2 Unix SMB/CIFS implementation.
3 ads (active directory) utility library
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Remus Koos 2001
6 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
7 Copyright (C) Guenther Deschner 2005
8 Copyright (C) Gerald Carter 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "lib/ldb/include/includes.h"
31 * @brief basic ldap client-side routines for ads server communications
33 * The routines contained here should do the necessary ldap calls for
36 * Important note: attribute names passed into ads_ routines must
37 * already be in UTF-8 format. We do not convert them because in almost
38 * all cases, they are just ascii (which is represented with the same
39 * codepoints in UTF-8). This may have to change at some point
43 #define LDAP_SERVER_TREE_DELETE_OID "1.2.840.113556.1.4.805"
45 static SIG_ATOMIC_T gotalarm
;
47 /***************************************************************
48 Signal function to tell us we timed out.
49 ****************************************************************/
51 static void gotalarm_sig(void)
56 LDAP
*ldap_open_with_timeout(const char *server
, int port
, unsigned int to
)
61 DEBUG(10, ("Opening connection to LDAP server '%s:%d', timeout "
62 "%u seconds\n", server
, port
, to
));
66 CatchSignal(SIGALRM
, SIGNAL_CAST gotalarm_sig
);
68 /* End setup timeout. */
70 ldp
= ldap_open(server
, port
);
73 DEBUG(2,("Could not open connection to LDAP server %s:%d: %s\n",
74 server
, port
, strerror(errno
)));
76 DEBUG(10, ("Connected to LDAP server '%s:%d'\n", server
, port
));
79 /* Teardown timeout. */
80 CatchSignal(SIGALRM
, SIGNAL_CAST SIG_IGN
);
86 static int ldap_search_with_timeout(LDAP
*ld
,
87 LDAP_CONST
char *base
,
89 LDAP_CONST
char *filter
,
97 struct timeval timeout
;
100 /* Setup timeout for the ldap_search_ext_s call - local and remote. */
101 timeout
.tv_sec
= lp_ldap_timeout();
104 /* Setup alarm timeout.... Do we need both of these ? JRA. */
106 CatchSignal(SIGALRM
, SIGNAL_CAST gotalarm_sig
);
107 alarm(lp_ldap_timeout());
108 /* End setup timeout. */
110 result
= ldap_search_ext_s(ld
, base
, scope
, filter
, attrs
,
111 attrsonly
, sctrls
, cctrls
, &timeout
,
114 /* Teardown timeout. */
115 CatchSignal(SIGALRM
, SIGNAL_CAST SIG_IGN
);
119 return LDAP_TIMELIMIT_EXCEEDED
;
122 * A bug in OpenLDAP means ldap_search_ext_s can return
123 * LDAP_SUCCESS but with a NULL res pointer. Cope with
124 * this. See bug #6279 for details. JRA.
128 return LDAP_TIMELIMIT_EXCEEDED
;
134 /**********************************************
135 Do client and server sitename match ?
136 **********************************************/
138 bool ads_sitename_match(ADS_STRUCT
*ads
)
140 if (ads
->config
.server_site_name
== NULL
&&
141 ads
->config
.client_site_name
== NULL
) {
142 DEBUG(10,("ads_sitename_match: both null\n"));
145 if (ads
->config
.server_site_name
&&
146 ads
->config
.client_site_name
&&
147 strequal(ads
->config
.server_site_name
,
148 ads
->config
.client_site_name
)) {
149 DEBUG(10,("ads_sitename_match: name %s match\n", ads
->config
.server_site_name
));
152 DEBUG(10,("ads_sitename_match: no match between server: %s and client: %s\n",
153 ads
->config
.server_site_name
? ads
->config
.server_site_name
: "NULL",
154 ads
->config
.client_site_name
? ads
->config
.client_site_name
: "NULL"));
158 /**********************************************
159 Is this the closest DC ?
160 **********************************************/
162 bool ads_closest_dc(ADS_STRUCT
*ads
)
164 if (ads
->config
.flags
& NBT_SERVER_CLOSEST
) {
165 DEBUG(10,("ads_closest_dc: NBT_SERVER_CLOSEST flag set\n"));
169 /* not sure if this can ever happen */
170 if (ads_sitename_match(ads
)) {
171 DEBUG(10,("ads_closest_dc: NBT_SERVER_CLOSEST flag not set but sites match\n"));
175 if (ads
->config
.client_site_name
== NULL
) {
176 DEBUG(10,("ads_closest_dc: client belongs to no site\n"));
180 DEBUG(10,("ads_closest_dc: %s is not the closest DC\n",
181 ads
->config
.ldap_server_name
));
188 try a connection to a given ldap server, returning True and setting the servers IP
189 in the ads struct if successful
191 static bool ads_try_connect(ADS_STRUCT
*ads
, const char *server
, bool gc
)
194 struct NETLOGON_SAM_LOGON_RESPONSE_EX cldap_reply
;
195 TALLOC_CTX
*mem_ctx
= NULL
;
198 if (!server
|| !*server
) {
202 DEBUG(5,("ads_try_connect: sending CLDAP request to %s (realm: %s)\n",
203 server
, ads
->server
.realm
));
205 mem_ctx
= talloc_init("ads_try_connect");
207 DEBUG(0,("out of memory\n"));
211 /* this copes with inet_ntoa brokenness */
213 srv
= SMB_STRDUP(server
);
215 ZERO_STRUCT( cldap_reply
);
217 if ( !ads_cldap_netlogon_5(mem_ctx
, srv
, ads
->server
.realm
, &cldap_reply
) ) {
218 DEBUG(3,("ads_try_connect: CLDAP request %s failed.\n", srv
));
223 /* Check the CLDAP reply flags */
225 if ( !(cldap_reply
.server_type
& NBT_SERVER_LDAP
) ) {
226 DEBUG(1,("ads_try_connect: %s's CLDAP reply says it is not an LDAP server!\n",
232 /* Fill in the ads->config values */
234 SAFE_FREE(ads
->config
.realm
);
235 SAFE_FREE(ads
->config
.bind_path
);
236 SAFE_FREE(ads
->config
.ldap_server_name
);
237 SAFE_FREE(ads
->config
.server_site_name
);
238 SAFE_FREE(ads
->config
.client_site_name
);
239 SAFE_FREE(ads
->server
.workgroup
);
241 ads
->config
.flags
= cldap_reply
.server_type
;
242 ads
->config
.ldap_server_name
= SMB_STRDUP(cldap_reply
.pdc_dns_name
);
243 ads
->config
.realm
= SMB_STRDUP(cldap_reply
.dns_domain
);
244 strupper_m(ads
->config
.realm
);
245 ads
->config
.bind_path
= ads_build_dn(ads
->config
.realm
);
246 if (*cldap_reply
.server_site
) {
247 ads
->config
.server_site_name
=
248 SMB_STRDUP(cldap_reply
.server_site
);
250 if (*cldap_reply
.client_site
) {
251 ads
->config
.client_site_name
=
252 SMB_STRDUP(cldap_reply
.client_site
);
254 ads
->server
.workgroup
= SMB_STRDUP(cldap_reply
.domain
);
256 ads
->ldap
.port
= gc
? LDAP_GC_PORT
: LDAP_PORT
;
257 if (!interpret_string_addr(&ads
->ldap
.ss
, srv
, 0)) {
258 DEBUG(1,("ads_try_connect: unable to convert %s "
265 /* Store our site name. */
266 sitename_store( cldap_reply
.domain
, cldap_reply
.client_site
);
267 sitename_store( cldap_reply
.dns_domain
, cldap_reply
.client_site
);
272 TALLOC_FREE(mem_ctx
);
277 /**********************************************************************
278 Try to find an AD dc using our internal name resolution routines
279 Try the realm first and then then workgroup name if netbios is not
281 **********************************************************************/
283 static NTSTATUS
ads_find_dc(ADS_STRUCT
*ads
)
285 const char *c_domain
;
288 struct ip_service
*ip_list
;
291 bool got_realm
= False
;
292 bool use_own_domain
= False
;
294 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
296 /* if the realm and workgroup are both empty, assume they are ours */
299 c_realm
= ads
->server
.realm
;
301 if ( !c_realm
|| !*c_realm
) {
302 /* special case where no realm and no workgroup means our own */
303 if ( !ads
->server
.workgroup
|| !*ads
->server
.workgroup
) {
304 use_own_domain
= True
;
305 c_realm
= lp_realm();
309 if (c_realm
&& *c_realm
)
314 /* we need to try once with the realm name and fallback to the
315 netbios domain name if we fail (if netbios has not been disabled */
317 if ( !got_realm
&& !lp_disable_netbios() ) {
318 c_realm
= ads
->server
.workgroup
;
319 if (!c_realm
|| !*c_realm
) {
320 if ( use_own_domain
)
321 c_realm
= lp_workgroup();
325 if ( !c_realm
|| !*c_realm
) {
326 DEBUG(0,("ads_find_dc: no realm or workgroup! Don't know what to do\n"));
327 return NT_STATUS_INVALID_PARAMETER
; /* rather need MISSING_PARAMETER ... */
330 if ( use_own_domain
) {
331 c_domain
= lp_workgroup();
333 c_domain
= ads
->server
.workgroup
;
340 * In case of LDAP we use get_dc_name() as that
341 * creates the custom krb5.conf file
343 if (!(ads
->auth
.flags
& ADS_AUTH_NO_BIND
)) {
345 struct sockaddr_storage ip_out
;
347 DEBUG(6,("ads_find_dc: (ldap) looking for %s '%s'\n",
348 (got_realm
? "realm" : "domain"), realm
));
350 if (get_dc_name(domain
, realm
, srv_name
, &ip_out
)) {
352 * we call ads_try_connect() to fill in the
353 * ads->config details
355 if (ads_try_connect(ads
, srv_name
, false)) {
360 return NT_STATUS_NO_LOGON_SERVERS
;
363 sitename
= sitename_fetch(realm
);
365 DEBUG(6,("ads_find_dc: (cldap) looking for %s '%s'\n",
366 (got_realm
? "realm" : "domain"), realm
));
368 status
= get_sorted_dc_list(realm
, sitename
, &ip_list
, &count
, got_realm
);
369 if (!NT_STATUS_IS_OK(status
)) {
370 /* fall back to netbios if we can */
371 if ( got_realm
&& !lp_disable_netbios() ) {
380 /* if we fail this loop, then giveup since all the IP addresses returned were dead */
381 for ( i
=0; i
<count
; i
++ ) {
382 char server
[INET6_ADDRSTRLEN
];
384 print_sockaddr(server
, sizeof(server
), &ip_list
[i
].ss
);
386 if ( !NT_STATUS_IS_OK(check_negative_conn_cache(realm
, server
)) )
390 /* realm in this case is a workgroup name. We need
391 to ignore any IP addresses in the negative connection
392 cache that match ip addresses returned in the ad realm
393 case. It sucks that I have to reproduce the logic above... */
394 c_realm
= ads
->server
.realm
;
395 if ( !c_realm
|| !*c_realm
) {
396 if ( !ads
->server
.workgroup
|| !*ads
->server
.workgroup
) {
397 c_realm
= lp_realm();
400 if (c_realm
&& *c_realm
&&
401 !NT_STATUS_IS_OK(check_negative_conn_cache(c_realm
, server
))) {
402 /* Ensure we add the workgroup name for this
403 IP address as negative too. */
404 add_failed_connection_entry( realm
, server
, NT_STATUS_UNSUCCESSFUL
);
409 if ( ads_try_connect(ads
, server
, false) ) {
415 /* keep track of failures */
416 add_failed_connection_entry( realm
, server
, NT_STATUS_UNSUCCESSFUL
);
421 /* In case we failed to contact one of our closest DC on our site we
422 * need to try to find another DC, retry with a site-less SRV DNS query
426 DEBUG(1,("ads_find_dc: failed to find a valid DC on our site (%s), "
427 "trying to find another DC\n", sitename
));
429 namecache_delete(realm
, 0x1C);
433 return NT_STATUS_NO_LOGON_SERVERS
;
436 /*********************************************************************
437 *********************************************************************/
439 static NTSTATUS
ads_lookup_site(void)
441 ADS_STRUCT
*ads
= NULL
;
442 ADS_STATUS ads_status
;
443 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
445 ads
= ads_init(lp_realm(), NULL
, NULL
);
447 return NT_STATUS_NO_MEMORY
;
450 /* The NO_BIND here will find a DC and set the client site
451 but not establish the TCP connection */
453 ads
->auth
.flags
= ADS_AUTH_NO_BIND
;
454 ads_status
= ads_connect(ads
);
455 if (!ADS_ERR_OK(ads_status
)) {
456 DEBUG(4, ("ads_lookup_site: ads_connect to our realm failed! (%s)\n",
457 ads_errstr(ads_status
)));
459 nt_status
= ads_ntstatus(ads_status
);
468 /*********************************************************************
469 *********************************************************************/
471 static const char* host_dns_domain(const char *fqdn
)
473 const char *p
= fqdn
;
475 /* go to next char following '.' */
477 if ((p
= strchr_m(fqdn
, '.')) != NULL
) {
486 * Connect to the Global Catalog server
487 * @param ads Pointer to an existing ADS_STRUCT
488 * @return status of connection
490 * Simple wrapper around ads_connect() that fills in the
491 * GC ldap server information
494 ADS_STATUS
ads_connect_gc(ADS_STRUCT
*ads
)
496 TALLOC_CTX
*frame
= talloc_stackframe();
497 struct dns_rr_srv
*gcs_list
;
499 char *realm
= ads
->server
.realm
;
500 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
501 ADS_STATUS ads_status
= ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL
);
504 char *sitename
= NULL
;
509 if ((sitename
= sitename_fetch(realm
)) == NULL
) {
511 sitename
= sitename_fetch(realm
);
515 /* We try once with a sitename and once without
516 (unless we don't have a sitename and then we're
519 if (sitename
== NULL
)
522 nt_status
= ads_dns_query_gcs(frame
, realm
, sitename
,
523 &gcs_list
, &num_gcs
);
527 if (!NT_STATUS_IS_OK(nt_status
)) {
528 ads_status
= ADS_ERROR_NT(nt_status
);
532 /* Loop until we get a successful connection or have gone
533 through them all. When connecting a GC server, make sure that
534 the realm is the server's DNS name and not the forest root */
536 for (i
=0; i
<num_gcs
; i
++) {
537 ads
->server
.gc
= true;
538 ads
->server
.ldap_server
= SMB_STRDUP(gcs_list
[i
].hostname
);
539 ads
->server
.realm
= SMB_STRDUP(host_dns_domain(ads
->server
.ldap_server
));
540 ads_status
= ads_connect(ads
);
541 if (ADS_ERR_OK(ads_status
)) {
542 /* Reset the bind_dn to "". A Global Catalog server
543 may host multiple domain trees in a forest.
544 Windows 2003 GC server will accept "" as the search
545 path to imply search all domain trees in the forest */
547 SAFE_FREE(ads
->config
.bind_path
);
548 ads
->config
.bind_path
= SMB_STRDUP("");
553 SAFE_FREE(ads
->server
.ldap_server
);
554 SAFE_FREE(ads
->server
.realm
);
557 TALLOC_FREE(gcs_list
);
563 talloc_destroy(frame
);
570 * Connect to the LDAP server
571 * @param ads Pointer to an existing ADS_STRUCT
572 * @return status of connection
574 ADS_STATUS
ads_connect(ADS_STRUCT
*ads
)
576 int version
= LDAP_VERSION3
;
579 char addr
[INET6_ADDRSTRLEN
];
581 ZERO_STRUCT(ads
->ldap
);
582 ads
->ldap
.last_attempt
= time(NULL
);
583 ads
->ldap
.wrap_type
= ADS_SASLWRAP_TYPE_PLAIN
;
585 /* try with a user specified server */
587 if (DEBUGLEVEL
>= 11) {
588 char *s
= NDR_PRINT_STRUCT_STRING(talloc_tos(), ads_struct
, ads
);
589 DEBUG(11,("ads_connect: entering\n"));
590 DEBUGADD(11,("%s\n", s
));
594 if (ads
->server
.ldap_server
)
596 if (ads_try_connect(ads
, ads
->server
.ldap_server
, ads
->server
.gc
)) {
600 /* The choice of which GC use is handled one level up in
601 ads_connect_gc(). If we continue on from here with
602 ads_find_dc() we will get GC searches on port 389 which
603 doesn't work. --jerry */
605 if (ads
->server
.gc
== true) {
606 return ADS_ERROR(LDAP_OPERATIONS_ERROR
);
610 ntstatus
= ads_find_dc(ads
);
611 if (NT_STATUS_IS_OK(ntstatus
)) {
615 status
= ADS_ERROR_NT(ntstatus
);
620 print_sockaddr(addr
, sizeof(addr
), &ads
->ldap
.ss
);
621 DEBUG(3,("Successfully contacted LDAP server %s\n", addr
));
623 if (!ads
->auth
.user_name
) {
624 /* Must use the userPrincipalName value here or sAMAccountName
625 and not servicePrincipalName; found by Guenther Deschner */
627 if (asprintf(&ads
->auth
.user_name
, "%s$", global_myname() ) == -1) {
628 DEBUG(0,("ads_connect: asprintf fail.\n"));
629 ads
->auth
.user_name
= NULL
;
633 if (!ads
->auth
.realm
) {
634 ads
->auth
.realm
= SMB_STRDUP(ads
->config
.realm
);
637 if (!ads
->auth
.kdc_server
) {
638 print_sockaddr(addr
, sizeof(addr
), &ads
->ldap
.ss
);
639 ads
->auth
.kdc_server
= SMB_STRDUP(addr
);
643 /* this is a really nasty hack to avoid ADS DNS problems. It needs a patch
644 to MIT kerberos to work (tridge) */
647 if (asprintf(&env
, "KRB5_KDC_ADDRESS_%s", ads
->config
.realm
) > 0) {
648 setenv(env
, ads
->auth
.kdc_server
, 1);
654 /* If the caller() requested no LDAP bind, then we are done */
656 if (ads
->auth
.flags
& ADS_AUTH_NO_BIND
) {
657 status
= ADS_SUCCESS
;
661 ads
->ldap
.mem_ctx
= talloc_init("ads LDAP connection memory");
662 if (!ads
->ldap
.mem_ctx
) {
663 status
= ADS_ERROR_NT(NT_STATUS_NO_MEMORY
);
667 /* Otherwise setup the TCP LDAP session */
669 ads
->ldap
.ld
= ldap_open_with_timeout(ads
->config
.ldap_server_name
,
670 ads
->ldap
.port
, lp_ldap_timeout());
671 if (ads
->ldap
.ld
== NULL
) {
672 status
= ADS_ERROR(LDAP_OPERATIONS_ERROR
);
675 DEBUG(3,("Connected to LDAP server %s\n", ads
->config
.ldap_server_name
));
677 /* cache the successful connection for workgroup and realm */
678 if (ads_closest_dc(ads
)) {
679 saf_store( ads
->server
.workgroup
, ads
->config
.ldap_server_name
);
680 saf_store( ads
->server
.realm
, ads
->config
.ldap_server_name
);
683 ldap_set_option(ads
->ldap
.ld
, LDAP_OPT_PROTOCOL_VERSION
, &version
);
685 if ( lp_ldap_ssl_ads() ) {
686 status
= ADS_ERROR(smb_ldap_start_tls(ads
->ldap
.ld
, version
));
687 if (!ADS_ERR_OK(status
)) {
692 /* fill in the current time and offsets */
694 status
= ads_current_time( ads
);
695 if ( !ADS_ERR_OK(status
) ) {
699 /* Now do the bind */
701 if (ads
->auth
.flags
& ADS_AUTH_ANON_BIND
) {
702 status
= ADS_ERROR(ldap_simple_bind_s(ads
->ldap
.ld
, NULL
, NULL
));
706 if (ads
->auth
.flags
& ADS_AUTH_SIMPLE_BIND
) {
707 status
= ADS_ERROR(ldap_simple_bind_s(ads
->ldap
.ld
, ads
->auth
.user_name
, ads
->auth
.password
));
711 status
= ads_sasl_bind(ads
);
714 if (DEBUGLEVEL
>= 11) {
715 char *s
= NDR_PRINT_STRUCT_STRING(talloc_tos(), ads_struct
, ads
);
716 DEBUG(11,("ads_connect: leaving with: %s\n",
717 ads_errstr(status
)));
718 DEBUGADD(11,("%s\n", s
));
726 * Connect to the LDAP server using given credentials
727 * @param ads Pointer to an existing ADS_STRUCT
728 * @return status of connection
730 ADS_STATUS
ads_connect_user_creds(ADS_STRUCT
*ads
)
732 ads
->auth
.flags
|= ADS_AUTH_USER_CREDS
;
734 return ads_connect(ads
);
738 * Disconnect the LDAP server
739 * @param ads Pointer to an existing ADS_STRUCT
741 void ads_disconnect(ADS_STRUCT
*ads
)
744 ldap_unbind(ads
->ldap
.ld
);
747 if (ads
->ldap
.wrap_ops
&& ads
->ldap
.wrap_ops
->disconnect
) {
748 ads
->ldap
.wrap_ops
->disconnect(ads
);
750 if (ads
->ldap
.mem_ctx
) {
751 talloc_free(ads
->ldap
.mem_ctx
);
753 ZERO_STRUCT(ads
->ldap
);
757 Duplicate a struct berval into talloc'ed memory
759 static struct berval
*dup_berval(TALLOC_CTX
*ctx
, const struct berval
*in_val
)
761 struct berval
*value
;
763 if (!in_val
) return NULL
;
765 value
= TALLOC_ZERO_P(ctx
, struct berval
);
768 if (in_val
->bv_len
== 0) return value
;
770 value
->bv_len
= in_val
->bv_len
;
771 value
->bv_val
= (char *)TALLOC_MEMDUP(ctx
, in_val
->bv_val
,
777 Make a values list out of an array of (struct berval *)
779 static struct berval
**ads_dup_values(TALLOC_CTX
*ctx
,
780 const struct berval
**in_vals
)
782 struct berval
**values
;
785 if (!in_vals
) return NULL
;
786 for (i
=0; in_vals
[i
]; i
++)
788 values
= TALLOC_ZERO_ARRAY(ctx
, struct berval
*, i
+1);
789 if (!values
) return NULL
;
791 for (i
=0; in_vals
[i
]; i
++) {
792 values
[i
] = dup_berval(ctx
, in_vals
[i
]);
798 UTF8-encode a values list out of an array of (char *)
800 static char **ads_push_strvals(TALLOC_CTX
*ctx
, const char **in_vals
)
806 if (!in_vals
) return NULL
;
807 for (i
=0; in_vals
[i
]; i
++)
809 values
= TALLOC_ZERO_ARRAY(ctx
, char *, i
+1);
810 if (!values
) return NULL
;
812 for (i
=0; in_vals
[i
]; i
++) {
813 if (!push_utf8_talloc(ctx
, &values
[i
], in_vals
[i
], &size
)) {
822 Pull a (char *) array out of a UTF8-encoded values list
824 static char **ads_pull_strvals(TALLOC_CTX
*ctx
, const char **in_vals
)
828 size_t converted_size
;
830 if (!in_vals
) return NULL
;
831 for (i
=0; in_vals
[i
]; i
++)
833 values
= TALLOC_ZERO_ARRAY(ctx
, char *, i
+1);
834 if (!values
) return NULL
;
836 for (i
=0; in_vals
[i
]; i
++) {
837 if (!pull_utf8_talloc(ctx
, &values
[i
], in_vals
[i
],
839 DEBUG(0,("ads_pull_strvals: pull_utf8_talloc failed: "
840 "%s", strerror(errno
)));
847 * Do a search with paged results. cookie must be null on the first
848 * call, and then returned on each subsequent call. It will be null
849 * again when the entire search is complete
850 * @param ads connection to ads server
851 * @param bind_path Base dn for the search
852 * @param scope Scope of search (LDAP_SCOPE_BASE | LDAP_SCOPE_ONE | LDAP_SCOPE_SUBTREE)
853 * @param expr Search expression - specified in local charset
854 * @param attrs Attributes to retrieve - specified in utf8 or ascii
855 * @param res ** which will contain results - free res* with ads_msgfree()
856 * @param count Number of entries retrieved on this page
857 * @param cookie The paged results cookie to be returned on subsequent calls
858 * @return status of search
860 static ADS_STATUS
ads_do_paged_search_args(ADS_STRUCT
*ads
,
861 const char *bind_path
,
862 int scope
, const char *expr
,
863 const char **attrs
, void *args
,
865 int *count
, struct berval
**cookie
)
868 char *utf8_expr
, *utf8_path
, **search_attrs
;
869 size_t converted_size
;
870 LDAPControl PagedResults
, NoReferrals
, ExternalCtrl
, *controls
[4], **rcontrols
;
871 BerElement
*cookie_be
= NULL
;
872 struct berval
*cookie_bv
= NULL
;
873 BerElement
*ext_be
= NULL
;
874 struct berval
*ext_bv
= NULL
;
877 ads_control
*external_control
= (ads_control
*) args
;
881 if (!(ctx
= talloc_init("ads_do_paged_search_args")))
882 return ADS_ERROR(LDAP_NO_MEMORY
);
884 /* 0 means the conversion worked but the result was empty
885 so we only fail if it's -1. In any case, it always
886 at least nulls out the dest */
887 if (!push_utf8_talloc(ctx
, &utf8_expr
, expr
, &converted_size
) ||
888 !push_utf8_talloc(ctx
, &utf8_path
, bind_path
, &converted_size
))
894 if (!attrs
|| !(*attrs
))
897 /* This would be the utf8-encoded version...*/
898 /* if (!(search_attrs = ads_push_strvals(ctx, attrs))) */
899 if (!(str_list_copy(talloc_tos(), &search_attrs
, attrs
))) {
905 /* Paged results only available on ldap v3 or later */
906 ldap_get_option(ads
->ldap
.ld
, LDAP_OPT_PROTOCOL_VERSION
, &version
);
907 if (version
< LDAP_VERSION3
) {
908 rc
= LDAP_NOT_SUPPORTED
;
912 cookie_be
= ber_alloc_t(LBER_USE_DER
);
914 ber_printf(cookie_be
, "{iO}", (ber_int_t
) 1000, *cookie
);
915 ber_bvfree(*cookie
); /* don't need it from last time */
918 ber_printf(cookie_be
, "{io}", (ber_int_t
) 1000, "", 0);
920 ber_flatten(cookie_be
, &cookie_bv
);
921 PagedResults
.ldctl_oid
= CONST_DISCARD(char *, ADS_PAGE_CTL_OID
);
922 PagedResults
.ldctl_iscritical
= (char) 1;
923 PagedResults
.ldctl_value
.bv_len
= cookie_bv
->bv_len
;
924 PagedResults
.ldctl_value
.bv_val
= cookie_bv
->bv_val
;
926 NoReferrals
.ldctl_oid
= CONST_DISCARD(char *, ADS_NO_REFERRALS_OID
);
927 NoReferrals
.ldctl_iscritical
= (char) 0;
928 NoReferrals
.ldctl_value
.bv_len
= 0;
929 NoReferrals
.ldctl_value
.bv_val
= CONST_DISCARD(char *, "");
931 if (external_control
&&
932 (strequal(external_control
->control
, ADS_EXTENDED_DN_OID
) ||
933 strequal(external_control
->control
, ADS_SD_FLAGS_OID
))) {
935 ExternalCtrl
.ldctl_oid
= CONST_DISCARD(char *, external_control
->control
);
936 ExternalCtrl
.ldctl_iscritical
= (char) external_control
->critical
;
938 /* win2k does not accept a ldctl_value beeing passed in */
940 if (external_control
->val
!= 0) {
942 if ((ext_be
= ber_alloc_t(LBER_USE_DER
)) == NULL
) {
947 if ((ber_printf(ext_be
, "{i}", (ber_int_t
) external_control
->val
)) == -1) {
951 if ((ber_flatten(ext_be
, &ext_bv
)) == -1) {
956 ExternalCtrl
.ldctl_value
.bv_len
= ext_bv
->bv_len
;
957 ExternalCtrl
.ldctl_value
.bv_val
= ext_bv
->bv_val
;
960 ExternalCtrl
.ldctl_value
.bv_len
= 0;
961 ExternalCtrl
.ldctl_value
.bv_val
= NULL
;
964 controls
[0] = &NoReferrals
;
965 controls
[1] = &PagedResults
;
966 controls
[2] = &ExternalCtrl
;
970 controls
[0] = &NoReferrals
;
971 controls
[1] = &PagedResults
;
975 /* we need to disable referrals as the openldap libs don't
976 handle them and paged results at the same time. Using them
977 together results in the result record containing the server
978 page control being removed from the result list (tridge/jmcd)
980 leaving this in despite the control that says don't generate
981 referrals, in case the server doesn't support it (jmcd)
983 ldap_set_option(ads
->ldap
.ld
, LDAP_OPT_REFERRALS
, LDAP_OPT_OFF
);
985 rc
= ldap_search_with_timeout(ads
->ldap
.ld
, utf8_path
, scope
, utf8_expr
,
986 search_attrs
, 0, controls
,
988 (LDAPMessage
**)res
);
990 ber_free(cookie_be
, 1);
991 ber_bvfree(cookie_bv
);
994 DEBUG(3,("ads_do_paged_search_args: ldap_search_with_timeout(%s) -> %s\n", expr
,
995 ldap_err2string(rc
)));
999 rc
= ldap_parse_result(ads
->ldap
.ld
, *res
, NULL
, NULL
, NULL
,
1000 NULL
, &rcontrols
, 0);
1006 for (i
=0; rcontrols
[i
]; i
++) {
1007 if (strcmp(ADS_PAGE_CTL_OID
, rcontrols
[i
]->ldctl_oid
) == 0) {
1008 cookie_be
= ber_init(&rcontrols
[i
]->ldctl_value
);
1009 ber_scanf(cookie_be
,"{iO}", (ber_int_t
*) count
,
1011 /* the berval is the cookie, but must be freed when
1013 if (cookie_bv
->bv_len
) /* still more to do */
1014 *cookie
=ber_bvdup(cookie_bv
);
1017 ber_bvfree(cookie_bv
);
1018 ber_free(cookie_be
, 1);
1022 ldap_controls_free(rcontrols
);
1025 talloc_destroy(ctx
);
1028 ber_free(ext_be
, 1);
1035 /* if/when we decide to utf8-encode attrs, take out this next line */
1036 TALLOC_FREE(search_attrs
);
1038 return ADS_ERROR(rc
);
1041 static ADS_STATUS
ads_do_paged_search(ADS_STRUCT
*ads
, const char *bind_path
,
1042 int scope
, const char *expr
,
1043 const char **attrs
, LDAPMessage
**res
,
1044 int *count
, struct berval
**cookie
)
1046 return ads_do_paged_search_args(ads
, bind_path
, scope
, expr
, attrs
, NULL
, res
, count
, cookie
);
1051 * Get all results for a search. This uses ads_do_paged_search() to return
1052 * all entries in a large search.
1053 * @param ads connection to ads server
1054 * @param bind_path Base dn for the search
1055 * @param scope Scope of search (LDAP_SCOPE_BASE | LDAP_SCOPE_ONE | LDAP_SCOPE_SUBTREE)
1056 * @param expr Search expression
1057 * @param attrs Attributes to retrieve
1058 * @param res ** which will contain results - free res* with ads_msgfree()
1059 * @return status of search
1061 ADS_STATUS
ads_do_search_all_args(ADS_STRUCT
*ads
, const char *bind_path
,
1062 int scope
, const char *expr
,
1063 const char **attrs
, void *args
,
1066 struct berval
*cookie
= NULL
;
1071 status
= ads_do_paged_search_args(ads
, bind_path
, scope
, expr
, attrs
, args
, res
,
1074 if (!ADS_ERR_OK(status
))
1077 #ifdef HAVE_LDAP_ADD_RESULT_ENTRY
1079 LDAPMessage
*res2
= NULL
;
1081 LDAPMessage
*msg
, *next
;
1083 status2
= ads_do_paged_search_args(ads
, bind_path
, scope
, expr
,
1084 attrs
, args
, &res2
, &count
, &cookie
);
1086 if (!ADS_ERR_OK(status2
)) break;
1088 /* this relies on the way that ldap_add_result_entry() works internally. I hope
1089 that this works on all ldap libs, but I have only tested with openldap */
1090 for (msg
= ads_first_message(ads
, res2
); msg
; msg
= next
) {
1091 next
= ads_next_message(ads
, msg
);
1092 ldap_add_result_entry((LDAPMessage
**)res
, msg
);
1094 /* note that we do not free res2, as the memory is now
1095 part of the main returned list */
1098 DEBUG(0, ("no ldap_add_result_entry() support in LDAP libs!\n"));
1099 status
= ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL
);
1105 ADS_STATUS
ads_do_search_all(ADS_STRUCT
*ads
, const char *bind_path
,
1106 int scope
, const char *expr
,
1107 const char **attrs
, LDAPMessage
**res
)
1109 return ads_do_search_all_args(ads
, bind_path
, scope
, expr
, attrs
, NULL
, res
);
1112 ADS_STATUS
ads_do_search_all_sd_flags(ADS_STRUCT
*ads
, const char *bind_path
,
1113 int scope
, const char *expr
,
1114 const char **attrs
, uint32 sd_flags
,
1119 args
.control
= ADS_SD_FLAGS_OID
;
1120 args
.val
= sd_flags
;
1121 args
.critical
= True
;
1123 return ads_do_search_all_args(ads
, bind_path
, scope
, expr
, attrs
, &args
, res
);
1128 * Run a function on all results for a search. Uses ads_do_paged_search() and
1129 * runs the function as each page is returned, using ads_process_results()
1130 * @param ads connection to ads server
1131 * @param bind_path Base dn for the search
1132 * @param scope Scope of search (LDAP_SCOPE_BASE | LDAP_SCOPE_ONE | LDAP_SCOPE_SUBTREE)
1133 * @param expr Search expression - specified in local charset
1134 * @param attrs Attributes to retrieve - specified in UTF-8 or ascii
1135 * @param fn Function which takes attr name, values list, and data_area
1136 * @param data_area Pointer which is passed to function on each call
1137 * @return status of search
1139 ADS_STATUS
ads_do_search_all_fn(ADS_STRUCT
*ads
, const char *bind_path
,
1140 int scope
, const char *expr
, const char **attrs
,
1141 bool (*fn
)(ADS_STRUCT
*, char *, void **, void *),
1144 struct berval
*cookie
= NULL
;
1149 status
= ads_do_paged_search(ads
, bind_path
, scope
, expr
, attrs
, &res
,
1152 if (!ADS_ERR_OK(status
)) return status
;
1154 ads_process_results(ads
, res
, fn
, data_area
);
1155 ads_msgfree(ads
, res
);
1158 status
= ads_do_paged_search(ads
, bind_path
, scope
, expr
, attrs
,
1159 &res
, &count
, &cookie
);
1161 if (!ADS_ERR_OK(status
)) break;
1163 ads_process_results(ads
, res
, fn
, data_area
);
1164 ads_msgfree(ads
, res
);
1171 * Do a search with a timeout.
1172 * @param ads connection to ads server
1173 * @param bind_path Base dn for the search
1174 * @param scope Scope of search (LDAP_SCOPE_BASE | LDAP_SCOPE_ONE | LDAP_SCOPE_SUBTREE)
1175 * @param expr Search expression
1176 * @param attrs Attributes to retrieve
1177 * @param res ** which will contain results - free res* with ads_msgfree()
1178 * @return status of search
1180 ADS_STATUS
ads_do_search(ADS_STRUCT
*ads
, const char *bind_path
, int scope
,
1182 const char **attrs
, LDAPMessage
**res
)
1185 char *utf8_expr
, *utf8_path
, **search_attrs
= NULL
;
1186 size_t converted_size
;
1190 if (!(ctx
= talloc_init("ads_do_search"))) {
1191 DEBUG(1,("ads_do_search: talloc_init() failed!"));
1192 return ADS_ERROR(LDAP_NO_MEMORY
);
1195 /* 0 means the conversion worked but the result was empty
1196 so we only fail if it's negative. In any case, it always
1197 at least nulls out the dest */
1198 if (!push_utf8_talloc(ctx
, &utf8_expr
, expr
, &converted_size
) ||
1199 !push_utf8_talloc(ctx
, &utf8_path
, bind_path
, &converted_size
))
1201 DEBUG(1,("ads_do_search: push_utf8_talloc() failed!"));
1202 rc
= LDAP_NO_MEMORY
;
1206 if (!attrs
|| !(*attrs
))
1207 search_attrs
= NULL
;
1209 /* This would be the utf8-encoded version...*/
1210 /* if (!(search_attrs = ads_push_strvals(ctx, attrs))) */
1211 if (!(str_list_copy(talloc_tos(), &search_attrs
, attrs
)))
1213 DEBUG(1,("ads_do_search: str_list_copy() failed!"));
1214 rc
= LDAP_NO_MEMORY
;
1219 /* see the note in ads_do_paged_search - we *must* disable referrals */
1220 ldap_set_option(ads
->ldap
.ld
, LDAP_OPT_REFERRALS
, LDAP_OPT_OFF
);
1222 rc
= ldap_search_with_timeout(ads
->ldap
.ld
, utf8_path
, scope
, utf8_expr
,
1223 search_attrs
, 0, NULL
, NULL
,
1225 (LDAPMessage
**)res
);
1227 if (rc
== LDAP_SIZELIMIT_EXCEEDED
) {
1228 DEBUG(3,("Warning! sizelimit exceeded in ldap. Truncating.\n"));
1233 talloc_destroy(ctx
);
1234 /* if/when we decide to utf8-encode attrs, take out this next line */
1235 TALLOC_FREE(search_attrs
);
1236 return ADS_ERROR(rc
);
1239 * Do a general ADS search
1240 * @param ads connection to ads server
1241 * @param res ** which will contain results - free res* with ads_msgfree()
1242 * @param expr Search expression
1243 * @param attrs Attributes to retrieve
1244 * @return status of search
1246 ADS_STATUS
ads_search(ADS_STRUCT
*ads
, LDAPMessage
**res
,
1247 const char *expr
, const char **attrs
)
1249 return ads_do_search(ads
, ads
->config
.bind_path
, LDAP_SCOPE_SUBTREE
,
1254 * Do a search on a specific DistinguishedName
1255 * @param ads connection to ads server
1256 * @param res ** which will contain results - free res* with ads_msgfree()
1257 * @param dn DistinguishName to search
1258 * @param attrs Attributes to retrieve
1259 * @return status of search
1261 ADS_STATUS
ads_search_dn(ADS_STRUCT
*ads
, LDAPMessage
**res
,
1262 const char *dn
, const char **attrs
)
1264 return ads_do_search(ads
, dn
, LDAP_SCOPE_BASE
, "(objectclass=*)",
1269 * Free up memory from a ads_search
1270 * @param ads connection to ads server
1271 * @param msg Search results to free
1273 void ads_msgfree(ADS_STRUCT
*ads
, LDAPMessage
*msg
)
1280 * Free up memory from various ads requests
1281 * @param ads connection to ads server
1282 * @param mem Area to free
1284 void ads_memfree(ADS_STRUCT
*ads
, void *mem
)
1290 * Get a dn from search results
1291 * @param ads connection to ads server
1292 * @param msg Search result
1295 char *ads_get_dn(ADS_STRUCT
*ads
, LDAPMessage
*msg
)
1297 char *utf8_dn
, *unix_dn
;
1298 size_t converted_size
;
1300 utf8_dn
= ldap_get_dn(ads
->ldap
.ld
, msg
);
1303 DEBUG (5, ("ads_get_dn: ldap_get_dn failed\n"));
1307 if (!pull_utf8_allocate(&unix_dn
, utf8_dn
, &converted_size
)) {
1308 DEBUG(0,("ads_get_dn: string conversion failure utf8 [%s]\n",
1312 ldap_memfree(utf8_dn
);
1317 * Get the parent from a dn
1318 * @param dn the dn to return the parent from
1319 * @return parent dn string
1321 char *ads_parent_dn(const char *dn
)
1329 p
= strchr(dn
, ',');
1339 * Find a machine account given a hostname
1340 * @param ads connection to ads server
1341 * @param res ** which will contain results - free res* with ads_msgfree()
1342 * @param host Hostname to search for
1343 * @return status of search
1345 ADS_STATUS
ads_find_machine_acct(ADS_STRUCT
*ads
, LDAPMessage
**res
,
1346 const char *machine
)
1350 const char *attrs
[] = {"*", "nTSecurityDescriptor", NULL
};
1354 /* the easiest way to find a machine account anywhere in the tree
1355 is to look for hostname$ */
1356 if (asprintf(&expr
, "(samAccountName=%s$)", machine
) == -1) {
1357 DEBUG(1, ("asprintf failed!\n"));
1358 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY
);
1361 status
= ads_search(ads
, res
, expr
, attrs
);
1367 * Initialize a list of mods to be used in a modify request
1368 * @param ctx An initialized TALLOC_CTX
1369 * @return allocated ADS_MODLIST
1371 ADS_MODLIST
ads_init_mods(TALLOC_CTX
*ctx
)
1373 #define ADS_MODLIST_ALLOC_SIZE 10
1376 if ((mods
= TALLOC_ZERO_ARRAY(ctx
, LDAPMod
*, ADS_MODLIST_ALLOC_SIZE
+ 1)))
1377 /* -1 is safety to make sure we don't go over the end.
1378 need to reset it to NULL before doing ldap modify */
1379 mods
[ADS_MODLIST_ALLOC_SIZE
] = (LDAPMod
*) -1;
1381 return (ADS_MODLIST
)mods
;
1386 add an attribute to the list, with values list already constructed
1388 static ADS_STATUS
ads_modlist_add(TALLOC_CTX
*ctx
, ADS_MODLIST
*mods
,
1389 int mod_op
, const char *name
,
1390 const void *_invals
)
1392 const void **invals
= (const void **)_invals
;
1394 LDAPMod
**modlist
= (LDAPMod
**) *mods
;
1395 struct berval
**ber_values
= NULL
;
1396 char **char_values
= NULL
;
1399 mod_op
= LDAP_MOD_DELETE
;
1401 if (mod_op
& LDAP_MOD_BVALUES
)
1402 ber_values
= ads_dup_values(ctx
,
1403 (const struct berval
**)invals
);
1405 char_values
= ads_push_strvals(ctx
,
1406 (const char **) invals
);
1409 /* find the first empty slot */
1410 for (curmod
=0; modlist
[curmod
] && modlist
[curmod
] != (LDAPMod
*) -1;
1412 if (modlist
[curmod
] == (LDAPMod
*) -1) {
1413 if (!(modlist
= TALLOC_REALLOC_ARRAY(ctx
, modlist
, LDAPMod
*,
1414 curmod
+ADS_MODLIST_ALLOC_SIZE
+1)))
1415 return ADS_ERROR(LDAP_NO_MEMORY
);
1416 memset(&modlist
[curmod
], 0,
1417 ADS_MODLIST_ALLOC_SIZE
*sizeof(LDAPMod
*));
1418 modlist
[curmod
+ADS_MODLIST_ALLOC_SIZE
] = (LDAPMod
*) -1;
1419 *mods
= (ADS_MODLIST
)modlist
;
1422 if (!(modlist
[curmod
] = TALLOC_ZERO_P(ctx
, LDAPMod
)))
1423 return ADS_ERROR(LDAP_NO_MEMORY
);
1424 modlist
[curmod
]->mod_type
= talloc_strdup(ctx
, name
);
1425 if (mod_op
& LDAP_MOD_BVALUES
) {
1426 modlist
[curmod
]->mod_bvalues
= ber_values
;
1427 } else if (mod_op
& LDAP_MOD_DELETE
) {
1428 modlist
[curmod
]->mod_values
= NULL
;
1430 modlist
[curmod
]->mod_values
= char_values
;
1433 modlist
[curmod
]->mod_op
= mod_op
;
1434 return ADS_ERROR(LDAP_SUCCESS
);
1438 * Add a single string value to a mod list
1439 * @param ctx An initialized TALLOC_CTX
1440 * @param mods An initialized ADS_MODLIST
1441 * @param name The attribute name to add
1442 * @param val The value to add - NULL means DELETE
1443 * @return ADS STATUS indicating success of add
1445 ADS_STATUS
ads_mod_str(TALLOC_CTX
*ctx
, ADS_MODLIST
*mods
,
1446 const char *name
, const char *val
)
1448 const char *values
[2];
1454 return ads_modlist_add(ctx
, mods
, LDAP_MOD_DELETE
, name
, NULL
);
1455 return ads_modlist_add(ctx
, mods
, LDAP_MOD_REPLACE
, name
, values
);
1459 * Add an array of string values to a mod list
1460 * @param ctx An initialized TALLOC_CTX
1461 * @param mods An initialized ADS_MODLIST
1462 * @param name The attribute name to add
1463 * @param vals The array of string values to add - NULL means DELETE
1464 * @return ADS STATUS indicating success of add
1466 ADS_STATUS
ads_mod_strlist(TALLOC_CTX
*ctx
, ADS_MODLIST
*mods
,
1467 const char *name
, const char **vals
)
1470 return ads_modlist_add(ctx
, mods
, LDAP_MOD_DELETE
, name
, NULL
);
1471 return ads_modlist_add(ctx
, mods
, LDAP_MOD_REPLACE
,
1472 name
, (const void **) vals
);
1477 * Add a single ber-encoded value to a mod list
1478 * @param ctx An initialized TALLOC_CTX
1479 * @param mods An initialized ADS_MODLIST
1480 * @param name The attribute name to add
1481 * @param val The value to add - NULL means DELETE
1482 * @return ADS STATUS indicating success of add
1484 static ADS_STATUS
ads_mod_ber(TALLOC_CTX
*ctx
, ADS_MODLIST
*mods
,
1485 const char *name
, const struct berval
*val
)
1487 const struct berval
*values
[2];
1492 return ads_modlist_add(ctx
, mods
, LDAP_MOD_DELETE
, name
, NULL
);
1493 return ads_modlist_add(ctx
, mods
, LDAP_MOD_REPLACE
|LDAP_MOD_BVALUES
,
1494 name
, (const void **) values
);
1499 * Perform an ldap modify
1500 * @param ads connection to ads server
1501 * @param mod_dn DistinguishedName to modify
1502 * @param mods list of modifications to perform
1503 * @return status of modify
1505 ADS_STATUS
ads_gen_mod(ADS_STRUCT
*ads
, const char *mod_dn
, ADS_MODLIST mods
)
1508 char *utf8_dn
= NULL
;
1509 size_t converted_size
;
1511 this control is needed to modify that contains a currently
1512 non-existent attribute (but allowable for the object) to run
1514 LDAPControl PermitModify
= {
1515 CONST_DISCARD(char *, ADS_PERMIT_MODIFY_OID
),
1518 LDAPControl
*controls
[2];
1520 controls
[0] = &PermitModify
;
1523 if (!push_utf8_allocate(&utf8_dn
, mod_dn
, &converted_size
)) {
1524 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY
);
1527 /* find the end of the list, marked by NULL or -1 */
1528 for(i
=0;(mods
[i
]!=0)&&(mods
[i
]!=(LDAPMod
*) -1);i
++);
1529 /* make sure the end of the list is NULL */
1531 ret
= ldap_modify_ext_s(ads
->ldap
.ld
, utf8_dn
,
1532 (LDAPMod
**) mods
, controls
, NULL
);
1534 return ADS_ERROR(ret
);
1538 * Perform an ldap add
1539 * @param ads connection to ads server
1540 * @param new_dn DistinguishedName to add
1541 * @param mods list of attributes and values for DN
1542 * @return status of add
1544 ADS_STATUS
ads_gen_add(ADS_STRUCT
*ads
, const char *new_dn
, ADS_MODLIST mods
)
1547 char *utf8_dn
= NULL
;
1548 size_t converted_size
;
1550 if (!push_utf8_allocate(&utf8_dn
, new_dn
, &converted_size
)) {
1551 DEBUG(1, ("ads_gen_add: push_utf8_allocate failed!"));
1552 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY
);
1555 /* find the end of the list, marked by NULL or -1 */
1556 for(i
=0;(mods
[i
]!=0)&&(mods
[i
]!=(LDAPMod
*) -1);i
++);
1557 /* make sure the end of the list is NULL */
1560 ret
= ldap_add_s(ads
->ldap
.ld
, utf8_dn
, (LDAPMod
**)mods
);
1562 return ADS_ERROR(ret
);
1566 * Delete a DistinguishedName
1567 * @param ads connection to ads server
1568 * @param new_dn DistinguishedName to delete
1569 * @return status of delete
1571 ADS_STATUS
ads_del_dn(ADS_STRUCT
*ads
, char *del_dn
)
1574 char *utf8_dn
= NULL
;
1575 size_t converted_size
;
1576 if (!push_utf8_allocate(&utf8_dn
, del_dn
, &converted_size
)) {
1577 DEBUG(1, ("ads_del_dn: push_utf8_allocate failed!"));
1578 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY
);
1581 ret
= ldap_delete_s(ads
->ldap
.ld
, utf8_dn
);
1583 return ADS_ERROR(ret
);
1587 * Build an org unit string
1588 * if org unit is Computers or blank then assume a container, otherwise
1589 * assume a / separated list of organisational units.
1590 * jmcd: '\' is now used for escapes so certain chars can be in the ou (e.g. #)
1591 * @param ads connection to ads server
1592 * @param org_unit Organizational unit
1593 * @return org unit string - caller must free
1595 char *ads_ou_string(ADS_STRUCT
*ads
, const char *org_unit
)
1599 if (!org_unit
|| !*org_unit
) {
1601 ret
= ads_default_ou_string(ads
, WELL_KNOWN_GUID_COMPUTERS
);
1603 /* samba4 might not yet respond to a wellknownobject-query */
1604 return ret
? ret
: SMB_STRDUP("cn=Computers");
1607 if (strequal(org_unit
, "Computers")) {
1608 return SMB_STRDUP("cn=Computers");
1611 /* jmcd: removed "\\" from the separation chars, because it is
1612 needed as an escape for chars like '#' which are valid in an
1614 return ads_build_path(org_unit
, "/", "ou=", 1);
1618 * Get a org unit string for a well-known GUID
1619 * @param ads connection to ads server
1620 * @param wknguid Well known GUID
1621 * @return org unit string - caller must free
1623 char *ads_default_ou_string(ADS_STRUCT
*ads
, const char *wknguid
)
1626 LDAPMessage
*res
= NULL
;
1627 char *base
, *wkn_dn
= NULL
, *ret
= NULL
, **wkn_dn_exp
= NULL
,
1628 **bind_dn_exp
= NULL
;
1629 const char *attrs
[] = {"distinguishedName", NULL
};
1630 int new_ln
, wkn_ln
, bind_ln
, i
;
1632 if (wknguid
== NULL
) {
1636 if (asprintf(&base
, "<WKGUID=%s,%s>", wknguid
, ads
->config
.bind_path
) == -1) {
1637 DEBUG(1, ("asprintf failed!\n"));
1641 status
= ads_search_dn(ads
, &res
, base
, attrs
);
1642 if (!ADS_ERR_OK(status
)) {
1643 DEBUG(1,("Failed while searching for: %s\n", base
));
1647 if (ads_count_replies(ads
, res
) != 1) {
1651 /* substitute the bind-path from the well-known-guid-search result */
1652 wkn_dn
= ads_get_dn(ads
, res
);
1657 wkn_dn_exp
= ldap_explode_dn(wkn_dn
, 0);
1662 bind_dn_exp
= ldap_explode_dn(ads
->config
.bind_path
, 0);
1667 for (wkn_ln
=0; wkn_dn_exp
[wkn_ln
]; wkn_ln
++)
1669 for (bind_ln
=0; bind_dn_exp
[bind_ln
]; bind_ln
++)
1672 new_ln
= wkn_ln
- bind_ln
;
1674 ret
= SMB_STRDUP(wkn_dn_exp
[0]);
1679 for (i
=1; i
< new_ln
; i
++) {
1682 if (asprintf(&s
, "%s,%s", ret
, wkn_dn_exp
[i
]) == -1) {
1688 ret
= SMB_STRDUP(s
);
1697 ads_msgfree(ads
, res
);
1698 ads_memfree(ads
, wkn_dn
);
1700 ldap_value_free(wkn_dn_exp
);
1703 ldap_value_free(bind_dn_exp
);
1710 * Adds (appends) an item to an attribute array, rather then
1711 * replacing the whole list
1712 * @param ctx An initialized TALLOC_CTX
1713 * @param mods An initialized ADS_MODLIST
1714 * @param name name of the ldap attribute to append to
1715 * @param vals an array of values to add
1716 * @return status of addition
1719 ADS_STATUS
ads_add_strlist(TALLOC_CTX
*ctx
, ADS_MODLIST
*mods
,
1720 const char *name
, const char **vals
)
1722 return ads_modlist_add(ctx
, mods
, LDAP_MOD_ADD
, name
,
1723 (const void *) vals
);
1727 * Determines the an account's current KVNO via an LDAP lookup
1728 * @param ads An initialized ADS_STRUCT
1729 * @param account_name the NT samaccountname.
1730 * @return the kvno for the account, or -1 in case of a failure.
1733 uint32
ads_get_kvno(ADS_STRUCT
*ads
, const char *account_name
)
1735 LDAPMessage
*res
= NULL
;
1736 uint32 kvno
= (uint32
)-1; /* -1 indicates a failure */
1738 const char *attrs
[] = {"msDS-KeyVersionNumber", NULL
};
1739 char *dn_string
= NULL
;
1740 ADS_STATUS ret
= ADS_ERROR(LDAP_SUCCESS
);
1742 DEBUG(5,("ads_get_kvno: Searching for account %s\n", account_name
));
1743 if (asprintf(&filter
, "(samAccountName=%s)", account_name
) == -1) {
1746 ret
= ads_search(ads
, &res
, filter
, attrs
);
1748 if (!ADS_ERR_OK(ret
) || (ads_count_replies(ads
, res
) != 1)) {
1749 DEBUG(1,("ads_get_kvno: Account for %s not found.\n", account_name
));
1750 ads_msgfree(ads
, res
);
1754 dn_string
= ads_get_dn(ads
, res
);
1756 DEBUG(0,("ads_get_kvno: out of memory.\n"));
1757 ads_msgfree(ads
, res
);
1760 DEBUG(5,("ads_get_kvno: Using: %s\n", dn_string
));
1761 ads_memfree(ads
, dn_string
);
1763 /* ---------------------------------------------------------
1764 * 0 is returned as a default KVNO from this point on...
1765 * This is done because Windows 2000 does not support key
1766 * version numbers. Chances are that a failure in the next
1767 * step is simply due to Windows 2000 being used for a
1768 * domain controller. */
1771 if (!ads_pull_uint32(ads
, res
, "msDS-KeyVersionNumber", &kvno
)) {
1772 DEBUG(3,("ads_get_kvno: Error Determining KVNO!\n"));
1773 DEBUG(3,("ads_get_kvno: Windows 2000 does not support KVNO's, so this may be normal.\n"));
1774 ads_msgfree(ads
, res
);
1779 DEBUG(5,("ads_get_kvno: Looked Up KVNO of: %d\n", kvno
));
1780 ads_msgfree(ads
, res
);
1785 * Determines the computer account's current KVNO via an LDAP lookup
1786 * @param ads An initialized ADS_STRUCT
1787 * @param machine_name the NetBIOS name of the computer, which is used to identify the computer account.
1788 * @return the kvno for the computer account, or -1 in case of a failure.
1791 uint32_t ads_get_machine_kvno(ADS_STRUCT
*ads
, const char *machine_name
)
1793 char *computer_account
= NULL
;
1796 if (asprintf(&computer_account
, "%s$", machine_name
) < 0) {
1800 kvno
= ads_get_kvno(ads
, computer_account
);
1801 free(computer_account
);
1807 * This clears out all registered spn's for a given hostname
1808 * @param ads An initilaized ADS_STRUCT
1809 * @param machine_name the NetBIOS name of the computer.
1810 * @return 0 upon success, non-zero otherwise.
1813 ADS_STATUS
ads_clear_service_principal_names(ADS_STRUCT
*ads
, const char *machine_name
)
1816 LDAPMessage
*res
= NULL
;
1818 const char *servicePrincipalName
[1] = {NULL
};
1819 ADS_STATUS ret
= ADS_ERROR(LDAP_SUCCESS
);
1820 char *dn_string
= NULL
;
1822 ret
= ads_find_machine_acct(ads
, &res
, machine_name
);
1823 if (!ADS_ERR_OK(ret
) || ads_count_replies(ads
, res
) != 1) {
1824 DEBUG(5,("ads_clear_service_principal_names: WARNING: Host Account for %s not found... skipping operation.\n", machine_name
));
1825 DEBUG(5,("ads_clear_service_principal_names: WARNING: Service Principals for %s have NOT been cleared.\n", machine_name
));
1826 ads_msgfree(ads
, res
);
1827 return ADS_ERROR(LDAP_NO_SUCH_OBJECT
);
1830 DEBUG(5,("ads_clear_service_principal_names: Host account for %s found\n", machine_name
));
1831 ctx
= talloc_init("ads_clear_service_principal_names");
1833 ads_msgfree(ads
, res
);
1834 return ADS_ERROR(LDAP_NO_MEMORY
);
1837 if (!(mods
= ads_init_mods(ctx
))) {
1838 talloc_destroy(ctx
);
1839 ads_msgfree(ads
, res
);
1840 return ADS_ERROR(LDAP_NO_MEMORY
);
1842 ret
= ads_mod_strlist(ctx
, &mods
, "servicePrincipalName", servicePrincipalName
);
1843 if (!ADS_ERR_OK(ret
)) {
1844 DEBUG(1,("ads_clear_service_principal_names: Error creating strlist.\n"));
1845 ads_msgfree(ads
, res
);
1846 talloc_destroy(ctx
);
1849 dn_string
= ads_get_dn(ads
, res
);
1851 talloc_destroy(ctx
);
1852 ads_msgfree(ads
, res
);
1853 return ADS_ERROR(LDAP_NO_MEMORY
);
1855 ret
= ads_gen_mod(ads
, dn_string
, mods
);
1856 ads_memfree(ads
,dn_string
);
1857 if (!ADS_ERR_OK(ret
)) {
1858 DEBUG(1,("ads_clear_service_principal_names: Error: Updating Service Principals for machine %s in LDAP\n",
1860 ads_msgfree(ads
, res
);
1861 talloc_destroy(ctx
);
1865 ads_msgfree(ads
, res
);
1866 talloc_destroy(ctx
);
1871 * This adds a service principal name to an existing computer account
1872 * (found by hostname) in AD.
1873 * @param ads An initialized ADS_STRUCT
1874 * @param machine_name the NetBIOS name of the computer, which is used to identify the computer account.
1875 * @param my_fqdn The fully qualified DNS name of the machine
1876 * @param spn A string of the service principal to add, i.e. 'host'
1877 * @return 0 upon sucess, or non-zero if a failure occurs
1880 ADS_STATUS
ads_add_service_principal_name(ADS_STRUCT
*ads
, const char *machine_name
,
1881 const char *my_fqdn
, const char *spn
)
1885 LDAPMessage
*res
= NULL
;
1888 char *dn_string
= NULL
;
1889 const char *servicePrincipalName
[3] = {NULL
, NULL
, NULL
};
1891 ret
= ads_find_machine_acct(ads
, &res
, machine_name
);
1892 if (!ADS_ERR_OK(ret
) || ads_count_replies(ads
, res
) != 1) {
1893 DEBUG(1,("ads_add_service_principal_name: WARNING: Host Account for %s not found... skipping operation.\n",
1895 DEBUG(1,("ads_add_service_principal_name: WARNING: Service Principal '%s/%s@%s' has NOT been added.\n",
1896 spn
, machine_name
, ads
->config
.realm
));
1897 ads_msgfree(ads
, res
);
1898 return ADS_ERROR(LDAP_NO_SUCH_OBJECT
);
1901 DEBUG(1,("ads_add_service_principal_name: Host account for %s found\n", machine_name
));
1902 if (!(ctx
= talloc_init("ads_add_service_principal_name"))) {
1903 ads_msgfree(ads
, res
);
1904 return ADS_ERROR(LDAP_NO_MEMORY
);
1907 /* add short name spn */
1909 if ( (psp1
= talloc_asprintf(ctx
, "%s/%s", spn
, machine_name
)) == NULL
) {
1910 talloc_destroy(ctx
);
1911 ads_msgfree(ads
, res
);
1912 return ADS_ERROR(LDAP_NO_MEMORY
);
1915 strlower_m(&psp1
[strlen(spn
)]);
1916 servicePrincipalName
[0] = psp1
;
1918 DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n",
1919 psp1
, machine_name
));
1922 /* add fully qualified spn */
1924 if ( (psp2
= talloc_asprintf(ctx
, "%s/%s", spn
, my_fqdn
)) == NULL
) {
1925 ret
= ADS_ERROR(LDAP_NO_MEMORY
);
1929 strlower_m(&psp2
[strlen(spn
)]);
1930 servicePrincipalName
[1] = psp2
;
1932 DEBUG(5,("ads_add_service_principal_name: INFO: Adding %s to host %s\n",
1933 psp2
, machine_name
));
1935 if ( (mods
= ads_init_mods(ctx
)) == NULL
) {
1936 ret
= ADS_ERROR(LDAP_NO_MEMORY
);
1940 ret
= ads_add_strlist(ctx
, &mods
, "servicePrincipalName", servicePrincipalName
);
1941 if (!ADS_ERR_OK(ret
)) {
1942 DEBUG(1,("ads_add_service_principal_name: Error: Updating Service Principals in LDAP\n"));
1946 if ( (dn_string
= ads_get_dn(ads
, res
)) == NULL
) {
1947 ret
= ADS_ERROR(LDAP_NO_MEMORY
);
1951 ret
= ads_gen_mod(ads
, dn_string
, mods
);
1952 ads_memfree(ads
,dn_string
);
1953 if (!ADS_ERR_OK(ret
)) {
1954 DEBUG(1,("ads_add_service_principal_name: Error: Updating Service Principals in LDAP\n"));
1960 ads_msgfree(ads
, res
);
1965 * adds a machine account to the ADS server
1966 * @param ads An intialized ADS_STRUCT
1967 * @param machine_name - the NetBIOS machine name of this account.
1968 * @param account_type A number indicating the type of account to create
1969 * @param org_unit The LDAP path in which to place this account
1970 * @return 0 upon success, or non-zero otherwise
1973 ADS_STATUS
ads_create_machine_acct(ADS_STRUCT
*ads
, const char *machine_name
,
1974 const char *org_unit
)
1977 char *samAccountName
, *controlstr
;
1980 char *machine_escaped
= NULL
;
1982 const char *objectClass
[] = {"top", "person", "organizationalPerson",
1983 "user", "computer", NULL
};
1984 LDAPMessage
*res
= NULL
;
1985 uint32 acct_control
= ( UF_WORKSTATION_TRUST_ACCOUNT
|\
1986 UF_DONT_EXPIRE_PASSWD
|\
1987 UF_ACCOUNTDISABLE
);
1989 if (!(ctx
= talloc_init("ads_add_machine_acct")))
1990 return ADS_ERROR(LDAP_NO_MEMORY
);
1992 ret
= ADS_ERROR(LDAP_NO_MEMORY
);
1994 machine_escaped
= escape_rdn_val_string_alloc(machine_name
);
1995 if (!machine_escaped
) {
1999 new_dn
= talloc_asprintf(ctx
, "cn=%s,%s", machine_escaped
, org_unit
);
2000 samAccountName
= talloc_asprintf(ctx
, "%s$", machine_name
);
2002 if ( !new_dn
|| !samAccountName
) {
2006 #ifndef ENCTYPE_ARCFOUR_HMAC
2007 acct_control
|= UF_USE_DES_KEY_ONLY
;
2010 if (!(controlstr
= talloc_asprintf(ctx
, "%u", acct_control
))) {
2014 if (!(mods
= ads_init_mods(ctx
))) {
2018 ads_mod_str(ctx
, &mods
, "cn", machine_name
);
2019 ads_mod_str(ctx
, &mods
, "sAMAccountName", samAccountName
);
2020 ads_mod_strlist(ctx
, &mods
, "objectClass", objectClass
);
2021 ads_mod_str(ctx
, &mods
, "userAccountControl", controlstr
);
2023 ret
= ads_gen_add(ads
, new_dn
, mods
);
2026 SAFE_FREE(machine_escaped
);
2027 ads_msgfree(ads
, res
);
2028 talloc_destroy(ctx
);
2034 * move a machine account to another OU on the ADS server
2035 * @param ads - An intialized ADS_STRUCT
2036 * @param machine_name - the NetBIOS machine name of this account.
2037 * @param org_unit - The LDAP path in which to place this account
2038 * @param moved - whether we moved the machine account (optional)
2039 * @return 0 upon success, or non-zero otherwise
2042 ADS_STATUS
ads_move_machine_acct(ADS_STRUCT
*ads
, const char *machine_name
,
2043 const char *org_unit
, bool *moved
)
2047 LDAPMessage
*res
= NULL
;
2048 char *filter
= NULL
;
2049 char *computer_dn
= NULL
;
2051 char *computer_rdn
= NULL
;
2052 bool need_move
= False
;
2054 if (asprintf(&filter
, "(samAccountName=%s$)", machine_name
) == -1) {
2055 rc
= ADS_ERROR(LDAP_NO_MEMORY
);
2059 /* Find pre-existing machine */
2060 rc
= ads_search(ads
, &res
, filter
, NULL
);
2061 if (!ADS_ERR_OK(rc
)) {
2065 computer_dn
= ads_get_dn(ads
, res
);
2067 rc
= ADS_ERROR(LDAP_NO_MEMORY
);
2071 parent_dn
= ads_parent_dn(computer_dn
);
2072 if (strequal(parent_dn
, org_unit
)) {
2078 if (asprintf(&computer_rdn
, "CN=%s", machine_name
) == -1) {
2079 rc
= ADS_ERROR(LDAP_NO_MEMORY
);
2083 ldap_status
= ldap_rename_s(ads
->ldap
.ld
, computer_dn
, computer_rdn
,
2084 org_unit
, 1, NULL
, NULL
);
2085 rc
= ADS_ERROR(ldap_status
);
2088 ads_msgfree(ads
, res
);
2090 SAFE_FREE(computer_dn
);
2091 SAFE_FREE(computer_rdn
);
2093 if (!ADS_ERR_OK(rc
)) {
2105 dump a binary result from ldap
2107 static void dump_binary(ADS_STRUCT
*ads
, const char *field
, struct berval
**values
)
2110 for (i
=0; values
[i
]; i
++) {
2111 printf("%s: ", field
);
2112 for (j
=0; j
<values
[i
]->bv_len
; j
++) {
2113 printf("%02X", (unsigned char)values
[i
]->bv_val
[j
]);
2119 static void dump_guid(ADS_STRUCT
*ads
, const char *field
, struct berval
**values
)
2122 for (i
=0; values
[i
]; i
++) {
2127 memcpy(guid
.info
, values
[i
]->bv_val
, sizeof(guid
.info
));
2128 smb_uuid_unpack(guid
, &tmp
);
2129 printf("%s: %s\n", field
, smb_uuid_string(talloc_tos(), tmp
));
2134 dump a sid result from ldap
2136 static void dump_sid(ADS_STRUCT
*ads
, const char *field
, struct berval
**values
)
2139 for (i
=0; values
[i
]; i
++) {
2142 if (!sid_parse(values
[i
]->bv_val
, values
[i
]->bv_len
, &sid
)) {
2145 printf("%s: %s\n", field
, sid_to_fstring(tmp
, &sid
));
2150 dump ntSecurityDescriptor
2152 static void dump_sd(ADS_STRUCT
*ads
, const char *filed
, struct berval
**values
)
2154 TALLOC_CTX
*frame
= talloc_stackframe();
2155 struct security_descriptor
*psd
;
2158 status
= unmarshall_sec_desc(talloc_tos(), (uint8
*)values
[0]->bv_val
,
2159 values
[0]->bv_len
, &psd
);
2160 if (!NT_STATUS_IS_OK(status
)) {
2161 DEBUG(0, ("unmarshall_sec_desc failed: %s\n",
2162 nt_errstr(status
)));
2168 ads_disp_sd(ads
, talloc_tos(), psd
);
2175 dump a string result from ldap
2177 static void dump_string(const char *field
, char **values
)
2180 for (i
=0; values
[i
]; i
++) {
2181 printf("%s: %s\n", field
, values
[i
]);
2186 dump a field from LDAP on stdout
2190 static bool ads_dump_field(ADS_STRUCT
*ads
, char *field
, void **values
, void *data_area
)
2195 void (*handler
)(ADS_STRUCT
*, const char *, struct berval
**);
2197 {"objectGUID", False
, dump_guid
},
2198 {"netbootGUID", False
, dump_guid
},
2199 {"nTSecurityDescriptor", False
, dump_sd
},
2200 {"dnsRecord", False
, dump_binary
},
2201 {"objectSid", False
, dump_sid
},
2202 {"tokenGroups", False
, dump_sid
},
2203 {"tokenGroupsNoGCAcceptable", False
, dump_sid
},
2204 {"tokengroupsGlobalandUniversal", False
, dump_sid
},
2205 {"mS-DS-CreatorSID", False
, dump_sid
},
2206 {"msExchMailboxGuid", False
, dump_guid
},
2211 if (!field
) { /* must be end of an entry */
2216 for (i
=0; handlers
[i
].name
; i
++) {
2217 if (StrCaseCmp(handlers
[i
].name
, field
) == 0) {
2218 if (!values
) /* first time, indicate string or not */
2219 return handlers
[i
].string
;
2220 handlers
[i
].handler(ads
, field
, (struct berval
**) values
);
2224 if (!handlers
[i
].name
) {
2225 if (!values
) /* first time, indicate string conversion */
2227 dump_string(field
, (char **)values
);
2233 * Dump a result from LDAP on stdout
2234 * used for debugging
2235 * @param ads connection to ads server
2236 * @param res Results to dump
2239 void ads_dump(ADS_STRUCT
*ads
, LDAPMessage
*res
)
2241 ads_process_results(ads
, res
, ads_dump_field
, NULL
);
2245 * Walk through results, calling a function for each entry found.
2246 * The function receives a field name, a berval * array of values,
2247 * and a data area passed through from the start. The function is
2248 * called once with null for field and values at the end of each
2250 * @param ads connection to ads server
2251 * @param res Results to process
2252 * @param fn Function for processing each result
2253 * @param data_area user-defined area to pass to function
2255 void ads_process_results(ADS_STRUCT
*ads
, LDAPMessage
*res
,
2256 bool (*fn
)(ADS_STRUCT
*, char *, void **, void *),
2261 size_t converted_size
;
2263 if (!(ctx
= talloc_init("ads_process_results")))
2266 for (msg
= ads_first_entry(ads
, res
); msg
;
2267 msg
= ads_next_entry(ads
, msg
)) {
2271 for (utf8_field
=ldap_first_attribute(ads
->ldap
.ld
,
2272 (LDAPMessage
*)msg
,&b
);
2274 utf8_field
=ldap_next_attribute(ads
->ldap
.ld
,
2275 (LDAPMessage
*)msg
,b
)) {
2276 struct berval
**ber_vals
;
2277 char **str_vals
, **utf8_vals
;
2281 if (!pull_utf8_talloc(ctx
, &field
, utf8_field
,
2284 DEBUG(0,("ads_process_results: "
2285 "pull_utf8_talloc failed: %s",
2289 string
= fn(ads
, field
, NULL
, data_area
);
2292 utf8_vals
= ldap_get_values(ads
->ldap
.ld
,
2293 (LDAPMessage
*)msg
, field
);
2294 str_vals
= ads_pull_strvals(ctx
,
2295 (const char **) utf8_vals
);
2296 fn(ads
, field
, (void **) str_vals
, data_area
);
2297 ldap_value_free(utf8_vals
);
2299 ber_vals
= ldap_get_values_len(ads
->ldap
.ld
,
2300 (LDAPMessage
*)msg
, field
);
2301 fn(ads
, field
, (void **) ber_vals
, data_area
);
2303 ldap_value_free_len(ber_vals
);
2305 ldap_memfree(utf8_field
);
2308 talloc_free_children(ctx
);
2309 fn(ads
, NULL
, NULL
, data_area
); /* completed an entry */
2312 talloc_destroy(ctx
);
2316 * count how many replies are in a LDAPMessage
2317 * @param ads connection to ads server
2318 * @param res Results to count
2319 * @return number of replies
2321 int ads_count_replies(ADS_STRUCT
*ads
, void *res
)
2323 return ldap_count_entries(ads
->ldap
.ld
, (LDAPMessage
*)res
);
2327 * pull the first entry from a ADS result
2328 * @param ads connection to ads server
2329 * @param res Results of search
2330 * @return first entry from result
2332 LDAPMessage
*ads_first_entry(ADS_STRUCT
*ads
, LDAPMessage
*res
)
2334 return ldap_first_entry(ads
->ldap
.ld
, res
);
2338 * pull the next entry from a ADS result
2339 * @param ads connection to ads server
2340 * @param res Results of search
2341 * @return next entry from result
2343 LDAPMessage
*ads_next_entry(ADS_STRUCT
*ads
, LDAPMessage
*res
)
2345 return ldap_next_entry(ads
->ldap
.ld
, res
);
2349 * pull the first message from a ADS result
2350 * @param ads connection to ads server
2351 * @param res Results of search
2352 * @return first message from result
2354 LDAPMessage
*ads_first_message(ADS_STRUCT
*ads
, LDAPMessage
*res
)
2356 return ldap_first_message(ads
->ldap
.ld
, res
);
2360 * pull the next message from a ADS result
2361 * @param ads connection to ads server
2362 * @param res Results of search
2363 * @return next message from result
2365 LDAPMessage
*ads_next_message(ADS_STRUCT
*ads
, LDAPMessage
*res
)
2367 return ldap_next_message(ads
->ldap
.ld
, res
);
2371 * pull a single string from a ADS result
2372 * @param ads connection to ads server
2373 * @param mem_ctx TALLOC_CTX to use for allocating result string
2374 * @param msg Results of search
2375 * @param field Attribute to retrieve
2376 * @return Result string in talloc context
2378 char *ads_pull_string(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
, LDAPMessage
*msg
,
2384 size_t converted_size
;
2386 values
= ldap_get_values(ads
->ldap
.ld
, msg
, field
);
2390 if (values
[0] && pull_utf8_talloc(mem_ctx
, &ux_string
, values
[0],
2395 ldap_value_free(values
);
2400 * pull an array of strings from a ADS result
2401 * @param ads connection to ads server
2402 * @param mem_ctx TALLOC_CTX to use for allocating result string
2403 * @param msg Results of search
2404 * @param field Attribute to retrieve
2405 * @return Result strings in talloc context
2407 char **ads_pull_strings(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
,
2408 LDAPMessage
*msg
, const char *field
,
2414 size_t converted_size
;
2416 values
= ldap_get_values(ads
->ldap
.ld
, msg
, field
);
2420 *num_values
= ldap_count_values(values
);
2422 ret
= TALLOC_ARRAY(mem_ctx
, char *, *num_values
+ 1);
2424 ldap_value_free(values
);
2428 for (i
=0;i
<*num_values
;i
++) {
2429 if (!pull_utf8_talloc(mem_ctx
, &ret
[i
], values
[i
],
2432 ldap_value_free(values
);
2438 ldap_value_free(values
);
2443 * pull an array of strings from a ADS result
2444 * (handle large multivalue attributes with range retrieval)
2445 * @param ads connection to ads server
2446 * @param mem_ctx TALLOC_CTX to use for allocating result string
2447 * @param msg Results of search
2448 * @param field Attribute to retrieve
2449 * @param current_strings strings returned by a previous call to this function
2450 * @param next_attribute The next query should ask for this attribute
2451 * @param num_values How many values did we get this time?
2452 * @param more_values Are there more values to get?
2453 * @return Result strings in talloc context
2455 char **ads_pull_strings_range(ADS_STRUCT
*ads
,
2456 TALLOC_CTX
*mem_ctx
,
2457 LDAPMessage
*msg
, const char *field
,
2458 char **current_strings
,
2459 const char **next_attribute
,
2460 size_t *num_strings
,
2464 char *expected_range_attrib
, *range_attr
;
2465 BerElement
*ptr
= NULL
;
2468 size_t num_new_strings
;
2469 unsigned long int range_start
;
2470 unsigned long int range_end
;
2472 /* we might have been given the whole lot anyway */
2473 if ((strings
= ads_pull_strings(ads
, mem_ctx
, msg
, field
, num_strings
))) {
2474 *more_strings
= False
;
2478 expected_range_attrib
= talloc_asprintf(mem_ctx
, "%s;Range=", field
);
2480 /* look for Range result */
2481 for (attr
= ldap_first_attribute(ads
->ldap
.ld
, (LDAPMessage
*)msg
, &ptr
);
2483 attr
= ldap_next_attribute(ads
->ldap
.ld
, (LDAPMessage
*)msg
, ptr
)) {
2484 /* we ignore the fact that this is utf8, as all attributes are ascii... */
2485 if (strnequal(attr
, expected_range_attrib
, strlen(expected_range_attrib
))) {
2493 /* nothing here - this field is just empty */
2494 *more_strings
= False
;
2498 if (sscanf(&range_attr
[strlen(expected_range_attrib
)], "%lu-%lu",
2499 &range_start
, &range_end
) == 2) {
2500 *more_strings
= True
;
2502 if (sscanf(&range_attr
[strlen(expected_range_attrib
)], "%lu-*",
2503 &range_start
) == 1) {
2504 *more_strings
= False
;
2506 DEBUG(1, ("ads_pull_strings_range: Cannot parse Range attriubte (%s)\n",
2508 ldap_memfree(range_attr
);
2509 *more_strings
= False
;
2514 if ((*num_strings
) != range_start
) {
2515 DEBUG(1, ("ads_pull_strings_range: Range attribute (%s) doesn't start at %u, but at %lu"
2516 " - aborting range retreival\n",
2517 range_attr
, (unsigned int)(*num_strings
) + 1, range_start
));
2518 ldap_memfree(range_attr
);
2519 *more_strings
= False
;
2523 new_strings
= ads_pull_strings(ads
, mem_ctx
, msg
, range_attr
, &num_new_strings
);
2525 if (*more_strings
&& ((*num_strings
+ num_new_strings
) != (range_end
+ 1))) {
2526 DEBUG(1, ("ads_pull_strings_range: Range attribute (%s) tells us we have %lu "
2527 "strings in this bunch, but we only got %lu - aborting range retreival\n",
2528 range_attr
, (unsigned long int)range_end
- range_start
+ 1,
2529 (unsigned long int)num_new_strings
));
2530 ldap_memfree(range_attr
);
2531 *more_strings
= False
;
2535 strings
= TALLOC_REALLOC_ARRAY(mem_ctx
, current_strings
, char *,
2536 *num_strings
+ num_new_strings
);
2538 if (strings
== NULL
) {
2539 ldap_memfree(range_attr
);
2540 *more_strings
= False
;
2544 if (new_strings
&& num_new_strings
) {
2545 memcpy(&strings
[*num_strings
], new_strings
,
2546 sizeof(*new_strings
) * num_new_strings
);
2549 (*num_strings
) += num_new_strings
;
2551 if (*more_strings
) {
2552 *next_attribute
= talloc_asprintf(mem_ctx
,
2557 if (!*next_attribute
) {
2558 DEBUG(1, ("talloc_asprintf for next attribute failed!\n"));
2559 ldap_memfree(range_attr
);
2560 *more_strings
= False
;
2565 ldap_memfree(range_attr
);
2571 * pull a single uint32 from a ADS result
2572 * @param ads connection to ads server
2573 * @param msg Results of search
2574 * @param field Attribute to retrieve
2575 * @param v Pointer to int to store result
2576 * @return boolean inidicating success
2578 bool ads_pull_uint32(ADS_STRUCT
*ads
, LDAPMessage
*msg
, const char *field
,
2583 values
= ldap_get_values(ads
->ldap
.ld
, msg
, field
);
2587 ldap_value_free(values
);
2591 *v
= atoi(values
[0]);
2592 ldap_value_free(values
);
2597 * pull a single objectGUID from an ADS result
2598 * @param ads connection to ADS server
2599 * @param msg results of search
2600 * @param guid 37-byte area to receive text guid
2601 * @return boolean indicating success
2603 bool ads_pull_guid(ADS_STRUCT
*ads
, LDAPMessage
*msg
, struct GUID
*guid
)
2606 UUID_FLAT flat_guid
;
2608 values
= ldap_get_values(ads
->ldap
.ld
, msg
, "objectGUID");
2613 memcpy(&flat_guid
.info
, values
[0], sizeof(UUID_FLAT
));
2614 smb_uuid_unpack(flat_guid
, guid
);
2615 ldap_value_free(values
);
2618 ldap_value_free(values
);
2625 * pull a single DOM_SID from a ADS result
2626 * @param ads connection to ads server
2627 * @param msg Results of search
2628 * @param field Attribute to retrieve
2629 * @param sid Pointer to sid to store result
2630 * @return boolean inidicating success
2632 bool ads_pull_sid(ADS_STRUCT
*ads
, LDAPMessage
*msg
, const char *field
,
2635 struct berval
**values
;
2638 values
= ldap_get_values_len(ads
->ldap
.ld
, msg
, field
);
2644 ret
= sid_parse(values
[0]->bv_val
, values
[0]->bv_len
, sid
);
2646 ldap_value_free_len(values
);
2651 * pull an array of DOM_SIDs from a ADS result
2652 * @param ads connection to ads server
2653 * @param mem_ctx TALLOC_CTX for allocating sid array
2654 * @param msg Results of search
2655 * @param field Attribute to retrieve
2656 * @param sids pointer to sid array to allocate
2657 * @return the count of SIDs pulled
2659 int ads_pull_sids(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
,
2660 LDAPMessage
*msg
, const char *field
, DOM_SID
**sids
)
2662 struct berval
**values
;
2666 values
= ldap_get_values_len(ads
->ldap
.ld
, msg
, field
);
2671 for (i
=0; values
[i
]; i
++)
2675 (*sids
) = TALLOC_ARRAY(mem_ctx
, DOM_SID
, i
);
2677 ldap_value_free_len(values
);
2685 for (i
=0; values
[i
]; i
++) {
2686 ret
= sid_parse(values
[i
]->bv_val
, values
[i
]->bv_len
, &(*sids
)[count
]);
2688 DEBUG(10, ("pulling SID: %s\n",
2689 sid_string_dbg(&(*sids
)[count
])));
2694 ldap_value_free_len(values
);
2699 * pull a SEC_DESC from a ADS result
2700 * @param ads connection to ads server
2701 * @param mem_ctx TALLOC_CTX for allocating sid array
2702 * @param msg Results of search
2703 * @param field Attribute to retrieve
2704 * @param sd Pointer to *SEC_DESC to store result (talloc()ed)
2705 * @return boolean inidicating success
2707 bool ads_pull_sd(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
,
2708 LDAPMessage
*msg
, const char *field
, SEC_DESC
**sd
)
2710 struct berval
**values
;
2713 values
= ldap_get_values_len(ads
->ldap
.ld
, msg
, field
);
2715 if (!values
) return false;
2719 status
= unmarshall_sec_desc(mem_ctx
,
2720 (uint8
*)values
[0]->bv_val
,
2721 values
[0]->bv_len
, sd
);
2722 if (!NT_STATUS_IS_OK(status
)) {
2723 DEBUG(0, ("unmarshall_sec_desc failed: %s\n",
2724 nt_errstr(status
)));
2729 ldap_value_free_len(values
);
2734 * in order to support usernames longer than 21 characters we need to
2735 * use both the sAMAccountName and the userPrincipalName attributes
2736 * It seems that not all users have the userPrincipalName attribute set
2738 * @param ads connection to ads server
2739 * @param mem_ctx TALLOC_CTX for allocating sid array
2740 * @param msg Results of search
2741 * @return the username
2743 char *ads_pull_username(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
,
2749 /* lookup_name() only works on the sAMAccountName to
2750 returning the username portion of userPrincipalName
2751 breaks winbindd_getpwnam() */
2753 ret
= ads_pull_string(ads
, mem_ctx
, msg
, "userPrincipalName");
2754 if (ret
&& (p
= strchr_m(ret
, '@'))) {
2759 return ads_pull_string(ads
, mem_ctx
, msg
, "sAMAccountName");
2764 * find the update serial number - this is the core of the ldap cache
2765 * @param ads connection to ads server
2766 * @param ads connection to ADS server
2767 * @param usn Pointer to retrieved update serial number
2768 * @return status of search
2770 ADS_STATUS
ads_USN(ADS_STRUCT
*ads
, uint32
*usn
)
2772 const char *attrs
[] = {"highestCommittedUSN", NULL
};
2776 status
= ads_do_search_retry(ads
, "", LDAP_SCOPE_BASE
, "(objectclass=*)", attrs
, &res
);
2777 if (!ADS_ERR_OK(status
))
2780 if (ads_count_replies(ads
, res
) != 1) {
2781 ads_msgfree(ads
, res
);
2782 return ADS_ERROR(LDAP_NO_RESULTS_RETURNED
);
2785 if (!ads_pull_uint32(ads
, res
, "highestCommittedUSN", usn
)) {
2786 ads_msgfree(ads
, res
);
2787 return ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE
);
2790 ads_msgfree(ads
, res
);
2794 /* parse a ADS timestring - typical string is
2795 '20020917091222.0Z0' which means 09:12.22 17th September
2797 static time_t ads_parse_time(const char *str
)
2803 if (sscanf(str
, "%4d%2d%2d%2d%2d%2d",
2804 &tm
.tm_year
, &tm
.tm_mon
, &tm
.tm_mday
,
2805 &tm
.tm_hour
, &tm
.tm_min
, &tm
.tm_sec
) != 6) {
2814 /********************************************************************
2815 ********************************************************************/
2817 ADS_STATUS
ads_current_time(ADS_STRUCT
*ads
)
2819 const char *attrs
[] = {"currentTime", NULL
};
2824 ADS_STRUCT
*ads_s
= ads
;
2826 if (!(ctx
= talloc_init("ads_current_time"))) {
2827 return ADS_ERROR(LDAP_NO_MEMORY
);
2830 /* establish a new ldap tcp session if necessary */
2832 if ( !ads
->ldap
.ld
) {
2833 if ( (ads_s
= ads_init( ads
->server
.realm
, ads
->server
.workgroup
,
2834 ads
->server
.ldap_server
)) == NULL
)
2838 ads_s
->auth
.flags
= ADS_AUTH_ANON_BIND
;
2839 status
= ads_connect( ads_s
);
2840 if ( !ADS_ERR_OK(status
))
2844 status
= ads_do_search(ads_s
, "", LDAP_SCOPE_BASE
, "(objectclass=*)", attrs
, &res
);
2845 if (!ADS_ERR_OK(status
)) {
2849 timestr
= ads_pull_string(ads_s
, ctx
, res
, "currentTime");
2851 ads_msgfree(ads_s
, res
);
2852 status
= ADS_ERROR(LDAP_NO_RESULTS_RETURNED
);
2856 /* but save the time and offset in the original ADS_STRUCT */
2858 ads
->config
.current_time
= ads_parse_time(timestr
);
2860 if (ads
->config
.current_time
!= 0) {
2861 ads
->auth
.time_offset
= ads
->config
.current_time
- time(NULL
);
2862 DEBUG(4,("time offset is %d seconds\n", ads
->auth
.time_offset
));
2865 ads_msgfree(ads
, res
);
2867 status
= ADS_SUCCESS
;
2870 /* free any temporary ads connections */
2871 if ( ads_s
!= ads
) {
2872 ads_destroy( &ads_s
);
2874 talloc_destroy(ctx
);
2879 /********************************************************************
2880 ********************************************************************/
2882 ADS_STATUS
ads_domain_func_level(ADS_STRUCT
*ads
, uint32
*val
)
2884 const char *attrs
[] = {"domainFunctionality", NULL
};
2887 ADS_STRUCT
*ads_s
= ads
;
2889 *val
= DS_DOMAIN_FUNCTION_2000
;
2891 /* establish a new ldap tcp session if necessary */
2893 if ( !ads
->ldap
.ld
) {
2894 if ( (ads_s
= ads_init( ads
->server
.realm
, ads
->server
.workgroup
,
2895 ads
->server
.ldap_server
)) == NULL
)
2897 status
= ADS_ERROR_NT(NT_STATUS_NO_MEMORY
);
2900 ads_s
->auth
.flags
= ADS_AUTH_ANON_BIND
;
2901 status
= ads_connect( ads_s
);
2902 if ( !ADS_ERR_OK(status
))
2906 /* If the attribute does not exist assume it is a Windows 2000
2907 functional domain */
2909 status
= ads_do_search(ads_s
, "", LDAP_SCOPE_BASE
, "(objectclass=*)", attrs
, &res
);
2910 if (!ADS_ERR_OK(status
)) {
2911 if ( status
.err
.rc
== LDAP_NO_SUCH_ATTRIBUTE
) {
2912 status
= ADS_SUCCESS
;
2917 if ( !ads_pull_uint32(ads_s
, res
, "domainFunctionality", val
) ) {
2918 DEBUG(5,("ads_domain_func_level: Failed to pull the domainFunctionality attribute.\n"));
2920 DEBUG(3,("ads_domain_func_level: %d\n", *val
));
2923 ads_msgfree(ads
, res
);
2926 /* free any temporary ads connections */
2927 if ( ads_s
!= ads
) {
2928 ads_destroy( &ads_s
);
2935 * find the domain sid for our domain
2936 * @param ads connection to ads server
2937 * @param sid Pointer to domain sid
2938 * @return status of search
2940 ADS_STATUS
ads_domain_sid(ADS_STRUCT
*ads
, DOM_SID
*sid
)
2942 const char *attrs
[] = {"objectSid", NULL
};
2946 rc
= ads_do_search_retry(ads
, ads
->config
.bind_path
, LDAP_SCOPE_BASE
, "(objectclass=*)",
2948 if (!ADS_ERR_OK(rc
)) return rc
;
2949 if (!ads_pull_sid(ads
, res
, "objectSid", sid
)) {
2950 ads_msgfree(ads
, res
);
2951 return ADS_ERROR_SYSTEM(ENOENT
);
2953 ads_msgfree(ads
, res
);
2959 * find our site name
2960 * @param ads connection to ads server
2961 * @param mem_ctx Pointer to talloc context
2962 * @param site_name Pointer to the sitename
2963 * @return status of search
2965 ADS_STATUS
ads_site_dn(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
, const char **site_name
)
2969 const char *dn
, *service_name
;
2970 const char *attrs
[] = { "dsServiceName", NULL
};
2972 status
= ads_do_search(ads
, "", LDAP_SCOPE_BASE
, "(objectclass=*)", attrs
, &res
);
2973 if (!ADS_ERR_OK(status
)) {
2977 service_name
= ads_pull_string(ads
, mem_ctx
, res
, "dsServiceName");
2978 if (service_name
== NULL
) {
2979 ads_msgfree(ads
, res
);
2980 return ADS_ERROR(LDAP_NO_RESULTS_RETURNED
);
2983 ads_msgfree(ads
, res
);
2985 /* go up three levels */
2986 dn
= ads_parent_dn(ads_parent_dn(ads_parent_dn(service_name
)));
2988 return ADS_ERROR(LDAP_NO_MEMORY
);
2991 *site_name
= talloc_strdup(mem_ctx
, dn
);
2992 if (*site_name
== NULL
) {
2993 return ADS_ERROR(LDAP_NO_MEMORY
);
2998 dsServiceName: CN=NTDS Settings,CN=W2K3DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ber,DC=suse,DC=de
3003 * find the site dn where a machine resides
3004 * @param ads connection to ads server
3005 * @param mem_ctx Pointer to talloc context
3006 * @param computer_name name of the machine
3007 * @param site_name Pointer to the sitename
3008 * @return status of search
3010 ADS_STATUS
ads_site_dn_for_machine(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
, const char *computer_name
, const char **site_dn
)
3014 const char *parent
, *filter
;
3015 char *config_context
= NULL
;
3018 /* shortcut a query */
3019 if (strequal(computer_name
, ads
->config
.ldap_server_name
)) {
3020 return ads_site_dn(ads
, mem_ctx
, site_dn
);
3023 status
= ads_config_path(ads
, mem_ctx
, &config_context
);
3024 if (!ADS_ERR_OK(status
)) {
3028 filter
= talloc_asprintf(mem_ctx
, "(cn=%s)", computer_name
);
3029 if (filter
== NULL
) {
3030 return ADS_ERROR(LDAP_NO_MEMORY
);
3033 status
= ads_do_search(ads
, config_context
, LDAP_SCOPE_SUBTREE
,
3034 filter
, NULL
, &res
);
3035 if (!ADS_ERR_OK(status
)) {
3039 if (ads_count_replies(ads
, res
) != 1) {
3040 ads_msgfree(ads
, res
);
3041 return ADS_ERROR(LDAP_NO_SUCH_OBJECT
);
3044 dn
= ads_get_dn(ads
, res
);
3046 ads_msgfree(ads
, res
);
3047 return ADS_ERROR(LDAP_NO_MEMORY
);
3050 /* go up three levels */
3051 parent
= ads_parent_dn(ads_parent_dn(ads_parent_dn(dn
)));
3052 if (parent
== NULL
) {
3053 ads_msgfree(ads
, res
);
3054 ads_memfree(ads
, dn
);
3055 return ADS_ERROR(LDAP_NO_MEMORY
);
3058 *site_dn
= talloc_strdup(mem_ctx
, parent
);
3059 if (*site_dn
== NULL
) {
3060 ads_msgfree(ads
, res
);
3061 ads_memfree(ads
, dn
);
3062 return ADS_ERROR(LDAP_NO_MEMORY
);
3065 ads_memfree(ads
, dn
);
3066 ads_msgfree(ads
, res
);
3072 * get the upn suffixes for a domain
3073 * @param ads connection to ads server
3074 * @param mem_ctx Pointer to talloc context
3075 * @param suffixes Pointer to an array of suffixes
3076 * @param num_suffixes Pointer to the number of suffixes
3077 * @return status of search
3079 ADS_STATUS
ads_upn_suffixes(ADS_STRUCT
*ads
, TALLOC_CTX
*mem_ctx
, char ***suffixes
, size_t *num_suffixes
)
3084 char *config_context
= NULL
;
3085 const char *attrs
[] = { "uPNSuffixes", NULL
};
3087 status
= ads_config_path(ads
, mem_ctx
, &config_context
);
3088 if (!ADS_ERR_OK(status
)) {
3092 base
= talloc_asprintf(mem_ctx
, "cn=Partitions,%s", config_context
);
3094 return ADS_ERROR(LDAP_NO_MEMORY
);
3097 status
= ads_search_dn(ads
, &res
, base
, attrs
);
3098 if (!ADS_ERR_OK(status
)) {
3102 if (ads_count_replies(ads
, res
) != 1) {
3103 ads_msgfree(ads
, res
);
3104 return ADS_ERROR(LDAP_NO_SUCH_OBJECT
);
3107 (*suffixes
) = ads_pull_strings(ads
, mem_ctx
, res
, "uPNSuffixes", num_suffixes
);
3108 if ((*suffixes
) == NULL
) {
3109 ads_msgfree(ads
, res
);
3110 return ADS_ERROR(LDAP_NO_MEMORY
);
3113 ads_msgfree(ads
, res
);
3119 * get the joinable ous for a domain
3120 * @param ads connection to ads server
3121 * @param mem_ctx Pointer to talloc context
3122 * @param ous Pointer to an array of ous
3123 * @param num_ous Pointer to the number of ous
3124 * @return status of search
3126 ADS_STATUS
ads_get_joinable_ous(ADS_STRUCT
*ads
,
3127 TALLOC_CTX
*mem_ctx
,
3132 LDAPMessage
*res
= NULL
;
3133 LDAPMessage
*msg
= NULL
;
3134 const char *attrs
[] = { "dn", NULL
};
3137 status
= ads_search(ads
, &res
,
3138 "(|(objectClass=domain)(objectclass=organizationalUnit))",
3140 if (!ADS_ERR_OK(status
)) {
3144 count
= ads_count_replies(ads
, res
);
3146 ads_msgfree(ads
, res
);
3147 return ADS_ERROR(LDAP_NO_RESULTS_RETURNED
);
3150 for (msg
= ads_first_entry(ads
, res
); msg
;
3151 msg
= ads_next_entry(ads
, msg
)) {
3155 dn
= ads_get_dn(ads
, msg
);
3157 ads_msgfree(ads
, res
);
3158 return ADS_ERROR(LDAP_NO_MEMORY
);
3161 if (!add_string_to_array(mem_ctx
, dn
,
3162 (const char ***)ous
,
3164 ads_memfree(ads
, dn
);
3165 ads_msgfree(ads
, res
);
3166 return ADS_ERROR(LDAP_NO_MEMORY
);
3169 ads_memfree(ads
, dn
);
3172 ads_msgfree(ads
, res
);
3179 * pull a DOM_SID from an extended dn string
3180 * @param mem_ctx TALLOC_CTX
3181 * @param extended_dn string
3182 * @param flags string type of extended_dn
3183 * @param sid pointer to a DOM_SID
3184 * @return NT_STATUS_OK on success,
3185 * NT_INVALID_PARAMETER on error,
3186 * NT_STATUS_NOT_FOUND if no SID present
3188 ADS_STATUS
ads_get_sid_from_extended_dn(TALLOC_CTX
*mem_ctx
,
3189 const char *extended_dn
,
3190 enum ads_extended_dn_flags flags
,
3196 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
3199 /* otherwise extended_dn gets stripped off */
3200 if ((dn
= talloc_strdup(mem_ctx
, extended_dn
)) == NULL
) {
3201 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
3204 * ADS_EXTENDED_DN_HEX_STRING:
3205 * <GUID=238e1963cb390f4bb032ba0105525a29>;<SID=010500000000000515000000bb68c8fd6b61b427572eb04556040000>;CN=gd,OU=berlin,OU=suse,DC=ber,DC=suse,DC=de
3207 * ADS_EXTENDED_DN_STRING (only with w2k3):
3208 * <GUID=63198e23-39cb-4b0f-b032-ba0105525a29>;<SID=S-1-5-21-4257769659-666132843-1169174103-1110>;CN=gd,OU=berlin,OU=suse,DC=ber,DC=suse,DC=de
3210 * Object with no SID, such as an Exchange Public Folder
3211 * <GUID=28907fb4bdf6854993e7f0a10b504e7c>;CN=public,CN=Microsoft Exchange System Objects,DC=sd2k3ms,DC=west,DC=isilon,DC=com
3214 p
= strchr(dn
, ';');
3216 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
3219 if (strncmp(p
, ";<SID=", strlen(";<SID=")) != 0) {
3220 DEBUG(5,("No SID present in extended dn\n"));
3221 return ADS_ERROR_NT(NT_STATUS_NOT_FOUND
);
3224 p
+= strlen(";<SID=");
3228 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
3233 DEBUG(100,("ads_get_sid_from_extended_dn: sid string is %s\n", p
));
3237 case ADS_EXTENDED_DN_STRING
:
3238 if (!string_to_sid(sid
, p
)) {
3239 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
3242 case ADS_EXTENDED_DN_HEX_STRING
: {
3246 buf_len
= strhex_to_str(buf
, sizeof(buf
), p
, strlen(p
));
3248 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
3251 if (!sid_parse(buf
, buf_len
, sid
)) {
3252 DEBUG(10,("failed to parse sid\n"));
3253 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
3258 DEBUG(10,("unknown extended dn format\n"));
3259 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER
);
3262 return ADS_ERROR_NT(NT_STATUS_OK
);
3266 * pull an array of DOM_SIDs from a ADS result
3267 * @param ads connection to ads server
3268 * @param mem_ctx TALLOC_CTX for allocating sid array
3269 * @param msg Results of search
3270 * @param field Attribute to retrieve
3271 * @param flags string type of extended_dn
3272 * @param sids pointer to sid array to allocate
3273 * @return the count of SIDs pulled
3275 int ads_pull_sids_from_extendeddn(ADS_STRUCT
*ads
,
3276 TALLOC_CTX
*mem_ctx
,
3279 enum ads_extended_dn_flags flags
,
3284 size_t dn_count
, ret_count
= 0;
3287 if ((dn_strings
= ads_pull_strings(ads
, mem_ctx
, msg
, field
,
3288 &dn_count
)) == NULL
) {
3292 (*sids
) = TALLOC_ZERO_ARRAY(mem_ctx
, DOM_SID
, dn_count
+ 1);
3294 TALLOC_FREE(dn_strings
);
3298 for (i
=0; i
<dn_count
; i
++) {
3299 rc
= ads_get_sid_from_extended_dn(mem_ctx
, dn_strings
[i
],
3300 flags
, &(*sids
)[i
]);
3301 if (!ADS_ERR_OK(rc
)) {
3302 if (NT_STATUS_EQUAL(ads_ntstatus(rc
),
3303 NT_STATUS_NOT_FOUND
)) {
3308 TALLOC_FREE(dn_strings
);
3315 TALLOC_FREE(dn_strings
);
3320 /********************************************************************
3321 ********************************************************************/
3323 char* ads_get_dnshostname( ADS_STRUCT
*ads
, TALLOC_CTX
*ctx
, const char *machine_name
)
3325 LDAPMessage
*res
= NULL
;
3330 status
= ads_find_machine_acct(ads
, &res
, global_myname());
3331 if (!ADS_ERR_OK(status
)) {
3332 DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n",
3337 if ( (count
= ads_count_replies(ads
, res
)) != 1 ) {
3338 DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count
));
3342 if ( (name
= ads_pull_string(ads
, ctx
, res
, "dNSHostName")) == NULL
) {
3343 DEBUG(0,("ads_get_dnshostname: No dNSHostName attribute!\n"));
3347 ads_msgfree(ads
, res
);
3352 /********************************************************************
3353 ********************************************************************/
3355 char* ads_get_upn( ADS_STRUCT
*ads
, TALLOC_CTX
*ctx
, const char *machine_name
)
3357 LDAPMessage
*res
= NULL
;
3362 status
= ads_find_machine_acct(ads
, &res
, machine_name
);
3363 if (!ADS_ERR_OK(status
)) {
3364 DEBUG(0,("ads_get_upn: Failed to find account for %s\n",
3369 if ( (count
= ads_count_replies(ads
, res
)) != 1 ) {
3370 DEBUG(1,("ads_get_upn: %d entries returned!\n", count
));
3374 if ( (name
= ads_pull_string(ads
, ctx
, res
, "userPrincipalName")) == NULL
) {
3375 DEBUG(2,("ads_get_upn: No userPrincipalName attribute!\n"));
3379 ads_msgfree(ads
, res
);
3384 /********************************************************************
3385 ********************************************************************/
3387 char* ads_get_samaccountname( ADS_STRUCT
*ads
, TALLOC_CTX
*ctx
, const char *machine_name
)
3389 LDAPMessage
*res
= NULL
;
3394 status
= ads_find_machine_acct(ads
, &res
, global_myname());
3395 if (!ADS_ERR_OK(status
)) {
3396 DEBUG(0,("ads_get_dnshostname: Failed to find account for %s\n",
3401 if ( (count
= ads_count_replies(ads
, res
)) != 1 ) {
3402 DEBUG(1,("ads_get_dnshostname: %d entries returned!\n", count
));
3406 if ( (name
= ads_pull_string(ads
, ctx
, res
, "sAMAccountName")) == NULL
) {
3407 DEBUG(0,("ads_get_dnshostname: No sAMAccountName attribute!\n"));
3411 ads_msgfree(ads
, res
);
3418 SAVED CODE
- we used to join via ldap
- remember how we did
this. JRA
.
3421 * Join a machine to a realm
3422 * Creates the machine account and sets the machine password
3423 * @param ads connection to ads server
3424 * @param machine name of host to add
3425 * @param org_unit Organizational unit to place machine in
3426 * @return status of join
3428 ADS_STATUS
ads_join_realm(ADS_STRUCT
*ads
, const char *machine_name
,
3429 uint32 account_type
, const char *org_unit
)
3432 LDAPMessage
*res
= NULL
;
3435 /* machine name must be lowercase */
3436 machine
= SMB_STRDUP(machine_name
);
3437 strlower_m(machine
);
3440 status = ads_find_machine_acct(ads, (void **)&res, machine);
3441 if (ADS_ERR_OK(status) && ads_count_replies(ads, res) == 1) {
3442 DEBUG(0, ("Host account for %s already exists - deleting old account\n", machine));
3443 status = ads_leave_realm(ads, machine);
3444 if (!ADS_ERR_OK(status)) {
3445 DEBUG(0, ("Failed to delete host '%s' from the '%s' realm.\n",
3446 machine, ads->config.realm));
3451 status
= ads_add_machine_acct(ads
, machine
, account_type
, org_unit
);
3452 if (!ADS_ERR_OK(status
)) {
3453 DEBUG(0, ("ads_join_realm: ads_add_machine_acct failed (%s): %s\n", machine
, ads_errstr(status
)));
3458 status
= ads_find_machine_acct(ads
, (void **)(void *)&res
, machine
);
3459 if (!ADS_ERR_OK(status
)) {
3460 DEBUG(0, ("ads_join_realm: Host account test failed for machine %s\n", machine
));
3466 ads_msgfree(ads
, res
);
3473 * Delete a machine from the realm
3474 * @param ads connection to ads server
3475 * @param hostname Machine to remove
3476 * @return status of delete
3478 ADS_STATUS
ads_leave_realm(ADS_STRUCT
*ads
, const char *hostname
)
3483 char *hostnameDN
, *host
;
3485 LDAPControl ldap_control
;
3486 LDAPControl
* pldap_control
[2] = {NULL
, NULL
};
3488 pldap_control
[0] = &ldap_control
;
3489 memset(&ldap_control
, 0, sizeof(LDAPControl
));
3490 ldap_control
.ldctl_oid
= (char *)LDAP_SERVER_TREE_DELETE_OID
;
3492 /* hostname must be lowercase */
3493 host
= SMB_STRDUP(hostname
);
3496 status
= ads_find_machine_acct(ads
, &res
, host
);
3497 if (!ADS_ERR_OK(status
)) {
3498 DEBUG(0, ("Host account for %s does not exist.\n", host
));
3503 msg
= ads_first_entry(ads
, res
);
3506 return ADS_ERROR_SYSTEM(ENOENT
);
3509 hostnameDN
= ads_get_dn(ads
, (LDAPMessage
*)msg
);
3511 rc
= ldap_delete_ext_s(ads
->ldap
.ld
, hostnameDN
, pldap_control
, NULL
);
3513 DEBUG(3,("ldap_delete_ext_s failed with error code %d\n", rc
));
3515 DEBUG(3,("ldap_delete_ext_s succeeded with error code %d\n", rc
));
3518 if (rc
!= LDAP_SUCCESS
) {
3519 const char *attrs
[] = { "cn", NULL
};
3520 LDAPMessage
*msg_sub
;
3522 /* we only search with scope ONE, we do not expect any further
3523 * objects to be created deeper */
3525 status
= ads_do_search_retry(ads
, hostnameDN
,
3526 LDAP_SCOPE_ONELEVEL
,
3527 "(objectclass=*)", attrs
, &res
);
3529 if (!ADS_ERR_OK(status
)) {
3531 ads_memfree(ads
, hostnameDN
);
3535 for (msg_sub
= ads_first_entry(ads
, res
); msg_sub
;
3536 msg_sub
= ads_next_entry(ads
, msg_sub
)) {
3540 if ((dn
= ads_get_dn(ads
, msg_sub
)) == NULL
) {
3542 ads_memfree(ads
, hostnameDN
);
3543 return ADS_ERROR(LDAP_NO_MEMORY
);
3546 status
= ads_del_dn(ads
, dn
);
3547 if (!ADS_ERR_OK(status
)) {
3548 DEBUG(3,("failed to delete dn %s: %s\n", dn
, ads_errstr(status
)));
3550 ads_memfree(ads
, dn
);
3551 ads_memfree(ads
, hostnameDN
);
3555 ads_memfree(ads
, dn
);
3558 /* there should be no subordinate objects anymore */
3559 status
= ads_do_search_retry(ads
, hostnameDN
,
3560 LDAP_SCOPE_ONELEVEL
,
3561 "(objectclass=*)", attrs
, &res
);
3563 if (!ADS_ERR_OK(status
) || ( (ads_count_replies(ads
, res
)) > 0 ) ) {
3565 ads_memfree(ads
, hostnameDN
);
3569 /* delete hostnameDN now */
3570 status
= ads_del_dn(ads
, hostnameDN
);
3571 if (!ADS_ERR_OK(status
)) {
3573 DEBUG(3,("failed to delete dn %s: %s\n", hostnameDN
, ads_errstr(status
)));
3574 ads_memfree(ads
, hostnameDN
);
3579 ads_memfree(ads
, hostnameDN
);
3581 status
= ads_find_machine_acct(ads
, &res
, host
);
3582 if (ADS_ERR_OK(status
) && ads_count_replies(ads
, res
) == 1) {
3583 DEBUG(3, ("Failed to remove host account.\n"));
3593 * pull all token-sids from an LDAP dn
3594 * @param ads connection to ads server
3595 * @param mem_ctx TALLOC_CTX for allocating sid array
3596 * @param dn of LDAP object
3597 * @param user_sid pointer to DOM_SID (objectSid)
3598 * @param primary_group_sid pointer to DOM_SID (self composed)
3599 * @param sids pointer to sid array to allocate
3600 * @param num_sids counter of SIDs pulled
3601 * @return status of token query
3603 ADS_STATUS
ads_get_tokensids(ADS_STRUCT
*ads
,
3604 TALLOC_CTX
*mem_ctx
,
3607 DOM_SID
*primary_group_sid
,
3612 LDAPMessage
*res
= NULL
;
3614 size_t tmp_num_sids
;
3616 DOM_SID tmp_user_sid
;
3617 DOM_SID tmp_primary_group_sid
;
3619 const char *attrs
[] = {
3626 status
= ads_search_retry_dn(ads
, &res
, dn
, attrs
);
3627 if (!ADS_ERR_OK(status
)) {
3631 count
= ads_count_replies(ads
, res
);
3633 ads_msgfree(ads
, res
);
3634 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT
);
3637 if (!ads_pull_sid(ads
, res
, "objectSid", &tmp_user_sid
)) {
3638 ads_msgfree(ads
, res
);
3639 return ADS_ERROR_LDAP(LDAP_NO_MEMORY
);
3642 if (!ads_pull_uint32(ads
, res
, "primaryGroupID", &pgid
)) {
3643 ads_msgfree(ads
, res
);
3644 return ADS_ERROR_LDAP(LDAP_NO_MEMORY
);
3648 /* hack to compose the primary group sid without knowing the
3654 sid_copy(&domsid
, &tmp_user_sid
);
3656 if (!sid_split_rid(&domsid
, &dummy_rid
)) {
3657 ads_msgfree(ads
, res
);
3658 return ADS_ERROR_LDAP(LDAP_NO_MEMORY
);
3661 if (!sid_compose(&tmp_primary_group_sid
, &domsid
, pgid
)) {
3662 ads_msgfree(ads
, res
);
3663 return ADS_ERROR_LDAP(LDAP_NO_MEMORY
);
3667 tmp_num_sids
= ads_pull_sids(ads
, mem_ctx
, res
, "tokenGroups", &tmp_sids
);
3669 if (tmp_num_sids
== 0 || !tmp_sids
) {
3670 ads_msgfree(ads
, res
);
3671 return ADS_ERROR_LDAP(LDAP_NO_MEMORY
);
3675 *num_sids
= tmp_num_sids
;
3683 *user_sid
= tmp_user_sid
;
3686 if (primary_group_sid
) {
3687 *primary_group_sid
= tmp_primary_group_sid
;
3690 DEBUG(10,("ads_get_tokensids: returned %d sids\n", (int)tmp_num_sids
+ 2));
3692 ads_msgfree(ads
, res
);
3693 return ADS_ERROR_LDAP(LDAP_SUCCESS
);
3697 * Find a sAMAccoutName in LDAP
3698 * @param ads connection to ads server
3699 * @param mem_ctx TALLOC_CTX for allocating sid array
3700 * @param samaccountname to search
3701 * @param uac_ret uint32 pointer userAccountControl attribute value
3702 * @param dn_ret pointer to dn
3703 * @return status of token query
3705 ADS_STATUS
ads_find_samaccount(ADS_STRUCT
*ads
,
3706 TALLOC_CTX
*mem_ctx
,
3707 const char *samaccountname
,
3709 const char **dn_ret
)
3712 const char *attrs
[] = { "userAccountControl", NULL
};
3714 LDAPMessage
*res
= NULL
;
3718 filter
= talloc_asprintf(mem_ctx
, "(&(objectclass=user)(sAMAccountName=%s))",
3720 if (filter
== NULL
) {
3721 status
= ADS_ERROR_NT(NT_STATUS_NO_MEMORY
);
3725 status
= ads_do_search_all(ads
, ads
->config
.bind_path
,
3727 filter
, attrs
, &res
);
3729 if (!ADS_ERR_OK(status
)) {
3733 if (ads_count_replies(ads
, res
) != 1) {
3734 status
= ADS_ERROR(LDAP_NO_RESULTS_RETURNED
);
3738 dn
= ads_get_dn(ads
, res
);
3740 status
= ADS_ERROR(LDAP_NO_MEMORY
);
3744 if (!ads_pull_uint32(ads
, res
, "userAccountControl", &uac
)) {
3745 status
= ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE
);
3754 *dn_ret
= talloc_strdup(mem_ctx
, dn
);
3756 status
= ADS_ERROR(LDAP_NO_MEMORY
);
3761 ads_memfree(ads
, dn
);
3762 ads_msgfree(ads
, res
);
3768 * find our configuration path
3769 * @param ads connection to ads server
3770 * @param mem_ctx Pointer to talloc context
3771 * @param config_path Pointer to the config path
3772 * @return status of search
3774 ADS_STATUS
ads_config_path(ADS_STRUCT
*ads
,
3775 TALLOC_CTX
*mem_ctx
,
3779 LDAPMessage
*res
= NULL
;
3780 const char *config_context
= NULL
;
3781 const char *attrs
[] = { "configurationNamingContext", NULL
};
3783 status
= ads_do_search(ads
, "", LDAP_SCOPE_BASE
,
3784 "(objectclass=*)", attrs
, &res
);
3785 if (!ADS_ERR_OK(status
)) {
3789 config_context
= ads_pull_string(ads
, mem_ctx
, res
,
3790 "configurationNamingContext");
3791 ads_msgfree(ads
, res
);
3792 if (!config_context
) {
3793 return ADS_ERROR(LDAP_NO_MEMORY
);
3797 *config_path
= talloc_strdup(mem_ctx
, config_context
);
3798 if (!*config_path
) {
3799 return ADS_ERROR(LDAP_NO_MEMORY
);
3803 return ADS_ERROR(LDAP_SUCCESS
);
3807 * find the displayName of an extended right
3808 * @param ads connection to ads server
3809 * @param config_path The config path
3810 * @param mem_ctx Pointer to talloc context
3811 * @param GUID struct of the rightsGUID
3812 * @return status of search
3814 const char *ads_get_extended_right_name_by_guid(ADS_STRUCT
*ads
,
3815 const char *config_path
,
3816 TALLOC_CTX
*mem_ctx
,
3817 const struct GUID
*rights_guid
)
3820 LDAPMessage
*res
= NULL
;
3822 const char *attrs
[] = { "displayName", NULL
};
3823 const char *result
= NULL
;
3826 if (!ads
|| !mem_ctx
|| !rights_guid
) {
3830 expr
= talloc_asprintf(mem_ctx
, "(rightsGuid=%s)",
3831 smb_uuid_string(mem_ctx
, *rights_guid
));
3836 path
= talloc_asprintf(mem_ctx
, "cn=Extended-Rights,%s", config_path
);
3841 rc
= ads_do_search_retry(ads
, path
, LDAP_SCOPE_SUBTREE
,
3843 if (!ADS_ERR_OK(rc
)) {
3847 if (ads_count_replies(ads
, res
) != 1) {
3851 result
= ads_pull_string(ads
, mem_ctx
, res
, "displayName");
3854 ads_msgfree(ads
, res
);
3860 * verify or build and verify an account ou
3861 * @param mem_ctx Pointer to talloc context
3862 * @param ads connection to ads server
3864 * @return status of search
3867 ADS_STATUS
ads_check_ou_dn(TALLOC_CTX
*mem_ctx
,
3869 const char **account_ou
)
3871 struct ldb_dn
*name_dn
= NULL
;
3872 const char *name
= NULL
;
3873 char *ou_string
= NULL
;
3875 name_dn
= ldb_dn_explode(mem_ctx
, *account_ou
);
3880 ou_string
= ads_ou_string(ads
, *account_ou
);
3882 return ADS_ERROR_LDAP(LDAP_INVALID_DN_SYNTAX
);
3885 name
= talloc_asprintf(mem_ctx
, "%s,%s", ou_string
,
3886 ads
->config
.bind_path
);
3887 SAFE_FREE(ou_string
);
3889 return ADS_ERROR_LDAP(LDAP_NO_MEMORY
);
3892 name_dn
= ldb_dn_explode(mem_ctx
, name
);
3894 return ADS_ERROR_LDAP(LDAP_INVALID_DN_SYNTAX
);
3897 *account_ou
= talloc_strdup(mem_ctx
, name
);
3899 return ADS_ERROR_LDAP(LDAP_NO_MEMORY
);