source: auth_ldap.c @ 297d2129

#define BITLBEE_CORE
#define LDAP_DEPRECATED 1
#include "bitlbee.h"
#include <ldap.h>

static storage_status_t ldap_check_pass(const char *nick, const char *password)
{
        LDAP *ldap;
        LDAPMessage *msg, *entry;
        char *dn = NULL;
        char *filter;
        char *attrs[1] = { NULL };
        int ret, count;

        if((ret = ldap_initialize(&ldap, NULL)) != LDAP_SUCCESS) {
                log_message(LOGLVL_WARNING, "ldap_initialize failed: %s", ldap_err2string(ret));
                return STORAGE_OTHER_ERROR;
        }

        /* First we do an anonymous bind to map uid=$nick to a DN*/
        if((ret = ldap_simple_bind_s(ldap, NULL, NULL)) != LDAP_SUCCESS) {
                ldap_unbind_s(ldap);
                log_message(LOGLVL_WARNING, "Anonymous bind failed: %s", ldap_err2string(ret));
                return STORAGE_OTHER_ERROR;
        }


        /* We search and process the result */
        filter = g_strdup_printf("(uid=%s)", nick);
        ret = ldap_search_ext_s(ldap, NULL, LDAP_SCOPE_SUBTREE, filter, attrs, 0, NULL, NULL, NULL, 1, &msg);
        g_free(filter);

        if(ret != LDAP_SUCCESS) {
                ldap_unbind_s(ldap);
                log_message(LOGLVL_WARNING, "uid search failed: %s", ldap_err2string(ret));
                return STORAGE_OTHER_ERROR;
        }

        count = ldap_count_entries(ldap, msg);
        if (count == -1) {
                ldap_get_option(ldap, LDAP_OPT_ERROR_NUMBER, &ret);
                ldap_msgfree(msg);
                ldap_unbind_s(ldap);
                log_message(LOGLVL_WARNING, "uid search failed: %s", ldap_err2string(ret));
                return STORAGE_OTHER_ERROR;
        }

        if (!count) {
                ldap_msgfree(msg);
                ldap_unbind_s(ldap);
                return STORAGE_NO_SUCH_USER;
        }

        entry = ldap_first_entry(ldap, msg);
        dn = ldap_get_dn(ldap, entry);
        ldap_msgfree(msg);

        /* And now we bind as the user to authenticate */
        ret = ldap_simple_bind_s(ldap, dn, password);
        g_free(dn);
        ldap_unbind_s(ldap);

        switch (ret) {
                case LDAP_SUCCESS:
                        return STORAGE_OK;
                case LDAP_INVALID_CREDENTIALS:
                        return STORAGE_INVALID_PASSWORD;
                default:
                        log_message(LOGLVL_WARNING, "Authenticated bind failed: %s", ldap_err2string(ret));
                        return STORAGE_OTHER_ERROR;
        }
}

auth_backend_t auth_ldap = {
        .name = "ldap",
        .check_pass = ldap_check_pass,
};