//******************************************************************************
// @@@ START COPYRIGHT @@@
//
// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.
//
// @@@ END COPYRIGHT @@@
//******************************************************************************
//******************************************************************************
//                                                                             *
//     This program is used to test authenticating with an LDAP server         *
//  configured in a Trafodion instance. It may also be used to test the        *
//  correctness of the code that communicates with the LDAP server.            *
//                                                                             *
//   Trafodion does not to be started to run this program.                     *
//                                                                             *
//******************************************************************************
#include "ldapconfignode.h"
#include "authEvents.h"
#include "auth.h"

#include <stdio.h>
#include <string.h>
#include <string>
#include <stdlib.h>
#include <iostream>
#include <unistd.h>
#include <getopt.h>
#include <termios.h>
#include <sys/types.h>
#include <unistd.h>
#include <time.h>
#include <vector>


using namespace std;

enum Operation {
   Authenticate = 2,
   Lookup = 3
};

AUTH_OUTCOME authenticateLDAPUser(
   std::vector<AuthEvent> &       authEvents,
   const char *                   username,
   const char *                   password,
   LDAPConfigNode::LDAPConfigType configType,
   char *                         searchHostName,
   char *                         authHostName);
   
void doAuthenticate(
   std::vector<AuthEvent> &       authEvents,
   const char *                   username,
   const char *                   password,
   LDAPConfigNode::LDAPConfigType configType,
   bool                           verbose);
   
void doCanaryCheck(
   std::vector<AuthEvent> &       authEvents,
   const char *                   username,
   LDAPConfigNode::LDAPConfigType configType,
   bool                           verbose,
   AUTH_OUTCOME                   exitCode);   
   
LDSearchStatus lookupLDAPUser(
   std::vector<AuthEvent> &        authEvents,
   const char *                    username,          
   LDAPConfigNode::LDAPConfigType  configType,        
   char *                          searchHostName);
   
void printTime();        
      
void reportResults(
    Operation                      operation, 
    const std::vector<AuthEvent> & authEvents,
    const char                   * username,
    AUTH_OUTCOME                   outcome,
    int                            verbose);

void setEcho(bool enable);

// *****************************************************************************
// *                                                                           *
// * Function: authenticateLDAPUser                                            *
// *                                                                           *
// *    Authenticate an LDAP user with either the primary or secondary LDAP    *
// * configuration.                                                            *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <authEvents>                    std::vector<AuthEvent> &        Out      *
// *    detailed event results of request                                      *
// *                                                                           *
// *  <username>                      const char *                    In       *
// *    is the external username to be checked on the directory server.        *
// *                                                                           *
// *  <password>                      const char *                    In       *
// *    is the password of the external user                                   *
// *                                                                           *
// *  <configType>                    LDAPConfigNode::LDAPConfigType  In       *
// *    is the type of configuration to use.                                   *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// * Returns: AUTH_OUTCOME                                                   *
// *                                                                           *
// *    AUTH_OK                      -- User was authenticated on LDAP server  *
// *    AUTH_REJECTED                -- User was rejected by LDAP server       *
// *    AUTH_FAILED                  -- An error prevented authentication      *
// *                                                                           *
// *****************************************************************************
AUTH_OUTCOME authenticateLDAPUser(
   std::vector<AuthEvent> &       authEvents,
   const char *                   username,
   const char *                   password,
   LDAPConfigNode::LDAPConfigType configType,
   char *                         searchHostName,
   char *                         authHostName)

{

   string userDN = "";       // User DN, used to bind to LDAP serer
   LDAPConfigNode *searchNode;

   // Zero len password is a non-auth bind in LDAP, so we treat it
   // as a failed authorization.
   if (strlen(password) == 0)
      return AUTH_REJECTED;

   searchNode = LDAPConfigNode::GetLDAPConnection(authEvents,configType,SearchConnection,
                                                  searchHostName);

   if (searchNode == NULL) 
      return AUTH_FAILED;

   LDSearchStatus searchStatus = searchNode->lookupUser(authEvents,username,userDN);
                                                     
   if (searchStatus == LDSearchNotFound)
      return AUTH_REJECTED;
      
   if (searchStatus != LDSearchFound)
      return AUTH_FAILED;

   // User is defined there.  But is their password correct?

   LDAPConfigNode *authNode = LDAPConfigNode::GetLDAPConnection(authEvents,configType,
                                                                AuthenticationConnection,
                                                                authHostName);

   if (authNode == NULL)
      return AUTH_FAILED;

   // User exists, let's validate that non-blank password!

   LDAuthStatus authStatus = authNode->authenticateUser(authEvents,userDN.c_str(),password);

   if (authStatus == LDAuthSuccessful)
      return AUTH_OK;
      
   if (authStatus == LDAuthRejected)
      return AUTH_REJECTED;

   return AUTH_FAILED;

}
//************************ End of authenticateLDAPUser *************************

// *****************************************************************************
// *                                                                           *
// * Function: doAuthenticate                                                  *
// *                                                                           *
// *    Authenticate an LDAP user with either the primary or secondary LDAP    *
// * configuration.                                                            *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <authEvents>                    std::vector<AuthEvent> &        Out      *
// *    detailed event results of request                                      *
// *                                                                           *
// *  <username>                      const char *                    In       *
// *    is the external username to be checked on the directory server.        *
// *                                                                           *
// *  <password>                      const char *                    In       *
// *    is the password of the external user                                   *
// *                                                                           *
// *  <configType>                    LDAPConfigNode::LDAPConfigType  In       *
// *    is the type of configuration to use.                                   *
// *                                                                           *
// *  <verbose>                       bool                            In       *
// *    if true, additional output is produced.                                *
// *                                                                           *
// *****************************************************************************
void doAuthenticate(
   std::vector<AuthEvent> &       authEvents,
   const char *                   username,
   const char *                   password,
   LDAPConfigNode::LDAPConfigType configType,
   bool                           verbose)

{

   LDAPConfigNode::ClearRetryCounts();
   
   char searchHostName[256];
   char authHostName[256];

   searchHostName[0] = authHostName[0] = 0;
 
   AUTH_OUTCOME rc = authenticateLDAPUser(authEvents,username,password,configType,
                                          searchHostName,authHostName);
                             
   if (verbose)
   {
      cout << "Search host name: " << searchHostName << endl;
      cout << "Auth host name: " << authHostName << endl;
   }
       
   // How'd it go?  In addition to a thumbs up/down, print diagnostics if 
   // requested.  This matches production behavior; we log retries if
   // successful, and we log all internal errors as well as number of retries
   // if authentication failed due to a resource error.  Resource errors include
   // problems with the LDAP servers and parsing the LDAP connection configuration
   // file (.traf_authentication_config).
           
   reportResults(Authenticate,authEvents,username,rc,verbose);

}
//*************************** End of doAuthenticate ****************************

// *****************************************************************************
// *                                                                           *
// * Function: doCanaryCheck                                                   *
// *                                                                           *
// *    Lookup a user on an LDAP server to test configuration and connection.  *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <authEvents>                    std::vector<AuthEvent> &        Out      *
// *    detailed event results of request                                      *
// *                                                                           *
// *  <username>                      const char *                    In       *
// *    is the external username to be checked on the directory server.        *
// *                                                                           *
// *  <configType>                    LDAPConfigNode::LDAPConfigType  In       *
// *    is the type of configuration to use.                                   *
// *                                                                           *
// *  <verbose>                       bool                            In       *
// *    if true, additional output is produced.                                *
// *                                                                           *
// *****************************************************************************
void doCanaryCheck(
   std::vector<AuthEvent> &       authEvents,
   const char *                   username,
   LDAPConfigNode::LDAPConfigType configType,
   bool                           verbose,
   AUTH_OUTCOME                   exitCode)   
   
{
   exitCode = AUTH_OK;

   char searchHostName[256];

   searchHostName[0] = 0;
   
   LDSearchStatus searchStatus = lookupLDAPUser(authEvents,username,configType,searchHostName);

   if (verbose)
      cout << "Search host name: " << searchHostName << endl;
   
   switch (searchStatus)
   {
      case LDSearchFound:
         exitCode = AUTH_OK;
         break;
      case LDSearchNotFound:
         exitCode = AUTH_REJECTED;
         break;
      case LDSearchResourceFailure:
         exitCode = AUTH_FAILED;
         break;
      default:
         exitCode = AUTH_FAILED;
   }
   

   reportResults(Lookup,authEvents,username,exitCode,verbose);

}
//*************************** End of doCanaryCheck *****************************


// *****************************************************************************
// *                                                                           *
// * Function: lookupLDAPUser                                                  *
// *                                                                           *
// *    Determines if the username is defined on an LDAP server in the         *
// *  specified configuration.                                                 *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <authEvents>                    std::vector<AuthEvent> &        Out      *
// *    detailed event results of request                                      *
// *                                                                           *
// *  <username>                      const char *                    In       *
// *    is the external username to be checked on the directory server.        *
// *                                                                           *
// *  <configType>                    LDAPConfigType                  In       *
// *    specifies which configuration (i.e.,which set of LDAP servers) to use  *
// *  when searching for the username.                                         *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// * Returns: LDSearchStatus                                                   *
// *                                                                           *
// *   LDSearchFound            -- User was found on LDAP server               *
// *   LDSearchNotFound         -- User was not found on LDAP server           *
// *   LDSearchResourceFailure  -- An error prevented checking                 *
// *                                                                           *
// *****************************************************************************
LDSearchStatus lookupLDAPUser(
   std::vector<AuthEvent> &        authEvents,
   const char *                    username,          
   LDAPConfigNode::LDAPConfigType  configType,        
   char *                          searchHostName)

{
  
LDAPConfigNode *searchNode;

   searchNode = LDAPConfigNode::GetLDAPConnection(authEvents,configType,SearchConnection,
                                                  searchHostName);

   if (searchNode == NULL) 
      return LDSearchResourceFailure;
      
string userDN = "";

   return searchNode->lookupUser(authEvents,username,userDN);

}
//************************** End of lookupLDAPUser *****************************

// *****************************************************************************
// *                                                                           *
// * Function: printTime                                                       *
// *                                                                           *
// *    Displays the current time in format YYYY-MM-DD hh:mm:ss.               *
// *                                                                           *
// *****************************************************************************
void printTime()

{

time_t t = time(NULL);
struct tm tm = *localtime(&t);

   printf("%4d-%02d-%02d %02d:%02d:%02d\n",tm.tm_year + 1900,tm.tm_mon + 1, 
          tm.tm_mday,tm.tm_hour,tm.tm_min,tm.tm_sec);

}
//***************************** End of printTime *******************************


// *****************************************************************************
// *                                                                           *
// * Function: printUsage                                                      *
// *                                                                           *
// *    Displays usage information for this program.                           *
// *                                                                           *
// *****************************************************************************
void printUsage()

{

   cout << "Usage:ldapcheck [option]..." << endl;
   cout << "option ::= --help|-h            display usage information" << endl;
   cout << "           --username=<LDAP-username>" << endl;
   cout << "           --password[=<password>]" << endl;
   cout << "           --platform           Use internal cluster configuration" << endl;
   cout << "           --primary            Use primary (ENTERPRISE|LOCAL) configuration" << endl;
   cout << "           --secondary          Use secondary (CLUSTER|REMOTE) configuration" << endl;
   cout << "           --verbose            Display non-zero retry counts and LDAP errors" << endl;

}
//***************************** End of printUsage ******************************


// *****************************************************************************
// *                                                                           *
// * Function: reportResults                                                   *
// *                                                                           *
// * Logs and optionally displays any retries, errors, and outcome of an       *
// * authentication or lookup operation.                                       *
// *                                                                           *
// *****************************************************************************
void reportResults(
    Operation                      operation,
    const std::vector<AuthEvent> & authEvents,
    const char                   * username,
    AUTH_OUTCOME                   outcome,
    int                            verbose)

{

   std::string msg;

   // Report any retries
   size_t bindRetryCount = LDAPConfigNode::GetBindRetryCount();
   size_t searchRetryCount = LDAPConfigNode::GetSearchRetryCount();

   char operationString[20];
   
   if (operation == Authenticate)
      strcpy(operationString,"Authentication");
   else
      strcpy(operationString,"Lookup"); 
      

   // Log and optionally display event for:
   //    search (name lookup) operation that was retried
   if (searchRetryCount > 0)
   { 
      char searchRetryMessage[5100];
       
      sprintf(searchRetryMessage,"%s required %d search retries. ",
              operationString,searchRetryCount);
      msg = searchRetryMessage;
      AuthEvent authEvent (DBS_AUTH_RETRY_SEARCH, msg, LL_INFO);
      authEvent.setCallerName("ldapcheck");
      authEvent.logAuthEvent();
      if (verbose)
         cout << searchRetryMessage << endl; 
   }
   
   // Log and optionally display event for:
   //   any bind (password authentication) operation that was retried
   if (bindRetryCount > 0)
   { 
      char bindRetryMessage[5100];
       
      sprintf(bindRetryMessage,"%s required %d bind retries. ",
              operationString,bindRetryCount);
      msg = bindRetryMessage;
      AuthEvent authEvent (DBS_AUTH_RETRY_BIND, msg, LL_INFO);
      authEvent.setCallerName("ldapcheck");
      authEvent.logAuthEvent();
      if (verbose)
         cout << bindRetryMessage << endl; 
   }

  // report any errors and retries

  //  Walk the list of errors encountered during the attempt to authenticate
  //  the username, or username and password, and for each error, log the event 
  //  ID and text. If verbose is true and logLevel is above the error 
  //  level, send message to standard out.
  std::string callerName ("ldapcheck");

  for (size_t i = 0; i < authEvents.size(); i++)
  {
     AuthEvent authEvent = authEvents[i];
     authEvent.setCallerName(callerName);
     authEvent.logAuthEvent();
     if (verbose)
       cout  << "ERROR: " << authEvent.getEventText().c_str() << endl;
  }

  // Finally, report the outcome.
   std::string outcomeDesc = getAuthOutcome(outcome);
   char buf[MAX_EVENT_MSG_SIZE];
   snprintf(buf, MAX_EVENT_MSG_SIZE,
                "Authentication request: externalUser %s, "
                "result %d (%s)",
                username,
                (int)outcome, outcomeDesc.c_str());
   msg = buf;
   AuthEvent authEvent (DBS_AUTHENTICATION_ATTEMPT,msg, LL_INFO);
   authEvent.setCallerName("ldapcheck");
   authEvent.logAuthEvent();
   cout  << "INFO: " << authEvent.getEventText().c_str() << endl;

}
//*************************** End of reportResults *****************************


// *****************************************************************************
// *                                                                           *
// * Function: setEcho                                                         *
// *                                                                           *
// *    Enables or disables echoing of input characters.                       *
// *                                                                           *
// *****************************************************************************
// *                                                                           *
// *  Parameters:                                                              *
// *                                                                           *
// *  <enable>                        bool                            In       *
// *    is true if echo should be enabled, false if it should be disabled.     *
// *                                                                           *
// *****************************************************************************
void setEcho(bool enable)

{

termios tty;

   tcgetattr(STDIN_FILENO,&tty);
   
   if (enable)
      tty.c_lflag |= ECHO;
   else
      tty.c_lflag &= ~ECHO;

   tcsetattr(STDIN_FILENO,TCSANOW,&tty);

}
//****************************** End of setEcho ********************************


#pragma page "main"
// *****************************************************************************
// *                                                                           *
// * Function: main                                                            *
// *                                                                           *
// *    Parses the arguments and attempt to authentication the username and    *
// * password.                                                                 *
// *                                                                           *
// * Trafodion does not to be started to run this program.                     *
// *                                                                           *
// *****************************************************************************
int main(int argc,char *argv[])

{
   // ldapcheck needs a username.  If not supplied, issue an error
   // and print usage information. 
   if (argc <= 1)
   {
      cout << "Username required to check LDAP" << endl;
      printUsage();
      exit(1);
   }
   
   // Help!
   if (strcmp(argv[1],"-h") == 0 || strcmp(argv[1],"--help") == 0)
   {
      printUsage();
      exit(0);
   } 
   
   enum Options {
      Primary = 1,
      Secondary = 0,
      Platform = 2};
   
   int c;
   int optionFlag = Primary;
   int verbose = 0;
   string password;
   char username[129];
   bool usernameSpecified = false;
   bool passwordSpecified = false;
   int loopCount = 1;
   int delayTime = 0;
   bool looping = false;

   // Walk the list of options.  Username and password are required, although
   // the password can be left blank and prompted for.
   while (true)
   {
      static struct option long_options[] =
      {
         {"one",       no_argument,&optionFlag,Primary},
         {"two",       no_argument,&optionFlag,Secondary},
         {"primary",   no_argument,&optionFlag,Primary},
         {"secondary", no_argument,&optionFlag,Secondary},
         {"enterprise",no_argument,&optionFlag,Primary},
         {"cluster",   no_argument,&optionFlag,Secondary},
         {"local",     no_argument,&optionFlag,Primary},
         {"remote",    no_argument,&optionFlag,Secondary},
         {"platform",  no_argument,&optionFlag,Platform},
         {"verbose",   no_argument,&verbose,1},
         {"loop",      optional_argument,0,'l'},
         {"delay",     optional_argument,0,'d'},
         {"password",  optional_argument,0,'p'},
         {"username",  required_argument,0,'u'},
         {0, 0, 0, 0}
      };
      int option_index = 0;
 
      c = getopt_long(argc,argv,"u:p::",long_options,&option_index);
 
      // No more options, break out of loop
      if (c == -1)
         break;
                 
      switch (c)
      {
         case 0:
            break;
 
         case 'u':
            if (usernameSpecified)
            {
               cout << "Username already specified" << endl;
               exit(1);
            }
            if (strlen(optarg) >= sizeof(username))
            {
               cout << "Username limited to 128 characters" << endl;
               exit(1);
            }
            strcpy(username,optarg);
            usernameSpecified = true;
            break;
 
         case 'p':
            if (passwordSpecified)
            {
               cout << "Password already specified" << endl;
               exit(1);
            }
            if (optarg)
            {
               if (strlen(optarg) > 64)
               {
                  cout << "Password limited to 64 characters" << endl;
                  exit(1);
               }
               password = optarg;
            }
            else
               do
               {
                  cout << "Password: ";
                  setEcho(false);
                  getline(cin,password);
                  setEcho(true);
                  cout << endl;
                  if (password.size() > 64)
                     cout << "Password limited to 64 characters" << endl;
                }
                while (password.size() > 64);
            passwordSpecified = true;
            break;
         case 'l':
            loopCount = atoi(optarg);
            if (loopCount <= 0)
            {
               cout << "Loop count must be at least 1" << endl;
               exit(1);
            }
            looping = true;
         case 'd':
            delayTime = atoi(optarg);
            if (delayTime <= 0)
            {
               cout << "Delay time must be at least 1" << endl;
               exit(1);
            }
         case '?':
            // getopt_long already printed an error message.
            break;
 
         default:
            cout << "Internal error,option " << c << endl;
            exit(1);
      }
   }
 
   // If there are any remaining command line arguments, report an error
   if (optind < argc)
   {
      cout << "Unrecognized text" << endl; 
      while (optind < argc)
          cout << argv[optind++] << " ";
      cout << endl;
      printUsage();
      exit(1);
   }
   
   // Verify a username was supplied, or we have nothing to do
   if (!usernameSpecified)
   {
      cout << "Username required" << endl;
      printUsage();
      exit(1);   
   }
   
   LDAPConfigNode::LDAPConfigType configType = LDAPConfigNode::PrimaryConfiguration;

   switch (optionFlag)
   {
      case Secondary:
         configType = LDAPConfigNode::SecondaryConfiguration;
         break;
      case Primary:
         break;
         configType = LDAPConfigNode::PrimaryConfiguration;
      case Platform:
         break;
         configType = LDAPConfigNode::SecondaryInternalConfiguration;
         break;
      default: //Should not happen, but just in case
         configType = LDAPConfigNode::PrimaryConfiguration;
   }    


   // allocate authEvents to store any issues
   std::vector<AuthEvent>  authEvents;
   authInitEventLog();

   // If no password is supplied, we just perform a name lookup.  This was 
   // added to provide a canary check for the LDAP server without having to 
   // supply a valid password.   
   if (!passwordSpecified)
   {
      AUTH_OUTCOME exitCode = AUTH_OK;
      while (loopCount--)
      {
         if (verbose && looping)
            printTime();
         doCanaryCheck(authEvents,username,configType,verbose,exitCode);
         if (loopCount > 0)
            sleep(delayTime);
      }

      // For the LDAP Canary check mode of ldapcheck, we return one of 
      // three exit codes (AUTH_OUTCOME)
      //
      // AUTH_OK:       LDAP configuration and server(s) good
      // AUTH_REJECTED: User was not defined in LDAP
      // AUTH_FAILED:   Could not communicate with LDAP server(s)  
      //    (check LDAP configuration or server(s))
      exit((int)exitCode);
   }
            
   // We have a username and password.  Let's authenticate!
   while (loopCount--)
   {
      if (verbose && looping)
         printTime();
      doAuthenticate(authEvents,username,password.c_str(),configType,verbose);
      if (loopCount > 0)
         sleep(delayTime);
   }
   exit(0);
   
}
//******************************** End of main *********************************