* Added a separate authentication mode AUTHMODE_LDAP_AD for Active Directory's nonsta...

[citadel.git] / citadel / ldap.c

diff --git a/citadel/ldap.c b/citadel/ldap.c
index 10eb31b51ce4c7f52e6ea8ad3b4e7a8f42ff548e..7a93098e59695a9e4fa5b0ab4057c23609682b96 100644 (file)
--- a/citadel/ldap.c
+++ b/citadel/ldap.c
@@ -5,7 +5,6 @@
 
 int ldap_version = 3;
 
-#ifdef HAVE_LDAP
 
 #include "sysdep.h"
 #include <errno.h>
@@ -54,11 +53,16 @@ int ldap_version = 3;
 #include "threads.h"
 #include "citadel_ldap.h"
 
+#ifdef HAVE_LDAP
+
 #define LDAP_DEPRECATED 1      /* Needed to suppress misleading warnings */
 
 #include <ldap.h>
 
-int CtdlTryUserLDAP(char *username, char *found_dn, int found_dn_size, char *fullname, int fullname_size)
+int CtdlTryUserLDAP(char *username,
+               char *found_dn, int found_dn_size,
+               char *fullname, int fullname_size,
+               uid_t *uid)
 {
        LDAP *ldserver = NULL;
        int i;
@@ -69,19 +73,24 @@ int CtdlTryUserLDAP(char *username, char *found_dn, int found_dn_size, char *ful
        char **values;
        char *user_dn = NULL;
 
-       safestrncpy(fullname, username, fullname_size);
+       if (fullname) safestrncpy(fullname, username, fullname_size);
 
-       ldserver = ldap_init(CTDL_LDAP_HOST, CTDL_LDAP_PORT);
+       ldserver = ldap_init(config.c_ldap_host, config.c_ldap_port);
        if (ldserver == NULL) {
                CtdlLogPrintf(CTDL_ALERT, "LDAP: Could not connect to %s:%d : %s\n",
-                       CTDL_LDAP_HOST, CTDL_LDAP_PORT,
+                       config.c_ldap_host, config.c_ldap_port,
                        strerror(errno));
                return(errno);
        }
 
        ldap_set_option(ldserver, LDAP_OPT_PROTOCOL_VERSION, &ldap_version);
 
-       i = ldap_simple_bind_s(ldserver, BIND_DN, BIND_PW);
+       striplt(config.c_ldap_bind_dn);
+       striplt(config.c_ldap_bind_pw);
+       i = ldap_simple_bind_s(ldserver,
+               (!IsEmptyStr(config.c_ldap_bind_dn) ? config.c_ldap_bind_dn : NULL),
+               (!IsEmptyStr(config.c_ldap_bind_pw) ? config.c_ldap_bind_pw : NULL)
+       );
        if (i != LDAP_SUCCESS) {
                CtdlLogPrintf(CTDL_ALERT, "LDAP: Cannot bind: %s (%d)\n", ldap_err2string(i), i);
                return(i);
@@ -90,10 +99,15 @@ int CtdlTryUserLDAP(char *username, char *found_dn, int found_dn_size, char *ful
        tv.tv_sec = 10;
        tv.tv_usec = 0;
 
-       sprintf(searchstring, SEARCH_STRING, username);
+       if (config.c_auth_mode == AUTHMODE_LDAP_AD) {
+               sprintf(searchstring, "(sAMAccountName=%s)", username);
+       }
+       else {
+               sprintf(searchstring, "(&(objectclass=posixAccount)(uid=%s))", username);
+       }
 
        i = ldap_search_st(ldserver,
-               BASE_DN,
+               config.c_ldap_base_dn,
                LDAP_SCOPE_SUBTREE,
                searchstring,
                NULL,   // return all attributes
@@ -125,29 +139,50 @@ int CtdlTryUserLDAP(char *username, char *found_dn, int found_dn_size, char *ful
                        CtdlLogPrintf(CTDL_DEBUG, "dn = %s\n", user_dn);
                }
 
-               values = ldap_get_values(ldserver, search_result, "cn");
-               if (values) {
-                       if (values[0]) {
-                               safestrncpy(fullname, values[0], fullname_size);
-                               CtdlLogPrintf(CTDL_DEBUG, "cn = %s\n", values[0]);
+               if (config.c_auth_mode == AUTHMODE_LDAP_AD) {
+                       values = ldap_get_values(ldserver, search_result, "displayName");
+                       if (values) {
+                               if (values[0]) {
+                                       if (fullname) safestrncpy(fullname, values[0], fullname_size);
+                                       CtdlLogPrintf(CTDL_DEBUG, "displayName = %s\n", values[0]);
+                               }
+                               ldap_value_free(values);
                        }
-                       ldap_value_free(values);
                }
-
-               values = ldap_get_values(ldserver, search_result, "uidNumber");
-               if (values) {
-                       if (values[0]) {
-                               CtdlLogPrintf(CTDL_DEBUG, "uidNumber = %s\n", values[0]);
+               else {
+                       values = ldap_get_values(ldserver, search_result, "cn");
+                       if (values) {
+                               if (values[0]) {
+                                       if (fullname) safestrncpy(fullname, values[0], fullname_size);
+                                       CtdlLogPrintf(CTDL_DEBUG, "cn = %s\n", values[0]);
+                               }
+                               ldap_value_free(values);
                        }
-                       ldap_value_free(values);
                }
 
-               values = ldap_get_values(ldserver, search_result, "objectGUID");
-               if (values) {
-                       if (values[0]) {
-                               CtdlLogPrintf(CTDL_DEBUG, "objectGUID = (%d characers)\n", strlen(values[0]));
+               if (config.c_auth_mode == AUTHMODE_LDAP_AD) {
+                       values = ldap_get_values(ldserver, search_result, "objectGUID");
+                       if (values) {
+                               if (values[0]) {
+                                       if (uid != NULL) {
+                                               *uid = abs(HashLittle(values[0], strlen(values[0])));
+                                               CtdlLogPrintf(CTDL_DEBUG, "uid hashed from objectGUID = %d\n", *uid);
+                                       }
+                               }
+                               ldap_value_free(values);
+                       }
+               }
+               else {
+                       values = ldap_get_values(ldserver, search_result, "uidNumber");
+                       if (values) {
+                               if (values[0]) {
+                                       CtdlLogPrintf(CTDL_DEBUG, "uidNumber = %s\n", values[0]);
+                                       if (uid != NULL) {
+                                               *uid = atoi(values[0]);
+                                       }
+                               }
+                               ldap_value_free(values);
                        }
-                       ldap_value_free(values);
                }
 
        }
@@ -163,7 +198,7 @@ int CtdlTryUserLDAP(char *username, char *found_dn, int found_dn_size, char *ful
                return(4);
        }
 
-       safestrncpy(found_dn, user_dn, found_dn_size);
+       if (found_dn) safestrncpy(found_dn, user_dn, found_dn_size);
        ldap_memfree(user_dn);
        return(0);
 }
@@ -172,9 +207,9 @@ int CtdlTryUserLDAP(char *username, char *found_dn, int found_dn_size, char *ful
 int CtdlTryPasswordLDAP(char *user_dn, char *password)
 {
        LDAP *ldserver = NULL;
-       int i;
+       int i = (-1);
 
-       ldserver = ldap_init(CTDL_LDAP_HOST, CTDL_LDAP_PORT);
+       ldserver = ldap_init(config.c_ldap_host, config.c_ldap_port);
        if (ldserver) {
                ldap_set_option(ldserver, LDAP_OPT_PROTOCOL_VERSION, &ldap_version);
                i = ldap_simple_bind_s(ldserver, user_dn, password);
@@ -187,7 +222,11 @@ int CtdlTryPasswordLDAP(char *user_dn, char *password)
                ldap_unbind(ldserver);
        }
 
-       return((i == LDAP_SUCCESS) ? 0 : 1);
+       if (i == LDAP_SUCCESS) {
+               return(0);
+       }
+
+       return(1);
 }