qmail-ldapam.c

Go to the documentation of this file.

#define LDAP_DEPRECATED 1
/* OpenLDAP still needs some time to stabilize the new code base.
   In the new regime, there are dark edges where dragons live ;-) 
*/
//#include <stdio.h>     // to be removed
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <string.h>
#include <grp.h>
#include <pwd.h>
#include <ldap.h>
#include "auto_qmail.h"
#include "qmail.h"
#include "case.h"
#include "control.h"
#include "constmap.h"
#include "readwrite.h"
#include "buffer.h"
#include "fd.h"
#include "byte.h"
#include "case.h"
#include "str.h"
#include "stralloc.h"
#include "exit.h"
#include "logmsg.h"
#include "pathexec.h"
#include "getln.h"
#include "scan.h"
#include "getoptb.h"
#include "open.h"
#include "readclose.h"
#include "env.h"
#include "base64.h"
 
#define WHO "qmail-ldapam"
 
#define FDAUTH 3
#define FDLOG 4
#define FDPWD 5
#define PORT_LDAP 389
#define PORT_LDAPS 636
 
char authbuf[BUFSIZE_AUTH];
buffer ba = BUFFER_INIT(buffer_unixwrite,FDAUTH,authbuf,sizeof(authbuf));
char bspace[512];
buffer bp;
 
char logbuf[BUFSIZE_SMALL];
buffer bl = BUFFER_INIT(buffer_unixwrite,FDLOG,logbuf,sizeof(logbuf));
 
struct constmap mapldapauth;
stralloc ldapcntl = {0};
stralloc disabled = {0};
 
/* LDAP binding params */
 
stralloc binddn = {0};
stralloc bindpw = {0};
stralloc bindpwds = {0};
stralloc bindbase = {0};
stralloc bindhost = {0};
stralloc filter = {0};
 
stralloc user = {0}; // user w/o domain appended
stralloc domaindn = {0};
stralloc password = {0};
stralloc filters = {0};
stralloc userattr = {0};
 
unsigned long scope = LDAP_SCOPE_SUBTREE; // (2), BASE (0), ONELEVEL (1)
int version = LDAP_VERSION3;
 
static void log_error(const char *in,const char *src,const char *type)
{
  buffer_puts(&bl,WHO);
  buffer_put(&bl,": ",2);
  if (type) { buffer_puts(&bl,type); buffer_put(&bl," ",1); }
  buffer_puts(&bl,in);
  if (src) { buffer_puts(&bl,src); buffer_put(&bl," ",1); }
  buffer_put(&bl,"\n",1);
  buffer_flush(&bl);
}
 
 
static void pam_exit(int fail)
{
  for (int i = 0; i < sizeof(authbuf); ++i) authbuf[i] = 0;
  _exit(fail);
} 
 
static void temp_nomem(void)
{
  buffer_puts(&bl,WHO);
  buffer_puts(&bl,": FATAL: out of memory\n");
  buffer_flush(&bl);
  pam_exit(111);
}
 
static int get_password(stralloc *in)
{
  int fd;
  struct stat st;
 
  fd = open_read(in->s);
  if (fd == -1) return 0;
 
  if (fstat(fd,&st) == -1)
    { log_error("unable to read: ",in->s,"FATAL"); pam_exit(111); }
  if ((st.st_mode & 0477) != 0400)
    { log_error("wrong file permissions for: ",in->s,"FATAL"); pam_exit(111); }
  if (readclose_append(fd,&password,BUFSIZE_LINE) == -1)
    { log_error("unable to read: ",in->s,"FATAL"); pam_exit(111); }
 
  if (!stralloc_copyb(in,password.s,password.len - 1)) return -1;
  if (!stralloc_0(in)) return -1;
 
  return password.len;
}
 
static void read_passwd(void) 
{
  int match = 0;
 
  if (!bindpwds.len) {
    buffer_init(&bp,buffer_unixread,FDPWD,bspace,sizeof(bspace));
    if (getln(&bp,&bindpwds,&match,'\0') == -1)
      { log_error("unable to read password",0,"FATAL"); pam_exit(111); }
    close(FDPWD);
    if (match) --bindpwds.len;
  }
  if (!stralloc_0(&bindpwds)) temp_nomem();
}
 
/* This is a clumsy way to convert DNs into three-level Internet domain names.
   DNs can be given as dc=,dc= (RFC 4514); or as legacy O=/OU=/C= and mapped in correct order
   Though domain names can be given in UTF8, standard ASCII is supported only and not converted to Punycode */
 
static int dn2domain(stralloc *domain,char *dn,int flagdn)
{
  char c;
  char *ou = 0;
  char *org = 0;
  char *country = 0;
  int j, k, l = 0;
 
  int dnlen = str_len(dn);
  if (!stralloc_copys(domain,"")) return -1;
  
  if (flagdn == 1) c = ',';
  if (flagdn == 2) c = '/';
 
  /* dc= case */
 
  for (int i = 0; i < dnlen; ++i) {
    if (case_startb(dn + i,3,"dc=")) {
      j = str_chr(dn + i,c);
      if (dn[i + j] == c || dnlen == i + j) {
        if (!stralloc_catb(domain,dn + i + 3,j - 3)) return -1;
        if (dnlen != i + j)
          if (!stralloc_cats(domain,".")) return -1;
       }
     }
  }
  if (domain->len > 2) {
    if (!stralloc_0(domain)) return -1;
    return 1;
  }
  
  /* o= case */
 
  for (int i = 0; i < dnlen; ++i) {
    if (case_startb(dn + i,3,"ou=")) {
      j = str_chr(dn + i,c);
      if (dn[i + j] == c || dnlen == i + j) ou = dn + i + 3;
    }
    if (case_startb(dn + i,2,"o=")) {
      k = str_chr(dn + i,c);
      if (dn[i + k] == c || dnlen == i + k) org = dn + i + 2;
    }
    if (case_startb(dn + i,2,"c=")) {
      l = str_chr(dn + i,c);
      if (dn[i + l] == c || dnlen == i + l) country = dn + i + 2;
    }
  }
  /* put everything together in correct order */
 
  if (org && *org && country && *country) {
    if (ou && *ou) {
      if (!stralloc_catb(domain,ou,j - 3)) return -1;
      if (!stralloc_cats(domain,".")) return -1;
    }
    if (!stralloc_catb(domain,org,k - 2)) return -1;
    if (!stralloc_cats(domain,".")) return -1;
    if (!stralloc_catb(domain,country,l)) return -1;
    if (!stralloc_0(domain)) return -1;
  }
  if (domain->len > 2) return 2;
 
  return 0;
}
 
static stralloc cafile = {0};
static stralloc cadir = {0};
static stralloc certfile = {0};
static stralloc keyfile = {0};
 
/* LDAP *ldap_setup() is used to prepare an (1) unencrypted, (2) StartTLS, 
   or (3) strong bind connection to a LDAP server, given flagtls on input */
 
LDAP *ldap_setup(int flagtls,char *host,int port)
{
  LDAP *ld;
 
/* Simple bind */
 
  if (!(ld = ldap_init(host,port)))
    { log_error("unable to initialize LDAP bind",0,"FATAL"); pam_exit(111); }
 
// Specify version 3; the default is version 2; required for TLS
 
  if (ldap_set_option(ld,LDAP_OPT_PROTOCOL_VERSION,(void *)&version) != LDAP_OPT_SUCCESS)
    { log_error("unable to initialize LDAP vers 3 bind",0,"FATAL"); pam_exit(111); }
 
/* StartTLS bind */
 
  if (flagtls == 1) {
    if (ldap_start_tls_s(ld,NULL,NULL) != LDAP_SUCCESS)
      { log_error("unable to connect via StartTLS to the LDAP server",0,"FATAL"); pam_exit(111); }
 
    if (cafile.len > 1) 
      if (ldap_set_option(ld,LDAP_OPT_X_TLS_CACERTFILE,(void *)cafile.s) != LDAP_OPT_SUCCESS)
        { log_error("unable to set LDAP CA file: ",cafile.s,"FATAL"); pam_exit(111); }
 
    if (cadir.len > 1)
      if (ldap_set_option(ld,LDAP_OPT_X_TLS_CACERTDIR,(void *)cadir.s) != LDAP_OPT_SUCCESS)
        { log_error("unable to set LDAP CA directory: ",cadir.s,"FATAL"); pam_exit(111); }
  }
 
/* Strong bind */
 
  if (flagtls == 2) { // setup TLS context -- options first
    if (certfile.len && keyfile.len) { 
      if (ldap_set_option(ld,LDAP_OPT_X_TLS_CERTFILE,certfile.s) != LDAP_OPT_SUCCESS)
        { log_error("unable to initialize LDAP vers 3 bind",0,"FATAL"); pam_exit(111); }
      if (ldap_set_option(ld,LDAP_OPT_X_TLS_KEYFILE,keyfile.s) != LDAP_OPT_SUCCESS)
        { log_error("unable to initialize LDAP vers 3 bind",0,"FATAL"); pam_exit(111); }
    }
    if (ldap_install_tls(ld) != LDAP_SUCCESS)
      { log_error("unable to connect via TLS for strong bind to the LDAP server",0,"FATAL"); pam_exit(111); }
  }
 
  return ld;
}
 
static int ldap_testbind(int flag,char *host,unsigned long port)
{
  LDAP *ld;
  int r;
 
  ld = ldap_setup(flag,host,port);
  r = ldap_simple_bind_s(ld,binddn.s,bindpw.s);
  if (r == LDAP_SUCCESS) ldap_unbind(ld);
 
  return r;
}
 
/* The ldap_mailaddr() recipient Mailbox given by the RECIPIENT interface 
   uses the checkpassword API:
   a) We start from existing DN in the LDAP (a 'proxy' from 'ldapbind') allowing
   b) to search for the MAIL attribute in the subtree given by the 'bindbase' from 'ldapbind'. 
      We return the DN as AUTHUSER. 
      The search attribute is customizable via 'ldapbind' but defaults to MAIL.
*/
 
static int ldap_mailaddr(int flag,char *host,unsigned long port,char *mailaddr,char *filter)
{
  LDAP *ld;
  LDAPMessage *result, *entry;
  char *search = "mail"; 
  char *dn, **mail;
  int r;
  int addrok = 0;
 
  r = str_len(mailaddr);
  if (r == 0 || str_chr(mailaddr,'@') == r)
    { log_error("invalid mail address : ",mailaddr,"ERROR"); pam_exit(2); }
 
  ld = ldap_setup(flag,host,port);
 
  if (ldap_simple_bind_s(ld,binddn.s,bindpw.s) != LDAP_SUCCESS)
    { log_error("can't bind with LDAP server for mailaddr. DN:",binddn.s,"ERROR"); pam_exit(110); }
 
  // Construct filter and search with limited scope 
 
  if (filter && *filter) search = filter;
  if (!stralloc_copys(&filters,"(")) temp_nomem();
  if (!stralloc_cats(&filters,search)) temp_nomem();
  if (!stralloc_cats(&filters,"=")) temp_nomem();
  if (!stralloc_cats(&filters,mailaddr)) temp_nomem();
  if (!stralloc_cats(&filters,")")) temp_nomem();
  if (!stralloc_0(&filters)) temp_nomem();
 
  r = ldap_search_s(ld,bindbase.s,scope,filters.s,NULL,0,&result);
  if (r) 
    { log_error("search failed: ",ldap_err2string(r),"ERROR"); pam_exit(110); }
 
  entry = ldap_first_entry(ld,result);
  if (!entry) { ldap_unbind(ld); pam_exit(1); }                // Not found
 
  dn = ldap_get_dn(ld,result);                             // DN = Authuser 
  mail = ldap_get_values(ld,entry,search);
  addrok = ldap_count_values(mail);
 
  ldap_msgfree(result);
  ldap_unbind(ld);
 
  if (!addrok) { log_error("mail address not found: ",mailaddr,"INFO"); pam_exit(1); }
 
  /* Done; set environment variables */
 
  if (!env_put("AUTHUSER",dn)) pam_exit(111);
  return 0;
}
 
/* The ldap_authuser() needs to be authorized by some information over the checkpassword API:
   a) The DN + password in the LDAP (LDAP aware).
   b) Username + password, where the username includes the userid + domain: userid@domain.
      From here, we construct the DN for the LDAP bind: CN = userid (default)
      UserAttr := userid, eg. UID: UID = userid; UserAttr defined in 'ldapbind'.
   c) We also check, whether the DN has a (MAIL) attribute value matching the SMTP Mailfrom:<>.
      Here, the default attribute is MAIL, but can be customized as well in 'ldapbind'.
      For the retrieved DN entry, we iterate for that attribute over of all values.
*/
 
static int ldap_authuser(int flag,char *host,unsigned long port,char *domain,char *user,char *pwd,char *id,char *filter)
{
  LDAP *ld;
  LDAPMessage *result, *entry;
  unsigned long scope = LDAP_SCOPE_BASE;
  char *search = "mail"; 
  char **mail;
  char *mailfrom;
  int addrok = 0;
  int r;
  
  mailfrom = env_get("MAILFROM");
  if (!mailfrom || !*mailfrom) 
    { log_error("Missing Mailfrom:<> for user: ",user,"FATAL"); pam_exit(2); }
 
  ld = ldap_setup(flag,host,port);
 
  /* Fabricate DN to use for binding; if not given directly */
 
  if (domain && *domain) {
    if (id && *id) {                                       // custom DN identifier
      if (!stralloc_copys(&binddn,id)) temp_nomem();
    } else 
      if (!stralloc_copys(&binddn,"cn")) temp_nomem();     // default DN cn=,dc=,...
    if (!stralloc_cats(&binddn,"=")) temp_nomem();
    if (!stralloc_cats(&binddn,user)) temp_nomem();
 
    if (!stralloc_cats(&binddn,",dc=")) temp_nomem();
    for (int i = 0; i < str_len(domain); ++i) {
      if (domain[i] == '.') {
        if (!stralloc_cats(&binddn,",dc=")) temp_nomem();
      } else
        if (!stralloc_catb(&binddn,domain + i,1)) temp_nomem();
    }
    if (!stralloc_0(&binddn)) temp_nomem();
  } else
    if (!stralloc_copys(&binddn,user)) temp_nomem();       // User DN given
 
  if (ldap_simple_bind_s(ld,binddn.s,pwd) != LDAP_SUCCESS)
    { log_error("can't bind with LDAP server for auth. DN:",binddn.s,"INFO"); pam_exit(111); }
 
  // Construct filter and search with limited scope 
 
  if (filter && *filter) search = filter;
  if (!stralloc_copys(&filters,"(")) temp_nomem();
  if (!stralloc_cats(&filters,search)) temp_nomem();
  if (!stralloc_cats(&filters,"=*)")) temp_nomem();
  if (!stralloc_0(&filters)) temp_nomem();
 
  r = ldap_search_s(ld,binddn.s,scope,filters.s,NULL,0,&result);
  if (r) 
    { log_error("search failed: ",ldap_err2string(r),"ERROR"); pam_exit(110); }
 
  entry = ldap_first_entry(ld,result);
  if (!entry) { ldap_msgfree(result); ldap_unbind(ld); pam_exit(1); }
 
  /* Look for a corresponding mailaddr matching $MAILFROM */
 
  mail = ldap_get_values(ld,entry,search);
  for (int i = 0; i < ldap_count_values(mail); ++i)
     if (case_equals(mailfrom,mail[i])) addrok++;
 
  ldap_msgfree(result);
  ldap_msgfree(entry);
  ldap_unbind(ld);
 
  if (!addrok) { log_error("mail address not found: ",mailfrom,"INFO"); pam_exit(1); }
 
  /* Done, set environment variables */
 
  if (!env_put("AUTHUSER",binddn.s)) pam_exit(111);
  return 0;
}
 
/* The ldap_mboxuser() needs to be authorized by some information over the checkpassword API:
   a) The DN + password in the LDAP (LDAP aware).
   b) Username + password, where the username includes the userid + domain: userid@domain.
      From here, we construct the DN for the LDAP bind:
      CN = userid (default)
      UserAttr := userid, eg. UID: UID = userid; UserAttr defined in 'ldapbind'.
   c) We require, that for the retrieved DN a HOMEDIRECTORY attribute exists (eg. PosixAccount schema).
      Here, the default attribute is 'homeDirectory', but can be customized as well in 'ldapbind'.
   d) For the given DN entry, we iterate for that attribute over of all values and check 
      its existance while opening it. Thus read access is required.
   e) We apply a chdir() to the HOMEDIRECTORY; if possible.
   f) The existance of a subsequent 'mbox' or 'maildir' is subject of the called program.
  
   Note: While for usual Unix users HOMEDIRECTORY, it is typically '/home/user', 
         for a virtual mail manager (VMM) it is the VMM's home directory.
*/
 
static int ldap_mboxuser(int flag,char *host,unsigned long port,char *domain,char *user,char *pwd,char *id,char *filter)
{
  LDAP *ld;
  LDAPMessage *result, *entry;
  unsigned long scope = LDAP_SCOPE_BASE;
  char *search = "homeDirectory";
  char **homedir;
  int fd;
  int homeok = 0;
  int r;
  
  ld = ldap_setup(flag,host,port);
 
  if (domain && *domain) {
    if (id && *id) {                                       // custom DN identifier
      if (!stralloc_copys(&binddn,id)) temp_nomem();
    } else 
      if (!stralloc_copys(&binddn,"cn")) temp_nomem();     // default DN cn=,dc=,...
    if (!stralloc_cats(&binddn,"=")) temp_nomem();
    if (!stralloc_cats(&binddn,user)) temp_nomem();
 
    if (!stralloc_cats(&binddn,",dc=")) temp_nomem();
    for (int i = 0; i < str_len(domain); ++i) {
      if (domain[i] == '.') {
        if (!stralloc_cats(&binddn,",dc=")) temp_nomem();
      } else
        if (!stralloc_catb(&binddn,domain + i,1)) temp_nomem();
    }
    if (!stralloc_0(&binddn)) temp_nomem();
  } else
    if (!stralloc_copys(&binddn,user)) temp_nomem();       // User DN given
 
  if (ldap_simple_bind_s(ld,binddn.s,pwd) != LDAP_SUCCESS)
    { log_error("can't bind with LDAP server for home. DN:",binddn.s,"INFO"); pam_exit(111); }
 
  // Construct filter and search with limited scope 
 
  if (filter && *filter) search = filter;
  if (!stralloc_copys(&filters,"(")) temp_nomem();
  if (!stralloc_cats(&filters,search)) temp_nomem();
  if (!stralloc_cats(&filters,"=*)")) temp_nomem();
  if (!stralloc_0(&filters)) temp_nomem();
 
  r = ldap_search_s(ld,binddn.s,scope,filters.s,NULL,0,&result);
  if (r) 
    { log_error("search failed: ",ldap_err2string(r),"ERROR"); pam_exit(110); }
 
  entry = ldap_first_entry(ld,result);
  if (!entry) { ldap_msgfree(result); ldap_unbind(ld); pam_exit(1); }    // Not found
  homedir = ldap_get_values(ld,entry,search);
 
  for (int i = 0; i < ldap_count_values(homedir); ++i) {
    fd = open_read(homedir[i]);
    if (fd == -1) continue;
    if (chdir(homedir[i]) != -1) {
      if (!env_put("HOME",homedir[i])) pam_exit(111);
      homeok++;
    }
  }
 
  ldap_memfree(search);
  ldap_msgfree(entry);
  ldap_unbind(ld);
 
  if (!homeok)
    { log_error("can't change to the home directory for DN:",binddn.s,"ERROR"); pam_exit(1); }
 
  return 0;
}
 
/* ldap_proxyauth():
   1. Do an initial bind using BindDN and BindPW from ldapbind; considering a hierarchy given by a UserAttr extension.
   2. Perform a search for the 'userPersonalName' in that branch resulting in a ProxyAuth user (UPN).
   3. Take the UPN's local part and perform a second bind with the given password of the user.
   4. If the 'home' variable is provided (taken from the filter value of ldapbind),
      construct the HOMEDIR of that user and chdir to that.
   Note: The mapping of BindDN <=> UserAttr <=> UPN + user password needs to realized in the LDAP.
*/
 
static int ldap_proxyauth(int flag,char *host,unsigned long port,char *mailaddr,char *pwd,char *id,char *home)
{
  LDAP *ld;
  LDAPMessage *result;
  stralloc binduser = {0};
  stralloc homedir = {0};
  int scope = LDAP_SCOPE_BASE;
  int fd;
  int i, j, r;
  int homeok = 0;
  
  ld = ldap_setup(flag,host,port);
 
  /* First BindDN with subordinate 'id' as context: DN:cn=bindCN,cn=id,dc=x,dc=y,dc=z */
 
  i = str_chr(binddn.s,',');
  if (case_starts(binddn.s + i + 1,"dc=") && id && *id) {
    if (!stralloc_copyb(&binduser,binddn.s,i)) temp_nomem();
    if (!stralloc_cats(&binduser,",cn=")) temp_nomem();
    if (!stralloc_cats(&binduser,id)) temp_nomem();
    if (!stralloc_cats(&binduser,binddn.s + i)) temp_nomem();
    if (!stralloc_0(&binduser)) temp_nomem();
  }    
  else
   { log_error("can't setup proxy auth user for DN:",binddn.s,"ERROR"); pam_exit(110); }
  
  if (ldap_simple_bind_s(ld,binduser.s,bindpw.s) != LDAP_SUCCESS)
    { log_error("can't bind with LDAP server for proxy. DN:",binduser.s,"INFO"); pam_exit(111); }
 
  /* Do we have a 'UserPrincipalName' with that 'mailaddr' in that scope? */
 
  if (!stralloc_copys(&filters,"(UserPrincipalName=")) temp_nomem();
  if (!stralloc_cats(&filters,mailaddr)) temp_nomem();
  if (!stralloc_cats(&filters,")")) temp_nomem();
  if (!stralloc_0(&filters)) temp_nomem();
 
  r = ldap_search_s(ld,binduser.s,scope,filters.s,NULL,0,&result);
  if (r) 
    { log_error("UserPrincipalName not found in LDAP ",mailaddr,"INFO"); pam_exit(1); }
 
  /* Second bind: If found, we try to bind with the localpart of 'mailaddr':
     DN:cn=local,cn=id,dc=x,dc=y,dc=z 
  */
 
  j = str_chr(mailaddr,'@');
  if (!stralloc_copys(&binduser,"cn=")) temp_nomem();
  if (!stralloc_catb(&binduser,mailaddr,j)) temp_nomem();
  if (!stralloc_cats(&binduser,",cn=")) temp_nomem();
  if (!stralloc_cats(&binduser,id)) temp_nomem();
  if (!stralloc_cats(&binduser,binddn.s + i)) temp_nomem();     // domainpart of binddn 
  if (!stralloc_0(&binduser)) temp_nomem();
 
  if (ldap_simple_bind_s(ld,binduser.s,pwd) != LDAP_SUCCESS)
    { log_error("can't bind with LDAP server. DN:",binduser.s,"INFO"); pam_exit(1); }
 
  /* Verify it! */
 
  if (!stralloc_copys(&filters,"(objectclass=*)")) temp_nomem();
  if (!stralloc_0(&filters)) temp_nomem();
 
  r = ldap_search_s(ld,binduser.s,scope,filters.s,NULL,0,&result);
  if (r) 
    { log_error("UserPincipalName rotten in LDAP",ldap_err2string(r),"ERROR"); ldap_unbind(ld); pam_exit(110); }
 
  if (!env_put("USER",mailaddr)) pam_exit(111);
 
  /* Look for a mbox/maildir path for eg. vpopmail/vmailmgr */
 
  if (home && *home) {
    if (!stralloc_copys(&homedir,home)) temp_nomem();
    if (!stralloc_cats(&homedir,"/")) temp_nomem();
    if (!stralloc_catb(&homedir,mailaddr,j)) temp_nomem();
    if (!stralloc_0(&homedir)) temp_nomem();
    fd = open_read(homedir.s);
    if (fd != -1 && chdir(homedir.s) != -1) { 
      if (!env_put("HOME",homedir.s)) pam_exit(111);
      homeok++;
    }
  }
 
  ldap_unbind(ld);
 
  if (home && !homeok) 
    { log_error("can't change to the home directory of user:",mailaddr,"ERROR"); pam_exit(1) ; }
 
  if (!env_put("AUTHUSER",binduser.s)) pam_exit(111);
  return 0;
}
 
int main(int argc,char * const argv[]) 
{
  char *authuser = 0;
  char *ldaparam = 0;
  char *domain = 0;
  char *pwgiven = 0;
  unsigned long port = PORT_LDAP;
  int authlen = 0;
  int buflen = 0;
  int domlen = 0;
  int flagauth = 0;
  int flaghome = 0;
  int flagprox = 0;
  int flagstls = 0;
  int dnseen = 0;
  int opt;
  int i = 0; 
  int s, p, u, k;
  int rc;
 
  while ((opt = getoptb(argc,(char **)argv,"ahps")) !=opteof)
    switch (opt) {
      case 'a': flagauth = 1; break;
      case 'h': flaghome = 1; break; 
      case 'p': flagprox = 1; break;
      case 's': flagstls = 1; break;
    }
  argv += optind;
  argc -= optind;
 
  env_unset("USER");
 
  /* Read input from FDAUTH */
 
  for (;;) {
    do {
      rc = read(FDAUTH,authbuf + buflen,sizeof(authbuf) - buflen);
    } while ((rc == -1) && (errno == EINTR));
    if (rc == -1) pam_exit(111);
    if (rc == 0) break;
    buflen += rc;
    if (buflen >= sizeof(authbuf)) pam_exit(2);
  }
  close(FDAUTH);
 
  authuser = authbuf + i;       /* username or DN */
  if (i == buflen) pam_exit(2);
  while (authbuf[i++])          /* password */
    if (i == buflen) pam_exit(2);
  pwgiven = authbuf + i;
  if (i == buflen) pam_exit(2);
 
  authlen = str_len(authuser);
  if (!stralloc_copyb(&user,authuser,authlen)) temp_nomem();
 
  if ((i = byte_rchr(authuser,authlen,'@')))    /* domain */
    if (i < authlen && authuser[i] == '@') {
      domain = authuser + i + 1;
      domlen = str_len(domain);
      case_lowerb(domain,domlen);
      if (!stralloc_copyb(&user,authuser,i)) temp_nomem();
    }
  if (!stralloc_0(&user)) pam_exit(111);
  if ((i = str_chr(authuser,',')) && authuser[i] == ',') dnseen = 1;
  if ((i = str_chr(authuser,'/')) && authuser[i] == '/') dnseen = 2; // old style
  if (!env_put("USER",authuser)) pam_exit(111);
 
  /* Read control file users/ldapauth and go for checks */
 
  if (chdir(auto_qmail) == -1) pam_exit(110);
 
  switch (control_readfile(&ldapcntl,"control/ldapbind",0)) {
    case -1: pam_exit(110);
    case  0: if (!constmap_init(&mapldapauth,"",0,1)) temp_nomem();
    case  1: if (!constmap_init(&mapldapauth,ldapcntl.s,ldapcntl.len,1)) temp_nomem();
  }
 
  /* For a propper lookup we need to convert X.500 DNs to domain names;
     dc= type style and old styles are supported */
 
  if (dnseen) { 
    dn2domain(&domaindn,authuser,dnseen);
    domain = domaindn.s;
  }
 
  /* Check for disabled authuser/domains - only working if user@domain given*/
 
  if (!stralloc_copys(&disabled,"!")) temp_nomem();
  if (!stralloc_catb(&disabled,authuser,authlen)) temp_nomem();
  if (constmap(&mapldapauth,disabled.s,disabled.len)) temp_nomem();
 
  if (domlen) {
    if (!stralloc_copys(&disabled,"!")) temp_nomem();
    if (!stralloc_catb(&disabled,domain,domlen)) temp_nomem();
    if (constmap(&mapldapauth,disabled.s,disabled.len)) temp_nomem();
  }
 
  if (!ldaparam && domlen)
    ldaparam = constmap(&mapldapauth,domain,domlen);  // 1. ldap server by domain
  if (!ldaparam)
    ldaparam = constmap(&mapldapauth,"*",1);          // 2. one ldap for all
  if (dnseen) domain = 0;                             // only used for lookup in ldapbind
 
  if (!ldaparam) pam_exit(1);
 
  /* Evaluate LDAP lookup params:  
                p       i    s     i      i       i      u        i  i    k
     domain:Host;[s]port|Base:Scope|BindDN|BindPwd|Filter:UserAttr|CA|Cert:keyfile*/
 
  i = 0;
  int len = 0;
  int paramlen = str_len(ldaparam);
  if (!stralloc_copys(&bindhost,"localhost")) temp_nomem();      /* Default LDAP host */
 
  i = str_chr(ldaparam,'|');                     /* Host;Port */
  len += i;
  if (ldaparam[i] == '|' || len == paramlen) {
    ldaparam[i] = 0;
    p = str_chr(ldaparam,';');                   /* Port */
    if (ldaparam[p] == ';') {
      ldaparam[p] = 0;
      if (ldaparam[p + 1] == 's') { flagstls = 2; port = PORT_LDAPS; ++p; }
      if (p < i) scan_ulong(ldaparam + p + 1,&port);
    }
    if (i)                                       /* can be omitted */
      if (!stralloc_copys(&bindhost,ldaparam)) temp_nomem();
  }
  if (!stralloc_0(&bindhost)) temp_nomem();
 
  if (len < paramlen) {
    ldaparam += i + 1;
    i = str_chr(ldaparam,'|');                   /* Base:Scope */
    len += i + 1;
    if (ldaparam[i] == '|' || len == paramlen) {
      ldaparam[i] = 0;
      s = str_chr(ldaparam,':');                 /* Scope */
      if (ldaparam[s] == ':') {
        ldaparam[s] = 0;
        if (s < i) scan_ulong(ldaparam + s + 1,&scope);
      } 
      if (!stralloc_copys(&bindbase,ldaparam)) temp_nomem();
      if (!stralloc_0(&bindbase)) temp_nomem();
    }
  }
 
  if (len < paramlen) {
    ldaparam += i + 1;
    i = str_chr(ldaparam,'|');                   /* Bind DN */
    len += i + 1;
    if (ldaparam[i] == '|' || len == paramlen) {
      ldaparam[i] = 0;
      if (!stralloc_copys(&binddn,ldaparam)) temp_nomem();
      if (!stralloc_0(&binddn)) temp_nomem();
    }
  }
 
  if (len < paramlen) {
    ldaparam += i + 1;
    i = str_chr(ldaparam,'|');                   /* Bind PWD */
    len += i + 1;
    if (ldaparam[i] == '|' || len == paramlen) {
      ldaparam[i] = 0;
      if (!stralloc_copys(&bindpw,ldaparam)) temp_nomem();
      if (!stralloc_0(&bindpw)) temp_nomem();
      switch (get_password(&bindpw)) {
        // case  0: log_error("pwd taken from ldapbind",0,"INFO"); break;
        case -1: log_error("can't copy pwd",0,"FATAL"); pam_exit(111);
        // default: log_error("pwd read from file",0,"INFO");
      }
    }
  }
 
  if (len < paramlen) {
    ldaparam += i + 1;                           /* Filter */
    i = str_chr(ldaparam,'|');
    len += i + 1;
    if (ldaparam[i] == '|' || len == paramlen) {
      ldaparam[i] = 0;
      u = str_chr(ldaparam,':');                 /* User Attribute */
      if (ldaparam[u] == ':') {
        ldaparam[u] = 0;
        if (!stralloc_copys(&userattr,ldaparam + u + 1)) temp_nomem();
        if (!stralloc_0(&userattr)) temp_nomem();
      } 
      if (!stralloc_copys(&filter,ldaparam)) temp_nomem();
      if (!stralloc_0(&filter)) temp_nomem();
    }
  }
 
  if (len < paramlen) {
    ldaparam += i + 1;
    i = str_chr(ldaparam,'|');                   /* CA cert */
    len += i + 1;
    if (ldaparam[i] == '|' || len == paramlen) {
      ldaparam[i] = 0;
      if (ldaparam[i - 1] == '/') {              /* CA dir/ */
        if (!stralloc_copys(&cadir,ldaparam)) temp_nomem();
        if (!stralloc_0(&cadir)) temp_nomem();
      } else {
        if (!stralloc_copys(&cafile,ldaparam)) temp_nomem();
        if (!stralloc_0(&cafile)) temp_nomem();
      }
    }
  }
 
  if (len < paramlen) {
    ldaparam += i + 1;
    i = str_chr(ldaparam,'|');                   /* Client cert */
    len += i + 1;
    if (ldaparam[i] == '|' || len == paramlen) {
      ldaparam[i] = 0;
      k = str_chr(ldaparam,':');                 /* keyfile */
      if (ldaparam[k] == ':') {
        ldaparam[k] = 0;
        if (!stralloc_copys(&keyfile,ldaparam + k + 1)) temp_nomem();
        if (!stralloc_0(&keyfile)) temp_nomem();
      }
      if (!stralloc_copys(&certfile,ldaparam)) temp_nomem();
      if (!stralloc_0(&certfile)) temp_nomem();
    }
  }
 
  /* Get and read passwords from file or FDAUTH */
 
  if (bindpw.s[0] == '*') {
    read_passwd();
    for (i = 0; i < bindpwds.len; i++) {
      if (bindpwds.s[i] == '\0' || bindpwds.s[i] == ' ' ) {
        if (!stralloc_copyb(&bindpw,bindpwds.s,i - 1)) temp_nomem();
        if (!stralloc_0(&bindpw)) temp_nomem();
        if (ldap_testbind(flagstls,bindhost.s,port) == LDAP_SUCCESS) break; // gotcha
        bindpwds.s = bindpwds.s + i;
      }
    }
  } 
 
  if (!stralloc_copys(&password,pwgiven)) temp_nomem();
  if (!stralloc_0(&password)) temp_nomem();
  
  if (flagauth)
        ldap_authuser(flagstls,bindhost.s,port,domain,user.s,password.s,userattr.s,filter.s);
  else if (flagprox)
        ldap_proxyauth(flagstls,bindhost.s,port,authuser,password.s,userattr.s,filter.s);
  else if (flaghome) 
        ldap_mboxuser(flagstls,bindhost.s,port,domain,user.s,password.s,userattr.s,filter.s);
  else
    ldap_mailaddr(flagstls,bindhost.s,port,authuser,filter.s);
 
  for (i = 0; i < sizeof(authbuf); ++i) authbuf[i] = 0;
 
  pathexec(argv);
  pam_exit(111);
}