webserver: comparison src/server/daemon/ldap

-:9a36a6b52e4c
+:467ed0f559af
 static LDAPConfig ws_ldap_default_config = {
 NULL, // resource
 NULL, // basedn
 NULL, // binddn
 NULL, // bindpw
-"(&(objectclass=inetorgperson)(!(cn=%s)(uid=%s)))", // userSearchFilter
+"(&(objectclass=inetorgperson)(|(cn=%s)(uid=%s)))", // userSearchFilter
 ws_ldap_default_uid_attr, // uidAttributes
 1, // numUidAttributes
 "(&(|(objectclass=groupOfNames)(objectclass=groupOfUniqueNames))(cn=%s))", // groupSearchFilter
 ws_ldap_default_member_attr, // memberAttributes
 2, // numMemberAttributes
 static LDAPConfig ws_ldap_ad_config = {
 NULL, // resource
 NULL, // basedn
 NULL, // binddn
 NULL, // bindpw
-"(&(objectclass=inetorgperson)(!(cn=%s)(uid=%s)))", // userSearchFilter
+"(&(objectclass=inetorgperson)(|(cn=%s)(uid=%s)))", // userSearchFilter
 ws_ad_default_uid_attr, // uidAttributes
 1, // numUidAttributes
 "", // groupSearchFilter
 ws_ad_default_member_attr, // memberAttributes
 2, // numMemberAttributes
 cxstring uidAttributes = serverconfig_object_directive_value(node, cx_str("UidAttributes"));
 cxstring groupSearchFilter = serverconfig_object_directive_value(node, cx_str("GroupSearchFilter"));
 cxstring memberAttributes = serverconfig_object_directive_value(node, cx_str("MemberAttributes"));
 cxstring memberType = serverconfig_object_directive_value(node, cx_str("MemberType"));
 cxstring enableGroups = serverconfig_object_directive_value(node, cx_str("EnableGroups"));
 cxstring userNameIsDn = serverconfig_object_directive_value(node, cx_str("UserNameIsDn"));
 if(!resource.ptr) {
 // TODO: create resource pool
 } else {
-authdb->config.resource = resource.ptr;
+authdb->config.resource = cx_strdup_a(cfg->a, resource).ptr;
+if(!authdb->config.resource) return NULL;
 }
 if(!basedn.ptr) {
 log_ereport(LOG_FAILURE, "ldap authdb %s: basedn is required", name);
 return NULL;
 }
-authdb->config.basedn = basedn.ptr;
+authdb->config.basedn = cx_strdup_a(cfg->a, basedn).ptr;
+if(!authdb->config.basedn) return NULL;
 // optional config
 if(binddn.ptr) {
 if(!bindpw.ptr) {
 log_ereport(LOG_FAILURE, "ldap authdb %s: binddn specified, but no bindpw", name);
 return NULL;
 }
-authdb->config.binddn = binddn.ptr;
+authdb->config.binddn = cx_strdup_a(cfg->a, binddn).ptr;
-authdb->config.bindpw = bindpw.ptr;
+authdb->config.bindpw = cx_strdup_a(cfg->a, bindpw).ptr;
-}
+if(!authdb->config.binddn || !authdb->config.bindpw) {
+return NULL;
+}
+}
 if(userSearchFilter.ptr) {
-authdb->config.userSearchFilter = userSearchFilter.ptr;
+authdb->config.userSearchFilter = cx_strdup_a(cfg->a, userSearchFilter).ptr;
 }
 if(uidAttributes.ptr) {
-authdb->config.numUidAttributes = cx_strsplit_a(
+cxmutstr uidAttributesCopy = cx_strdup_a(cfg->a, uidAttributes);
-cfg->a,
+if(uidAttributesCopy.ptr) {
-uidAttributes,
+authdb->config.numUidAttributes = cx_strsplit_a(
-cx_str(","),
+cfg->a,
-1024,
+cx_strcast(uidAttributesCopy),
-&authdb->config.uidAttributes);
+cx_str(","),
+1024,
+&authdb->config.uidAttributes);
+}
 }
 if(groupSearchFilter.ptr) {
 authdb->config.groupSearchFilter = groupSearchFilter.ptr;
 }
 if(memberAttributes.ptr) {
-authdb->config.numMemberAttributes = cx_strsplit_a(
+cxmutstr memberAttributesCopy = cx_strdup_a(cfg->a, memberAttributes);
-cfg->a,
+if(memberAttributesCopy.ptr) {
-memberAttributes,
+authdb->config.numMemberAttributes = cx_strsplit_a(
-cx_str(","),
+cfg->a,
-1024,
+cx_strcast(memberAttributesCopy),
-&authdb->config.memberAttributes);
+cx_str(","),
+1024,
+&authdb->config.memberAttributes);
+}
 }
 if(memberType.ptr) {
 if(!cx_strcmp(memberType, cx_str("dn"))) {
 authdb->config.groupMemberType = WS_LDAP_GROUP_MEMBER_DN;
-} else if(cx_strcmp(memberType, cx_str("uid"))) {
+} else if(!cx_strcmp(memberType, cx_str("uid"))) {
 authdb->config.groupMemberType = WS_LDAP_GROUP_MEMBER_UID;
 } else {
 log_ereport(LOG_FAILURE, "ldap authdb %s: unknown MemberType %s", name, memberType.ptr);
 return NULL;
 }
 }
 return ldap;
 }
+static LDAPUser* ldap_msg_to_user(
+Session *sn,
+Request *rq,
+LDAPAuthDB *authdb,
+LDAP *ldap,
+LDAPMessage *msg)
+{
+CxAllocator *a = pool_allocator(sn->pool);
+LDAPUser *user = pool_malloc(sn->pool, sizeof(LDAPUser));
+if(!user) {
+return NULL;
+}
+// get dn
+char *ldap_dn = ldap_get_dn(ldap, msg);
+if(!ldap_dn) {
+return NULL;
+}
+char *dn = pool_strdup(sn->pool, ldap_dn);
+ldap_memfree(ldap_dn);
+if(!dn) {
+return NULL;
+}
+// get uid
+char *uid = NULL;
+// values of configured UidAttributes
+size_t numUidAttributes = authdb->config.numUidAttributes;
+cxmutstr *uid_values = pool_calloc(sn->pool, authdb->config.numUidAttributes, sizeof(cxmutstr));
+if(!uid_values) {
+return NULL;
+}
+BerElement *ber = NULL;
+char *attribute = ldap_first_attribute(ldap, msg, &ber);
+while(attribute) {
+cxstring attr = cx_str(attribute);
+for(int i=0;i<numUidAttributes;i++) {
+// check if the attribute is one of the uid attributes
+if(!uid_values[i].ptr && !cx_strcmp(attr, authdb->config.uidAttributes[i])) {
+// copy value to uid_values
+struct berval **values = ldap_get_values_len(ldap, msg, attribute);
+if(values) {
+int count = ldap_count_values_len(values);
+if(count > 0) {
+cxstring attr_val = cx_strn(values[0]->bv_val, values[0]->bv_len);
+uid_values[i] = cx_strdup_a(a, attr_val);
+} else {
+log_ereport(LOG_FAILURE, "ldap user: dn: %s   attribute %s: no values", dn, attribute);
+}
+ldap_value_free_len(values);
+}
+}
+}
+if(uid_values[0].ptr) {
+// if we found a value for the first attribute, we can use that
+break;
+}
+ldap_memfree(attribute);
+attribute = ldap_next_attribute(ldap, msg, ber);
+}
+// use first value as uid
+for(int i=0;i<numUidAttributes;i++) {
+if(uid_values[i].ptr) {
+if(!uid) {
+uid = uid_values[i].ptr;
+} else {
+cxFree(a, uid_values[i].ptr);
+}
+}
+}
+pool_free(sn->pool, uid_values);
+// get user name
+char *username;
+if(authdb->config.userNameIsDN) {
+username = dn;
+}  else {
+username = uid;
+}
+if(!username) {
+return NULL;
+}
+user->authdb = authdb;
+user->user.verify_password = ldap_user_verify_password;
+user->user.check_group = ldap_user_check_group;
+user->user.free = ldap_user_free;
+user->user.name = username;
+user->sn = sn;
+user->rq = rq;
+// TODO: get uid/gid from ldap
+user->user.uid = -1;
+user->user.gid = -1;
+user->ldap = ldap;
+user->userdn = dn;
+user->uid_attr = uid;
+return user;
+}
 User* ldap_get_user(AuthDB *db, Session *sn, Request *rq, const char *username) {
 LDAPAuthDB *authdb = (LDAPAuthDB*) db;
 LDAPConfig *config = &authdb->config;
+CxAllocator *a = pool_allocator(sn->pool);
 LDAP *ld = get_ldap_session(sn, rq, authdb);
 if (ld == NULL) {
-fprintf(stderr, "ldap_init failed\n");
 return NULL;
 }
 // get the user dn
-// TODO: use config for filter
+cxstring userSearch = cx_str(config->userSearchFilter);
-// TODO: use asprintf
+cxmutstr filter = cx_strreplace_a(a, userSearch, cx_str("%s"), cx_str(username));
-char filter[128];
+if(!filter.ptr) {
-snprintf(filter, 128, "(uid=%s)", username);
+return NULL;
+}
+log_ereport(LOG_DEBUG, "ldap_get_user: filter: %s", filter.ptr);
 LDAPMessage *result;
 struct timeval timeout;
-timeout.tv_sec = 8;
+timeout.tv_sec = 8; // TODO: add config parameter for timeout
 timeout.tv_usec = 0;
 int r = ldap_search_ext_s(
 ld,
 config->basedn,
 LDAP_SCOPE_SUBTREE,
-filter,
+filter.ptr,
 NULL,
 0,
 NULL,        // server controls
 NULL,        // client controls
 &timeout,
-1,           // size limit
+2,           // size limit
 &result);
-if (r != LDAP_SUCCESS) {
+cxFree(a, filter.ptr);
-//ws_ldap_close(ld);
+if(r != LDAP_SUCCESS) {
+if(result) {
+ldap_msgfree(result);
+}
 log_ereport(LOG_FAILURE, "ldap_get_user: search failed: %s", ldap_err2string(r));
 return NULL;
 }
+if(!result) {
+// not sure if this can happen
+log_ereport(LOG_FAILURE, "ldap_get_user: search failed: no result");
+return NULL;
+}
 LDAPMessage *msg = ldap_first_entry(ld, result);
-if (msg) {
+LDAPUser *user = NULL;
-LDAPUser *user = pool_malloc(sn->pool, sizeof(LDAPUser));
+if(msg) {
-if (user != NULL) {
+if(ldap_count_entries(ld, msg) > 1) {
-user->authdb = authdb;
+log_ereport(LOG_FAILURE, "ldap_get_user: more than one search result");
-user->user.verify_password = ldap_user_verify_password;
+} else {
-user->user.check_group = ldap_user_check_group;
+user = ldap_msg_to_user(sn, rq, authdb, ld, msg);
-user->user.free = ldap_user_free;
+}
-user->user.name = pool_strdup(sn->pool, username);
+}
-user->sn = sn;
+ldap_msgfree(result);
-user->rq = rq;
+return (User*)user;
-// TODO: get uid/gid from ldap
-user->user.uid = -1;
-user->user.gid = -1;
-user->ldap = ld;
-user->userdn = ldap_get_dn(ld, msg);
-ldap_msgfree(result);
-return (User*)user;
-}
-}
-//ws_ldap_close(ld);
-return NULL;
 }
 LDAPGroup* ldap_get_group(Session *sn, Request *rq, LDAPAuthDB *authdb, const char *group) {
 printf("ldap_get_group: %s\n", group);
 &cred,
 NULL,
 NULL,
 &server_cred);
 if(r == LDAP_SUCCESS) {
-printf("ldap password ok\n");
+log_ereport(LOG_VERBOSE, "ldap user %s password ok", user->userdn);
 return 1;
 } else {
-printf("ldap password not ok\n");
+log_ereport(LOG_VERBOSE, "ldap user %s password not ok", user->userdn);
 return 0;
 }
 }
 int ldap_user_check_group(User *u, const char *group_str) {

comparison: src/server/daemon/ldap_auth.c

src/server/daemon/ldap_auth.c

Mercurial > hg > webserver / file comparison

comparison: src/server/daemon/ldap_auth.c

src/server/daemon/ldap_auth.c