>From 8791148ed07495966f086101b3237f860461223f Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Fri, 25 Sep 2009 12:09:37 +0200 Subject: [PATCH] add new config options ldap_tls_cacert and ldap_tls_cacertdir --- server/man/sssd-ldap.5.xml | 43 ++++++++++++++++++++++++++ server/providers/ldap/ldap_auth.c | 37 ++-------------------- server/providers/ldap/ldap_id.c | 38 +++-------------------- server/providers/ldap/sdap.c | 60 ++++++++++++++++++++++++++++++++++++- server/providers/ldap/sdap.h | 4 ++ 5 files changed, 115 insertions(+), 67 deletions(-) diff --git a/server/man/sssd-ldap.5.xml b/server/man/sssd-ldap.5.xml index 176849a..22c7c0c 100644 --- a/server/man/sssd-ldap.5.xml +++ b/server/man/sssd-ldap.5.xml @@ -35,6 +35,13 @@ There can be more than one LDAP domain configured with SSSD. + + If you want to authenticate against a LDAP server TLS/SSL is + required. sssd does not + support authentication over an unencrypted channel. If the LDAP + server is used a an identify provider an encrypted channel is not + needed. + @@ -439,6 +446,42 @@ hard = Same as demand + + Default: hard + + + + + + ldap_tls_cacert (string) + + + Specifies the file that contains certificates for + all of the Certificate Authorities + sssd will recognize. + + + Default: use OpenLDAP defaults, typically in + /etc/openldap/ldap.conf + + + + + + ldap_tls_cacertdir (string) + + + Specifies the path of a directory that contains + Certificate Authority certificates in separate + individual files. Typically the file names need to + be the hash of the certificate followed by '.0'. + If available cacertdir_rehash + can be used to create the correct names. + + + Default: use OpenLDAP defaults, typically in + /etc/openldap/ldap.conf + diff --git a/server/providers/ldap/ldap_auth.c b/server/providers/ldap/ldap_auth.c index a64a27f..430ac21 100644 --- a/server/providers/ldap/ldap_auth.c +++ b/server/providers/ldap/ldap_auth.c @@ -629,9 +629,7 @@ int sssm_ldap_auth_init(struct be_ctx *bectx, struct bet_ops **ops, void **pvt_data) { - int ldap_opt_x_tls_require_cert; struct sdap_auth_ctx *ctx; - char *tls_reqcert; int ret; ctx = talloc(bectx, struct sdap_auth_ctx); @@ -643,37 +641,10 @@ int sssm_ldap_auth_init(struct be_ctx *bectx, &ctx->opts); if (ret != EOK) goto done; - tls_reqcert = sdap_go_get_string(ctx->opts->basic, SDAP_TLS_REQCERT); - if (tls_reqcert) { - if (strcasecmp(tls_reqcert, "never") == 0) { - ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_NEVER; - } - else if (strcasecmp(tls_reqcert, "allow") == 0) { - ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_ALLOW; - } - else if (strcasecmp(tls_reqcert, "try") == 0) { - ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_TRY; - } - else if (strcasecmp(tls_reqcert, "demand") == 0) { - ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_DEMAND; - } - else if (strcasecmp(tls_reqcert, "hard") == 0) { - ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_HARD; - } - else { - DEBUG(1, ("Unknown value for tls_reqcert.\n")); - ret = EINVAL; - goto done; - } - /* LDAP_OPT_X_TLS_REQUIRE_CERT has to be set as a global option, - * because the SSL/TLS context is initialized from this value. */ - ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, - &ldap_opt_x_tls_require_cert); - if (ret != LDAP_OPT_SUCCESS) { - DEBUG(1, ("ldap_set_option failed: %s\n", ldap_err2string(ret))); - ret = EIO; - goto done; - } + ret = setup_tls_config(ctx->opts->basic); + if (ret != EOK) { + DEBUG(1, ("setup_tls_config failed [%d][%s].\n", ret, strerror(ret))); + goto done; } *ops = &sdap_auth_ops; diff --git a/server/providers/ldap/ldap_id.c b/server/providers/ldap/ldap_id.c index 4a06298..12fb476 100644 --- a/server/providers/ldap/ldap_id.c +++ b/server/providers/ldap/ldap_id.c @@ -1301,10 +1301,8 @@ int sssm_ldap_init(struct be_ctx *bectx, struct bet_ops **ops, void **pvt_data) { - int ldap_opt_x_tls_require_cert; struct tevent_timer *enum_task; struct sdap_id_ctx *ctx; - char *tls_reqcert; int ret; ctx = talloc_zero(bectx, struct sdap_id_ctx); @@ -1313,38 +1311,12 @@ int sssm_ldap_init(struct be_ctx *bectx, ctx->be = bectx; ret = sdap_get_options(ctx, bectx->cdb, bectx->conf_path, &ctx->opts); + if (ret != EOK) goto done; - tls_reqcert = sdap_go_get_string(ctx->opts->basic, SDAP_TLS_REQCERT); - if (tls_reqcert) { - if (strcasecmp(tls_reqcert, "never") == 0) { - ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_NEVER; - } - else if (strcasecmp(tls_reqcert, "allow") == 0) { - ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_ALLOW; - } - else if (strcasecmp(tls_reqcert, "try") == 0) { - ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_TRY; - } - else if (strcasecmp(tls_reqcert, "demand") == 0) { - ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_DEMAND; - } - else if (strcasecmp(tls_reqcert, "hard") == 0) { - ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_HARD; - } - else { - DEBUG(1, ("Unknown value for tls_reqcert.\n")); - ret = EINVAL; - goto done; - } - /* LDAP_OPT_X_TLS_REQUIRE_CERT has to be set as a global option, - * because the SSL/TLS context is initialized from this value. */ - ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, - &ldap_opt_x_tls_require_cert); - if (ret != LDAP_OPT_SUCCESS) { - DEBUG(1, ("ldap_set_option failed: %s\n", ldap_err2string(ret))); - ret = EIO; - goto done; - } + ret = setup_tls_config(ctx->opts->basic); + if (ret != EOK) { + DEBUG(1, ("setup_tls_config failed [%d][%s].\n", ret, strerror(ret))); + goto done; } /* set up enumeration task */ diff --git a/server/providers/ldap/sdap.c b/server/providers/ldap/sdap.c index 22d238e..eeb7510 100644 --- a/server/providers/ldap/sdap.c +++ b/server/providers/ldap/sdap.c @@ -49,7 +49,9 @@ struct sdap_gen_opts default_basic_opts[] = { { "offline_timeout", SDAP_NUMBER, { .number = 60 }, NULL_NUMBER }, { "force_upper_case_realm", SDAP_BOOL, BOOL_FALSE, BOOL_FALSE }, { "enumeration_refresh_timeout", SDAP_NUMBER, { .number = 300 }, NULL_NUMBER }, - { "stale_time", SDAP_NUMBER, { .number = 1800 }, NULL_NUMBER } + { "stale_time", SDAP_NUMBER, { .number = 1800 }, NULL_NUMBER }, + { "ldap_tls_cacert", SDAP_STRING, NULL_STRING, NULL_STRING }, + { "ldap_tls_cacertdir", SDAP_STRING, NULL_STRING, NULL_STRING } }; struct sdap_id_map rfc2307_user_map[] = { @@ -543,3 +545,59 @@ int sdap_get_msg_dn(TALLOC_CTX *memctx, struct sdap_handle *sh, return EOK; } +errno_t setup_tls_config(struct sdap_gen_opts *basic_opts) +{ + int ret; + int ldap_opt_x_tls_require_cert; + const char *tls_opt; + tls_opt = sdap_go_get_string(basic_opts, SDAP_TLS_REQCERT); + if (tls_opt) { + if (strcasecmp(tls_opt, "never") == 0) { + ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_NEVER; + } + else if (strcasecmp(tls_opt, "allow") == 0) { + ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_ALLOW; + } + else if (strcasecmp(tls_opt, "try") == 0) { + ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_TRY; + } + else if (strcasecmp(tls_opt, "demand") == 0) { + ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_DEMAND; + } + else if (strcasecmp(tls_opt, "hard") == 0) { + ldap_opt_x_tls_require_cert = LDAP_OPT_X_TLS_HARD; + } + else { + DEBUG(1, ("Unknown value for tls_reqcert.\n")); + return EINVAL; + } + /* LDAP_OPT_X_TLS_REQUIRE_CERT has to be set as a global option, + * because the SSL/TLS context is initialized from this value. */ + ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, + &ldap_opt_x_tls_require_cert); + if (ret != LDAP_OPT_SUCCESS) { + DEBUG(1, ("ldap_set_option failed: %s\n", ldap_err2string(ret))); + return EIO; + } + } + + tls_opt = sdap_go_get_string(basic_opts, SDAP_TLS_CACERT); + if (tls_opt) { + ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, tls_opt); + if (ret != LDAP_OPT_SUCCESS) { + DEBUG(1, ("ldap_set_option failed: %s\n", ldap_err2string(ret))); + return EIO; + } + } + + tls_opt = sdap_go_get_string(basic_opts, SDAP_TLS_CACERTDIR); + if (tls_opt) { + ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTDIR, tls_opt); + if (ret != LDAP_OPT_SUCCESS) { + DEBUG(1, ("ldap_set_option failed: %s\n", ldap_err2string(ret))); + return EIO; + } + } + + return EOK; +} diff --git a/server/providers/ldap/sdap.h b/server/providers/ldap/sdap.h index 7168a5a..8a932d3 100644 --- a/server/providers/ldap/sdap.h +++ b/server/providers/ldap/sdap.h @@ -88,6 +88,8 @@ enum sdap_basic_opt { SDAP_FORCE_UPPER_CASE_REALM, SDAP_ENUM_REFRESH_TIMEOUT, SDAP_STALE_TIME, + SDAP_TLS_CACERT, + SDAP_TLS_CACERTDIR, SDAP_OPTS_BASIC /* opts counter */ }; @@ -207,3 +209,5 @@ int sdap_parse_group(TALLOC_CTX *memctx, struct sdap_options *opts, int sdap_get_msg_dn(TALLOC_CTX *memctx, struct sdap_handle *sh, struct sdap_msg *sm, char **_dn); + +errno_t setup_tls_config(struct sdap_gen_opts *basic_opts); -- 1.6.2.5