|
259
|
1 /* LDAP client interface for XEmacs.
|
|
265
|
2 Copyright (C) 1998 Free Software Foundation, Inc.
|
|
259
|
3
|
|
|
4 This file is part of XEmacs.
|
|
|
5
|
|
|
6 XEmacs is free software; you can redistribute it and/or modify it
|
|
|
7 under the terms of the GNU General Public License as published by the
|
|
|
8 Free Software Foundation; either version 2, or (at your option) any
|
|
|
9 later version.
|
|
|
10
|
|
|
11 XEmacs is distributed in the hope that it will be useful, but WITHOUT
|
|
|
12 ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
|
13 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
|
14 for more details.
|
|
|
15
|
|
|
16 You should have received a copy of the GNU General Public License
|
|
|
17 along with XEmacs; see the file COPYING. If not, write to
|
|
|
18 the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
|
|
|
19 Boston, MA 02111-1307, USA. */
|
|
|
20
|
|
|
21 /* Synched up with: Not in FSF. */
|
|
|
22
|
|
|
23 /* Author: Oscar Figueiredo */
|
|
|
24
|
|
|
25 /* This file provides lisp primitives for access to an LDAP library
|
|
|
26 conforming to the API defined in RFC 1823.
|
|
|
27 It has been tested with:
|
|
|
28 - UMich LDAP 3.3 (http://www.umich.edu/~dirsvcs/ldap/)
|
|
|
29 - Netscape's LDAP SDK 1.0 (http://developer.netscape.com) */
|
|
|
30
|
|
|
31
|
|
|
32
|
|
|
33 #include <config.h>
|
|
|
34
|
|
|
35 #if defined (HAVE_LDAP)
|
|
|
36
|
|
|
37 /* The entire file is within this conditional */
|
|
|
38
|
|
|
39 #include "lisp.h"
|
|
|
40
|
|
265
|
41 #include <errno.h>
|
|
|
42
|
|
259
|
43 #include "eldap.h"
|
|
|
44 #include <lber.h>
|
|
|
45 #include <ldap.h>
|
|
|
46
|
|
|
47 #ifdef HAVE_NS_LDAP
|
|
|
48 #define HAVE_LDAP_SET_OPTION 1
|
|
|
49 #define HAVE_LDAP_GET_ERRNO 1
|
|
|
50 #else
|
|
|
51 #undef HAVE_LDAP_SET_OPTION
|
|
|
52 #undef HAVE_LDAP_GET_ERRNO
|
|
|
53 #endif
|
|
|
54
|
|
|
55 static Lisp_Object Vldap_default_base;
|
|
|
56 static Lisp_Object Vldap_default_host;
|
|
|
57
|
|
|
58 /* ldap-search-internal plist keywords */
|
|
|
59 static Lisp_Object Qhost, Qfilter, Qattributes, Qattrsonly, Qbase, Qscope,
|
|
|
60 Qauth, Qbinddn, Qpasswd, Qderef, Qtimelimit, Qsizelimit;
|
|
|
61 /* Search scope limits */
|
|
|
62 static Lisp_Object Qbase, Qonelevel, Qsubtree;
|
|
|
63 /* Authentication methods */
|
|
|
64 #ifdef LDAP_AUTH_KRBV41
|
|
|
65 static Lisp_Object Qkrbv41;
|
|
|
66 #endif
|
|
|
67 #ifdef LDAP_AUTH_KRBV42
|
|
|
68 static Lisp_Object Qkrbv42;
|
|
|
69 #endif
|
|
|
70 /* Deref policy */
|
|
261
|
71 static Lisp_Object Qnever, Qalways, Qfind;
|
|
259
|
72
|
|
|
73 DEFUN ("ldap-search-internal", Fldap_search_internal, 1, 1, 0, /*
|
|
|
74 Perform a search on a LDAP server.
|
|
|
75 SEARCH-PLIST is a property list describing the search request.
|
|
|
76 Valid keys in that list are:
|
|
|
77 `host' is a string naming one or more (blank separated) LDAP servers to
|
|
|
78 to try to connect to. Each host name may optionally be of the form host:port.
|
|
|
79 `filter' is a filter string for the search as described in RFC 1558
|
|
|
80 `attributes' is a list of strings indicating which attributes to retrieve
|
|
|
81 for each matching entry. If nil return all available attributes.
|
|
|
82 `attrsonly' if non-nil indicates that only the attributes are retrieved, not
|
|
|
83 the associated values.
|
|
|
84 `base' is the base for the search as described in RFC 1779.
|
|
|
85 `scope' is one of the three symbols `subtree', `base' or `onelevel'.
|
|
|
86 `auth' is the authentication method to use, possible values depend on
|
|
|
87 the LDAP library XEmacs was compiled with: `simple', `krbv41' and `krbv42'.
|
|
|
88 `binddn' is the distinguished name of the user to bind as (in RFC 1779 syntax).
|
|
|
89 `passwd' is the password to use for simple authentication.
|
|
|
90 `deref' is one of the symbols `never', `always', `search' or `find'.
|
|
|
91 `timelimit' is the timeout limit for the connection in seconds.
|
|
|
92 `sizelimit' is the maximum number of matches to return.
|
|
|
93 The function returns a list of matching entries. Each entry is itself
|
|
|
94 an alist of attribute/values.
|
|
|
95 */
|
|
|
96 (search_plist))
|
|
|
97 {
|
|
|
98 /* This function calls lisp */
|
|
|
99
|
|
|
100 /* Vars for query */
|
|
|
101 LDAP *ld;
|
|
|
102 LDAPMessage *res, *e;
|
|
|
103 BerElement *ptr;
|
|
|
104 char *a;
|
|
|
105 int i, rc, err;
|
|
|
106
|
|
|
107 char *ldap_host = NULL;
|
|
|
108 char *ldap_filter = NULL;
|
|
|
109 char **ldap_attributes = NULL;
|
|
|
110 int ldap_attrsonly = 0;
|
|
|
111 char *ldap_base = NULL;
|
|
|
112 int ldap_scope = LDAP_SCOPE_SUBTREE;
|
|
|
113 int ldap_auth = LDAP_AUTH_SIMPLE;
|
|
|
114 char *ldap_binddn = NULL;
|
|
|
115 char *ldap_passwd = NULL;
|
|
|
116 int ldap_deref = LDAP_DEREF_NEVER;
|
|
|
117 int ldap_timelimit = 0;
|
|
|
118 int ldap_sizelimit = 0;
|
|
|
119
|
|
|
120 char **vals = NULL;
|
|
|
121 int matches;
|
|
|
122
|
|
|
123 Lisp_Object list, entry, result, keyword, value;
|
|
|
124 struct gcpro gcpro1, gcpro2, gcpro3, gcpro4, gcpro5;
|
|
|
125
|
|
|
126 list = entry = result = keyword = value = Qnil;
|
|
|
127 GCPRO5 (list, entry, result, keyword, value);
|
|
|
128
|
|
|
129
|
|
|
130 EXTERNAL_PROPERTY_LIST_LOOP(list, keyword, value, search_plist)
|
|
|
131 {
|
|
|
132 /* Host */
|
|
|
133 if (EQ (keyword, Qhost))
|
|
|
134 {
|
|
|
135 CHECK_STRING (value);
|
|
|
136 ldap_host = alloca (XSTRING_LENGTH (value) + 1);
|
|
|
137 strcpy (ldap_host, (char *)XSTRING_DATA (value));
|
|
|
138 }
|
|
|
139 /* Filter */
|
|
|
140 else if (EQ (keyword, Qfilter))
|
|
|
141 {
|
|
|
142 CHECK_STRING (value);
|
|
|
143 ldap_filter = alloca (XSTRING_LENGTH (value) + 1);
|
|
|
144 strcpy (ldap_filter, (char *)XSTRING_DATA (value));
|
|
|
145 }
|
|
|
146 /* Attributes */
|
|
|
147 else if (EQ (keyword, Qattributes))
|
|
|
148 {
|
|
|
149 if (! NILP (value))
|
|
|
150 {
|
|
|
151 Lisp_Object attr_left = value;
|
|
|
152 struct gcpro ngcpro1;
|
|
|
153
|
|
|
154 NGCPRO1 (attr_left);
|
|
|
155 CHECK_CONS (value);
|
|
|
156
|
|
|
157 ldap_attributes = alloca ((XINT (Flength (value)) + 1)*sizeof (char *));
|
|
|
158
|
|
|
159 for (i=0; !NILP (attr_left); i++) {
|
|
|
160 CHECK_STRING (XCAR (attr_left));
|
|
|
161 ldap_attributes[i] = alloca (XSTRING_LENGTH (XCAR (attr_left)) + 1);
|
|
|
162 strcpy(ldap_attributes[i],
|
|
|
163 (char *)(XSTRING_DATA( XCAR (attr_left))));
|
|
|
164 attr_left = XCDR (attr_left);
|
|
|
165 }
|
|
|
166 ldap_attributes[i] = NULL;
|
|
|
167 NUNGCPRO;
|
|
|
168 }
|
|
|
169 }
|
|
|
170 /* Attributes Only */
|
|
|
171 else if (EQ (keyword, Qattrsonly))
|
|
|
172 {
|
|
|
173 CHECK_SYMBOL (value);
|
|
|
174 ldap_attrsonly = NILP (value) ? 0 : 1;
|
|
|
175 }
|
|
|
176 /* Base */
|
|
|
177 else if (EQ (keyword, Qbase))
|
|
|
178 {
|
|
|
179 if (!NILP (value))
|
|
|
180 {
|
|
|
181 CHECK_STRING (value);
|
|
|
182 ldap_base = alloca (XSTRING_LENGTH (value) + 1);
|
|
|
183 strcpy (ldap_base, (char *)XSTRING_DATA (value));
|
|
|
184 }
|
|
|
185 }
|
|
|
186 /* Scope */
|
|
|
187 else if (EQ (keyword, Qscope))
|
|
|
188 {
|
|
|
189 CHECK_SYMBOL (value);
|
|
|
190
|
|
|
191 if (EQ (value, Qbase))
|
|
|
192 ldap_scope = LDAP_SCOPE_BASE;
|
|
|
193 else if (EQ (value, Qonelevel))
|
|
|
194 ldap_scope = LDAP_SCOPE_ONELEVEL;
|
|
|
195 else if (EQ (value, Qsubtree))
|
|
|
196 ldap_scope = LDAP_SCOPE_SUBTREE;
|
|
|
197 else
|
|
|
198 signal_simple_error ("Invalid scope", value);
|
|
|
199 }
|
|
|
200 /* Authentication method */
|
|
|
201 else if (EQ (keyword, Qauth))
|
|
|
202 {
|
|
|
203 CHECK_SYMBOL (value);
|
|
|
204
|
|
|
205 if (EQ (value, Qsimple))
|
|
|
206 ldap_auth = LDAP_AUTH_SIMPLE;
|
|
|
207 #ifdef LDAP_AUTH_KRBV41
|
|
|
208 else if (EQ (value, Qkrbv41))
|
|
|
209 ldap_auth = LDAP_AUTH_KRBV41;
|
|
|
210 #endif
|
|
|
211 #ifdef LDAP_AUTH_KRBV42
|
|
|
212 else if (EQ (value, Qkrbv42))
|
|
|
213 ldap_auth = LDAP_AUTH_KRBV42;
|
|
|
214 #endif
|
|
|
215 else
|
|
|
216 signal_simple_error ("Invalid authentication method", value);
|
|
|
217 }
|
|
|
218 /* Bind DN */
|
|
|
219 else if (EQ (keyword, Qbinddn))
|
|
|
220 {
|
|
|
221 if (!NILP (value))
|
|
|
222 {
|
|
|
223 CHECK_STRING (value);
|
|
|
224 ldap_binddn = alloca (XSTRING_LENGTH (value) + 1);
|
|
|
225 strcpy (ldap_binddn, (char *)XSTRING_DATA (value));
|
|
|
226 }
|
|
|
227 }
|
|
|
228 /* Password */
|
|
|
229 else if (EQ (keyword, Qpasswd))
|
|
|
230 {
|
|
|
231 if (!NILP (value))
|
|
|
232 {
|
|
|
233 CHECK_STRING (value);
|
|
|
234 ldap_passwd = alloca (XSTRING_LENGTH (value) + 1);
|
|
|
235 strcpy (ldap_passwd, (char *)XSTRING_DATA (value));
|
|
|
236 }
|
|
|
237 }
|
|
|
238 /* Deref */
|
|
|
239 else if (EQ (keyword, Qderef))
|
|
|
240 {
|
|
|
241 CHECK_SYMBOL (value);
|
|
|
242 if (EQ (value, Qnever))
|
|
|
243 ldap_deref = LDAP_DEREF_NEVER;
|
|
|
244 else if (EQ (value, Qsearch))
|
|
|
245 ldap_deref = LDAP_DEREF_SEARCHING;
|
|
|
246 else if (EQ (value, Qfind))
|
|
|
247 ldap_deref = LDAP_DEREF_FINDING;
|
|
|
248 else if (EQ (value, Qalways))
|
|
|
249 ldap_deref = LDAP_DEREF_ALWAYS;
|
|
|
250 else
|
|
|
251 signal_simple_error ("Invalid deref value", value);
|
|
|
252 }
|
|
|
253 /* Timelimit */
|
|
|
254 else if (EQ (keyword, Qtimelimit))
|
|
|
255 {
|
|
|
256 if (!NILP (value))
|
|
|
257 {
|
|
|
258 CHECK_INT (value);
|
|
|
259 ldap_timelimit = XINT (value);
|
|
|
260 }
|
|
|
261 }
|
|
|
262 /* Sizelimit */
|
|
|
263 else if (EQ (keyword, Qsizelimit))
|
|
|
264 {
|
|
|
265 if (!NILP (value))
|
|
|
266 {
|
|
|
267 CHECK_INT (value);
|
|
|
268 ldap_sizelimit = XINT (value);
|
|
|
269 }
|
|
|
270 }
|
|
|
271 }
|
|
|
272
|
|
|
273 /* Use ldap-default-base if no default base was given */
|
|
|
274 if (ldap_base == NULL && !NILP (Vldap_default_base))
|
|
|
275 {
|
|
|
276 CHECK_STRING (Vldap_default_base);
|
|
|
277 ldap_base = alloca (XSTRING_LENGTH (Vldap_default_base) + 1);
|
|
|
278 strcpy (ldap_base, (char *)XSTRING_DATA (Vldap_default_base));
|
|
|
279 }
|
|
|
280
|
|
|
281 /* Use ldap-default-host if no host was given */
|
|
|
282 if (ldap_host == NULL && !NILP (Vldap_default_host))
|
|
|
283 {
|
|
|
284 CHECK_STRING (Vldap_default_host);
|
|
|
285 ldap_host = alloca (XSTRING_LENGTH (Vldap_default_host) + 1);
|
|
|
286 strcpy (ldap_host, (char *)XSTRING_DATA (Vldap_default_host));
|
|
|
287 }
|
|
|
288
|
|
|
289 if (ldap_filter == NULL)
|
|
|
290 error ("Empty search filter");
|
|
|
291
|
|
|
292 /* Garbage collect before connecting (if using UMich lib).
|
|
|
293 This is ugly, I know, but without this, the UMich LDAP library 3.3
|
|
|
294 frequently reports "Can't contact LDAP server". I really need to
|
|
|
295 check what happens inside that lib. Anyway this should be harmless to
|
|
|
296 XEmacs and makes things work. */
|
|
|
297 #if defined (HAVE_UMICH_LDAP)
|
|
265
|
298 garbage_collect_1 ();
|
|
259
|
299 #endif
|
|
|
300
|
|
|
301 /* Connect to the server and bind */
|
|
|
302 message ("Connecting to %s...", ldap_host);
|
|
|
303 if ( (ld = ldap_open (ldap_host, LDAP_PORT)) == NULL )
|
|
265
|
304 signal_simple_error_2 ("Failed connecting to host",
|
|
|
305 build_string (ldap_host),
|
|
|
306 lisp_strerror (errno));
|
|
259
|
307
|
|
|
308 #if HAVE_LDAP_SET_OPTION
|
|
|
309 if (ldap_set_option (ld, LDAP_OPT_DEREF, (void *)&ldap_deref) != LDAP_SUCCESS)
|
|
|
310 error ("Failed to set deref option");
|
|
|
311 if (ldap_set_option (ld, LDAP_OPT_TIMELIMIT, (void *)&ldap_timelimit) != LDAP_SUCCESS)
|
|
|
312 error ("Failed to set timelimit option");
|
|
|
313 if (ldap_set_option (ld, LDAP_OPT_SIZELIMIT, (void *)&ldap_sizelimit) != LDAP_SUCCESS)
|
|
|
314 error ("Failed to set sizelimit option");
|
|
|
315 if (ldap_set_option (ld, LDAP_OPT_REFERRALS, LDAP_OPT_ON) != LDAP_SUCCESS)
|
|
|
316 error ("Failed to set referral option");
|
|
|
317 #else /* HAVE_LDAP_SET_OPTION */
|
|
|
318 ld->ld_deref = ldap_deref;
|
|
|
319 ld->ld_timelimit = ldap_timelimit;
|
|
|
320 ld->ld_sizelimit = ldap_sizelimit;
|
|
|
321 #ifdef LDAP_REFERRALS
|
|
|
322 ld->ld_options = LDAP_OPT_REFERRALS;
|
|
|
323 #else /* LDAP_REFERRALS */
|
|
|
324 ld->ld_options = 0;
|
|
|
325 #endif /* LDAP_REFERRALS */
|
|
|
326 #endif /* HAVE_LDAP_SET_OPTION */
|
|
|
327
|
|
|
328 message ("Binding to %s...", ldap_host);
|
|
|
329 if ( (err = (ldap_bind_s (ld, ldap_binddn, ldap_passwd, ldap_auth ))) != LDAP_SUCCESS )
|
|
|
330 signal_simple_error ("Failed binding to the server",
|
|
|
331 build_string (ldap_err2string (err)));
|
|
|
332
|
|
|
333 /* Perform the search */
|
|
|
334 message ("Searching with LDAP on %s...", ldap_host);
|
|
|
335 if ( ldap_search (ld, ldap_base, ldap_scope, ldap_filter,
|
|
|
336 ldap_attributes, ldap_attrsonly) == -1)
|
|
|
337 {
|
|
|
338 ldap_unbind (ld);
|
|
|
339 #if HAVE_LDAP_GET_ERRNO
|
|
|
340 signal_simple_error ("Error during LDAP search",
|
|
|
341 build_string (ldap_err2string (ldap_get_lderrno (ld, NULL, NULL))));
|
|
|
342 #else
|
|
|
343 signal_simple_error ("Error during LDAP search",
|
|
|
344 build_string (ldap_err2string (ld->ld_errno)));
|
|
|
345 #endif
|
|
|
346 }
|
|
|
347
|
|
|
348 /* Build the results list */
|
|
|
349 matches = 0;
|
|
|
350
|
|
|
351 while ( (rc = ldap_result (ld, LDAP_RES_ANY, 0, NULL, &res))
|
|
|
352 == LDAP_RES_SEARCH_ENTRY )
|
|
|
353 {
|
|
|
354 matches ++;
|
|
|
355 e = ldap_first_entry (ld, res);
|
|
|
356 message ("Parsing results... %d", matches);
|
|
|
357 entry = Qnil;
|
|
|
358 for (a= ldap_first_attribute (ld, e, &ptr);
|
|
|
359 a != NULL;
|
|
|
360 a= ldap_next_attribute (ld, e, ptr) )
|
|
|
361 {
|
|
|
362 list = Fcons (build_string (a), Qnil);
|
|
|
363 vals = ldap_get_values (ld, e, a);
|
|
|
364 if (vals != NULL)
|
|
|
365 {
|
|
|
366 for (i=0; vals[i]!=NULL; i++)
|
|
|
367 {
|
|
|
368 list = Fcons (build_string (vals[i]),
|
|
|
369 list);
|
|
|
370 }
|
|
|
371 }
|
|
|
372 entry = Fcons (Fnreverse (list),
|
|
|
373 entry);
|
|
|
374 ldap_value_free (vals);
|
|
|
375 }
|
|
|
376 result = Fcons (Fnreverse (entry),
|
|
|
377 result);
|
|
|
378 ldap_msgfree (res);
|
|
|
379 }
|
|
|
380
|
|
|
381 if (rc == -1)
|
|
|
382 {
|
|
|
383 #if HAVE_LDAP_GET_ERRNO
|
|
|
384 signal_simple_error ("Error retrieving result",
|
|
|
385 build_string (ldap_err2string (ldap_get_lderrno (ld, NULL, NULL))));
|
|
|
386 #else
|
|
|
387 signal_simple_error ("Error retrieving result",
|
|
|
388 build_string (ldap_err2string (ld->ld_errno)));
|
|
|
389 #endif
|
|
|
390 }
|
|
|
391
|
|
|
392 if ((rc = ldap_result2error (ld, res, 0)) != LDAP_SUCCESS)
|
|
|
393 {
|
|
|
394 #if HAVE_LDAP_GET_ERRNO
|
|
|
395 signal_simple_error ("Error on result",
|
|
|
396 build_string (ldap_err2string (ldap_get_lderrno (ld, NULL, NULL))));
|
|
|
397 #else
|
|
|
398 signal_simple_error ("Error on result",
|
|
|
399 build_string (ldap_err2string (ld->ld_errno)));
|
|
|
400 #endif
|
|
|
401 }
|
|
|
402
|
|
|
403 ldap_msgfree (res);
|
|
|
404 ldap_unbind (ld);
|
|
|
405 message ("Done.");
|
|
|
406
|
|
|
407 result = Fnreverse (result);
|
|
|
408 clear_message ();
|
|
|
409
|
|
|
410 UNGCPRO;
|
|
|
411 return result;
|
|
|
412 }
|
|
|
413
|
|
|
414
|
|
|
415 void
|
|
|
416 syms_of_eldap (void)
|
|
|
417 {
|
|
|
418 DEFSUBR(Fldap_search_internal);
|
|
|
419
|
|
|
420 defsymbol (&Qhost, "host");
|
|
|
421 defsymbol (&Qfilter, "filter");
|
|
|
422 defsymbol (&Qattributes, "attributes");
|
|
|
423 defsymbol (&Qattrsonly, "attrsonly");
|
|
|
424 defsymbol (&Qbase, "base");
|
|
|
425 defsymbol (&Qscope, "scope");
|
|
|
426 defsymbol (&Qauth, "auth");
|
|
|
427 defsymbol (&Qbinddn, "binddn");
|
|
|
428 defsymbol (&Qpasswd, "passwd");
|
|
|
429 defsymbol (&Qderef, "deref");
|
|
|
430 defsymbol (&Qtimelimit, "timelimit");
|
|
|
431 defsymbol (&Qsizelimit, "sizelimit");
|
|
|
432 defsymbol (&Qbase, "base");
|
|
|
433 defsymbol (&Qonelevel, "onelevel");
|
|
|
434 defsymbol (&Qsubtree, "subtree");
|
|
|
435 #ifdef LDAP_AUTH_KRBV41
|
|
|
436 defsymbol (&Qkrbv41, "krbv41");
|
|
|
437 #endif
|
|
|
438 #ifdef LDAP_AUTH_KRBV42
|
|
|
439 defsymbol (&Qkrbv42, "krbv42");
|
|
|
440 #endif
|
|
|
441 defsymbol (&Qnever, "never");
|
|
|
442 defsymbol (&Qalways, "always");
|
|
|
443 defsymbol (&Qfind, "find");
|
|
|
444 }
|
|
|
445
|
|
|
446 void
|
|
|
447 vars_of_eldap (void)
|
|
|
448 {
|
|
|
449 Fprovide (intern ("ldap-internal"));
|
|
|
450
|
|
|
451 DEFVAR_LISP ("ldap-default-host", &Vldap_default_host /*
|
|
|
452 Default LDAP host.
|
|
|
453 */ );
|
|
|
454
|
|
|
455 DEFVAR_LISP ("ldap-default-base", &Vldap_default_base /*
|
|
|
456 Default base for LDAP searches.
|
|
|
457 This is a string using the syntax of RFC 1779.
|
|
|
458 For instance, "o=ACME, c=US" limits the search to the
|
|
|
459 Acme organization in the United States.
|
|
|
460 */ );
|
|
|
461
|
|
|
462 Vldap_default_host = Qnil;
|
|
|
463 Vldap_default_base = Qnil;
|
|
|
464 }
|
|
|
465
|
|
|
466 #endif /* HAVE_LDAP */
|
