From f1eab726c10be66e94f6984418babfa9d68993b0 Mon Sep 17 00:00:00 2001
From: Russ Allbery <rra@stanford.edu>
Date: Tue, 3 Apr 2012 20:40:01 -0700
Subject: Add initial LDAP attribute ACL verifier

A new ACL type, ldap-attr (Wallet::ACL::LDAP::Attribute), is now
supported.  This ACL type grants access if the LDAP entry
corresponding to the principal contains the attribute name and value
specified in the ACL.  The Net::LDAP and Authen::SASL Perl modules are
required to use this ACL type.  New configuration settings are
required as well; see Wallet::Config for more information.  To enable
this ACL type for an existing wallet database, use wallet-admin to
register the new verifier.
---
 perl/Wallet/ACL/LDAP/Attribute.pm | 258 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 258 insertions(+)
 create mode 100644 perl/Wallet/ACL/LDAP/Attribute.pm

(limited to 'perl/Wallet/ACL/LDAP')

diff --git a/perl/Wallet/ACL/LDAP/Attribute.pm b/perl/Wallet/ACL/LDAP/Attribute.pm
new file mode 100644
index 0000000..7a54546
--- /dev/null
+++ b/perl/Wallet/ACL/LDAP/Attribute.pm
@@ -0,0 +1,258 @@
+# Wallet::ACL::LDAP::Attribute -- Wallet LDAP attribute ACL verifier.
+#
+# Written by Russ Allbery
+# Copyright 2012
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# See LICENSE for licensing terms.
+
+##############################################################################
+# Modules and declarations
+##############################################################################
+
+package Wallet::ACL::LDAP::Attribute;
+require 5.006;
+
+use strict;
+use vars qw(@ISA $VERSION);
+
+use Authen::SASL ();
+use Net::LDAP qw(LDAP_COMPARE_TRUE);
+use Wallet::ACL::Base;
+
+@ISA = qw(Wallet::ACL::Base);
+
+# This version should be increased on any code change to this module.  Always
+# use two digits for the minor version with a leading zero if necessary so
+# that it will sort properly.
+$VERSION = '0.01';
+
+##############################################################################
+# Interface
+##############################################################################
+
+# Create a new persistant verifier.  Load the Net::LDAP module and open a
+# persistant LDAP server connection that we'll use for later calls.
+sub new {
+    my $type = shift;
+    my $host = $Wallet::Config::LDAP_HOST;
+    my $base = $Wallet::Config::LDAP_BASE;
+    unless ($host and defined ($base) and $Wallet::Config::LDAP_CACHE) {
+        die "LDAP attribute ACL support not configured\n";
+    }
+
+    # Ensure the required Perl modules are available and bind to the directory
+    # server.  Catch any errors with a try/catch block.
+    my $ldap;
+    eval {
+        local $ENV{KRB5CCNAME} = $Wallet::Config::LDAP_CACHE;
+        my $sasl = Authen::SASL->new (mechanism => 'GSSAPI');
+        $ldap = Net::LDAP->new ($host, onerror => 'die');
+        my $mesg = eval { $ldap->bind (undef, sasl => $sasl) };
+    };
+    if ($@) {
+        my $error = $@;
+        chomp $error;
+        1 while ($error =~ s/ at \S+ line \d+\.?\z//);
+        die "LDAP attribute ACL support not available: $error\n";
+    }
+
+    # We successfully bound, so create our object and return it.
+    my $self = { ldap => $ldap };
+    bless ($self, $type);
+    return $self;
+}
+
+# Check whether a given principal has the required LDAP attribute.  We first
+# map the principal to a DN by doing a search for that principal (and bailing
+# if we get more than one entry).  Then, we do a compare to see if that DN has
+# the desired attribute and value.
+#
+# If the ldap_map_principal sub is defined in Wallet::Config, call it on the
+# principal first to map it to the value for which we'll search.
+#
+# The connection is configured to die on any error, so we do all the work in a
+# try/catch block to report errors.
+sub check {
+    my ($self, $principal, $acl) = @_;
+    undef $self->{error};
+    unless ($principal) {
+        $self->error ('no principal specified');
+        return;
+    }
+    my ($attr, $value);
+    if ($acl) {
+        ($attr, $value) = split ('=', $acl, 2);
+    }
+    unless (defined ($attr) and defined ($value)) {
+        $self->error ('malformed ldap-attr ACL');
+        return;
+    }
+    my $ldap = $self->{ldap};
+
+    # Map the principal name to an attribute value for our search if we're
+    # doing a custom mapping.
+    if (defined &Wallet::Config::ldap_map_principal) {
+        eval { $principal = Wallet::Config::ldap_map_principal ($principal) };
+        if ($@) {
+            $self->error ("mapping principal to LDAP failed: $@");
+            return;
+        }
+    }
+
+    # Now, map the user to a DN by doing a search.
+    my $entry;
+    eval {
+        my $fattr = $Wallet::Config::LDAP_FILTER_ATTR || 'krb5PrincipalName';
+        my $filter = "($fattr=$principal)";
+        my $base = $Wallet::Config::LDAP_BASE;
+        my @options = (base => $base, filter => $filter, attrs => [ 'dn' ]);
+        my $search = $ldap->search (@options);
+        if ($search->count == 1) {
+            $entry = $search->pop_entry;
+        } elsif ($search->count > 1) {
+            die $search->count . " LDAP entries found for $principal";
+        }
+    };
+    if ($@) {
+        $self->error ("cannot search for $principal in LDAP: $@");
+        return;
+    }
+    return 0 unless $entry;
+
+    # We have a user entry.  We can now check whether that user has the
+    # desired attribute and value.
+    my $result;
+    eval {
+        my $mesg = $ldap->compare ($entry, attr => $attr, value => $value);
+        $result = $mesg->code;
+    };
+    if ($@) {
+        $self->error ("cannot check LDAP attribute $attr for $principal: $@");
+        return;
+    }
+    return ($result == LDAP_COMPARE_TRUE) ? 1 : 0;
+}
+
+1;
+
+##############################################################################
+# Documentation
+##############################################################################
+
+=for stopwords
+ACL Allbery
+
+=head1 NAME
+
+Wallet::ACL::LDAP::Attribute - Wallet ACL verifier for LDAP attribute compares
+
+=head1 SYNOPSIS
+
+    my $verifier = Wallet::ACL::LDAP::Attribute->new;
+    my $status = $verifier->check ($principal, "$attr=$value");
+    if (not defined $status) {
+        die "Something failed: ", $verifier->error, "\n";
+    } elsif ($status) {
+        print "Access granted\n";
+    } else {
+        print "Access denied\n";
+    }
+
+=head1 DESCRIPTION
+
+Wallet::ACL::LDAP::Attribute checks whether the LDAP record for the entry
+corresponding to a principal contains an attribute with a particular
+value.  It is used to verify ACL lines of type C<ldap-attr>.  The value of
+such an ACL is an attribute followed by an equal sign and a value, and the
+ACL grants access to a given principal if and only if the LDAP entry for
+that principal has that attribute set to that value.
+
+To use this object, several configuration parameters must be set.  See
+L<Wallet::Config> for details on those configuration parameters and
+information about how to set wallet configuration.
+
+=head1 METHODS
+
+=item new()
+
+Creates a new ACL verifier.  Opens and binds the connection to the LDAP
+server.
+
+=item check(PRINCIPAL, ACL)
+
+Returns true if PRINCIPAL is granted access according to ACL, false if
+not, and undef on an error (see L<"DIAGNOSTICS"> below).  ACL must be an
+attribute name and a value, separated by an equal sign (with no
+whitespace).  PRINCIPAL will be granted access if its LDAP entry contains
+that attribute with that value.
+
+=item error()
+
+Returns the error if check() returned undef.
+
+=back
+
+=head1 DIAGNOSTICS
+
+The new() method may fail with one of the following exceptions:
+
+=item LDAP attribute ACL support not available: %s
+
+Attempting to connect or bind to the LDAP server failed.
+
+=item LDAP attribute ACL support not configured
+
+The required configuration parameters were not set.  See Wallet::Config(3)
+for the required configuration parameters and how to set them.
+
+=back
+
+Verifying an LDAP attribute ACL may fail with the following errors
+(returned by the error() method):
+
+=over 4
+
+=item cannot check LDAP attribute %s for %s: %s
+
+The LDAP compare to check for the required attribute failed.  The
+attribute may have been misspelled, or there may be LDAP directory
+permission issues.  This error indicates that PRINCIPAL's entry was
+located in LDAP, but the check failed during the compare to verify the
+attribute value.
+
+=item cannot search for %s in LDAP: %s
+
+Searching for PRINCIPAL (possibly after ldap_map_principal() mapping)
+failed.  This is often due to LDAP directory permissions issues.  This
+indicates a failure during the mapping of PRINCIPAL to an LDAP DN.
+
+=item malformed ldap-attr ACL
+
+The ACL parameter to check() was malformed.  Usually this means that
+either the attribute or the value were empty or the required C<=> sign
+separating them was missing.
+
+=item mapping principal to LDAP failed: %s
+
+There was an ldap_map_principal() function defined in the wallet
+configuration, but calling it for the PRINCIPAL argument failed.
+
+=item no principal specified
+
+The PRINCIPAL parameter to check() was undefined or the empty string.
+
+=back
+
+=head1 SEE ALSO
+
+Wallet::ACL(3), Wallet::ACL::Base(3), Wallet::Config(3), wallet-backend(8)
+
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
+
+=head1 AUTHOR
+
+Russ Allbery <rra@stanford.edu>
+
+=cut
-- 
cgit v1.2.3


From fef66a4c6ca0c452ce9af641469c831e36399c19 Mon Sep 17 00:00:00 2001
From: Russ Allbery <rra@stanford.edu>
Date: Thu, 30 Aug 2012 14:57:10 -0700
Subject: Fix POD stopwords and formatting

Fix a formatting error in Wallet::ACL::LDAP::Attribute and add new
stopwords required by the latest aspell.
---
 perl/Wallet/ACL.pm                | 2 +-
 perl/Wallet/ACL/Base.pm           | 2 +-
 perl/Wallet/ACL/Krb5.pm           | 2 +-
 perl/Wallet/ACL/Krb5/Regex.pm     | 2 +-
 perl/Wallet/ACL/LDAP/Attribute.pm | 6 +++++-
 perl/Wallet/ACL/NetDB.pm          | 2 +-
 perl/Wallet/ACL/NetDB/Root.pm     | 2 +-
 perl/Wallet/Admin.pm              | 2 +-
 perl/Wallet/Config.pm             | 2 +-
 perl/Wallet/Kadmin/Heimdal.pm     | 2 +-
 perl/Wallet/Kadmin/MIT.pm         | 1 +
 perl/Wallet/Object/Base.pm        | 2 +-
 perl/Wallet/Object/Keytab.pm      | 2 +-
 perl/Wallet/Schema.pm             | 2 +-
 perl/Wallet/Server.pm             | 2 +-
 15 files changed, 19 insertions(+), 14 deletions(-)

(limited to 'perl/Wallet/ACL/LDAP')

diff --git a/perl/Wallet/ACL.pm b/perl/Wallet/ACL.pm
index 44a82b2..2a06442 100644
--- a/perl/Wallet/ACL.pm
+++ b/perl/Wallet/ACL.pm
@@ -442,7 +442,7 @@ __END__
 Wallet::ACL - Implementation of ACLs in the wallet system
 
 =for stopwords
-ACL DBH metadata HOSTNAME DATETIME timestamp Allbery
+ACL DBH metadata HOSTNAME DATETIME timestamp Allbery verifier verifiers
 
 =head1 SYNOPSIS
 
diff --git a/perl/Wallet/ACL/Base.pm b/perl/Wallet/ACL/Base.pm
index 9a8a3cb..85eaefa 100644
--- a/perl/Wallet/ACL/Base.pm
+++ b/perl/Wallet/ACL/Base.pm
@@ -60,7 +60,7 @@ __END__
 ##############################################################################
 
 =for stopwords
-ACL Allbery
+ACL Allbery verifier verifiers
 
 =head1 NAME
 
diff --git a/perl/Wallet/ACL/Krb5.pm b/perl/Wallet/ACL/Krb5.pm
index 496fcf0..12be141 100644
--- a/perl/Wallet/ACL/Krb5.pm
+++ b/perl/Wallet/ACL/Krb5.pm
@@ -51,7 +51,7 @@ __END__
 ##############################################################################
 
 =for stopwords
-ACL krb5 Allbery
+ACL krb5 Allbery verifier
 
 =head1 NAME
 
diff --git a/perl/Wallet/ACL/Krb5/Regex.pm b/perl/Wallet/ACL/Krb5/Regex.pm
index 52f4bf5..8f9702e 100644
--- a/perl/Wallet/ACL/Krb5/Regex.pm
+++ b/perl/Wallet/ACL/Krb5/Regex.pm
@@ -56,7 +56,7 @@ __END__
 ##############################################################################
 
 =for stopwords
-ACL krb5-regex Durkacz Allbery
+ACL krb5-regex Durkacz Allbery verifier
 
 =head1 NAME
 
diff --git a/perl/Wallet/ACL/LDAP/Attribute.pm b/perl/Wallet/ACL/LDAP/Attribute.pm
index 7a54546..802c710 100644
--- a/perl/Wallet/ACL/LDAP/Attribute.pm
+++ b/perl/Wallet/ACL/LDAP/Attribute.pm
@@ -141,7 +141,7 @@ sub check {
 ##############################################################################
 
 =for stopwords
-ACL Allbery
+ACL Allbery verifier LDAP PRINCIPAL's DN ldap-attr
 
 =head1 NAME
 
@@ -174,6 +174,8 @@ information about how to set wallet configuration.
 
 =head1 METHODS
 
+=over 4
+
 =item new()
 
 Creates a new ACL verifier.  Opens and binds the connection to the LDAP
@@ -197,6 +199,8 @@ Returns the error if check() returned undef.
 
 The new() method may fail with one of the following exceptions:
 
+=over 4
+
 =item LDAP attribute ACL support not available: %s
 
 Attempting to connect or bind to the LDAP server failed.
diff --git a/perl/Wallet/ACL/NetDB.pm b/perl/Wallet/ACL/NetDB.pm
index 0fb5a2c..0aa8958 100644
--- a/perl/Wallet/ACL/NetDB.pm
+++ b/perl/Wallet/ACL/NetDB.pm
@@ -136,7 +136,7 @@ __END__
 ##############################################################################
 
 =for stopwords
-ACL NetDB remctl DNS DHCP Allbery netdb
+ACL NetDB remctl DNS DHCP Allbery netdb verifier
 
 =head1 NAME
 
diff --git a/perl/Wallet/ACL/NetDB/Root.pm b/perl/Wallet/ACL/NetDB/Root.pm
index 3aeebda..c28bb1e 100644
--- a/perl/Wallet/ACL/NetDB/Root.pm
+++ b/perl/Wallet/ACL/NetDB/Root.pm
@@ -49,7 +49,7 @@ sub check {
 ##############################################################################
 
 =for stopwords
-ACL NetDB DNS DHCP Allbery
+ACL NetDB DNS DHCP Allbery verifier
 
 =head1 NAME
 
diff --git a/perl/Wallet/Admin.pm b/perl/Wallet/Admin.pm
index 8fb49af..a1aef83 100644
--- a/perl/Wallet/Admin.pm
+++ b/perl/Wallet/Admin.pm
@@ -178,7 +178,7 @@ __DATA__
 Wallet::Admin - Wallet system administrative interface
 
 =for stopwords
-ACL hostname Allbery
+ACL hostname Allbery verifier
 
 =head1 SYNOPSIS
 
diff --git a/perl/Wallet/Config.pm b/perl/Wallet/Config.pm
index 1a74506..cd4e569 100644
--- a/perl/Wallet/Config.pm
+++ b/perl/Wallet/Config.pm
@@ -27,7 +27,7 @@ Wallet::Config - Configuration handling for the wallet server
 DBI DSN SQLite subdirectories KEYTAB keytab kadmind KDC add-ons kadmin DNS
 SRV kadmin keytabs remctl backend lowercased NETDB ACL NetDB unscoped
 usernames rekey hostnames Allbery wallet-backend keytab-backend Heimdal
-rekeys
+rekeys WebAuth WEBAUTH keyring LDAP DN GSS-API
 
 =head1 SYNOPSIS
 
diff --git a/perl/Wallet/Kadmin/Heimdal.pm b/perl/Wallet/Kadmin/Heimdal.pm
index 658ac04..6c91b1d 100644
--- a/perl/Wallet/Kadmin/Heimdal.pm
+++ b/perl/Wallet/Kadmin/Heimdal.pm
@@ -234,7 +234,7 @@ __END__
 ##############################################################################
 
 =for stopwords
-keytabs keytab kadmin KDC API Allbery Heimdal
+keytabs keytab kadmin KDC API Allbery Heimdal unlinked
 
 =head1 NAME
 
diff --git a/perl/Wallet/Kadmin/MIT.pm b/perl/Wallet/Kadmin/MIT.pm
index fc4d271..c191bc9 100644
--- a/perl/Wallet/Kadmin/MIT.pm
+++ b/perl/Wallet/Kadmin/MIT.pm
@@ -256,6 +256,7 @@ __END__
 
 =for stopwords
 rekeying rekeys remctl backend keytabs keytab kadmin KDC API Allbery
+unlinked
 
 =head1 NAME
 
diff --git a/perl/Wallet/Object/Base.pm b/perl/Wallet/Object/Base.pm
index 556cb27..87506f4 100644
--- a/perl/Wallet/Object/Base.pm
+++ b/perl/Wallet/Object/Base.pm
@@ -695,7 +695,7 @@ Wallet::Object::Base - Generic parent class for wallet objects
 
 =for stopwords
 DBH HOSTNAME DATETIME ACL backend metadata timestamp Allbery wallet-backend
-backend-specific
+backend-specific subclasses
 
 =head1 SYNOPSIS
 
diff --git a/perl/Wallet/Object/Keytab.pm b/perl/Wallet/Object/Keytab.pm
index b7c2805..fd3001f 100644
--- a/perl/Wallet/Object/Keytab.pm
+++ b/perl/Wallet/Object/Keytab.pm
@@ -347,7 +347,7 @@ __END__
 
 =for stopwords
 keytab API KDC keytabs HOSTNAME DATETIME enctypes enctype DBH metadata
-unmanaged kadmin Allbery
+unmanaged kadmin Allbery unlinked
 
 =head1 NAME
 
diff --git a/perl/Wallet/Schema.pm b/perl/Wallet/Schema.pm
index 5c6b9ca..9a7fe44 100644
--- a/perl/Wallet/Schema.pm
+++ b/perl/Wallet/Schema.pm
@@ -171,7 +171,7 @@ Wallet::Schema - Database schema for the wallet system
 
 =for stopwords
 SQL ACL API APIs enums Enums Keytab Backend keytab backend enctypes
-enctype Allbery Metadata metadata
+enctype Allbery Metadata metadata verifier
 
 =head1 SYNOPSIS
 
diff --git a/perl/Wallet/Server.pm b/perl/Wallet/Server.pm
index 7b3fb8f..b2bae2c 100644
--- a/perl/Wallet/Server.pm
+++ b/perl/Wallet/Server.pm
@@ -753,7 +753,7 @@ Wallet::Server - Wallet system server implementation
 
 =for stopwords
 keytabs metadata backend HOSTNAME ACL timestamp ACL's nul Allbery
-backend-specific wallet-backend
+backend-specific wallet-backend verifier
 
 =head1 SYNOPSIS
 
-- 
cgit v1.2.3