27 #ifdef ENABLE_LDAP_AUTH
30 #include <glib/gstdio.h>
41 #define G_LOG_DOMAIN "lib ldap"
43 #define KEY_LDAP_HOST "ldaphost"
44 #define KEY_LDAP_DN_AUTH "authdn"
65 const gchar *username,
const gchar *password,
72 if (info == NULL || username == NULL || password == NULL || !info->
ldap_host)
74 g_debug (
"Not attempting ldap_connect: missing parameter.");
78 dn = ldap_auth_info_auth_dn (info, username);
85 g_debug (
"Could not bind to ldap host %s", info->
ldap_host);
89 ldap_unbind_ext_s (ldap, NULL, NULL);
110 gboolean allow_plaintext)
113 if (!ldap_host || !auth_dn)
116 if (ldap_auth_dn_is_good (auth_dn) == FALSE)
121 info->
auth_dn = g_strdup (auth_dn);
156 if (info == NULL || username == NULL)
159 gchar *dn = g_strdup_printf (info->
auth_dn, username);
178 ldap_auth_bind (
const gchar *host,
const gchar *userdn,
const gchar *password,
179 gboolean force_encryption,
const gchar *cacert)
183 int ldapv3 = LDAP_VERSION3;
184 gchar *ldapuri = NULL;
185 struct berval credential;
189 if (host == NULL || userdn == NULL || password == NULL)
194 if (strlen (password) == 0)
197 if (force_encryption == FALSE)
198 g_warning (
"Allowed plaintext LDAP authentication.");
205 fd = g_file_open_tmp (NULL, &name, &error);
208 g_warning (
"Could not open temp file for LDAP CACERTFILE: %s",
210 g_error_free (error);
214 if (g_chmod (name, 0600))
215 g_warning (
"Could not chmod for LDAP CACERTFILE");
217 g_file_set_contents (name, cacert, strlen (cacert), &error);
220 g_warning (
"Could not write LDAP CACERTFILE: %s", error->message);
221 g_error_free (error);
225 if (ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE, name)
227 g_warning (
"Could not set LDAP CACERTFILE option.");
234 ldapuri = g_strconcat (
"ldap://", host, NULL);
236 ldap_return = ldap_initialize (&ldap, ldapuri);
238 if (ldap == NULL || ldap_return != LDAP_SUCCESS)
240 g_warning (
"Could not open LDAP connection for authentication.");
246 ldap_return = ldap_set_option (ldap, LDAP_OPT_PROTOCOL_VERSION, &ldapv3);
247 if (ldap_return != LDAP_SUCCESS)
249 g_warning (
"Aborting, could not set ldap protocol version to 3: %s.",
250 ldap_err2string (ldap_return));
255 ldap_return = ldap_start_tls_s (ldap, NULL, NULL);
256 if (ldap_return != LDAP_SUCCESS)
259 g_warning (
"StartTLS failed, trying to establish ldaps connection.");
261 ldapuri = g_strconcat (
"ldaps://", host, NULL);
263 ldap_return = ldap_initialize (&ldap, ldapuri);
264 if (ldap == NULL || ldap_return != LDAP_SUCCESS)
266 if (force_encryption == TRUE)
268 g_warning (
"Aborting ldap authentication: Could not init LDAP "
269 "StartTLS nor ldaps: %s.",
270 ldap_err2string (ldap_return));
276 g_warning (
"Could not init LDAP StartTLS, nor ldaps: %s.",
277 ldap_err2string (ldap_return));
279 "Reinit LDAP connection to do plaintext authentication");
280 ldap_unbind_ext_s (ldap, NULL, NULL);
284 ldap_return = ldap_initialize (&ldap, ldapuri);
285 if (ldap == NULL || ldap_return != LDAP_SUCCESS)
288 "Could not reopen LDAP connection for authentication.");
296 g_debug (
"LDAP StartTLS initialized.");
302 gchar *use_dn = NULL;
306 if (ldap_str2dn (userdn, &dn, LDAP_DN_FORMAT_LDAPV3) == LDAP_SUCCESS)
308 gchar **use_uid = NULL;
311 uid = g_strsplit (userdn,
",", 2);
312 use_uid = g_strsplit (uid[0],
"=", 2);
314 if (!g_strcmp0 (use_uid[0],
"uid"))
321 g_strfreev (use_uid);
329 credential.bv_val = NULL;
330 credential.bv_len = 0U;
331 ldap_return = ldap_sasl_bind_s (ldap, NULL, LDAP_SASL_SIMPLE, &credential,
333 if (ldap_return != LDAP_SUCCESS)
335 g_warning (
"LDAP anonymous authentication failure: %s",
336 ldap_err2string (ldap_return));
341 char *attrs[2] = {
"dn", NULL};
342 LDAPMessage *result = NULL;
343 gchar **base = g_strsplit (userdn,
",", 2);
347 ldap_search_ext_s (ldap, base[1], LDAP_SCOPE_SUBTREE, uid[0], attrs,
348 0, NULL, NULL, NULL, 1, &result);
353 if (ldap_return != LDAP_SUCCESS)
354 use_dn = g_strdup (userdn);
358 found_dn = ldap_get_dn (ldap, result);
359 if ((found_dn == NULL) || (strlen (found_dn) == 0U))
360 use_dn = g_strdup (userdn);
362 use_dn = g_strdup (found_dn);
363 ldap_memfree (found_dn);
365 ldap_msgfree (result);
369 use_dn = g_strdup (userdn);
373 credential.bv_val = g_strdup (password);
374 credential.bv_len = strlen (password);
375 ldap_return = ldap_sasl_bind_s (ldap, use_dn, LDAP_SASL_SIMPLE,
376 &credential, NULL, NULL, NULL);
377 g_free (credential.bv_val);
379 if (ldap_return != LDAP_SUCCESS)
381 g_warning (
"LDAP authentication failure: %s.",
382 ldap_err2string (ldap_return));
413 ldap_auth_dn_is_good (
const gchar *authdn)
419 if (authdn == NULL || authdn[0] ==
'\0')
423 if (!strstr (authdn,
"%s"))
427 char *pos = strchr (authdn,
'%');
428 pos = strchr (pos + 1,
'%');
432 ln = strlen (authdn);
435 if (strchr (authdn,
'\\') && authdn[ln - 2] ==
'%' && authdn[ln - 1] ==
's')
439 if (authdn[0] ==
'%' && authdn[1] ==
's' && authdn[2] ==
'@')
443 eg = g_strdup_printf (authdn,
"example");
445 if (ldap_str2dn (eg, &dn, LDAP_DN_FORMAT_LDAPV3))
473 gboolean allow_plaintext)
477 (void) allow_plaintext;
493 const gchar *username,
const gchar *password,