upstream/openldap
1
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2025-12-23 08:09:34 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add option to disallow unprotected simple authentication.

Browse source 
Add protected simple authentication as a "strong" mechanism.
This commit is contained in:
Kurt Zeilenga 2002-06-17 22:18:27 +00:00
parent 3ad829e389
commit 9a38d98d37
5 changed files with 35 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
doc/man/man5/slapd.conf.5
View file

@ -195,6 +195,9 @@ disallow (default none).
disables acceptance of anonymous bind requests. disables acceptance of anonymous bind requests.
.B bind_simple .B bind_simple
disables simple (bind) authentication. disables simple (bind) authentication.
.B bind_simple_unprotected
disables simple (bind) authentication when confidentiality
protections (e.g. TLS) are not in place.
.B bind_krbv4 .B bind_krbv4
disables Kerberos V4 (bind) authentication. disables Kerberos V4 (bind) authentication.
.B tls_2_anon .B tls_2_anon
@ -506,11 +509,8 @@ requires authentication prior to directory operations.
requires SASL authentication prior to directory operations. requires SASL authentication prior to directory operations.
.B strong .B strong
requires strong authentication prior to directory operations. requires strong authentication prior to directory operations.
The The strong keyword allows protected "simple" authentication
.B SASL as well as SASL authentication.
and
.B strong
conditions are currently same.
.B none .B none
may be used to require no conditions (useful for clearly globally may be used to require no conditions (useful for clearly globally
set conditions within a particular database). set conditions within a particular database).

6
servers/slapd/backend.c
View file

@ -924,7 +924,8 @@ backend_check_restrictions(
if( requires & SLAP_REQUIRE_STRONG ) { if( requires & SLAP_REQUIRE_STRONG ) {
/* should check mechanism */ /* should check mechanism */
if( op->o_authmech.bv_len == 0 || op->o_dn.bv_len == 0 ) if( ( op->o_transport_ssf < ssf->sss_transport
&& op->o_authmech.bv_len == 0 ) || op->o_dn.bv_len == 0 )
{ {
*text = "strong authentication required"; *text = "strong authentication required";
return LDAP_STRONG_AUTH_REQUIRED; return LDAP_STRONG_AUTH_REQUIRED;
@ -932,8 +933,7 @@ backend_check_restrictions(
} }
if( requires & SLAP_REQUIRE_SASL ) { if( requires & SLAP_REQUIRE_SASL ) {
if( op->o_authmech.bv_len == 0 || op->o_dn.bv_len == 0 ) if( op->o_authmech.bv_len == 0 || op->o_dn.bv_len == 0 ) {
{
*text = "SASL authentication required"; *text = "SASL authentication required";
return LDAP_STRONG_AUTH_REQUIRED; return LDAP_STRONG_AUTH_REQUIRED;
} }

21
servers/slapd/bind.c
View file

@ -402,6 +402,27 @@ do_bind(
Debug( LDAP_DEBUG_TRACE, Debug( LDAP_DEBUG_TRACE,
"do_bind: v%d simple bind(%s) disallowed\n", "do_bind: v%d simple bind(%s) disallowed\n",
version, ndn.bv_val, 0 ); version, ndn.bv_val, 0 );
#endif
goto cleanup;
} else if (( global_disallows & SLAP_DISALLOW_BIND_SIMPLE_UNPROTECTED )
&& ( op->o_transport_ssf < global_ssf_set.sss_transport ))
{
rc = LDAP_CONFIDENTIALITY_REQUIRED;
text = "unwilling to perform simple authentication "
"without confidentilty protection";
send_ldap_result( conn, op, rc,
NULL, text, NULL, NULL );
#ifdef NEW_LOGGING
LDAP_LOG(( "operation", LDAP_LEVEL_INFO, "do_bind: conn %d "
"v%d unprotected simple bind(%s) disallowed\n",
conn->c_connid, version, ndn.bv_val ));
#else
Debug( LDAP_DEBUG_TRACE,
"do_bind: v%d unprotected simple bind(%s) disallowed\n",
version, ndn.bv_val, 0 );
#endif #endif
goto cleanup; goto cleanup;
} }

3
servers/slapd/config.c
View file

@ -1289,6 +1289,9 @@ read_config( const char *fname )
} else if( strcasecmp( cargv[i], "bind_simple" ) == 0 ) { } else if( strcasecmp( cargv[i], "bind_simple" ) == 0 ) {
disallows |= SLAP_DISALLOW_BIND_SIMPLE; disallows |= SLAP_DISALLOW_BIND_SIMPLE;
} else if( strcasecmp( cargv[i], "bind_simple_unprotected" ) == 0 ) {
disallows |= SLAP_DISALLOW_BIND_SIMPLE_UNPROTECTED;
} else if( strcasecmp( cargv[i], "bind_krbv4" ) == 0 ) { } else if( strcasecmp( cargv[i], "bind_krbv4" ) == 0 ) {
disallows |= SLAP_DISALLOW_BIND_KRBV4; disallows |= SLAP_DISALLOW_BIND_KRBV4;

4
servers/slapd/slap.h
View file

@ -1175,7 +1175,9 @@ struct slap_backend_db {
#define SLAP_DISALLOW_BIND_ANON 0x0001U /* no anonymous */ #define SLAP_DISALLOW_BIND_ANON 0x0001U /* no anonymous */
#define SLAP_DISALLOW_BIND_SIMPLE 0x0002U /* simple authentication */ #define SLAP_DISALLOW_BIND_SIMPLE 0x0002U /* simple authentication */
#define SLAP_DISALLOW_BIND_KRBV4 0x0004U /* Kerberos V4 authentication */ #define SLAP_DISALLOW_BIND_SIMPLE_UNPROTECTED \
0x0004U /* unprotected simple auth */
#define SLAP_DISALLOW_BIND_KRBV4 0x0008U /* Kerberos V4 authentication */
#define SLAP_DISALLOW_TLS_2_ANON 0x0010U /* StartTLS -> Anonymous */ #define SLAP_DISALLOW_TLS_2_ANON 0x0010U /* StartTLS -> Anonymous */
#define SLAP_DISALLOW_TLS_AUTHC 0x0020U /* TLS while authenticated */ #define SLAP_DISALLOW_TLS_AUTHC 0x0020U /* TLS while authenticated */