upstream/openldap
1
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2026-01-05 22:50:51 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

More for sessions, working. TODO: configure list of sessions to record

Browse source
This commit is contained in:
Howard Chu 2009-04-23 07:56:40 +00:00
parent 4a6d46dfa9
commit 50283523bd
5 changed files with 100 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
contrib/slapd-modules/nssov/README
View file

@ -120,7 +120,7 @@ of the authorizedServiceObject auxiliary class) to use this method.
Session management: the overlay may optionally add a "logged in" attribute
to a user's entry for successful logins, and delete the corresponding
value upon logout. The attribute value is of the form
<host> <service> <tty> <ruser@rhost> <generalizedTime>
<generalizedTime> <host> <service> <tty> (<ruser@rhost>)
Password management: the overlay will perform a PasswordModify exop
in the server for the given user.

16
contrib/slapd-modules/nssov/nss-ldapd/nss/pam.c
View file

@ -65,6 +65,7 @@ typedef struct pld_ctx {
char *oldpw;
int authok;
int authz;
int sessid;
char buf[1024];
} pld_ctx;
@ -414,6 +415,14 @@ int pam_sm_acct_mgmt(
return rc;
}
static enum nss_status pam_read_sess(
TFILE *fp,pld_ctx *ctx,int *errnop)
{
int tmpint32;
READ_INT32(fp,ctx->sessid);
return NSS_STATUS_SUCCESS;
}
static enum nss_status pam_do_sess(
pam_handle_t *pamh,pld_ctx *ctx,int action,int *errnop)
{
@ -431,12 +440,13 @@ static enum nss_status pam_do_sess(
WRITE_STRING(fp,svc);
WRITE_STRING(fp,tty);
WRITE_STRING(fp,rhost);
WRITE_STRING(fp,ruser),
NSS_STATUS_SUCCESS);
WRITE_STRING(fp,ruser);
WRITE_INT32(fp,ctx->sessid),
pam_read_sess(fp,ctx,errnop));
}
}
int pam_sm_session(
static int pam_sm_session(
pam_handle_t *pamh, int flags, int argc, const char **argv,
int action, int *no_warn)
{

5
contrib/slapd-modules/nssov/nssov.c
View file

@ -688,7 +688,10 @@ nssov_db_init(
slap_overinst *on = (slap_overinst *)be->bd_info;
nssov_info *ni;
nssov_mapinfo *mi;
int i, j;
int rc;
rc = nssov_pam_init();
if (rc) return rc;
ni = ch_malloc( sizeof(nssov_info) );
on->on_bi.bi_private = ni;

2
contrib/slapd-modules/nssov/nssov.h
View file

@ -187,6 +187,8 @@ void nssov_rpc_init(nssov_info *ni);
void nssov_service_init(nssov_info *ni);
void nssov_shadow_init(nssov_info *ni);
int nssov_pam_init(void);
/* these are the different functions that handle the database
specific actions, see nslcd.h for the action descriptions */
int nssov_alias_byname(nssov_info *ni,TFILE *fp,Operation *op);

125
contrib/slapd-modules/nssov/pam.c
View file

@ -14,10 +14,22 @@
*/
#include "nssov.h"
#include "lutil.h"
#include <security/pam_modules.h>
static int ppolicy_cid;
static AttributeDescription *ad_loginStatus;
const char *at_loginStatus =
"( 1.3.6.1.4.1.4745.1.20.1 "
"NAME ( 'loginStatus' ) "
"DESC 'Currently logged in sessions for a user' "
"EQUALITY caseIgnoreMatch "
"SUBSTR caseIgnoreSubstringsMatch "
"ORDERING caseIgnoreOrderingMatch "
"SYNTAX OMsDirectoryString "
"USAGE directoryOperation )";
struct paminfo {
struct berval uid;
@ -234,11 +246,6 @@ finish:
return 0;
}
static int pam_nullcb(Operation *op, SlapReply *rs)
{
return LDAP_SUCCESS;
}
static struct berval grpmsg =
BER_BVC("Access denied by group check");
static struct berval hostmsg =
@ -330,7 +337,7 @@ int pam_authz(nssov_info *ni,TFILE *fp,Operation *op)
}
}
cb.sc_response = pam_nullcb;
cb.sc_response = slap_null_cb;
cb.sc_private = NULL;
op->o_tag = LDAP_REQ_COMPARE;
op->o_req_dn = hostdn;
@ -354,7 +361,7 @@ int pam_authz(nssov_info *ni,TFILE *fp,Operation *op)
ni->ni_pam_group_ad) {
AttributeAssertion ava = ATTRIBUTEASSERTION_INIT;
op->o_callback = &cb;
cb.sc_response = pam_nullcb;
cb.sc_response = slap_null_cb;
op->o_tag = LDAP_REQ_COMPARE;
op->o_req_dn = ni->ni_pam_group_dn;
op->o_req_ndn = ni->ni_pam_group_dn;
@ -449,7 +456,7 @@ finish:
return 0;
}
int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
static int pam_sess(nssov_info *ni,TFILE *fp,Operation *op,int action)
{
struct berval dn, uid, svc, tty, rhost, ruser;
int32_t tmpint32;
@ -459,6 +466,12 @@ int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
char ttyc[32];
char rhostc[256];
char ruserc[32];
slap_callback cb = {0};
SlapReply rs = {REP_RESULT};
char timebuf[LDAP_LUTIL_GENTIME_BUFSIZE];
struct berval timestamp, bv[2], *nbv;
time_t stamp;
Modifications mod;
READ_STRING_BUF2(fp,uidc,sizeof(uidc));
uid.bv_val = uidc;
@ -478,51 +491,65 @@ int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
READ_STRING_BUF2(fp,ruserc,sizeof(ruserc));
ruser.bv_val = ruserc;
ruser.bv_len = tmpint32;
READ_INT32(fp,stamp);
Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_o(%s)\n",dn.bv_val,0,0);
Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_%c(%s)\n",
action==NSLCD_ACTION_PAM_SESS_O ? 'o' : 'c', dn.bv_val,0);
if (!dn.bv_len) return 0;
slap_op_time( &op->o_time, &op->o_tincr );
timestamp.bv_len = sizeof(timebuf);
timestamp.bv_val = timebuf;
if (action == NSLCD_ACTION_PAM_SESS_O )
stamp = op->o_time;
slap_timestamp( &stamp, &timestamp );
bv[0].bv_len = timestamp.bv_len + global_host_bv.bv_len + svc.bv_len +
tty.bv_len + ruser.bv_len + rhost.bv_len + STRLENOF(" (@)");
bv[0].bv_val = op->o_tmpalloc( bv[0].bv_len+1, op->o_tmpmemctx );
sprintf(bv[0].bv_val, "%s %s %s %s (%s@%s)",
timestamp.bv_val, global_host_bv.bv_val, svc.bv_val, tty.bv_val,
ruser.bv_val, rhost.bv_val);
mod.sml_numvals = 1;
mod.sml_values = bv;
BER_BVZERO(&bv[1]);
attr_normalize( ad_loginStatus, bv, &nbv, op->o_tmpmemctx );
mod.sml_nvalues = nbv;
mod.sml_desc = ad_loginStatus;
mod.sml_op = action == NSLCD_ACTION_PAM_SESS_O ? LDAP_MOD_ADD :
LDAP_MOD_DELETE;
mod.sml_flags = SLAP_MOD_INTERNAL;
mod.sml_next = NULL;
cb.sc_response = slap_null_cb;
op->o_callback = &cb;
op->o_tag = LDAP_REQ_MODIFY;
op->orm_modlist = &mod;
op->orm_no_opattrs = 1;
op->o_req_dn = dn;
op->o_req_ndn = dn;
op->o_bd->be_modify( op, &rs );
if ( mod.sml_next ) {
slap_mods_free( mod.sml_next, 1 );
}
ber_bvarray_free_x( nbv, op->o_tmpmemctx );
WRITE_INT32(fp,NSLCD_VERSION);
WRITE_INT32(fp,NSLCD_ACTION_PAM_SESS_O);
WRITE_INT32(fp,action);
WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
WRITE_INT32(fp,op->o_time);
return 0;
}
int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
{
return pam_sess(ni,fp,op,NSLCD_ACTION_PAM_SESS_O);
}
int pam_sess_c(nssov_info *ni,TFILE *fp,Operation *op)
{
struct berval dn, uid, svc, tty, rhost, ruser;
int32_t tmpint32;
char dnc[1024];
char svcc[256];
char uidc[32];
char ttyc[32];
char rhostc[256];
char ruserc[32];
READ_STRING_BUF2(fp,uidc,sizeof(uidc));
uid.bv_val = uidc;
uid.bv_len = tmpint32;
READ_STRING_BUF2(fp,dnc,sizeof(dnc));
dn.bv_val = dnc;
dn.bv_len = tmpint32;
READ_STRING_BUF2(fp,svcc,sizeof(svcc));
svc.bv_val = svcc;
svc.bv_len = tmpint32;
READ_STRING_BUF2(fp,ttyc,sizeof(ttyc));
tty.bv_val = ttyc;
tty.bv_len = tmpint32;
READ_STRING_BUF2(fp,rhostc,sizeof(rhostc));
rhost.bv_val = rhostc;
rhost.bv_len = tmpint32;
READ_STRING_BUF2(fp,ruserc,sizeof(ruserc));
ruser.bv_val = ruserc;
ruser.bv_len = tmpint32;
Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_c(%s)\n",dn.bv_val,0,0);
WRITE_INT32(fp,NSLCD_VERSION);
WRITE_INT32(fp,NSLCD_ACTION_PAM_SESS_C);
WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
return 0;
return pam_sess(ni,fp,op,NSLCD_ACTION_PAM_SESS_C);
}
int pam_pwmod(nssov_info *ni,TFILE *fp,Operation *op)
@ -587,7 +614,7 @@ int pam_pwmod(nssov_info *ni,TFILE *fp,Operation *op)
op->o_ndn = pi.dn;
op->o_callback = &cb;
op->o_conn->c_authz_backend = op->o_bd;
cb.sc_response = pam_nullcb;
cb.sc_response = slap_null_cb;
op->o_bd = frontendDB;
rc = op->o_bd->be_extended(op, &rs);
if (rs.sr_text)
@ -606,3 +633,11 @@ int pam_pwmod(nssov_info *ni,TFILE *fp,Operation *op)
WRITE_BERVAL(fp,&pi.msg);
return 0;
}
int nssov_pam_init()
{
int code = 0;
if (!ad_loginStatus)
code = register_at( at_loginStatus, &ad_loginStatus, 0 );
return code;
}