[0001]
[0002]
[0003]
[0004]
[0005]
[0006]
[0007]
[0008]
[0009]
[0010]
[0011]
[0012]
[0013]
[0014]
[0015]
[0016]
[0017]
[0018]
[0019]
[0020]
[0021]
[0022]
[0023]
[0024]
[0025]
[0026]
[0027]
[0028]
[0029]
[0030]
[0031]
[0032]
[0033]
[0034]
[0035]
[0036]
[0037]
[0038]
[0039]
[0040]
[0041]
[0042]
[0043]
[0044]
[0045]
[0046]
[0047]
[0048]
[0049]
[0050]
[0051]
[0052]
[0053]
[0054]
[0055]
[0056]
[0057]
[0058]
[0059]
[0060]
[0061]
[0062]
[0063]
[0064]
[0065]
[0066]
[0067]
[0068]
[0069]
[0070]
[0071]
[0072]
[0073]
[0074]
[0075]
[0076]
[0077]
[0078]
[0079]
[0080]
[0081]
[0082]
[0083]
[0084]
[0085]
[0086]
[0087]
[0088]
[0089]
[0090]
[0091]
[0092]
[0093]
[0094]
[0095]
[0096]
[0097]
[0098]
[0099]
[0100]
[0101]
[0102]
[0103]
[0104]
[0105]
[0106]
[0107]
[0108]
[0109]
[0110]
[0111]
[0112]
[0113]
[0114]
[0115]
[0116]
[0117]
[0118]
[0119]
[0120]
[0121]
[0122]
[0123]
[0124]
[0125]
[0126]
[0127]
[0128]
[0129]
[0130]
[0131]
[0132]
[0133]
[0134]
[0135]
[0136]
[0137]
[0138]
[0139]
[0140]
[0141]
[0142]
[0143]
[0144]
[0145]
[0146]
[0147]
[0148]
[0149]
[0150]
[0151]
[0152]
[0153]
[0154]
[0155]
[0156]
[0157]
[0158]
[0159]
[0160]
[0161]
[0162]
[0163]
[0164]
[0165]
[0166]
[0167]
[0168]
[0169]
[0170]
[0171]
[0172]
[0173]
[0174]
[0175]
[0176]
[0177]
[0178]
[0179]
[0180]
[0181]
[0182]
[0183]
[0184]
[0185]
[0186]
[0187]
[0188]
[0189]
[0190]
[0191]
[0192]
[0193]
[0194]
[0195]
[0196]
[0197]
[0198]
[0199]
[0200]
[0201]
[0202]
[0203]
[0204]
[0205]
[0206]
[0207]
[0208]
[0209]
[0210]
[0211]
[0212]
[0213]
[0214]
[0215]
[0216]
[0217]
[0218]
[0219]
[0220]
[0221]
[0222]
[0223]
[0224]
[0225]
[0226]
[0227]
[0228]
[0229]
[0230]
[0231]
[0232]
[0233]
[0234]
[0235]
[0236]
[0237]
[0238]
[0239]
[0240]
[0241]
[0242]
[0243]
[0244]
[0245]
[0246]
[0247]
[0248]
[0249]
[0250]
[0251]
[0252]
[0253]
[0254]
[0255]
[0256]
[0257]
[0258]
[0259]
[0260]
[0261]
[0262]
[0263]
[0264]
[0265]
[0266]
[0267]
[0268]
[0269]
[0270]
[0271]
[0272]
[0273]
[0274]
[0275]
[0276]
[0277]
[0278]
[0279]
[0280]
[0281]
[0282]
[0283]
[0284]
[0285]
[0286]
[0287]
[0288]
[0289]
[0290]
[0291]
[0292]
[0293]
[0294]
[0295]
[0296]
[0297]
[0298]
[0299]
[0300]
[0301]
[0302]
[0303]
[0304]
[0305]
[0306]
[0307]
[0308]
[0309]
[0310]
[0311]
[0312]
[0313]
[0314]
[0315]
[0316]
[0317]
[0318]
[0319]
[0320]
[0321]
[0322]
[0323]
[0324]
[0325]
[0326]
[0327]
[0328]
[0329]
[0330]
[0331]
[0332]
[0333]
[0334]
[0335]
[0336]
[0337]
[0338]
[0339]
[0340]
[0341]
[0342]
[0343]
[0344]
[0345]
[0346]
[0347]
[0348]
[0349]
[0350]
[0351]
[0352]
[0353]
[0354]
[0355]
[0356]
[0357]
[0358]
[0359]
[0360]
[0361]
[0362]
[0363]
[0364]
[0365]
[0366]
[0367]
[0368]
[0369]
[0370]
[0371]
[0372]
[0373]
[0374]
[0375]
[0376]
[0377]
[0378]
[0379]
[0380]
[0381]
[0382]
[0383]
[0384]
[0385]
[0386]
[0387]
[0388]
[0389]
[0390]
[0391]
[0392]
[0393]
[0394]
[0395]
[0396]
[0397]
[0398]
[0399]
[0400]
[0401]
[0402]
[0403]
[0404]
[0405]
[0406]
[0407]
[0408]
[0409]
[0410]
[0411]
[0412]
[0413]
[0414]
[0415]
[0416]
[0417]
[0418]
[0419]
[0420]
[0421]
[0422]
[0423]
[0424]
[0425]
[0426]
[0427]
[0428]
[0429]
[0430]
[0431]
[0432]
[0433]
[0434]
[0435]
[0436]
[0437]
[0438]
[0439]
[0440]
[0441]
[0442]
[0443]
[0444]
[0445]
[0446]
[0447]
[0448]
[0449]
[0450]
[0451]
[0452]
[0453]
[0454]
[0455]
[0456]
[0457]
[0458]
[0459]
[0460]
[0461]
[0462]
[0463]
[0464]
[0465]
[0466]
[0467]
[0468]
[0469]
[0470]
[0471]
[0472]
[0473]
[0474]
[0475]
[0476]
[0477]
[0478]
[0479]
[0480]
[0481]
[0482]
[0483]
[0484]
[0485]
[0486]
[0487]
[0488]
[0489]
[0490]
[0491]
[0492]
[0493]
[0494]
[0495]
[0496]
[0497]
[0498]
[0499]
[0500]
[0501]
[0502]
[0503]
[0504]
[0505]
[0506]
[0507]
[0508]
[0509]
[0510]
[0511]
[0512]
[0513]
[0514]
[0515]
[0516]
[0517]
[0518]
[0519]
[0520]
[0521]
[0522]
[0523]
[0524]
[0525]
[0526]
[0527]
[0528]
[0529]
[0530]
[0531]
[0532]
[0533]
[0534]
[0535]
[0536]
[0537]
[0538]
[0539]
[0540]
[0541]
[0542]
[0543]
[0544]
[0545]
[0546]
[0547]
[0548]
[0549]
[0550]
[0551]
[0552]
[0553]
[0554]
[0555]
[0556]
[0557]
[0558]
[0559]
[0560]
[0561]
[0562]
[0563]
[0564]
[0565]
[0566]
[0567]
[0568]
[0569]
[0570]
[0571]
[0572]
[0573]
[0574]
[0575]
[0576]
[0577]
[0578]
[0579]
[0580]
[0581]
[0582]
[0583]
[0584]
[0585]
[0586]
[0587]
[0588]
[0589]
[0590]
[0591]
[0592]
[0593]
[0594]
[0595]
[0596]
[0597]
[0598]
[0599]
[0600]
[0601]
[0602]
[0603]
[0604]
[0605]
[0606]
[0607]
[0608]
[0609]
[0610]
[0611]
[0612]
[0613]
[0614]
[0615]
[0616]
[0617]
[0618]
[0619]
[0620]
[0621]
[0622]
[0623]
[0624]
[0625]
[0626]
[0627]
[0628]
[0629]
[0630]
[0631]
[0632]
[0633]
[0634]
[0635]
[0636]
[0637]
[0638]
[0639]
[0640]
[0641]
[0642]
[0643]
[0644]
[0645]
[0646]
[0647]
[0648]
[0649]
[0650]
[0651]
[0652]
[0653]
[0654]
[0655]
[0656]
[0657]
[0658]
[0659]
[0660]
[0661]
[0662]
[0663]
[0664]
[0665]
[0666]
[0667]
[0668]
[0669]
[0670]
[0671]
[0672]
[0673]
[0674]
[0675]
[0676]
[0677]
[0678]
[0679]
[0680]
[0681]
[0682]
[0683]
[0684]
[0685]
[0686]
[0687]
[0688]
[0689]
[0690]
[0691]
[0692]
[0693]
[0694]
[0695]
[0696]
[0697]
[0698]
[0699]
[0700]
[0701]
[0702]
[0703]
[0704]
[0705]
[0706]
[0707]
[0708]
[0709]
[0710]
[0711]
[0712]
[0713]
[0714]
[0715]
[0716]
[0717]
[0718]
[0719]
[0720]
[0721]
[0722]
[0723]
[0724]
[0725]
[0726]
[0727]
[0728]
[0729]
[0730]
[0731]
[0732]
[0733]
[0734]
[0735]
[0736]
[0737]
[0738]
[0739]
[0740]
[0741]
[0742]
[0743]
[0744]
[0745]
[0746]
[0747]
[0748]
[0749]
[0750]
[0751]
[0752]
[0753]
[0754]
[0755]
[0756]
[0757]
[0758]
[0759]
[0760]
[0761]
[0762]
[0763]
[0764]
[0765]
[0766]
[0767]
[0768]
[0769]
[0770]
[0771]
[0772]
[0773]
[0774]
[0775]
[0776]
[0777]
[0778]
[0779]
[0780]
[0781]
[0782]
[0783]
[0784]
[0785]
[0786]
[0787]
[0788]
[0789]
[0790]
[0791]
[0792]
[0793]
[0794]
[0795]
[0796]
[0797]
[0798]
[0799]
[0800]
[0801]
[0802]
[0803]
[0804]
[0805]
[0806]
[0807]
[0808]
[0809]
[0810]
[0811]
[0812]
[0813]
[0814]
[0815]
[0816]
[0817]
[0818]
[0819]
[0820]
[0821]
[0822]
[0823]
[0824]
[0825]
[0826]
[0827]
[0828]
[0829]
[0830]
[0831]
[0832]
[0833]
[0834]
[0835]
[0836]
[0837]
[0838]
[0839]
[0840]
[0841]
[0842]
[0843]
[0844]
[0845]
[0846]
[0847]
[0848]
[0849]
[0850]
[0851]
[0852]
[0853]
[0854]
[0855]
[0856]
[0857]
[0858]
[0859]
[0860]
[0861]
[0862]
[0863]
[0864]
[0865]
[0866]
[0867]
[0868]
[0869]
[0870]
[0871]
[0872]
[0873]
[0874]
[0875]
[0876]
[0877]
[0878]
[0879]
[0880]
[0881]
[0882]
[0883]
[0884]
[0885]
[0886]
[0887]
[0888]
[0889]
[0890]
[0891]
[0892]
[0893]
[0894]
[0895]
[0896]
[0897]
[0898]
[0899]
[0900]
[0901]
[0902]
[0903]
[0904]
[0905]
[0906]
[0907]
[0908]
[0909]
[0910]
[0911]
[0912]
[0913]
[0914]
[0915]
[0916]
[0917]
[0918]
[0919]
[0920]
[0921]
[0922]
[0923]
[0924]
[0925]
[0926]
[0927]
[0928]
[0929]
[0930]
[0931]
[0932]
[0933]
[0934]
[0935]
[0936]
[0937]
[0938]
[0939]
[0940]
[0941]
[0942]
[0943]
[0944]
[0945]
[0946]
[0947]
[0948]
[0949]
[0950]
[0951]
[0952]
[0953]
[0954]
[0955]
[0956]
[0957]
[0958]
[0959]
[0960]
[0961]
[0962]
[0963]
[0964]
[0965]
[0966]
[0967]
[0968]
[0969]
[0970]
[0971]
[0972]
[0973]
[0974]
[0975]
[0976]
[0977]
[0978]
[0979]
[0980]
[0981]
[0982]
[0983]
[0984]
[0985]
[0986]
[0987]
[0988]
[0989]
[0990]
[0991]
[0992]
[0993]
[0994]
[0995]
[0996]
[0997]
[0998]
[0999]
[1000]
[1001]
[1002]
[1003]
[1004]
[1005]
[1006]
[1007]
[1008]
[1009]
[1010]
[1011]
[1012]
[1013]
[1014]
[1015]
[1016]
[1017]
[1018]
[1019]
[1020]
[1021]
[1022]
[1023]
[1024]
[1025]
[1026]
[1027]
[1028]
[1029]
[1030]
[1031]
[1032]
[1033]
[1034]
[1035]
[1036]
[1037]
[1038]
[1039]
[1040]
[1041]
[1042]
[1043]
[1044]
[1045]
[1046]
[1047]
[1048]
[1049]
[1050]
[1051]
[1052]
[1053]
[1054]
[1055]
[1056]
[1057]
[1058]
[1059]
[1060]
[1061]
[1062]
[1063]
[1064]
[1065]
[1066]
[1067]
[1068]
[1069]
[1070]
[1071]
[1072]
[1073]
[1074]
[1075]
[1076]
[1077]
[1078]
[1079]
[1080]
[1081]
[1082]
[1083]
[1084]
[1085]
[1086]
[1087]
[1088]
[1089]
[1090]
[1091]
[1092]
[1093]
[1094]
[1095]
[1096]
[1097]
[1098]
[1099]
[1100]
[1101]
[1102]
[1103]
[1104]
[1105]
[1106]
[1107]
[1108]
[1109]
[1110]
[1111]
[1112]
[1113]
[1114]
[1115]
[1116]
[1117]
[1118]
[1119]
[1120]
[1121]
[1122]
[1123]
[1124]
[1125]
[1126]
[1127]
[1128]
[1129]
[1130]
[1131]
[1132]
[1133]
[1134]
[1135]
[1136]
[1137]
[1138]
[1139]
[1140]
[1141]
[1142]
[1143]
[1144]
[1145]
[1146]
[1147]
[1148]
[1149]
[1150]
[1151]
[1152]
[1153]
[1154]
[1155]
[1156]
[1157]
[1158]
[1159]
[1160]
[1161]
[1162]
[1163]
[1164]
[1165]
[1166]
[1167]
[1168]
[1169]
[1170]
[1171]
[1172]
[1173]
[1174]
[1175]
[1176]
[1177]
[1178]
[1179]
[1180]
[1181]
[1182]
[1183]
[1184]
[1185]
[1186]
[1187]
[1188]
[1189]
[1190]
[1191]
[1192]
[1193]
[1194]
[1195]
[1196]
[1197]
[1198]
[1199]
[1200]
[1201]
[1202]
[1203]
[1204]
[1205]
[1206]
[1207]
[1208]
[1209]
[1210]
[1211]
[1212]
[1213]
[1214]
[1215]
[1216]
[1217]
[1218]
[1219]
[1220]
[1221]
[1222]
[1223]
[1224]
[1225]
[1226]
[1227]
[1228]
[1229]
[1230]
[1231]
[1232]
[1233]
[1234]
[1235]
[1236]
[1237]
[1238]
[1239]
[1240]
[1241]
[1242]
[1243]
[1244]
[1245]
[1246]
[1247]
[1248]
[1249]
[1250]
[1251]
[1252]
[1253]
[1254]
[1255]
[1256]
[1257]
[1258]
[1259]
[1260]
[1261]
[1262]
[1263]
[1264]
[1265]
[1266]
[1267]
[1268]
[1269]
[1270]
[1271]
[1272]
[1273]
[1274]
[1275]
[1276]
[1277]
[1278]
[1279]
[1280]
[1281]
[1282]
[1283]
[1284]
[1285]
[1286]
[1287]
[1288]
[1289]
[1290]
[1291]
[1292]
[1293]
[1294]
[1295]
[1296]
[1297]
[1298]
[1299]
[1300]
[1301]
[1302]
[1303]
[1304]
[1305]
[1306]
[1307]
[1308]
[1309]
[1310]
[1311]
[1312]
[1313]
[1314]
[1315]
[1316]
[1317]
[1318]
[1319]
[1320]
[1321]
[1322]
[1323]
[1324]
[1325]
[1326]
[1327]
[1328]
[1329]
[1330]
[1331]
[1332]
[1333]
[1334]
[1335]
[1336]
[1337]
[1338]
[1339]
[1340]
[1341]
[1342]
[1343]
[1344]
[1345]
[1346]
[1347]
[1348]
[1349]
[1350]
[1351]
[1352]
[1353]
[1354]
[1355]
[1356]
[1357]
[1358]
[1359]
[1360]
[1361]
[1362]
[1363]
[1364]
[1365]
[1366]
[1367]
[1368]
[1369]
[1370]
[1371]
[1372]
[1373]
[1374]
[1375]
[1376]
[1377]
[1378]
[1379]
[1380]
[1381]
[1382]
[1383]
[1384]
[1385]
[1386]
[1387]
[1388]
[1389]
[1390]
[1391]
[1392]
[1393]
[1394]
[1395]
[1396]
[1397]
[1398]
[1399]
[1400]
[1401]
[1402]
[1403]
[1404]
[1405]
[1406]
[1407]
[1408]
[1409]
[1410]
[1411]
[1412]
[1413]
[1414]
[1415]
[1416]
[1417]
[1418]
[1419]
[1420]
[1421]
[1422]
[1423]
[1424]
[1425]
[1426]
[1427]
[1428]
[1429]
[1430]
[1431]
[1432]
[1433]
[1434]
[1435]
[1436]
[1437]
[1438]
[1439]
[1440]
[1441]
[1442]
[1443]
[1444]
[1445]
[1446]
[1447]
[1448]
[1449]
[1450]
[1451]
[1452]
[1453]
[1454]
[1455]
[1456]
[1457]
[1458]
[1459]
[1460]
[1461]
[1462]
[1463]
[1464]
[1465]
[1466]
[1467]
[1468]
[1469]
[1470]
[1471]
[1472]
[1473]
[1474]
[1475]
[1476]
[1477]
[1478]
[1479]
[1480]
[1481]
[1482]
[1483]
[1484]
[1485]
[1486]
[1487]
[1488]
[1489]
[1490]
[1491]
[1492]
[1493]
[1494]
[1495]
[1496]
[1497]
[1498]
[1499]
[1500]
[1501]
[1502]
[1503]
[1504]
[1505]
[1506]
[1507]
[1508]
[1509]
[1510]
[1511]
[1512]
[1513]
[1514]
[1515]
[1516]
[1517]
[1518]
[1519]
[1520]
[1521]
[1522]
[1523]
[1524]
[1525]
[1526]
[1527]
[1528]
[1529]
[1530]
[1531]
[1532]
[1533]
[1534]
[1535]
[1536]
[1537]
[1538]
[1539]
[1540]
[1541]
[1542]
[1543]
[1544]
[1545]
[1546]
[1547]
[1548]
[1549]
[1550]
[1551]
[1552]
[1553]
[1554]
[1555]
[1556]
[1557]
[1558]
[1559]
[1560]
[1561]
[1562]
[1563]
[1564]
[1565]
[1566]
[1567]
[1568]
[1569]
[1570]
[1571]
[1572]
[1573]
[1574]
[1575]
[1576]
[1577]
[1578]
[1579]
[1580]
[1581]
[1582]
[1583]
[1584]
[1585]
[1586]
[1587]
[1588]
[1589]
[1590]
[1591]
[1592]
[1593]
[1594]
[1595]
[1596]
[1597]
[1598]
[1599]
[1600]
[1601]
[1602]
[1603]
[1604]
[1605]
[1606]
[1607]
[1608]
[1609]
[1610]
[1611]
[1612]
[1613]
[1614]
[1615]
[1616]
[1617]
[1618]
[1619]
[1620]
[1621]
[1622]
[1623]
[1624]
[1625]
[1626]
[1627]
[1628]
[1629]
[1630]
[1631]
[1632]
[1633]
[1634]
[1635]
[1636]
[1637]
[1638]
[1639]
[1640]
[1641]
[1642]
[1643]
[1644]
[1645]
[1646]
[1647]
[1648]
[1649]
[1650]
[1651]
[1652]
[1653]
[1654]
[1655]
[1656]
[1657]
[1658]
[1659]
[1660]
[1661]
[1662]
[1663]
[1664]
[1665]
[1666]
[1667]
[1668]
[1669]
[1670]
[1671]
[1672]
[1673]
[1674]
[1675]
[1676]
[1677]
[1678]
[1679]
[1680]
[1681]
[1682]
[1683]
[1684]
[1685]
[1686]
[1687]
[1688]
[1689]
[1690]
[1691]
[1692]
[1693]
[1694]
[1695]
[1696]
[1697]
[1698]
[1699]
[1700]
[1701]
[1702]
[1703]
[1704]
[1705]
[1706]
[1707]
[1708]
[1709]
[1710]
[1711]
[1712]
[1713]
[1714]
[1715]
[1716]
[1717]
[1718]
[1719]
[1720]
[1721]
[1722]
[1723]
[1724]
[1725]
[1726]
[1727]
[1728]
[1729]
[1730]
[1731]
[1732]
[1733]
[1734]
[1735]
[1736]
[1737]
[1738]
[1739]
[1740]
[1741]
[1742]
[1743]
[1744]
[1745]
[1746]
[1747]
[1748]
[1749]
[1750]
[1751]
[1752]
[1753]
[1754]
[1755]
[1756]
[1757]
[1758]
[1759]
[1760]
[1761]
[1762]
[1763]
[1764]
[1765]
[1766]
[1767]
[1768]
[1769]
[1770]
[1771]
[1772]
[1773]
[1774]
[1775]
[1776]
[1777]
[1778]
[1779]
[1780]
[1781]
[1782]
[1783]
[1784]
[1785]
[1786]
[1787]
[1788]
[1789]
[1790]
[1791]
[1792]
[1793]
[1794]
[1795]
[1796]
[1797]
[1798]
[1799]
[1800]
[1801]
[1802]
[1803]
[1804]
[1805]
[1806]
[1807]
[1808]
[1809]
[1810]
[1811]
[1812]
[1813]
[1814]
[1815]
[1816]
[1817]
[1818]
[1819]
[1820]
[1821]
[1822]
[1823]
[1824]
[1825]
[1826]
[1827]
[1828]
[1829]
[1830]
[1831]
[1832]
[1833]
[1834]
[1835]
[1836]
[1837]
[1838]
[1839]
[1840]
[1841]
[1842]
[1843]
[1844]
[1845]
[1846]
[1847]
[1848]
[1849]
[1850]
[1851]
[1852]
[1853]
[1854]
[1855]
[1856]
[1857]
[1858]
[1859]
[1860]
[1861]
[1862]
[1863]
[1864]
[1865]
[1866]
[1867]
[1868]
[1869]
[1870]
[1871]
[1872]
[1873]
[1874]
[1875]
[1876]
[1877]
[1878]
[1879]
[1880]
[1881]
[1882]
[1883]
[1884]
[1885]
[1886]
[1887]
[1888]
[1889]
[1890]
[1891]
[1892]
[1893]
[1894]
[1895]
[1896]
[1897]
[1898]
[1899]
[1900]
[1901]
[1902]
[1903]
[1904]
[1905]
[1906]
[1907]
[1908]
[1909]
[1910]
[1911]
[1912]
[1913]
[1914]
[1915]
[1916]
/*****************************************************************************/
/*
authagent_LDAP_2.c
*** THIS VERSION USES IT'S OWN CODE TO DO THE AUTHENTICATION ***
LDAP authentication agent CGIplus script, using the callout mechanism.
Code adapted from the OpenVMS Utility Routines Manual, Sample LDAP API Code.
Uses the integrated LDAP run-time support available with VMS V7.3 and later.
Requires the HP SSL Package to be installed and started.
Attempts to improve performance by remaining connected to the last accessed
LDAP server. If the server host or port changes between authentication
requests (which is generally unlikely) the agent unbinds from the currently
connected LDAP server before connecting to the new. If there are any 'hard'
errors while processing (e.g. broken connection) the agent unbinds and retries.
Parameters can be passed in the command-line or the HTTPD$AUTH param=
directive, or a combination of both. Agent persistence means parameters set
remain set until use of the same parameter (qualifier) again overwriting the
previous value, or until the /RESET qualifier is encountered. This resets the
values of *all* parameters to the default values. Hence, basic parameters such
as host and port, and perhaps simple binding parameters, may be established at
the command-line (perhaps using a wrapper DCL procedure) and then each
authorization request could vary that as necessary using HTTPD$AUTH param=
directives. Care must be exercised that one does not interfere with another.
In general though most LDAP agent parameters can just be passed through from
the authorization rule with each request (see example below).
The filter implements the '%u' and '%d' conversion characters to allow complex
expressions to be built using the userid and realm from the user credentials.
Will verify the 'password' attribute returned either:
1) against the SYSUAF using $GETUAI and $HASH_PASSWORD to hash the password
supplied with the request and compare it to the SUSUAF entry.
2) using the 'userPassword' attribute returned to compute a local digest and
compare that to the digest in the attribute. Current digests supported:
a) {SHA} SHA1 (base-64 encoded)
b) {SSHA} salted SHA1 (base-64 encoded)
c) {MD5} MD5 (base-64 encoded)
d) {SMD5} salted MD5 (base-64 encoded)
e) plain-text
If the password verifies the 'uid' is used as the VMS username.
If the entry did not contain a 'uid' and a default username has been configured
(using the /UDEF="<string>" parameter) this is substituted as the authenticated
VMS username. Note that (for the obvious Catch-22) the password cannot be one
validated using the /SYSUAF facility.
RUN-TIME PARAMETERS
-------------------
These parameters are used to pass run-time information to the authentication
agent from the authorization configuration (see Authentication Configuration
below).
/BASE=<string> ldap_search_s() 'base' string
/CERT=<file-spec> client certificate and private key (if files are
protected may need to be INSTALLed with SYSPRV)
/DATT=<string> LDAP attribute containing the user detail for the
AUTH_USER variable (defaults to 'displayName')
/DIGEST verify the returned username and supplied password
by matching the digested password locally
/FILTER=<string> ldap_search_s() 'filter' string
(implements the '%u' and '%d' conversions)
/LOCAL verify username through locally supplied function
/PATT=<string> LDAP attribute name containing (encoded) password
(defaults to 'userPassword' attribute)
/PORT=<integer> optional method for specifying LDAP server port
/RESET reset the parameters (in persistent environments
parameters can remain across uses)
/SERVER=<host[:port]> host name and optional port number for LDAP server
/SIMPLE=<dn:passwd> account and ':'-separated password for simple bind
/SSL[=<integer>] use LDAPS (deprecated SSL) and optionally specify
the SSL protocol (default 1; 20, 23, 30, 31, etc)
/SYSUAF verify the returned username and supplied password
using $GETUAI and $HASH_PASSWORD
/TLS[=<integer>] use LDAP TLS (current SSL) and optionally specify
the SSL protocol (default 1; 20, 23, 30, 31, etc.)
/UDEF=<string> default VMS username when entry found and password
validated but no uid available
/UATT=<string> LDAP attribute name containing VMS username
(defaults to 'uid' attribute)
/VERSION=<integer> LDAP protocol version (defaults to 3)
COMMAND-LINE PARAMETERS
-----------------------
In addition to the run-time parameters these are available at the command-line.
/AUTH_PASSWORD=<string> emulates CGI environment AUTH_PASSWORD variable
/DBUG low level debug statements
/DUMP output the detail of matching entries
/REMOTE_USER=<string> emulates CGI environment REMOTE_USER variable
/WATCH output WASD server WATCH-able statements
AUTHENTICATION CONFIGURATION
----------------------------
The run-time parameters CAN be passed via a 'param=' argument to the HTTPD$AUTH
configuration for the realm.
["Just an LDAP Example"=AUTHAGENT_LDAP=agent]
/an/example/path/* r+w,param='\
/HOST="ldap.host.domain"/BASE="dc=domain,DC=au"\
/FILTER="uid=%u"/SIMPLE="account:password"'
COMMAND-LINE CHECKING
---------------------
Most functionality may be checked from the command-line using (almost) exactly
the same syntax and parameters as used in the authentication (CGIplus) mode.
This allows the format and syntax of the authentication configuration to be
developed and tested interactively. In addition, and for general information,
queries not possible (e.g. using wildcards) in the authentication mode may be
used in the command-line mode.
$ LDAPAGE == "$WASD_EXE:AUTHAGENT_LDAP /WATCH"
$ LDAPAGE /DUMP /HOST="ldap.fnal.gov" /BASE="o=fnal" /FILTER="cn=*smith*"
$ LDAPAGE /HOST="ldap.host.domain" /BASE="dc=domain,DC=au" -
/FILTER="uid=%u" /SIMPLE="account:password" -
/REMOTE_USER="whatever"
PRIVILEGED IMAGE
----------------
To use the /SYSUAF qualifier (and $GETUAI) for verifying the supplied password
the image must be installed with SYSPRV.
$ INSTALL REPLACE <directory>:AUTHAGENT_LDAP.EXE /AUTHPRIV=SYSPRV
LOGICAL NAMES
-------------
AUTHAGENT_LDAP$DBUG same as /DBUG
AUTHAGENT_LDAP$WATCH same as /WATCH
BUILD DETAILS
-------------
Compile then link:
$ @BUILD_AUTHAGENT_LDAP
To just link:
$ @BUILD_AUTHAGENT_LDAP LINK
SPONSOR
-------
This software has been developed under the sponsorship of the University of
Malaga and generously made available to the wider WASD community. Many thanks.
COPYRIGHT
---------
Copyright (C) 2006-2021 Mark G.Daniel
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
VERSION HISTORY (update SOFTWAREVN as well)
---------------
10-JUN-2021 MGD v2.0.0, minimal changes for WASD v12... agent requirements
04-MAY-2017 MGD v1.0.3, upper-case kludge to work around SSL1 link issues
(needs a lot more effort to make work with OSSL$)
11-MAY-2007 MGD v1.0.2, belt-and-braces
16-JUL-2006 MGD v1.0.1, add /DATT and user details callout
08-JUL-2006 MGD v1.0.0, initial development
*/
/*****************************************************************************/
#ifndef USE_OPENSSL
#define USE_OPENSSL 1
#endif
#ifdef USE_OPENSSL
#define USING_OPENSSL " (SSL)"
#else
#define USING_OPENSSL " (sans SSL)"
#endif
#define SOFTWAREVN "2.0.0"
#define SOFTWARENM "AUTHAGENT_LDAP"
#ifdef __ALPHA
# define SOFTWAREID SOFTWARENM " AXP-" SOFTWAREVN USING_OPENSSL
#endif
#ifdef __ia64
# define SOFTWAREID SOFTWARENM " IA64-" SOFTWAREVN USING_OPENSSL
#endif
#ifdef __x86_64
# define SOFTWAREID SOFTWARENM " X86-" SOFTWAREVN
#endif
/* standard C header files */
#include <ctype.h>
#include <errno.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
/* VMS related header files */
#include <descrip.h>
#include <jpidef.h>
#include <libdef.h>
#include <lib$routines.h>
#include <lnmdef.h>
#include <prvdef.h>
#include <ssdef.h>
#include <starlet.h>
#include <stsdef.h>
#include <uaidef.h>
/* application header files */
#include <ldap.h>
#include <cgilib.h>
#if USE_OPENSSL
/* upper-case kludge to work around SSL1 link issues */
#define BIO_ctrl BIO_CTRL
#define BIO_f_base64 BIO_F_BASE64
#define BIO_new BIO_NEW
#define BIO_push BIO_PUSH
#define BIO_read BIO_READ
#define BIO_s_mem BIO_S_MEM
#define BIO_set_flags BIO_SET_FLAGS
#define BIO_write BIO_WRITE
#define MD5_Final MD5_FINAL
#define MD5_Init MD5_INIT
#define MD5_Update MD5_UPDATE
#define SHA1_Final SHA1_FINAL
#define SHA1_Init SHA1_INIT
#define SHA1_Update SHA1_UPDATE
/* OpenSSL header files (0.9.3ff) */
#include "openssl/err.h"
#include "openssl/md5.h"
#include "openssl/X509.h"
#include "openssl/ssl.h"
#include "openssl/bio.h"
#include "openssl/buffer.h"
#include "openssl/crypto.h"
#endif /* USE_OPENSSL */
#define VMSok(x) ((x) & STS$M_SUCCESS)
#define VMSnok(x) !(((x) & STS$M_SUCCESS))
#define BOOL int
#define TRUE 1
#define FALSE 0
#define DEFAULT_ATTRIBUTE_USERNAME "uid"
#define DEFAULT_ATTRIBUTE_PASSWORD "userPassword"
#define DEFAULT_ATTRIBUTE_DISPLAY "displayName"
#define DEFAULT_SSL_PORT 636
/******************/
/* global storage */
/******************/
char Utility [] = "AUTHAGENT_LDAP";
BOOL Debug,
DebugWatch,
DoDump,
LdapSimpleBind,
VerifyDigest,
VerifyLocal,
VerifySYSUAF;
int CgiPlusUsageCount,
LdapProtocolVersion = LDAP_VERSION3,
LdapSSL,
StartTLS;
unsigned short LdapPort;
char *AuthAgentPtr,
*RemoteUserPtr;
char CertKeyFileName [128],
CliRemoteUser [48],
CliAuthPassword [48],
LdapBase [128],
LdapFilter [128],
LdapHost [128],
LdapSimpleBindDn [128],
LdapSimpleBindPasswd [64],
PasswordAttribute [64] = DEFAULT_ATTRIBUTE_PASSWORD,
PasswordValue [96],
PasswordHash [128],
SoftwareId [96],
UserDisplayAttribute [64] = DEFAULT_ATTRIBUTE_DISPLAY,
UserDisplayValue [64],
UserNameAttribute [64] = DEFAULT_ATTRIBUTE_USERNAME,
UserNameDefault [64],
UserNameValue [64],
VmsUserName [48];
unsigned long SysPrvMask [2] = { PRV$M_SYSPRV, 0 };
/***********************/
/* function prototypes */
/***********************/
int DecodeBase64 (char*, int, char*, int);
void GetParameters ();
void GetRunTimeParameters (char*, BOOL);
void HashMD5 (char*, int, char*, int, char*);
void HashSHA1 (char*, int, char*, int, char*);
void NeedsPrivilegedAccount ();
BOOL ProcessRequest ();
void RemoveSlash (char*);
char* SysTrnLnm (char*, char*);
BOOL VerifyAgainstSYSUAF (char*, char*);
BOOL VerifyLocalFunction (char*, char*);
BOOL VerifyMD5 (char*, char*);
BOOL VerifySMD5 (char*, char*);
BOOL VerifySHA (char*, char*);
BOOL VerifySSHA (char*, char*);
char* WatchElapsed ();
void WatchThis (int, char*, ...);
int strzcpy (char*, char*, int);
BOOL strsame (char*, char*, int);
/*****************************************************************************/
/*
*/
main ()
{
BOOL ok;
int status;
char *cptr;
/*********/
/* begin */
/*********/
sprintf (SoftwareId, "%s (%s)", SOFTWAREID, CgiLibEnvironmentVersion());
Debug = (SysTrnLnm ("AUTHAGENT_LDAP$DBUG", NULL) != NULL);
CgiLibEnvironmentSetDebug (Debug);
GetParameters ();
CgiLibEnvironmentInit (0, NULL, FALSE);
if (!SysTrnLnm ("HTTP$INPUT", NULL))
{
/* not in a server context (interactive, command-line testing) */
NeedsPrivilegedAccount ();
if (DebugWatch) WatchElapsed ();
ProcessRequest ();
if (DebugWatch) WatchThis (__LINE__, "ELAPSED %s", WatchElapsed());
exit (SS$_NORMAL);
}
/* MUST only be executed in a CGIplus environment! */
if (!CgiLibEnvironmentIsCgiPlus ())
{
CgiLibResponseHeader (502, "text/plain");
fputs ("CGIplus!\n", stdout);
exit (SS$_NORMAL);
}
for (;;)
{
/* block waiting for the next request */
CgiLibVar ("");
CgiPlusUsageCount++;
if (cptr = CgiLibVarNull("REQUEST_METHOD"))
if (!*cptr)
{
/* proctored into existance */
CgiLibResponseHeader (204, "application/proctor");
CgiLibCgiPlusEOF ();
continue;
}
CgiLibCgiPlusCallout ("!AGENT-BEGIN: %s (%s) usage:%d",
SoftwareId, CgiLibEnvironmentVersion(),
CgiPlusUsageCount);
/* provide the server attention "escape" sequence record */
if (!Debug) CgiLibCgiPlusESC ();
DebugWatch = (SysTrnLnm ("AUTHAGENT_LDAP$WATCH", NULL) != NULL);
if (DebugWatch) WatchElapsed ();
/* ensure this is being invoked by the server */
if (!(AuthAgentPtr = CgiLibVarNull ("AUTH_AGENT"))) exit (SS$_ABORT);
if (DebugWatch) WatchThis (__LINE__, "AUTH_AGENT %s", AuthAgentPtr);
/* belt and braces */
fprintf (stdout, "100 AUTHAGENT-CALLOUT\n");
fflush (stdout);
/* have at least two goes at authenticating the user */
if (!(ok = ProcessRequest ())) ok = ProcessRequest ();
if (!ok)
{
fprintf (stdout, "500 LDAP authenticator.\n");
fflush (stdout);
}
if (DebugWatch) WatchThis (__LINE__, "ELAPSED %s", WatchElapsed());
/* provide the "escape" end-of-text sequence record */
if (!Debug) CgiLibCgiPlusEOT ();
CgiLibCgiPlusCallout ("!AGENT-END:");
CgiLibCgiPlusEOF ();
if (!ok) exit (SS$_NORMAL);
}
}
/*****************************************************************************/
/*
Main authentication request processing function.
*/
BOOL ProcessRequest ()
{
static BOOL ServerUnbind;
static char ConnectedLdapHost [128];
static short ConnectedLdapPort;
static LDAP *ld;
BOOL PasswordOK;
int idx, rc, status,
EntryCount;
char *cptr, *sptr, *tptr, *zptr,
*PasswordPtr;
char UserFilter [256],
UserId [64],
UserRealm [128];
LDAPMessage *resptr, *entptr;
char *attptr, *dnptr;
BerElement *berptr;
char **AttValues;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "ProcessRequest()\n");
if (DebugWatch) WatchThis (__LINE__, "%s", SoftwareId);
if (AuthAgentPtr) GetRunTimeParameters (AuthAgentPtr, FALSE);
if (CgiLibEnvironmentIsCgiPlus())
{
RemoteUserPtr = CgiLibVarNull ("REMOTE_USER");
if (!RemoteUserPtr)
{
if (DebugWatch) WatchThis (__LINE__, "REMOTE_USER?");
return (FALSE);
}
}
else
RemoteUserPtr = CliRemoteUser;
/* ensure no covert expressions sneak in under the radar */
for (cptr = RemoteUserPtr; *cptr; cptr++)
if (*cptr == '*' || *cptr == '&' || *cptr == '|' ||
*cptr == '!' || *cptr == '(' || *cptr == ')' ||
*cptr == '\\') break;
if (*cptr)
{
if (DebugWatch) WatchThis (__LINE__, "REMOTE_USER wildcard/expression!");
fprintf (stdout, "401 ambiguous credentials.\n");
fflush (stdout);
return (TRUE);
}
/********************/
/* build the filter */
/********************/
zptr = (sptr = UserId) + sizeof(UserId)-1;
for (cptr = RemoteUserPtr;
*cptr && *cptr != '@' && sptr < zptr;
*sptr++ = *cptr++);
*sptr = '\0';
if (*cptr) cptr++;
zptr = (sptr = UserRealm) + sizeof(UserRealm)-1;
while (*cptr && sptr < zptr) *sptr++ = *cptr++;
*sptr = '\0';
/* implement '%u' for userid and '%d' for realm */
zptr = (sptr = UserFilter) + sizeof(UserFilter)-1;
cptr = LdapFilter;
while (*cptr && sptr < zptr)
{
while (*cptr && *cptr != '%' && sptr < zptr) *sptr++ = *cptr++;
if (!*cptr) break;
cptr++;
if (!*cptr) break;
if (*cptr == 'u')
{
cptr++;
for (tptr = UserId; *tptr && sptr < zptr; *sptr++ = *tptr++);
}
else
if (*cptr == 'd')
{
cptr++;
for (tptr = UserRealm; *tptr && sptr < zptr; *sptr++ = *tptr++);
}
else
/* unknown conversion character, just ignore it */
*sptr++ = *cptr++;
}
*sptr = '\0';
/* just override the above if from the command-line and no remote user */
if (!CgiLibEnvironmentIsCgiPlus() && !CliRemoteUser[0])
strzcpy (UserFilter, LdapFilter, sizeof(UserFilter));
if (DebugWatch) WatchThis (__LINE__, "FILTER |%s|", UserFilter);
/******************************/
/* connect to the LDAP server */
/******************************/
/* check if we need to change any persistent connection */
if ((ConnectedLdapHost[0] && strcmp (LdapHost, ConnectedLdapHost)) ||
(ConnectedLdapPort && ConnectedLdapPort != LdapPort))
ServerUnbind = TRUE;
if (ServerUnbind)
{
if (DebugWatch)
WatchThis (__LINE__, "ldap_unbind() %s:%d",
ConnectedLdapHost, ConnectedLdapPort);
rc = ldap_unbind (ld);
if (DebugWatch)
if (rc != LDAP_SUCCESS)
WatchThis (__LINE__, "ERROR %d %d %%X%08.08X %s",
rc, errno, vaxc$errno, ldap_err2string(rc));
ServerUnbind = FALSE;
ConnectedLdapHost[0] = '\0';
ConnectedLdapPort = 0;
}
if (ConnectedLdapHost[0])
{
/* already connected to the required server */
if (DebugWatch)
WatchThis (__LINE__, "persistent %s:%d",
ConnectedLdapHost, ConnectedLdapPort);
}
else
{
strzcpy (ConnectedLdapHost, LdapHost, sizeof(ConnectedLdapHost));
ConnectedLdapPort = LdapPort;
if (!ConnectedLdapPort)
if (!LdapSSL)
ConnectedLdapPort = LDAP_PORT;
else
ConnectedLdapPort = DEFAULT_SSL_PORT;
if (DebugWatch)
WatchThis (__LINE__, "ldap_init() %s:%d",
ConnectedLdapHost, ConnectedLdapPort);
ld = ldap_init (ConnectedLdapHost, ConnectedLdapPort);
if (ld == NULL)
{
if (DebugWatch)
WatchThis (__LINE__, "ERROR %d %%X%08.08X", errno, vaxc$errno);
ServerUnbind = TRUE;
return (FALSE);
}
ldap_set_option (ld, LDAP_OPT_PROTOCOL_VERSION, &LdapProtocolVersion);
if (StartTLS || LdapSSL)
{
/******************/
/* secure sockets */
/******************/
ldap_set_option (ld, LDAP_OPT_TLS_VERSION,
StartTLS ? &StartTLS : &LdapSSL);
if (CertKeyFileName[0])
{
ldap_set_option (ld, LDAP_OPT_TLS_CERT_FILE, CertKeyFileName);
ldap_set_option (ld, LDAP_OPT_TLS_PKEY_FILE, CertKeyFileName);
/* turn on SYSPRV to allow access to possibly protected files */
status = sys$setprv (1, &SysPrvMask, 0, 0);
if (DebugWatch)
if (VMSnok(status) || status == SS$_NOTALLPRIV)
WatchThis (__LINE__, "sys$setprv() %%X%08.08X\n", status);
}
if (DebugWatch)
WatchThis (__LINE__, "ldap_tls_start() %s:%d",
StartTLS ? "StartTLS" : "LDAPS",
StartTLS ? StartTLS : LdapSSL);
rc = ldap_tls_start (ld, StartTLS ? 1 : 0);
/* turn off SYSPRV */
if (CertKeyFileName[0]) sys$setprv (0, &SysPrvMask, 0, 0);
if (rc != LDAP_SUCCESS)
{
if (DebugWatch)
WatchThis (__LINE__, "ERROR %d %d %%X%08.08X %s",
rc, errno, vaxc$errno, ldap_err2string(rc));
ServerUnbind = TRUE;
return (FALSE);
}
}
if (LdapSimpleBind)
{
/* authenticate with simple username (well, dn=) and password */
if (DebugWatch)
WatchThis (__LINE__, "ldap_simple_bind_s() |%s|%s|",
LdapSimpleBindDn ? LdapSimpleBindDn : "(NULL)",
LdapSimpleBindPasswd ? LdapSimpleBindPasswd : "(NULL)");
rc = ldap_simple_bind_s (ld, LdapSimpleBindDn,
LdapSimpleBindPasswd);
if (rc != LDAP_SUCCESS)
{
if (DebugWatch)
WatchThis (__LINE__, "ERROR %d %d %%X%08.08X %s",
rc, errno, vaxc$errno, ldap_err2string(rc));
ServerUnbind = TRUE;
return (FALSE);
}
}
}
/******************/
/* make the query */
/******************/
if (DebugWatch)
WatchThis (__LINE__, "ldap_search_s() |%s|%s|", LdapBase, UserFilter);
rc = ldap_search_s (ld,
LdapBase,
LDAP_SCOPE_SUBTREE,
UserFilter,
NULL, 0,
&resptr);
if (rc != LDAP_SUCCESS)
{
if (DebugWatch)
WatchThis (__LINE__, "ERROR %d %d %%X%08.08X %s",
rc, errno, vaxc$errno, ldap_err2string(rc));
ServerUnbind = TRUE;
return (FALSE);
}
/*******************/
/* process results */
/*******************/
PasswordValue[0] = UserDisplayValue[0] = UserNameValue[0] = '\0';
EntryCount = 0;
for (entptr = ldap_first_entry (ld, resptr);
entptr != NULL;
entptr = ldap_next_entry (ld, entptr))
{
EntryCount++;
dnptr = ldap_get_dn (ld, entptr);
if (DoDump) fprintf (stdout, "\n%03.03d |%s|\n", EntryCount, dnptr);
ldap_memfree (dnptr);
for (attptr = ldap_first_attribute (ld, entptr, &berptr);
attptr != NULL;
attptr = ldap_next_attribute (ld, entptr, berptr))
{
if (DoDump) fprintf (stdout, " |->|%s|\n", attptr);
AttValues = ldap_get_values (ld, entptr, attptr);
for (idx = 0; AttValues[idx] != NULL; idx++)
{
if (!strcmp (PasswordAttribute, attptr))
{
strzcpy (PasswordValue, AttValues[idx], sizeof(PasswordValue));
if (DebugWatch)
WatchThis (__LINE__, "MATCH |%s|%s|",
PasswordAttribute, PasswordValue);
}
else
if (!strcmp (UserDisplayAttribute, attptr))
{
strzcpy (UserDisplayValue, AttValues[idx],
sizeof(UserDisplayValue));
if (DebugWatch)
WatchThis (__LINE__, "MATCH |%s|%s|",
UserDisplayAttribute, UserDisplayValue);
}
else
if (!strcmp (UserNameAttribute, attptr))
{
strzcpy (UserNameValue, AttValues[idx], sizeof(UserNameValue));
if (DebugWatch)
WatchThis (__LINE__, "MATCH |%s|%s|",
UserNameAttribute, UserNameValue);
}
if (DoDump)
{
if (!idx)
fprintf (stdout, " | |->|%s|\n", AttValues[idx]);
else
fprintf (stdout, " | |%s|\n", AttValues[idx]);
}
}
ldap_value_free (AttValues);
ldap_memfree (attptr);
}
if (berptr != NULL) ber_free (berptr, 0);
}
if (DoDump)
fprintf (stdout, "%s%d entries\n\n", EntryCount ? "\n" : "", EntryCount);
if (DebugWatch) WatchThis (__LINE__, "ENTRIES %d", EntryCount);
/* free the search results (let's hope it doesn't leak too much!) */
ldap_msgfree (resptr);
if (EntryCount == 1)
{
/*******************/
/* found one entry */
/*******************/
if (!PasswordValue[0])
{
/***********************/
/* password attribute? */
/***********************/
/* can't do much in the way of authentication without this! */
if (DebugWatch) WatchThis (__LINE__, "PASSWORD? (/PATT=)");
fprintf (stdout, "500 ambiguous LDAP result.\n");
}
else
if (!UserNameValue[0] && !UserNameDefault[0])
{
/***********************/
/* username attribute? */
/***********************/
/* no username ('uid') and no default to fall back on */
if (DebugWatch) WatchThis (__LINE__, "USERNAME? (/UATT=)");
fprintf (stdout, "500 ambiguous LDAP result.\n");
}
else
{
PasswordOK = FALSE;
if (CliAuthPassword[0])
PasswordPtr = CliAuthPassword;
else
PasswordPtr = CgiLibVarNull ("AUTH_PASSWORD");
if (!PasswordPtr)
{
if (DebugWatch) WatchThis (__LINE__, "AUTH_PASSWORD?");
return (FALSE);
}
if (VerifyDigest)
{
/*****************************/
/* verify password by digest */
/*****************************/
#if USE_OPENSSL
if (!memcmp (PasswordValue, "{SSHA}", 6))
{
if (DebugWatch) WatchThis (__LINE__, "SSHA %s", PasswordValue+6);
PasswordOK = VerifySSHA (PasswordValue, PasswordPtr);
}
else
if (!memcmp (PasswordValue, "{SHA}", 5))
{
if (DebugWatch) WatchThis (__LINE__, "SHA %s", PasswordValue+5);
PasswordOK = VerifySHA (PasswordValue, PasswordPtr);
}
else
if (!memcmp (PasswordValue, "{SMD5}", 6))
{
if (DebugWatch) WatchThis (__LINE__, "SMD5 %s", PasswordValue+6);
PasswordOK = VerifySMD5 (PasswordValue, PasswordPtr);
}
else
if (!memcmp (PasswordValue, "{MD5}", 5))
{
if (DebugWatch) WatchThis (__LINE__, "MD5 %s", PasswordValue+5);
PasswordOK = VerifyMD5 (PasswordValue, PasswordPtr);
}
else
#endif /* USE_OPENSSL */
/* dangling 'else' from the macro */
if (PasswordValue[0] != '{')
{
/* plain-text!! */
PasswordOK = (strcmp (PasswordValue, PasswordPtr) == 0);
}
else
if (DebugWatch) WatchThis (__LINE__, "ENCODING unknown");
}
else
if (VerifySYSUAF)
{
/********************************/
/* verify password using SYSUAF */
/********************************/
PasswordOK = VerifyAgainstSYSUAF (UserNameValue, PasswordPtr);
}
else
if (VerifyLocal)
{
/************************************/
/* verify using local functionality */
/************************************/
PasswordOK = VerifyLocalFunction (UserNameValue, PasswordPtr);
}
else
{
/*****************************/
/* must be verified somehow! */
/*****************************/
if (DebugWatch) WatchThis (__LINE__, "VERIFY?");
}
/************/
/* verified */
/************/
if (PasswordOK)
{
if (!UserNameValue[0])
{
if (DebugWatch)
WatchThis (__LINE__, "DEFAULT %s", UserNameDefault);
strzcpy (UserNameValue, UserNameDefault, sizeof(UserNameValue));
}
fprintf (stdout, "100 VMS-USER %s\n", UserNameValue);
if (UserDisplayValue[0])
{
/* must be done following VMS-USER which also sets USER! */
fflush (stdout);
fprintf (stdout, "100 USER %s\n", UserDisplayValue);
}
}
else
fprintf (stdout, "401 authentication failure.\n");
}
}
else
if (EntryCount > 1)
{
/********************/
/* ambiguous result */
/********************/
if (DebugWatch) WatchThis (__LINE__, "AMBIGUOUS");
fprintf (stdout, "500 ambiguous LDAP result.\n");
}
else
{
/*************/
/* not found */
/*************/
fprintf (stdout, "401 authentication failure.\n");
}
/* flush the callout record */
fflush (stdout);
return (TRUE);
}
/*****************************************************************************/
/*
Verify the supplied username/password from the SYSUAF.
Get the specified user's flags, authorized privileges, quadword password, hash
salt and encryption algorithm from SYSUAF. If any of specified bits in the
flags are set (e.g. "disusered") then fail the password authentication.
Using the salt and encryption algorithm hash the supplied password and compare
it to the UAF hashed password.
Return TRUE if the password is validated and there are no account restrictions,
FALSE otherwise.
*/
BOOL VerifyAgainstSYSUAF
(
char *UserNamePtr,
char *PasswordPtr
)
{
/* UAI flags that disallow SYSUAF authentication */
unsigned long DisallowVmsFlags = UAI$M_DISACNT |
UAI$M_PWD_EXPIRED |
UAI$M_PWD2_EXPIRED |
UAI$M_CAPTIVE |
UAI$M_RESTRICTED | 0;
static unsigned long Context = -1;
static unsigned long UaiFlags,
UaiUic;
static unsigned long UaiPriv [2],
HashedPwd [2],
UaiPwd [2];
static unsigned short UaiSalt;
static unsigned char UaiEncrypt;
static char UserName [15+1],
Password [39+1];
static $DESCRIPTOR (UserNameDsc, UserName);
static $DESCRIPTOR (PasswordDsc, Password);
static struct {
short int buf_len;
short int item;
void *buf_addr;
unsigned short *ret_len;
} UaiItems [] =
{
{ sizeof(UaiUic), UAI$_UIC, &UaiUic, 0 },
{ sizeof(UaiFlags), UAI$_FLAGS, &UaiFlags, 0 },
{ sizeof(UaiPriv), UAI$_PRIV, &UaiPriv, 0 },
{ sizeof(UaiPwd), UAI$_PWD, &UaiPwd, 0 },
{ sizeof(UaiEncrypt), UAI$_ENCRYPT, &UaiEncrypt, 0 },
{ sizeof(UaiSalt), UAI$_SALT, &UaiSalt, 0 },
{ 0, 0, 0, 0 }
};
int status;
char *cptr, *sptr, *zptr;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "VerifyAgainstSYSUAF()\n");
/* to upper case! (just truncate if too long) */
zptr = (sptr = UserName) + sizeof(UserName)-1;
for (cptr = UserNamePtr; *cptr && sptr < zptr; *sptr++ = toupper(*cptr++));
*sptr = '\0';
UserNameDsc.dsc$w_length = sptr - UserName;
if (DebugWatch) WatchThis (__LINE__, "SYSUAF |%s|", UserName);
/* turn on SYSPRV to allow access to SYSUAF records */
status = sys$setprv (1, &SysPrvMask, 0, 0);
if (DebugWatch)
if (VMSnok(status) || status == SS$_NOTALLPRIV)
WatchThis (__LINE__, "sys$setprv() %%X%08.08X\n", status);
status = sys$getuai (0, &Context, &UserNameDsc, &UaiItems, 0, 0, 0);
if (Debug) fprintf (stdout, "sys$getuai() %%X%08.08X\n", status);
/* turn off SYSPRV */
sys$setprv (0, &SysPrvMask, 0, 0);
if (VMSnok (status))
{
if (DebugWatch) WatchThis (__LINE__, "sys$getuai() %%X%08.08X", status);
return (FALSE);
}
/* automatically disallow if any of these flags are set! */
if (UaiFlags & DisallowVmsFlags)
{
if (DebugWatch) WatchThis (__LINE__, "FAILED on SYSUAF flags");
return (FALSE);
}
/* to upper case! (just truncate if too long) */
zptr = (sptr = Password) + sizeof(Password)-1;
for (cptr = PasswordPtr; *cptr && sptr < zptr; *sptr++ = toupper(*cptr++));
*sptr = '\0';
PasswordDsc.dsc$w_length = sptr - Password;
status = sys$hash_password (&PasswordDsc, UaiEncrypt,
UaiSalt, &UserNameDsc, &HashedPwd);
if (Debug) fprintf (stdout, "sys$hash_password() %%X%08.08X\n", status);
if (VMSnok (status))
{
if (DebugWatch)
WatchThis (__LINE__, "sys$hash_password() %%X%08.08X", status);
return (FALSE);
}
if (HashedPwd[0] != UaiPwd[0] || HashedPwd[1] != UaiPwd[1])
{
if (DebugWatch) WatchThis (__LINE__, "FAILED password match");
return (FALSE);
}
if (DebugWatch) WatchThis (__LINE__, "VERIFIED");
return (TRUE);
}
/*****************************************************************************/
/*
Roll-you-own here!
*/
BOOL VerifyLocalFunction
(
char *StringPtr,
char *PasswordPtr
)
{
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "VerifyLocalFunction() |%s|\n", StringPtr);
return (FALSE);
}
/*****************************************************************************/
#if USE_OPENSSL
/*
Compare the supplied "{SHA}LcRNUdyib7gGaI8qq4wGNen46MoqL" SHA1 hash string to
the supplied plain-text password.
*/
BOOL VerifySHA
(
char *StringPtr,
char *PasswordPtr
)
{
int len;
char DecodeBuffer [20],
PasswordHash [20];
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "VerifySHA() |%s|\n", StringPtr);
if (!memcmp (StringPtr, "{SHA}", 5)) StringPtr += 5;
len = DecodeBase64 (StringPtr, strlen(StringPtr),
DecodeBuffer, sizeof(DecodeBuffer));
if (len != 20) return (FALSE);
HashSHA1 (PasswordPtr, strlen(PasswordPtr), NULL, 0, PasswordHash);
if (!memcmp (DecodeBuffer, PasswordHash, 20)) return (TRUE);
return (FALSE);
}
/*****************************************************************************/
/*
Compare the supplied "{SSHA}LcRNUdyib7gGaI8qq4wGNen46MoqLrPH" Salted SHA1 hash
string to the supplied plain-text password.
*/
BOOL VerifySSHA
(
char *StringPtr,
char *PasswordPtr
)
{
int len;
char DecodeBuffer [48],
PasswordHash [20];
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "VerifySSHA() |%s|\n", StringPtr);
if (!memcmp (StringPtr, "{SSHA}", 6)) StringPtr += 6;
len = DecodeBase64 (StringPtr, strlen(StringPtr),
DecodeBuffer, sizeof(DecodeBuffer));
if (len < 20 || len > 32) return (FALSE);
HashSHA1 (PasswordPtr, strlen(PasswordPtr),
DecodeBuffer+20, len-20, PasswordHash);
if (!memcmp (DecodeBuffer, PasswordHash, 20)) return (TRUE);
return (FALSE);
}
/*****************************************************************************/
/*
Compare the supplied "{MD5}LcRNUdyib7gGaI8qq4wGNen46MoqL" MD5 hash string to
the supplied plain-text password.
*/
BOOL VerifyMD5
(
char *StringPtr,
char *PasswordPtr
)
{
int len;
char DecodeBuffer [16],
PasswordHash [16];
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "VerifyMD5() |%s|\n", StringPtr);
if (!memcmp (StringPtr, "{MD5}", 5)) StringPtr += 5;
len = DecodeBase64 (StringPtr, strlen(StringPtr),
DecodeBuffer, sizeof(DecodeBuffer));
if (len != 16) return (FALSE);
HashMD5 (PasswordPtr, strlen(PasswordPtr), NULL, 0, PasswordHash);
if (!memcmp (DecodeBuffer, PasswordHash, 16)) return (TRUE);
return (FALSE);
}
/*****************************************************************************/
/*
Compare the supplied "{SMD5}LcRNUdy7gGaI8qq4wGNen46oqLrPm" Salted MD5 hash
string to the supplied plain-text password.
*/
BOOL VerifySMD5
(
char *StringPtr,
char *PasswordPtr
)
{
int len;
char DecodeBuffer [48],
PasswordHash [20];
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "VerifySMD5() |%s|\n", StringPtr);
if (!memcmp (StringPtr, "{SMD5}", 6)) StringPtr += 6;
len = DecodeBase64 (StringPtr, strlen(StringPtr),
DecodeBuffer, sizeof(DecodeBuffer));
if (len < 16 || len > 32) return (FALSE);
HashMD5 (PasswordPtr, strlen(PasswordPtr),
DecodeBuffer+16, len-16, PasswordHash);
if (!memcmp (DecodeBuffer, PasswordHash, 16)) return (TRUE);
return (FALSE);
}
/*****************************************************************************/
/*
Applies a (optionally Salted) SHA1 hash (RFC3112) to the supplied data.
*/
void HashSHA1
(
char *DataPtr,
int DataLength,
char *SaltPtr,
int SaltLength,
char *HashBuffer
)
{
SHA_CTX ctx;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "HashSHA1()\n");
SHA1_Init (&ctx);
SHA1_Update (&ctx, DataPtr, DataLength);
if (SaltPtr) SHA1_Update (&ctx, SaltPtr, SaltLength);
SHA1_Final ((unsigned char*)HashBuffer, &ctx);
}
/*****************************************************************************/
/*
Applies a (optionally Salted) MD5 hash (RFC1321) to the supplied data.
*/
void HashMD5
(
char *DataPtr,
int DataLength,
char *SaltPtr,
int SaltLength,
char *HashBuffer
)
{
MD5_CTX ctx;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "HashMD5()\n");
MD5_Init (&ctx);
MD5_Update (&ctx, DataPtr, DataLength);
if (SaltPtr) MD5_Update (&ctx, SaltPtr, SaltLength);
MD5_Final ((unsigned char*)HashBuffer, &ctx);
}
/*****************************************************************************/
/*
Using OpenSSL BIO streams decode base-64 into a plain-string. And yes, it
does seem a bit of an overkill but as we're using OpenSSL for the SHA1 hashing
why not just use as much more as we need!
*/
int DecodeBase64
(
char *Base64Ptr,
int Base64Length,
char *BufferPtr,
int SizeOfBuffer
)
{
static BIO *bio,
*BioB64Ptr,
*BioMemPtr;
int rc;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "DecodeBase64()\n");
if (!BioMemPtr)
{
BioMemPtr = BIO_new (BIO_s_mem());
if (!BioMemPtr) exit (SS$_BUGCHECK);
BioB64Ptr = BIO_new (BIO_f_base64());
if (!BioB64Ptr) exit (SS$_BUGCHECK);
BIO_set_flags (BioB64Ptr, BIO_FLAGS_BASE64_NO_NL);
bio = BIO_push (BioB64Ptr, BioMemPtr);
if (!bio) exit (SS$_BUGCHECK);
}
if (Base64Length == -1) Base64Length = strlen(Base64Ptr);
BIO_reset (bio);
rc = BIO_write (BioMemPtr, Base64Ptr, Base64Length);
rc = BIO_flush (bio);
rc = BIO_pending (bio);
if (rc > SizeOfBuffer) rc = SizeOfBuffer;
rc = BIO_read (bio, BufferPtr, rc);
if (Debug) fprintf (stdout, "|%s|\n", BufferPtr);
return (rc);
}
#endif /* USE_OPENSSL */
/*****************************************************************************/
/*
Prevent the great unwashed from pillaging the treasures within!
*/
void NeedsPrivilegedAccount ()
{
static unsigned long PrivAcctMask [2] = { PRV$M_SETPRV | PRV$M_SYSPRV, 0 };
static long Pid = -1;
static unsigned long JpiAuthPriv [2];
static struct
{
unsigned short buf_len;
unsigned short item;
void *buf_addr;
void *ret_len;
}
JpiItems [] =
{
{ sizeof(JpiAuthPriv), JPI$_AUTHPRIV, &JpiAuthPriv, 0 },
{0,0,0,0}
};
int status;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "NeedsPrivilegedAccount()\n");
status = sys$getjpiw (0, &Pid, 0, &JpiItems, 0, 0, 0);
if (VMSnok (status)) exit (status);
if (!(JpiAuthPriv[0] & PrivAcctMask[0])) exit (SS$_NOSYSPRV);
}
/*****************************************************************************/
/*
Output and flush a record suitable for WASD to WATCH in callout mode.
*/
void WatchThis
(
int SourceCodeLine,
char *FormatString,
...
)
{
static unsigned long PrevBinTime [2];
static char TimeString [12];
static $DESCRIPTOR (TimeFaoDsc, "!2ZL:!2ZL:!2ZL.!2ZL\0");
static $DESCRIPTOR (TimeStringDsc, TimeString);
int argcnt;
unsigned long BinTime [2];
unsigned short NumTime [7];
va_list argptr;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "WatchThis()\n");
sys$gettim (&BinTime);
if (BinTime[0] != PrevBinTime[0] ||
BinTime[1] != PrevBinTime[1])
{
PrevBinTime[0] == BinTime[0];
PrevBinTime[1] == BinTime[1];
sys$numtim (&NumTime, &BinTime);
sys$fao (&TimeFaoDsc, NULL, &TimeStringDsc,
NumTime[3], NumTime[4], NumTime[5], NumTime[6]);
}
fprintf (stdout, "000 [%d] %s ", SourceCodeLine, TimeString);
va_count (argcnt);
va_start (argptr, FormatString);
vprintf (FormatString, argptr);
fputs ("\n", stdout);
fflush (stdout);
}
/*****************************************************************************/
/*
Return a pointer to a string showing the elapsed time (for WATCHing).
*/
char* WatchElapsed ()
{
static unsigned long StatTimerContext;
static unsigned long StatTimerElapsedTime = 1;
static char ElapsedTime [24];
static $DESCRIPTOR (ElapsedFaoDsc, "!%D\0");
static $DESCRIPTOR (ElapsedTimeDsc, ElapsedTime);
int status;
unsigned long ElapsedBinTime [2];
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "WatchElapsed()\n");
if (StatTimerContext)
{
status = lib$stat_timer (&StatTimerElapsedTime,
&ElapsedBinTime,
&StatTimerContext);
if (VMSnok (status)) exit (status);
sys$fao (&ElapsedFaoDsc, NULL, &ElapsedTimeDsc, &ElapsedBinTime);
memmove (ElapsedTime, ElapsedTime+5, 12);
status = lib$free_timer (&StatTimerContext);
if (VMSnok (status)) exit (status);
StatTimerContext = 0;
return (ElapsedTime);
}
/* initialize statistics timer */
status = lib$init_timer (&StatTimerContext);
if (VMSnok (status)) exit (status);
return (NULL);
}
/*****************************************************************************/
/*
Translate a logical name using LNM$FILE_DEV. Return a pointer to the value
string, or NULL if the name does not exist. If 'LogValue' is supplied the
logical name is translated into that (assumed to be large enough), otherwise
it's translated into an internal static buffer.
*/
char* SysTrnLnm
(
char *LogName,
char *LogValue
)
{
static unsigned short ShortLength;
static char StaticLogValue [256];
static $DESCRIPTOR (LogNameDsc, "");
static $DESCRIPTOR (LnmFileDevDsc, "LNM$FILE_DEV");
static struct {
short int buf_len;
short int item;
void *buf_addr;
unsigned short *ret_len;
} LnmItems [] =
{
{ 255, LNM$_STRING, 0, &ShortLength },
{ 0,0,0,0 }
};
int status;
char *cptr;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "SysTrnLnm() |%s|\n", LogName);
LogNameDsc.dsc$a_pointer = LogName;
LogNameDsc.dsc$w_length = strlen(LogName);
if (LogValue)
cptr = LnmItems[0].buf_addr = LogValue;
else
cptr = LnmItems[0].buf_addr = StaticLogValue;
status = sys$trnlnm (0, &LnmFileDevDsc, &LogNameDsc, 0, &LnmItems);
if (Debug) fprintf (stdout, "sys$trnlnm() %%X%08.08X\n", status);
if (!(status & 1))
{
if (Debug) fprintf (stdout, "|(null)|\n");
return (NULL);
}
cptr[ShortLength] = '\0';
if (Debug) fprintf (stdout, "|%s|\n", cptr);
return (cptr);
}
/*****************************************************************************/
/*
Parses the string passed to it as a 'command-line' with parameters and
qualifiers. Makes the real command-line and the authentication configuration
parameters look and behave in the same fashion.
*/
void GetRunTimeParameters
(
char *clptr,
BOOL FromCli
)
{
char ch;
char *aptr, *cptr, *sptr, *zptr;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "RunTimeParameters() |%s|\n", clptr);
aptr = NULL;
ch = *clptr;
for (;;)
{
if (aptr && *aptr == '/') *aptr = '\0';
if (!ch) break;
*clptr = ch;
if (Debug) fprintf (stdout, "clptr |%s|\n", clptr);
while (*clptr && isspace(*clptr)) *clptr++ = '\0';
aptr = clptr;
if (*clptr == '/') clptr++;
while (*clptr && !isspace (*clptr) && *clptr != '/')
{
if (*clptr != '\"')
{
clptr++;
continue;
}
cptr = clptr;
clptr++;
while (*clptr)
{
if (*clptr == '\"')
if (*(clptr+1) == '\"')
clptr++;
else
break;
*cptr++ = *clptr++;
}
*cptr = '\0';
if (*clptr) clptr++;
}
ch = *clptr;
if (*clptr) *clptr = '\0';
if (Debug) fprintf (stdout, "aptr |%s|\n", aptr);
if (!*aptr) continue;
if (FromCli && strsame (aptr, "/AUTH_PASSWORD=", 4))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (CliAuthPassword, cptr, sizeof(CliAuthPassword));
continue;
}
if (strsame (aptr, "/BASE=", 4))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (LdapBase, cptr, sizeof(LdapBase));
continue;
}
if (strsame (aptr, "/CERT=", 4))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (CertKeyFileName, cptr, sizeof(CertKeyFileName));
continue;
}
if (strsame (aptr, "/DATT=", 4))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (UserDisplayAttribute, cptr, sizeof(UserDisplayAttribute));
continue;
}
if (strsame (aptr, "/DIGEST", 4))
{
VerifyDigest = TRUE;
continue;
}
if (FromCli && strsame (aptr, "/DUMP", 4))
{
DoDump = TRUE;
continue;
}
if (FromCli && strsame (aptr, "/DBUG", -1))
{
Debug = TRUE;
continue;
}
if (strsame (aptr, "/FILTER=", 4))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (LdapFilter, cptr, sizeof(LdapFilter));
continue;
}
if (strsame (aptr, "/HOST=", 4) ||
strsame (aptr, "/SERVER=", 4))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (LdapHost, cptr, sizeof(LdapHost));
for (cptr = LdapHost; *cptr && *cptr != ':'; cptr++);
if (*cptr)
{
*cptr++ = '\0';
if (isdigit(*cptr)) LdapPort = (short)atoi(cptr);
}
continue;
}
if (strsame (aptr, "/LOCAL", 4))
{
VerifyLocal = TRUE;
continue;
}
if (strsame (aptr, "/PATT=", 5))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (PasswordAttribute, cptr, sizeof(PasswordAttribute));
continue;
}
if (strsame (aptr, "/PORT=", 4))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (*cptr) cptr++;
LdapPort = (short)atoi(cptr);
continue;
}
if (FromCli && strsame (aptr, "/REMOTE_USER=", 4))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (CliRemoteUser, cptr, sizeof(CliRemoteUser));
continue;
}
if (strsame (aptr, "/RESET", 4))
{
DoDump =
VerifySYSUAF =
VerifyDigest = FALSE;
LdapPort = LdapSSL = StartTLS = 0;
LdapProtocolVersion = LDAP_VERSION3;
CertKeyFileName[0] =
CliAuthPassword[0] =
CliRemoteUser[0] =
LdapBase[0] =
LdapFilter[0] =
LdapHost[0] =
LdapSimpleBindDn[0] =
LdapSimpleBindPasswd[0] =
PasswordAttribute[0] =
UserDisplayAttribute[0] =
UserNameDefault[0] =
UserNameAttribute[0] = '\0';
strcpy (PasswordAttribute, DEFAULT_ATTRIBUTE_PASSWORD);
strcpy (UserDisplayAttribute, DEFAULT_ATTRIBUTE_DISPLAY);
strcpy (UserNameAttribute, DEFAULT_ATTRIBUTE_USERNAME);
continue;
}
if (strsame (aptr, "/SIMPLE=", 4))
{
LdapSimpleBind = TRUE;
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (LdapSimpleBindDn, cptr, sizeof(LdapSimpleBindDn));
for (cptr = LdapSimpleBindDn; *cptr && *cptr != ':'; cptr++)
if (*cptr == '\\') RemoveSlash (cptr);
if (*cptr)
{
*cptr++ = '\0';
strzcpy (LdapSimpleBindPasswd, cptr, sizeof(LdapSimpleBindPasswd));
for (cptr = LdapSimpleBindPasswd; *cptr && *cptr != ':'; cptr++)
if (*cptr == '\\') RemoveSlash (cptr);
}
continue;
}
if (strsame (aptr, "/SSL=", 4))
{
LdapSSL = 1; /* the default; TLSv1 */
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
LdapSSL = atoi(cptr);
continue;
}
if (strsame (aptr, "/TLS=", 4))
{
StartTLS = 1; /* the default; TLSv1 */
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
StartTLS = atoi(cptr);
continue;
}
if (strsame (aptr, "/SYSUAF", 4))
{
VerifySYSUAF = TRUE;
continue;
}
if (strsame (aptr, "/UDEF=", 4))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (UserNameDefault, cptr, sizeof(UserNameDefault));
continue;
}
if (strsame (aptr, "/UATT=", 4))
{
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
strzcpy (UserNameAttribute, cptr, sizeof(UserNameAttribute));
continue;
}
if (strsame (aptr, "/VERSION=", 4))
{
LdapProtocolVersion = LDAP_VERSION3;
for (cptr = aptr; *cptr && *cptr != '='; cptr++);
if (!*cptr) continue;
cptr++;
LdapProtocolVersion = atoi(cptr);
continue;
}
if (FromCli && strsame (aptr, "/WATCH", -1))
{
DebugWatch = TRUE;
continue;
}
if (FromCli)
{
if (*aptr == '/')
{
fprintf (stdout, "%%%s-E-IVQUAL, unrecognized qualifier\n \\%s\\\n",
Utility, aptr+1);
exit (STS$K_ERROR | STS$M_INHIB_MSG);
}
else
{
fprintf (stdout, "%%%s-E-MAXPARM, too many parameters\n \\%s\\\n",
Utility, aptr);
exit (STS$K_ERROR | STS$M_INHIB_MSG);
}
}
}
}
/*****************************************************************************/
/*
Get "command-line" parameters, whether from the command-line.
*/
void GetParameters ()
{
static char CommandLine [512];
static unsigned long Flags = 0;
int status;
unsigned short Length;
$DESCRIPTOR (CommandLineDsc, CommandLine);
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "GetParameters()\n");
/* get the entire command line following the verb */
status = lib$get_foreign (&CommandLineDsc, 0, &Length, &Flags);
if (VMSnok (status)) exit (status);
CommandLine[Length] = '\0';
GetRunTimeParameters (CommandLine, TRUE);
}
/****************************************************************************/
/*
Remove the '\' for slash-escaped characters by shuffling all the remaining
characters left. Elementary but enough for this.
*/
void RemoveSlash (char *cptr)
{
char *sptr;
/*********/
/* begin */
/*********/
if (!*(sptr = cptr+1)) return;
while (*sptr) *cptr++ = *sptr++;
*cptr = '\0';
}
/****************************************************************************/
/*
Copy a string without overflow (or indication of it :-).
*/
int strzcpy
(
char *String,
char *cptr,
int SizeOfString
)
{
char *sptr, *zptr;
/*********/
/* begin */
/*********/
if (SizeOfString) SizeOfString--;
zptr = (sptr = String) + SizeOfString;
while (*cptr && sptr < zptr) *sptr++ = *cptr++;
*sptr = '\0';
return (sptr - String);
}
/****************************************************************************/
/*
Does a case-insensitive, character-by-character string compare and returns
TRUE if two strings are the same, or FALSE if not. If a maximum number of
characters are specified only those will be compared, if the entire strings
should be compared then specify the number of characters as 0.
*/
BOOL strsame
(
char *sptr1,
char *sptr2,
int count
)
{
/*********/
/* begin */
/*********/
while (*sptr1 && *sptr2)
{
if (toupper (*sptr1++) != toupper (*sptr2++)) return (FALSE);
if (count)
if (!--count) return (TRUE);
}
if (*sptr1 || *sptr2)
return (FALSE);
else
return (TRUE);
}
/*****************************************************************************/