![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to mod_auth.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / lighttpd / src|
Return to mod_auth.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / lighttpd / src |
1.1 misho 1: #include "plugin.h"
2: #include "http_auth.h"
3: #include "log.h"
4: #include "response.h"
5:
6: #include <sys/types.h>
7: #include <sys/stat.h>
8:
9: #include <stdlib.h>
10: #include <string.h>
11: #include <errno.h>
12: #include <fcntl.h>
13: #include <unistd.h>
14:
15: handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s);
16:
17:
18: /**
19: * the basic and digest auth framework
20: *
21: * - config handling
22: * - protocol handling
23: *
24: * http_auth.c
25: * http_auth_digest.c
26: *
27: * do the real work
28: */
29:
30: INIT_FUNC(mod_auth_init) {
31: mod_auth_plugin_data *p;
32:
33: p = calloc(1, sizeof(*p));
34:
35: p->tmp_buf = buffer_init();
36:
37: p->auth_user = buffer_init();
38: #ifdef USE_LDAP
39: p->ldap_filter = buffer_init();
40: #endif
41:
42: return p;
43: }
44:
45: FREE_FUNC(mod_auth_free) {
46: mod_auth_plugin_data *p = p_d;
47:
48: UNUSED(srv);
49:
50: if (!p) return HANDLER_GO_ON;
51:
52: buffer_free(p->tmp_buf);
53: buffer_free(p->auth_user);
54: #ifdef USE_LDAP
55: buffer_free(p->ldap_filter);
56: #endif
57:
58: if (p->config_storage) {
59: size_t i;
60: for (i = 0; i < srv->config_context->used; i++) {
61: mod_auth_plugin_config *s = p->config_storage[i];
62:
63: if (!s) continue;
64:
65: array_free(s->auth_require);
66: buffer_free(s->auth_plain_groupfile);
67: buffer_free(s->auth_plain_userfile);
68: buffer_free(s->auth_htdigest_userfile);
69: buffer_free(s->auth_htpasswd_userfile);
70: buffer_free(s->auth_backend_conf);
71:
72: buffer_free(s->auth_ldap_hostname);
73: buffer_free(s->auth_ldap_basedn);
74: buffer_free(s->auth_ldap_binddn);
75: buffer_free(s->auth_ldap_bindpw);
76: buffer_free(s->auth_ldap_filter);
77: buffer_free(s->auth_ldap_cafile);
78:
79: #ifdef USE_LDAP
80: buffer_free(s->ldap_filter_pre);
81: buffer_free(s->ldap_filter_post);
82:
83: if (s->ldap) ldap_unbind_s(s->ldap);
84: #endif
85:
86: free(s);
87: }
88: free(p->config_storage);
89: }
90:
91: free(p);
92:
93: return HANDLER_GO_ON;
94: }
95:
96: #define PATCH(x) \
97: p->conf.x = s->x;
98: static int mod_auth_patch_connection(server *srv, connection *con, mod_auth_plugin_data *p) {
99: size_t i, j;
100: mod_auth_plugin_config *s = p->config_storage[0];
101:
102: PATCH(auth_backend);
103: PATCH(auth_plain_groupfile);
104: PATCH(auth_plain_userfile);
105: PATCH(auth_htdigest_userfile);
106: PATCH(auth_htpasswd_userfile);
107: PATCH(auth_require);
108: PATCH(auth_debug);
109: PATCH(auth_ldap_hostname);
110: PATCH(auth_ldap_basedn);
111: PATCH(auth_ldap_binddn);
112: PATCH(auth_ldap_bindpw);
113: PATCH(auth_ldap_filter);
114: PATCH(auth_ldap_cafile);
115: PATCH(auth_ldap_starttls);
116: PATCH(auth_ldap_allow_empty_pw);
117: #ifdef USE_LDAP
118: p->anon_conf = s;
119: PATCH(ldap_filter_pre);
120: PATCH(ldap_filter_post);
121: #endif
122:
123: /* skip the first, the global context */
124: for (i = 1; i < srv->config_context->used; i++) {
125: data_config *dc = (data_config *)srv->config_context->data[i];
126: s = p->config_storage[i];
127:
128: /* condition didn't match */
129: if (!config_check_cond(srv, con, dc)) continue;
130:
131: /* merge config */
132: for (j = 0; j < dc->value->used; j++) {
133: data_unset *du = dc->value->data[j];
134:
135: if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend"))) {
136: PATCH(auth_backend);
137: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.plain.groupfile"))) {
138: PATCH(auth_plain_groupfile);
139: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.plain.userfile"))) {
140: PATCH(auth_plain_userfile);
141: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.htdigest.userfile"))) {
142: PATCH(auth_htdigest_userfile);
143: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.htpasswd.userfile"))) {
144: PATCH(auth_htpasswd_userfile);
145: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.require"))) {
146: PATCH(auth_require);
147: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.debug"))) {
148: PATCH(auth_debug);
149: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.hostname"))) {
150: PATCH(auth_ldap_hostname);
151: #ifdef USE_LDAP
152: p->anon_conf = s;
153: #endif
154: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.base-dn"))) {
155: PATCH(auth_ldap_basedn);
156: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.filter"))) {
157: PATCH(auth_ldap_filter);
158: #ifdef USE_LDAP
159: PATCH(ldap_filter_pre);
160: PATCH(ldap_filter_post);
161: #endif
162: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.ca-file"))) {
163: PATCH(auth_ldap_cafile);
164: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.starttls"))) {
165: PATCH(auth_ldap_starttls);
166: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.bind-dn"))) {
167: PATCH(auth_ldap_binddn);
168: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.bind-pw"))) {
169: PATCH(auth_ldap_bindpw);
170: } else if (buffer_is_equal_string(du->key, CONST_STR_LEN("auth.backend.ldap.allow-empty-pw"))) {
171: PATCH(auth_ldap_allow_empty_pw);
172: }
173: }
174: }
175:
176: return 0;
177: }
178: #undef PATCH
179:
180: static handler_t mod_auth_uri_handler(server *srv, connection *con, void *p_d) {
181: size_t k;
182: int auth_required = 0, auth_satisfied = 0;
183: char *http_authorization = NULL;
184: const char *auth_type = NULL;
185: data_string *ds;
186: mod_auth_plugin_data *p = p_d;
187: array *req;
188: data_string *req_method;
189:
190: /* select the right config */
191: mod_auth_patch_connection(srv, con, p);
192:
193: if (p->conf.auth_require == NULL) return HANDLER_GO_ON;
194:
195: /*
196: * AUTH
197: *
198: */
199:
200: /* do we have to ask for auth ? */
201:
202: auth_required = 0;
203: auth_satisfied = 0;
204:
205: /* search auth-directives for path */
206: for (k = 0; k < p->conf.auth_require->used; k++) {
207: buffer *require = p->conf.auth_require->data[k]->key;
208:
209: if (require->used == 0) continue;
210: if (con->uri.path->used < require->used) continue;
211:
212: /* if we have a case-insensitive FS we have to lower-case the URI here too */
213:
214: if (con->conf.force_lowercase_filenames) {
215: if (0 == strncasecmp(con->uri.path->ptr, require->ptr, require->used - 1)) {
216: auth_required = 1;
217: break;
218: }
219: } else {
220: if (0 == strncmp(con->uri.path->ptr, require->ptr, require->used - 1)) {
221: auth_required = 1;
222: break;
223: }
224: }
225: }
226:
227: /* nothing to do for us */
228: if (auth_required == 0) return HANDLER_GO_ON;
229:
230: req = ((data_array *)(p->conf.auth_require->data[k]))->value;
231: req_method = (data_string *)array_get_element(req, "method");
232:
233: if (0 == strcmp(req_method->value->ptr, "extern")) {
234: /* require REMOTE_USER to be already set */
235: if (NULL == (ds = (data_string *)array_get_element(con->environment, "REMOTE_USER"))) {
236: con->http_status = 401;
237: con->mode = DIRECT;
238: return HANDLER_FINISHED;
239: } else if (http_auth_match_rules(srv, req, ds->value->ptr, NULL, NULL)) {
240: log_error_write(srv, __FILE__, __LINE__, "s", "rules didn't match");
241: con->http_status = 401;
242: con->mode = DIRECT;
243: return HANDLER_FINISHED;
244: } else {
245: return HANDLER_GO_ON;
246: }
247: }
248:
249: /* try to get Authorization-header */
250:
251: if (NULL != (ds = (data_string *)array_get_element(con->request.headers, "Authorization")) && ds->value->used) {
252: char *auth_realm;
253:
254: http_authorization = ds->value->ptr;
255:
256: /* parse auth-header */
257: if (NULL != (auth_realm = strchr(http_authorization, ' '))) {
258: int auth_type_len = auth_realm - http_authorization;
259:
260: if ((auth_type_len == 5) &&
261: (0 == strncasecmp(http_authorization, "Basic", auth_type_len))) {
262: auth_type = "Basic";
263:
264: if (0 == strcmp(req_method->value->ptr, "basic")) {
265: auth_satisfied = http_auth_basic_check(srv, con, p, req, auth_realm+1);
266: }
267: } else if ((auth_type_len == 6) &&
268: (0 == strncasecmp(http_authorization, "Digest", auth_type_len))) {
269: auth_type = "Digest";
270: if (0 == strcmp(req_method->value->ptr, "digest")) {
271: if (-1 == (auth_satisfied = http_auth_digest_check(srv, con, p, req, auth_realm+1))) {
272: con->http_status = 400;
273: con->mode = DIRECT;
274:
275: /* a field was missing */
276:
277: return HANDLER_FINISHED;
278: }
279: }
280: } else {
281: log_error_write(srv, __FILE__, __LINE__, "ss",
282: "unknown authentification type:",
283: http_authorization);
284: }
285: }
286: }
287:
288: if (!auth_satisfied) {
289: data_string *method, *realm;
290: method = (data_string *)array_get_element(req, "method");
291: realm = (data_string *)array_get_element(req, "realm");
292:
293: con->http_status = 401;
294: con->mode = DIRECT;
295:
296: if (0 == strcmp(method->value->ptr, "basic")) {
297: buffer_copy_string_len(p->tmp_buf, CONST_STR_LEN("Basic realm=\""));
298: buffer_append_string_buffer(p->tmp_buf, realm->value);
299: buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\""));
300:
301: response_header_insert(srv, con, CONST_STR_LEN("WWW-Authenticate"), CONST_BUF_LEN(p->tmp_buf));
302: } else if (0 == strcmp(method->value->ptr, "digest")) {
303: char hh[33];
304: http_auth_digest_generate_nonce(srv, p, srv->tmp_buf, hh);
305:
306: buffer_copy_string_len(p->tmp_buf, CONST_STR_LEN("Digest realm=\""));
307: buffer_append_string_buffer(p->tmp_buf, realm->value);
308: buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\", nonce=\""));
309: buffer_append_string(p->tmp_buf, hh);
310: buffer_append_string_len(p->tmp_buf, CONST_STR_LEN("\", qop=\"auth\""));
311:
312: response_header_insert(srv, con, CONST_STR_LEN("WWW-Authenticate"), CONST_BUF_LEN(p->tmp_buf));
313: } else {
314: /* evil */
315: }
316: return HANDLER_FINISHED;
317: } else {
318: /* the REMOTE_USER header */
319:
320: if (NULL == (ds = (data_string *)array_get_element(con->environment, "REMOTE_USER"))) {
321: if (NULL == (ds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
322: ds = data_string_init();
323: }
324: buffer_copy_string(ds->key, "REMOTE_USER");
325: array_insert_unique(con->environment, (data_unset *)ds);
326: }
327: buffer_copy_string_buffer(ds->value, p->auth_user);
328:
329: /* AUTH_TYPE environment */
330:
331: if (NULL == (ds = (data_string *)array_get_element(con->environment, "AUTH_TYPE"))) {
332: if (NULL == (ds = (data_string *)array_get_unused_element(con->environment, TYPE_STRING))) {
333: ds = data_string_init();
334: }
335: buffer_copy_string(ds->key, "AUTH_TYPE");
336: array_insert_unique(con->environment, (data_unset *)ds);
337: }
338: buffer_copy_string(ds->value, auth_type);
339: }
340:
341: return HANDLER_GO_ON;
342: }
343:
344: SETDEFAULTS_FUNC(mod_auth_set_defaults) {
345: mod_auth_plugin_data *p = p_d;
346: size_t i;
347:
348: config_values_t cv[] = {
349: { "auth.backend", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 0 */
350: { "auth.backend.plain.groupfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 1 */
351: { "auth.backend.plain.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 2 */
352: { "auth.require", NULL, T_CONFIG_LOCAL, T_CONFIG_SCOPE_CONNECTION }, /* 3 */
353: { "auth.backend.ldap.hostname", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 4 */
354: { "auth.backend.ldap.base-dn", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 5 */
355: { "auth.backend.ldap.filter", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 6 */
356: { "auth.backend.ldap.ca-file", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 7 */
357: { "auth.backend.ldap.starttls", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 8 */
358: { "auth.backend.ldap.bind-dn", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 9 */
359: { "auth.backend.ldap.bind-pw", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 10 */
360: { "auth.backend.ldap.allow-empty-pw", NULL, T_CONFIG_BOOLEAN, T_CONFIG_SCOPE_CONNECTION }, /* 11 */
361: { "auth.backend.htdigest.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 12 */
362: { "auth.backend.htpasswd.userfile", NULL, T_CONFIG_STRING, T_CONFIG_SCOPE_CONNECTION }, /* 13 */
363: { "auth.debug", NULL, T_CONFIG_SHORT, T_CONFIG_SCOPE_CONNECTION }, /* 14 */
364: { NULL, NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
365: };
366:
367: p->config_storage = calloc(1, srv->config_context->used * sizeof(specific_config *));
368:
369: for (i = 0; i < srv->config_context->used; i++) {
370: mod_auth_plugin_config *s;
371: size_t n;
372: data_array *da;
373: array *ca;
374:
375: s = calloc(1, sizeof(mod_auth_plugin_config));
376: s->auth_plain_groupfile = buffer_init();
377: s->auth_plain_userfile = buffer_init();
378: s->auth_htdigest_userfile = buffer_init();
379: s->auth_htpasswd_userfile = buffer_init();
380: s->auth_backend_conf = buffer_init();
381:
382: s->auth_ldap_hostname = buffer_init();
383: s->auth_ldap_basedn = buffer_init();
384: s->auth_ldap_binddn = buffer_init();
385: s->auth_ldap_bindpw = buffer_init();
386: s->auth_ldap_filter = buffer_init();
387: s->auth_ldap_cafile = buffer_init();
388: s->auth_ldap_starttls = 0;
389: s->auth_debug = 0;
390:
391: s->auth_require = array_init();
392:
393: #ifdef USE_LDAP
394: s->ldap_filter_pre = buffer_init();
395: s->ldap_filter_post = buffer_init();
396: s->ldap = NULL;
397: #endif
398:
399: cv[0].destination = s->auth_backend_conf;
400: cv[1].destination = s->auth_plain_groupfile;
401: cv[2].destination = s->auth_plain_userfile;
402: cv[3].destination = s->auth_require;
403: cv[4].destination = s->auth_ldap_hostname;
404: cv[5].destination = s->auth_ldap_basedn;
405: cv[6].destination = s->auth_ldap_filter;
406: cv[7].destination = s->auth_ldap_cafile;
407: cv[8].destination = &(s->auth_ldap_starttls);
408: cv[9].destination = s->auth_ldap_binddn;
409: cv[10].destination = s->auth_ldap_bindpw;
410: cv[11].destination = &(s->auth_ldap_allow_empty_pw);
411: cv[12].destination = s->auth_htdigest_userfile;
412: cv[13].destination = s->auth_htpasswd_userfile;
413: cv[14].destination = &(s->auth_debug);
414:
415: p->config_storage[i] = s;
416: ca = ((data_config *)srv->config_context->data[i])->value;
417:
418: if (0 != config_insert_values_global(srv, ca, cv)) {
419: return HANDLER_ERROR;
420: }
421:
422: if (s->auth_backend_conf->used) {
423: if (0 == strcmp(s->auth_backend_conf->ptr, "htpasswd")) {
424: s->auth_backend = AUTH_BACKEND_HTPASSWD;
425: } else if (0 == strcmp(s->auth_backend_conf->ptr, "htdigest")) {
426: s->auth_backend = AUTH_BACKEND_HTDIGEST;
427: } else if (0 == strcmp(s->auth_backend_conf->ptr, "plain")) {
428: s->auth_backend = AUTH_BACKEND_PLAIN;
429: } else if (0 == strcmp(s->auth_backend_conf->ptr, "ldap")) {
430: s->auth_backend = AUTH_BACKEND_LDAP;
431: } else {
432: log_error_write(srv, __FILE__, __LINE__, "sb", "auth.backend not supported:", s->auth_backend_conf);
433:
434: return HANDLER_ERROR;
435: }
436: }
437:
438: #ifdef USE_LDAP
439: if (s->auth_ldap_filter->used) {
440: char *dollar;
441:
442: /* parse filter */
443:
444: if (NULL == (dollar = strchr(s->auth_ldap_filter->ptr, '$'))) {
445: log_error_write(srv, __FILE__, __LINE__, "s", "ldap: auth.backend.ldap.filter is missing a replace-operator '$'");
446:
447: return HANDLER_ERROR;
448: }
449:
450: buffer_copy_string_len(s->ldap_filter_pre, s->auth_ldap_filter->ptr, dollar - s->auth_ldap_filter->ptr);
451: buffer_copy_string(s->ldap_filter_post, dollar+1);
452: }
453: #endif
454:
455: /* no auth.require for this section */
456: if (NULL == (da = (data_array *)array_get_element(ca, "auth.require"))) continue;
457:
458: if (da->type != TYPE_ARRAY) continue;
459:
460: for (n = 0; n < da->value->used; n++) {
461: size_t m;
462: data_array *da_file = (data_array *)da->value->data[n];
463: const char *method, *realm, *require;
464:
465: if (da->value->data[n]->type != TYPE_ARRAY) {
466: log_error_write(srv, __FILE__, __LINE__, "ss",
467: "auth.require should contain an array as in:",
468: "auth.require = ( \"...\" => ( ..., ...) )");
469:
470: return HANDLER_ERROR;
471: }
472:
473: method = realm = require = NULL;
474:
475: for (m = 0; m < da_file->value->used; m++) {
476: if (da_file->value->data[m]->type == TYPE_STRING) {
477: if (0 == strcmp(da_file->value->data[m]->key->ptr, "method")) {
478: method = ((data_string *)(da_file->value->data[m]))->value->ptr;
479: } else if (0 == strcmp(da_file->value->data[m]->key->ptr, "realm")) {
480: realm = ((data_string *)(da_file->value->data[m]))->value->ptr;
481: } else if (0 == strcmp(da_file->value->data[m]->key->ptr, "require")) {
482: require = ((data_string *)(da_file->value->data[m]))->value->ptr;
483: } else {
484: log_error_write(srv, __FILE__, __LINE__, "ssbs",
485: "the field is unknown in:",
486: "auth.require = ( \"...\" => ( ..., -> \"",
487: da_file->value->data[m]->key,
488: "\" <- => \"...\" ) )");
489:
490: return HANDLER_ERROR;
491: }
492: } else {
493: log_error_write(srv, __FILE__, __LINE__, "ssbs",
494: "a string was expected for:",
495: "auth.require = ( \"...\" => ( ..., -> \"",
496: da_file->value->data[m]->key,
497: "\" <- => \"...\" ) )");
498:
499: return HANDLER_ERROR;
500: }
501: }
502:
503: if (method == NULL) {
504: log_error_write(srv, __FILE__, __LINE__, "ss",
505: "the method field is missing in:",
506: "auth.require = ( \"...\" => ( ..., \"method\" => \"...\" ) )");
507: return HANDLER_ERROR;
508: } else {
509: if (0 != strcmp(method, "basic") &&
510: 0 != strcmp(method, "digest") &&
511: 0 != strcmp(method, "extern")) {
512: log_error_write(srv, __FILE__, __LINE__, "ss",
513: "method has to be either \"basic\", \"digest\" or \"extern\" in",
514: "auth.require = ( \"...\" => ( ..., \"method\" => \"...\") )");
515: return HANDLER_ERROR;
516: }
517: }
518:
519: if (realm == NULL) {
520: log_error_write(srv, __FILE__, __LINE__, "ss",
521: "the realm field is missing in:",
522: "auth.require = ( \"...\" => ( ..., \"realm\" => \"...\" ) )");
523: return HANDLER_ERROR;
524: }
525:
526: if (require == NULL) {
527: log_error_write(srv, __FILE__, __LINE__, "ss",
528: "the require field is missing in:",
529: "auth.require = ( \"...\" => ( ..., \"require\" => \"...\" ) )");
530: return HANDLER_ERROR;
531: }
532:
533: if (method && realm && require) {
534: data_string *ds;
535: data_array *a;
536:
537: a = data_array_init();
538: buffer_copy_string_buffer(a->key, da_file->key);
539:
540: ds = data_string_init();
541:
542: buffer_copy_string_len(ds->key, CONST_STR_LEN("method"));
543: buffer_copy_string(ds->value, method);
544:
545: array_insert_unique(a->value, (data_unset *)ds);
546:
547: ds = data_string_init();
548:
549: buffer_copy_string_len(ds->key, CONST_STR_LEN("realm"));
550: buffer_copy_string(ds->value, realm);
551:
552: array_insert_unique(a->value, (data_unset *)ds);
553:
554: ds = data_string_init();
555:
556: buffer_copy_string_len(ds->key, CONST_STR_LEN("require"));
557: buffer_copy_string(ds->value, require);
558:
559: array_insert_unique(a->value, (data_unset *)ds);
560:
561: array_insert_unique(s->auth_require, (data_unset *)a);
562: }
563: }
564:
565: switch(s->auth_ldap_hostname->used) {
566: case AUTH_BACKEND_LDAP: {
567: handler_t ret = auth_ldap_init(srv, s);
568: if (ret == HANDLER_ERROR)
569: return (ret);
570: break;
571: }
572: default:
573: break;
574: }
575: }
576:
577: return HANDLER_GO_ON;
578: }
579:
580: handler_t auth_ldap_init(server *srv, mod_auth_plugin_config *s) {
581: #ifdef USE_LDAP
582: int ret;
583: #if 0
584: if (s->auth_ldap_basedn->used == 0) {
585: log_error_write(srv, __FILE__, __LINE__, "s", "ldap: auth.backend.ldap.base-dn has to be set");
586:
587: return HANDLER_ERROR;
588: }
589: #endif
590:
591: if (s->auth_ldap_hostname->used) {
592: /* free old context */
593: if (NULL != s->ldap) ldap_unbind_s(s->ldap);
594:
595: if (NULL == (s->ldap = ldap_init(s->auth_ldap_hostname->ptr, LDAP_PORT))) {
596: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap ...", strerror(errno));
597:
598: return HANDLER_ERROR;
599: }
600:
601: ret = LDAP_VERSION3;
602: if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(s->ldap, LDAP_OPT_PROTOCOL_VERSION, &ret))) {
603: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
604:
605: return HANDLER_ERROR;
606: }
607:
608: if (s->auth_ldap_starttls) {
609: /* if no CA file is given, it is ok, as we will use encryption
610: * if the server requires a CAfile it will tell us */
611: if (!buffer_is_empty(s->auth_ldap_cafile)) {
612: if (LDAP_OPT_SUCCESS != (ret = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE,
613: s->auth_ldap_cafile->ptr))) {
614: log_error_write(srv, __FILE__, __LINE__, "ss",
615: "Loading CA certificate failed:", ldap_err2string(ret));
616:
617: return HANDLER_ERROR;
618: }
619: }
620:
621: if (LDAP_OPT_SUCCESS != (ret = ldap_start_tls_s(s->ldap, NULL, NULL))) {
622: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap startTLS failed:", ldap_err2string(ret));
623:
624: return HANDLER_ERROR;
625: }
626: }
627:
628:
629: /* 1. */
630: if (s->auth_ldap_binddn->used) {
631: if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(s->ldap, s->auth_ldap_binddn->ptr, s->auth_ldap_bindpw->ptr))) {
632: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
633:
634: return HANDLER_ERROR;
635: }
636: } else {
637: if (LDAP_SUCCESS != (ret = ldap_simple_bind_s(s->ldap, NULL, NULL))) {
638: log_error_write(srv, __FILE__, __LINE__, "ss", "ldap:", ldap_err2string(ret));
639:
640: return HANDLER_ERROR;
641: }
642: }
643: }
644: return HANDLER_GO_ON;
645: #else
646: UNUSED(s);
647: log_error_write(srv, __FILE__, __LINE__, "s", "no ldap support available");
648: return HANDLER_ERROR;
649: #endif
650: }
651:
652: int mod_auth_plugin_init(plugin *p);
653: int mod_auth_plugin_init(plugin *p) {
654: p->version = LIGHTTPD_VERSION_ID;
655: p->name = buffer_init_string("auth");
656: p->init = mod_auth_init;
657: p->set_defaults = mod_auth_set_defaults;
658: p->handle_uri_clean = mod_auth_uri_handler;
659: p->cleanup = mod_auth_free;
660:
661: p->data = NULL;
662:
663: return 0;
664: }