?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r6303: Setting up for 3.0.15pre1
[Samba.git] / source / passdb / pdb_ldap.c
blob3899949058a94ef6ea2a60ac3a785c56bc29e15c
1 /*
2 Unix SMB/CIFS implementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean François Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002-2003
8 Copyright (C) Stefan (metze) Metzmacher 2002-2003
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23
24 */
25
26 /* TODO:
27 * persistent connections: if using NSS LDAP, many connections are made
28 * however, using only one within Samba would be nice
29 *
30 * Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
31 *
32 * Other LDAP based login attributes: accountExpires, etc.
33 * (should be the domain of Samba proper, but the sam_password/SAM_ACCOUNT
34 * structures don't have fields for some of these attributes)
35 *
36 * SSL is done, but can't get the certificate based authentication to work
37 * against on my test platform (Linux 2.4, OpenLDAP 2.x)
38 */
39
40 /* NOTE: this will NOT work against an Active Directory server
41 * due to the fact that the two password fields cannot be retrieved
42 * from a server; recommend using security = domain in this situation
43 * and/or winbind
44 */
45
46 #include "includes.h"
47
48 #undef DBGC_CLASS
49 #define DBGC_CLASS DBGC_PASSDB
50
51 #include <lber.h>
52 #include <ldap.h>
53
54 /*
55 * Work around versions of the LDAP client libs that don't have the OIDs
56 * defined, or have them defined under the old name.
57 * This functionality is really a factor of the server, not the client
58 *
59 */
60
61 #if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD)
62 #define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD
63 #elif !defined(LDAP_EXOP_MODIFY_PASSWD)
64 #define LDAP_EXOP_MODIFY_PASSWD "1.3.6.1.4.1.4203.1.11.1"
65 #endif
66
67 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
68 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID
69 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
70 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID ((ber_tag_t) 0x80U)
71 #endif
72
73 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
74 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW
75 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
76 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ((ber_tag_t) 0x82U)
77 #endif
78
79
80 #ifndef SAM_ACCOUNT
81 #define SAM_ACCOUNT struct sam_passwd
82 #endif
83
84 #include "smbldap.h"
85
86 /**********************************************************************
87 Free a LDAPMessage (one is stored on the SAM_ACCOUNT).
88 **********************************************************************/
89
90 void private_data_free_fn(void **result)
91 {
92 ldap_msgfree(*result);
93 *result = NULL;
94 }
95
96 /**********************************************************************
97 Get the attribute name given a user schame version.
98 **********************************************************************/
99
100 static const char* get_userattr_key2string( int schema_ver, int key )
101 {
102 switch ( schema_ver ) {
103 case SCHEMAVER_SAMBAACCOUNT:
104 return get_attr_key2string( attrib_map_v22, key );
105
106 case SCHEMAVER_SAMBASAMACCOUNT:
107 return get_attr_key2string( attrib_map_v30, key );
108
109 default:
110 DEBUG(0,("get_userattr_key2string: unknown schema version specified\n"));
111 break;
112 }
113 return NULL;
114 }
115
116 /**********************************************************************
117 Return the list of attribute names given a user schema version.
118 **********************************************************************/
119
120 const char** get_userattr_list( int schema_ver )
121 {
122 switch ( schema_ver ) {
123 case SCHEMAVER_SAMBAACCOUNT:
124 return get_attr_list( attrib_map_v22 );
125
126 case SCHEMAVER_SAMBASAMACCOUNT:
127 return get_attr_list( attrib_map_v30 );
128 default:
129 DEBUG(0,("get_userattr_list: unknown schema version specified!\n"));
130 break;
131 }
132
133 return NULL;
134 }
135
136 /**************************************************************************
137 Return the list of attribute names to delete given a user schema version.
138 **************************************************************************/
139
140 static const char** get_userattr_delete_list( int schema_ver )
141 {
142 switch ( schema_ver ) {
143 case SCHEMAVER_SAMBAACCOUNT:
144 return get_attr_list( attrib_map_to_delete_v22 );
145
146 case SCHEMAVER_SAMBASAMACCOUNT:
147 return get_attr_list( attrib_map_to_delete_v30 );
148 default:
149 DEBUG(0,("get_userattr_delete_list: unknown schema version specified!\n"));
150 break;
151 }
152
153 return NULL;
154 }
155
156
157 /*******************************************************************
158 Generate the LDAP search filter for the objectclass based on the
159 version of the schema we are using.
160 ******************************************************************/
161
162 static const char* get_objclass_filter( int schema_ver )
163 {
164 static fstring objclass_filter;
165
166 switch( schema_ver ) {
167 case SCHEMAVER_SAMBAACCOUNT:
168 fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT );
169 break;
170 case SCHEMAVER_SAMBASAMACCOUNT:
171 fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT );
172 break;
173 default:
174 DEBUG(0,("get_objclass_filter: Invalid schema version specified!\n"));
175 break;
176 }
177
178 return objclass_filter;
179 }
180
181 /*******************************************************************
182 Run the search by name.
183 ******************************************************************/
184
185 int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
186 const char *user,
187 LDAPMessage ** result,
188 const char **attr)
189 {
190 pstring filter;
191 char *escape_user = escape_ldap_string_alloc(user);
192
193 if (!escape_user) {
194 return LDAP_NO_MEMORY;
195 }
196
197 /*
198 * in the filter expression, replace %u with the real name
199 * so in ldap filter, %u MUST exist :-)
200 */
201 pstr_sprintf(filter, "(&%s%s)", lp_ldap_filter(),
202 get_objclass_filter(ldap_state->schema_ver));
203
204 /*
205 * have to use this here because $ is filtered out
206 * in pstring_sub
207 */
208
209
210 all_string_sub(filter, "%u", escape_user, sizeof(pstring));
211 SAFE_FREE(escape_user);
212
213 return smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
214 }
215
216 /*******************************************************************
217 Run the search by rid.
218 ******************************************************************/
219
220 static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
221 uint32 rid, LDAPMessage ** result,
222 const char **attr)
223 {
224 pstring filter;
225 int rc;
226
227 pstr_sprintf(filter, "(&(rid=%i)%s)", rid,
228 get_objclass_filter(ldap_state->schema_ver));
229
230 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
231
232 return rc;
233 }
234
235 /*******************************************************************
236 Run the search by SID.
237 ******************************************************************/
238
239 static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
240 const DOM_SID *sid, LDAPMessage ** result,
241 const char **attr)
242 {
243 pstring filter;
244 int rc;
245 fstring sid_string;
246
247 pstr_sprintf(filter, "(&(%s=%s)%s)",
248 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
249 sid_to_string(sid_string, sid),
250 get_objclass_filter(ldap_state->schema_ver));
251
252 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
253
254 return rc;
255 }
256
257 /*******************************************************************
258 Delete complete object or objectclass and attrs from
259 object found in search_result depending on lp_ldap_delete_dn
260 ******************************************************************/
261
262 static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state,
263 LDAPMessage *result,
264 const char *objectclass,
265 const char **attrs)
266 {
267 int rc;
268 LDAPMessage *entry = NULL;
269 LDAPMod **mods = NULL;
270 char *name, *dn;
271 BerElement *ptr = NULL;
272
273 rc = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
274
275 if (rc != 1) {
276 DEBUG(0, ("ldapsam_delete_entry: Entry must exist exactly once!\n"));
277 return NT_STATUS_UNSUCCESSFUL;
278 }
279
280 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
281 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
282 if (!dn) {
283 return NT_STATUS_UNSUCCESSFUL;
284 }
285
286 if (lp_ldap_delete_dn()) {
287 NTSTATUS ret = NT_STATUS_OK;
288 rc = smbldap_delete(ldap_state->smbldap_state, dn);
289
290 if (rc != LDAP_SUCCESS) {
291 DEBUG(0, ("ldapsam_delete_entry: Could not delete object %s\n", dn));
292 ret = NT_STATUS_UNSUCCESSFUL;
293 }
294 SAFE_FREE(dn);
295 return ret;
296 }
297
298 /* Ok, delete only the SAM attributes */
299
300 for (name = ldap_first_attribute(ldap_state->smbldap_state->ldap_struct, entry, &ptr);
301 name != NULL;
302 name = ldap_next_attribute(ldap_state->smbldap_state->ldap_struct, entry, ptr)) {
303 const char **attrib;
304
305 /* We are only allowed to delete the attributes that
306 really exist. */
307
308 for (attrib = attrs; *attrib != NULL; attrib++) {
309 /* Don't delete LDAP_ATTR_MOD_TIMESTAMP attribute. */
310 if (strequal(*attrib, get_userattr_key2string(ldap_state->schema_ver,
311 LDAP_ATTR_MOD_TIMESTAMP))) {
312 continue;
313 }
314 if (strequal(*attrib, name)) {
315 DEBUG(10, ("ldapsam_delete_entry: deleting "
316 "attribute %s\n", name));
317 smbldap_set_mod(&mods, LDAP_MOD_DELETE, name,
318 NULL);
319 }
320 }
321
322 ldap_memfree(name);
323 }
324
325 if (ptr != NULL) {
326 ber_free(ptr, 0);
327 }
328
329 smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
330
331 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
332 ldap_mods_free(mods, True);
333
334 if (rc != LDAP_SUCCESS) {
335 char *ld_error = NULL;
336 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
337 &ld_error);
338
339 DEBUG(0, ("ldapsam_delete_entry: Could not delete attributes for %s, error: %s (%s)\n",
340 dn, ldap_err2string(rc), ld_error?ld_error:"unknown"));
341 SAFE_FREE(ld_error);
342 SAFE_FREE(dn);
343 return NT_STATUS_UNSUCCESSFUL;
344 }
345
346 SAFE_FREE(dn);
347 return NT_STATUS_OK;
348 }
349
350 /* New Interface is being implemented here */
351
352 #if 0 /* JERRY - not uesed anymore */
353
354 /**********************************************************************
355 Initialize SAM_ACCOUNT from an LDAP query (unix attributes only)
356 *********************************************************************/
357 static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state,
358 SAM_ACCOUNT * sampass,
359 LDAPMessage * entry,
360 gid_t *gid)
361 {
362 pstring homedir;
363 pstring temp;
364 char **ldap_values;
365 char **values;
366
367 if ((ldap_values = ldap_get_values (ldap_state->smbldap_state->ldap_struct, entry, "objectClass")) == NULL) {
368 DEBUG (1, ("get_unix_attributes: no objectClass! \n"));
369 return False;
370 }
371
372 for (values=ldap_values;*values;values++) {
373 if (strequal(*values, LDAP_OBJ_POSIXACCOUNT )) {
374 break;
375 }
376 }
377
378 if (!*values) { /*end of array, no posixAccount */
379 DEBUG(10, ("user does not have %s attributes\n", LDAP_OBJ_POSIXACCOUNT));
380 ldap_value_free(ldap_values);
381 return False;
382 }
383 ldap_value_free(ldap_values);
384
385 if ( !smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
386 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_UNIX_HOME), homedir) )
387 {
388 return False;
389 }
390
391 if ( !smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
392 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_GIDNUMBER), temp) )
393 {
394 return False;
395 }
396
397 *gid = (gid_t)atol(temp);
398
399 pdb_set_unix_homedir(sampass, homedir, PDB_SET);
400
401 DEBUG(10, ("user has %s attributes\n", LDAP_OBJ_POSIXACCOUNT));
402
403 return True;
404 }
405
406 #endif
407
408 static time_t ldapsam_get_entry_timestamp(
409 struct ldapsam_privates *ldap_state,
410 LDAPMessage * entry)
411 {
412 pstring temp;
413 struct tm tm;
414
415 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
416 get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
417 temp))
418 return (time_t) 0;
419
420 strptime(temp, "%Y%m%d%H%M%SZ", &tm);
421 tzset();
422 return timegm(&tm);
423 }
424
425 /**********************************************************************
426 Initialize SAM_ACCOUNT from an LDAP query.
427 (Based on init_sam_from_buffer in pdb_tdb.c)
428 *********************************************************************/
429
430 static BOOL init_sam_from_ldap(struct ldapsam_privates *ldap_state,
431 SAM_ACCOUNT * sampass,
432 LDAPMessage * entry)
433 {
434 time_t logon_time,
435 logoff_time,
436 kickoff_time,
437 pass_last_set_time,
438 pass_can_change_time,
439 pass_must_change_time,
440 ldap_entry_time,
441 bad_password_time;
442 pstring username,
443 domain,
444 nt_username,
445 fullname,
446 homedir,
447 dir_drive,
448 logon_script,
449 profile_path,
450 acct_desc,
451 workstations;
452 char munged_dial[2048];
453 uint32 user_rid;
454 uint8 smblmpwd[LM_HASH_LEN],
455 smbntpwd[NT_HASH_LEN];
456 BOOL use_samba_attrs = True;
457 uint16 acct_ctrl = 0,
458 logon_divs;
459 uint16 bad_password_count = 0,
460 logon_count = 0;
461 uint32 hours_len;
462 uint8 hours[MAX_HOURS_LEN];
463 pstring temp;
464 LOGIN_CACHE *cache_entry = NULL;
465 uint32 pwHistLen;
466 pstring tmpstring;
467
468 /*
469 * do a little initialization
470 */
471 username[0] = '\0';
472 domain[0] = '\0';
473 nt_username[0] = '\0';
474 fullname[0] = '\0';
475 homedir[0] = '\0';
476 dir_drive[0] = '\0';
477 logon_script[0] = '\0';
478 profile_path[0] = '\0';
479 acct_desc[0] = '\0';
480 munged_dial[0] = '\0';
481 workstations[0] = '\0';
482
483
484 if (sampass == NULL || ldap_state == NULL || entry == NULL) {
485 DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
486 return False;
487 }
488
489 if (ldap_state->smbldap_state->ldap_struct == NULL) {
490 DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->ldap_struct is NULL!\n"));
491 return False;
492 }
493
494 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, "uid", username)) {
495 DEBUG(1, ("init_sam_from_ldap: No uid attribute found for this user!\n"));
496 return False;
497 }
498
499 DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
500
501 pstrcpy(nt_username, username);
502
503 pstrcpy(domain, ldap_state->domain_name);
504
505 pdb_set_username(sampass, username, PDB_SET);
506
507 pdb_set_domain(sampass, domain, PDB_DEFAULT);
508 pdb_set_nt_username(sampass, nt_username, PDB_SET);
509
510 /* deal with different attributes between the schema first */
511
512 if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
513 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
514 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp)) {
515 pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
516 }
517
518 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
519 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_SID), temp)) {
520 pdb_set_group_sid_from_string(sampass, temp, PDB_SET);
521 } else {
522 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
523 }
524 } else {
525 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
526 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp)) {
527 user_rid = (uint32)atol(temp);
528 pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
529 }
530
531 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
532 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_RID), temp)) {
533 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
534 } else {
535 uint32 group_rid;
536
537 group_rid = (uint32)atol(temp);
538
539 /* for some reason, we often have 0 as a primary group RID.
540 Make sure that we treat this just as a 'default' value */
541
542 if ( group_rid > 0 )
543 pdb_set_group_sid_from_rid(sampass, group_rid, PDB_SET);
544 else
545 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
546 }
547 }
548
549 if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
550 DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
551 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
552 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
553 username));
554 return False;
555 }
556
557 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
558 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) {
559 /* leave as default */
560 } else {
561 pass_last_set_time = (time_t) atol(temp);
562 pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
563 }
564
565 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
566 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp)) {
567 /* leave as default */
568 } else {
569 logon_time = (time_t) atol(temp);
570 pdb_set_logon_time(sampass, logon_time, PDB_SET);
571 }
572
573 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
574 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp)) {
575 /* leave as default */
576 } else {
577 logoff_time = (time_t) atol(temp);
578 pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
579 }
580
581 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
582 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp)) {
583 /* leave as default */
584 } else {
585 kickoff_time = (time_t) atol(temp);
586 pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
587 }
588
589 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
590 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp)) {
591 /* leave as default */
592 } else {
593 pass_can_change_time = (time_t) atol(temp);
594 pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
595 }
596
597 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
598 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp)) {
599 /* leave as default */
600 } else {
601 pass_must_change_time = (time_t) atol(temp);
602 pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
603 }
604
605 /* recommend that 'gecos' and 'displayName' should refer to the same
606 * attribute OID. userFullName depreciated, only used by Samba
607 * primary rules of LDAP: don't make a new attribute when one is already defined
608 * that fits your needs; using cn then displayName rather than 'userFullName'
609 */
610
611 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
612 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname)) {
613 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
614 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname)) {
615 /* leave as default */
616 } else {
617 pdb_set_fullname(sampass, fullname, PDB_SET);
618 }
619 } else {
620 pdb_set_fullname(sampass, fullname, PDB_SET);
621 }
622
623 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
624 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive))
625 {
626 pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
627 } else {
628 pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
629 }
630
631 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
632 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir))
633 {
634 pdb_set_homedir( sampass,
635 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_home()),
636 PDB_DEFAULT );
637 } else {
638 pstrcpy( tmpstring, homedir );
639 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
640 pdb_set_homedir(sampass, tmpstring, PDB_SET);
641 }
642
643 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
644 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script))
645 {
646 pdb_set_logon_script( sampass,
647 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_script()),
648 PDB_DEFAULT );
649 } else {
650 pstrcpy( tmpstring, logon_script );
651 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
652 pdb_set_logon_script(sampass, tmpstring, PDB_SET);
653 }
654
655 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
656 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path))
657 {
658 pdb_set_profile_path( sampass,
659 talloc_sub_basic( sampass->mem_ctx, username, lp_logon_path()),
660 PDB_DEFAULT );
661 } else {
662 pstrcpy( tmpstring, profile_path );
663 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
664 pdb_set_profile_path(sampass, tmpstring, PDB_SET);
665 }
666
667 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
668 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC), acct_desc))
669 {
670 /* leave as default */
671 } else {
672 pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
673 }
674
675 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
676 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations)) {
677 /* leave as default */;
678 } else {
679 pdb_set_workstations(sampass, workstations, PDB_SET);
680 }
681
682 if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
683 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL), munged_dial, sizeof(munged_dial))) {
684 /* leave as default */;
685 } else {
686 pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
687 }
688
689 /* FIXME: hours stuff should be cleaner */
690
691 logon_divs = 168;
692 hours_len = 21;
693 memset(hours, 0xff, hours_len);
694
695 if (ldap_state->is_nds_ldap) {
696 char *user_dn;
697 int pwd_len;
698 char clear_text_pw[512];
699
700 /* Make call to Novell eDirectory ldap extension to get clear text password.
701 NOTE: This will only work if we have an SSL connection to eDirectory. */
702 user_dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
703 if (user_dn != NULL) {
704 DEBUG(3, ("init_sam_from_ldap: smbldap_get_dn(%s) returned '%s'\n", username, user_dn));
705
706 pwd_len = sizeof(clear_text_pw);
707 if (pdb_nds_get_password(ldap_state->smbldap_state, user_dn, &pwd_len, clear_text_pw) == LDAP_SUCCESS) {
708 nt_lm_owf_gen(clear_text_pw, smbntpwd, smblmpwd);
709 if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
710 return False;
711 ZERO_STRUCT(smblmpwd);
712 if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
713 return False;
714 ZERO_STRUCT(smbntpwd);
715 use_samba_attrs = False;
716 }
717 } else {
718 DEBUG(0, ("init_sam_from_ldap: failed to get user_dn for '%s'\n", username));
719 }
720 }
721
722 if (use_samba_attrs) {
723 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
724 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp)) {
725 /* leave as default */
726 } else {
727 pdb_gethexpwd(temp, smblmpwd);
728 memset((char *)temp, '\0', strlen(temp)+1);
729 if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
730 return False;
731 ZERO_STRUCT(smblmpwd);
732 }
733
734 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
735 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp)) {
736 /* leave as default */
737 } else {
738 pdb_gethexpwd(temp, smbntpwd);
739 memset((char *)temp, '\0', strlen(temp)+1);
740 if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
741 return False;
742 ZERO_STRUCT(smbntpwd);
743 }
744 }
745
746 account_policy_get(AP_PASSWORD_HISTORY, &pwHistLen);
747 if (pwHistLen > 0){
748 uint8 *pwhist = NULL;
749 int i;
750
751 /* We can only store (sizeof(pstring)-1)/64 password history entries. */
752 pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));
753
754 if ((pwhist = SMB_MALLOC(pwHistLen * PW_HISTORY_ENTRY_LEN)) == NULL){
755 DEBUG(0, ("init_sam_from_ldap: malloc failed!\n"));
756 return False;
757 }
758 memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
759
760 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
761 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY), temp)) {
762 /* leave as default - zeros */
763 } else {
764 BOOL hex_failed = False;
765 for (i = 0; i < pwHistLen; i++){
766 /* Get the 16 byte salt. */
767 if (!pdb_gethexpwd(&temp[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN])) {
768 hex_failed = True;
769 break;
770 }
771 /* Get the 16 byte MD5 hash of salt+passwd. */
772 if (!pdb_gethexpwd(&temp[(i*64)+32],
773 &pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN])) {
774 hex_failed = True;
775 break;
776 }
777 }
778 if (hex_failed) {
779 DEBUG(0,("init_sam_from_ldap: Failed to get password history for user %s\n",
780 username));
781 memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
782 }
783 }
784 if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
785 SAFE_FREE(pwhist);
786 return False;
787 }
788 SAFE_FREE(pwhist);
789 }
790
791 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
792 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp)) {
793 acct_ctrl |= ACB_NORMAL;
794 } else {
795 acct_ctrl = pdb_decode_acct_ctrl(temp);
796
797 if (acct_ctrl == 0)
798 acct_ctrl |= ACB_NORMAL;
799
800 pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
801 }
802
803 pdb_set_hours_len(sampass, hours_len, PDB_SET);
804 pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
805
806 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
807 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_COUNT), temp)) {
808 /* leave as default */
809 } else {
810 bad_password_count = (uint32) atol(temp);
811 pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET);
812 }
813
814 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
815 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_TIME), temp)) {
816 /* leave as default */
817 } else {
818 bad_password_time = (time_t) atol(temp);
819 pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
820 }
821
822
823 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
824 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_COUNT), temp)) {
825 /* leave as default */
826 } else {
827 logon_count = (uint32) atol(temp);
828 pdb_set_logon_count(sampass, logon_count, PDB_SET);
829 }
830
831 /* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
832
833 if(!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
834 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_HOURS), temp)) {
835 /* leave as default */
836 } else {
837 pdb_gethexhours(temp, hours);
838 memset((char *)temp, '\0', strlen(temp) +1);
839 pdb_set_hours(sampass, hours, PDB_SET);
840 ZERO_STRUCT(hours);
841 }
842
843 /* check the timestamp of the cache vs ldap entry */
844 if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
845 entry)))
846 return True;
847
848 /* see if we have newer updates */
849 if (!(cache_entry = login_cache_read(sampass))) {
850 DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
851 (unsigned int)pdb_get_bad_password_count(sampass),
852 (unsigned int)pdb_get_bad_password_time(sampass)));
853 return True;
854 }
855
856 DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
857 (unsigned int)ldap_entry_time, (unsigned int)cache_entry->entry_timestamp,
858 (unsigned int)cache_entry->bad_password_time));
859
860 if (ldap_entry_time > cache_entry->entry_timestamp) {
861 /* cache is older than directory , so
862 we need to delete the entry but allow the
863 fields to be written out */
864 login_cache_delentry(sampass);
865 } else {
866 /* read cache in */
867 pdb_set_acct_ctrl(sampass,
868 pdb_get_acct_ctrl(sampass) |
869 (cache_entry->acct_ctrl & ACB_AUTOLOCK),
870 PDB_SET);
871 pdb_set_bad_password_count(sampass,
872 cache_entry->bad_password_count,
873 PDB_SET);
874 pdb_set_bad_password_time(sampass,
875 cache_entry->bad_password_time,
876 PDB_SET);
877 }
878
879 SAFE_FREE(cache_entry);
880 return True;
881 }
882
883 /**********************************************************************
884 Initialize the ldap db from a SAM_ACCOUNT. Called on update.
885 (Based on init_buffer_from_sam in pdb_tdb.c)
886 *********************************************************************/
887
888 static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state,
889 LDAPMessage *existing,
890 LDAPMod *** mods, SAM_ACCOUNT * sampass,
891 BOOL (*need_update)(const SAM_ACCOUNT *,
892 enum pdb_elements))
893 {
894 pstring temp;
895 uint32 rid;
896
897 if (mods == NULL || sampass == NULL) {
898 DEBUG(0, ("init_ldap_from_sam: NULL parameters found!\n"));
899 return False;
900 }
901
902 *mods = NULL;
903
904 /*
905 * took out adding "objectclass: sambaAccount"
906 * do this on a per-mod basis
907 */
908 if (need_update(sampass, PDB_USERNAME))
909 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
910 "uid", pdb_get_username(sampass));
911
912 DEBUG(2, ("init_ldap_from_sam: Setting entry for user: %s\n", pdb_get_username(sampass)));
913
914 /* only update the RID if we actually need to */
915 if (need_update(sampass, PDB_USERSID)) {
916 fstring sid_string;
917 fstring dom_sid_string;
918 const DOM_SID *user_sid = pdb_get_user_sid(sampass);
919
920 switch ( ldap_state->schema_ver ) {
921 case SCHEMAVER_SAMBAACCOUNT:
922 if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
923 DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
924 sid_to_string(sid_string, user_sid),
925 sid_to_string(dom_sid_string, &ldap_state->domain_sid)));
926 return False;
927 }
928 slprintf(temp, sizeof(temp) - 1, "%i", rid);
929 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
930 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
931 temp);
932 break;
933
934 case SCHEMAVER_SAMBASAMACCOUNT:
935 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
936 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
937 sid_to_string(sid_string, user_sid));
938 break;
939
940 default:
941 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
942 break;
943 }
944 }
945
946 /* we don't need to store the primary group RID - so leaving it
947 'free' to hang off the unix primary group makes life easier */
948
949 if (need_update(sampass, PDB_GROUPSID)) {
950 fstring sid_string;
951 fstring dom_sid_string;
952 const DOM_SID *group_sid = pdb_get_group_sid(sampass);
953
954 switch ( ldap_state->schema_ver ) {
955 case SCHEMAVER_SAMBAACCOUNT:
956 if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
957 DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
958 sid_to_string(sid_string, group_sid),
959 sid_to_string(dom_sid_string, &ldap_state->domain_sid)));
960 return False;
961 }
962
963 slprintf(temp, sizeof(temp) - 1, "%i", rid);
964 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
965 get_userattr_key2string(ldap_state->schema_ver,
966 LDAP_ATTR_PRIMARY_GROUP_RID), temp);
967 break;
968
969 case SCHEMAVER_SAMBASAMACCOUNT:
970 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
971 get_userattr_key2string(ldap_state->schema_ver,
972 LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_string(sid_string, group_sid));
973 break;
974
975 default:
976 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
977 break;
978 }
979
980 }
981
982 /* displayName, cn, and gecos should all be the same
983 * most easily accomplished by giving them the same OID
984 * gecos isn't set here b/c it should be handled by the
985 * add-user script
986 * We change displayName only and fall back to cn if
987 * it does not exist.
988 */
989
990 if (need_update(sampass, PDB_FULLNAME))
991 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
992 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME),
993 pdb_get_fullname(sampass));
994
995 if (need_update(sampass, PDB_ACCTDESC))
996 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
997 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC),
998 pdb_get_acct_desc(sampass));
999
1000 if (need_update(sampass, PDB_WORKSTATIONS))
1001 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1002 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
1003 pdb_get_workstations(sampass));
1004
1005 if (need_update(sampass, PDB_MUNGEDDIAL))
1006 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1007 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL),
1008 pdb_get_munged_dial(sampass));
1009
1010 if (need_update(sampass, PDB_SMBHOME))
1011 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1012 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
1013 pdb_get_homedir(sampass));
1014
1015 if (need_update(sampass, PDB_DRIVE))
1016 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1017 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
1018 pdb_get_dir_drive(sampass));
1019
1020 if (need_update(sampass, PDB_LOGONSCRIPT))
1021 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1022 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT),
1023 pdb_get_logon_script(sampass));
1024
1025 if (need_update(sampass, PDB_PROFILE))
1026 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1027 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
1028 pdb_get_profile_path(sampass));
1029
1030 slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logon_time(sampass));
1031 if (need_update(sampass, PDB_LOGONTIME))
1032 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1033 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
1034
1035 slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logoff_time(sampass));
1036 if (need_update(sampass, PDB_LOGOFFTIME))
1037 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1038 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
1039
1040 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_kickoff_time(sampass));
1041 if (need_update(sampass, PDB_KICKOFFTIME))
1042 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1043 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
1044
1045 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_can_change_time(sampass));
1046 if (need_update(sampass, PDB_CANCHANGETIME))
1047 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1048 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
1049
1050 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_must_change_time(sampass));
1051 if (need_update(sampass, PDB_MUSTCHANGETIME))
1052 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1053 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
1054
1055
1056 if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST))
1057 || (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
1058
1059 if (need_update(sampass, PDB_LMPASSWD)) {
1060 const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
1061 if (lm_pw) {
1062 pdb_sethexpwd(temp, lm_pw,
1063 pdb_get_acct_ctrl(sampass));
1064 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1065 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1066 temp);
1067 } else {
1068 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1069 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1070 NULL);
1071 }
1072 }
1073 if (need_update(sampass, PDB_NTPASSWD)) {
1074 const uchar *nt_pw = pdb_get_nt_passwd(sampass);
1075 if (nt_pw) {
1076 pdb_sethexpwd(temp, nt_pw,
1077 pdb_get_acct_ctrl(sampass));
1078 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1079 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1080 temp);
1081 } else {
1082 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1083 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1084 NULL);
1085 }
1086 }
1087
1088 if (need_update(sampass, PDB_PWHISTORY)) {
1089 uint32 pwHistLen = 0;
1090 account_policy_get(AP_PASSWORD_HISTORY, &pwHistLen);
1091 if (pwHistLen == 0) {
1092 /* Remove any password history from the LDAP store. */
1093 memset(temp, '0', 64); /* NOTE !!!! '0' *NOT '\0' */
1094 temp[64] = '\0';
1095 } else {
1096 int i;
1097 uint32 currHistLen = 0;
1098 const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
1099 if (pwhist != NULL) {
1100 /* We can only store (sizeof(pstring)-1)/64 password history entries. */
1101 pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));
1102 for (i=0; i< pwHistLen && i < currHistLen; i++) {
1103 /* Store the salt. */
1104 pdb_sethexpwd(&temp[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN], 0);
1105 /* Followed by the md5 hash of salt + md4 hash */
1106 pdb_sethexpwd(&temp[(i*64)+32],
1107 &pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
1108 DEBUG(100, ("temp=%s\n", temp));
1109 }
1110 }
1111 }
1112 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1113 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
1114 temp);
1115 }
1116
1117 if (need_update(sampass, PDB_PASSLASTSET)) {
1118 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_last_set_time(sampass));
1119 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1120 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
1121 temp);
1122 }
1123 }
1124
1125 if (need_update(sampass, PDB_HOURS)) {
1126 const uint8 *hours = pdb_get_hours(sampass);
1127 if (hours) {
1128 pdb_sethexhours(temp, hours);
1129 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
1130 existing,
1131 mods,
1132 get_userattr_key2string(ldap_state->schema_ver,
1133 LDAP_ATTR_LOGON_HOURS),
1134 temp);
1135 }
1136 }
1137
1138 if (need_update(sampass, PDB_ACCTCTRL))
1139 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1140 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
1141 pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
1142
1143 /* password lockout cache:
1144 - If we are now autolocking or clearing, we write to ldap
1145 - If we are clearing, we delete the cache entry
1146 - If the count is > 0, we update the cache
1147
1148 This even means when autolocking, we cache, just in case the
1149 update doesn't work, and we have to cache the autolock flag */
1150
1151 if (need_update(sampass, PDB_BAD_PASSWORD_COUNT)) /* &&
1152 need_update(sampass, PDB_BAD_PASSWORD_TIME)) */ {
1153 uint16 badcount = pdb_get_bad_password_count(sampass);
1154 time_t badtime = pdb_get_bad_password_time(sampass);
1155 uint32 pol;
1156 account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &pol);
1157
1158 DEBUG(3, ("updating bad password fields, policy=%u, count=%u, time=%u\n",
1159 (unsigned int)pol, (unsigned int)badcount, (unsigned int)badtime));
1160
1161 if ((badcount >= pol) || (badcount == 0)) {
1162 DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
1163 (unsigned int)badcount, (unsigned int)badtime));
1164 slprintf (temp, sizeof (temp) - 1, "%li", (long)badcount);
1165 smbldap_make_mod(
1166 ldap_state->smbldap_state->ldap_struct,
1167 existing, mods,
1168 get_userattr_key2string(
1169 ldap_state->schema_ver,
1170 LDAP_ATTR_BAD_PASSWORD_COUNT),
1171 temp);
1172
1173 slprintf (temp, sizeof (temp) - 1, "%li", badtime);
1174 smbldap_make_mod(
1175 ldap_state->smbldap_state->ldap_struct,
1176 existing, mods,
1177 get_userattr_key2string(
1178 ldap_state->schema_ver,
1179 LDAP_ATTR_BAD_PASSWORD_TIME),
1180 temp);
1181 }
1182 if (badcount == 0) {
1183 DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
1184 login_cache_delentry(sampass);
1185 } else {
1186 LOGIN_CACHE cache_entry;
1187
1188 cache_entry.entry_timestamp = time(NULL);
1189 cache_entry.acct_ctrl = pdb_get_acct_ctrl(sampass);
1190 cache_entry.bad_password_count = badcount;
1191 cache_entry.bad_password_time = badtime;
1192
1193 DEBUG(7, ("Updating bad password count and time in login cache\n"));
1194 login_cache_write(sampass, cache_entry);
1195 }
1196 }
1197
1198 return True;
1199 }
1200
1201 /**********************************************************************
1202 Connect to LDAP server for password enumeration.
1203 *********************************************************************/
1204
1205 static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update, uint16 acb_mask)
1206 {
1207 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1208 int rc;
1209 pstring filter, suffix;
1210 const char **attr_list;
1211 BOOL machine_mask = False, user_mask = False;
1212
1213 pstr_sprintf( filter, "(&%s%s)", lp_ldap_filter(),
1214 get_objclass_filter(ldap_state->schema_ver));
1215 all_string_sub(filter, "%u", "*", sizeof(pstring));
1216
1217 machine_mask = ((acb_mask != 0) && (acb_mask & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)));
1218 user_mask = ((acb_mask != 0) && (acb_mask & ACB_NORMAL));
1219
1220 if (machine_mask) {
1221 pstrcpy(suffix, lp_ldap_machine_suffix());
1222 } else if (user_mask) {
1223 pstrcpy(suffix, lp_ldap_user_suffix());
1224 } else {
1225 pstrcpy(suffix, lp_ldap_suffix());
1226 }
1227
1228 DEBUG(10,("ldapsam_setsampwent: LDAP Query for acb_mask 0x%x will use suffix %s\n",
1229 acb_mask, suffix));
1230
1231 attr_list = get_userattr_list(ldap_state->schema_ver);
1232 rc = smbldap_search(ldap_state->smbldap_state, suffix, LDAP_SCOPE_SUBTREE, filter,
1233 attr_list, 0, &ldap_state->result);
1234 free_attr_list( attr_list );
1235
1236 if (rc != LDAP_SUCCESS) {
1237 DEBUG(0, ("ldapsam_setsampwent: LDAP search failed: %s\n", ldap_err2string(rc)));
1238 DEBUG(3, ("ldapsam_setsampwent: Query was: %s, %s\n", suffix, filter));
1239 ldap_msgfree(ldap_state->result);
1240 ldap_state->result = NULL;
1241 return NT_STATUS_UNSUCCESSFUL;
1242 }
1243
1244 DEBUG(2, ("ldapsam_setsampwent: %d entries in the base %s\n",
1245 ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
1246 ldap_state->result), suffix));
1247
1248 ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
1249 ldap_state->result);
1250 ldap_state->index = 0;
1251
1252 return NT_STATUS_OK;
1253 }
1254
1255 /**********************************************************************
1256 End enumeration of the LDAP password list.
1257 *********************************************************************/
1258
1259 static void ldapsam_endsampwent(struct pdb_methods *my_methods)
1260 {
1261 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1262 if (ldap_state->result) {
1263 ldap_msgfree(ldap_state->result);
1264 ldap_state->result = NULL;
1265 }
1266 }
1267
1268 /**********************************************************************
1269 Get the next entry in the LDAP password database.
1270 *********************************************************************/
1271
1272 static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT *user)
1273 {
1274 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1275 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1276 BOOL bret = False;
1277
1278 while (!bret) {
1279 if (!ldap_state->entry)
1280 return ret;
1281
1282 ldap_state->index++;
1283 bret = init_sam_from_ldap(ldap_state, user, ldap_state->entry);
1284
1285 ldap_state->entry = ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
1286 ldap_state->entry);
1287 }
1288
1289 return NT_STATUS_OK;
1290 }
1291
1292 static void append_attr(const char ***attr_list, const char *new_attr)
1293 {
1294 int i;
1295
1296 if (new_attr == NULL) {
1297 return;
1298 }
1299
1300 for (i=0; (*attr_list)[i] != NULL; i++) {
1301 ;
1302 }
1303
1304 (*attr_list) = SMB_REALLOC_ARRAY((*attr_list), const char *, i+2);
1305 SMB_ASSERT((*attr_list) != NULL);
1306 (*attr_list)[i] = SMB_STRDUP(new_attr);
1307 (*attr_list)[i+1] = NULL;
1308 }
1309
1310 /**********************************************************************
1311 Get SAM_ACCOUNT entry from LDAP by username.
1312 *********************************************************************/
1313
1314 static NTSTATUS ldapsam_getsampwnam(struct pdb_methods *my_methods, SAM_ACCOUNT *user, const char *sname)
1315 {
1316 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1317 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1318 LDAPMessage *result = NULL;
1319 LDAPMessage *entry = NULL;
1320 int count;
1321 const char ** attr_list;
1322 int rc;
1323
1324 attr_list = get_userattr_list( ldap_state->schema_ver );
1325 append_attr(&attr_list, get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP));
1326 rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result, attr_list);
1327 free_attr_list( attr_list );
1328
1329 if ( rc != LDAP_SUCCESS )
1330 return NT_STATUS_NO_SUCH_USER;
1331
1332 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1333
1334 if (count < 1) {
1335 DEBUG(4, ("ldapsam_getsampwnam: Unable to locate user [%s] count=%d\n", sname, count));
1336 ldap_msgfree(result);
1337 return NT_STATUS_NO_SUCH_USER;
1338 } else if (count > 1) {
1339 DEBUG(1, ("ldapsam_getsampwnam: Duplicate entries for this user [%s] Failing. count=%d\n", sname, count));
1340 ldap_msgfree(result);
1341 return NT_STATUS_NO_SUCH_USER;
1342 }
1343
1344 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1345 if (entry) {
1346 if (!init_sam_from_ldap(ldap_state, user, entry)) {
1347 DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname));
1348 ldap_msgfree(result);
1349 return NT_STATUS_NO_SUCH_USER;
1350 }
1351 pdb_set_backend_private_data(user, result,
1352 private_data_free_fn,
1353 my_methods, PDB_CHANGED);
1354 ret = NT_STATUS_OK;
1355 } else {
1356 ldap_msgfree(result);
1357 }
1358 return ret;
1359 }
1360
1361 static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state,
1362 const DOM_SID *sid, LDAPMessage **result)
1363 {
1364 int rc = -1;
1365 const char ** attr_list;
1366 uint32 rid;
1367
1368 switch ( ldap_state->schema_ver ) {
1369 case SCHEMAVER_SAMBASAMACCOUNT:
1370 attr_list = get_userattr_list(ldap_state->schema_ver);
1371 append_attr(&attr_list, get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP));
1372 rc = ldapsam_search_suffix_by_sid(ldap_state, sid, result, attr_list);
1373 free_attr_list( attr_list );
1374
1375 if ( rc != LDAP_SUCCESS )
1376 return rc;
1377 break;
1378
1379 case SCHEMAVER_SAMBAACCOUNT:
1380 if (!sid_peek_check_rid(&ldap_state->domain_sid, sid, &rid)) {
1381 return rc;
1382 }
1383
1384 attr_list = get_userattr_list(ldap_state->schema_ver);
1385 rc = ldapsam_search_suffix_by_rid(ldap_state, rid, result, attr_list );
1386 free_attr_list( attr_list );
1387
1388 if ( rc != LDAP_SUCCESS )
1389 return rc;
1390 break;
1391 }
1392 return rc;
1393 }
1394
1395 /**********************************************************************
1396 Get SAM_ACCOUNT entry from LDAP by SID.
1397 *********************************************************************/
1398
1399 static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT * user, const DOM_SID *sid)
1400 {
1401 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1402 LDAPMessage *result = NULL;
1403 LDAPMessage *entry = NULL;
1404 int count;
1405 int rc;
1406 fstring sid_string;
1407
1408 rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1409 sid, &result);
1410 if (rc != LDAP_SUCCESS)
1411 return NT_STATUS_NO_SUCH_USER;
1412
1413 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1414
1415 if (count < 1) {
1416 DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string, sid),
1417 count));
1418 ldap_msgfree(result);
1419 return NT_STATUS_NO_SUCH_USER;
1420 } else if (count > 1) {
1421 DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string, sid),
1422 count));
1423 ldap_msgfree(result);
1424 return NT_STATUS_NO_SUCH_USER;
1425 }
1426
1427 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1428 if (!entry) {
1429 ldap_msgfree(result);
1430 return NT_STATUS_NO_SUCH_USER;
1431 }
1432
1433 if (!init_sam_from_ldap(ldap_state, user, entry)) {
1434 DEBUG(1,("ldapsam_getsampwsid: init_sam_from_ldap failed!\n"));
1435 ldap_msgfree(result);
1436 return NT_STATUS_NO_SUCH_USER;
1437 }
1438
1439 pdb_set_backend_private_data(user, result,
1440 private_data_free_fn,
1441 my_methods, PDB_CHANGED);
1442 return NT_STATUS_OK;
1443 }
1444
1445 static BOOL ldapsam_can_pwchange_exop(struct smbldap_state *ldap_state)
1446 {
1447 return smbldap_has_extension(ldap_state, LDAP_EXOP_MODIFY_PASSWD);
1448 }
1449
1450 /********************************************************************
1451 Do the actual modification - also change a plaintext passord if
1452 it it set.
1453 **********************************************************************/
1454
1455 static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods,
1456 SAM_ACCOUNT *newpwd, char *dn,
1457 LDAPMod **mods, int ldap_op,
1458 BOOL (*need_update)(const SAM_ACCOUNT *, enum pdb_elements))
1459 {
1460 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1461 int rc;
1462
1463 if (!my_methods || !newpwd || !dn) {
1464 return NT_STATUS_INVALID_PARAMETER;
1465 }
1466
1467 if (!mods) {
1468 DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
1469 /* may be password change below however */
1470 } else {
1471 switch(ldap_op) {
1472 case LDAP_MOD_ADD:
1473 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1474 "objectclass",
1475 LDAP_OBJ_ACCOUNT);
1476 rc = smbldap_add(ldap_state->smbldap_state,
1477 dn, mods);
1478 break;
1479 case LDAP_MOD_REPLACE:
1480 rc = smbldap_modify(ldap_state->smbldap_state,
1481 dn ,mods);
1482 break;
1483 default:
1484 DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n",
1485 ldap_op));
1486 return NT_STATUS_INVALID_PARAMETER;
1487 }
1488
1489 if (rc!=LDAP_SUCCESS) {
1490 char *ld_error = NULL;
1491 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1492 &ld_error);
1493 DEBUG(1, ("ldapsam_modify_entry: Failed to %s user dn= %s with: %s\n\t%s\n",
1494 ldap_op == LDAP_MOD_ADD ? "add" : "modify",
1495 dn, ldap_err2string(rc),
1496 ld_error?ld_error:"unknown"));
1497 SAFE_FREE(ld_error);
1498 return NT_STATUS_UNSUCCESSFUL;
1499 }
1500 }
1501
1502 if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) &&
1503 (lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) &&
1504 need_update(newpwd, PDB_PLAINTEXT_PW) &&
1505 (pdb_get_plaintext_passwd(newpwd)!=NULL)) {
1506 BerElement *ber;
1507 struct berval *bv;
1508 char *retoid = NULL;
1509 struct berval *retdata = NULL;
1510 char *utf8_password;
1511 char *utf8_dn;
1512
1513 if (!ldap_state->is_nds_ldap) {
1514 if (!ldapsam_can_pwchange_exop(ldap_state->smbldap_state)) {
1515 DEBUG(2, ("ldap password change requested, but LDAP "
1516 "server does not support it -- ignoring\n"));
1517 return NT_STATUS_OK;
1518 }
1519 }
1520
1521 if (push_utf8_allocate(&utf8_password, pdb_get_plaintext_passwd(newpwd)) == (size_t)-1) {
1522 return NT_STATUS_NO_MEMORY;
1523 }
1524
1525 if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) {
1526 return NT_STATUS_NO_MEMORY;
1527 }
1528
1529 if ((ber = ber_alloc_t(LBER_USE_DER))==NULL) {
1530 DEBUG(0,("ber_alloc_t returns NULL\n"));
1531 SAFE_FREE(utf8_password);
1532 return NT_STATUS_UNSUCCESSFUL;
1533 }
1534
1535 ber_printf (ber, "{");
1536 ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, utf8_dn);
1537 ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, utf8_password);
1538 ber_printf (ber, "N}");
1539
1540 if ((rc = ber_flatten (ber, &bv))<0) {
1541 DEBUG(0,("ldapsam_modify_entry: ber_flatten returns a value <0\n"));
1542 ber_free(ber,1);
1543 SAFE_FREE(utf8_dn);
1544 SAFE_FREE(utf8_password);
1545 return NT_STATUS_UNSUCCESSFUL;
1546 }
1547
1548 SAFE_FREE(utf8_dn);
1549 SAFE_FREE(utf8_password);
1550 ber_free(ber, 1);
1551
1552 if (!ldap_state->is_nds_ldap) {
1553 rc = smbldap_extended_operation(ldap_state->smbldap_state,
1554 LDAP_EXOP_MODIFY_PASSWD,
1555 bv, NULL, NULL, &retoid,
1556 &retdata);
1557 } else {
1558 rc = pdb_nds_set_password(ldap_state->smbldap_state, dn,
1559 pdb_get_plaintext_passwd(newpwd));
1560 }
1561 if (rc != LDAP_SUCCESS) {
1562 char *ld_error = NULL;
1563
1564 if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
1565 DEBUG(3, ("Could not set userPassword "
1566 "attribute due to an objectClass "
1567 "violation -- ignoring\n"));
1568 ber_bvfree(bv);
1569 return NT_STATUS_OK;
1570 }
1571
1572 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1573 &ld_error);
1574 DEBUG(0,("ldapsam_modify_entry: LDAP Password could not be changed for user %s: %s\n\t%s\n",
1575 pdb_get_username(newpwd), ldap_err2string(rc), ld_error?ld_error:"unknown"));
1576 SAFE_FREE(ld_error);
1577 ber_bvfree(bv);
1578 return NT_STATUS_UNSUCCESSFUL;
1579 } else {
1580 DEBUG(3,("ldapsam_modify_entry: LDAP Password changed for user %s\n",pdb_get_username(newpwd)));
1581 #ifdef DEBUG_PASSWORD
1582 DEBUG(100,("ldapsam_modify_entry: LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd)));
1583 #endif
1584 if (retdata)
1585 ber_bvfree(retdata);
1586 if (retoid)
1587 ber_memfree(retoid);
1588 }
1589 ber_bvfree(bv);
1590 }
1591 return NT_STATUS_OK;
1592 }
1593
1594 /**********************************************************************
1595 Delete entry from LDAP for username.
1596 *********************************************************************/
1597
1598 static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * sam_acct)
1599 {
1600 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1601 const char *sname;
1602 int rc;
1603 LDAPMessage *result = NULL;
1604 NTSTATUS ret;
1605 const char **attr_list;
1606 fstring objclass;
1607
1608 if (!sam_acct) {
1609 DEBUG(0, ("ldapsam_delete_sam_account: sam_acct was NULL!\n"));
1610 return NT_STATUS_INVALID_PARAMETER;
1611 }
1612
1613 sname = pdb_get_username(sam_acct);
1614
1615 DEBUG (3, ("ldapsam_delete_sam_account: Deleting user %s from LDAP.\n", sname));
1616
1617 attr_list= get_userattr_delete_list( ldap_state->schema_ver );
1618 rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result, attr_list);
1619
1620 if (rc != LDAP_SUCCESS) {
1621 free_attr_list( attr_list );
1622 return NT_STATUS_NO_SUCH_USER;
1623 }
1624
1625 switch ( ldap_state->schema_ver ) {
1626 case SCHEMAVER_SAMBASAMACCOUNT:
1627 fstrcpy( objclass, LDAP_OBJ_SAMBASAMACCOUNT );
1628 break;
1629
1630 case SCHEMAVER_SAMBAACCOUNT:
1631 fstrcpy( objclass, LDAP_OBJ_SAMBAACCOUNT );
1632 break;
1633 default:
1634 fstrcpy( objclass, "UNKNOWN" );
1635 DEBUG(0,("ldapsam_delete_sam_account: Unknown schema version specified!\n"));
1636 break;
1637 }
1638
1639 ret = ldapsam_delete_entry(ldap_state, result, objclass, attr_list );
1640 ldap_msgfree(result);
1641 free_attr_list( attr_list );
1642
1643 return ret;
1644 }
1645
1646 /**********************************************************************
1647 Helper function to determine for update_sam_account whether
1648 we need LDAP modification.
1649 *********************************************************************/
1650
1651 static BOOL element_is_changed(const SAM_ACCOUNT *sampass,
1652 enum pdb_elements element)
1653 {
1654 return IS_SAM_CHANGED(sampass, element);
1655 }
1656
1657 /**********************************************************************
1658 Update SAM_ACCOUNT.
1659 *********************************************************************/
1660
1661 static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd)
1662 {
1663 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1664 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1665 int rc = 0;
1666 char *dn;
1667 LDAPMessage *result = NULL;
1668 LDAPMessage *entry = NULL;
1669 LDAPMod **mods = NULL;
1670 const char **attr_list;
1671
1672 result = pdb_get_backend_private_data(newpwd, my_methods);
1673 if (!result) {
1674 attr_list = get_userattr_list(ldap_state->schema_ver);
1675 rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list );
1676 free_attr_list( attr_list );
1677 if (rc != LDAP_SUCCESS) {
1678 return NT_STATUS_UNSUCCESSFUL;
1679 }
1680 pdb_set_backend_private_data(newpwd, result, private_data_free_fn, my_methods, PDB_CHANGED);
1681 }
1682
1683 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
1684 DEBUG(0, ("ldapsam_update_sam_account: No user to modify!\n"));
1685 return NT_STATUS_UNSUCCESSFUL;
1686 }
1687
1688 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1689 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
1690 if (!dn) {
1691 return NT_STATUS_UNSUCCESSFUL;
1692 }
1693
1694 DEBUG(4, ("ldapsam_update_sam_account: user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn));
1695
1696 if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
1697 element_is_changed)) {
1698 DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
1699 SAFE_FREE(dn);
1700 if (mods != NULL)
1701 ldap_mods_free(mods,True);
1702 return NT_STATUS_UNSUCCESSFUL;
1703 }
1704
1705 if (mods == NULL) {
1706 DEBUG(4,("ldapsam_update_sam_account: mods is empty: nothing to update for user: %s\n",
1707 pdb_get_username(newpwd)));
1708 SAFE_FREE(dn);
1709 return NT_STATUS_OK;
1710 }
1711
1712 ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed);
1713 ldap_mods_free(mods,True);
1714 SAFE_FREE(dn);
1715
1716 if (!NT_STATUS_IS_OK(ret)) {
1717 char *ld_error = NULL;
1718 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1719 &ld_error);
1720 DEBUG(0,("ldapsam_update_sam_account: failed to modify user with uid = %s, error: %s (%s)\n",
1721 pdb_get_username(newpwd), ld_error?ld_error:"(unknwon)", ldap_err2string(rc)));
1722 SAFE_FREE(ld_error);
1723 return ret;
1724 }
1725
1726 DEBUG(2, ("ldapsam_update_sam_account: successfully modified uid = %s in the LDAP database\n",
1727 pdb_get_username(newpwd)));
1728 return NT_STATUS_OK;
1729 }
1730
1731 /**********************************************************************
1732 Helper function to determine for update_sam_account whether
1733 we need LDAP modification.
1734 *********************************************************************/
1735
1736 static BOOL element_is_set_or_changed(const SAM_ACCOUNT *sampass,
1737 enum pdb_elements element)
1738 {
1739 return (IS_SAM_SET(sampass, element) ||
1740 IS_SAM_CHANGED(sampass, element));
1741 }
1742
1743 /**********************************************************************
1744 Add SAM_ACCOUNT to LDAP.
1745 *********************************************************************/
1746
1747 static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd)
1748 {
1749 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1750 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1751 int rc;
1752 LDAPMessage *result = NULL;
1753 LDAPMessage *entry = NULL;
1754 pstring dn;
1755 LDAPMod **mods = NULL;
1756 int ldap_op = LDAP_MOD_REPLACE;
1757 uint32 num_result;
1758 const char **attr_list;
1759 char *escape_user;
1760 const char *username = pdb_get_username(newpwd);
1761 const DOM_SID *sid = pdb_get_user_sid(newpwd);
1762 pstring filter;
1763 fstring sid_string;
1764
1765 if (!username || !*username) {
1766 DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
1767 return NT_STATUS_INVALID_PARAMETER;
1768 }
1769
1770 /* free this list after the second search or in case we exit on failure */
1771 attr_list = get_userattr_list(ldap_state->schema_ver);
1772
1773 rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
1774
1775 if (rc != LDAP_SUCCESS) {
1776 free_attr_list( attr_list );
1777 return NT_STATUS_UNSUCCESSFUL;
1778 }
1779
1780 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
1781 DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
1782 username));
1783 ldap_msgfree(result);
1784 free_attr_list( attr_list );
1785 return NT_STATUS_UNSUCCESSFUL;
1786 }
1787 ldap_msgfree(result);
1788 result = NULL;
1789
1790 if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
1791 rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1792 sid, &result);
1793 if (rc == LDAP_SUCCESS) {
1794 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
1795 DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n",
1796 sid_to_string(sid_string, sid)));
1797 free_attr_list( attr_list );
1798 ldap_msgfree(result);
1799 return NT_STATUS_UNSUCCESSFUL;
1800 }
1801 ldap_msgfree(result);
1802 }
1803 }
1804
1805 /* does the entry already exist but without a samba attributes?
1806 we need to return the samba attributes here */
1807
1808 escape_user = escape_ldap_string_alloc( username );
1809 pstrcpy( filter, lp_ldap_filter() );
1810 all_string_sub( filter, "%u", escape_user, sizeof(filter) );
1811 SAFE_FREE( escape_user );
1812
1813 rc = smbldap_search_suffix(ldap_state->smbldap_state,
1814 filter, attr_list, &result);
1815 if ( rc != LDAP_SUCCESS ) {
1816 free_attr_list( attr_list );
1817 return NT_STATUS_UNSUCCESSFUL;
1818 }
1819
1820 num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1821
1822 if (num_result > 1) {
1823 DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
1824 free_attr_list( attr_list );
1825 ldap_msgfree(result);
1826 return NT_STATUS_UNSUCCESSFUL;
1827 }
1828
1829 /* Check if we need to update an existing entry */
1830 if (num_result == 1) {
1831 char *tmp;
1832
1833 DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
1834 ldap_op = LDAP_MOD_REPLACE;
1835 entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
1836 tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
1837 if (!tmp) {
1838 free_attr_list( attr_list );
1839 ldap_msgfree(result);
1840 return NT_STATUS_UNSUCCESSFUL;
1841 }
1842 slprintf (dn, sizeof (dn) - 1, "%s", tmp);
1843 SAFE_FREE(tmp);
1844
1845 } else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
1846
1847 /* There might be a SID for this account already - say an idmap entry */
1848
1849 pstr_sprintf(filter, "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))",
1850 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
1851 sid_to_string(sid_string, sid),
1852 LDAP_OBJ_IDMAP_ENTRY,
1853 LDAP_OBJ_SID_ENTRY);
1854
1855 /* free old result before doing a new search */
1856 if (result != NULL) {
1857 ldap_msgfree(result);
1858 result = NULL;
1859 }
1860 rc = smbldap_search_suffix(ldap_state->smbldap_state,
1861 filter, attr_list, &result);
1862
1863 if ( rc != LDAP_SUCCESS ) {
1864 free_attr_list( attr_list );
1865 return NT_STATUS_UNSUCCESSFUL;
1866 }
1867
1868 num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1869
1870 if (num_result > 1) {
1871 DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
1872 free_attr_list( attr_list );
1873 ldap_msgfree(result);
1874 return NT_STATUS_UNSUCCESSFUL;
1875 }
1876
1877 /* Check if we need to update an existing entry */
1878 if (num_result == 1) {
1879 char *tmp;
1880
1881 DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
1882 ldap_op = LDAP_MOD_REPLACE;
1883 entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
1884 tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
1885 if (!tmp) {
1886 free_attr_list( attr_list );
1887 ldap_msgfree(result);
1888 return NT_STATUS_UNSUCCESSFUL;
1889 }
1890 slprintf (dn, sizeof (dn) - 1, "%s", tmp);
1891 SAFE_FREE(tmp);
1892 }
1893 }
1894
1895 free_attr_list( attr_list );
1896
1897 if (num_result == 0) {
1898 /* Check if we need to add an entry */
1899 DEBUG(3,("ldapsam_add_sam_account: Adding new user\n"));
1900 ldap_op = LDAP_MOD_ADD;
1901 if (username[strlen(username)-1] == '$') {
1902 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_machine_suffix ());
1903 } else {
1904 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_user_suffix ());
1905 }
1906 }
1907
1908 if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
1909 element_is_set_or_changed)) {
1910 DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
1911 ldap_msgfree(result);
1912 if (mods != NULL)
1913 ldap_mods_free(mods,True);
1914 return NT_STATUS_UNSUCCESSFUL;
1915 }
1916
1917 ldap_msgfree(result);
1918
1919 if (mods == NULL) {
1920 DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
1921 return NT_STATUS_UNSUCCESSFUL;
1922 }
1923 switch ( ldap_state->schema_ver ) {
1924 case SCHEMAVER_SAMBAACCOUNT:
1925 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT);
1926 break;
1927 case SCHEMAVER_SAMBASAMACCOUNT:
1928 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT);
1929 break;
1930 default:
1931 DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n"));
1932 break;
1933 }
1934
1935 ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed);
1936 if (!NT_STATUS_IS_OK(ret)) {
1937 DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
1938 pdb_get_username(newpwd),dn));
1939 ldap_mods_free(mods, True);
1940 return ret;
1941 }
1942
1943 DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
1944 ldap_mods_free(mods, True);
1945
1946 return NT_STATUS_OK;
1947 }
1948
1949 /**********************************************************************
1950 *********************************************************************/
1951
1952 static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
1953 const char *filter,
1954 LDAPMessage ** result)
1955 {
1956 int scope = LDAP_SCOPE_SUBTREE;
1957 int rc;
1958 const char **attr_list;
1959
1960 attr_list = get_attr_list(groupmap_attr_list);
1961 rc = smbldap_search(ldap_state->smbldap_state,
1962 lp_ldap_group_suffix (), scope,
1963 filter, attr_list, 0, result);
1964 free_attr_list( attr_list );
1965
1966 if (rc != LDAP_SUCCESS) {
1967 char *ld_error = NULL;
1968 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1969 &ld_error);
1970 DEBUG(0, ("ldapsam_search_one_group: "
1971 "Problem during the LDAP search: LDAP error: %s (%s)\n",
1972 ld_error?ld_error:"(unknown)", ldap_err2string(rc)));
1973 DEBUGADD(3, ("ldapsam_search_one_group: Query was: %s, %s\n",
1974 lp_ldap_group_suffix(), filter));
1975 SAFE_FREE(ld_error);
1976 }
1977
1978 return rc;
1979 }
1980
1981 /**********************************************************************
1982 *********************************************************************/
1983
1984 static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state,
1985 GROUP_MAP *map, LDAPMessage *entry)
1986 {
1987 pstring temp;
1988
1989 if (ldap_state == NULL || map == NULL || entry == NULL ||
1990 ldap_state->smbldap_state->ldap_struct == NULL) {
1991 DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
1992 return False;
1993 }
1994
1995 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
1996 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp)) {
1997 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
1998 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
1999 return False;
2000 }
2001 DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
2002
2003 map->gid = (gid_t)atol(temp);
2004
2005 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2006 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp)) {
2007 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2008 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
2009 return False;
2010 }
2011
2012 if (!string_to_sid(&map->sid, temp)) {
2013 DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
2014 return False;
2015 }
2016
2017 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2018 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) {
2019 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2020 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
2021 return False;
2022 }
2023 map->sid_name_use = (enum SID_NAME_USE)atol(temp);
2024
2025 if ((map->sid_name_use < SID_NAME_USER) ||
2026 (map->sid_name_use > SID_NAME_UNKNOWN)) {
2027 DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
2028 return False;
2029 }
2030
2031 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2032 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp)) {
2033 temp[0] = '\0';
2034 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2035 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp))
2036 {
2037 DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
2038 for gidNumber(%lu)\n",(unsigned long)map->gid));
2039 return False;
2040 }
2041 }
2042 fstrcpy(map->nt_name, temp);
2043
2044 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2045 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp)) {
2046 temp[0] = '\0';
2047 }
2048 fstrcpy(map->comment, temp);
2049
2050 return True;
2051 }
2052
2053 /**********************************************************************
2054 *********************************************************************/
2055
2056 static BOOL init_ldap_from_group(LDAP *ldap_struct,
2057 LDAPMessage *existing,
2058 LDAPMod ***mods,
2059 const GROUP_MAP *map)
2060 {
2061 pstring tmp;
2062
2063 if (mods == NULL || map == NULL) {
2064 DEBUG(0, ("init_ldap_from_group: NULL parameters found!\n"));
2065 return False;
2066 }
2067
2068 *mods = NULL;
2069
2070 sid_to_string(tmp, &map->sid);
2071
2072 smbldap_make_mod(ldap_struct, existing, mods,
2073 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID), tmp);
2074 pstr_sprintf(tmp, "%i", map->sid_name_use);
2075 smbldap_make_mod(ldap_struct, existing, mods,
2076 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), tmp);
2077
2078 smbldap_make_mod(ldap_struct, existing, mods,
2079 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), map->nt_name);
2080 smbldap_make_mod(ldap_struct, existing, mods,
2081 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), map->comment);
2082
2083 return True;
2084 }
2085
2086 /**********************************************************************
2087 *********************************************************************/
2088
2089 static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods,
2090 const char *filter,
2091 GROUP_MAP *map)
2092 {
2093 struct ldapsam_privates *ldap_state =
2094 (struct ldapsam_privates *)methods->private_data;
2095 LDAPMessage *result = NULL;
2096 LDAPMessage *entry = NULL;
2097 int count;
2098
2099 if (ldapsam_search_one_group(ldap_state, filter, &result)
2100 != LDAP_SUCCESS) {
2101 return NT_STATUS_NO_SUCH_GROUP;
2102 }
2103
2104 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2105
2106 if (count < 1) {
2107 DEBUG(4, ("ldapsam_getgroup: Did not find group\n"));
2108 ldap_msgfree(result);
2109 return NT_STATUS_NO_SUCH_GROUP;
2110 }
2111
2112 if (count > 1) {
2113 DEBUG(1, ("ldapsam_getgroup: Duplicate entries for filter %s: count=%d\n",
2114 filter, count));
2115 ldap_msgfree(result);
2116 return NT_STATUS_NO_SUCH_GROUP;
2117 }
2118
2119 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
2120
2121 if (!entry) {
2122 ldap_msgfree(result);
2123 return NT_STATUS_UNSUCCESSFUL;
2124 }
2125
2126 if (!init_group_from_ldap(ldap_state, map, entry)) {
2127 DEBUG(1, ("ldapsam_getgroup: init_group_from_ldap failed for group filter %s\n",
2128 filter));
2129 ldap_msgfree(result);
2130 return NT_STATUS_NO_SUCH_GROUP;
2131 }
2132
2133 ldap_msgfree(result);
2134 return NT_STATUS_OK;
2135 }
2136
2137 /**********************************************************************
2138 *********************************************************************/
2139
2140 static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
2141 DOM_SID sid)
2142 {
2143 pstring filter;
2144
2145 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
2146 LDAP_OBJ_GROUPMAP,
2147 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
2148 sid_string_static(&sid));
2149
2150 return ldapsam_getgroup(methods, filter, map);
2151 }
2152
2153 /**********************************************************************
2154 *********************************************************************/
2155
2156 static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
2157 gid_t gid)
2158 {
2159 pstring filter;
2160
2161 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%d))",
2162 LDAP_OBJ_GROUPMAP,
2163 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2164 gid);
2165
2166 return ldapsam_getgroup(methods, filter, map);
2167 }
2168
2169 /**********************************************************************
2170 *********************************************************************/
2171
2172 static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
2173 const char *name)
2174 {
2175 pstring filter;
2176 char *escape_name = escape_ldap_string_alloc(name);
2177
2178 if (!escape_name) {
2179 return NT_STATUS_NO_MEMORY;
2180 }
2181
2182 pstr_sprintf(filter, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
2183 LDAP_OBJ_GROUPMAP,
2184 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
2185 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), escape_name);
2186
2187 SAFE_FREE(escape_name);
2188
2189 return ldapsam_getgroup(methods, filter, map);
2190 }
2191
2192 static void add_rid_to_array_unique(TALLOC_CTX *mem_ctx,
2193 uint32 rid, uint32 **rids, int *num)
2194 {
2195 int i;
2196
2197 for (i=0; i<*num; i++) {
2198 if ((*rids)[i] == rid)
2199 return;
2200 }
2201
2202 *rids = TALLOC_REALLOC_ARRAY(mem_ctx, *rids, uint32, *num+1);
2203
2204 if (*rids == NULL)
2205 return;
2206
2207 (*rids)[*num] = rid;
2208 *num += 1;
2209 }
2210
2211 static BOOL ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
2212 LDAPMessage *entry,
2213 const DOM_SID *domain_sid,
2214 uint32 *rid)
2215 {
2216 fstring str;
2217 DOM_SID sid;
2218
2219 if (!smbldap_get_single_attribute(ldap_struct, entry, "sambaSID",
2220 str, sizeof(str)-1)) {
2221 DEBUG(10, ("Could not find sambaSID attribute\n"));
2222 return False;
2223 }
2224
2225 if (!string_to_sid(&sid, str)) {
2226 DEBUG(10, ("Could not convert string %s to sid\n", str));
2227 return False;
2228 }
2229
2230 if (sid_compare_domain(&sid, domain_sid) != 0) {
2231 DEBUG(10, ("SID %s is not in expected domain %s\n",
2232 str, sid_string_static(domain_sid)));
2233 return False;
2234 }
2235
2236 if (!sid_peek_rid(&sid, rid)) {
2237 DEBUG(10, ("Could not peek into RID\n"));
2238 return False;
2239 }
2240
2241 return True;
2242 }
2243
2244 static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
2245 TALLOC_CTX *mem_ctx,
2246 const DOM_SID *group,
2247 uint32 **member_rids,
2248 int *num_members)
2249 {
2250 struct ldapsam_privates *ldap_state =
2251 (struct ldapsam_privates *)methods->private_data;
2252 struct smbldap_state *conn = ldap_state->smbldap_state;
2253 pstring filter;
2254 int rc, count;
2255 LDAPMessage *msg = NULL;
2256 LDAPMessage *entry;
2257 char **values = NULL;
2258 char **memberuid;
2259 char *sid_filter = NULL;
2260 char *tmp;
2261 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2262
2263 if (!lp_parm_bool(-1, "ldapsam", "trusted", False))
2264 return pdb_default_enum_group_members(methods, mem_ctx, group,
2265 member_rids,
2266 num_members);
2267
2268 *member_rids = NULL;
2269 *num_members = 0;
2270
2271 pstr_sprintf(filter,
2272 "(&(objectClass=sambaSamAccount)"
2273 "(sambaPrimaryGroupSid=%s))",
2274 sid_string_static(group));
2275
2276 {
2277 const char *attrs[] = { "sambaSID", NULL };
2278 rc = smbldap_search(conn, lp_ldap_user_suffix(),
2279 LDAP_SCOPE_SUBTREE, filter, attrs, 0,
2280 &msg);
2281 }
2282
2283 if (rc != LDAP_SUCCESS)
2284 goto done;
2285
2286 for (entry = ldap_first_entry(conn->ldap_struct, msg);
2287 entry != NULL;
2288 entry = ldap_next_entry(conn->ldap_struct, entry))
2289 {
2290 uint32 rid;
2291
2292 if (!ldapsam_extract_rid_from_entry(conn->ldap_struct,
2293 entry,
2294 get_global_sam_sid(),
2295 &rid)) {
2296 DEBUG(2, ("Could not find sid from ldap entry\n"));
2297 continue;
2298 }
2299
2300 add_rid_to_array_unique(mem_ctx, rid, member_rids,
2301 num_members);
2302 }
2303
2304 if (msg != NULL)
2305 ldap_msgfree(msg);
2306
2307 pstr_sprintf(filter,
2308 "(&(objectClass=sambaGroupMapping)"
2309 "(objectClass=posixGroup)"
2310 "(sambaSID=%s))",
2311 sid_string_static(group));
2312
2313 {
2314 const char *attrs[] = { "memberUid", NULL };
2315 rc = smbldap_search(conn, lp_ldap_group_suffix(),
2316 LDAP_SCOPE_SUBTREE, filter, attrs, 0,
2317 &msg);
2318 }
2319
2320 if (rc != LDAP_SUCCESS)
2321 goto done;
2322
2323 count = ldap_count_entries(conn->ldap_struct, msg);
2324
2325 if (count > 1) {
2326 DEBUG(1, ("Found more than one groupmap entry for %s\n",
2327 sid_string_static(group)));
2328 goto done;
2329 }
2330
2331 if (count == 0) {
2332 result = NT_STATUS_OK;
2333 goto done;
2334 }
2335
2336 entry = ldap_first_entry(conn->ldap_struct, msg);
2337 if (entry == NULL)
2338 goto done;
2339
2340 values = ldap_get_values(conn->ldap_struct, msg, "memberUid");
2341 if (values == NULL) {
2342 result = NT_STATUS_OK;
2343 goto done;
2344 }
2345
2346 sid_filter = strdup("(&(objectClass=sambaSamAccount)(|");
2347 if (sid_filter == NULL) {
2348 result = NT_STATUS_NO_MEMORY;
2349 goto done;
2350 }
2351
2352 for (memberuid = values; *memberuid != NULL; memberuid += 1) {
2353 tmp = sid_filter;
2354 asprintf(&sid_filter, "%s(uid=%s)", tmp, *memberuid);
2355 free(tmp);
2356 if (sid_filter == NULL) {
2357 result = NT_STATUS_NO_MEMORY;
2358 goto done;
2359 }
2360 }
2361
2362 tmp = sid_filter;
2363 asprintf(&sid_filter, "%s))", sid_filter);
2364 free(tmp);
2365 if (sid_filter == NULL) {
2366 result = NT_STATUS_NO_MEMORY;
2367 goto done;
2368 }
2369
2370 {
2371 const char *attrs[] = { "sambaSID", NULL };
2372 rc = smbldap_search(conn, lp_ldap_user_suffix(),
2373 LDAP_SCOPE_SUBTREE, sid_filter, attrs, 0,
2374 &msg);
2375 }
2376
2377 if (rc != LDAP_SUCCESS)
2378 goto done;
2379
2380 for (entry = ldap_first_entry(conn->ldap_struct, msg);
2381 entry != NULL;
2382 entry = ldap_next_entry(conn->ldap_struct, entry))
2383 {
2384 fstring str;
2385 DOM_SID sid;
2386 uint32 rid;
2387
2388 if (!smbldap_get_single_attribute(conn->ldap_struct,
2389 entry, "sambaSID",
2390 str, sizeof(str)-1))
2391 continue;
2392
2393 if (!string_to_sid(&sid, str))
2394 goto done;
2395
2396 if (!sid_check_is_in_our_domain(&sid)) {
2397 DEBUG(1, ("Inconsistent SAM -- group member uid not "
2398 "in our domain\n"));
2399 continue;
2400 }
2401
2402 sid_peek_rid(&sid, &rid);
2403
2404 add_rid_to_array_unique(mem_ctx, rid, member_rids,
2405 num_members);
2406 }
2407
2408 result = NT_STATUS_OK;
2409
2410 done:
2411 SAFE_FREE(sid_filter);
2412
2413 if (values != NULL)
2414 ldap_value_free(values);
2415
2416 if (msg != NULL)
2417 ldap_msgfree(msg);
2418
2419 return result;
2420 }
2421
2422 static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
2423 const char *username,
2424 gid_t primary_gid,
2425 DOM_SID **sids, gid_t **gids,
2426 int *num_groups)
2427 {
2428 struct ldapsam_privates *ldap_state =
2429 (struct ldapsam_privates *)methods->private_data;
2430 struct smbldap_state *conn = ldap_state->smbldap_state;
2431 pstring filter;
2432 const char *attrs[] = { "gidNumber", "sambaSID", NULL };
2433 char *escape_name;
2434 int rc;
2435 LDAPMessage *msg = NULL;
2436 LDAPMessage *entry;
2437 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2438 int num_sids, num_gids;
2439
2440 if (!lp_parm_bool(-1, "ldapsam", "trusted", False))
2441 return pdb_default_enum_group_memberships(methods, username,
2442 primary_gid, sids,
2443 gids, num_groups);
2444
2445 *sids = NULL;
2446 num_sids = 0;
2447
2448 escape_name = escape_ldap_string_alloc(username);
2449
2450 if (escape_name == NULL)
2451 return NT_STATUS_NO_MEMORY;
2452
2453 pstr_sprintf(filter, "(&(objectClass=posixGroup)"
2454 "(|(memberUid=%s)(gidNumber=%d)))",
2455 username, primary_gid);
2456
2457 rc = smbldap_search(conn, lp_ldap_group_suffix(),
2458 LDAP_SCOPE_SUBTREE, filter, attrs, 0, &msg);
2459
2460 if (rc != LDAP_SUCCESS)
2461 goto done;
2462
2463 num_gids = 0;
2464 *gids = NULL;
2465
2466 num_sids = 0;
2467 *sids = NULL;
2468
2469 /* We need to add the primary group as the first gid/sid */
2470
2471 add_gid_to_array_unique(NULL, primary_gid, gids, &num_gids);
2472
2473 /* This sid will be replaced later */
2474
2475 add_sid_to_array_unique(NULL, &global_sid_NULL, sids, &num_sids);
2476
2477 for (entry = ldap_first_entry(conn->ldap_struct, msg);
2478 entry != NULL;
2479 entry = ldap_next_entry(conn->ldap_struct, entry))
2480 {
2481 fstring str;
2482 DOM_SID sid;
2483 gid_t gid;
2484 char *end;
2485
2486 if (!smbldap_get_single_attribute(conn->ldap_struct,
2487 entry, "sambaSID",
2488 str, sizeof(str)-1))
2489 continue;
2490
2491 if (!string_to_sid(&sid, str))
2492 goto done;
2493
2494 if (!smbldap_get_single_attribute(conn->ldap_struct,
2495 entry, "gidNumber",
2496 str, sizeof(str)-1))
2497 continue;
2498
2499 gid = strtoul(str, &end, 10);
2500
2501 if (PTR_DIFF(end, str) != strlen(str))
2502 goto done;
2503
2504 if (gid == primary_gid) {
2505 sid_copy(&(*sids)[0], &sid);
2506 } else {
2507 add_gid_to_array_unique(NULL, gid, gids, &num_gids);
2508 add_sid_to_array_unique(NULL, &sid, sids, &num_sids);
2509 }
2510 }
2511
2512 if (sid_compare(&global_sid_NULL, &(*sids)[0]) == 0) {
2513 DEBUG(3, ("primary group of [%s] not found\n", username));
2514 goto done;
2515 }
2516
2517 *num_groups = num_sids;
2518
2519 result = NT_STATUS_OK;
2520
2521 done:
2522
2523 SAFE_FREE(escape_name);
2524 if (msg != NULL)
2525 ldap_msgfree(msg);
2526
2527 return result;
2528 }
2529
2530 /**********************************************************************
2531 *********************************************************************/
2532
2533 static int ldapsam_search_one_group_by_gid(struct ldapsam_privates *ldap_state,
2534 gid_t gid,
2535 LDAPMessage **result)
2536 {
2537 pstring filter;
2538
2539 pstr_sprintf(filter, "(&(|(objectClass=%s)(objectclass=%s))(%s=%d))",
2540 LDAP_OBJ_POSIXGROUP, LDAP_OBJ_IDMAP_ENTRY,
2541 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2542 gid);
2543
2544 return ldapsam_search_one_group(ldap_state, filter, result);
2545 }
2546
2547 /**********************************************************************
2548 *********************************************************************/
2549
2550 static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
2551 GROUP_MAP *map)
2552 {
2553 struct ldapsam_privates *ldap_state =
2554 (struct ldapsam_privates *)methods->private_data;
2555 LDAPMessage *result = NULL;
2556 LDAPMod **mods = NULL;
2557 int count;
2558
2559 char *tmp;
2560 pstring dn;
2561 LDAPMessage *entry;
2562
2563 GROUP_MAP dummy;
2564
2565 int rc;
2566
2567 if (NT_STATUS_IS_OK(ldapsam_getgrgid(methods, &dummy,
2568 map->gid))) {
2569 DEBUG(0, ("ldapsam_add_group_mapping_entry: Group %ld already exists in LDAP\n", (unsigned long)map->gid));
2570 return NT_STATUS_UNSUCCESSFUL;
2571 }
2572
2573 rc = ldapsam_search_one_group_by_gid(ldap_state, map->gid, &result);
2574 if (rc != LDAP_SUCCESS) {
2575 ldap_msgfree(result);
2576 return NT_STATUS_UNSUCCESSFUL;
2577 }
2578
2579 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2580
2581 if ( count == 0 ) {
2582 /* There's no posixGroup account, let's try to find an
2583 * appropriate idmap entry for aliases */
2584
2585 pstring suffix;
2586 pstring filter;
2587 const char **attr_list;
2588
2589 ldap_msgfree(result);
2590
2591 pstrcpy( suffix, lp_ldap_idmap_suffix() );
2592 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%d))",
2593 LDAP_OBJ_IDMAP_ENTRY, LDAP_ATTRIBUTE_GIDNUMBER,
2594 map->gid);
2595
2596 attr_list = get_attr_list( sidmap_attr_list );
2597 rc = smbldap_search(ldap_state->smbldap_state, suffix,
2598 LDAP_SCOPE_SUBTREE, filter, attr_list,
2599 0, &result);
2600
2601 free_attr_list(attr_list);
2602
2603 if (rc != LDAP_SUCCESS) {
2604 DEBUG(3,("Failure looking up entry (%s)\n",
2605 ldap_err2string(rc) ));
2606 ldap_msgfree(result);
2607 return NT_STATUS_UNSUCCESSFUL;
2608 }
2609 }
2610
2611 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2612 if ( count == 0 ) {
2613 ldap_msgfree(result);
2614 return NT_STATUS_UNSUCCESSFUL;
2615 }
2616
2617 if (count > 1) {
2618 DEBUG(2, ("ldapsam_add_group_mapping_entry: Group %lu must exist exactly once in LDAP\n",
2619 (unsigned long)map->gid));
2620 ldap_msgfree(result);
2621 return NT_STATUS_UNSUCCESSFUL;
2622 }
2623
2624 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
2625 tmp = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
2626 if (!tmp) {
2627 ldap_msgfree(result);
2628 return NT_STATUS_UNSUCCESSFUL;
2629 }
2630 pstrcpy(dn, tmp);
2631 SAFE_FREE(tmp);
2632
2633 if (!init_ldap_from_group(ldap_state->smbldap_state->ldap_struct,
2634 result, &mods, map)) {
2635 DEBUG(0, ("ldapsam_add_group_mapping_entry: init_ldap_from_group failed!\n"));
2636 ldap_mods_free(mods, True);
2637 ldap_msgfree(result);
2638 return NT_STATUS_UNSUCCESSFUL;
2639 }
2640
2641 ldap_msgfree(result);
2642
2643 if (mods == NULL) {
2644 DEBUG(0, ("ldapsam_add_group_mapping_entry: mods is empty\n"));
2645 return NT_STATUS_UNSUCCESSFUL;
2646 }
2647
2648 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP );
2649
2650 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2651 ldap_mods_free(mods, True);
2652
2653 if (rc != LDAP_SUCCESS) {
2654 char *ld_error = NULL;
2655 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
2656 &ld_error);
2657 DEBUG(0, ("ldapsam_add_group_mapping_entry: failed to add group %lu error: %s (%s)\n", (unsigned long)map->gid,
2658 ld_error ? ld_error : "(unknown)", ldap_err2string(rc)));
2659 SAFE_FREE(ld_error);
2660 return NT_STATUS_UNSUCCESSFUL;
2661 }
2662
2663 DEBUG(2, ("ldapsam_add_group_mapping_entry: successfully modified group %lu in LDAP\n", (unsigned long)map->gid));
2664 return NT_STATUS_OK;
2665 }
2666
2667 /**********************************************************************
2668 *********************************************************************/
2669
2670 static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods,
2671 GROUP_MAP *map)
2672 {
2673 struct ldapsam_privates *ldap_state =
2674 (struct ldapsam_privates *)methods->private_data;
2675 int rc;
2676 char *dn = NULL;
2677 LDAPMessage *result = NULL;
2678 LDAPMessage *entry = NULL;
2679 LDAPMod **mods = NULL;
2680
2681 rc = ldapsam_search_one_group_by_gid(ldap_state, map->gid, &result);
2682
2683 if (rc != LDAP_SUCCESS) {
2684 return NT_STATUS_UNSUCCESSFUL;
2685 }
2686
2687 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
2688 DEBUG(0, ("ldapsam_update_group_mapping_entry: No group to modify!\n"));
2689 ldap_msgfree(result);
2690 return NT_STATUS_UNSUCCESSFUL;
2691 }
2692
2693 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
2694
2695 if (!init_ldap_from_group(ldap_state->smbldap_state->ldap_struct,
2696 result, &mods, map)) {
2697 DEBUG(0, ("ldapsam_update_group_mapping_entry: init_ldap_from_group failed\n"));
2698 ldap_msgfree(result);
2699 if (mods != NULL)
2700 ldap_mods_free(mods,True);
2701 return NT_STATUS_UNSUCCESSFUL;
2702 }
2703
2704 if (mods == NULL) {
2705 DEBUG(4, ("ldapsam_update_group_mapping_entry: mods is empty: nothing to do\n"));
2706 ldap_msgfree(result);
2707 return NT_STATUS_OK;
2708 }
2709
2710 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
2711 if (!dn) {
2712 ldap_msgfree(result);
2713 return NT_STATUS_UNSUCCESSFUL;
2714 }
2715 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2716 SAFE_FREE(dn);
2717
2718 ldap_mods_free(mods, True);
2719 ldap_msgfree(result);
2720
2721 if (rc != LDAP_SUCCESS) {
2722 char *ld_error = NULL;
2723 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
2724 &ld_error);
2725 DEBUG(0, ("ldapsam_update_group_mapping_entry: failed to modify group %lu error: %s (%s)\n", (unsigned long)map->gid,
2726 ld_error ? ld_error : "(unknown)", ldap_err2string(rc)));
2727 SAFE_FREE(ld_error);
2728 return NT_STATUS_UNSUCCESSFUL;
2729 }
2730
2731 DEBUG(2, ("ldapsam_update_group_mapping_entry: successfully modified group %lu in LDAP\n", (unsigned long)map->gid));
2732 return NT_STATUS_OK;
2733 }
2734
2735 /**********************************************************************
2736 *********************************************************************/
2737
2738 static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods,
2739 DOM_SID sid)
2740 {
2741 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)methods->private_data;
2742 pstring sidstring, filter;
2743 LDAPMessage *result = NULL;
2744 int rc;
2745 NTSTATUS ret;
2746 const char **attr_list;
2747
2748 sid_to_string(sidstring, &sid);
2749
2750 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
2751 LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID, sidstring);
2752
2753 rc = ldapsam_search_one_group(ldap_state, filter, &result);
2754
2755 if (rc != LDAP_SUCCESS) {
2756 return NT_STATUS_NO_SUCH_GROUP;
2757 }
2758
2759 attr_list = get_attr_list( groupmap_attr_list_to_delete );
2760 ret = ldapsam_delete_entry(ldap_state, result, LDAP_OBJ_GROUPMAP, attr_list);
2761 free_attr_list ( attr_list );
2762
2763 ldap_msgfree(result);
2764
2765 return ret;
2766 }
2767
2768 /**********************************************************************
2769 *********************************************************************/
2770
2771 static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods, BOOL update)
2772 {
2773 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2774 fstring filter;
2775 int rc;
2776 const char **attr_list;
2777
2778 pstr_sprintf( filter, "(objectclass=%s)", LDAP_OBJ_GROUPMAP);
2779 attr_list = get_attr_list( groupmap_attr_list );
2780 rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
2781 LDAP_SCOPE_SUBTREE, filter,
2782 attr_list, 0, &ldap_state->result);
2783 free_attr_list( attr_list );
2784
2785 if (rc != LDAP_SUCCESS) {
2786 DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n", ldap_err2string(rc)));
2787 DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n", lp_ldap_group_suffix(), filter));
2788 ldap_msgfree(ldap_state->result);
2789 ldap_state->result = NULL;
2790 return NT_STATUS_UNSUCCESSFUL;
2791 }
2792
2793 DEBUG(2, ("ldapsam_setsamgrent: %d entries in the base!\n",
2794 ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
2795 ldap_state->result)));
2796
2797 ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, ldap_state->result);
2798 ldap_state->index = 0;
2799
2800 return NT_STATUS_OK;
2801 }
2802
2803 /**********************************************************************
2804 *********************************************************************/
2805
2806 static void ldapsam_endsamgrent(struct pdb_methods *my_methods)
2807 {
2808 ldapsam_endsampwent(my_methods);
2809 }
2810
2811 /**********************************************************************
2812 *********************************************************************/
2813
2814 static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods,
2815 GROUP_MAP *map)
2816 {
2817 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2818 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2819 BOOL bret = False;
2820
2821 while (!bret) {
2822 if (!ldap_state->entry)
2823 return ret;
2824
2825 ldap_state->index++;
2826 bret = init_group_from_ldap(ldap_state, map, ldap_state->entry);
2827
2828 ldap_state->entry = ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
2829 ldap_state->entry);
2830 }
2831
2832 return NT_STATUS_OK;
2833 }
2834
2835 /**********************************************************************
2836 *********************************************************************/
2837
2838 static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
2839 enum SID_NAME_USE sid_name_use,
2840 GROUP_MAP **rmap, int *num_entries,
2841 BOOL unix_only)
2842 {
2843 GROUP_MAP map;
2844 GROUP_MAP *mapt;
2845 int entries = 0;
2846
2847 *num_entries = 0;
2848 *rmap = NULL;
2849
2850 if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods, False))) {
2851 DEBUG(0, ("ldapsam_enum_group_mapping: Unable to open passdb\n"));
2852 return NT_STATUS_ACCESS_DENIED;
2853 }
2854
2855 while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) {
2856 if (sid_name_use != SID_NAME_UNKNOWN &&
2857 sid_name_use != map.sid_name_use) {
2858 DEBUG(11,("ldapsam_enum_group_mapping: group %s is not of the requested type\n", map.nt_name));
2859 continue;
2860 }
2861 if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
2862 DEBUG(11,("ldapsam_enum_group_mapping: group %s is non mapped\n", map.nt_name));
2863 continue;
2864 }
2865
2866 mapt=SMB_REALLOC_ARRAY((*rmap), GROUP_MAP, entries+1);
2867 if (!mapt) {
2868 DEBUG(0,("ldapsam_enum_group_mapping: Unable to enlarge group map!\n"));
2869 SAFE_FREE(*rmap);
2870 return NT_STATUS_UNSUCCESSFUL;
2871 }
2872 else
2873 (*rmap) = mapt;
2874
2875 mapt[entries] = map;
2876
2877 entries += 1;
2878
2879 }
2880 ldapsam_endsamgrent(methods);
2881
2882 *num_entries = entries;
2883
2884 return NT_STATUS_OK;
2885 }
2886
2887 static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
2888 const DOM_SID *alias,
2889 const DOM_SID *member,
2890 int modop)
2891 {
2892 struct ldapsam_privates *ldap_state =
2893 (struct ldapsam_privates *)methods->private_data;
2894 char *dn;
2895 LDAPMessage *result = NULL;
2896 LDAPMessage *entry = NULL;
2897 int count;
2898 LDAPMod **mods = NULL;
2899 int rc;
2900
2901 pstring filter;
2902
2903 pstr_sprintf(filter, "(&(|(objectClass=%s)(objectclass=%s))(%s=%s))",
2904 LDAP_OBJ_GROUPMAP, LDAP_OBJ_IDMAP_ENTRY,
2905 get_attr_key2string(groupmap_attr_list,
2906 LDAP_ATTR_GROUP_SID),
2907 sid_string_static(alias));
2908
2909 if (ldapsam_search_one_group(ldap_state, filter,
2910 &result) != LDAP_SUCCESS)
2911 return NT_STATUS_NO_SUCH_ALIAS;
2912
2913 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
2914 result);
2915
2916 if (count < 1) {
2917 DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
2918 ldap_msgfree(result);
2919 return NT_STATUS_NO_SUCH_ALIAS;
2920 }
2921
2922 if (count > 1) {
2923 DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for filter %s: "
2924 "count=%d\n", filter, count));
2925 ldap_msgfree(result);
2926 return NT_STATUS_NO_SUCH_ALIAS;
2927 }
2928
2929 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
2930 result);
2931
2932 if (!entry) {
2933 ldap_msgfree(result);
2934 return NT_STATUS_UNSUCCESSFUL;
2935 }
2936
2937 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
2938 if (!dn) {
2939 ldap_msgfree(result);
2940 return NT_STATUS_UNSUCCESSFUL;
2941 }
2942
2943 smbldap_set_mod(&mods, modop,
2944 get_attr_key2string(groupmap_attr_list,
2945 LDAP_ATTR_SID_LIST),
2946 sid_string_static(member));
2947
2948 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2949
2950 ldap_mods_free(mods, True);
2951 ldap_msgfree(result);
2952
2953 if (rc != LDAP_SUCCESS) {
2954 char *ld_error = NULL;
2955 ldap_get_option(ldap_state->smbldap_state->ldap_struct,
2956 LDAP_OPT_ERROR_STRING,&ld_error);
2957
2958 DEBUG(0, ("ldapsam_modify_aliasmem: Could not modify alias "
2959 "for %s, error: %s (%s)\n", dn, ldap_err2string(rc),
2960 ld_error?ld_error:"unknown"));
2961 SAFE_FREE(ld_error);
2962 SAFE_FREE(dn);
2963 return NT_STATUS_UNSUCCESSFUL;
2964 }
2965
2966 SAFE_FREE(dn);
2967
2968 return NT_STATUS_OK;
2969 }
2970
2971 static NTSTATUS ldapsam_add_aliasmem(struct pdb_methods *methods,
2972 const DOM_SID *alias,
2973 const DOM_SID *member)
2974 {
2975 return ldapsam_modify_aliasmem(methods, alias, member, LDAP_MOD_ADD);
2976 }
2977
2978 static NTSTATUS ldapsam_del_aliasmem(struct pdb_methods *methods,
2979 const DOM_SID *alias,
2980 const DOM_SID *member)
2981 {
2982 return ldapsam_modify_aliasmem(methods, alias, member,
2983 LDAP_MOD_DELETE);
2984 }
2985
2986 static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
2987 const DOM_SID *alias, DOM_SID **members,
2988 int *num_members)
2989 {
2990 struct ldapsam_privates *ldap_state =
2991 (struct ldapsam_privates *)methods->private_data;
2992 LDAPMessage *result = NULL;
2993 LDAPMessage *entry = NULL;
2994 int count;
2995 char **values;
2996 int i;
2997 pstring filter;
2998
2999 *members = NULL;
3000 *num_members = 0;
3001
3002 pstr_sprintf(filter, "(&(|(objectClass=%s)(objectclass=%s))(%s=%s))",
3003 LDAP_OBJ_GROUPMAP, LDAP_OBJ_IDMAP_ENTRY,
3004 get_attr_key2string(groupmap_attr_list,
3005 LDAP_ATTR_GROUP_SID),
3006 sid_string_static(alias));
3007
3008 if (ldapsam_search_one_group(ldap_state, filter,
3009 &result) != LDAP_SUCCESS)
3010 return NT_STATUS_NO_SUCH_ALIAS;
3011
3012 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3013 result);
3014
3015 if (count < 1) {
3016 DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
3017 ldap_msgfree(result);
3018 return NT_STATUS_NO_SUCH_ALIAS;
3019 }
3020
3021 if (count > 1) {
3022 DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for filter %s: "
3023 "count=%d\n", filter, count));
3024 ldap_msgfree(result);
3025 return NT_STATUS_NO_SUCH_ALIAS;
3026 }
3027
3028 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3029 result);
3030
3031 if (!entry) {
3032 ldap_msgfree(result);
3033 return NT_STATUS_UNSUCCESSFUL;
3034 }
3035
3036 values = ldap_get_values(ldap_state->smbldap_state->ldap_struct,
3037 entry,
3038 get_attr_key2string(groupmap_attr_list,
3039 LDAP_ATTR_SID_LIST));
3040
3041 if (values == NULL) {
3042 ldap_msgfree(result);
3043 return NT_STATUS_OK;
3044 }
3045
3046 count = ldap_count_values(values);
3047
3048 for (i=0; i<count; i++) {
3049 DOM_SID member;
3050
3051 if (!string_to_sid(&member, values[i]))
3052 continue;
3053
3054 add_sid_to_array(NULL, &member, members, num_members);
3055 }
3056
3057 ldap_value_free(values);
3058 ldap_msgfree(result);
3059
3060 return NT_STATUS_OK;
3061 }
3062
3063 static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
3064 TALLOC_CTX *mem_ctx,
3065 const DOM_SID *domain_sid,
3066 const DOM_SID *members,
3067 int num_members,
3068 uint32 **alias_rids,
3069 int *num_alias_rids)
3070 {
3071 struct ldapsam_privates *ldap_state =
3072 (struct ldapsam_privates *)methods->private_data;
3073 LDAP *ldap_struct;
3074
3075 const char *attrs[] = { LDAP_ATTRIBUTE_SID, NULL };
3076
3077 LDAPMessage *result = NULL;
3078 LDAPMessage *entry = NULL;
3079 int i;
3080 int rc;
3081 char *filter;
3082
3083 /* This query could be further optimized by adding a
3084 (&(sambaSID=<domain-sid>*)) so that only those aliases that are
3085 asked for in the getuseraliases are returned. */
3086
3087 filter = talloc_asprintf(mem_ctx,
3088 "(&(|(objectclass=%s)(objectclass=%s))(|",
3089 LDAP_OBJ_GROUPMAP, LDAP_OBJ_IDMAP_ENTRY);
3090
3091 for (i=0; i<num_members; i++)
3092 filter = talloc_asprintf(mem_ctx, "%s(sambaSIDList=%s)",
3093 filter,
3094 sid_string_static(&members[i]));
3095
3096 filter = talloc_asprintf(mem_ctx, "%s))", filter);
3097
3098 rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
3099 LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
3100
3101 talloc_destroy(mem_ctx);
3102
3103 if (rc != LDAP_SUCCESS)
3104 return NT_STATUS_UNSUCCESSFUL;
3105
3106 ldap_struct = ldap_state->smbldap_state->ldap_struct;
3107
3108 for (entry = ldap_first_entry(ldap_struct, result);
3109 entry != NULL;
3110 entry = ldap_next_entry(ldap_struct, entry))
3111 {
3112 fstring sid_str;
3113 DOM_SID sid;
3114 uint32 rid;
3115
3116 if (!smbldap_get_single_attribute(ldap_struct, entry,
3117 LDAP_ATTRIBUTE_SID,
3118 sid_str,
3119 sizeof(sid_str)-1))
3120 continue;
3121
3122 if (!string_to_sid(&sid, sid_str))
3123 continue;
3124
3125 if (!sid_peek_check_rid(domain_sid, &sid, &rid))
3126 continue;
3127
3128 add_rid_to_array_unique(mem_ctx, rid, alias_rids,
3129 num_alias_rids);
3130 }
3131
3132 ldap_msgfree(result);
3133 return NT_STATUS_OK;
3134 }
3135
3136 static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
3137 TALLOC_CTX *mem_ctx,
3138 const DOM_SID *domain_sid,
3139 int num_rids,
3140 uint32 *rids,
3141 const char ***names,
3142 uint32 **attrs)
3143 {
3144 struct ldapsam_privates *ldap_state =
3145 (struct ldapsam_privates *)methods->private_data;
3146 LDAP *ldap_struct = ldap_state->smbldap_state->ldap_struct;
3147 LDAPMessage *msg = NULL;
3148 LDAPMessage *entry;
3149 char *allsids = NULL;
3150 char *tmp;
3151 int i, rc, num_mapped;
3152 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
3153
3154 if (!lp_parm_bool(-1, "ldapsam", "trusted", False))
3155 return pdb_default_lookup_rids(methods, mem_ctx, domain_sid,
3156 num_rids, rids, names, attrs);
3157
3158 if (!sid_equal(domain_sid, get_global_sam_sid())) {
3159 /* TODO: Sooner or later we need to look up BUILTIN rids as
3160 * well. -- vl */
3161 goto done;
3162 }
3163
3164 (*names) = TALLOC_ZERO_ARRAY(mem_ctx, const char *, num_rids);
3165 (*attrs) = TALLOC_ARRAY(mem_ctx, uint32, num_rids);
3166
3167 if ((num_rids != 0) && (((*names) == NULL) || ((*attrs) == NULL)))
3168 return NT_STATUS_NO_MEMORY;
3169
3170 for (i=0; i<num_rids; i++)
3171 (*attrs)[i] = SID_NAME_UNKNOWN;
3172
3173 allsids = strdup("");
3174 if (allsids == NULL) return NT_STATUS_NO_MEMORY;
3175
3176 for (i=0; i<num_rids; i++) {
3177 DOM_SID sid;
3178 sid_copy(&sid, domain_sid);
3179 sid_append_rid(&sid, rids[i]);
3180 tmp = allsids;
3181 asprintf(&allsids, "%s(sambaSid=%s)", allsids,
3182 sid_string_static(&sid));
3183 if (allsids == NULL) return NT_STATUS_NO_MEMORY;
3184 free(tmp);
3185 }
3186
3187 /* First look for users */
3188
3189 {
3190 char *filter;
3191 const char *ldap_attrs[] = { "uid", "sambaSid", NULL };
3192
3193 asprintf(&filter, ("(&(objectClass=sambaSamAccount)(|%s))"),
3194 allsids);
3195 if (filter == NULL) return NT_STATUS_NO_MEMORY;
3196
3197 rc = smbldap_search(ldap_state->smbldap_state,
3198 lp_ldap_user_suffix(),
3199 LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
3200 &msg);
3201
3202 SAFE_FREE(filter);
3203 }
3204
3205 if (rc != LDAP_SUCCESS)
3206 goto done;
3207
3208 num_mapped = 0;
3209
3210 for (entry = ldap_first_entry(ldap_struct, msg);
3211 entry != NULL;
3212 entry = ldap_next_entry(ldap_struct, entry))
3213 {
3214 uint32 rid;
3215 int rid_index;
3216 fstring str;
3217
3218 if (!ldapsam_extract_rid_from_entry(ldap_struct, entry,
3219 get_global_sam_sid(),
3220 &rid)) {
3221 DEBUG(2, ("Could not find sid from ldap entry\n"));
3222 continue;
3223 }
3224
3225 if (!smbldap_get_single_attribute(ldap_struct, entry,
3226 "uid", str, sizeof(str)-1)) {
3227 DEBUG(2, ("Could not retrieve uid attribute\n"));
3228 continue;
3229 }
3230
3231 for (rid_index = 0; rid_index < num_rids; rid_index++) {
3232 if (rid == rids[rid_index])
3233 break;
3234 }
3235
3236 if (rid_index == num_rids) {
3237 DEBUG(2, ("Got a RID not asked for: %d\n", rid));
3238 continue;
3239 }
3240
3241 (*attrs)[rid_index] = SID_NAME_USER;
3242 (*names)[rid_index] = talloc_strdup(mem_ctx, str);
3243 if ((*names)[rid_index] == NULL) return NT_STATUS_NO_MEMORY;
3244
3245 num_mapped += 1;
3246 }
3247
3248 if (num_mapped == num_rids) {
3249 /* No need to look for groups anymore -- we're done */
3250 result = NT_STATUS_OK;
3251 goto done;
3252 }
3253
3254 /* Same game for groups */
3255
3256 {
3257 char *filter;
3258 const char *ldap_attrs[] = { "cn", "sambaSid", NULL };
3259
3260 asprintf(&filter, ("(&(objectClass=sambaGroupMapping)(|%s))"),
3261 allsids);
3262 if (filter == NULL) return NT_STATUS_NO_MEMORY;
3263
3264 rc = smbldap_search(ldap_state->smbldap_state,
3265 lp_ldap_group_suffix(),
3266 LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
3267 &msg);
3268
3269 SAFE_FREE(filter);
3270 }
3271
3272 if (rc != LDAP_SUCCESS)
3273 goto done;
3274
3275 for (entry = ldap_first_entry(ldap_struct, msg);
3276 entry != NULL;
3277 entry = ldap_next_entry(ldap_struct, entry))
3278 {
3279 uint32 rid;
3280 int rid_index;
3281 fstring str;
3282
3283 if (!ldapsam_extract_rid_from_entry(ldap_struct, entry,
3284 get_global_sam_sid(),
3285 &rid)) {
3286 DEBUG(2, ("Could not find sid from ldap entry\n"));
3287 continue;
3288 }
3289
3290 if (!smbldap_get_single_attribute(ldap_struct, entry,
3291 "cn", str, sizeof(str)-1)) {
3292 DEBUG(2, ("Could not retrieve cn attribute\n"));
3293 continue;
3294 }
3295
3296 for (rid_index = 0; rid_index < num_rids; rid_index++) {
3297 if (rid == rids[rid_index])
3298 break;
3299 }
3300
3301 if (rid_index == num_rids) {
3302 DEBUG(2, ("Got a RID not asked for: %d\n", rid));
3303 continue;
3304 }
3305
3306 (*attrs)[rid_index] = SID_NAME_DOM_GRP;
3307 (*names)[rid_index] = talloc_strdup(mem_ctx, str);
3308 if ((*names)[rid_index] == NULL) return NT_STATUS_NO_MEMORY;
3309 num_mapped += 1;
3310 }
3311
3312 result = NT_STATUS_NONE_MAPPED;
3313
3314 if (num_mapped > 0)
3315 result = (num_mapped == num_rids) ?
3316 NT_STATUS_OK : STATUS_SOME_UNMAPPED;
3317 done:
3318 SAFE_FREE(allsids);
3319
3320 if (msg != NULL)
3321 ldap_msgfree(msg);
3322
3323 return result;
3324 }
3325
3326 /**********************************************************************
3327 Housekeeping
3328 *********************************************************************/
3329
3330 static void free_private_data(void **vp)
3331 {
3332 struct ldapsam_privates **ldap_state = (struct ldapsam_privates **)vp;
3333
3334 smbldap_free_struct(&(*ldap_state)->smbldap_state);
3335
3336 if ((*ldap_state)->result != NULL) {
3337 ldap_msgfree((*ldap_state)->result);
3338 (*ldap_state)->result = NULL;
3339 }
3340 if ((*ldap_state)->domain_dn != NULL) {
3341 SAFE_FREE((*ldap_state)->domain_dn);
3342 }
3343
3344 *ldap_state = NULL;
3345
3346 /* No need to free any further, as it is talloc()ed */
3347 }
3348
3349 /**********************************************************************
3350 Intitalise the parts of the pdb_context that are common to all pdb_ldap modes
3351 *********************************************************************/
3352
3353 static NTSTATUS pdb_init_ldapsam_common(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method,
3354 const char *location)
3355 {
3356 NTSTATUS nt_status;
3357 struct ldapsam_privates *ldap_state;
3358
3359 if (!NT_STATUS_IS_OK(nt_status = make_pdb_methods(pdb_context->mem_ctx, pdb_method))) {
3360 return nt_status;
3361 }
3362
3363 (*pdb_method)->name = "ldapsam";
3364
3365 (*pdb_method)->setsampwent = ldapsam_setsampwent;
3366 (*pdb_method)->endsampwent = ldapsam_endsampwent;
3367 (*pdb_method)->getsampwent = ldapsam_getsampwent;
3368 (*pdb_method)->getsampwnam = ldapsam_getsampwnam;
3369 (*pdb_method)->getsampwsid = ldapsam_getsampwsid;
3370 (*pdb_method)->add_sam_account = ldapsam_add_sam_account;
3371 (*pdb_method)->update_sam_account = ldapsam_update_sam_account;
3372 (*pdb_method)->delete_sam_account = ldapsam_delete_sam_account;
3373
3374 (*pdb_method)->getgrsid = ldapsam_getgrsid;
3375 (*pdb_method)->getgrgid = ldapsam_getgrgid;
3376 (*pdb_method)->getgrnam = ldapsam_getgrnam;
3377 (*pdb_method)->add_group_mapping_entry = ldapsam_add_group_mapping_entry;
3378 (*pdb_method)->update_group_mapping_entry = ldapsam_update_group_mapping_entry;
3379 (*pdb_method)->delete_group_mapping_entry = ldapsam_delete_group_mapping_entry;
3380 (*pdb_method)->enum_group_mapping = ldapsam_enum_group_mapping;
3381 (*pdb_method)->enum_group_members = ldapsam_enum_group_members;
3382 (*pdb_method)->enum_group_memberships = ldapsam_enum_group_memberships;
3383 (*pdb_method)->lookup_rids = ldapsam_lookup_rids;
3384
3385 /* TODO: Setup private data and free */
3386
3387 ldap_state = TALLOC_ZERO_P(pdb_context->mem_ctx, struct ldapsam_privates);
3388 if (!ldap_state) {
3389 DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
3390 return NT_STATUS_NO_MEMORY;
3391 }
3392
3393 if (!NT_STATUS_IS_OK(nt_status =
3394 smbldap_init(pdb_context->mem_ctx, location,
3395 &ldap_state->smbldap_state)));
3396
3397 ldap_state->domain_name = talloc_strdup(pdb_context->mem_ctx, get_global_sam_name());
3398 if (!ldap_state->domain_name) {
3399 return NT_STATUS_NO_MEMORY;
3400 }
3401
3402 (*pdb_method)->private_data = ldap_state;
3403
3404 (*pdb_method)->free_private_data = free_private_data;
3405
3406 return NT_STATUS_OK;
3407 }
3408
3409 /**********************************************************************
3410 Initialise the 'compat' mode for pdb_ldap
3411 *********************************************************************/
3412
3413 NTSTATUS pdb_init_ldapsam_compat(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location)
3414 {
3415 NTSTATUS nt_status;
3416 struct ldapsam_privates *ldap_state;
3417
3418 #ifdef WITH_LDAP_SAMCONFIG
3419 if (!location) {
3420 int ldap_port = lp_ldap_port();
3421
3422 /* remap default port if not using SSL (ie clear or TLS) */
3423 if ( (lp_ldap_ssl() != LDAP_SSL_ON) && (ldap_port == 636) ) {
3424 ldap_port = 389;
3425 }
3426
3427 location = talloc_asprintf(pdb_context->mem_ctx, "%s://%s:%d", lp_ldap_ssl() == LDAP_SSL_ON ? "ldaps" : "ldap", lp_ldap_server(), ldap_port);
3428 if (!location) {
3429 return NT_STATUS_NO_MEMORY;
3430 }
3431 }
3432 #endif
3433
3434 if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) {
3435 return nt_status;
3436 }
3437
3438 (*pdb_method)->name = "ldapsam_compat";
3439
3440 ldap_state = (*pdb_method)->private_data;
3441 ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT;
3442
3443 sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
3444
3445 return NT_STATUS_OK;
3446 }
3447
3448 /**********************************************************************
3449 Initialise the normal mode for pdb_ldap
3450 *********************************************************************/
3451
3452 NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location)
3453 {
3454 NTSTATUS nt_status;
3455 struct ldapsam_privates *ldap_state;
3456 uint32 alg_rid_base;
3457 pstring alg_rid_base_string;
3458 LDAPMessage *result = NULL;
3459 LDAPMessage *entry = NULL;
3460 DOM_SID ldap_domain_sid;
3461 DOM_SID secrets_domain_sid;
3462 pstring domain_sid_string;
3463 char *dn;
3464
3465 if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) {
3466 return nt_status;
3467 }
3468
3469 (*pdb_method)->name = "ldapsam";
3470
3471 (*pdb_method)->add_aliasmem = ldapsam_add_aliasmem;
3472 (*pdb_method)->del_aliasmem = ldapsam_del_aliasmem;
3473 (*pdb_method)->enum_aliasmem = ldapsam_enum_aliasmem;
3474 (*pdb_method)->enum_alias_memberships = ldapsam_alias_memberships;
3475
3476 ldap_state = (*pdb_method)->private_data;
3477 ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
3478
3479 /* Try to setup the Domain Name, Domain SID, algorithmic rid base */
3480
3481 nt_status = smbldap_search_domain_info(ldap_state->smbldap_state, &result,
3482 ldap_state->domain_name, True);
3483
3484 if ( !NT_STATUS_IS_OK(nt_status) ) {
3485 DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain info, nor add one to the domain\n"));
3486 DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, will be unable to allocate new users/groups, \
3487 and will risk BDCs having inconsistant SIDs\n"));
3488 sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
3489 return NT_STATUS_OK;
3490 }
3491
3492 /* Given that the above might fail, everything below this must be optional */
3493
3494 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
3495 if (!entry) {
3496 DEBUG(0, ("pdb_init_ldapsam: Could not get domain info entry\n"));
3497 ldap_msgfree(result);
3498 return NT_STATUS_UNSUCCESSFUL;
3499 }
3500
3501 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
3502 if (!dn) {
3503 return NT_STATUS_UNSUCCESSFUL;
3504 }
3505
3506 ldap_state->domain_dn = smb_xstrdup(dn);
3507 ldap_memfree(dn);
3508
3509 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
3510 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
3511 domain_sid_string)) {
3512 BOOL found_sid;
3513 if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
3514 DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be read as a valid SID\n", domain_sid_string));
3515 return NT_STATUS_INVALID_PARAMETER;
3516 }
3517 found_sid = secrets_fetch_domain_sid(ldap_state->domain_name, &secrets_domain_sid);
3518 if (!found_sid || !sid_equal(&secrets_domain_sid, &ldap_domain_sid)) {
3519 fstring new_sid_str, old_sid_str;
3520 DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain %s based on pdb_ldap results %s -> %s\n",
3521 ldap_state->domain_name,
3522 sid_to_string(old_sid_str, &secrets_domain_sid),
3523 sid_to_string(new_sid_str, &ldap_domain_sid)));
3524
3525 /* reset secrets.tdb sid */
3526 secrets_store_domain_sid(ldap_state->domain_name, &ldap_domain_sid);
3527 DEBUG(1, ("New global sam SID: %s\n", sid_to_string(new_sid_str, get_global_sam_sid())));
3528 }
3529 sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
3530 }
3531
3532 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
3533 get_attr_key2string( dominfo_attr_list, LDAP_ATTR_ALGORITHMIC_RID_BASE ),
3534 alg_rid_base_string)) {
3535 alg_rid_base = (uint32)atol(alg_rid_base_string);
3536 if (alg_rid_base != algorithmic_rid_base()) {
3537 DEBUG(0, ("The value of 'algorithmic RID base' has changed since the LDAP\n"
3538 "database was initialised. Aborting. \n"));
3539 ldap_msgfree(result);
3540 return NT_STATUS_UNSUCCESSFUL;
3541 }
3542 }
3543 ldap_msgfree(result);
3544
3545 return NT_STATUS_OK;
3546 }
3547
3548 NTSTATUS pdb_ldap_init(void)
3549 {
3550 NTSTATUS nt_status;
3551 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam)))
3552 return nt_status;
3553
3554 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_compat", pdb_init_ldapsam_compat)))
3555 return nt_status;
3556
3557 /* Let pdb_nds register backends */
3558 pdb_nds_init();
3559
3560 return NT_STATUS_OK;
3561 }
Samba GIT mirror