Changeset 268

Timestamp:

05/09/07 08:48:00 (5 years ago)

Author:

ludovic.rousseau

Message:

ldap-patches from Sandro Wefel
http://www.opensc-project.org/pipermail/opensc-devel/2007-April/009764.html

which offers:

• support for more than one LDAP server as fallback system
• support of secure connection (SSL+TLS) because someone may use simple authentication with username and password
• multiple certificates per attribute
• LDAP-URI support
• selection of base, one-level or subtree search
• timeout support and a somewhat enhanced documentation.

Location:

trunk

Files:

• configure.in (modified) (1 diff)
• doc/pam_pkcs11.xml (modified) (1 diff)
• etc/pam_pkcs11.conf.example (modified) (1 diff)
• src/mappers/ldap_mapper.c (modified) (13 diffs)

trunk/configure.in

@@ -77 +77 @@
         ])
 fi
+if test "$with_ldap" \!= "no"; then
+  AC_CHECK_FUNCS(ldap_init ldap_initialize)
+  AC_CHECK_FUNCS(ldap_set_option ldap_get_option)  
+  AC_CHECK_FUNCS(ldap_start_tls ldap_start_tls_s)
+fi      
 AC_SUBST(LDAP_CFLAGS)
 AC_SUBST(LDAP_LIBS)

trunk/doc/pam_pkcs11.xml

@@ -1664 +1664 @@
         This mapper is still under development.
 </para>
+<para>
+ldap_mapper configuration file shows like:
+<screen>
+  # Directory ( ldap style ) mapper
+  mapper ldap {
+        debug = false;
+        module = /usr/lib/pam_pkcs11/ldap_mapper.so;
+        ldaphost = "";
+        ldapport = ;
+        URI = "";
+        scope = 2;
+        binddn = "cn=pam,o=example,c=com";
+        passwd = "";
+        base = "ou=People,o=example,c=com";
+        attribute = "userCertificate";
+        filter = "<![CDATA[(&(objectClass=posixAccount)(uid=%s))]]>"
+        # SSL/TLS-Settings
+        ssl = tls
+        # tls_randfile = ...
+        tls_cacertfile = /etc/ssl/cacert.pem
+        # tls_cacertdir = ...
+        tls_checkpeer = 0
+        #tls_ciphers = ...
+        #tls_cert = ...
+        #tls_key = ...
+  }
+</screen>
+The following options are recognized by
+
+<varlistentry>
+<term><token>ldaphost</token></term>
+<listitem>The FQDN (hostname) oder IP-address of the ldap server.</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>URI</token></term>
+<listitem>A space separated list of LDAP URIs. The URIs are used in the given order.
+If a ldaphost is also submitted, it will be appended to the URI list.
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>ldapport</token></term>
+<listitem>The LDAP Port on the server (default:
+389 for LDAP and LDAP-TLS and 636 for SSL)
+</listitem>
+</varlistentry>
+
+<varlistentry>
+ <term><token>scope</token></term>
+ <listitem>Scope of search: 0-2
+        <itemizedlist>
+                <listitem><option> 0 </option> "base", search only the basedn
+                </listitem>
+        
+                <listitem><option> 1 </option> "one", only the set of records one
+            level below the basedn is searched (default) 
+            </listitem>
+        
+                <listitem><option> 2 </option> "sub"  means the union of entries 
+                at the "base" level and all levels below are searched 
+                </listitem>
+        </itemizedlist>
+ </listitem>
+        
+</varlistentry>
+
+<varlistentry>
+<term><token>binddn</token></term>
+<listitem>The bind-DN if needed.
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>passwd</token></term>
+<listitem>Password for bind-DN
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>base</token></term>
+<listitem>The DN of the searchbase (see scope)
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>attribute</token></term>
+<listitem>The user attribute in LDAP entry, which contains 
+the certificate. This can be an multi-value attribute. That
+implies you can store more than one certificate under this
+attribute. All certificates are utilized.
+</listitem>
+</varlistentry>
+
+
+<varlistentry>
+<term><token>filter</token></term>
+<listitem>LDAP filter string. You can use ist to restrict
+the entries returned by the LDAP server, e.g. by checking
+other attributes of the user entry.
+%s is substituted by the user name.
+
+<![CDATA[(&(objectClass=posixAccount)(uid=%s))]]>
+means, only that
+LDAP entry is returned which has an objectClass 
+"posixAccount" and the uid with the user name.
+
+<lineannotation>IMPORTANT NOTE:</lineannotation> The filter string
+must be choosen in such a way that only one entry for the user is 
+returned. If an user has more certifactes than these should be 
+collected under the attribute.
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>ssl</token></term>
+<listitem>Enable or disable the usage of TLS or SSL
+        <itemizedlist>
+                <listitem><option> off </option>   TLS/SSL off(default)
+                </listitem>
+        
+                <listitem><option> tls </option>   enable TLS 
+            </listitem>
+        
+                <listitem><option> on|ssl </option>   enable SSL
+                </listitem>
+        </itemizedlist>
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>tls_randfile</token></term>
+<listitem>Specifies the path to an entropy source.
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>tls_cacertfile</token></term>
+<listitem>Specifies the path to the X.509 certificate for peer authentication.
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>tls_cacertdir</token></term>
+<listitem>Specifies the directory containing X.509 certificates for peer authentication.
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>tls_checkpeer</token></term>
+<listitem>Specifies whether to require and verify the server certificate or not.
+<option> 1 </option>  check the certificate 
+<option> 0 </option>  off (default)
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>tls_ciphers</token></term>
+<listitem>Specifies the ciphers to use.
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>tls_cert</token></term>
+<listitem>Specifies the path to the file containing the local certificate for client TLS authentication if required.
+</listitem>
+</varlistentry>
+
+<varlistentry>
+<term><token>tls_key</token></term>
+<listitem>Specifies the path to the file containing the private key for client TLS authentication.
+</listitem>
+</varlistentry>
+
+</para>
+
+
+
 </sect2>
 

trunk/etc/pam_pkcs11.conf.example

@@ -182 +182 @@
         debug = false;
         module = /usr/lib/pam_pkcs11/ldap_mapper.so;
-        # where base directory resides
-        basedir = /etc/pam_pkcs11/mapdir;
-        # hostname of ldap server
-        ldaphost = "localhost";
-        # Port on ldap server to connect
-        ldapport = 389;
-        # Scope of search: 0 = x, 1 = y, 2 = z
-        scope = 2;
-        # DN to bind with. Must have read-access for user entries under "base"
-        binddn = "cn=pam,o=example,c=com";
+        # hostname of ldap server (use LDAP-URI for more then one)
+        ldaphost = "";
+        # Port on ldap server to connect, this is also the default
+        #   if no port is given in URI below
+        #   if empty, then 389 for TLS and 636 for SSL is used
+        ldapport = ;
+        # space separted list of LDAP URIs (URIs are used by given order)
+        URI = "";
+        # Scope of search: 0-2
+        #   Default is 1 = "one", meaning the set of records one
+        #   level below the basedn.
+        #   0 = "base"  means search only the basedn, and
+        #   2 = "sub"  means the union of entries at the "base" level
+        #   and ? all or "one" level below ??? FIXME
+        scope = 2;
+        # DN to bind with. Must have read-access for user entries
+        # under "base"
+        binddn = "cn=pam,o=example,c=com";
         # Password for above DN
-        passwd = "test";
+        passwd = "";
         # Searchbase for user entries
-        base = "ou=People,o=example,c=com";
+        base = "ou=People,o=example,c=com";
         # Attribute of user entry which contains the certificate
-        attribute = "userCertificate";
-        # Searchfilter for user entry. Must only let pass user entry for the login user.
-        filter = "(&(objectClass=posixAccount)(uid=%s))"
+        attribute = "userCertificate";
+        # Searchfilter for user entry. Must only let pass user entry
+        # for the login user.
+        filter = "(&(objectClass=posixAccount)(uid=%s))"
+        # SSL/TLS-Switch
+        #   This is a global switch, you can't switch between
+        #   SSL or TLS and non secured connections per URI!
+        #   values: off (standard), tls or on (ssl) or ssl
+        ssl = tls
+        # SSL specific settings
+        # tls_randfile = ...
+        tls_cacertfile = /etc/ssl/cacert.pem
+        # tls_cacertdir = ...
+        tls_checkpeer = 0
+        #tls_ciphers = ...
+        #tls_cert = ...
+        #tls_key = ...
   }
 

trunk/src/mappers/ldap_mapper.c

@@ -22 +22 @@
  */
 
+/*
+ * Sandro Wefel (SaW) <sandro.wefel@informatik.uni-halle.de> added
+ *  TLS/SSL support (see autofs-ldap and libnss-ldap)
+ *  multiple LDAP-Server support
+ *  multi-value certificate entries
+ */
+
 #define __LDAP_MAPPER_C_
 
@@ -49 +56 @@
 */
 
+
+static const int LDAP_CONFIG_URI_MAX = 10;
+
+
 /*
-* TODO: Support for LDAPS Connection
-*/
+ * TODO: 
+ * - Support for SASL-AUTH not included yet, I can't test it
+ *  
+ * - ldap_unbind (*ld) crash if you connect to a SSL port but have set TLS intead SSL
+ *   - no idea why!?
+ *   - you got no error-massage from your application
+ *   - believe skip ldap_unbind (*ld) for a bind handle isn't a good solution
+ * 
+ * - implement searchtimeout
+ * - implement ignorecase
+ */
+
+
+enum ldap_ssl_options
+{
+  SSL_OFF,
+  SSL_LDAPS,
+  SSL_START_TLS
+};
+
+typedef enum ldap_ssl_options ldap_ssl_options_t;
+
+#ifndef LDAPS_PORT
+#define LDAPS_PORT 636
+#endif 
+
 
 /*** Internal vars *****************************************************/
 
-static const char *ldaphost="localhost";
-static int ldapport=389;
-static int scope=0; /* 0: LDAP_SCOPE_BASE, 1: LDAP_SCOPE_ONE, 2: LDAP_SCOPE_SUB */
+/* Host and Port */
+static const char *ldaphost="";
+static int ldapport=0;
+/* or URI (allow multiple hosts) */
+static const char *ldapURI="";
+static int scope=1; /* 0: LDAP_SCOPE_BASE, 1: LDAP_SCOPE_ONE, 2: LDAP_SCOPE_SUB */
 static const char *binddn="";
 static const char *passwd="";
@@ -65 +103 @@
 static int searchtimeout=20;
 static int ignorecase=0;
-static const X509 *ldap_x509;
+static const X509 **ldap_x509;
+static int certcnt=0;
+
+static ldap_ssl_options_t ssl_on = SSL_OFF;
+#if defined HAVE_LDAP_START_TLS_S || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))
+/* TLS/SSL specific options */
+static const char *tls_randfile="";
+static const char *tls_cacertfile="";
+static const char *tls_cacertdir="";
+static int tls_checkpeer=-1;
+static const char *tls_ciphers="";
+static const char *tls_cert=""; 
+static const char *tls_key="";
+#endif
+
+static int ldapVersion = 3;             
+#ifdef HAVE_LDAP_SET_OPTION
+static int timeout = 8;                 // 8 seconds       
+#endif
+static int bind_timelimit = 2;  // Timelimit for BIND
+
+static const int sscope[] = {
+        LDAP_SCOPE_BASE, 
+        LDAP_SCOPE_ONELEVEL, 
+        LDAP_SCOPE_SUBTREE};
 
 /*** Internal funcs ****************************************************/
+
+
+static int do_init (LDAP ** ld, const char *uri, int ldapdefport)
+{
+        int rc;
+        int ldaps;
+        char uribuf[512];
+        char *p;
+        
+        DBG("do_init():");
+
+        ldaps = (strncasecmp (uri, "ldaps://", sizeof ("ldaps://") - 1) == 0);
+        p = strchr (uri, ':');
+        /* we should be looking for the second instance to find the port number */
+        if (p != NULL)
+        {
+                p = strchr (p, ':');
+        }
+
+#ifdef HAVE_LDAP_INITIALIZE
+        if (p == NULL &&
+                ((ldaps && ldapdefport != LDAPS_PORT) || (!ldaps && ldapdefport != LDAP_PORT)))
+        {
+                /* No port specified in URI and non-default port specified */
+                snprintf (uribuf, sizeof (uribuf), "%s:%d", uri, ldapdefport);
+                uri = uribuf;
+        }
+        rc = ldap_initialize (ld, uri);
+#else
+        // TODO: !HAVE_LDAP_INITIALIZE => no ldaps:// possible?
+        if (strncasecmp (uri, "ldap://", sizeof ("ldap://") - 1) != 0)
+    {
+                return LDAP_UNAVAILABLE;
+    }
+
+        uri += sizeof ("ldap://") - 1;
+        p = strchr (uri, ':');
+
+        if (p != NULL)
+    {
+                size_t urilen = (p - uri);
+                
+                if (urilen >= sizeof (uribuf))
+                {
+                        return LDAP_UNAVAILABLE;
+                }
+                
+                memcpy (uribuf, uri, urilen);
+                uribuf[urilen] = '\0';
+                
+                ldapdefport = atoi (p + 1);
+                uri = uribuf;
+        }
+
+# ifdef HAVE_LDAP_INIT
+        *ld = ldap_init (uri, defport);
+# else
+        *ld = ldap_open (uri, defport);
+# endif
+        rc = (*ld == NULL) ? LDAP_SERVER_DOWN : LDAP_SUCCESS;
+
+#endif /* HAVE_LDAP_INITIALIZE */
+
+        if (rc == LDAP_SUCCESS && *ld == NULL)
+        {
+                rc = LDAP_UNAVAILABLE;
+        }
+        return rc;
+}
+
+
+#if defined HAVE_LDAP_START_TLS_S || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))
+/* 
+ * Set the ssl option
+ */
+static int do_ssl_options (LDAP *ldap_connection)
+{
+        int rc;
+
+        DBG("do_ssl_options");
+
+#ifdef LDAP_OPT_X_TLS_RANDOM_FILE
+        if (strncmp(tls_randfile,"",1))
+        {
+
+                /* rand file */
+                rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_RANDOM_FILE,
+                    tls_randfile);
+                if (rc != LDAP_SUCCESS)
+                {
+                        DBG("do_ssl_options: Setting of LDAP_OPT_X_TLS_RANDOM_FILE failed");
+                        return LDAP_OPERATIONS_ERROR;
+                }
+        }
+#endif /* LDAP_OPT_X_TLS_RANDOM_FILE */
+
+        if (strncmp(tls_cacertfile,"",1))
+        {
+                /* ca cert file */
+                rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTFILE,
+                        tls_cacertfile);
+                if (rc != LDAP_SUCCESS)
+                {
+                        DBG("do_ssl_options: Setting of LDAP_OPT_X_TLS_CACERTFILE failed");
+                        return LDAP_OPERATIONS_ERROR;
+                }
+        }
+
+        if (strncmp(tls_cacertdir,"",1))
+    {
+                /* ca cert directory */
+                rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CACERTDIR,
+                                    tls_cacertdir);
+                if (rc != LDAP_SUCCESS)
+                {
+                        DBG("do_ssl_options: Setting of LDAP_OPT_X_TLS_CACERTDIR failed");
+                        return LDAP_OPERATIONS_ERROR;
+                }
+    }
+
+        /* the cert have to be checked ? */
+        if (tls_checkpeer > -1)
+        {
+                rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_REQUIRE_CERT,
+                        &tls_checkpeer);
+                if (rc != LDAP_SUCCESS)
+                {
+                        DBG("do_ssl_options: Setting of LDAP_OPT_X_TLS_REQUIRE_CERT failed");
+                        return LDAP_OPERATIONS_ERROR;
+                }
+        }
+
+        if (strncmp(tls_ciphers,"",1))
+    {
+                /* set cipher suite, certificate and private key: */
+                rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CIPHER_SUITE,
+                        tls_ciphers);
+                if (rc != LDAP_SUCCESS)
+                {
+                        DBG("do_ssl_options: Setting of LDAP_OPT_X_TLS_CIPHER_SUITE failed");
+                        return LDAP_OPERATIONS_ERROR;
+                }
+        }
+
+        /* where is the requiered cert */
+        if (strncmp(tls_cert,"",1))
+    {
+            rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE, 
+                tls_cert);
+            if (rc != LDAP_SUCCESS)
+                {
+                        DBG("do_ssl_options: Setting of LDAP_OPT_X_TLS_CERTFILE failed");
+                        return LDAP_OPERATIONS_ERROR;
+                }
+    }
+
+        /* where is the key */
+        if (strncmp(tls_key,"",1))
+        {
+                rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE, 
+                        tls_key);
+                if (rc != LDAP_SUCCESS)
+                {
+                        DBG("do_ssl_options: Setting of LDAP_OPT_X_TLS_KEYFILE failed");
+                        return LDAP_OPERATIONS_ERROR;
+                }
+        }
+        return LDAP_SUCCESS;
+}
+#endif
+
+
+static int
+do_bind (LDAP * ldap_connection, int timelimit)
+{
+        int rc;
+        int rv;
+        struct timeval tv;
+        LDAPMessage *result;
+
+        /*
+         * set timelimit in ld for select() call in ldap_pvt_connect() 
+         * function implemented in libldap2's os-ip.c
+         */
+        tv.tv_sec = timelimit;
+        tv.tv_usec = 0;
+
+DBG2("do_bind(): bind DN=\"%s\" pass=\"%s\"",binddn,passwd);
+
+        /* LDAPv3 doesn't need bind at all, 
+         * nevertheless, if no binddn is given than bind anonymous */
+        if ( ! strncmp(binddn,"",1) ) {
+                rv = ldap_simple_bind(ldap_connection, NULL, NULL);
+        } else {
+                rv = ldap_simple_bind(ldap_connection, binddn, passwd);
+        }
+
+        if (rv < 0)
+        {
+DBG("do_bind: rv < 0");
+                
+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
+                if (ldap_get_option (ldap_connection, LDAP_OPT_ERROR_NUMBER, &rc) !=
+            LDAP_SUCCESS)
+                {
+                  rc = LDAP_UNAVAILABLE;
+                }
+#else
+                rc = ldap_connection->ld_errno;
+#endif /* LDAP_OPT_ERROR_NUMBER */
+                /* Notify if we failed. */
+                DBG3("could not connect to LDAP server as %s - %d - %s",
+                  binddn, rc, ldap_err2string (rc));
+
+                return rc;
+        }
+
+        rc = ldap_result (ldap_connection, rv, 0, &tv, &result);
+        if (rc > 0)
+        {
+DBG1("do_bind rc=%d", rc);
+                //debug ("<== do_bind");
+                return ldap_result2error (ldap_connection, result, 1);
+        }
+
+        /* took too long */
+        if (rc == 0)
+        {
+DBG("do_bind rc=0");
+                
+                ldap_abandon (ldap_connection, rv);
+        }
+
+DBG("do_bind return -1");
+        return -1;
+}
+
+/*
+ * Opes connection to an LDAP server
+ * uri must be one URI
+ */
+static int do_open (LDAP **ld, const char* uri, int defport, ldap_ssl_options_t ssl_on)
+{
+        
+#if defined(LDAP_OPT_NETWORK_TIMEOUT) || defined(HAVE_LDAP_START_TLS)   
+        struct timeval tv;
+#endif
+#ifdef HAVE_LDAP_START_TLS
+        struct timeval *tvp;
+        LDAPMessage *res = NULL;
+        int msgid;
+#endif  
+        int rc;
+
+        rc = do_init (ld, uri, defport);
+        
+        if (rc != LDAP_SUCCESS)
+        {
+                DBG("do_open(): do_init failed");
+                return rc;
+    }
+
+        if( ! *ld)
+        {
+                DBG("do_open(): internal error - assert (*ld != NULL)");
+                return(-2);
+        }
+
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_PROTOCOL_VERSION)
+        ldap_set_option (*ld, LDAP_OPT_PROTOCOL_VERSION, &ldapVersion);
+#endif /* LDAP_OPT_PROTOCOL_VERSION */
+
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_NETWORK_TIMEOUT)
+//      ldap_set_option (*ld, LDAP_OPT_NETWORK_TIMEOUT, &timeout);
+
+        rc = ldap_set_option(*ld, LDAP_OPT_NETWORK_TIMEOUT, &timeout);
+        if ( rc != LDAP_SUCCESS ) {
+                DBG2("Warning: failed to set connection timeout to %d: %s", timeout, ldap_err2string(rc));
+        } else
+                DBG1("Set connection timeout to %d", timeout);
+#endif /* LDAP_OPT_NETWORK_TIMEOUT */
+
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_NETWORK_TIMEOUT)
+        tv.tv_sec = bind_timelimit;
+        tv.tv_usec = 0;
+        ldap_set_option (*ld, LDAP_OPT_NETWORK_TIMEOUT, &tv);
+#endif /* LDAP_OPT_NETWORK_TIMEOUT */
+
+
+#if defined(HAVE_LDAP_START_TLS_S) || defined(HAVE_LDAP_START_TLS)
+        if (ssl_on == SSL_START_TLS)
+    {
+                int version;
+
+                // we need V3 at least
+                if (ldap_get_option(*ld, LDAP_OPT_PROTOCOL_VERSION,
+                                                        &version) == LDAP_OPT_SUCCESS)
+                {
+                        if (ldapVersion < LDAP_VERSION3)
+                        {
+                                ldapVersion = LDAP_VERSION3;
+                                ldap_set_option (*ld, LDAP_OPT_PROTOCOL_VERSION,
+                                                &ldapVersion);
+                }
+                }
+
+                /* set up SSL context */
+                if (do_ssl_options (*ld) != LDAP_SUCCESS)
+                {
+                        ldap_unbind (*ld);
+                        DBG("do_open(): SSL setup failed");
+                        return LDAP_UNAVAILABLE;
+                }
+
+#ifdef HAVE_LDAP_START_TLS
+
+                DBG("do_open(): do_start_tls");
+                rc = ldap_start_tls (*ld, NULL, NULL, &msgid);
+                if (rc != LDAP_SUCCESS)
+                {
+                  DBG1("do_open(): ldap_start_tls failed: %s", ldap_err2string (rc));
+                  return rc;
+                }
+
+                if (bind_timelimit == LDAP_NO_LIMIT)
+                {
+                        tvp = NULL;
+        }
+                else
+        {
+                tv.tv_sec = bind_timelimit;
+                tv.tv_usec = 0;
+                tvp = &tv;
+        }
+
+                rc = ldap_result (*ld, msgid, 1, tvp, &res);
+                if (rc == -1)
+                {
+#if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER)
+                        if (ldap_get_option (*ld, LDAP_OPT_ERROR_NUMBER, &rc) != LDAP_SUCCESS)
+                        {
+                                rc = LDAP_UNAVAILABLE;
+                        }
+#else
+                        rc = ld->ld_errno;
+#endif /* LDAP_OPT_ERROR_NUMBER */
+
+                        DBG1("do_open(): ldap_start_tls failed: %s", ldap_err2string (rc));
+                        return rc;
+                }
+
+                rc = ldap_result2error (*ld, res, 1);
+                if (rc != LDAP_SUCCESS)
+                {
+                        DBG1("do_open(): ldap_result2error failed: %s)", ldap_err2string (rc));
+                        return rc;
+                }
+
+                rc = ldap_install_tls (*ld);
+#else
+                rc = ldap_start_tls_s (*ld, NULL, NULL);
+#endif /* HAVE_LDAP_START_TLS */
+
+                if (rc == LDAP_SUCCESS)
+                {
+                        DBG("do_open(): TLS startup succeeded");
+                }
+                else
+                {
+                        ldap_unbind (*ld);
+                        DBG2("do_open(): TLS startup failed for LDAP server %s: %s",
+                             uri, ldap_err2string (rc));
+                    return rc;
+                }
+        }
+        else
+#endif /* HAVE_LDAP_START_TLS_S || HAVE_LDAP_START_TLS */
+
+        /*
+         * If SSL is desired, then enable it.
+         */
+        if (ssl_on == SSL_LDAPS)
+    {
+#if defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)
+                int tls = LDAP_OPT_X_TLS_HARD;
+                if (ldap_set_option (*ld, LDAP_OPT_X_TLS, &tls) !=
+                        LDAP_SUCCESS)
+                {
+                        ldap_unbind (*ld);
+                        DBG("do_open(): TLS setup failed");
+                        return LDAP_UNAVAILABLE;
+                }
+
+                /* set up SSL context */
+                if (do_ssl_options (*ld) != LDAP_SUCCESS)
+                {
+                        ldap_unbind (*ld);
+                        DBG("do_open(): SSL setup failed");
+                        return LDAP_UNAVAILABLE;
+                }
+#endif          
+    }
+        
+        rc = do_bind (*ld, bind_timelimit);
+        if (rc != LDAP_SUCCESS)
+        {
+                DBG2("do_open(): failed to bind to LDAP server %s: %s",
+                         uri, ldap_err2string (rc));
+                ldap_unbind (*ld);
+        }
+        return rc;
+}
+
+/*
+ * add singe URI to array of uris
+ */
+int ldap_add_uri (char **uris, const char *a_uri, char **buffer, size_t *buflen)
+{
+        int i;
+        size_t uri_len;
+
+        for (i = 0; uris[i] != NULL; i++)
+    ;
+
+        if (i == LDAP_CONFIG_URI_MAX)
+        {
+                DBG("maximum number of URIs exceeded");
+                return -1;
+        }
+
+        uri_len = strlen (a_uri);
+
+        if (*buflen < uri_len + 1)
+        {
+                DBG("buffer to small for URI");
+                return -1;
+        }
+
+        memcpy (*buffer, a_uri, uri_len + 1);
+
+        uris[i] = *buffer;
+        uris[i + 1] = NULL;
+
+        *buffer += uri_len + 1;
+        *buflen -= uri_len + 1;
+
+        DBG1("added URI %s", a_uri);
+
+        return 0;
+}
+
+
 
 /**
 * Get certificate from LDAP-Server.
 */
+// not global then 
+//  static int ldap_get_certificate(const char *login, X509*** ldap_x509) {
 static int ldap_get_certificate(const char *login) {
         LDAP *ldap_connection;
@@ -82 +598 @@
         char filter_str[100];
         char *attrs[2];
+        int rv;
+        void *bv_val;
+
+        char uri[4096];
+        char uribuf[4096];
+        char *uris[LDAP_CONFIG_URI_MAX + 1];
+        const char *p;
+        int current_uri = 0, start_uri = 0;
+
+        uris[0] = NULL;
 
         attrs[0] = (char *)attribute;
         attrs[1] = NULL;
-        
 
         DBG1("ldap_get_certificate(): begin login = %s", login);
 
+        // Put the login to the %s in Filterstring
         snprintf(filter_str, sizeof(filter_str), filter, login); 
 
         DBG1("ldap_get_certificate(): filter_str = %s", filter_str);
         
-        ldap_connection = ldap_init(ldaphost, ldapport);
-        if ( NULL == ldap_connection) {
-                DBG("ldap_init() failed");
+        // parse and split URI config entry  
+        char *buffer = uribuf;
+    size_t buflen = sizeof (uribuf);
+
+        strncpy(uri, ldapURI, sizeof (uri)-1);
+
+        /* Add a space separated list of URIs */
+        // TODO: no spaces in one URI allowed => URL-encoding? 
+        if(strncmp(ldapURI,"",1))
+                for (p = uri; p != NULL; )
+                {
+                        char *q = strchr (p, ' ');
+                        if (q != NULL)
+                                *q = '\0';
+                        
+                        if( strlen(p) > 1 ) // SAW: don't add spaces   
+                                rv = ldap_add_uri (uris, p, &buffer, &buflen);
+                        
+                        p = (q != NULL) ? ++q : NULL;
+                        
+                        if (rv)
+                                break;
+                }
+    // set the default port if no port is given
+        if (ldapport == 0)
+    {
+                if (ssl_on == SSL_LDAPS)
+                {
+                  ldapport = LDAPS_PORT;
+                }
+                else
+                {
+                  ldapport = LDAP_PORT;
+                }
+        }
+
+        // add ldaphost to uris if set, nevermind "uri" is set in config
+        if( strlen(ldaphost) > 1 )
+        {
+                /* No port specified in URI and non-default port specified */
+                snprintf (uri, sizeof (uri), "%s%s:%d", 
+                       ssl_on == SSL_LDAPS ? "ldaps://" : "ldap://",
+                       ldaphost, ldapport);
+                rv = ldap_add_uri (uris, uri, &buffer, &buflen);
+        }
+
+        if (uris[0] == NULL)
+    {
+                DBG("ldap_get_certificate(): Nor URI or useable Host entry found");
                 return(-1);
-        }
-
-        if ( 0 != ldap_simple_bind_s(ldap_connection, binddn, passwd)) {
-                DBG("ldap_simple_bind_s() failed");
+    }
+        
+        /* Attempt to connect to specified URI in order until do_open succeed */
+        start_uri = current_uri;
+        do
+        {
+                if(uris[current_uri] != NULL)
+                        DBG1("ldap_get_certificate(): try do_open for %s", uris[current_uri]);
+                rv = do_open(&ldap_connection, uris[current_uri], ldapport, ssl_on);
+                //  hot-fix, because in some circumstances an LDAP_SERVER_DOWN is returned  
+                if (rv != LDAP_UNAVAILABLE && rv != LDAP_SERVER_DOWN)
+                        break;
+                current_uri++;
+                
+                if (uris[current_uri] == NULL)
+                        current_uri = 0;
+        }
+        while (current_uri != start_uri);
+        
+        if( rv != LDAP_SUCCESS )
+        {
+                DBG("ldap_get_certificate(): do_open failed");
                 return(-2);
         }
 
-        if ( LDAP_SUCCESS != ldap_search_s(ldap_connection, base, LDAP_SCOPE_SUBTREE, filter_str, attrs, 0, &res)) {
-                DBG("ldap_search_s() failed");
+        /* TODO: (1) The problem: if an working uri is found it is used
+             and if there is an (SSL-)error, no other one is tried
+             (2) There is no session, so we don't know which LDAP_Server
+             is the last with a successful connection. So we try the same
+             server again. Perhaps create a state file/smem/etc. ?
+    */
+
+        rv = ldap_search_s(
+                                ldap_connection, 
+                                base, 
+                                sscope[scope], 
+                                filter_str, 
+                                attrs, 
+                                0, 
+                                &res);
+        if ( rv != LDAP_SUCCESS ) {
+                DBG1("ldap_search_s() failed: %s", ldap_err2string(rv));
                 ldap_unbind_s(ldap_connection);
                 return(-3);
@@ -112 +717 @@
                 DBG1("ldap_get_certificate(): entries = %d", entries);
 
+                if( entries > 1 ) {
+                        DBG("!  Warning, more than one entry found. Please choose \"filter\" and"); 
+                        DBG("!  \"attribute\" in ldap mapper config section of your config,");
+                        DBG("!  that only one entry with one attribute is matched");
+                        DBG("!  Maybe there is an other problem in ldap with not unique user");
+                        DBG("!  entries in your LDAP server.");
+                }
+                                
                 /* Only first entry is used. "filter" and "attribute" 
                  *  should be choosen, so that only one entry with
                  * one attribute is returned */
                 if ( NULL == (entry = ldap_first_entry(ldap_connection, res))){
-                        DBG("ldap_first_entry() failed");
+                        DBG("ldap_first_entry() failed: %s");
                         ldap_unbind_s(ldap_connection);
                         return(-4);
@@ -129 +742 @@
                 DBG1("attribute name = %s", name);
 
-                /* TODO: Add support for multi-value attribute for usercertificate */
                 bvals = ldap_get_values_len(ldap_connection, entry, name);
-                ldap_x509 = d2i_X509(NULL, (unsigned char **) &bvals[0]->bv_val, bvals[0]->bv_len);
-                if (NULL == ldap_x509) {
-                        DBG("d2i_X509() failed");
-                        ldap_msgfree(res);
-                        ldap_unbind_s(ldap_connection);
-                        return(-6);
-                }else {
-                        DBG("d2i_X509(): success");
+                certcnt = ldap_count_values_len(bvals);
+
+                DBG1("number auf usercertificates = %d", certcnt);
+        
+                //*ldap_x509 = malloc(sizeof(X509*) * certcnt );
+                ldap_x509 = malloc(sizeof(X509*) * certcnt );
+                
+                rv = 0;
+                while(rv < certcnt )
+                {
+                        // SaW: not nifty, but otherwise gcc doesn't optimize
+                        bv_val = &bvals[rv]->bv_val;
+                        ldap_x509[rv] = d2i_X509(NULL, ((const unsigned char **) bv_val), bvals[rv]->bv_len);
+                        if (NULL == ldap_x509) {
+                                DBG1("d2i_X509() failed for certificate %d", rv);
+                                free(ldap_x509);                                
+                                certcnt=0;
+                                ldap_msgfree(res);
+                                ldap_unbind_s(ldap_connection);
+                                return(-6);
+                        }else {
+                                DBG1("d2i_X509(): success for certificate %d", rv);
+                        }
+                        rv++;
                 }
                 ldap_msgfree(res);
+                // TODO: this leads to a segfault, but the doc said ...
+                //      ldap_value_free_len(bvals);
         }
         if ( 0 != (ret = ldap_unbind_s(ldap_connection))) {
@@ -156 +786 @@
         ldaphost = scconf_get_str(blk,"ldaphost",ldaphost);
         ldapport = scconf_get_int(blk,"ldapport",ldapport);
+        ldapURI = scconf_get_str(blk,"uri",ldapURI);
         scope = scconf_get_int(blk,"scope",scope);
         binddn = scconf_get_str(blk,"binddn",binddn);
@@ -165 +796 @@
         searchtimeout = scconf_get_int(blk,"searchtimeout",searchtimeout);
 
+        const char *ssltls =  scconf_get_str(blk,"ssl","off");
+        if (! strncasecmp (ssltls, "tls", 3)) 
+                ssl_on = SSL_START_TLS;
+        else if( ! strncasecmp (ssltls, "on", 2))
+                ssl_on = SSL_LDAPS;
+        else if( ! strncasecmp (ssltls, "ssl", 3))
+                ssl_on = SSL_LDAPS;
+                
+#if defined HAVE_LDAP_START_TLS_S || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))
+        /* TLS specific options */
+        tls_randfile = scconf_get_str(blk,"tls_randfile",tls_randfile);
+        tls_cacertfile = scconf_get_str(blk,"tls_cacertfile",tls_cacertfile);
+        tls_cacertdir = scconf_get_str(blk,"tls_cacertdir",tls_cacertdir);
+        tls_checkpeer=scconf_get_int(blk,"tls_checkpeer",tls_checkpeer);
+        tls_ciphers = scconf_get_str(blk,"tls_ciphers",tls_ciphers);
+        tls_cert = scconf_get_str(blk,"tls_cert",tls_cert); 
+        tls_key = scconf_get_str(blk,"tls_key",tls_key);
+#endif
+
+
         set_debug_level(debug);
+DBG1("test ssltls = %s", ssltls);
 
         DBG("LDAP mapper started.");
-        DBG1("debug      = %d", debug);
-        DBG1("ignorecase = %d", ignorecase);
-        DBG1("ldaphost   = %s", ldaphost);
-        DBG1("ldapport   = %d", ldapport);
-        DBG1("scope      = %d", scope);
-        DBG1("binddn     = %s", binddn);
-        DBG1("passwd     = %s", passwd);
-        DBG1("base       = %s", base);
-        DBG1("attribute  = %s", attribute);
-        DBG1("filter     = %s", filter);
+        DBG1("debug         = %d", debug);
+        DBG1("ignorecase    = %d", ignorecase);
+        DBG1("ldaphost      = %s", ldaphost);
+        DBG1("ldapport      = %d", ldapport);
+        DBG1("ldapURI       = %s", ldapURI);
+        DBG1("scope         = %d", scope);
+        DBG1("binddn        = %s", binddn);
+        DBG1("passwd        = %s", passwd);
+        DBG1("base          = %s", base);
+        DBG1("attribute     = %s", attribute);
+        DBG1("filter        = %s", filter);
+        DBG1("searchtimeout = %d", searchtimeout);
+        DBG1("ssl_on        = %d", ssl_on);
+#if defined HAVE_LDAP_START_TLS_S || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS))
+        DBG1("tls_randfile  = %s", tls_randfile);
+        DBG1("tls_cacertfile= %s", tls_cacertfile);
+        DBG1("tls_cacertdir = %s", tls_cacertdir);
+        DBG1("tls_checkpeer = %d", tls_checkpeer);
+        DBG1("tls_ciphers   = %s", tls_ciphers);
+        DBG1("tls_cert      = %s", tls_cert); 
+        DBG1("tls_key       = %s", tls_key);    
+#endif
         return 1;
 
@@ -194 +858 @@
 
 static int ldap_mapper_match_user(X509 *x509, const char *login, void *context) {
+        //X509 **ldap_x509 = 0;
         int match_found = 0;
-
+        int i=0;
+
+        //if ( 1 != ldap_get_certificate(login, &ldap_x509)){
         if ( 1 != ldap_get_certificate(login)){
                 DBG("ldap_get_certificate() failed");
@@ -201 +868 @@
         } else {
                 /* TODO: maybe compare public keys instead of hashes */
-                if ( 0 == X509_cmp(x509, ldap_x509)) {
-                        DBG("Certifcates matching");
-                        match_found = 1;
-                } else {
-                        DBG("Certifcates NOT matching");
-                        match_found = 0;
-                }
+                while( i<certcnt && !match_found ) {
+                        if ( 0 == X509_cmp(x509, ldap_x509[i])) {
+                                DBG1("Certificate %d is matching", i);
+                                match_found = 1;
+                        } else { 
+                                DBG1("Certificate %d is NOT matching", i);
+                        }
+                        i++;
+                }
+                if (certcnt) 
+                        free(ldap_x509);
+                certcnt=0;
         }
         return match_found;
@@ -229 +901 @@
         }
         endpwent();
+
+#ifdef false
+        int res;        
+        res= ldap_mapper_match_user(x509,"wefel",context);
+        if (res) {
+                        DBG("Certificate maps to user wefel");
+                        found= clone_str("wefel");
+        } else {
+                        DBG("Certificate map to user wefel failed");
+        }
+#endif
+        
         return found;
 }
@@ -253 +937 @@
         mapper_module *pt;
 
-        pt = init_mapper_st(blk,mapper_name);
+    pt = init_mapper_st(blk,mapper_name);
 
         if (blk) {
@@ -261 +945 @@
                 DBG1("No configuration entry for mapper '%s'. Assume defaults", mapper_name);
         }
-        
-        return pt;
-}
+    return pt;
+}