Yubico Forum

static int
validate_user_token_ldap (const char *ldapserver,
                          const char *ldapdn, const char *user_attr,
                          const char *yubi_attr, const char *user,
                          const char *token_id)
{

  int retval = 0;
#ifdef HAVE_LIBLDAP
  LDAP *ld;
  LDAPMessage *result, *e;
  BerElement *ber;
  char *a;
  struct berval **vals;
  int i, rc;
  /* FIXME: dont' use hard coded buffers here. */
  char find[256] = "";
  char sr[128] = "(";
  char sep[2] = ",";
  char eq[2] = "=";
  char sren[4] = "=*)";



  strcat (find, user_attr);
  strcat (find, eq);
  strcat (find, user);
  strcat (find, sep);
  strcat (find, ldapdn);

  strcat (sr, yubi_attr);
  strcat (sr, sren);

 
  /* Get a handle to an LDAP connection. */
  if (ldap_initialize(&ld,ldapserver) != NULL)
    {
      D (("ldap_init"));
      return (0);
    }

  /* Bind anonymously to the LDAP server. */
  rc = ldap_simple_bind_s (ld, NULL, NULL);

  if (rc != LDAP_SUCCESS)
    {
      D (("ldap_simple_bind_s: %s", ldap_err2string (rc)));
      return (0);
    }
 
  /* Search for the entry. */
  D (("ldap-dn: %s", find));
  D (("ldap-filter: %s", sr));

  if ((rc = ldap_search_ext_s (ld, find, LDAP_SCOPE_BASE,
                               sr, NULL, 0, NULL, NULL, LDAP_NO_LIMIT,
                               LDAP_NO_LIMIT, &result)) != LDAP_SUCCESS)
    {
      D (("ldap_search_ext_s: %s", ldap_err2string (rc)));

      return (0);
    }
  e = ldap_first_entry (ld, result);
  if (e != NULL)
    {

      /* Iterate through each attribute in the entry. */
      for (a = ldap_first_attribute (ld, e, &ber);
           a != NULL; a = ldap_next_attribute (ld, e, ber))
        {
          if ((vals = ldap_get_values_len (ld, e, a)) != NULL)
            {
              for (i = 0; vals[i] != NULL; i++)
                {
                  if (!strncmp (token_id, vals[i]->bv_val, strlen (token_id)))
                    {
                      D (("Token Found :: %s", vals[i]->bv_val));
                      retval = 1;
                    }
                }
              ldap_value_free (vals);
            }
          ldap_memfree (a);
        }
      if (ber != NULL)
        {
          ber_free (ber, 0);
        }

    }

  ldap_msgfree (result);
  ldap_unbind (ld);
#else
  D (("Trying to use LDAP, but this function is not compiled in pam_yubico!!"));
  D (("Install libldap-dev and then recompile pam_yubico."));
#endif
  return retval;
}