diff -uNra NewsCache-1.2rc6/acconfig.h NewsCache/acconfig.h --- NewsCache-1.2rc6/acconfig.h 2004-06-15 20:41:04.000000000 +0200 +++ NewsCache/acconfig.h 2006-08-09 13:24:53.000000000 +0200 @@ -25,6 +25,7 @@ #undef WITH_UNIQUE_PACKAGE_NAME #undef WITH_LIBGPP #undef WITH_SYSLOG +#undef WITH_LDAP #undef WITH_EXCEPTIONS #undef SYSCONFDIR #ifdef WITH_EXCEPTIONS diff -uNra NewsCache-1.2rc6/configure.in NewsCache/configure.in --- NewsCache-1.2rc6/configure.in 2004-09-28 21:10:47.000000000 +0200 +++ NewsCache/configure.in 2006-08-09 13:24:53.000000000 +0200 @@ -5,7 +5,7 @@ AM_CONFIG_HEADER(config.h) dnl Initialize automake stuff -AM_INIT_AUTOMAKE(NewsCache, 1.2rc6) +AM_INIT_AUTOMAKE(NewsCache, 1.2rc7) AC_DEFUN([AC_PROG_CXX_EXCEPTIONS],[]) @@ -96,6 +96,14 @@ fi, ) +AC_ARG_WITH(ldap, [ --with-ldap with ldap check [default=no]], +if eval " test x$with_uniquenames = xno"; then + AC_DEFINE(WITH_LDAP) + fi, +) + + + AC_DEFINE(PACKAGE_NEWSCACHECLEAN,"NewsCacheClean") AC_DEFINE(PACKAGE_UPDATENEWS,"updatenews") @@ -296,6 +304,11 @@ with_shadow=yes fi +if eval "test x$with_ldap = xyes"; then + AC_CHECK_LIB(ldap, ldap_open, LIBS="$LIBS -lldap", + AC_MSG_RESULT([Can't find libldap]);exit 1) +fi + dnl **************************************************************** dnl Generate output files diff -uNra NewsCache-1.2rc6/README NewsCache/README --- NewsCache-1.2rc6/README 2004-06-15 20:41:04.000000000 +0200 +++ NewsCache/README 2006-08-09 14:31:45.000000000 +0200 @@ -113,3 +113,14 @@ The latest release is always available from http://members.aon.at/hstraub/linux/newscache/ + + +Das ist die Open-News-Network Version mit ldap Support. +benötigt libldap +In der newscache.conf ist dann folgender Eintrag möglich + Default { + Authentication ldap:auth.open-news-network.org:debug + + } + + diff -uNra NewsCache-1.2rc6/src/ldapconfig.h NewsCache/src/ldapconfig.h --- NewsCache-1.2rc6/src/ldapconfig.h 1970-01-01 01:00:00.000000000 +0100 +++ NewsCache/src/ldapconfig.h 2006-08-09 13:24:53.000000000 +0200 @@ -0,0 +1,13 @@ +/* change these for your setup */ +#define LDAPSEARCH_BASE "dc=open-news-network,dc=org" + +#define LDAPPORT 389 +/* this is what stdin gets from newsreader */ +#define NAMESTR "ClientAuthname: " +#define PASSSTR "ClientPassword: " + +#ifdef LDAP_SUCCESS +#undef LDAP_SUCCESS +#endif +#define LDAP_SUCCESS 0 +extern "C" LDAP *ldap_open(LDAP_CONST char *ldaphost, int portno); diff -uNra NewsCache-1.2rc6/src/NewsCache.cc NewsCache/src/NewsCache.cc --- NewsCache-1.2rc6/src/NewsCache.cc 2004-06-28 10:49:25.000000000 +0200 +++ NewsCache/src/NewsCache.cc 2006-08-09 14:31:45.000000000 +0200 @@ -80,9 +80,27 @@ #ifdef WITH_UNIQUE_PACKAGE_NAME "--with-uniquenames", #endif +#ifdef WITH_LDAP + "--with-ldap", +#endif NULL }; +//#ifdef WITH_LDAP +#include +#include +#include +#include +#include +#include "ldapconfig.h" + +extern "C" int ldap_simple_bind_s(LDAP *ld, LDAP_CONST char *dn, LDAP_CONST char *passwd); +extern "C" int ldap_bind(LDAP *ld, LDAP_CONST char *dn, LDAP_CONST char *cred, int method); +extern "C" int ldap_bind_s(LDAP *ld, LDAP_CONST char *dn, LDAP_CONST char *cred, int method); + + +//#endif + using namespace std; #ifdef HAVE_LIBWRAP @@ -440,6 +458,46 @@ return NULL; } + +//#ifdef WITH_LDAP +int ldap_pwd_ok ( const char *ldaphost, char *user, char *passwd) { + //char ldaphost[]="localhost"; + LDAP * ld; + int port = LDAP_PORT; + char * base_dn = LDAPSEARCH_BASE; + char userdn[512]; + + snprintf(userdn, 511, "uid=%s,%s", user, base_dn); + + if (( ld = ldap_open( ldaphost,port)) == NULL ) { + slog.p(Logger::Debug) << "cannot open " + << ldaphost + << "for authbind \n"; + return(0); + } + + slog.p(Logger::Debug) << " binding as " + << userdn + << " at " + << ldaphost + << "\n"; + + if ( ldap_simple_bind_s( ld, userdn, passwd ) != LDAP_SUCCESS ) { + /* invalid credentials */ + /*ldap_perror( ld, "ldap_fsearch" );*/ + slog.p(Logger::Debug) << user + << " not authenticated with " + << passwd + << "\n"; + return(0); + } + return(1); +} +//#endif /* WITH_LDAP */ + + + + int auto_cryptcheck(const char *key, const char *pass) { #ifdef MD5_AUTO @@ -505,6 +563,38 @@ return 0; } +/** +* check_auth_ldap code by Arnold Schiller schiller@babsi.de +* need +* ldap_pwd_ok.c written over a crate of beer by Keith Lewis (monash.edu.au) +* +**/ +//#ifdef WITH_LDAP +int check_auth_ldap (ClientData *clt) +{ + AccessEntry *access_entry = clt->access_entry; + string type("ldap:"); + + if (access_entry->authentication.typeEqual (type)) + return -1; + string ldaphost = access_entry->authentication.getField(1); + string user = clt->auth_user; + string pass = clt->auth_pass; + if(ldap_pwd_ok(ldaphost.c_str(), clt->auth_user, clt->auth_pass)) { + slog.p(Logger::Info) << "check_auth_ldap valid passwd User: " + << clt->auth_user << "\n"; + return 0; + }else{ + slog.p(Logger::Info) << "check_auth_ldap invalid passwd User: " + << clt->auth_user << "\n"; + return -1; + } + return 0; + + +} +//#endif /* WITH_LDAP */ + int check_auth_file (ClientData *clt) { AccessEntry *access_entry = clt->access_entry; @@ -748,6 +838,13 @@ return check_auth_pam (clt); } #endif /* #ifndef PAM_AUTH */ + else if (!strncmp + ((access_entry->authentication.getType()).c_str(), + "ldap", 3)) { + return check_auth_ldap (clt); + } + + // auth_{deny,none} is handled in nnrpd() return -1; }