74ca47
From 22f1ff8d87a7daf9fbbe2ddfbd195a6bfdae1cd6 Mon Sep 17 00:00:00 2001
74ca47
From: William Brown <firstyear@redhat.com>
74ca47
Date: Tue, 14 Mar 2017 14:01:33 +1000
74ca47
Subject: [PATCH 3/5] Ticket 49165 pw_verify did not handle external auth
74ca47
74ca47
Bug Description:  During the change to improve sasl and simple bind,
74ca47
we externalised the backend selection outside of do_bind. In an
74ca47
auto_bind scenario however, this mean the be was null, causing the
74ca47
dn to always be invalidated.
74ca47
74ca47
Fix Description:  Add a pw_validate_be_dn function, that correctly
74ca47
checks if we are anonymous, a real be dn, or rootdn. This then allows
74ca47
the correct authentication of autobinds.
74ca47
74ca47
https://pagure.io/389-ds-base/issue/49165
74ca47
74ca47
Author: wibrown
74ca47
74ca47
Review by: mreynolds (Thanks!)
74ca47
74ca47
(cherry picked from commit 8dbfff1ff4152afb018490886a612c448ea2a1b0)
74ca47
---
74ca47
 ldap/servers/slapd/bind.c         |  9 +++++--
74ca47
 ldap/servers/slapd/dn.c           |  5 ++++
74ca47
 ldap/servers/slapd/pw_verify.c    | 57 +++++++++++++++++++++++++++++++++++++--
74ca47
 ldap/servers/slapd/pw_verify.h    |  1 +
74ca47
 ldap/servers/slapd/slapi-plugin.h |  9 +++++++
74ca47
 5 files changed, 77 insertions(+), 4 deletions(-)
74ca47
74ca47
diff --git a/ldap/servers/slapd/bind.c b/ldap/servers/slapd/bind.c
74ca47
index b4bb363..5c4fada 100644
74ca47
--- a/ldap/servers/slapd/bind.c
74ca47
+++ b/ldap/servers/slapd/bind.c
74ca47
@@ -656,7 +656,12 @@ do_bind( Slapi_PBlock *pb )
74ca47
         /* We could be serving multiple database backends.  Select the appropriate one */
74ca47
         /* pw_verify_be_dn will select the backend we need for us. */
74ca47
 
74ca47
-        rc = pw_verify_be_dn(pb, &referral);
74ca47
+        if (auto_bind) {
74ca47
+            /* We have no password material. We should just check who we are binding as. */
74ca47
+            rc = pw_validate_be_dn(pb, &referral);
74ca47
+        } else {
74ca47
+            rc = pw_verify_be_dn(pb, &referral);
74ca47
+        }
74ca47
 
74ca47
         if (rc == SLAPI_BIND_NO_BACKEND) {
74ca47
             send_nobackend_ldap_result( pb );
74ca47
@@ -715,7 +720,7 @@ do_bind( Slapi_PBlock *pb )
74ca47
                  *
74ca47
                  */
74ca47
                 slapi_pblock_get(pb, SLAPI_BACKEND, &be);
74ca47
-                if (!slapi_be_is_flag_set(be, SLAPI_BE_FLAG_REMOTE_DATA)) {
74ca47
+                if (!isroot && !slapi_be_is_flag_set(be, SLAPI_BE_FLAG_REMOTE_DATA)) {
74ca47
                     bind_target_entry = get_entry(pb, slapi_sdn_get_ndn(sdn));
74ca47
                     myrc = slapi_check_account_lock(pb, bind_target_entry, pw_response_requested, 1, 1);
74ca47
                     if (1 == myrc) { /* account is locked */
74ca47
diff --git a/ldap/servers/slapd/dn.c b/ldap/servers/slapd/dn.c
74ca47
index d043f2a..fa3909f 100644
74ca47
--- a/ldap/servers/slapd/dn.c
74ca47
+++ b/ldap/servers/slapd/dn.c
74ca47
@@ -1738,6 +1738,11 @@ slapi_dn_isroot( const char *dn )
74ca47
 	return( rc );
74ca47
 }
74ca47
 
74ca47
+int32_t
74ca47
+slapi_sdn_isroot(const Slapi_DN *sdn) {
74ca47
+    return slapi_dn_isroot(slapi_sdn_get_ndn(sdn));
74ca47
+}
74ca47
+
74ca47
 int
74ca47
 slapi_is_rootdse( const char *dn )
74ca47
 {
74ca47
diff --git a/ldap/servers/slapd/pw_verify.c b/ldap/servers/slapd/pw_verify.c
74ca47
index 93e5ff3..529bb83 100644
74ca47
--- a/ldap/servers/slapd/pw_verify.c
74ca47
+++ b/ldap/servers/slapd/pw_verify.c
74ca47
@@ -88,8 +88,61 @@ pw_verify_be_dn(Slapi_PBlock *pb, Slapi_Entry **referral)
74ca47
     return rc;
74ca47
 }
74ca47
 
74ca47
+/*
74ca47
+ * Resolve the dn we have been requested to bind with and verify it's
74ca47
+ * valid, and has a backend.
74ca47
+ *
74ca47
+ * We are checking:
74ca47
+ * * is this anonymous?
74ca47
+ * * is this the rootdn?
74ca47
+ * * is this a real dn, which associates to a real backend.
74ca47
+ *
74ca47
+ * This is used in SASL autobinds, so we need to handle this validation.
74ca47
+ */
74ca47
+
74ca47
 int
74ca47
-pw_verify_dn()
74ca47
+pw_validate_be_dn(Slapi_PBlock *pb, Slapi_Entry **referral)
74ca47
 {
74ca47
-    return LDAP_OPERATIONS_ERROR;
74ca47
+    int rc = 0;
74ca47
+    Slapi_Backend *be = NULL;
74ca47
+    Slapi_DN *pb_sdn;
74ca47
+    struct berval *cred;
74ca47
+    ber_tag_t method;
74ca47
+
74ca47
+
74ca47
+    slapi_pblock_get(pb, SLAPI_BIND_TARGET_SDN, &pb_sdn);
74ca47
+    slapi_pblock_get(pb, SLAPI_BIND_CREDENTIALS, &cred);
74ca47
+    slapi_pblock_get(pb, SLAPI_BIND_METHOD, &method);
74ca47
+
74ca47
+    if (pb_sdn != NULL || cred != NULL) {
74ca47
+        return LDAP_OPERATIONS_ERROR;
74ca47
+    }
74ca47
+
74ca47
+    if (*referral) {
74ca47
+        return SLAPI_BIND_REFERRAL;
74ca47
+    }
74ca47
+
74ca47
+    /* We need a slapi_sdn_isanon? */
74ca47
+    if (method == LDAP_AUTH_SIMPLE && cred->bv_len == 0) {
74ca47
+        return SLAPI_BIND_ANONYMOUS;
74ca47
+    }
74ca47
+
74ca47
+    if (slapi_sdn_isroot(pb_sdn)) {
74ca47
+        /* This is a real identity */
74ca47
+        return SLAPI_BIND_SUCCESS;
74ca47
+    }
74ca47
+
74ca47
+    if (slapi_mapping_tree_select(pb, &be, referral, NULL, 0) != LDAP_SUCCESS) {
74ca47
+        return SLAPI_BIND_NO_BACKEND;
74ca47
+    }
74ca47
+    slapi_be_Unlock(be);
74ca47
+
74ca47
+    slapi_pblock_set(pb, SLAPI_BACKEND, be);
74ca47
+    slapi_pblock_set(pb, SLAPI_PLUGIN, be->be_database);
74ca47
+    /* Make sure the result handlers are setup */
74ca47
+    set_db_default_result_handlers(pb);
74ca47
+
74ca47
+    /* The backend associated with this identity is real. */
74ca47
+
74ca47
+    return SLAPI_BIND_SUCCESS;
74ca47
 }
74ca47
diff --git a/ldap/servers/slapd/pw_verify.h b/ldap/servers/slapd/pw_verify.h
74ca47
index fc34fd1..5137027 100644
74ca47
--- a/ldap/servers/slapd/pw_verify.h
74ca47
+++ b/ldap/servers/slapd/pw_verify.h
74ca47
@@ -11,5 +11,6 @@
74ca47
 
74ca47
 int pw_verify_root_dn(const char *dn, const Slapi_Value *cred);
74ca47
 int pw_verify_be_dn(Slapi_PBlock *pb, Slapi_Entry **referral);
74ca47
+int pw_validate_be_dn(Slapi_PBlock *pb, Slapi_Entry **referral);
74ca47
 
74ca47
 #endif /* _SLAPD_PW_VERIFY_H_ */
74ca47
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
74ca47
index b223f65..1bd8fc8 100644
74ca47
--- a/ldap/servers/slapd/slapi-plugin.h
74ca47
+++ b/ldap/servers/slapd/slapi-plugin.h
74ca47
@@ -3800,6 +3800,15 @@ int slapi_dn_isparent( const char *parentdn, const char *childdn );
74ca47
 int slapi_dn_isroot( const char *dn );
74ca47
 
74ca47
 /**
74ca47
+ * Determines if an SDN is the root DN.
74ca47
+ *
74ca47
+ * \param sdn The DN to check
74ca47
+ * \return \c 1 if the DN is the root DN.
74ca47
+ * \return \c 0 if the DN is not the root DN.
74ca47
+ */
74ca47
+int32_t slapi_sdn_isroot( const Slapi_DN *sdn );
74ca47
+
74ca47
+/**
74ca47
  * Checks if a DN is the backend suffix.
74ca47
  *
74ca47
  * \param pb A parameter block with the backend set.
74ca47
-- 
74ca47
2.9.3
74ca47