byterazor/qpsmtpd
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

auth_ldap: added logging

Browse Source 
whitespace changes (stinkin windows newline chars)
This commit is contained in:
Matt Simerson 2012-05-07 03:32:16 -04:00 committed by Robert
parent 35f26c23bb
commit 319391affe
1 changed files with 115 additions and 110 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

225
plugins/auth/auth_ldap_bind
View File

@ -78,115 +78,120 @@ Please see the LICENSE file included with qpsmtpd for details.
=cut =cut
use strict;
use warnings;
sub register { use Net::LDAP qw(:all);
my ( $self, $qp, @args ) = @_; use Qpsmtpd::Constants;
$self->register_hook( "auth-plain", "authldap" );
$self->register_hook( "auth-login", "authldap" ); sub register {
my ($self, $qp, @args) = @_;
# pull config defaults in from file
%{ $self->{"ldconf"} } = map { (split /\s+/, $_, 2)[0,1] } $self->qp->config('ldap'); $self->register_hook("auth-plain", "authldap");
$self->register_hook("auth-login", "authldap");
# override ldap config defaults with plugin args
for my $ldap_arg (@args) { # pull config defaults in from file
%{ $self->{"ldconf"} } = map { (split /\s+/, $_, 2)[0,1] } $ldap_arg; %{$self->{"ldconf"}} =
} map { (split /\s+/, $_, 2)[0, 1] } $self->qp->config('ldap');
# do light validation of ldap_host and ldap_port to satisfy -T # override ldap config defaults with plugin args
my $ldhost = $self->{"ldconf"}->{'ldap_host'}; for my $ldap_arg (@args) {
my $ldport = $self->{"ldconf"}->{'ldap_port'}; %{$self->{"ldconf"}} = map { (split /\s+/, $_, 2)[0, 1] } $ldap_arg;
if (($ldhost) && ($ldhost =~ m/^(([a-z0-9]+\.?)+)$/)) { }
$self->{"ldconf"}->{'ldap_host'} = $1
} else { # do light validation of ldap_host and ldap_port to satisfy -T
undef $self->{"ldconf"}->{'ldap_host'}; my $ldhost = $self->{"ldconf"}->{'ldap_host'};
} my $ldport = $self->{"ldconf"}->{'ldap_port'};
if (($ldport) && ($ldport =~ m/^(\d+)$/)) { if (($ldhost) && ($ldhost =~ m/^(([a-z0-9]+\.?)+)$/)) {
$self->{"ldconf"}->{'ldap_port'} = $1 $self->{"ldconf"}->{'ldap_host'} = $1;
} else { }
undef $self->{"ldconf"}->{'ldap_port'}; else {
} undef $self->{"ldconf"}->{'ldap_host'};
}
# set any values that are not already if (($ldport) && ($ldport =~ m/^(\d+)$/)) {
$self->{"ldconf"}->{"ldap_host"} ||= "127.0.0.1"; $self->{"ldconf"}->{'ldap_port'} = $1;
$self->{"ldconf"}->{"ldap_port"} ||= 389; }
$self->{"ldconf"}->{"ldap_timeout"} ||= 5; else {
$self->{"ldconf"}->{"ldap_auth_filter_attr"} ||= "uid"; undef $self->{"ldconf"}->{'ldap_port'};
} }
sub authldap { # set any values that are not already
use Net::LDAP qw(:all); $self->{"ldconf"}->{"ldap_host"} ||= "127.0.0.1";
use Qpsmtpd::Constants; $self->{"ldconf"}->{"ldap_port"} ||= 389;
$self->{"ldconf"}->{"ldap_timeout"} ||= 5;
my ( $self, $transaction, $method, $user, $passClear, $passHash, $ticket ) = $self->{"ldconf"}->{"ldap_auth_filter_attr"} ||= "uid";
@_; }
my ($ldhost, $ldport, $ldwait, $ldbase, $ldmattr, $lduserdn, $ldh, $mesg);
sub authldap {
# pull values in from config my ($self, $transaction, $method, $user, $passClear, $passHash, $ticket) =
$ldhost = $self->{"ldconf"}->{"ldap_host"}; @_;
$ldport = $self->{"ldconf"}->{"ldap_port"}; my ($ldhost, $ldport, $ldwait, $ldbase, $ldmattr, $lduserdn, $ldh, $mesg);
$ldbase = $self->{"ldconf"}->{"ldap_base"};
# pull values in from config
# log error here and DECLINE if no baseDN, because a custom baseDN is required: $ldhost = $self->{"ldconf"}->{"ldap_host"};
unless ($ldbase) { $ldport = $self->{"ldconf"}->{"ldap_port"};
$self->log(LOGERROR, "authldap/$method - please configure ldap_base" ) && $ldbase = $self->{"ldconf"}->{"ldap_base"};
return ( DECLINED, "authldap/$method - temporary auth error" );
} # log error here and DECLINE if no baseDN, because a custom baseDN is required:
$ldwait = $self->{"ldconf"}->{'ldap_timeout'}; unless ($ldbase) {
$ldmattr = $self->{"ldconf"}->{'ldap_auth_filter_attr'}; $self->log(LOGERROR, "skip: please configure ldap_base");
return (DECLINED, "authldap - temporary auth error");
my ( $pw_name, $pw_domain ) = split "@", lc($user); };
$ldwait = $self->{"ldconf"}->{'ldap_timeout'};
# find dn of user matching supplied username $ldmattr = $self->{"ldconf"}->{'ldap_auth_filter_attr'};
$ldh = Net::LDAP->new($ldhost, port=>$ldport, timeout=>$ldwait ) or
$self->log(LOGALERT, "authldap/$method - error in initial conn" ) && my ($pw_name, $pw_domain) = split "@", lc($user);
return ( DECLINED, "authldap/$method - temporary auth error" );
# find dn of user matching supplied username
# find the user's DN $ldh = Net::LDAP->new($ldhost, port => $ldport, timeout => $ldwait) or do {
$mesg = $ldh->search( $self->log(LOGALERT, "skip: error in initial conn");
base=>$ldbase, return (DECLINED, "authldap - temporary auth error");
scope=>'sub', };
filter=>"$ldmattr=$pw_name",
attrs=>['uid'], # find the user's DN
timeout=>$ldwait, $mesg = $ldh->search( base => $ldbase,
sizelimit=>'1') or scope => 'sub',
$self->log(LOGALERT, "authldap/$method - err in search for user" ) && filter => "$ldmattr=$pw_name",
return ( DECLINED, "authldap/$method - temporary auth error" ); attrs => ['uid'],
timeout => $ldwait,
# deal with errors if they exist sizelimit => '1'
if ( $mesg->code ) { ) or do {
$self->log(LOGALERT, "authldap/$method - err " . $mesg->code . " in search for user" ); $self->log(LOGALERT, "skip: err in search for user");
return ( DECLINED, "authldap/$method - temporary auth error" ); return (DECLINED, "authldap - temporary auth error");
} };
# unbind, so as to allow a rebind below # deal with errors if they exist
$ldh->unbind if ($ldh); if ($mesg->code) {
$self->log(LOGALERT, "skip: err " . $mesg->code . " in search for user");
# bind against directory as user with password supplied return (DECLINED, "authldap - temporary auth error");
if (($mesg->count) && ($lduserdn = $mesg->entry->dn)) { }
$ldh = Net::LDAP->new($ldhost, port=>$ldport, timeout=>$ldwait ) or
$self->log(LOGALERT, "authldap/$method - err in user conn" ) && # unbind, so as to allow a rebind below
return ( DECLINED, "authldap/$method - temporary auth error" ); $ldh->unbind if $ldh;
# here's the whole reason for the script # bind against directory as user with password supplied
$mesg = $ldh->bind($lduserdn, password=>$passClear, timeout=>$ldwait); if ( ! $mesg->count || $lduserdn = $mesg->entry->dn ) {
$ldh->unbind if ($ldh); $self->log(LOGALERT, "fail: user not found");
return (DECLINED, "authldap - wrong username or password");
# deal with errors if they exist, or allow success };
if ( $mesg->code ) {
$self->log(LOGALERT, "authldap/$method - error in user bind" ); $ldh = Net::LDAP->new($ldhost, port => $ldport, timeout => $ldwait) or do {
return ( DECLINED, "authldap/$method - wrong username or password" ); $self->log(LOGALERT, "skip: err in user conn");
} else { return (DECLINED, "authldap - temporary auth error");
$self->log( LOGINFO, "authldap/$method - $user auth success" ); };
$self->log( LOGDEBUG, "authldap/$method - user: $user, pass: $passClear" );
return ( OK, "authldap/$method" ); # here's the whole reason for the script
} $mesg = $ldh->bind($lduserdn, password => $passClear, timeout => $ldwait);
$ldh->unbind if $ldh;
# if the plugin couldn't find user's entry
} else { # deal with errors if they exist, or allow success
$self->log(LOGALERT, "authldap/$method - user not found" ) && if ($mesg->code) {
return ( DECLINED, "authldap/$method - wrong username or password" ); $self->log(LOGALERT, "fail: error in user bind");
} return (DECLINED, "authldap - wrong username or password");
}
$ldh->disconnect;
} $self->log(LOGINFO, "pass: $user auth success");
$self->log(LOGDEBUG, "user: $user, pass: $passClear");
return (OK, "authldap");
}