00001
00002
00003
00004
00005
00006 #include "gsiAuthRequest.h"
00007 #include "authResponse.h"
00008 #include "genQuery.h"
00009 #include "reGlobalsExtern.h"
00010
00011 static int gsiAuthReqStatus=0;
00012 static int gsiAuthReqError=0;
00013 static char gsiAuthReqErrorMsg[1000];
00014
00015 int
00016 rsGsiAuthRequest (rsComm_t *rsComm, gsiAuthRequestOut_t **gsiAuthRequestOut)
00017 {
00018 int status;
00019
00020 if (gsiAuthReqStatus==1) {
00021 gsiAuthReqStatus=0;
00022 if (gsiAuthReqError != 0) {
00023 rodsLogAndErrorMsg( LOG_NOTICE, &rsComm->rError, gsiAuthReqError,
00024 gsiAuthReqErrorMsg);
00025 }
00026 return gsiAuthReqError;
00027 }
00028
00029 *gsiAuthRequestOut = (gsiAuthRequestOut_t *)malloc(sizeof(gsiAuthRequestOut_t));
00030 memset((char *)*gsiAuthRequestOut, 0, sizeof(gsiAuthRequestOut_t));
00031
00032 #if defined(GSI_AUTH)
00033 status = igsiSetupCreds(NULL, rsComm, NULL, &(*gsiAuthRequestOut)->serverDN);
00034 if (status==0) {
00035 rsComm->gsiRequest=1;
00036 }
00037 return(status);
00038 #else
00039 status = GSI_NOT_BUILT_INTO_SERVER;
00040 rodsLog (LOG_ERROR,
00041 "rsGsiAuthRequest failed GSI_NOT_BUILT_INTO_SERVER, status = %d",
00042 status);
00043 return (status);
00044 #endif
00045
00046 }
00047
00048 int igsiServersideAuth(rsComm_t *rsComm) {
00049 int status;
00050 #if defined(GSI_AUTH)
00051 char clientName[500];
00052 genQueryInp_t genQueryInp;
00053 genQueryOut_t *genQueryOut;
00054 char condition1[MAX_NAME_LEN];
00055 char condition2[MAX_NAME_LEN];
00056 char *tResult;
00057 int privLevel;
00058 int clientPrivLevel;
00059 int noNameMode;
00060 int statusRule;
00061 #ifdef GSI_DEBUG
00062 char *getVar;
00063 getVar = getenv("X509_CERT_DIR");
00064 if (getVar != NULL) {
00065 printf("X509_CERT_DIR:%s\n",getVar);
00066 }
00067 #endif
00068
00069 gsiAuthReqStatus=1;
00070
00071 status = igsiEstablishContextServerside(rsComm, clientName,
00072 500);
00073 #ifdef GSI_DEBUG
00074 if (status==0) printf("clientName:%s\n",clientName);
00075 #endif
00076
00077 memset (&genQueryInp, 0, sizeof (genQueryInp_t));
00078
00079 noNameMode=0;
00080 if (strlen(rsComm->clientUser.userName)>0) {
00081
00082
00083 snprintf (condition1, MAX_NAME_LEN, "='%s'", clientName);
00084 addInxVal (&genQueryInp.sqlCondInp, COL_USER_DN, condition1);
00085
00086 snprintf (condition2, MAX_NAME_LEN, "='%s'",
00087 rsComm->clientUser.userName);
00088 addInxVal (&genQueryInp.sqlCondInp, COL_USER_NAME, condition2);
00089
00090 addInxIval (&genQueryInp.selectInp, COL_USER_ID, 1);
00091 addInxIval (&genQueryInp.selectInp, COL_USER_TYPE, 1);
00092 addInxIval (&genQueryInp.selectInp, COL_USER_ZONE, 1);
00093
00094 genQueryInp.maxRows = 2;
00095
00096 status = rsGenQuery (rsComm, &genQueryInp, &genQueryOut);
00097 }
00098 else {
00099
00100
00101
00102
00103
00104 noNameMode=1;
00105 memset (&genQueryInp, 0, sizeof (genQueryInp_t));
00106
00107 snprintf (condition1, MAX_NAME_LEN, "='%s'", clientName);
00108 addInxVal (&genQueryInp.sqlCondInp, COL_USER_DN, condition1);
00109
00110 addInxIval (&genQueryInp.selectInp, COL_USER_ID, 1);
00111 addInxIval (&genQueryInp.selectInp, COL_USER_TYPE, 1);
00112 addInxIval (&genQueryInp.selectInp, COL_USER_NAME, 1);
00113 addInxIval (&genQueryInp.selectInp, COL_USER_ZONE, 1);
00114
00115 genQueryInp.maxRows = 2;
00116
00117 status = rsGenQuery (rsComm, &genQueryInp, &genQueryOut);
00118
00119 if (status == CAT_NO_ROWS_FOUND) {
00120
00121
00122
00123
00124
00125
00126
00127
00128
00129 ruleExecInfo_t rei;
00130 char *args[2];
00131 msParamArray_t *myMsParamArray;
00132 msParamArray_t myInOutParamArray;
00133
00134 memset((char*)&rei,0,sizeof(rei));
00135 rei.rsComm = rsComm;
00136 rei.uoic = &rsComm->clientUser;
00137 rei.uoip = &rsComm->proxyUser;
00138 args[0]=clientName;
00139 char out[200]="*cmdOutput";
00140 args[1]=out;
00141
00142 rei.inOutMsParamArray = myInOutParamArray;
00143
00144 myMsParamArray = (msParamArray_t *) malloc (sizeof (msParamArray_t));
00145 memset (myMsParamArray, 0, sizeof (msParamArray_t));
00146
00147 statusRule = applyRuleArgPA("acGetUserByDN", args, 2,
00148 myMsParamArray, &rei, NO_SAVE_REI);
00149
00150 #ifdef GSI_DEBUG
00151 printf("acGetUserByDN status=%d\n",statusRule);
00152
00153 int i;
00154 for (i=0;i<myMsParamArray->len;i++)
00155 {
00156 char *r;
00157 msParam_t *myP;
00158 myP = myMsParamArray->msParam[i];
00159 r = myP->label;
00160 printf("l1=%s\n", r);
00161 }
00162 #endif
00163
00164
00165 memset (&genQueryInp, 0, sizeof (genQueryInp_t));
00166
00167 snprintf (condition1, MAX_NAME_LEN, "='%s'", clientName);
00168 addInxVal (&genQueryInp.sqlCondInp, COL_USER_DN, condition1);
00169
00170 addInxIval (&genQueryInp.selectInp, COL_USER_ID, 1);
00171 addInxIval (&genQueryInp.selectInp, COL_USER_TYPE, 1);
00172 addInxIval (&genQueryInp.selectInp, COL_USER_NAME, 1);
00173 addInxIval (&genQueryInp.selectInp, COL_USER_ZONE, 1);
00174
00175 genQueryInp.maxRows = 2;
00176
00177 status = rsGenQuery (rsComm, &genQueryInp, &genQueryOut);
00178 }
00179 if (status == 0) {
00180 char *myBuf;
00181 strncpy(rsComm->clientUser.userName, genQueryOut->sqlResult[2].value,
00182 NAME_LEN);
00183 strncpy(rsComm->proxyUser.userName, genQueryOut->sqlResult[2].value,
00184 NAME_LEN);
00185 strncpy(rsComm->clientUser.rodsZone, genQueryOut->sqlResult[3].value,
00186 NAME_LEN);
00187 strncpy(rsComm->proxyUser.rodsZone, genQueryOut->sqlResult[3].value,
00188 NAME_LEN);
00189 myBuf = (char *)malloc (NAME_LEN * 2);
00190 snprintf (myBuf, NAME_LEN * 2, "%s=%s", SP_CLIENT_USER,
00191 rsComm->clientUser.userName);
00192 putenv (myBuf);
00193 free( myBuf );
00194 }
00195 }
00196 if (status == CAT_NO_ROWS_FOUND || genQueryOut==NULL) {
00197 status = GSI_DN_DOES_NOT_MATCH_USER;
00198 rodsLog (LOG_NOTICE,
00199 "igsiServersideAuth: DN mismatch, user=%s, Certificate DN=%s, status=%d",
00200 rsComm->clientUser.userName,
00201 clientName,
00202 status);
00203 snprintf(gsiAuthReqErrorMsg, sizeof gsiAuthReqErrorMsg,
00204 "igsiServersideAuth: DN mismatch, user=%s, Certificate DN=%s, status=%d",
00205 rsComm->clientUser.userName,
00206 clientName,
00207 status);
00208 gsiAuthReqError = status;
00209 return(status);
00210 }
00211
00212 if (status < 0) {
00213 rodsLog (LOG_NOTICE,
00214 "igsiServersideAuth: rsGenQuery failed, status = %d", status);
00215 snprintf(gsiAuthReqErrorMsg, sizeof gsiAuthReqErrorMsg,
00216 "igsiServersideAuth: rsGenQuery failed, status = %d", status);
00217 gsiAuthReqError = status;
00218 return (status);
00219 }
00220
00221 if (noNameMode==0) {
00222 if (genQueryOut==NULL || genQueryOut->rowCnt < 1) {
00223 gsiAuthReqError = GSI_NO_MATCHING_DN_FOUND;
00224 return(GSI_NO_MATCHING_DN_FOUND);
00225 }
00226 if (genQueryOut->rowCnt > 1) {
00227 gsiAuthReqError = GSI_MULTIPLE_MATCHING_DN_FOUND;
00228 return(GSI_MULTIPLE_MATCHING_DN_FOUND);
00229 }
00230 if (genQueryOut->attriCnt != 3) {
00231 gsiAuthReqError = GSI_QUERY_INTERNAL_ERROR;
00232 return(GSI_QUERY_INTERNAL_ERROR);
00233 }
00234 }
00235 else {
00236 if (genQueryOut==NULL || genQueryOut->rowCnt < 1) {
00237 gsiAuthReqError = GSI_NO_MATCHING_DN_FOUND;
00238 return(GSI_NO_MATCHING_DN_FOUND);
00239 }
00240 if (genQueryOut->rowCnt > 1) {
00241 gsiAuthReqError = GSI_MULTIPLE_MATCHING_DN_FOUND;
00242 return(GSI_MULTIPLE_MATCHING_DN_FOUND);
00243 }
00244 if (genQueryOut->attriCnt != 4) {
00245 gsiAuthReqError = GSI_QUERY_INTERNAL_ERROR;
00246 return(GSI_QUERY_INTERNAL_ERROR);
00247 }
00248 }
00249
00250 #ifdef GSI_DEBUG
00251 printf("Results=%d\n",genQueryOut->rowCnt);
00252 #endif
00253
00254 tResult = genQueryOut->sqlResult[0].value;
00255 #ifdef GSI_DEBUG
00256 printf("0:%s\n",tResult);
00257 #endif
00258 tResult = genQueryOut->sqlResult[1].value;
00259 #ifdef GSI_DEBUG
00260 printf("1:%s\n",tResult);
00261 #endif
00262 privLevel = LOCAL_USER_AUTH;
00263 clientPrivLevel = LOCAL_USER_AUTH;
00264
00265 if (strcmp(tResult, "rodsadmin") == 0) {
00266 privLevel = LOCAL_PRIV_USER_AUTH;
00267 clientPrivLevel = LOCAL_PRIV_USER_AUTH;
00268 }
00269
00270 status = chkProxyUserPriv (rsComm, privLevel);
00271
00272 if (status < 0) return status;
00273
00274 rsComm->proxyUser.authInfo.authFlag = privLevel;
00275 rsComm->clientUser.authInfo.authFlag = clientPrivLevel;
00276
00277 if (noNameMode) {
00278 int status2, status3;
00279 rodsServerHost_t *rodsServerHost = NULL;
00280 status2 = getAndConnRcatHost (rsComm, MASTER_RCAT,
00281 rsComm->myEnv.rodsZone, &rodsServerHost);
00282 if (status2 >= 0 &&
00283 rodsServerHost->localFlag == REMOTE_HOST &&
00284 rodsServerHost->conn != NULL) {
00285
00286 status3 = rcDisconnect(rodsServerHost->conn);
00287
00288
00289
00290
00291 rodsServerHost->conn = NULL;
00292
00293
00294 status3 = getAndConnRcatHost (rsComm, MASTER_RCAT,
00295 rsComm->myEnv.rodsZone,
00296 &rodsServerHost);
00297 if (status3) {
00298 rodsLog (LOG_ERROR,
00299 "igsiServersideAuth failed in getAndConnRcatHost, status = %d",
00300 status3);
00301 return (status3);
00302 }
00303 }
00304 }
00305 return status;
00306 #else
00307 status = GSI_NOT_BUILT_INTO_SERVER;
00308 rodsLog (LOG_ERROR,
00309 "igsiServersideAuth failed GSI_NOT_BUILT_INTO_SERVER, status = %d",
00310 status);
00311 return (status);
00312 #endif
00313 }