LDAP Suggestion

I have a suggestion that I'd like you all to take a look at.

The background is that I'm using SunOne/iPlanet/Netscape(name of the week, 
take your pick) LDAP server with SHA1 for the passwords. This isn't 
something that I can change.

Instead of using a BindDN and getting the password, comparing, etc., how 
about just performing a bind operation with the login and password in 
question? If you are able to bind with them then you've determined that they 
are valid.

The added benefit is that you can then use the same login and password to 
obtain the rest of the attributes required and you don't need the BindDN.

You also won't need to store a password in a text file, something we should 
all frown on anyway.

Below I've included an example of what I'm trying to do. It's based on the 
LDAP authenticator included with Squid proxy.

I think that the bind operation with the BindDN occurs earlier, so this 
probably won't work as-is, but it should illustrate my suggestion.

Caveat: I'm a complete amature. I'd appreciate feedback. Please be kind.

Thanks
-Jon




/* ------------------------------------------------------------ **
**
**	Function......:	ldap_auth
**
**	Parameters....:	ld		Pointer to LDAP struct
**			e		Pointer to result buffer
**			who		Pointer to user name
**			pwd		Pointer to user pwd
**
**	Return........:	0 on success
**
**	Purpose.......: Preform LDAP userauth
**
** ------------------------------------------------------------ */

static int   ldap_auth(LDAP *ld, LDAPMessage *e, char *who, char *pwd)
{
    int luser;
    char *dn;
    char *base = "ou=people,o=x.com";
    char str[MAX_PATH_SIZE];
    char *v, *p;
    size_t len;

    /* test server connection */
    if (ld == NULL || e == NULL)
    {
      misc_die(FL, "ldap_checkauth: ?ld? ?e?");
    }

    /* no null usernames or passwords accepted */
    if (who == NULL || strcmp(who, "") == 0)
    {
      syslog_write(U_WRN,
      "access denied for NULL usernames");
      return -1;
    }

    if (pwd == NULL || strcmp(pwd, "") == 0)
    {
      syslog_write(U_WRN,
      "access denied for NULL passwords");
      return -1;
    }

    /*
    ** check "user enabled" flag if present
    */
    if( (p = config_str(NULL, "LDAPAuthOKFlag", NULL))) {
      misc_strncpy(str, p, sizeof(str));
      if( (v = strchr(str, '='))) {
        *v++ = '\0';
      } else {
        v = 0;
      }

      if(v && strlen(v) && strlen(str)) {
        if(0 != ldap_exists(ld, e, str, v, 0)) {
          syslog_write(U_WRN,
          "access denied for %s", NIL(who));
          return -1;
        } else {
          syslog_write(T_DBG,
          "LDAP auth ok-check: '%.256s'='%.256s' passed",
          NIL(str), NIL(v));
        }
      } else {
        errno = 0;
        misc_die(FL, "ldap_auth: ?LDAPAuthOKFlag?");
      }
    } else {
    syslog_write(T_DBG, "LDAP auth ok-check skipped");
    }

    /* dn=uid=<username>,<ldapbase> */
    auth_dn=malloc(255);
    strcpy(auth_dn,"uid=");
    strcpy(auth_dn+4,who);
    luser=strlen(who);
    strcpy(auth_dn+4+luser,", ");
    strcpy(auth_dn+6+luser,base);

    /* attempt bind to server using found DN and provided password */
    if (ldap_simple_bind_s(ld, auth_dn, pwd) == LDAP_SUCCESS) {
      free(auth_dn);
      ldap_unbind(ld);
      return 0;
    }

    /* bind failed, password probably no good */
    free(auth_dn);
    ldap_unbind(ld);
    return -1;
}



_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail. 
http://www.hotmail.com


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]