lp_ctx, req->dn, &nt4_domain, &nt4_account);
49 if (NT_STATUS_IS_OK(status)) {
50 status = authenticate_username_pw(call,
51 call->conn->connection->event.ctx,
52 call->conn->connection->msg_ctx,
53 call->conn->lp_ctx,
54 nt4_domain, nt4_account,
55 req->creds.password,
56 MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
57 MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
58 &session_info);
59 }
60
61 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
62 if (!reply) {
63 return NT_STATUS_NO_MEMORY;
64 }
65
66 if (NT_STATUS_IS_OK(status)) {
67 result = LDAP_SUCCESS;
68 errstr = NULL;
69
70 talloc_unlink(call->conn, call->conn->session_info);
71 call->conn->session_info = session_info;
72 talloc_steal(call->conn, session_info);
73
74 /* don't leak the old LDB */
75 talloc_unlink(call->conn, call->conn->ldb);
76
77 status = ldapsrv_backend_Init(call->conn);
78
79 if (!NT_STATUS_IS_OK(status)) {
80 result = LDAP_OPERATIONS_ERROR;
81 errstr = talloc_asprintf(reply, "Simple Bind: Failed to advise ldb new credentials: %s", nt_errstr(status));
82 }
83 } else {
84 status = nt_status_squash(status);
85
86 result = LDAP_INVALID_CREDENTIALS;
87 errstr = talloc_asprintf(reply, "Simple Bind Failed: %s", nt_errstr(status));
88 }
89
90 resp = &reply->msg->r.BindResponse;
91 resp->response.resultcode = result;
92 resp->response.errormessage = errstr;
93 resp->response.dn = NULL;
94 resp->response.referral = NULL;
95 resp->SASL.secblob = NULL;
96
97 ldapsrv_queue_reply(call, reply);
98 return NT_STATUS_OK;
99}
100
101struct ldapsrv_sasl_postprocess_context {
102 struct ldapsrv_connection *conn;
103 struct tstream_context *sasl;
104};
105
106struct ldapsrv_sasl_postprocess_state {
107 uint8_t dummy;
108};
109
110static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
111 struct tevent_context *ev,
112 void *private_data)
113{
114 struct ldapsrv_sasl_postprocess_context *context =
115 talloc_get_type_abort(private_data,
116 struct ldapsrv_sasl_postprocess_context);
117 struct tevent_req *req;
118 struct ldapsrv_sasl_postprocess_state *state;
119
120 req = tevent_req_create(mem_ctx, &state,
121 struct ldapsrv_sasl_postprocess_state);
122 if (req == NULL) {
123 return NULL;
124 }
125
126 TALLOC_FREE(context->conn->sockets.sasl);
127 context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
128 context->conn->sockets.active = context->conn->sockets.sasl;
129
130 tevent_req_done(req);
131 return tevent_req_post(req, ev);
132}
133
134static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
135{
136 return tevent_req_simple_recv_ntstatus(req);
137}
138
139static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
140{
141 struct ldap_BindRequest *req = &call->request->r.BindRequest;
142 struct ldapsrv_reply *reply;
143 struct ldap_BindResponse *resp;
144 struct ldapsrv_connection *conn;
145 int result = 0;
146 const char *errstr=NULL;
147 NTSTATUS status = NT_STATUS_OK;
148
149 DEBUG(10, ("BindSASL dn: %s\n",req->dn));
150
151 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
152 if (!reply) {
153 return NT_STATUS_NO_MEMORY;
154 }
155 resp = &reply->msg->r.BindResponse;
156
157 conn = call->conn;
158
159 /*
160 * TODO: a SASL bind with a different mechanism
161 * should cancel an inprogress SASL bind.
162 * (see RFC 4513)
163 */
164
165 if (!conn->gensec) {
166 conn->session_info = NULL;
167
168 status = samba_server_gensec_start(conn,
169 conn->connection->event.ctx,
170 conn->connection->msg_ctx,
171 conn->lp_ctx,
172 conn->server_credentials,
173 "ldap",
174 &conn->gensec);
175 if (!NT_STATUS_IS_OK(status)) {
176 DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status)));
177 result = LDAP_OPERATIONS_ERROR;
178 errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s",
179 nt_errstr(status));
180 } else {
181
182 gensec_want_feature(conn->gensec, GENSEC_FEATURE_SIGN);
183 gensec_want_feature(conn->gensec, GENSEC_FEATURE_SEAL);
184 gensec_want_feature(conn->gensec, GENSEC_FEATURE_ASYNC_REPLIES);
185
186 status = gensec_start_mech_by_sasl_name(conn->gensec, req->creds.SASL.mechanism);
187
188 if (!NT_STATUS_IS_OK(status)) {
189 DEBUG(1, ("Failed to start GENSEC SASL[%s] server code: %s\n",
190 req->creds.SASL.mechanism, nt_errstr(status)));
191 result = LDAP_OPERATIONS_ERROR;
192 errstr = talloc_asprintf(reply, "SASL:[%s]: Failed to start authentication backend: %s",
193 req->creds.SASL.mechanism, nt_errstr(status));
194 }
195 }
196 }
197
198 if (NT_STATUS_IS_OK(status)) {
199 DATA_BLOB input = data_blob(NULL, 0);
200 DATA_BLOB output = data_blob(NULL, 0);
201
202 if (req->creds.SASL.secblob) {
203 input = *req->creds.SASL.secblob;
204 }
205
206 status = gensec_update(conn->gensec, reply,
207 input, &output);
208
209 /* Windows 2000 mmc doesn't like secblob == NULL and reports a decoding error */
210 resp->SASL.secblob = talloc(reply, DATA_BLOB);
211 NT_STATUS_HAVE_NO_MEMORY(resp->SASL.secblob);
212 *resp->SASL.secblob = output;
213 } else {
214 resp->SASL.secblob = NULL;
215 }
216
217 if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
218 result = LDAP_SASL_BIND_IN_PROGRESS;
219 errstr = NULL;
220 } else if (NT_STATUS_IS_OK(status)) {
221 struct auth_session_info *old_session_info=NULL;
222 struct ldapsrv_sasl_postprocess_context *context = NULL;
223
224 result = LDAP_SUCCESS;
225 errstr = NULL;
226
227 if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
228 gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
229
230 context = talloc(call, struct ldapsrv_sasl_postprocess_context);
231
232 if (!context) {
233 status = NT_STATUS_NO_MEMORY;
234 }
235 }
236
237 if (context && conn->sockets.tls) {
238 TALLOC_FREE(context);
239 status = NT_STATUS_NOT_SUPPORTED;
240 result = LDAP_UNWILLING_TO_PERFORM;
241 errstr = talloc_asprintf(reply,
242 "SASL:[%s]: Sign or Seal are not allowed if TLS is used",
243 req->creds.SASL.mechanism);
244 }
245
246 if (context && conn->sockets.sasl) {
247 TALLOC_FREE(context);
248 status = NT_STATUS_NOT_SUPPORTED;
249 result = LDAP_UNWILLING_TO_PERFORM;
250 errstr = talloc_asprintf(reply,
251 "SASL:[%s]: Sign or Seal are not allowed if SASL encryption has already been set up",
252 req->creds.SASL.mechanism);
253 }
254
255 if (context) {
256 context->conn = conn;
257 status = gensec_create_tstream(context,
258 context->conn->gensec,
259 context->conn->sockets.raw,
260 &context->sasl);
261 if (NT_STATUS_IS_OK(status)) {
262 if (!talloc_reference(context->sasl, conn->gensec)) {
263 status = NT_STATUS_NO_MEMORY;
264 }
265 }
266 }
267
268 if (result != LDAP_SUCCESS) {
269 conn->session_info = old_session_info;
270 } else if (!NT_STATUS_IS_OK(status)) {
271 conn->session_info = old_session_info;
272 result = LDAP_OPERATIONS_ERROR;
273 errstr = talloc_asprintf(reply,
274 "SASL:[%s]: Failed to setup SASL socket: %s",
275 req->creds.SASL.mechanism, nt_errstr(status));
276 } else {
277
278 old_session_info = conn->session_info;
279 conn->session_info = NULL;
280 status = gensec_session_info(conn->gensec, &conn->session_info);
281 if (!NT_STATUS_IS_OK(status)) {
282 conn->session_info = old_session_info;
283 result = LDAP_OPERATIONS_ERROR;
284 errstr = talloc_asprintf(reply,
285 "SASL:[%s]: Failed to get session info: %s",
286 req->creds.SASL.mechanism, nt_errstr(status));
287 } else {
288 talloc_unlink(conn, old_session_info);
289 talloc_steal(conn, conn->session_info);
290
291 /* don't leak the old LDB */
292 talloc_unlink(conn, conn->ldb);
293
294 status = ldapsrv_backend_Init(conn);
295
296 if (!NT_STATUS_IS_OK(status)) {
297 result = LDAP_OPERATIONS_ERROR;
298 errstr = talloc_asprintf(reply,
299 "SASL:[%s]: Failed to advise samdb of new credentials: %s",
300 req->creds.SASL.mechanism,
301 nt_errstr(status));
302 }
303 }
304 }
305
306 if (NT_STATUS_IS_OK(status) && context) {
307 call->postprocess_send = ldapsrv_sasl_postprocess_send;
308 call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
309 call->postprocess_private = context;
310 }
311 talloc_unlink(conn, conn->gensec);
312 conn->gensec = NULL;
313 } else {
314 status = nt_status_squash(status);
315 if (result == 0) {
316 result = LDAP_INVALID_CREDENTIALS;
317 errstr = talloc_asprintf(reply, "SASL:[%s]: %s", req->creds.SASL.mechanism, nt_errstr(status));
318 }
319 talloc_unlink(conn, conn->gensec);
320 conn->gensec = NULL;
321 }
322
323 resp->response.resultcode = result;
324 resp->response.dn = NULL;
325 resp->response.errormessage = errstr;
326 resp->response.referral = NULL;
327
328 ldapsrv_queue_reply(call, reply);
329 return NT_STATUS_OK;
330}
331
332NTSTATUS ldapsrv_BindRequest(struct ldapsrv_call *call)
333{
334 struct ldap_BindRequest *req = &call->request->r.BindRequest;
335 struct ldapsrv_reply *reply;
336 struct ldap_BindResponse *resp;
337
338 /*
339 * TODO: we should fail the bind request
340 * if there're any pending requests.
341 *
342 * also a simple bind should cancel an
343 * inprogress SASL bind.
344 * (see RFC 4513)
345 */
346 switch (req->mechanism) {
347 case LDAP_AUTH_MECH_SIMPLE:
348 return ldapsrv_BindSimple(call);
349 case LDAP_AUTH_MECH_SASL:
350 return ldapsrv_BindSASL(call);
351 }
352
353 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
354 if (!reply) {
355 return NT_STATUS_NO_MEMORY;
356 }
357
358 resp = &reply->msg->r.BindResponse;
359 resp->response.resultcode = 7;
360 resp->response.dn = NULL;
361 resp->response.errormessage = talloc_asprintf(reply, "Bad AuthenticationChoice [%d]", req->mechanism);
362 resp->response.referral = NULL;
363 resp->SASL.secblob = NULL;
364
365 ldapsrv_queue_reply(call, reply);
366 return NT_STATUS_OK;
367}
368
369NTSTATUS ldapsrv_UnbindRequest(struct ldapsrv_call *call)
370{
371 DEBUG(10, ("UnbindRequest\n"));
372 return NT_STATUS_OK;
373}
Note: See TracBrowser for help on using the repository browser.