summaryrefslogtreecommitdiffstats
path: root/clients/tools/ldapvc.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--clients/tools/ldapvc.c506
1 files changed, 506 insertions, 0 deletions
diff --git a/clients/tools/ldapvc.c b/clients/tools/ldapvc.c
new file mode 100644
index 0000000..8465618
--- /dev/null
+++ b/clients/tools/ldapvc.c
@@ -0,0 +1,506 @@
+/* ldapvc.c -- a tool for verifying credentials */
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 1998-2022 The OpenLDAP Foundation.
+ * Portions Copyright 2010 Kurt D. Zeilenga.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in the file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * <http://www.OpenLDAP.org/license.html>.
+ */
+/* Portions Copyright (c) 1992-1996 Regents of the University of Michigan.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that this notice is preserved and that due credit is given
+ * to the University of Michigan at Ann Arbor. The name of the
+ * University may not be used to endorse or promote products derived
+ * from this software without specific prior written permission. This
+ * software is provided ``as is'' without express or implied warranty.
+ */
+/* ACKNOWLEDGEMENTS:
+ * This work was originally developed by Kurt D. Zeilenga for inclusion
+ * in OpenLDAP Software based, in part, on other client tools.
+ */
+
+#include "portable.h"
+
+#include <stdio.h>
+
+#include <ac/stdlib.h>
+
+#include <ac/ctype.h>
+#include <ac/socket.h>
+#include <ac/string.h>
+#include <ac/time.h>
+#include <ac/unistd.h>
+
+#include <ldap.h>
+#include "lutil.h"
+#include "lutil_ldap.h"
+#include "ldap_defaults.h"
+
+#include "common.h"
+
+static int req_authzid = 0;
+static int req_pp = 0;
+
+#if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
+#define LDAP_SASL_NONE (~0U)
+static unsigned vc_sasl = LDAP_SASL_NONE;
+static char *vc_sasl_realm = NULL;
+static char *vc_sasl_authcid = NULL;
+static char *vc_sasl_authzid = NULL;
+static char *vc_sasl_mech = NULL;
+static char *vc_sasl_secprops = NULL;
+#endif
+static char * dn = NULL;
+static struct berval cred = {0, NULL};
+
+void
+usage( void )
+{
+ fprintf( stderr, _("Issue LDAP Verify Credentials operation to verify a user's credentials\n\n"));
+ fprintf( stderr, _("usage: %s [options] [DN [cred]])\n"), prog);
+ fprintf( stderr, _("where:\n"));
+ fprintf( stderr, _(" DN\tDistinguished Name\n"));
+ fprintf( stderr, _(" cred\tCredentials (prompt if not present)\n"));
+ fprintf( stderr, _("options:\n"));
+ fprintf( stderr, _(" -a\tRequest AuthzId\n"));
+ fprintf( stderr, _(" -b\tRequest Password Policy Information\n"));
+ fprintf( stderr, _(" -E sasl=(a[utomatic]|i[nteractive]|q[uiet]>\tSASL mode (defaults to automatic if any other -E option provided, otherwise none))\n"));
+ fprintf( stderr, _(" -E mech=<mech>\tSASL mechanism (default "" e.g. Simple)\n"));
+ fprintf( stderr, _(" -E realm=<realm>\tSASL Realm (defaults to none)\n"));
+ fprintf( stderr, _(" -E authcid=<authcid>\tSASL Authentication Identity (defaults to USER)\n"));
+ fprintf( stderr, _(" -E authzid=<authzid>\tSASL Authorization Identity (defaults to none)\n"));
+ fprintf( stderr, _(" -E secprops=<secprops>\tSASL Security Properties (defaults to none)\n"));
+ tool_common_usage();
+ exit( EXIT_FAILURE );
+}
+
+
+const char options[] = "abE:"
+ "d:D:e:h:H:InNO:o:p:QR:U:vVw:WxX:y:Y:Z";
+
+int
+handle_private_option( int i )
+{
+ switch ( i ) {
+ char *control, *cvalue;
+ case 'E': /* vc extension */
+ if( protocol == LDAP_VERSION2 ) {
+ fprintf( stderr, _("%s: -E incompatible with LDAPv%d\n"),
+ prog, protocol );
+ exit( EXIT_FAILURE );
+ }
+
+ /* should be extended to support comma separated list of
+ * [!]key[=value] parameters, e.g. -E !foo,bar=567
+ */
+
+ cvalue = NULL;
+ if( optarg[0] == '!' ) {
+ optarg++;
+ }
+
+ control = optarg;
+ if ( (cvalue = strchr( control, '=' )) != NULL ) {
+ *cvalue++ = '\0';
+ }
+
+ if (strcasecmp(control, "sasl") == 0) {
+#if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
+ if (vc_sasl != LDAP_SASL_NONE) {
+ fprintf(stderr,
+ _("SASL option previously specified\n"));
+ exit(EXIT_FAILURE);
+ }
+ if (cvalue == NULL) {
+ fprintf(stderr,
+ _("missing mode in SASL option\n"));
+ exit(EXIT_FAILURE);
+ }
+
+ switch (*cvalue) {
+ case 'a':
+ case 'A':
+ vc_sasl = LDAP_SASL_AUTOMATIC;
+ break;
+ case 'i':
+ case 'I':
+ vc_sasl = LDAP_SASL_INTERACTIVE;
+ break;
+ case 'q':
+ case 'Q':
+ vc_sasl = LDAP_SASL_QUIET;
+ break;
+ default:
+ fprintf(stderr,
+ _("unknown mode %s in SASL option\n"), cvalue);
+ exit(EXIT_FAILURE);
+ }
+#else
+ fprintf(stderr,
+ _("%s: not compiled with SASL support\n"), prog);
+ exit(EXIT_FAILURE);
+#endif
+
+ } else if (strcasecmp(control, "mech") == 0) {
+#if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
+ if (vc_sasl_mech) {
+ fprintf(stderr,
+ _("SASL mech previously specified\n"));
+ exit(EXIT_FAILURE);
+ }
+ if (cvalue == NULL) {
+ fprintf(stderr,
+ _("missing mech in SASL option\n"));
+ exit(EXIT_FAILURE);
+ }
+
+ vc_sasl_mech = ber_strdup(cvalue);
+#else
+#endif
+
+ } else if (strcasecmp(control, "realm") == 0) {
+#if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
+ if (vc_sasl_realm) {
+ fprintf(stderr,
+ _("SASL realm previously specified\n"));
+ exit(EXIT_FAILURE);
+ }
+ if (cvalue == NULL) {
+ fprintf(stderr,
+ _("missing realm in SASL option\n"));
+ exit(EXIT_FAILURE);
+ }
+
+ vc_sasl_realm = ber_strdup(cvalue);
+#else
+ fprintf(stderr,
+ _("%s: not compiled with SASL support\n"), prog);
+ exit(EXIT_FAILURE);
+#endif
+
+ } else if (strcasecmp(control, "authcid") == 0) {
+#if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
+ if (vc_sasl_authcid) {
+ fprintf(stderr,
+ _("SASL authcid previously specified\n"));
+ exit(EXIT_FAILURE);
+ }
+ if (cvalue == NULL) {
+ fprintf(stderr,
+ _("missing authcid in SASL option\n"));
+ exit(EXIT_FAILURE);
+ }
+
+ vc_sasl_authcid = ber_strdup(cvalue);
+#else
+ fprintf(stderr,
+ _("%s: not compiled with SASL support\n"), prog);
+ exit(EXIT_FAILURE);
+#endif
+
+ } else if (strcasecmp(control, "authzid") == 0) {
+#if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
+ if (vc_sasl_authzid) {
+ fprintf(stderr,
+ _("SASL authzid previously specified\n"));
+ exit(EXIT_FAILURE);
+ }
+ if (cvalue == NULL) {
+ fprintf(stderr,
+ _("missing authzid in SASL option\n"));
+ exit(EXIT_FAILURE);
+ }
+
+ vc_sasl_authzid = ber_strdup(cvalue);
+#else
+ fprintf(stderr,
+ _("%s: not compiled with SASL support\n"), prog);
+ exit(EXIT_FAILURE);
+#endif
+
+ } else if (strcasecmp(control, "secprops") == 0) {
+#if defined(LDAP_API_FEATURES_VERIFY_CREDENTIALS_INTERACTIVE) && defined(HAVE_CYRUS_SASL)
+ if (vc_sasl_secprops) {
+ fprintf(stderr,
+ _("SASL secprops previously specified\n"));
+ exit(EXIT_FAILURE);
+ }
+ if (cvalue == NULL) {
+ fprintf(stderr,
+ _("missing secprops in SASL option\n"));
+ exit(EXIT_FAILURE);
+ }
+
+ vc_sasl_secprops = ber_strdup(cvalue);
+#else
+ fprintf(stderr,
+ _("%s: not compiled with SASL support\n"), prog);
+ exit(EXIT_FAILURE);
+#endif
+
+ } else {
+ fprintf( stderr, _("Invalid Verify Credentials extension name: %s\n"), control );
+ usage();
+ }
+ break;
+
+ case 'a': /* request authzid */
+ req_authzid++;
+ break;
+
+ case 'b': /* request authzid */
+ req_pp++;
+ break;
+
+ default:
+ return 0;
+ }
+ return 1;
+}
+
+
+int
+main( int argc, char *argv[] )
+{
+ int rc;
+ LDAP *ld = NULL;
+ char *matcheddn = NULL, *text = NULL, **refs = NULL;
+ int rcode;
+ char * diag = NULL;
+ struct berval *scookie = NULL;
+ struct berval *scred = NULL;
+ int id, code = 0;
+ LDAPMessage *res;
+ LDAPControl **ctrls = NULL;
+ LDAPControl **vcctrls = NULL;
+ int nvcctrls = 0;
+
+ tool_init( TOOL_VC );
+ prog = lutil_progname( "ldapvc", argc, argv );
+
+ /* LDAPv3 only */
+ protocol = LDAP_VERSION3;
+
+ tool_args( argc, argv );
+
+ if (argc - optind > 0) {
+ dn = argv[optind++];
+ }
+ if (argc - optind > 0) {
+ cred.bv_val = strdup(argv[optind++]);
+ cred.bv_len = strlen(cred.bv_val);
+ }
+ if (argc - optind > 0) {
+ usage();
+ }
+ if (dn
+#ifdef LDAP_API_FEATURE_VERIFY_CREDENTIALS_INTERACTIVE
+ && !vc_sasl_mech
+#endif
+ && !cred.bv_val)
+ {
+ cred.bv_val = strdup(getpassphrase(_("User's password: ")));
+ cred.bv_len = strlen(cred.bv_val);
+ }
+
+#ifdef LDAP_API_FEATURE_VERIFY_CREDENTIALS_INTERACTIVE
+ if (vc_sasl_mech && (vc_sasl == LDAP_SASL_NONE)) {
+ vc_sasl = LDAP_SASL_AUTOMATIC;
+ }
+#endif
+
+ ld = tool_conn_setup( 0, 0 );
+
+ tool_bind( ld );
+
+ if ( dont ) {
+ rc = LDAP_SUCCESS;
+ goto skip;
+ }
+
+ tool_server_controls( ld, NULL, 0 );
+
+ if (req_authzid) {
+ vcctrls = (LDAPControl **) malloc(3*sizeof(LDAPControl *));
+ vcctrls[nvcctrls] = (LDAPControl *) malloc(sizeof(LDAPControl));
+ vcctrls[nvcctrls]->ldctl_oid = ldap_strdup(LDAP_CONTROL_AUTHZID_REQUEST);
+ vcctrls[nvcctrls]->ldctl_iscritical = 0;
+ vcctrls[nvcctrls]->ldctl_value.bv_val = NULL;
+ vcctrls[nvcctrls]->ldctl_value.bv_len = 0;
+ vcctrls[++nvcctrls] = NULL;
+ }
+
+ if (req_pp) {
+ if (!vcctrls) vcctrls = (LDAPControl **) malloc(3*sizeof(LDAPControl *));
+ vcctrls[nvcctrls] = (LDAPControl *) malloc(sizeof(LDAPControl));
+ vcctrls[nvcctrls]->ldctl_oid = ldap_strdup(LDAP_CONTROL_PASSWORDPOLICYREQUEST);
+ vcctrls[nvcctrls]->ldctl_iscritical = 0;
+ vcctrls[nvcctrls]->ldctl_value.bv_val = NULL;
+ vcctrls[nvcctrls]->ldctl_value.bv_len = 0;
+ vcctrls[++nvcctrls] = NULL;
+ }
+
+#ifdef LDAP_API_FEATURE_VERIFY_CREDENTIALS_INTERACTIVE
+#ifdef HAVE_CYRUS_SASL
+ if (vc_sasl_mech) {
+ int msgid;
+ void * defaults;
+ void * context = NULL;
+ const char *rmech = NULL;
+
+ defaults = lutil_sasl_defaults(ld,
+ vc_sasl_mech,
+ vc_sasl_realm,
+ vc_sasl_authcid,
+ cred.bv_val,
+ sasl_authz_id);
+
+ do {
+ rc = ldap_verify_credentials_interactive(ld, dn, vc_sasl_mech,
+ vcctrls, NULL, NULL,
+ vc_sasl, lutil_sasl_interact, defaults, context,
+ res, &rmech, &msgid);
+
+ if (rc != LDAP_SASL_BIND_IN_PROGRESS) break;
+
+ ldap_msgfree(res);
+
+ if (ldap_result(ld, msgid, LDAP_MSG_ALL, NULL, &res) == -1 || !res) {
+ ldap_get_option(ld, LDAP_OPT_RESULT_CODE, (void*) &rc);
+ ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE, (void*) &text);
+ tool_perror( "ldap_verify_credentials_interactive", rc, NULL, NULL, text, NULL);
+ ldap_memfree(text);
+ tool_exit(ld, rc);
+ }
+ } while (rc == LDAP_SASL_BIND_IN_PROGRESS);
+
+ lutil_sasl_freedefs(defaults);
+
+ if( rc != LDAP_SUCCESS ) {
+ ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE, (void*) &text);
+ tool_perror( "ldap_verify_credentials", rc, NULL, NULL, text, NULL );
+ rc = EXIT_FAILURE;
+ goto skip;
+ }
+
+ } else
+#endif
+#endif
+ {
+ rc = ldap_verify_credentials( ld,
+ NULL,
+ dn, NULL, cred.bv_val ? &cred: NULL, vcctrls,
+ NULL, NULL, &id );
+
+ if( rc != LDAP_SUCCESS ) {
+ ldap_get_option(ld, LDAP_OPT_DIAGNOSTIC_MESSAGE, (void*) &text);
+ tool_perror( "ldap_verify_credentials", rc, NULL, NULL, text, NULL );
+ rc = EXIT_FAILURE;
+ goto skip;
+ }
+
+ for ( ; ; ) {
+ struct timeval tv;
+
+ if ( tool_check_abandon( ld, id ) ) {
+ tool_exit( ld, LDAP_CANCELLED );
+ }
+
+ tv.tv_sec = 0;
+ tv.tv_usec = 100000;
+
+ rc = ldap_result( ld, LDAP_RES_ANY, LDAP_MSG_ALL, &tv, &res );
+ if ( rc < 0 ) {
+ tool_perror( "ldap_result", rc, NULL, NULL, NULL, NULL );
+ tool_exit( ld, rc );
+ }
+
+ if ( rc != 0 ) {
+ break;
+ }
+ }
+ }
+
+ ldap_controls_free(vcctrls);
+ vcctrls = NULL;
+
+ rc = ldap_parse_result( ld, res,
+ &code, &matcheddn, &text, &refs, &ctrls, 0 );
+
+ if (rc == LDAP_SUCCESS) rc = code;
+
+ if (rc != LDAP_SUCCESS) {
+ tool_perror( "ldap_parse_result", rc, NULL, matcheddn, text, refs );
+ rc = EXIT_FAILURE;
+ goto skip;
+ }
+
+ rc = ldap_parse_verify_credentials( ld, res, &rcode, &diag, &scookie, &scred, &vcctrls );
+ ldap_msgfree(res);
+
+ if (rc != LDAP_SUCCESS) {
+ tool_perror( "ldap_parse_verify_credentials", rc, NULL, NULL, NULL, NULL );
+ rc = EXIT_FAILURE;
+ goto skip;
+ }
+
+ if (rcode != LDAP_SUCCESS) {
+ printf(_("Failed: %s (%d)\n"), ldap_err2string(rcode), rcode);
+ }
+
+ if (diag && *diag) {
+ printf(_("Diagnostic: %s\n"), diag);
+ }
+
+ if (vcctrls) {
+ tool_print_ctrls( ld, vcctrls );
+ }
+
+skip:
+ if ( verbose || code != LDAP_SUCCESS ||
+ ( matcheddn && *matcheddn ) || ( text && *text ) || refs || ctrls )
+ {
+ printf( _("Result: %s (%d)\n"), ldap_err2string( code ), code );
+
+ if( text && *text ) {
+ printf( _("Additional info: %s\n"), text );
+ }
+
+ if( matcheddn && *matcheddn ) {
+ printf( _("Matched DN: %s\n"), matcheddn );
+ }
+
+ if( refs ) {
+ int i;
+ for( i=0; refs[i]; i++ ) {
+ printf(_("Referral: %s\n"), refs[i] );
+ }
+ }
+
+ if (ctrls) {
+ tool_print_ctrls( ld, ctrls );
+ ldap_controls_free( ctrls );
+ }
+ }
+
+ ber_memfree( text );
+ ber_memfree( matcheddn );
+ ber_memvfree( (void **) refs );
+ ber_bvfree( scookie );
+ ber_bvfree( scred );
+ ber_memfree( diag );
+ free( cred.bv_val );
+
+ /* disconnect from server */
+ tool_exit( ld, code == LDAP_SUCCESS ? EXIT_SUCCESS : EXIT_FAILURE );
+}
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-26 23:32:59 +0000