Home | History | Annotate | Line # | Download | only in lastbind 
      1 /*	$NetBSD: lastbind.c,v 1.3 2025/09/05 21:16:16 christos Exp $	*/
      2 
      3 /* lastbind.c - Record timestamp of the last successful bind to entries */
      4 /* $OpenLDAP$ */
      5 /*
      6  * Copyright 2009 Jonathan Clarke <jonathan (at) phillipoux.net>.
      7  * All rights reserved.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted only as authorized by the OpenLDAP
     11  * Public License.
     12  *
     13  * A copy of this license is available in the file LICENSE in the
     14  * top-level directory of the distribution or, alternatively, at
     15  * <http://www.OpenLDAP.org/license.html>.
     16  */
     17 /* ACKNOWLEDGEMENTS:
     18  * This work is loosely derived from the ppolicy overlay.
     19  */
     20 
     21 #include <sys/cdefs.h>
     22 __RCSID("$NetBSD: lastbind.c,v 1.3 2025/09/05 21:16:16 christos Exp $");
     23 
     24 #include "portable.h"
     25 
     26 /*
     27  * This file implements an overlay that stores the timestamp of the
     28  * last successful bind operation in a directory entry.
     29  *
     30  * Optimization: to avoid performing a write on each bind,
     31  * a precision for this timestamp may be configured on the database,
     32  * causing it to only be updated if it is older than a given number
     33  * of seconds.
     34  */
     35 
     36 #ifdef SLAPD_OVER_LASTBIND
     37 
     38 #include <ldap.h>
     39 #include "lutil.h"
     40 #include "slap.h"
     41 #include <ac/errno.h>
     42 #include <ac/time.h>
     43 #include <ac/string.h>
     44 #include <ac/ctype.h>
     45 #include "slap-config.h"
     46 
     47 /* Per-instance configuration information */
     48 typedef struct lastbind_info {
     49 	int forward_updates;	/* use frontend for authTimestamp updates */
     50 } lastbind_info;
     51 
     52 /* Operational attributes */
     53 static AttributeDescription *ad_authTimestamp;
     54 
     55 /* This is the definition used by ISODE, as supplied to us in
     56  * ITS#6238 Followup #9
     57  */
     58 static struct schema_info {
     59 	char *def;
     60 	AttributeDescription **ad;
     61 } lastBind_OpSchema[] = {
     62 	{	"( 1.3.6.1.4.1.453.16.2.188 "
     63 		"NAME 'authTimestamp' "
     64 		"DESC 'last successful authentication using any method/mech' "
     65 		"EQUALITY generalizedTimeMatch "
     66 		"ORDERING generalizedTimeOrderingMatch "
     67 		"SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 "
     68 		"SINGLE-VALUE NO-USER-MODIFICATION USAGE dsaOperation )",
     69 		&ad_authTimestamp},
     70 	{ NULL, NULL }
     71 };
     72 
     73 /* configuration attribute and objectclass */
     74 static ConfigTable lastbindcfg[] = {
     75 	{ "lastbind_forward_updates", "on|off", 1, 2, 0,
     76 	  ARG_ON_OFF|ARG_OFFSET,
     77 	  (void *)offsetof(lastbind_info,forward_updates),
     78 	  "( OLcfgAt:5.2 NAME 'olcLastBindForwardUpdates' "
     79 	  "DESC 'Allow authTimestamp updates to be forwarded via updateref' "
     80 	  "EQUALITY booleanMatch "
     81 	  "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
     82 	{ NULL, NULL, 0, 0, 0, ARG_IGNORED }
     83 };
     84 
     85 static ConfigOCs lastbindocs[] = {
     86 	{ "( OLcfgCtOc:5.1 "
     87 	  "NAME 'olcLastBindConfig' "
     88 	  "DESC 'Last Bind configuration' "
     89 	  "SUP olcOverlayConfig "
     90 	  "MAY ( olcLastBindForwardUpdates) )",
     91 	  Cft_Overlay, lastbindcfg, NULL, NULL },
     92 	{ NULL, 0, NULL }
     93 };
     94 
     95 static time_t
     96 parse_time( char *atm )
     97 {
     98 	struct lutil_tm tm;
     99 	struct lutil_timet tt;
    100 	time_t ret = (time_t)-1;
    101 
    102 	if ( lutil_parsetime( atm, &tm ) == 0) {
    103 		lutil_tm2time( &tm, &tt );
    104 		ret = tt.tt_sec;
    105 	}
    106 	return ret;
    107 }
    108 
    109 static int
    110 lastbind_bind_response( Operation *op, SlapReply *rs )
    111 {
    112 	Modifications *mod = NULL;
    113 	BackendInfo *bi = op->o_bd->bd_info;
    114 	Entry *e;
    115 	int rc;
    116 
    117 	/* we're only interested if the bind was successful */
    118 	if ( rs->sr_err != LDAP_SUCCESS )
    119 		return SLAP_CB_CONTINUE;
    120 
    121 	rc = be_entry_get_rw( op, &op->o_req_ndn, NULL, NULL, 0, &e );
    122 	op->o_bd->bd_info = bi;
    123 
    124 	if ( rc != LDAP_SUCCESS ) {
    125 		return SLAP_CB_CONTINUE;
    126 	}
    127 
    128 	{
    129 		lastbind_info *lbi = (lastbind_info *) op->o_callback->sc_private;
    130 
    131 		time_t now, bindtime = (time_t)-1;
    132 		Attribute *a;
    133 		Modifications *m;
    134 		char nowstr[ LDAP_LUTIL_GENTIME_BUFSIZE ];
    135 		struct berval timestamp;
    136 
    137 		/* get the current time */
    138 		now = slap_get_time();
    139 
    140 		/* get authTimestamp attribute, if it exists */
    141 		if ((a = attr_find( e->e_attrs, ad_authTimestamp)) != NULL) {
    142 			bindtime = parse_time( a->a_nvals[0].bv_val );
    143 
    144 			if (bindtime != (time_t)-1) {
    145 				/* if the recorded bind time is within our precision, we're done
    146 				 * it doesn't need to be updated (save a write for nothing) */
    147 				if ((now - bindtime) < op->o_bd->be_lastbind_precision) {
    148 					goto done;
    149 				}
    150 			}
    151 		}
    152 
    153 		/* update the authTimestamp in the user's entry with the current time */
    154 		timestamp.bv_val = nowstr;
    155 		timestamp.bv_len = sizeof(nowstr);
    156 		slap_timestamp( &now, &timestamp );
    157 
    158 		m = ch_calloc( sizeof(Modifications), 1 );
    159 		m->sml_op = LDAP_MOD_REPLACE;
    160 		m->sml_flags = 0;
    161 		m->sml_type = ad_authTimestamp->ad_cname;
    162 		m->sml_desc = ad_authTimestamp;
    163 		m->sml_numvals = 1;
    164 		m->sml_values = ch_calloc( sizeof(struct berval), 2 );
    165 		m->sml_nvalues = ch_calloc( sizeof(struct berval), 2 );
    166 
    167 		ber_dupbv( &m->sml_values[0], &timestamp );
    168 		ber_dupbv( &m->sml_nvalues[0], &timestamp );
    169 		m->sml_next = mod;
    170 		mod = m;
    171 	}
    172 
    173 done:
    174 	be_entry_release_r( op, e );
    175 
    176 	/* perform the update, if necessary */
    177 	if ( mod ) {
    178 		Operation op2 = *op;
    179 		SlapReply r2 = { REP_RESULT };
    180 		slap_callback cb = { NULL, slap_null_cb, NULL, NULL };
    181 		LDAPControl c, *ca[2];
    182 		lastbind_info *lbi = (lastbind_info *) op->o_callback->sc_private;
    183 
    184 		/* This is a DSA-specific opattr, it never gets replicated. */
    185 		op2.o_tag = LDAP_REQ_MODIFY;
    186 		op2.o_callback = &cb;
    187 		op2.orm_modlist = mod;
    188 		op2.orm_no_opattrs = 0;
    189 		op2.o_dn = op->o_bd->be_rootdn;
    190 		op2.o_ndn = op->o_bd->be_rootndn;
    191 
    192 		/*
    193 		 * Code for forwarding of updates adapted from ppolicy.c of slapo-ppolicy
    194 		 *
    195 		 * If this server is a shadow and forward_updates is true,
    196 		 * use the frontend to perform this modify. That will trigger
    197 		 * the update referral, which can then be forwarded by the
    198 		 * chain overlay. Obviously the updateref and chain overlay
    199 		 * must be configured appropriately for this to be useful.
    200 		 */
    201 		if ( SLAP_SHADOW( op->o_bd ) && lbi->forward_updates ) {
    202 			op2.o_bd = frontendDB;
    203 
    204 			/* Must use Relax control since these are no-user-mod */
    205 			op2.o_relax = SLAP_CONTROL_CRITICAL;
    206 			op2.o_ctrls = ca;
    207 			ca[0] = &c;
    208 			ca[1] = NULL;
    209 			BER_BVZERO( &c.ldctl_value );
    210 			c.ldctl_iscritical = 1;
    211 			c.ldctl_oid = LDAP_CONTROL_RELAX;
    212 		} else {
    213 			/* If not forwarding, don't update opattrs and don't replicate */
    214 			if ( SLAP_SINGLE_SHADOW( op->o_bd )) {
    215 				op2.orm_no_opattrs = 1;
    216 				op2.o_dont_replicate = 1;
    217 			}
    218 			/* TODO: not sure what this does in slapo-ppolicy */
    219 			/*
    220 			op2.o_bd->bd_info = (BackendInfo *)on->on_info;
    221 			*/
    222 		}
    223 
    224 		rc = op2.o_bd->be_modify( &op2, &r2 );
    225 		slap_mods_free( mod, 1 );
    226 	}
    227 
    228 	op->o_bd->bd_info = bi;
    229 	return SLAP_CB_CONTINUE;
    230 }
    231 
    232 static int
    233 lastbind_bind( Operation *op, SlapReply *rs )
    234 {
    235 	slap_callback *cb;
    236 	slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
    237 
    238 	/* setup a callback to intercept result of this bind operation
    239 	 * and pass along the lastbind_info struct */
    240 	cb = op->o_tmpcalloc( sizeof(slap_callback), 1, op->o_tmpmemctx );
    241 	cb->sc_response = lastbind_bind_response;
    242 	cb->sc_next = op->o_callback->sc_next;
    243 	cb->sc_private = on->on_bi.bi_private;
    244 	op->o_callback->sc_next = cb;
    245 
    246 	return SLAP_CB_CONTINUE;
    247 }
    248 
    249 static int
    250 lastbind_db_init(
    251 	BackendDB *be,
    252 	ConfigReply *cr
    253 )
    254 {
    255 	slap_overinst *on = (slap_overinst *) be->bd_info;
    256 
    257 	/* initialize private structure to store configuration */
    258 	on->on_bi.bi_private = ch_calloc( 1, sizeof(lastbind_info) );
    259 
    260 	return 0;
    261 }
    262 
    263 static int
    264 lastbind_db_close(
    265 	BackendDB *be,
    266 	ConfigReply *cr
    267 )
    268 {
    269 	slap_overinst *on = (slap_overinst *) be->bd_info;
    270 	lastbind_info *lbi = (lastbind_info *) on->on_bi.bi_private;
    271 
    272 	/* free private structure to store configuration */
    273 	free( lbi );
    274 
    275 	return 0;
    276 }
    277 
    278 static slap_overinst lastbind;
    279 
    280 int lastbind_initialize()
    281 {
    282 	int i, code;
    283 
    284 	/* register operational schema for this overlay (authTimestamp attribute) */
    285 	for (i=0; lastBind_OpSchema[i].def; i++) {
    286 		code = register_at( lastBind_OpSchema[i].def, lastBind_OpSchema[i].ad, 0 );
    287 		if ( code ) {
    288 			Debug( LDAP_DEBUG_ANY,
    289 				"lastbind_initialize: register_at failed\n" );
    290 			return code;
    291 		}
    292 	}
    293 
    294 	ad_authTimestamp->ad_type->sat_flags |= SLAP_AT_MANAGEABLE;
    295 
    296 	lastbind.on_bi.bi_type = "lastbind";
    297 	lastbind.on_bi.bi_flags = SLAPO_BFLAG_SINGLE;
    298 	lastbind.on_bi.bi_db_init = lastbind_db_init;
    299 	lastbind.on_bi.bi_db_close = lastbind_db_close;
    300 	lastbind.on_bi.bi_op_bind = lastbind_bind;
    301 
    302 	/* register configuration directives */
    303 	lastbind.on_bi.bi_cf_ocs = lastbindocs;
    304 	code = config_register_schema( lastbindcfg, lastbindocs );
    305 	if ( code ) return code;
    306 
    307 	return overlay_register( &lastbind );
    308 }
    309 
    310 #if SLAPD_OVER_LASTBIND == SLAPD_MOD_DYNAMIC
    311 int init_module(int argc, char *argv[]) {
    312 	return lastbind_initialize();
    313 }
    314 #endif
    315 
    316 #endif	/* defined(SLAPD_OVER_LASTBIND) */
    317