Allow authentication for referrals

1 files changed, 193 insertions, 0 deletions

diff --git a/src/providers/ldap/sdap_async_connection.c b/src/providers/ldap/sdap_async_connection.c
index f73f34e1c..fbbec182f 100644
--- a/src/providers/ldap/sdap_async_connection.c
+++ b/src/providers/ldap/sdap_async_connection.c
@@ -48,6 +48,15 @@ errno_t deref_string_to_val(const char *str, int *val)
 
 /* ==Connect-to-LDAP-Server=============================================== */
 
+struct sdap_rebind_proc_params {
+    struct sdap_options *opts;
+    struct sdap_handle *sh;
+    bool use_start_tls;
+};
+
+static int sdap_rebind_proc(LDAP *ldap, LDAP_CONST char *url, ber_tag_t request,
+                            ber_int_t msgid, void *params);
+
 struct sdap_connect_state {
     struct tevent_context *ev;
     struct sdap_options *opts;
@@ -81,6 +90,7 @@ struct tevent_req *sdap_connect_send(TALLOC_CTX *memctx,
     bool ldap_referrals;
     const char *ldap_deref;
     int ldap_deref_val;
+    struct sdap_rebind_proc_params *rebind_proc_params;
 
     req = tevent_req_create(memctx, &state, struct sdap_connect_state);
     if (!req) return NULL;
@@ -150,6 +160,27 @@ struct tevent_req *sdap_connect_send(TALLOC_CTX *memctx,
         goto fail;
     }
 
+    if (ldap_referrals) {
+        rebind_proc_params = talloc_zero(state->sh,
+                                         struct sdap_rebind_proc_params);
+        if (rebind_proc_params == NULL) {
+            DEBUG(1, ("talloc_zero failed.\n"));
+            ret = ENOMEM;
+            goto fail;
+        }
+
+        rebind_proc_params->opts = opts;
+        rebind_proc_params->sh = state->sh;
+        rebind_proc_params->use_start_tls = use_start_tls;
+
+        lret = ldap_set_rebind_proc(state->sh->ldap, sdap_rebind_proc,
+                                    rebind_proc_params);
+        if (lret != LDAP_SUCCESS) {
+            DEBUG(1, ("ldap_set_rebind_proc failed.\n"));
+            goto fail;
+        }
+    }
+
     /* Set alias dereferencing */
     ldap_deref = dp_opt_get_string(opts->basic, SDAP_DEREF);
     if (ldap_deref != NULL) {
@@ -1427,3 +1458,165 @@ int sdap_cli_connect_recv_ext(struct tevent_req *req,
     return EOK;
 }
 
+static int synchronous_tls_setup(LDAP *ldap)
+{
+    int lret;
+    int optret;
+    int ldaperr;
+    int msgid;
+    char *errmsg = NULL;
+    LDAPMessage *result;
+
+    DEBUG(4, ("Executing START TLS\n"));
+
+    lret = ldap_start_tls(ldap, NULL, NULL, &msgid);
+    if (lret != LDAP_SUCCESS) {
+        optret = ldap_get_option(ldap, SDAP_DIAGNOSTIC_MESSAGE, (void*)&errmsg);
+        if (optret == LDAP_SUCCESS) {
+            DEBUG(3, ("ldap_start_tls failed: [%s] [%s]\n",
+                      ldap_err2string(lret), errmsg));
+            sss_log(SSS_LOG_ERR, "Could not start TLS. %s", errmsg);
+            ldap_memfree(errmsg);
+        } else {
+            DEBUG(3, ("ldap_start_tls failed: [%s]\n", ldap_err2string(lret)));
+            sss_log(SSS_LOG_ERR, "Could not start TLS. "
+                                 "Check for certificate issues.");
+        }
+        return lret;
+    }
+
+    lret = ldap_result(ldap, msgid, 1, NULL, &result);
+    if (lret != LDAP_RES_EXTENDED) {
+        DEBUG(2, ("Unexpected ldap_result, expected [%d] got [%d].\n",
+                  LDAP_RES_EXTENDED, lret));
+        return LDAP_PARAM_ERROR;
+    }
+
+    lret = ldap_parse_result(ldap, result, &ldaperr, NULL, &errmsg, NULL, NULL,
+                             0);
+    if (lret != LDAP_SUCCESS) {
+        DEBUG(2, ("ldap_parse_result failed (%d) [%d][%s]\n", msgid, lret,
+                  ldap_err2string(lret)));
+        return lret;
+    }
+
+    DEBUG(3, ("START TLS result: %s(%d), %s\n",
+              ldap_err2string(ldaperr), ldaperr, errmsg));
+    ldap_memfree(errmsg);
+
+    if (ldap_tls_inplace(ldap)) {
+        DEBUG(9, ("SSL/TLS handler already in place.\n"));
+        return LDAP_SUCCESS;
+    }
+
+    lret = ldap_install_tls(ldap);
+    if (lret != LDAP_SUCCESS) {
+
+        optret = ldap_get_option(ldap, SDAP_DIAGNOSTIC_MESSAGE, (void*)&errmsg);
+        if (optret == LDAP_SUCCESS) {
+            DEBUG(3, ("ldap_install_tls failed: [%s] [%s]\n",
+                      ldap_err2string(lret), errmsg));
+            sss_log(SSS_LOG_ERR, "Could not start TLS encryption. %s", errmsg);
+            ldap_memfree(errmsg);
+        } else {
+            DEBUG(3, ("ldap_install_tls failed: [%s]\n",
+                      ldap_err2string(lret)));
+            sss_log(SSS_LOG_ERR, "Could not start TLS encryption. "
+                                 "Check for certificate issues.");
+        }
+
+        return lret;
+    }
+
+    return LDAP_SUCCESS;
+}
+
+static int sdap_rebind_proc(LDAP *ldap, LDAP_CONST char *url, ber_tag_t request,
+                            ber_int_t msgid, void *params)
+{
+    struct sdap_rebind_proc_params *p = talloc_get_type(params,
+                                                struct sdap_rebind_proc_params);
+    const char *sasl_mech;
+    const char *user_dn;
+    struct berval password = {0, NULL};
+    LDAPControl **request_controls = NULL;
+    LDAPControl *ctrls[2] = { NULL, NULL };
+    TALLOC_CTX *tmp_ctx = NULL;
+    struct sasl_bind_state *sasl_bind_state;
+    int ret;
+
+    if (p->use_start_tls) {
+        ret = synchronous_tls_setup(ldap);
+        if (ret != EOK) {
+            DEBUG(1, ("synchronous_tls_setup failed.\n"));
+            return ret;
+        }
+    }
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        DEBUG(1, ("talloc_new failed.\n"));
+        return LDAP_NO_MEMORY;
+    }
+
+    sasl_mech = dp_opt_get_string(p->opts->basic, SDAP_SASL_MECH);
+
+    if (sasl_mech == NULL) {
+        ret = sdap_control_create(p->sh, LDAP_CONTROL_PASSWORDPOLICYREQUEST,
+                                  0, NULL, 0, &ctrls[0]);
+        if (ret != LDAP_SUCCESS && ret != LDAP_NOT_SUPPORTED) {
+            DEBUG(1, ("sdap_control_create failed to create "
+                      "Password Policy control.\n"));
+            goto done;
+        }
+        request_controls = ctrls;
+
+        user_dn = dp_opt_get_string(p->opts->basic, SDAP_DEFAULT_BIND_DN);
+        if (user_dn != NULL) {
+            ret = sdap_auth_get_authtok(tmp_ctx,
+                                        dp_opt_get_string(p->opts->basic,
+                                                     SDAP_DEFAULT_AUTHTOK_TYPE),
+                                        dp_opt_get_blob(p->opts->basic,
+                                                        SDAP_DEFAULT_AUTHTOK),
+                                        &password);
+            if (ret != EOK) {
+                DEBUG(1, ("sdap_auth_get_authtok failed.\n"));
+                ret = LDAP_LOCAL_ERROR;
+                goto done;
+            }
+        }
+
+        ret = ldap_sasl_bind_s(ldap, user_dn, LDAP_SASL_SIMPLE, &password,
+                               request_controls, NULL, NULL);
+        if (ret != LDAP_SUCCESS) {
+            DEBUG(1, ("ldap_sasl_bind_s failed (%d)[%s]\n", ret,
+                      ldap_err2string(ret)));
+        }
+    } else {
+        sasl_bind_state = talloc_zero(tmp_ctx, struct sasl_bind_state);
+        if (sasl_bind_state == NULL) {
+            DEBUG(1, ("talloc_zero failed.\n"));
+            ret = LDAP_NO_MEMORY;
+            goto done;
+        }
+        sasl_bind_state->sasl_user = dp_opt_get_string(p->opts->basic,
+                                                      SDAP_SASL_AUTHID);
+        ret = ldap_sasl_interactive_bind_s(ldap, NULL,
+                                           sasl_mech, NULL, NULL,
+                                           LDAP_SASL_QUIET,
+                                           (*sdap_sasl_interact),
+                                           sasl_bind_state);
+        if (ret != LDAP_SUCCESS) {
+            DEBUG(1, ("ldap_sasl_interactive_bind_s failed (%d)[%s]\n", ret,
+                      ldap_err2string(ret)));
+        }
+    }
+
+    DEBUG(7, ("%s bind to [%s].\n",
+             (ret == LDAP_SUCCESS ? "Successfully" : "Failed to"), url));
+
+done:
+    talloc_free(tmp_ctx);
+
+    return ret;
+}