2 Unix SMB/CIFS implementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean François Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002-2003
8 Copyright (C) Stefan (metze) Metzmacher 2002-2003
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 * persistent connections: if using NSS LDAP, many connections are made
28 * however, using only one within Samba would be nice
30 * Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
32 * Other LDAP based login attributes: accountExpires, etc.
33 * (should be the domain of Samba proper, but the sam_password/SAM_ACCOUNT
34 * structures don't have fields for some of these attributes)
36 * SSL is done, but can't get the certificate based authentication to work
37 * against on my test platform (Linux 2.4, OpenLDAP 2.x)
40 /* NOTE: this will NOT work against an Active Directory server
41 * due to the fact that the two password fields cannot be retrieved
42 * from a server; recommend using security = domain in this situation
49 #define DBGC_CLASS DBGC_PASSDB
55 * Work around versions of the LDAP client libs that don't have the OIDs
56 * defined, or have them defined under the old name.
57 * This functionality is really a factor of the server, not the client
61 #if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD)
62 #define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD
63 #elif !defined(LDAP_EXOP_MODIFY_PASSWD)
64 #define LDAP_EXOP_MODIFY_PASSWD "1.3.6.1.4.1.4203.1.11.1"
67 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
68 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID
69 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
70 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID ((ber_tag_t) 0x80U)
73 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
74 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW
75 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
76 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ((ber_tag_t) 0x82U)
81 #define SAM_ACCOUNT struct sam_passwd
86 /**********************************************************************
87 Free a LDAPMessage (one is stored on the SAM_ACCOUNT).
88 **********************************************************************/
90 void private_data_free_fn(void **result
)
92 ldap_msgfree(*result
);
96 /**********************************************************************
97 Get the attribute name given a user schame version.
98 **********************************************************************/
100 static const char* get_userattr_key2string( int schema_ver
, int key
)
102 switch ( schema_ver
) {
103 case SCHEMAVER_SAMBAACCOUNT
:
104 return get_attr_key2string( attrib_map_v22
, key
);
106 case SCHEMAVER_SAMBASAMACCOUNT
:
107 return get_attr_key2string( attrib_map_v30
, key
);
110 DEBUG(0,("get_userattr_key2string: unknown schema version specified\n"));
116 /**********************************************************************
117 Return the list of attribute names given a user schema version.
118 **********************************************************************/
120 const char** get_userattr_list( int schema_ver
)
122 switch ( schema_ver
) {
123 case SCHEMAVER_SAMBAACCOUNT
:
124 return get_attr_list( attrib_map_v22
);
126 case SCHEMAVER_SAMBASAMACCOUNT
:
127 return get_attr_list( attrib_map_v30
);
129 DEBUG(0,("get_userattr_list: unknown schema version specified!\n"));
136 /**************************************************************************
137 Return the list of attribute names to delete given a user schema version.
138 **************************************************************************/
140 static const char** get_userattr_delete_list( int schema_ver
)
142 switch ( schema_ver
) {
143 case SCHEMAVER_SAMBAACCOUNT
:
144 return get_attr_list( attrib_map_to_delete_v22
);
146 case SCHEMAVER_SAMBASAMACCOUNT
:
147 return get_attr_list( attrib_map_to_delete_v30
);
149 DEBUG(0,("get_userattr_delete_list: unknown schema version specified!\n"));
157 /*******************************************************************
158 Generate the LDAP search filter for the objectclass based on the
159 version of the schema we are using.
160 ******************************************************************/
162 static const char* get_objclass_filter( int schema_ver
)
164 static fstring objclass_filter
;
166 switch( schema_ver
) {
167 case SCHEMAVER_SAMBAACCOUNT
:
168 fstr_sprintf( objclass_filter
, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT
);
170 case SCHEMAVER_SAMBASAMACCOUNT
:
171 fstr_sprintf( objclass_filter
, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT
);
174 DEBUG(0,("get_objclass_filter: Invalid schema version specified!\n"));
178 return objclass_filter
;
181 /*******************************************************************
182 Run the search by name.
183 ******************************************************************/
185 int ldapsam_search_suffix_by_name(struct ldapsam_privates
*ldap_state
,
187 LDAPMessage
** result
,
191 char *escape_user
= escape_ldap_string_alloc(user
);
194 return LDAP_NO_MEMORY
;
198 * in the filter expression, replace %u with the real name
199 * so in ldap filter, %u MUST exist :-)
201 pstr_sprintf(filter
, "(&%s%s)", "(uid=%u)",
202 get_objclass_filter(ldap_state
->schema_ver
));
205 * have to use this here because $ is filtered out
210 all_string_sub(filter
, "%u", escape_user
, sizeof(pstring
));
211 SAFE_FREE(escape_user
);
213 return smbldap_search_suffix(ldap_state
->smbldap_state
, filter
, attr
, result
);
216 /*******************************************************************
217 Run the search by rid.
218 ******************************************************************/
220 static int ldapsam_search_suffix_by_rid (struct ldapsam_privates
*ldap_state
,
221 uint32 rid
, LDAPMessage
** result
,
227 pstr_sprintf(filter
, "(&(rid=%i)%s)", rid
,
228 get_objclass_filter(ldap_state
->schema_ver
));
230 rc
= smbldap_search_suffix(ldap_state
->smbldap_state
, filter
, attr
, result
);
235 /*******************************************************************
236 Run the search by SID.
237 ******************************************************************/
239 static int ldapsam_search_suffix_by_sid (struct ldapsam_privates
*ldap_state
,
240 const DOM_SID
*sid
, LDAPMessage
** result
,
247 pstr_sprintf(filter
, "(&(%s=%s)%s)",
248 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_SID
),
249 sid_to_string(sid_string
, sid
),
250 get_objclass_filter(ldap_state
->schema_ver
));
252 rc
= smbldap_search_suffix(ldap_state
->smbldap_state
, filter
, attr
, result
);
257 /*******************************************************************
258 Delete complete object or objectclass and attrs from
259 object found in search_result depending on lp_ldap_delete_dn
260 ******************************************************************/
262 static NTSTATUS
ldapsam_delete_entry(struct ldapsam_privates
*ldap_state
,
264 const char *objectclass
,
268 LDAPMessage
*entry
= NULL
;
269 LDAPMod
**mods
= NULL
;
271 BerElement
*ptr
= NULL
;
273 rc
= ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
);
276 DEBUG(0, ("ldapsam_delete_entry: Entry must exist exactly once!\n"));
277 return NT_STATUS_UNSUCCESSFUL
;
280 entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
, result
);
281 dn
= smbldap_get_dn(ldap_state
->smbldap_state
->ldap_struct
, entry
);
283 return NT_STATUS_UNSUCCESSFUL
;
286 if (lp_ldap_delete_dn()) {
287 NTSTATUS ret
= NT_STATUS_OK
;
288 rc
= smbldap_delete(ldap_state
->smbldap_state
, dn
);
290 if (rc
!= LDAP_SUCCESS
) {
291 DEBUG(0, ("ldapsam_delete_entry: Could not delete object %s\n", dn
));
292 ret
= NT_STATUS_UNSUCCESSFUL
;
298 /* Ok, delete only the SAM attributes */
300 for (name
= ldap_first_attribute(ldap_state
->smbldap_state
->ldap_struct
, entry
, &ptr
);
302 name
= ldap_next_attribute(ldap_state
->smbldap_state
->ldap_struct
, entry
, ptr
)) {
305 /* We are only allowed to delete the attributes that
308 for (attrib
= attrs
; *attrib
!= NULL
; attrib
++) {
309 /* Don't delete LDAP_ATTR_MOD_TIMESTAMP attribute. */
310 if (strequal(*attrib
, get_userattr_key2string(ldap_state
->schema_ver
,
311 LDAP_ATTR_MOD_TIMESTAMP
))) {
314 if (strequal(*attrib
, name
)) {
315 DEBUG(10, ("ldapsam_delete_entry: deleting "
316 "attribute %s\n", name
));
317 smbldap_set_mod(&mods
, LDAP_MOD_DELETE
, name
,
329 smbldap_set_mod(&mods
, LDAP_MOD_DELETE
, "objectClass", objectclass
);
331 rc
= smbldap_modify(ldap_state
->smbldap_state
, dn
, mods
);
332 ldap_mods_free(mods
, True
);
334 if (rc
!= LDAP_SUCCESS
) {
335 char *ld_error
= NULL
;
336 ldap_get_option(ldap_state
->smbldap_state
->ldap_struct
, LDAP_OPT_ERROR_STRING
,
339 DEBUG(0, ("ldapsam_delete_entry: Could not delete attributes for %s, error: %s (%s)\n",
340 dn
, ldap_err2string(rc
), ld_error
?ld_error
:"unknown"));
343 return NT_STATUS_UNSUCCESSFUL
;
350 /* New Interface is being implemented here */
352 #if 0 /* JERRY - not uesed anymore */
354 /**********************************************************************
355 Initialize SAM_ACCOUNT from an LDAP query (unix attributes only)
356 *********************************************************************/
357 static BOOL
get_unix_attributes (struct ldapsam_privates
*ldap_state
,
358 SAM_ACCOUNT
* sampass
,
367 if ((ldap_values
= ldap_get_values (ldap_state
->smbldap_state
->ldap_struct
, entry
, "objectClass")) == NULL
) {
368 DEBUG (1, ("get_unix_attributes: no objectClass! \n"));
372 for (values
=ldap_values
;*values
;values
++) {
373 if (strequal(*values
, LDAP_OBJ_POSIXACCOUNT
)) {
378 if (!*values
) { /*end of array, no posixAccount */
379 DEBUG(10, ("user does not have %s attributes\n", LDAP_OBJ_POSIXACCOUNT
));
380 ldap_value_free(ldap_values
);
383 ldap_value_free(ldap_values
);
385 if ( !smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
386 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_UNIX_HOME
), homedir
) )
391 if ( !smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
392 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_GIDNUMBER
), temp
) )
397 *gid
= (gid_t
)atol(temp
);
399 pdb_set_unix_homedir(sampass
, homedir
, PDB_SET
);
401 DEBUG(10, ("user has %s attributes\n", LDAP_OBJ_POSIXACCOUNT
));
408 static time_t ldapsam_get_entry_timestamp(
409 struct ldapsam_privates
*ldap_state
,
415 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
416 get_userattr_key2string(ldap_state
->schema_ver
,LDAP_ATTR_MOD_TIMESTAMP
),
420 strptime(temp
, "%Y%m%d%H%M%SZ", &tm
);
425 /**********************************************************************
426 Initialize SAM_ACCOUNT from an LDAP query.
427 (Based on init_sam_from_buffer in pdb_tdb.c)
428 *********************************************************************/
430 static BOOL
init_sam_from_ldap(struct ldapsam_privates
*ldap_state
,
431 SAM_ACCOUNT
* sampass
,
438 pass_can_change_time
,
439 pass_must_change_time
,
452 char munged_dial
[2048];
454 uint8 smblmpwd
[LM_HASH_LEN
],
455 smbntpwd
[NT_HASH_LEN
];
456 BOOL use_samba_attrs
= True
;
457 uint16 acct_ctrl
= 0,
459 uint16 bad_password_count
= 0,
462 uint8 hours
[MAX_HOURS_LEN
];
464 LOGIN_CACHE
*cache_entry
= NULL
;
469 * do a little initialization
473 nt_username
[0] = '\0';
477 logon_script
[0] = '\0';
478 profile_path
[0] = '\0';
480 munged_dial
[0] = '\0';
481 workstations
[0] = '\0';
484 if (sampass
== NULL
|| ldap_state
== NULL
|| entry
== NULL
) {
485 DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
489 if (ldap_state
->smbldap_state
->ldap_struct
== NULL
) {
490 DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->ldap_struct is NULL!\n"));
494 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
, "uid", username
)) {
495 DEBUG(1, ("init_sam_from_ldap: No uid attribute found for this user!\n"));
499 DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username
));
501 pstrcpy(nt_username
, username
);
503 pstrcpy(domain
, ldap_state
->domain_name
);
505 pdb_set_username(sampass
, username
, PDB_SET
);
507 pdb_set_domain(sampass
, domain
, PDB_DEFAULT
);
508 pdb_set_nt_username(sampass
, nt_username
, PDB_SET
);
510 /* deal with different attributes between the schema first */
512 if ( ldap_state
->schema_ver
== SCHEMAVER_SAMBASAMACCOUNT
) {
513 if (smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
514 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_SID
), temp
)) {
515 pdb_set_user_sid_from_string(sampass
, temp
, PDB_SET
);
518 if (smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
519 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PRIMARY_GROUP_SID
), temp
)) {
520 pdb_set_group_sid_from_string(sampass
, temp
, PDB_SET
);
522 pdb_set_group_sid_from_rid(sampass
, DOMAIN_GROUP_RID_USERS
, PDB_DEFAULT
);
525 if (smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
526 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_RID
), temp
)) {
527 user_rid
= (uint32
)atol(temp
);
528 pdb_set_user_sid_from_rid(sampass
, user_rid
, PDB_SET
);
531 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
532 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PRIMARY_GROUP_RID
), temp
)) {
533 pdb_set_group_sid_from_rid(sampass
, DOMAIN_GROUP_RID_USERS
, PDB_DEFAULT
);
537 group_rid
= (uint32
)atol(temp
);
539 /* for some reason, we often have 0 as a primary group RID.
540 Make sure that we treat this just as a 'default' value */
543 pdb_set_group_sid_from_rid(sampass
, group_rid
, PDB_SET
);
545 pdb_set_group_sid_from_rid(sampass
, DOMAIN_GROUP_RID_USERS
, PDB_DEFAULT
);
549 if (pdb_get_init_flags(sampass
,PDB_USERSID
) == PDB_DEFAULT
) {
550 DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
551 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_SID
),
552 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_RID
),
557 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
558 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PWD_LAST_SET
), temp
)) {
559 /* leave as default */
561 pass_last_set_time
= (time_t) atol(temp
);
562 pdb_set_pass_last_set_time(sampass
, pass_last_set_time
, PDB_SET
);
565 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
566 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LOGON_TIME
), temp
)) {
567 /* leave as default */
569 logon_time
= (time_t) atol(temp
);
570 pdb_set_logon_time(sampass
, logon_time
, PDB_SET
);
573 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
574 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LOGOFF_TIME
), temp
)) {
575 /* leave as default */
577 logoff_time
= (time_t) atol(temp
);
578 pdb_set_logoff_time(sampass
, logoff_time
, PDB_SET
);
581 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
582 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_KICKOFF_TIME
), temp
)) {
583 /* leave as default */
585 kickoff_time
= (time_t) atol(temp
);
586 pdb_set_kickoff_time(sampass
, kickoff_time
, PDB_SET
);
589 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
590 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PWD_CAN_CHANGE
), temp
)) {
591 /* leave as default */
593 pass_can_change_time
= (time_t) atol(temp
);
594 pdb_set_pass_can_change_time(sampass
, pass_can_change_time
, PDB_SET
);
597 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
598 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PWD_MUST_CHANGE
), temp
)) {
599 /* leave as default */
601 pass_must_change_time
= (time_t) atol(temp
);
602 pdb_set_pass_must_change_time(sampass
, pass_must_change_time
, PDB_SET
);
605 /* recommend that 'gecos' and 'displayName' should refer to the same
606 * attribute OID. userFullName depreciated, only used by Samba
607 * primary rules of LDAP: don't make a new attribute when one is already defined
608 * that fits your needs; using cn then displayName rather than 'userFullName'
611 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
612 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_DISPLAY_NAME
), fullname
)) {
613 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
614 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_CN
), fullname
)) {
615 /* leave as default */
617 pdb_set_fullname(sampass
, fullname
, PDB_SET
);
620 pdb_set_fullname(sampass
, fullname
, PDB_SET
);
623 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
624 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_HOME_DRIVE
), dir_drive
))
626 pdb_set_dir_drive( sampass
, lp_logon_drive(), PDB_DEFAULT
);
628 pdb_set_dir_drive(sampass
, dir_drive
, PDB_SET
);
631 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
632 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_HOME_PATH
), homedir
))
634 pdb_set_homedir( sampass
,
635 talloc_sub_basic(sampass
->mem_ctx
, username
, lp_logon_home()),
638 pstrcpy( tmpstring
, homedir
);
639 standard_sub_basic( username
, tmpstring
, sizeof(tmpstring
) );
640 pdb_set_homedir(sampass
, tmpstring
, PDB_SET
);
643 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
644 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LOGON_SCRIPT
), logon_script
))
646 pdb_set_logon_script( sampass
,
647 talloc_sub_basic(sampass
->mem_ctx
, username
, lp_logon_script()),
650 pstrcpy( tmpstring
, logon_script
);
651 standard_sub_basic( username
, tmpstring
, sizeof(tmpstring
) );
652 pdb_set_logon_script(sampass
, tmpstring
, PDB_SET
);
655 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
656 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PROFILE_PATH
), profile_path
))
658 pdb_set_profile_path( sampass
,
659 talloc_sub_basic( sampass
->mem_ctx
, username
, lp_logon_path()),
662 pstrcpy( tmpstring
, profile_path
);
663 standard_sub_basic( username
, tmpstring
, sizeof(tmpstring
) );
664 pdb_set_profile_path(sampass
, tmpstring
, PDB_SET
);
667 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
668 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_DESC
), acct_desc
))
670 /* leave as default */
672 pdb_set_acct_desc(sampass
, acct_desc
, PDB_SET
);
675 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
676 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_WKS
), workstations
)) {
677 /* leave as default */;
679 pdb_set_workstations(sampass
, workstations
, PDB_SET
);
682 if (!smbldap_get_single_attribute(ldap_state
->smbldap_state
->ldap_struct
, entry
,
683 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_MUNGED_DIAL
), munged_dial
, sizeof(munged_dial
))) {
684 /* leave as default */;
686 pdb_set_munged_dial(sampass
, munged_dial
, PDB_SET
);
689 /* FIXME: hours stuff should be cleaner */
693 memset(hours
, 0xff, hours_len
);
695 if (ldap_state
->is_nds_ldap
) {
698 char clear_text_pw
[512];
700 /* Make call to Novell eDirectory ldap extension to get clear text password.
701 NOTE: This will only work if we have an SSL connection to eDirectory. */
702 user_dn
= smbldap_get_dn(ldap_state
->smbldap_state
->ldap_struct
, entry
);
703 if (user_dn
!= NULL
) {
704 DEBUG(3, ("init_sam_from_ldap: smbldap_get_dn(%s) returned '%s'\n", username
, user_dn
));
706 pwd_len
= sizeof(clear_text_pw
);
707 if (pdb_nds_get_password(ldap_state
->smbldap_state
, user_dn
, &pwd_len
, clear_text_pw
) == LDAP_SUCCESS
) {
708 nt_lm_owf_gen(clear_text_pw
, smbntpwd
, smblmpwd
);
709 if (!pdb_set_lanman_passwd(sampass
, smblmpwd
, PDB_SET
))
711 ZERO_STRUCT(smblmpwd
);
712 if (!pdb_set_nt_passwd(sampass
, smbntpwd
, PDB_SET
))
714 ZERO_STRUCT(smbntpwd
);
715 use_samba_attrs
= False
;
718 DEBUG(0, ("init_sam_from_ldap: failed to get user_dn for '%s'\n", username
));
722 if (use_samba_attrs
) {
723 if (!smbldap_get_single_pstring (ldap_state
->smbldap_state
->ldap_struct
, entry
,
724 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LMPW
), temp
)) {
725 /* leave as default */
727 pdb_gethexpwd(temp
, smblmpwd
);
728 memset((char *)temp
, '\0', strlen(temp
)+1);
729 if (!pdb_set_lanman_passwd(sampass
, smblmpwd
, PDB_SET
))
731 ZERO_STRUCT(smblmpwd
);
734 if (!smbldap_get_single_pstring (ldap_state
->smbldap_state
->ldap_struct
, entry
,
735 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_NTPW
), temp
)) {
736 /* leave as default */
738 pdb_gethexpwd(temp
, smbntpwd
);
739 memset((char *)temp
, '\0', strlen(temp
)+1);
740 if (!pdb_set_nt_passwd(sampass
, smbntpwd
, PDB_SET
))
742 ZERO_STRUCT(smbntpwd
);
746 account_policy_get(AP_PASSWORD_HISTORY
, &pwHistLen
);
748 uint8
*pwhist
= NULL
;
751 /* We can only store (sizeof(pstring)-1)/64 password history entries. */
752 pwHistLen
= MIN(pwHistLen
, ((sizeof(temp
)-1)/64));
754 if ((pwhist
= SMB_MALLOC(pwHistLen
* PW_HISTORY_ENTRY_LEN
)) == NULL
){
755 DEBUG(0, ("init_sam_from_ldap: malloc failed!\n"));
758 memset(pwhist
, '\0', pwHistLen
* PW_HISTORY_ENTRY_LEN
);
760 if (!smbldap_get_single_pstring (ldap_state
->smbldap_state
->ldap_struct
, entry
,
761 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PWD_HISTORY
), temp
)) {
762 /* leave as default - zeros */
764 BOOL hex_failed
= False
;
765 for (i
= 0; i
< pwHistLen
; i
++){
766 /* Get the 16 byte salt. */
767 if (!pdb_gethexpwd(&temp
[i
*64], &pwhist
[i
*PW_HISTORY_ENTRY_LEN
])) {
771 /* Get the 16 byte MD5 hash of salt+passwd. */
772 if (!pdb_gethexpwd(&temp
[(i
*64)+32],
773 &pwhist
[(i
*PW_HISTORY_ENTRY_LEN
)+PW_HISTORY_SALT_LEN
])) {
779 DEBUG(0,("init_sam_from_ldap: Failed to get password history for user %s\n",
781 memset(pwhist
, '\0', pwHistLen
* PW_HISTORY_ENTRY_LEN
);
784 if (!pdb_set_pw_history(sampass
, pwhist
, pwHistLen
, PDB_SET
)){
791 if (!smbldap_get_single_pstring (ldap_state
->smbldap_state
->ldap_struct
, entry
,
792 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_ACB_INFO
), temp
)) {
793 acct_ctrl
|= ACB_NORMAL
;
795 acct_ctrl
= pdb_decode_acct_ctrl(temp
);
798 acct_ctrl
|= ACB_NORMAL
;
800 pdb_set_acct_ctrl(sampass
, acct_ctrl
, PDB_SET
);
803 pdb_set_hours_len(sampass
, hours_len
, PDB_SET
);
804 pdb_set_logon_divs(sampass
, logon_divs
, PDB_SET
);
806 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
807 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_BAD_PASSWORD_COUNT
), temp
)) {
808 /* leave as default */
810 bad_password_count
= (uint32
) atol(temp
);
811 pdb_set_bad_password_count(sampass
, bad_password_count
, PDB_SET
);
814 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
815 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_BAD_PASSWORD_TIME
), temp
)) {
816 /* leave as default */
818 bad_password_time
= (time_t) atol(temp
);
819 pdb_set_bad_password_time(sampass
, bad_password_time
, PDB_SET
);
823 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
824 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LOGON_COUNT
), temp
)) {
825 /* leave as default */
827 logon_count
= (uint32
) atol(temp
);
828 pdb_set_logon_count(sampass
, logon_count
, PDB_SET
);
831 /* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
833 if(!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
834 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LOGON_HOURS
), temp
)) {
835 /* leave as default */
837 pdb_gethexhours(temp
, hours
);
838 memset((char *)temp
, '\0', strlen(temp
) +1);
839 pdb_set_hours(sampass
, hours
, PDB_SET
);
843 /* check the timestamp of the cache vs ldap entry */
844 if (!(ldap_entry_time
= ldapsam_get_entry_timestamp(ldap_state
,
848 /* see if we have newer updates */
849 if (!(cache_entry
= login_cache_read(sampass
))) {
850 DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
851 (unsigned int)pdb_get_bad_password_count(sampass
),
852 (unsigned int)pdb_get_bad_password_time(sampass
)));
856 DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
857 (unsigned int)ldap_entry_time
, (unsigned int)cache_entry
->entry_timestamp
,
858 (unsigned int)cache_entry
->bad_password_time
));
860 if (ldap_entry_time
> cache_entry
->entry_timestamp
) {
861 /* cache is older than directory , so
862 we need to delete the entry but allow the
863 fields to be written out */
864 login_cache_delentry(sampass
);
867 pdb_set_acct_ctrl(sampass
,
868 pdb_get_acct_ctrl(sampass
) |
869 (cache_entry
->acct_ctrl
& ACB_AUTOLOCK
),
871 pdb_set_bad_password_count(sampass
,
872 cache_entry
->bad_password_count
,
874 pdb_set_bad_password_time(sampass
,
875 cache_entry
->bad_password_time
,
879 SAFE_FREE(cache_entry
);
883 /**********************************************************************
884 Initialize the ldap db from a SAM_ACCOUNT. Called on update.
885 (Based on init_buffer_from_sam in pdb_tdb.c)
886 *********************************************************************/
888 static BOOL
init_ldap_from_sam (struct ldapsam_privates
*ldap_state
,
889 LDAPMessage
*existing
,
890 LDAPMod
*** mods
, SAM_ACCOUNT
* sampass
,
891 BOOL (*need_update
)(const SAM_ACCOUNT
*,
897 if (mods
== NULL
|| sampass
== NULL
) {
898 DEBUG(0, ("init_ldap_from_sam: NULL parameters found!\n"));
905 * took out adding "objectclass: sambaAccount"
906 * do this on a per-mod basis
908 if (need_update(sampass
, PDB_USERNAME
))
909 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
910 "uid", pdb_get_username(sampass
));
912 DEBUG(2, ("init_ldap_from_sam: Setting entry for user: %s\n", pdb_get_username(sampass
)));
914 /* only update the RID if we actually need to */
915 if (need_update(sampass
, PDB_USERSID
)) {
917 fstring dom_sid_string
;
918 const DOM_SID
*user_sid
= pdb_get_user_sid(sampass
);
920 switch ( ldap_state
->schema_ver
) {
921 case SCHEMAVER_SAMBAACCOUNT
:
922 if (!sid_peek_check_rid(&ldap_state
->domain_sid
, user_sid
, &rid
)) {
923 DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
924 sid_to_string(sid_string
, user_sid
),
925 sid_to_string(dom_sid_string
, &ldap_state
->domain_sid
)));
928 slprintf(temp
, sizeof(temp
) - 1, "%i", rid
);
929 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
930 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_RID
),
934 case SCHEMAVER_SAMBASAMACCOUNT
:
935 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
936 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_SID
),
937 sid_to_string(sid_string
, user_sid
));
941 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
946 /* we don't need to store the primary group RID - so leaving it
947 'free' to hang off the unix primary group makes life easier */
949 if (need_update(sampass
, PDB_GROUPSID
)) {
951 fstring dom_sid_string
;
952 const DOM_SID
*group_sid
= pdb_get_group_sid(sampass
);
954 switch ( ldap_state
->schema_ver
) {
955 case SCHEMAVER_SAMBAACCOUNT
:
956 if (!sid_peek_check_rid(&ldap_state
->domain_sid
, group_sid
, &rid
)) {
957 DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
958 sid_to_string(sid_string
, group_sid
),
959 sid_to_string(dom_sid_string
, &ldap_state
->domain_sid
)));
963 slprintf(temp
, sizeof(temp
) - 1, "%i", rid
);
964 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
965 get_userattr_key2string(ldap_state
->schema_ver
,
966 LDAP_ATTR_PRIMARY_GROUP_RID
), temp
);
969 case SCHEMAVER_SAMBASAMACCOUNT
:
970 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
971 get_userattr_key2string(ldap_state
->schema_ver
,
972 LDAP_ATTR_PRIMARY_GROUP_SID
), sid_to_string(sid_string
, group_sid
));
976 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
982 /* displayName, cn, and gecos should all be the same
983 * most easily accomplished by giving them the same OID
984 * gecos isn't set here b/c it should be handled by the
986 * We change displayName only and fall back to cn if
990 if (need_update(sampass
, PDB_FULLNAME
))
991 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
992 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_DISPLAY_NAME
),
993 pdb_get_fullname(sampass
));
995 if (need_update(sampass
, PDB_ACCTDESC
))
996 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
997 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_DESC
),
998 pdb_get_acct_desc(sampass
));
1000 if (need_update(sampass
, PDB_WORKSTATIONS
))
1001 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1002 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_WKS
),
1003 pdb_get_workstations(sampass
));
1005 if (need_update(sampass
, PDB_MUNGEDDIAL
))
1006 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1007 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_MUNGED_DIAL
),
1008 pdb_get_munged_dial(sampass
));
1010 if (need_update(sampass
, PDB_SMBHOME
))
1011 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1012 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_HOME_PATH
),
1013 pdb_get_homedir(sampass
));
1015 if (need_update(sampass
, PDB_DRIVE
))
1016 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1017 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_HOME_DRIVE
),
1018 pdb_get_dir_drive(sampass
));
1020 if (need_update(sampass
, PDB_LOGONSCRIPT
))
1021 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1022 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LOGON_SCRIPT
),
1023 pdb_get_logon_script(sampass
));
1025 if (need_update(sampass
, PDB_PROFILE
))
1026 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1027 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PROFILE_PATH
),
1028 pdb_get_profile_path(sampass
));
1030 slprintf(temp
, sizeof(temp
) - 1, "%li", pdb_get_logon_time(sampass
));
1031 if (need_update(sampass
, PDB_LOGONTIME
))
1032 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1033 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LOGON_TIME
), temp
);
1035 slprintf(temp
, sizeof(temp
) - 1, "%li", pdb_get_logoff_time(sampass
));
1036 if (need_update(sampass
, PDB_LOGOFFTIME
))
1037 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1038 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LOGOFF_TIME
), temp
);
1040 slprintf (temp
, sizeof (temp
) - 1, "%li", pdb_get_kickoff_time(sampass
));
1041 if (need_update(sampass
, PDB_KICKOFFTIME
))
1042 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1043 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_KICKOFF_TIME
), temp
);
1045 slprintf (temp
, sizeof (temp
) - 1, "%li", pdb_get_pass_can_change_time(sampass
));
1046 if (need_update(sampass
, PDB_CANCHANGETIME
))
1047 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1048 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PWD_CAN_CHANGE
), temp
);
1050 slprintf (temp
, sizeof (temp
) - 1, "%li", pdb_get_pass_must_change_time(sampass
));
1051 if (need_update(sampass
, PDB_MUSTCHANGETIME
))
1052 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1053 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PWD_MUST_CHANGE
), temp
);
1056 if ((pdb_get_acct_ctrl(sampass
)&(ACB_WSTRUST
|ACB_SVRTRUST
|ACB_DOMTRUST
))
1057 || (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY
)) {
1059 if (need_update(sampass
, PDB_LMPASSWD
)) {
1060 const uchar
*lm_pw
= pdb_get_lanman_passwd(sampass
);
1062 pdb_sethexpwd(temp
, lm_pw
,
1063 pdb_get_acct_ctrl(sampass
));
1064 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1065 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LMPW
),
1068 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1069 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_LMPW
),
1073 if (need_update(sampass
, PDB_NTPASSWD
)) {
1074 const uchar
*nt_pw
= pdb_get_nt_passwd(sampass
);
1076 pdb_sethexpwd(temp
, nt_pw
,
1077 pdb_get_acct_ctrl(sampass
));
1078 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1079 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_NTPW
),
1082 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1083 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_NTPW
),
1088 if (need_update(sampass
, PDB_PWHISTORY
)) {
1089 uint32 pwHistLen
= 0;
1090 account_policy_get(AP_PASSWORD_HISTORY
, &pwHistLen
);
1091 if (pwHistLen
== 0) {
1092 /* Remove any password history from the LDAP store. */
1093 memset(temp
, '0', 64); /* NOTE !!!! '0' *NOT '\0' */
1097 uint32 currHistLen
= 0;
1098 const uint8
*pwhist
= pdb_get_pw_history(sampass
, &currHistLen
);
1099 if (pwhist
!= NULL
) {
1100 /* We can only store (sizeof(pstring)-1)/64 password history entries. */
1101 pwHistLen
= MIN(pwHistLen
, ((sizeof(temp
)-1)/64));
1102 for (i
=0; i
< pwHistLen
&& i
< currHistLen
; i
++) {
1103 /* Store the salt. */
1104 pdb_sethexpwd(&temp
[i
*64], &pwhist
[i
*PW_HISTORY_ENTRY_LEN
], 0);
1105 /* Followed by the md5 hash of salt + md4 hash */
1106 pdb_sethexpwd(&temp
[(i
*64)+32],
1107 &pwhist
[(i
*PW_HISTORY_ENTRY_LEN
)+PW_HISTORY_SALT_LEN
], 0);
1108 DEBUG(100, ("temp=%s\n", temp
));
1112 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1113 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PWD_HISTORY
),
1117 if (need_update(sampass
, PDB_PASSLASTSET
)) {
1118 slprintf (temp
, sizeof (temp
) - 1, "%li", pdb_get_pass_last_set_time(sampass
));
1119 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1120 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_PWD_LAST_SET
),
1125 if (need_update(sampass
, PDB_HOURS
)) {
1126 const uint8
*hours
= pdb_get_hours(sampass
);
1128 pdb_sethexhours(temp
, hours
);
1129 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
,
1132 get_userattr_key2string(ldap_state
->schema_ver
,
1133 LDAP_ATTR_LOGON_HOURS
),
1138 if (need_update(sampass
, PDB_ACCTCTRL
))
1139 smbldap_make_mod(ldap_state
->smbldap_state
->ldap_struct
, existing
, mods
,
1140 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_ACB_INFO
),
1141 pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass
), NEW_PW_FORMAT_SPACE_PADDED_LEN
));
1143 /* password lockout cache:
1144 - If we are now autolocking or clearing, we write to ldap
1145 - If we are clearing, we delete the cache entry
1146 - If the count is > 0, we update the cache
1148 This even means when autolocking, we cache, just in case the
1149 update doesn't work, and we have to cache the autolock flag */
1151 if (need_update(sampass
, PDB_BAD_PASSWORD_COUNT
)) /* &&
1152 need_update(sampass, PDB_BAD_PASSWORD_TIME)) */ {
1153 uint16 badcount
= pdb_get_bad_password_count(sampass
);
1154 time_t badtime
= pdb_get_bad_password_time(sampass
);
1156 account_policy_get(AP_BAD_ATTEMPT_LOCKOUT
, &pol
);
1158 DEBUG(3, ("updating bad password fields, policy=%u, count=%u, time=%u\n",
1159 (unsigned int)pol
, (unsigned int)badcount
, (unsigned int)badtime
));
1161 if ((badcount
>= pol
) || (badcount
== 0)) {
1162 DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
1163 (unsigned int)badcount
, (unsigned int)badtime
));
1164 slprintf (temp
, sizeof (temp
) - 1, "%li", (long)badcount
);
1166 ldap_state
->smbldap_state
->ldap_struct
,
1168 get_userattr_key2string(
1169 ldap_state
->schema_ver
,
1170 LDAP_ATTR_BAD_PASSWORD_COUNT
),
1173 slprintf (temp
, sizeof (temp
) - 1, "%li", badtime
);
1175 ldap_state
->smbldap_state
->ldap_struct
,
1177 get_userattr_key2string(
1178 ldap_state
->schema_ver
,
1179 LDAP_ATTR_BAD_PASSWORD_TIME
),
1182 if (badcount
== 0) {
1183 DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass
)));
1184 login_cache_delentry(sampass
);
1186 LOGIN_CACHE cache_entry
;
1188 cache_entry
.entry_timestamp
= time(NULL
);
1189 cache_entry
.acct_ctrl
= pdb_get_acct_ctrl(sampass
);
1190 cache_entry
.bad_password_count
= badcount
;
1191 cache_entry
.bad_password_time
= badtime
;
1193 DEBUG(7, ("Updating bad password count and time in login cache\n"));
1194 login_cache_write(sampass
, cache_entry
);
1201 /**********************************************************************
1202 Connect to LDAP server for password enumeration.
1203 *********************************************************************/
1205 static NTSTATUS
ldapsam_setsampwent(struct pdb_methods
*my_methods
, BOOL update
, uint16 acb_mask
)
1207 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
1209 pstring filter
, suffix
;
1210 const char **attr_list
;
1211 BOOL machine_mask
= False
, user_mask
= False
;
1213 pstr_sprintf( filter
, "(&%s%s)", "(uid=%u)",
1214 get_objclass_filter(ldap_state
->schema_ver
));
1215 all_string_sub(filter
, "%u", "*", sizeof(pstring
));
1217 machine_mask
= ((acb_mask
!= 0) && (acb_mask
& (ACB_WSTRUST
|ACB_SVRTRUST
|ACB_DOMTRUST
)));
1218 user_mask
= ((acb_mask
!= 0) && (acb_mask
& ACB_NORMAL
));
1221 pstrcpy(suffix
, lp_ldap_machine_suffix());
1222 } else if (user_mask
) {
1223 pstrcpy(suffix
, lp_ldap_user_suffix());
1225 pstrcpy(suffix
, lp_ldap_suffix());
1228 DEBUG(10,("ldapsam_setsampwent: LDAP Query for acb_mask 0x%x will use suffix %s\n",
1231 attr_list
= get_userattr_list(ldap_state
->schema_ver
);
1232 rc
= smbldap_search(ldap_state
->smbldap_state
, suffix
, LDAP_SCOPE_SUBTREE
, filter
,
1233 attr_list
, 0, &ldap_state
->result
);
1234 free_attr_list( attr_list
);
1236 if (rc
!= LDAP_SUCCESS
) {
1237 DEBUG(0, ("ldapsam_setsampwent: LDAP search failed: %s\n", ldap_err2string(rc
)));
1238 DEBUG(3, ("ldapsam_setsampwent: Query was: %s, %s\n", suffix
, filter
));
1239 ldap_msgfree(ldap_state
->result
);
1240 ldap_state
->result
= NULL
;
1241 return NT_STATUS_UNSUCCESSFUL
;
1244 DEBUG(2, ("ldapsam_setsampwent: %d entries in the base %s\n",
1245 ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
,
1246 ldap_state
->result
), suffix
));
1248 ldap_state
->entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
,
1249 ldap_state
->result
);
1250 ldap_state
->index
= 0;
1252 return NT_STATUS_OK
;
1255 /**********************************************************************
1256 End enumeration of the LDAP password list.
1257 *********************************************************************/
1259 static void ldapsam_endsampwent(struct pdb_methods
*my_methods
)
1261 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
1262 if (ldap_state
->result
) {
1263 ldap_msgfree(ldap_state
->result
);
1264 ldap_state
->result
= NULL
;
1268 /**********************************************************************
1269 Get the next entry in the LDAP password database.
1270 *********************************************************************/
1272 static NTSTATUS
ldapsam_getsampwent(struct pdb_methods
*my_methods
, SAM_ACCOUNT
*user
)
1274 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
1275 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
1279 if (!ldap_state
->entry
)
1282 ldap_state
->index
++;
1283 bret
= init_sam_from_ldap(ldap_state
, user
, ldap_state
->entry
);
1285 ldap_state
->entry
= ldap_next_entry(ldap_state
->smbldap_state
->ldap_struct
,
1289 return NT_STATUS_OK
;
1292 static void append_attr(const char ***attr_list
, const char *new_attr
)
1296 if (new_attr
== NULL
) {
1300 for (i
=0; (*attr_list
)[i
] != NULL
; i
++) {
1304 (*attr_list
) = SMB_REALLOC_ARRAY((*attr_list
), const char *, i
+2);
1305 SMB_ASSERT((*attr_list
) != NULL
);
1306 (*attr_list
)[i
] = SMB_STRDUP(new_attr
);
1307 (*attr_list
)[i
+1] = NULL
;
1310 /**********************************************************************
1311 Get SAM_ACCOUNT entry from LDAP by username.
1312 *********************************************************************/
1314 static NTSTATUS
ldapsam_getsampwnam(struct pdb_methods
*my_methods
, SAM_ACCOUNT
*user
, const char *sname
)
1316 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
1317 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
1318 LDAPMessage
*result
= NULL
;
1319 LDAPMessage
*entry
= NULL
;
1321 const char ** attr_list
;
1324 attr_list
= get_userattr_list( ldap_state
->schema_ver
);
1325 append_attr(&attr_list
, get_userattr_key2string(ldap_state
->schema_ver
,LDAP_ATTR_MOD_TIMESTAMP
));
1326 rc
= ldapsam_search_suffix_by_name(ldap_state
, sname
, &result
, attr_list
);
1327 free_attr_list( attr_list
);
1329 if ( rc
!= LDAP_SUCCESS
)
1330 return NT_STATUS_NO_SUCH_USER
;
1332 count
= ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
);
1335 DEBUG(4, ("ldapsam_getsampwnam: Unable to locate user [%s] count=%d\n", sname
, count
));
1336 ldap_msgfree(result
);
1337 return NT_STATUS_NO_SUCH_USER
;
1338 } else if (count
> 1) {
1339 DEBUG(1, ("ldapsam_getsampwnam: Duplicate entries for this user [%s] Failing. count=%d\n", sname
, count
));
1340 ldap_msgfree(result
);
1341 return NT_STATUS_NO_SUCH_USER
;
1344 entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
, result
);
1346 if (!init_sam_from_ldap(ldap_state
, user
, entry
)) {
1347 DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname
));
1348 ldap_msgfree(result
);
1349 return NT_STATUS_NO_SUCH_USER
;
1351 pdb_set_backend_private_data(user
, result
,
1352 private_data_free_fn
,
1353 my_methods
, PDB_CHANGED
);
1356 ldap_msgfree(result
);
1361 static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates
*ldap_state
,
1362 const DOM_SID
*sid
, LDAPMessage
**result
)
1365 const char ** attr_list
;
1368 switch ( ldap_state
->schema_ver
) {
1369 case SCHEMAVER_SAMBASAMACCOUNT
:
1370 attr_list
= get_userattr_list(ldap_state
->schema_ver
);
1371 append_attr(&attr_list
, get_userattr_key2string(ldap_state
->schema_ver
,LDAP_ATTR_MOD_TIMESTAMP
));
1372 rc
= ldapsam_search_suffix_by_sid(ldap_state
, sid
, result
, attr_list
);
1373 free_attr_list( attr_list
);
1375 if ( rc
!= LDAP_SUCCESS
)
1379 case SCHEMAVER_SAMBAACCOUNT
:
1380 if (!sid_peek_check_rid(&ldap_state
->domain_sid
, sid
, &rid
)) {
1384 attr_list
= get_userattr_list(ldap_state
->schema_ver
);
1385 rc
= ldapsam_search_suffix_by_rid(ldap_state
, rid
, result
, attr_list
);
1386 free_attr_list( attr_list
);
1388 if ( rc
!= LDAP_SUCCESS
)
1395 /**********************************************************************
1396 Get SAM_ACCOUNT entry from LDAP by SID.
1397 *********************************************************************/
1399 static NTSTATUS
ldapsam_getsampwsid(struct pdb_methods
*my_methods
, SAM_ACCOUNT
* user
, const DOM_SID
*sid
)
1401 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
1402 LDAPMessage
*result
= NULL
;
1403 LDAPMessage
*entry
= NULL
;
1408 rc
= ldapsam_get_ldap_user_by_sid(ldap_state
,
1410 if (rc
!= LDAP_SUCCESS
)
1411 return NT_STATUS_NO_SUCH_USER
;
1413 count
= ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
);
1416 DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string
, sid
),
1418 ldap_msgfree(result
);
1419 return NT_STATUS_NO_SUCH_USER
;
1420 } else if (count
> 1) {
1421 DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string
, sid
),
1423 ldap_msgfree(result
);
1424 return NT_STATUS_NO_SUCH_USER
;
1427 entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
, result
);
1429 ldap_msgfree(result
);
1430 return NT_STATUS_NO_SUCH_USER
;
1433 if (!init_sam_from_ldap(ldap_state
, user
, entry
)) {
1434 DEBUG(1,("ldapsam_getsampwsid: init_sam_from_ldap failed!\n"));
1435 ldap_msgfree(result
);
1436 return NT_STATUS_NO_SUCH_USER
;
1439 pdb_set_backend_private_data(user
, result
,
1440 private_data_free_fn
,
1441 my_methods
, PDB_CHANGED
);
1442 return NT_STATUS_OK
;
1445 static BOOL
ldapsam_can_pwchange_exop(struct smbldap_state
*ldap_state
)
1447 return smbldap_has_extension(ldap_state
, LDAP_EXOP_MODIFY_PASSWD
);
1450 /********************************************************************
1451 Do the actual modification - also change a plaintext passord if
1453 **********************************************************************/
1455 static NTSTATUS
ldapsam_modify_entry(struct pdb_methods
*my_methods
,
1456 SAM_ACCOUNT
*newpwd
, char *dn
,
1457 LDAPMod
**mods
, int ldap_op
,
1458 BOOL (*need_update
)(const SAM_ACCOUNT
*, enum pdb_elements
))
1460 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
1463 if (!my_methods
|| !newpwd
|| !dn
) {
1464 return NT_STATUS_INVALID_PARAMETER
;
1468 DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
1469 /* may be password change below however */
1473 smbldap_set_mod(&mods
, LDAP_MOD_ADD
,
1476 rc
= smbldap_add(ldap_state
->smbldap_state
,
1479 case LDAP_MOD_REPLACE
:
1480 rc
= smbldap_modify(ldap_state
->smbldap_state
,
1484 DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n",
1486 return NT_STATUS_INVALID_PARAMETER
;
1489 if (rc
!=LDAP_SUCCESS
) {
1490 char *ld_error
= NULL
;
1491 ldap_get_option(ldap_state
->smbldap_state
->ldap_struct
, LDAP_OPT_ERROR_STRING
,
1493 DEBUG(1, ("ldapsam_modify_entry: Failed to %s user dn= %s with: %s\n\t%s\n",
1494 ldap_op
== LDAP_MOD_ADD
? "add" : "modify",
1495 dn
, ldap_err2string(rc
),
1496 ld_error
?ld_error
:"unknown"));
1497 SAFE_FREE(ld_error
);
1498 return NT_STATUS_UNSUCCESSFUL
;
1502 if (!(pdb_get_acct_ctrl(newpwd
)&(ACB_WSTRUST
|ACB_SVRTRUST
|ACB_DOMTRUST
)) &&
1503 (lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF
) &&
1504 need_update(newpwd
, PDB_PLAINTEXT_PW
) &&
1505 (pdb_get_plaintext_passwd(newpwd
)!=NULL
)) {
1508 char *retoid
= NULL
;
1509 struct berval
*retdata
= NULL
;
1510 char *utf8_password
;
1513 if (!ldap_state
->is_nds_ldap
) {
1514 if (!ldapsam_can_pwchange_exop(ldap_state
->smbldap_state
)) {
1515 DEBUG(2, ("ldap password change requested, but LDAP "
1516 "server does not support it -- ignoring\n"));
1517 return NT_STATUS_OK
;
1521 if (push_utf8_allocate(&utf8_password
, pdb_get_plaintext_passwd(newpwd
)) == (size_t)-1) {
1522 return NT_STATUS_NO_MEMORY
;
1525 if (push_utf8_allocate(&utf8_dn
, dn
) == (size_t)-1) {
1526 return NT_STATUS_NO_MEMORY
;
1529 if ((ber
= ber_alloc_t(LBER_USE_DER
))==NULL
) {
1530 DEBUG(0,("ber_alloc_t returns NULL\n"));
1531 SAFE_FREE(utf8_password
);
1532 return NT_STATUS_UNSUCCESSFUL
;
1535 ber_printf (ber
, "{");
1536 ber_printf (ber
, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID
, utf8_dn
);
1537 ber_printf (ber
, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW
, utf8_password
);
1538 ber_printf (ber
, "N}");
1540 if ((rc
= ber_flatten (ber
, &bv
))<0) {
1541 DEBUG(0,("ldapsam_modify_entry: ber_flatten returns a value <0\n"));
1544 SAFE_FREE(utf8_password
);
1545 return NT_STATUS_UNSUCCESSFUL
;
1549 SAFE_FREE(utf8_password
);
1552 if (!ldap_state
->is_nds_ldap
) {
1553 rc
= smbldap_extended_operation(ldap_state
->smbldap_state
,
1554 LDAP_EXOP_MODIFY_PASSWD
,
1555 bv
, NULL
, NULL
, &retoid
,
1558 rc
= pdb_nds_set_password(ldap_state
->smbldap_state
, dn
,
1559 pdb_get_plaintext_passwd(newpwd
));
1561 if (rc
!= LDAP_SUCCESS
) {
1562 char *ld_error
= NULL
;
1564 if (rc
== LDAP_OBJECT_CLASS_VIOLATION
) {
1565 DEBUG(3, ("Could not set userPassword "
1566 "attribute due to an objectClass "
1567 "violation -- ignoring\n"));
1569 return NT_STATUS_OK
;
1572 ldap_get_option(ldap_state
->smbldap_state
->ldap_struct
, LDAP_OPT_ERROR_STRING
,
1574 DEBUG(0,("ldapsam_modify_entry: LDAP Password could not be changed for user %s: %s\n\t%s\n",
1575 pdb_get_username(newpwd
), ldap_err2string(rc
), ld_error
?ld_error
:"unknown"));
1576 SAFE_FREE(ld_error
);
1578 return NT_STATUS_UNSUCCESSFUL
;
1580 DEBUG(3,("ldapsam_modify_entry: LDAP Password changed for user %s\n",pdb_get_username(newpwd
)));
1581 #ifdef DEBUG_PASSWORD
1582 DEBUG(100,("ldapsam_modify_entry: LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd
)));
1585 ber_bvfree(retdata
);
1587 ber_memfree(retoid
);
1591 return NT_STATUS_OK
;
1594 /**********************************************************************
1595 Delete entry from LDAP for username.
1596 *********************************************************************/
1598 static NTSTATUS
ldapsam_delete_sam_account(struct pdb_methods
*my_methods
, SAM_ACCOUNT
* sam_acct
)
1600 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
1603 LDAPMessage
*result
= NULL
;
1605 const char **attr_list
;
1609 DEBUG(0, ("ldapsam_delete_sam_account: sam_acct was NULL!\n"));
1610 return NT_STATUS_INVALID_PARAMETER
;
1613 sname
= pdb_get_username(sam_acct
);
1615 DEBUG (3, ("ldapsam_delete_sam_account: Deleting user %s from LDAP.\n", sname
));
1617 attr_list
= get_userattr_delete_list( ldap_state
->schema_ver
);
1618 rc
= ldapsam_search_suffix_by_name(ldap_state
, sname
, &result
, attr_list
);
1620 if (rc
!= LDAP_SUCCESS
) {
1621 free_attr_list( attr_list
);
1622 return NT_STATUS_NO_SUCH_USER
;
1625 switch ( ldap_state
->schema_ver
) {
1626 case SCHEMAVER_SAMBASAMACCOUNT
:
1627 fstrcpy( objclass
, LDAP_OBJ_SAMBASAMACCOUNT
);
1630 case SCHEMAVER_SAMBAACCOUNT
:
1631 fstrcpy( objclass
, LDAP_OBJ_SAMBAACCOUNT
);
1634 fstrcpy( objclass
, "UNKNOWN" );
1635 DEBUG(0,("ldapsam_delete_sam_account: Unknown schema version specified!\n"));
1639 ret
= ldapsam_delete_entry(ldap_state
, result
, objclass
, attr_list
);
1640 ldap_msgfree(result
);
1641 free_attr_list( attr_list
);
1646 /**********************************************************************
1647 Helper function to determine for update_sam_account whether
1648 we need LDAP modification.
1649 *********************************************************************/
1651 static BOOL
element_is_changed(const SAM_ACCOUNT
*sampass
,
1652 enum pdb_elements element
)
1654 return IS_SAM_CHANGED(sampass
, element
);
1657 /**********************************************************************
1659 *********************************************************************/
1661 static NTSTATUS
ldapsam_update_sam_account(struct pdb_methods
*my_methods
, SAM_ACCOUNT
* newpwd
)
1663 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
1664 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
1667 LDAPMessage
*result
= NULL
;
1668 LDAPMessage
*entry
= NULL
;
1669 LDAPMod
**mods
= NULL
;
1670 const char **attr_list
;
1672 result
= pdb_get_backend_private_data(newpwd
, my_methods
);
1674 attr_list
= get_userattr_list(ldap_state
->schema_ver
);
1675 rc
= ldapsam_search_suffix_by_name(ldap_state
, pdb_get_username(newpwd
), &result
, attr_list
);
1676 free_attr_list( attr_list
);
1677 if (rc
!= LDAP_SUCCESS
) {
1678 return NT_STATUS_UNSUCCESSFUL
;
1680 pdb_set_backend_private_data(newpwd
, result
, private_data_free_fn
, my_methods
, PDB_CHANGED
);
1683 if (ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
) == 0) {
1684 DEBUG(0, ("ldapsam_update_sam_account: No user to modify!\n"));
1685 return NT_STATUS_UNSUCCESSFUL
;
1688 entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
, result
);
1689 dn
= smbldap_get_dn(ldap_state
->smbldap_state
->ldap_struct
, entry
);
1691 return NT_STATUS_UNSUCCESSFUL
;
1694 DEBUG(4, ("ldapsam_update_sam_account: user %s to be modified has dn: %s\n", pdb_get_username(newpwd
), dn
));
1696 if (!init_ldap_from_sam(ldap_state
, entry
, &mods
, newpwd
,
1697 element_is_changed
)) {
1698 DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
1701 ldap_mods_free(mods
,True
);
1702 return NT_STATUS_UNSUCCESSFUL
;
1706 DEBUG(4,("ldapsam_update_sam_account: mods is empty: nothing to update for user: %s\n",
1707 pdb_get_username(newpwd
)));
1709 return NT_STATUS_OK
;
1712 ret
= ldapsam_modify_entry(my_methods
,newpwd
,dn
,mods
,LDAP_MOD_REPLACE
, element_is_changed
);
1713 ldap_mods_free(mods
,True
);
1716 if (!NT_STATUS_IS_OK(ret
)) {
1717 char *ld_error
= NULL
;
1718 ldap_get_option(ldap_state
->smbldap_state
->ldap_struct
, LDAP_OPT_ERROR_STRING
,
1720 DEBUG(0,("ldapsam_update_sam_account: failed to modify user with uid = %s, error: %s (%s)\n",
1721 pdb_get_username(newpwd
), ld_error
?ld_error
:"(unknwon)", ldap_err2string(rc
)));
1722 SAFE_FREE(ld_error
);
1726 DEBUG(2, ("ldapsam_update_sam_account: successfully modified uid = %s in the LDAP database\n",
1727 pdb_get_username(newpwd
)));
1728 return NT_STATUS_OK
;
1731 /**********************************************************************
1732 Helper function to determine for update_sam_account whether
1733 we need LDAP modification.
1734 *********************************************************************/
1736 static BOOL
element_is_set_or_changed(const SAM_ACCOUNT
*sampass
,
1737 enum pdb_elements element
)
1739 return (IS_SAM_SET(sampass
, element
) ||
1740 IS_SAM_CHANGED(sampass
, element
));
1743 /**********************************************************************
1744 Add SAM_ACCOUNT to LDAP.
1745 *********************************************************************/
1747 static NTSTATUS
ldapsam_add_sam_account(struct pdb_methods
*my_methods
, SAM_ACCOUNT
* newpwd
)
1749 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
1750 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
1752 LDAPMessage
*result
= NULL
;
1753 LDAPMessage
*entry
= NULL
;
1755 LDAPMod
**mods
= NULL
;
1756 int ldap_op
= LDAP_MOD_REPLACE
;
1758 const char **attr_list
;
1760 const char *username
= pdb_get_username(newpwd
);
1761 const DOM_SID
*sid
= pdb_get_user_sid(newpwd
);
1765 if (!username
|| !*username
) {
1766 DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
1767 return NT_STATUS_INVALID_PARAMETER
;
1770 /* free this list after the second search or in case we exit on failure */
1771 attr_list
= get_userattr_list(ldap_state
->schema_ver
);
1773 rc
= ldapsam_search_suffix_by_name (ldap_state
, username
, &result
, attr_list
);
1775 if (rc
!= LDAP_SUCCESS
) {
1776 free_attr_list( attr_list
);
1777 return NT_STATUS_UNSUCCESSFUL
;
1780 if (ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
) != 0) {
1781 DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
1783 ldap_msgfree(result
);
1784 free_attr_list( attr_list
);
1785 return NT_STATUS_UNSUCCESSFUL
;
1787 ldap_msgfree(result
);
1790 if (element_is_set_or_changed(newpwd
, PDB_USERSID
)) {
1791 rc
= ldapsam_get_ldap_user_by_sid(ldap_state
,
1793 if (rc
== LDAP_SUCCESS
) {
1794 if (ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
) != 0) {
1795 DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n",
1796 sid_to_string(sid_string
, sid
)));
1797 free_attr_list( attr_list
);
1798 ldap_msgfree(result
);
1799 return NT_STATUS_UNSUCCESSFUL
;
1801 ldap_msgfree(result
);
1805 /* does the entry already exist but without a samba attributes?
1806 we need to return the samba attributes here */
1808 escape_user
= escape_ldap_string_alloc( username
);
1809 pstrcpy( filter
, "(uid=%u)" );
1810 all_string_sub( filter
, "%u", escape_user
, sizeof(filter
) );
1811 SAFE_FREE( escape_user
);
1813 rc
= smbldap_search_suffix(ldap_state
->smbldap_state
,
1814 filter
, attr_list
, &result
);
1815 if ( rc
!= LDAP_SUCCESS
) {
1816 free_attr_list( attr_list
);
1817 return NT_STATUS_UNSUCCESSFUL
;
1820 num_result
= ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
);
1822 if (num_result
> 1) {
1823 DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
1824 free_attr_list( attr_list
);
1825 ldap_msgfree(result
);
1826 return NT_STATUS_UNSUCCESSFUL
;
1829 /* Check if we need to update an existing entry */
1830 if (num_result
== 1) {
1833 DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
1834 ldap_op
= LDAP_MOD_REPLACE
;
1835 entry
= ldap_first_entry (ldap_state
->smbldap_state
->ldap_struct
, result
);
1836 tmp
= smbldap_get_dn (ldap_state
->smbldap_state
->ldap_struct
, entry
);
1838 free_attr_list( attr_list
);
1839 ldap_msgfree(result
);
1840 return NT_STATUS_UNSUCCESSFUL
;
1842 slprintf (dn
, sizeof (dn
) - 1, "%s", tmp
);
1845 } else if (ldap_state
->schema_ver
== SCHEMAVER_SAMBASAMACCOUNT
) {
1847 /* There might be a SID for this account already - say an idmap entry */
1849 pstr_sprintf(filter
, "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))",
1850 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_SID
),
1851 sid_to_string(sid_string
, sid
),
1852 LDAP_OBJ_IDMAP_ENTRY
,
1853 LDAP_OBJ_SID_ENTRY
);
1855 /* free old result before doing a new search */
1856 if (result
!= NULL
) {
1857 ldap_msgfree(result
);
1860 rc
= smbldap_search_suffix(ldap_state
->smbldap_state
,
1861 filter
, attr_list
, &result
);
1863 if ( rc
!= LDAP_SUCCESS
) {
1864 free_attr_list( attr_list
);
1865 return NT_STATUS_UNSUCCESSFUL
;
1868 num_result
= ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
);
1870 if (num_result
> 1) {
1871 DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
1872 free_attr_list( attr_list
);
1873 ldap_msgfree(result
);
1874 return NT_STATUS_UNSUCCESSFUL
;
1877 /* Check if we need to update an existing entry */
1878 if (num_result
== 1) {
1881 DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
1882 ldap_op
= LDAP_MOD_REPLACE
;
1883 entry
= ldap_first_entry (ldap_state
->smbldap_state
->ldap_struct
, result
);
1884 tmp
= smbldap_get_dn (ldap_state
->smbldap_state
->ldap_struct
, entry
);
1886 free_attr_list( attr_list
);
1887 ldap_msgfree(result
);
1888 return NT_STATUS_UNSUCCESSFUL
;
1890 slprintf (dn
, sizeof (dn
) - 1, "%s", tmp
);
1895 free_attr_list( attr_list
);
1897 if (num_result
== 0) {
1898 /* Check if we need to add an entry */
1899 DEBUG(3,("ldapsam_add_sam_account: Adding new user\n"));
1900 ldap_op
= LDAP_MOD_ADD
;
1901 if (username
[strlen(username
)-1] == '$') {
1902 slprintf (dn
, sizeof (dn
) - 1, "uid=%s,%s", username
, lp_ldap_machine_suffix ());
1904 slprintf (dn
, sizeof (dn
) - 1, "uid=%s,%s", username
, lp_ldap_user_suffix ());
1908 if (!init_ldap_from_sam(ldap_state
, entry
, &mods
, newpwd
,
1909 element_is_set_or_changed
)) {
1910 DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
1911 ldap_msgfree(result
);
1913 ldap_mods_free(mods
,True
);
1914 return NT_STATUS_UNSUCCESSFUL
;
1917 ldap_msgfree(result
);
1920 DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd
)));
1921 return NT_STATUS_UNSUCCESSFUL
;
1923 switch ( ldap_state
->schema_ver
) {
1924 case SCHEMAVER_SAMBAACCOUNT
:
1925 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectclass", LDAP_OBJ_SAMBAACCOUNT
);
1927 case SCHEMAVER_SAMBASAMACCOUNT
:
1928 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT
);
1931 DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n"));
1935 ret
= ldapsam_modify_entry(my_methods
,newpwd
,dn
,mods
,ldap_op
, element_is_set_or_changed
);
1936 if (!NT_STATUS_IS_OK(ret
)) {
1937 DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
1938 pdb_get_username(newpwd
),dn
));
1939 ldap_mods_free(mods
, True
);
1943 DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd
)));
1944 ldap_mods_free(mods
, True
);
1946 return NT_STATUS_OK
;
1949 /**********************************************************************
1950 *********************************************************************/
1952 static int ldapsam_search_one_group (struct ldapsam_privates
*ldap_state
,
1954 LDAPMessage
** result
)
1956 int scope
= LDAP_SCOPE_SUBTREE
;
1958 const char **attr_list
;
1960 attr_list
= get_attr_list(groupmap_attr_list
);
1961 rc
= smbldap_search(ldap_state
->smbldap_state
,
1962 lp_ldap_group_suffix (), scope
,
1963 filter
, attr_list
, 0, result
);
1964 free_attr_list( attr_list
);
1966 if (rc
!= LDAP_SUCCESS
) {
1967 char *ld_error
= NULL
;
1968 ldap_get_option(ldap_state
->smbldap_state
->ldap_struct
, LDAP_OPT_ERROR_STRING
,
1970 DEBUG(0, ("ldapsam_search_one_group: "
1971 "Problem during the LDAP search: LDAP error: %s (%s)\n",
1972 ld_error
?ld_error
:"(unknown)", ldap_err2string(rc
)));
1973 DEBUGADD(3, ("ldapsam_search_one_group: Query was: %s, %s\n",
1974 lp_ldap_group_suffix(), filter
));
1975 SAFE_FREE(ld_error
);
1981 /**********************************************************************
1982 *********************************************************************/
1984 static BOOL
init_group_from_ldap(struct ldapsam_privates
*ldap_state
,
1985 GROUP_MAP
*map
, LDAPMessage
*entry
)
1989 if (ldap_state
== NULL
|| map
== NULL
|| entry
== NULL
||
1990 ldap_state
->smbldap_state
->ldap_struct
== NULL
) {
1991 DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
1995 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
1996 get_attr_key2string(groupmap_attr_list
, LDAP_ATTR_GIDNUMBER
), temp
)) {
1997 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
1998 get_attr_key2string( groupmap_attr_list
, LDAP_ATTR_GIDNUMBER
)));
2001 DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp
));
2003 map
->gid
= (gid_t
)atol(temp
);
2005 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
2006 get_attr_key2string( groupmap_attr_list
, LDAP_ATTR_GROUP_SID
), temp
)) {
2007 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2008 get_attr_key2string( groupmap_attr_list
, LDAP_ATTR_GROUP_SID
)));
2012 if (!string_to_sid(&map
->sid
, temp
)) {
2013 DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp
));
2017 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
2018 get_attr_key2string( groupmap_attr_list
, LDAP_ATTR_GROUP_TYPE
), temp
)) {
2019 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2020 get_attr_key2string( groupmap_attr_list
, LDAP_ATTR_GROUP_TYPE
)));
2023 map
->sid_name_use
= (enum SID_NAME_USE
)atol(temp
);
2025 if ((map
->sid_name_use
< SID_NAME_USER
) ||
2026 (map
->sid_name_use
> SID_NAME_UNKNOWN
)) {
2027 DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map
->sid_name_use
));
2031 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
2032 get_attr_key2string( groupmap_attr_list
, LDAP_ATTR_DISPLAY_NAME
), temp
)) {
2034 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
2035 get_attr_key2string( groupmap_attr_list
, LDAP_ATTR_CN
), temp
))
2037 DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
2038 for gidNumber(%lu)\n",(unsigned long)map
->gid
));
2042 fstrcpy(map
->nt_name
, temp
);
2044 if (!smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
2045 get_attr_key2string( groupmap_attr_list
, LDAP_ATTR_DESC
), temp
)) {
2048 fstrcpy(map
->comment
, temp
);
2053 /**********************************************************************
2054 *********************************************************************/
2056 static BOOL
init_ldap_from_group(LDAP
*ldap_struct
,
2057 LDAPMessage
*existing
,
2059 const GROUP_MAP
*map
)
2063 if (mods
== NULL
|| map
== NULL
) {
2064 DEBUG(0, ("init_ldap_from_group: NULL parameters found!\n"));
2070 sid_to_string(tmp
, &map
->sid
);
2072 smbldap_make_mod(ldap_struct
, existing
, mods
,
2073 get_attr_key2string(groupmap_attr_list
, LDAP_ATTR_GROUP_SID
), tmp
);
2074 pstr_sprintf(tmp
, "%i", map
->sid_name_use
);
2075 smbldap_make_mod(ldap_struct
, existing
, mods
,
2076 get_attr_key2string(groupmap_attr_list
, LDAP_ATTR_GROUP_TYPE
), tmp
);
2078 smbldap_make_mod(ldap_struct
, existing
, mods
,
2079 get_attr_key2string( groupmap_attr_list
, LDAP_ATTR_DISPLAY_NAME
), map
->nt_name
);
2080 smbldap_make_mod(ldap_struct
, existing
, mods
,
2081 get_attr_key2string( groupmap_attr_list
, LDAP_ATTR_DESC
), map
->comment
);
2086 /**********************************************************************
2087 *********************************************************************/
2089 static NTSTATUS
ldapsam_getgroup(struct pdb_methods
*methods
,
2093 struct ldapsam_privates
*ldap_state
=
2094 (struct ldapsam_privates
*)methods
->private_data
;
2095 LDAPMessage
*result
= NULL
;
2096 LDAPMessage
*entry
= NULL
;
2099 if (ldapsam_search_one_group(ldap_state
, filter
, &result
)
2101 return NT_STATUS_NO_SUCH_GROUP
;
2104 count
= ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
);
2107 DEBUG(4, ("ldapsam_getgroup: Did not find group\n"));
2108 ldap_msgfree(result
);
2109 return NT_STATUS_NO_SUCH_GROUP
;
2113 DEBUG(1, ("ldapsam_getgroup: Duplicate entries for filter %s: count=%d\n",
2115 ldap_msgfree(result
);
2116 return NT_STATUS_NO_SUCH_GROUP
;
2119 entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
, result
);
2122 ldap_msgfree(result
);
2123 return NT_STATUS_UNSUCCESSFUL
;
2126 if (!init_group_from_ldap(ldap_state
, map
, entry
)) {
2127 DEBUG(1, ("ldapsam_getgroup: init_group_from_ldap failed for group filter %s\n",
2129 ldap_msgfree(result
);
2130 return NT_STATUS_NO_SUCH_GROUP
;
2133 ldap_msgfree(result
);
2134 return NT_STATUS_OK
;
2137 /**********************************************************************
2138 *********************************************************************/
2140 static NTSTATUS
ldapsam_getgrsid(struct pdb_methods
*methods
, GROUP_MAP
*map
,
2145 pstr_sprintf(filter
, "(&(objectClass=%s)(%s=%s))",
2147 get_attr_key2string(groupmap_attr_list
, LDAP_ATTR_GROUP_SID
),
2148 sid_string_static(&sid
));
2150 return ldapsam_getgroup(methods
, filter
, map
);
2153 /**********************************************************************
2154 *********************************************************************/
2156 static NTSTATUS
ldapsam_getgrgid(struct pdb_methods
*methods
, GROUP_MAP
*map
,
2161 pstr_sprintf(filter
, "(&(objectClass=%s)(%s=%d))",
2163 get_attr_key2string(groupmap_attr_list
, LDAP_ATTR_GIDNUMBER
),
2166 return ldapsam_getgroup(methods
, filter
, map
);
2169 /**********************************************************************
2170 *********************************************************************/
2172 static NTSTATUS
ldapsam_getgrnam(struct pdb_methods
*methods
, GROUP_MAP
*map
,
2176 char *escape_name
= escape_ldap_string_alloc(name
);
2179 return NT_STATUS_NO_MEMORY
;
2182 pstr_sprintf(filter
, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
2184 get_attr_key2string(groupmap_attr_list
, LDAP_ATTR_DISPLAY_NAME
), escape_name
,
2185 get_attr_key2string(groupmap_attr_list
, LDAP_ATTR_CN
), escape_name
);
2187 SAFE_FREE(escape_name
);
2189 return ldapsam_getgroup(methods
, filter
, map
);
2192 static void add_rid_to_array_unique(TALLOC_CTX
*mem_ctx
,
2193 uint32 rid
, uint32
**rids
, int *num
)
2197 for (i
=0; i
<*num
; i
++) {
2198 if ((*rids
)[i
] == rid
)
2202 *rids
= TALLOC_REALLOC_ARRAY(mem_ctx
, *rids
, uint32
, *num
+1);
2207 (*rids
)[*num
] = rid
;
2211 static BOOL
ldapsam_extract_rid_from_entry(LDAP
*ldap_struct
,
2213 const DOM_SID
*domain_sid
,
2219 if (!smbldap_get_single_attribute(ldap_struct
, entry
, "sambaSID",
2220 str
, sizeof(str
)-1)) {
2221 DEBUG(10, ("Could not find sambaSID attribute\n"));
2225 if (!string_to_sid(&sid
, str
)) {
2226 DEBUG(10, ("Could not convert string %s to sid\n", str
));
2230 if (sid_compare_domain(&sid
, domain_sid
) != 0) {
2231 DEBUG(10, ("SID %s is not in expected domain %s\n",
2232 str
, sid_string_static(domain_sid
)));
2236 if (!sid_peek_rid(&sid
, rid
)) {
2237 DEBUG(10, ("Could not peek into RID\n"));
2244 static NTSTATUS
ldapsam_enum_group_members(struct pdb_methods
*methods
,
2245 TALLOC_CTX
*mem_ctx
,
2246 const DOM_SID
*group
,
2247 uint32
**member_rids
,
2250 struct ldapsam_privates
*ldap_state
=
2251 (struct ldapsam_privates
*)methods
->private_data
;
2252 struct smbldap_state
*conn
= ldap_state
->smbldap_state
;
2255 LDAPMessage
*msg
= NULL
;
2257 char **values
= NULL
;
2259 char *sid_filter
= NULL
;
2261 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
2263 if (!lp_parm_bool(-1, "ldapsam", "trusted", False
))
2264 return pdb_default_enum_group_members(methods
, mem_ctx
, group
,
2268 *member_rids
= NULL
;
2271 pstr_sprintf(filter
,
2272 "(&(objectClass=sambaSamAccount)"
2273 "(sambaPrimaryGroupSid=%s))",
2274 sid_string_static(group
));
2277 const char *attrs
[] = { "sambaSID", NULL
};
2278 rc
= smbldap_search(conn
, lp_ldap_user_suffix(),
2279 LDAP_SCOPE_SUBTREE
, filter
, attrs
, 0,
2283 if (rc
!= LDAP_SUCCESS
)
2286 for (entry
= ldap_first_entry(conn
->ldap_struct
, msg
);
2288 entry
= ldap_next_entry(conn
->ldap_struct
, entry
))
2292 if (!ldapsam_extract_rid_from_entry(conn
->ldap_struct
,
2294 get_global_sam_sid(),
2296 DEBUG(2, ("Could not find sid from ldap entry\n"));
2300 add_rid_to_array_unique(mem_ctx
, rid
, member_rids
,
2307 pstr_sprintf(filter
,
2308 "(&(objectClass=sambaGroupMapping)"
2309 "(objectClass=posixGroup)"
2311 sid_string_static(group
));
2314 const char *attrs
[] = { "memberUid", NULL
};
2315 rc
= smbldap_search(conn
, lp_ldap_group_suffix(),
2316 LDAP_SCOPE_SUBTREE
, filter
, attrs
, 0,
2320 if (rc
!= LDAP_SUCCESS
)
2323 count
= ldap_count_entries(conn
->ldap_struct
, msg
);
2326 DEBUG(1, ("Found more than one groupmap entry for %s\n",
2327 sid_string_static(group
)));
2332 result
= NT_STATUS_OK
;
2336 entry
= ldap_first_entry(conn
->ldap_struct
, msg
);
2340 values
= ldap_get_values(conn
->ldap_struct
, msg
, "memberUid");
2341 if (values
== NULL
) {
2342 result
= NT_STATUS_OK
;
2346 sid_filter
= SMB_STRDUP("(&(objectClass=sambaSamAccount)(|");
2347 if (sid_filter
== NULL
) {
2348 result
= NT_STATUS_NO_MEMORY
;
2352 for (memberuid
= values
; *memberuid
!= NULL
; memberuid
+= 1) {
2354 asprintf(&sid_filter
, "%s(uid=%s)", tmp
, *memberuid
);
2356 if (sid_filter
== NULL
) {
2357 result
= NT_STATUS_NO_MEMORY
;
2363 asprintf(&sid_filter
, "%s))", sid_filter
);
2365 if (sid_filter
== NULL
) {
2366 result
= NT_STATUS_NO_MEMORY
;
2371 const char *attrs
[] = { "sambaSID", NULL
};
2372 rc
= smbldap_search(conn
, lp_ldap_user_suffix(),
2373 LDAP_SCOPE_SUBTREE
, sid_filter
, attrs
, 0,
2377 if (rc
!= LDAP_SUCCESS
)
2380 for (entry
= ldap_first_entry(conn
->ldap_struct
, msg
);
2382 entry
= ldap_next_entry(conn
->ldap_struct
, entry
))
2388 if (!smbldap_get_single_attribute(conn
->ldap_struct
,
2390 str
, sizeof(str
)-1))
2393 if (!string_to_sid(&sid
, str
))
2396 if (!sid_check_is_in_our_domain(&sid
)) {
2397 DEBUG(1, ("Inconsistent SAM -- group member uid not "
2398 "in our domain\n"));
2402 sid_peek_rid(&sid
, &rid
);
2404 add_rid_to_array_unique(mem_ctx
, rid
, member_rids
,
2408 result
= NT_STATUS_OK
;
2411 SAFE_FREE(sid_filter
);
2414 ldap_value_free(values
);
2422 static NTSTATUS
ldapsam_enum_group_memberships(struct pdb_methods
*methods
,
2423 const char *username
,
2425 DOM_SID
**sids
, gid_t
**gids
,
2428 struct ldapsam_privates
*ldap_state
=
2429 (struct ldapsam_privates
*)methods
->private_data
;
2430 struct smbldap_state
*conn
= ldap_state
->smbldap_state
;
2432 const char *attrs
[] = { "gidNumber", "sambaSID", NULL
};
2435 LDAPMessage
*msg
= NULL
;
2437 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
2438 int num_sids
, num_gids
;
2440 if (!lp_parm_bool(-1, "ldapsam", "trusted", False
))
2441 return pdb_default_enum_group_memberships(methods
, username
,
2448 escape_name
= escape_ldap_string_alloc(username
);
2450 if (escape_name
== NULL
)
2451 return NT_STATUS_NO_MEMORY
;
2453 pstr_sprintf(filter
, "(&(objectClass=posixGroup)"
2454 "(|(memberUid=%s)(gidNumber=%d)))",
2455 username
, primary_gid
);
2457 rc
= smbldap_search(conn
, lp_ldap_group_suffix(),
2458 LDAP_SCOPE_SUBTREE
, filter
, attrs
, 0, &msg
);
2460 if (rc
!= LDAP_SUCCESS
)
2469 /* We need to add the primary group as the first gid/sid */
2471 add_gid_to_array_unique(NULL
, primary_gid
, gids
, &num_gids
);
2473 /* This sid will be replaced later */
2475 add_sid_to_array_unique(NULL
, &global_sid_NULL
, sids
, &num_sids
);
2477 for (entry
= ldap_first_entry(conn
->ldap_struct
, msg
);
2479 entry
= ldap_next_entry(conn
->ldap_struct
, entry
))
2486 if (!smbldap_get_single_attribute(conn
->ldap_struct
,
2488 str
, sizeof(str
)-1))
2491 if (!string_to_sid(&sid
, str
))
2494 if (!smbldap_get_single_attribute(conn
->ldap_struct
,
2496 str
, sizeof(str
)-1))
2499 gid
= strtoul(str
, &end
, 10);
2501 if (PTR_DIFF(end
, str
) != strlen(str
))
2504 if (gid
== primary_gid
) {
2505 sid_copy(&(*sids
)[0], &sid
);
2507 add_gid_to_array_unique(NULL
, gid
, gids
, &num_gids
);
2508 add_sid_to_array_unique(NULL
, &sid
, sids
, &num_sids
);
2512 if (sid_compare(&global_sid_NULL
, &(*sids
)[0]) == 0) {
2513 DEBUG(3, ("primary group of [%s] not found\n", username
));
2517 *num_groups
= num_sids
;
2519 result
= NT_STATUS_OK
;
2523 SAFE_FREE(escape_name
);
2530 /**********************************************************************
2531 *********************************************************************/
2533 static int ldapsam_search_one_group_by_gid(struct ldapsam_privates
*ldap_state
,
2535 LDAPMessage
**result
)
2539 pstr_sprintf(filter
, "(&(|(objectClass=%s)(objectclass=%s))(%s=%d))",
2540 LDAP_OBJ_POSIXGROUP
, LDAP_OBJ_IDMAP_ENTRY
,
2541 get_attr_key2string(groupmap_attr_list
, LDAP_ATTR_GIDNUMBER
),
2544 return ldapsam_search_one_group(ldap_state
, filter
, result
);
2547 /**********************************************************************
2548 *********************************************************************/
2550 static NTSTATUS
ldapsam_add_group_mapping_entry(struct pdb_methods
*methods
,
2553 struct ldapsam_privates
*ldap_state
=
2554 (struct ldapsam_privates
*)methods
->private_data
;
2555 LDAPMessage
*result
= NULL
;
2556 LDAPMod
**mods
= NULL
;
2567 if (NT_STATUS_IS_OK(ldapsam_getgrgid(methods
, &dummy
,
2569 DEBUG(0, ("ldapsam_add_group_mapping_entry: Group %ld already exists in LDAP\n", (unsigned long)map
->gid
));
2570 return NT_STATUS_UNSUCCESSFUL
;
2573 rc
= ldapsam_search_one_group_by_gid(ldap_state
, map
->gid
, &result
);
2574 if (rc
!= LDAP_SUCCESS
) {
2575 ldap_msgfree(result
);
2576 return NT_STATUS_UNSUCCESSFUL
;
2579 count
= ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
);
2582 /* There's no posixGroup account, let's try to find an
2583 * appropriate idmap entry for aliases */
2587 const char **attr_list
;
2589 ldap_msgfree(result
);
2591 pstrcpy( suffix
, lp_ldap_idmap_suffix() );
2592 pstr_sprintf(filter
, "(&(objectClass=%s)(%s=%d))",
2593 LDAP_OBJ_IDMAP_ENTRY
, LDAP_ATTRIBUTE_GIDNUMBER
,
2596 attr_list
= get_attr_list( sidmap_attr_list
);
2597 rc
= smbldap_search(ldap_state
->smbldap_state
, suffix
,
2598 LDAP_SCOPE_SUBTREE
, filter
, attr_list
,
2601 free_attr_list(attr_list
);
2603 if (rc
!= LDAP_SUCCESS
) {
2604 DEBUG(3,("Failure looking up entry (%s)\n",
2605 ldap_err2string(rc
) ));
2606 ldap_msgfree(result
);
2607 return NT_STATUS_UNSUCCESSFUL
;
2611 count
= ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
);
2613 ldap_msgfree(result
);
2614 return NT_STATUS_UNSUCCESSFUL
;
2618 DEBUG(2, ("ldapsam_add_group_mapping_entry: Group %lu must exist exactly once in LDAP\n",
2619 (unsigned long)map
->gid
));
2620 ldap_msgfree(result
);
2621 return NT_STATUS_UNSUCCESSFUL
;
2624 entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
, result
);
2625 tmp
= smbldap_get_dn(ldap_state
->smbldap_state
->ldap_struct
, entry
);
2627 ldap_msgfree(result
);
2628 return NT_STATUS_UNSUCCESSFUL
;
2633 if (!init_ldap_from_group(ldap_state
->smbldap_state
->ldap_struct
,
2634 result
, &mods
, map
)) {
2635 DEBUG(0, ("ldapsam_add_group_mapping_entry: init_ldap_from_group failed!\n"));
2636 ldap_mods_free(mods
, True
);
2637 ldap_msgfree(result
);
2638 return NT_STATUS_UNSUCCESSFUL
;
2641 ldap_msgfree(result
);
2644 DEBUG(0, ("ldapsam_add_group_mapping_entry: mods is empty\n"));
2645 return NT_STATUS_UNSUCCESSFUL
;
2648 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectClass", LDAP_OBJ_GROUPMAP
);
2650 rc
= smbldap_modify(ldap_state
->smbldap_state
, dn
, mods
);
2651 ldap_mods_free(mods
, True
);
2653 if (rc
!= LDAP_SUCCESS
) {
2654 char *ld_error
= NULL
;
2655 ldap_get_option(ldap_state
->smbldap_state
->ldap_struct
, LDAP_OPT_ERROR_STRING
,
2657 DEBUG(0, ("ldapsam_add_group_mapping_entry: failed to add group %lu error: %s (%s)\n", (unsigned long)map
->gid
,
2658 ld_error
? ld_error
: "(unknown)", ldap_err2string(rc
)));
2659 SAFE_FREE(ld_error
);
2660 return NT_STATUS_UNSUCCESSFUL
;
2663 DEBUG(2, ("ldapsam_add_group_mapping_entry: successfully modified group %lu in LDAP\n", (unsigned long)map
->gid
));
2664 return NT_STATUS_OK
;
2667 /**********************************************************************
2668 *********************************************************************/
2670 static NTSTATUS
ldapsam_update_group_mapping_entry(struct pdb_methods
*methods
,
2673 struct ldapsam_privates
*ldap_state
=
2674 (struct ldapsam_privates
*)methods
->private_data
;
2677 LDAPMessage
*result
= NULL
;
2678 LDAPMessage
*entry
= NULL
;
2679 LDAPMod
**mods
= NULL
;
2681 rc
= ldapsam_search_one_group_by_gid(ldap_state
, map
->gid
, &result
);
2683 if (rc
!= LDAP_SUCCESS
) {
2684 return NT_STATUS_UNSUCCESSFUL
;
2687 if (ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
, result
) == 0) {
2688 DEBUG(0, ("ldapsam_update_group_mapping_entry: No group to modify!\n"));
2689 ldap_msgfree(result
);
2690 return NT_STATUS_UNSUCCESSFUL
;
2693 entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
, result
);
2695 if (!init_ldap_from_group(ldap_state
->smbldap_state
->ldap_struct
,
2696 result
, &mods
, map
)) {
2697 DEBUG(0, ("ldapsam_update_group_mapping_entry: init_ldap_from_group failed\n"));
2698 ldap_msgfree(result
);
2700 ldap_mods_free(mods
,True
);
2701 return NT_STATUS_UNSUCCESSFUL
;
2705 DEBUG(4, ("ldapsam_update_group_mapping_entry: mods is empty: nothing to do\n"));
2706 ldap_msgfree(result
);
2707 return NT_STATUS_OK
;
2710 dn
= smbldap_get_dn(ldap_state
->smbldap_state
->ldap_struct
, entry
);
2712 ldap_msgfree(result
);
2713 return NT_STATUS_UNSUCCESSFUL
;
2715 rc
= smbldap_modify(ldap_state
->smbldap_state
, dn
, mods
);
2718 ldap_mods_free(mods
, True
);
2719 ldap_msgfree(result
);
2721 if (rc
!= LDAP_SUCCESS
) {
2722 char *ld_error
= NULL
;
2723 ldap_get_option(ldap_state
->smbldap_state
->ldap_struct
, LDAP_OPT_ERROR_STRING
,
2725 DEBUG(0, ("ldapsam_update_group_mapping_entry: failed to modify group %lu error: %s (%s)\n", (unsigned long)map
->gid
,
2726 ld_error
? ld_error
: "(unknown)", ldap_err2string(rc
)));
2727 SAFE_FREE(ld_error
);
2728 return NT_STATUS_UNSUCCESSFUL
;
2731 DEBUG(2, ("ldapsam_update_group_mapping_entry: successfully modified group %lu in LDAP\n", (unsigned long)map
->gid
));
2732 return NT_STATUS_OK
;
2735 /**********************************************************************
2736 *********************************************************************/
2738 static NTSTATUS
ldapsam_delete_group_mapping_entry(struct pdb_methods
*methods
,
2741 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)methods
->private_data
;
2742 pstring sidstring
, filter
;
2743 LDAPMessage
*result
= NULL
;
2746 const char **attr_list
;
2748 sid_to_string(sidstring
, &sid
);
2750 pstr_sprintf(filter
, "(&(objectClass=%s)(%s=%s))",
2751 LDAP_OBJ_GROUPMAP
, LDAP_ATTRIBUTE_SID
, sidstring
);
2753 rc
= ldapsam_search_one_group(ldap_state
, filter
, &result
);
2755 if (rc
!= LDAP_SUCCESS
) {
2756 return NT_STATUS_NO_SUCH_GROUP
;
2759 attr_list
= get_attr_list( groupmap_attr_list_to_delete
);
2760 ret
= ldapsam_delete_entry(ldap_state
, result
, LDAP_OBJ_GROUPMAP
, attr_list
);
2761 free_attr_list ( attr_list
);
2763 ldap_msgfree(result
);
2768 /**********************************************************************
2769 *********************************************************************/
2771 static NTSTATUS
ldapsam_setsamgrent(struct pdb_methods
*my_methods
, BOOL update
)
2773 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
2776 const char **attr_list
;
2778 pstr_sprintf( filter
, "(objectclass=%s)", LDAP_OBJ_GROUPMAP
);
2779 attr_list
= get_attr_list( groupmap_attr_list
);
2780 rc
= smbldap_search(ldap_state
->smbldap_state
, lp_ldap_group_suffix(),
2781 LDAP_SCOPE_SUBTREE
, filter
,
2782 attr_list
, 0, &ldap_state
->result
);
2783 free_attr_list( attr_list
);
2785 if (rc
!= LDAP_SUCCESS
) {
2786 DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n", ldap_err2string(rc
)));
2787 DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n", lp_ldap_group_suffix(), filter
));
2788 ldap_msgfree(ldap_state
->result
);
2789 ldap_state
->result
= NULL
;
2790 return NT_STATUS_UNSUCCESSFUL
;
2793 DEBUG(2, ("ldapsam_setsamgrent: %d entries in the base!\n",
2794 ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
,
2795 ldap_state
->result
)));
2797 ldap_state
->entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
, ldap_state
->result
);
2798 ldap_state
->index
= 0;
2800 return NT_STATUS_OK
;
2803 /**********************************************************************
2804 *********************************************************************/
2806 static void ldapsam_endsamgrent(struct pdb_methods
*my_methods
)
2808 ldapsam_endsampwent(my_methods
);
2811 /**********************************************************************
2812 *********************************************************************/
2814 static NTSTATUS
ldapsam_getsamgrent(struct pdb_methods
*my_methods
,
2817 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
2818 struct ldapsam_privates
*ldap_state
= (struct ldapsam_privates
*)my_methods
->private_data
;
2822 if (!ldap_state
->entry
)
2825 ldap_state
->index
++;
2826 bret
= init_group_from_ldap(ldap_state
, map
, ldap_state
->entry
);
2828 ldap_state
->entry
= ldap_next_entry(ldap_state
->smbldap_state
->ldap_struct
,
2832 return NT_STATUS_OK
;
2835 /**********************************************************************
2836 *********************************************************************/
2838 static NTSTATUS
ldapsam_enum_group_mapping(struct pdb_methods
*methods
,
2839 enum SID_NAME_USE sid_name_use
,
2840 GROUP_MAP
**rmap
, int *num_entries
,
2850 if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods
, False
))) {
2851 DEBUG(0, ("ldapsam_enum_group_mapping: Unable to open passdb\n"));
2852 return NT_STATUS_ACCESS_DENIED
;
2855 while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods
, &map
))) {
2856 if (sid_name_use
!= SID_NAME_UNKNOWN
&&
2857 sid_name_use
!= map
.sid_name_use
) {
2858 DEBUG(11,("ldapsam_enum_group_mapping: group %s is not of the requested type\n", map
.nt_name
));
2861 if (unix_only
==ENUM_ONLY_MAPPED
&& map
.gid
==-1) {
2862 DEBUG(11,("ldapsam_enum_group_mapping: group %s is non mapped\n", map
.nt_name
));
2866 mapt
=SMB_REALLOC_ARRAY((*rmap
), GROUP_MAP
, entries
+1);
2868 DEBUG(0,("ldapsam_enum_group_mapping: Unable to enlarge group map!\n"));
2870 return NT_STATUS_UNSUCCESSFUL
;
2875 mapt
[entries
] = map
;
2880 ldapsam_endsamgrent(methods
);
2882 *num_entries
= entries
;
2884 return NT_STATUS_OK
;
2887 static NTSTATUS
ldapsam_modify_aliasmem(struct pdb_methods
*methods
,
2888 const DOM_SID
*alias
,
2889 const DOM_SID
*member
,
2892 struct ldapsam_privates
*ldap_state
=
2893 (struct ldapsam_privates
*)methods
->private_data
;
2895 LDAPMessage
*result
= NULL
;
2896 LDAPMessage
*entry
= NULL
;
2898 LDAPMod
**mods
= NULL
;
2903 pstr_sprintf(filter
, "(&(|(objectClass=%s)(objectclass=%s))(%s=%s))",
2904 LDAP_OBJ_GROUPMAP
, LDAP_OBJ_IDMAP_ENTRY
,
2905 get_attr_key2string(groupmap_attr_list
,
2906 LDAP_ATTR_GROUP_SID
),
2907 sid_string_static(alias
));
2909 if (ldapsam_search_one_group(ldap_state
, filter
,
2910 &result
) != LDAP_SUCCESS
)
2911 return NT_STATUS_NO_SUCH_ALIAS
;
2913 count
= ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
,
2917 DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
2918 ldap_msgfree(result
);
2919 return NT_STATUS_NO_SUCH_ALIAS
;
2923 DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for filter %s: "
2924 "count=%d\n", filter
, count
));
2925 ldap_msgfree(result
);
2926 return NT_STATUS_NO_SUCH_ALIAS
;
2929 entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
,
2933 ldap_msgfree(result
);
2934 return NT_STATUS_UNSUCCESSFUL
;
2937 dn
= smbldap_get_dn(ldap_state
->smbldap_state
->ldap_struct
, entry
);
2939 ldap_msgfree(result
);
2940 return NT_STATUS_UNSUCCESSFUL
;
2943 smbldap_set_mod(&mods
, modop
,
2944 get_attr_key2string(groupmap_attr_list
,
2945 LDAP_ATTR_SID_LIST
),
2946 sid_string_static(member
));
2948 rc
= smbldap_modify(ldap_state
->smbldap_state
, dn
, mods
);
2950 ldap_mods_free(mods
, True
);
2951 ldap_msgfree(result
);
2953 if (rc
!= LDAP_SUCCESS
) {
2954 char *ld_error
= NULL
;
2955 ldap_get_option(ldap_state
->smbldap_state
->ldap_struct
,
2956 LDAP_OPT_ERROR_STRING
,&ld_error
);
2958 DEBUG(0, ("ldapsam_modify_aliasmem: Could not modify alias "
2959 "for %s, error: %s (%s)\n", dn
, ldap_err2string(rc
),
2960 ld_error
?ld_error
:"unknown"));
2961 SAFE_FREE(ld_error
);
2963 return NT_STATUS_UNSUCCESSFUL
;
2968 return NT_STATUS_OK
;
2971 static NTSTATUS
ldapsam_add_aliasmem(struct pdb_methods
*methods
,
2972 const DOM_SID
*alias
,
2973 const DOM_SID
*member
)
2975 return ldapsam_modify_aliasmem(methods
, alias
, member
, LDAP_MOD_ADD
);
2978 static NTSTATUS
ldapsam_del_aliasmem(struct pdb_methods
*methods
,
2979 const DOM_SID
*alias
,
2980 const DOM_SID
*member
)
2982 return ldapsam_modify_aliasmem(methods
, alias
, member
,
2986 static NTSTATUS
ldapsam_enum_aliasmem(struct pdb_methods
*methods
,
2987 const DOM_SID
*alias
, DOM_SID
**members
,
2990 struct ldapsam_privates
*ldap_state
=
2991 (struct ldapsam_privates
*)methods
->private_data
;
2992 LDAPMessage
*result
= NULL
;
2993 LDAPMessage
*entry
= NULL
;
3002 pstr_sprintf(filter
, "(&(|(objectClass=%s)(objectclass=%s))(%s=%s))",
3003 LDAP_OBJ_GROUPMAP
, LDAP_OBJ_IDMAP_ENTRY
,
3004 get_attr_key2string(groupmap_attr_list
,
3005 LDAP_ATTR_GROUP_SID
),
3006 sid_string_static(alias
));
3008 if (ldapsam_search_one_group(ldap_state
, filter
,
3009 &result
) != LDAP_SUCCESS
)
3010 return NT_STATUS_NO_SUCH_ALIAS
;
3012 count
= ldap_count_entries(ldap_state
->smbldap_state
->ldap_struct
,
3016 DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
3017 ldap_msgfree(result
);
3018 return NT_STATUS_NO_SUCH_ALIAS
;
3022 DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for filter %s: "
3023 "count=%d\n", filter
, count
));
3024 ldap_msgfree(result
);
3025 return NT_STATUS_NO_SUCH_ALIAS
;
3028 entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
,
3032 ldap_msgfree(result
);
3033 return NT_STATUS_UNSUCCESSFUL
;
3036 values
= ldap_get_values(ldap_state
->smbldap_state
->ldap_struct
,
3038 get_attr_key2string(groupmap_attr_list
,
3039 LDAP_ATTR_SID_LIST
));
3041 if (values
== NULL
) {
3042 ldap_msgfree(result
);
3043 return NT_STATUS_OK
;
3046 count
= ldap_count_values(values
);
3048 for (i
=0; i
<count
; i
++) {
3051 if (!string_to_sid(&member
, values
[i
]))
3054 add_sid_to_array(NULL
, &member
, members
, num_members
);
3057 ldap_value_free(values
);
3058 ldap_msgfree(result
);
3060 return NT_STATUS_OK
;
3063 static NTSTATUS
ldapsam_alias_memberships(struct pdb_methods
*methods
,
3064 TALLOC_CTX
*mem_ctx
,
3065 const DOM_SID
*domain_sid
,
3066 const DOM_SID
*members
,
3068 uint32
**alias_rids
,
3069 int *num_alias_rids
)
3071 struct ldapsam_privates
*ldap_state
=
3072 (struct ldapsam_privates
*)methods
->private_data
;
3075 const char *attrs
[] = { LDAP_ATTRIBUTE_SID
, NULL
};
3077 LDAPMessage
*result
= NULL
;
3078 LDAPMessage
*entry
= NULL
;
3083 /* This query could be further optimized by adding a
3084 (&(sambaSID=<domain-sid>*)) so that only those aliases that are
3085 asked for in the getuseraliases are returned. */
3087 filter
= talloc_asprintf(mem_ctx
,
3088 "(&(|(objectclass=%s)(objectclass=%s))(|",
3089 LDAP_OBJ_GROUPMAP
, LDAP_OBJ_IDMAP_ENTRY
);
3091 for (i
=0; i
<num_members
; i
++)
3092 filter
= talloc_asprintf(mem_ctx
, "%s(sambaSIDList=%s)",
3094 sid_string_static(&members
[i
]));
3096 filter
= talloc_asprintf(mem_ctx
, "%s))", filter
);
3098 rc
= smbldap_search(ldap_state
->smbldap_state
, lp_ldap_group_suffix(),
3099 LDAP_SCOPE_SUBTREE
, filter
, attrs
, 0, &result
);
3101 if (rc
!= LDAP_SUCCESS
)
3102 return NT_STATUS_UNSUCCESSFUL
;
3104 ldap_struct
= ldap_state
->smbldap_state
->ldap_struct
;
3106 for (entry
= ldap_first_entry(ldap_struct
, result
);
3108 entry
= ldap_next_entry(ldap_struct
, entry
))
3114 if (!smbldap_get_single_attribute(ldap_struct
, entry
,
3120 if (!string_to_sid(&sid
, sid_str
))
3123 if (!sid_peek_check_rid(domain_sid
, &sid
, &rid
))
3126 add_rid_to_array_unique(mem_ctx
, rid
, alias_rids
,
3130 ldap_msgfree(result
);
3131 return NT_STATUS_OK
;
3134 static NTSTATUS
ldapsam_lookup_rids(struct pdb_methods
*methods
,
3135 TALLOC_CTX
*mem_ctx
,
3136 const DOM_SID
*domain_sid
,
3139 const char ***names
,
3142 struct ldapsam_privates
*ldap_state
=
3143 (struct ldapsam_privates
*)methods
->private_data
;
3144 LDAP
*ldap_struct
= ldap_state
->smbldap_state
->ldap_struct
;
3145 LDAPMessage
*msg
= NULL
;
3147 char *allsids
= NULL
;
3149 int i
, rc
, num_mapped
;
3150 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
3152 if (!lp_parm_bool(-1, "ldapsam", "trusted", False
))
3153 return pdb_default_lookup_rids(methods
, mem_ctx
, domain_sid
,
3154 num_rids
, rids
, names
, attrs
);
3156 if (!sid_equal(domain_sid
, get_global_sam_sid())) {
3157 /* TODO: Sooner or later we need to look up BUILTIN rids as
3162 (*names
) = TALLOC_ZERO_ARRAY(mem_ctx
, const char *, num_rids
);
3163 (*attrs
) = TALLOC_ARRAY(mem_ctx
, uint32
, num_rids
);
3165 if ((num_rids
!= 0) && (((*names
) == NULL
) || ((*attrs
) == NULL
)))
3166 return NT_STATUS_NO_MEMORY
;
3168 for (i
=0; i
<num_rids
; i
++)
3169 (*attrs
)[i
] = SID_NAME_UNKNOWN
;
3171 allsids
= SMB_STRDUP("");
3172 if (allsids
== NULL
) return NT_STATUS_NO_MEMORY
;
3174 for (i
=0; i
<num_rids
; i
++) {
3176 sid_copy(&sid
, domain_sid
);
3177 sid_append_rid(&sid
, rids
[i
]);
3179 asprintf(&allsids
, "%s(sambaSid=%s)", allsids
,
3180 sid_string_static(&sid
));
3181 if (allsids
== NULL
) return NT_STATUS_NO_MEMORY
;
3185 /* First look for users */
3189 const char *ldap_attrs
[] = { "uid", "sambaSid", NULL
};
3191 asprintf(&filter
, ("(&(objectClass=sambaSamAccount)(|%s))"),
3193 if (filter
== NULL
) return NT_STATUS_NO_MEMORY
;
3195 rc
= smbldap_search(ldap_state
->smbldap_state
,
3196 lp_ldap_user_suffix(),
3197 LDAP_SCOPE_SUBTREE
, filter
, ldap_attrs
, 0,
3203 if (rc
!= LDAP_SUCCESS
)
3208 for (entry
= ldap_first_entry(ldap_struct
, msg
);
3210 entry
= ldap_next_entry(ldap_struct
, entry
))
3216 if (!ldapsam_extract_rid_from_entry(ldap_struct
, entry
,
3217 get_global_sam_sid(),
3219 DEBUG(2, ("Could not find sid from ldap entry\n"));
3223 if (!smbldap_get_single_attribute(ldap_struct
, entry
,
3224 "uid", str
, sizeof(str
)-1)) {
3225 DEBUG(2, ("Could not retrieve uid attribute\n"));
3229 for (rid_index
= 0; rid_index
< num_rids
; rid_index
++) {
3230 if (rid
== rids
[rid_index
])
3234 if (rid_index
== num_rids
) {
3235 DEBUG(2, ("Got a RID not asked for: %d\n", rid
));
3239 (*attrs
)[rid_index
] = SID_NAME_USER
;
3240 (*names
)[rid_index
] = talloc_strdup(mem_ctx
, str
);
3241 if ((*names
)[rid_index
] == NULL
) return NT_STATUS_NO_MEMORY
;
3246 if (num_mapped
== num_rids
) {
3247 /* No need to look for groups anymore -- we're done */
3248 result
= NT_STATUS_OK
;
3252 /* Same game for groups */
3256 const char *ldap_attrs
[] = { "cn", "sambaSid", NULL
};
3258 asprintf(&filter
, ("(&(objectClass=sambaGroupMapping)(|%s))"),
3260 if (filter
== NULL
) return NT_STATUS_NO_MEMORY
;
3262 rc
= smbldap_search(ldap_state
->smbldap_state
,
3263 lp_ldap_group_suffix(),
3264 LDAP_SCOPE_SUBTREE
, filter
, ldap_attrs
, 0,
3270 if (rc
!= LDAP_SUCCESS
)
3273 for (entry
= ldap_first_entry(ldap_struct
, msg
);
3275 entry
= ldap_next_entry(ldap_struct
, entry
))
3281 if (!ldapsam_extract_rid_from_entry(ldap_struct
, entry
,
3282 get_global_sam_sid(),
3284 DEBUG(2, ("Could not find sid from ldap entry\n"));
3288 if (!smbldap_get_single_attribute(ldap_struct
, entry
,
3289 "cn", str
, sizeof(str
)-1)) {
3290 DEBUG(2, ("Could not retrieve cn attribute\n"));
3294 for (rid_index
= 0; rid_index
< num_rids
; rid_index
++) {
3295 if (rid
== rids
[rid_index
])
3299 if (rid_index
== num_rids
) {
3300 DEBUG(2, ("Got a RID not asked for: %d\n", rid
));
3304 (*attrs
)[rid_index
] = SID_NAME_DOM_GRP
;
3305 (*names
)[rid_index
] = talloc_strdup(mem_ctx
, str
);
3306 if ((*names
)[rid_index
] == NULL
) return NT_STATUS_NO_MEMORY
;
3310 result
= NT_STATUS_NONE_MAPPED
;
3313 result
= (num_mapped
== num_rids
) ?
3314 NT_STATUS_OK
: STATUS_SOME_UNMAPPED
;
3324 char *get_ldap_filter(TALLOC_CTX
*mem_ctx
, const char *username
)
3326 char *filter
= NULL
;
3327 char *escaped
= NULL
;
3328 char *result
= NULL
;
3330 asprintf(&filter
, "(&%s(objectclass=sambaSamAccount))",
3332 if (filter
== NULL
) goto done
;
3334 escaped
= escape_ldap_string_alloc(username
);
3335 if (escaped
== NULL
) goto done
;
3337 filter
= realloc_string_sub(filter
, "%u", username
);
3338 result
= talloc_strdup(mem_ctx
, filter
);
3347 const char **talloc_attrs(TALLOC_CTX
*mem_ctx
, ...)
3351 const char **result
;
3353 va_start(ap
, mem_ctx
);
3354 while (va_arg(ap
, const char *) != NULL
)
3358 result
= TALLOC_ARRAY(mem_ctx
, const char *, num
+1);
3360 va_start(ap
, mem_ctx
);
3361 for (i
=0; i
<num
; i
++)
3362 result
[i
] = talloc_strdup(mem_ctx
, va_arg(ap
, const char*));
3369 struct ldap_search_state
{
3370 struct smbldap_state
*connection
;
3380 void *pagedresults_cookie
;
3382 LDAPMessage
*entries
, *current_entry
;
3383 BOOL (*ldap2displayentry
)(struct ldap_search_state
*state
,
3384 TALLOC_CTX
*mem_ctx
,
3385 LDAP
*ld
, LDAPMessage
*entry
,
3386 struct samr_displayentry
*result
);
3389 static BOOL
ldapsam_search_firstpage(struct pdb_search
*search
)
3391 struct ldap_search_state
*state
= search
->private_data
;
3393 int rc
= LDAP_OPERATIONS_ERROR
;
3395 state
->entries
= NULL
;
3397 if (state
->connection
->paged_results
) {
3398 rc
= smbldap_search_paged(state
->connection
, state
->base
,
3399 state
->scope
, state
->filter
,
3400 state
->attrs
, state
->attrsonly
,
3401 lp_ldap_page_size(), &state
->entries
,
3402 &state
->pagedresults_cookie
);
3405 if ((rc
!= LDAP_SUCCESS
) || (state
->entries
== NULL
)) {
3407 if (state
->entries
!= NULL
) {
3408 /* Left over from unsuccessful paged attempt */
3409 ldap_msgfree(state
->entries
);
3410 state
->entries
= NULL
;
3413 rc
= smbldap_search(state
->connection
, state
->base
,
3414 state
->scope
, state
->filter
, state
->attrs
,
3415 state
->attrsonly
, &state
->entries
);
3417 if ((rc
!= LDAP_SUCCESS
) || (state
->entries
== NULL
))
3420 /* Ok, the server was lying. It told us it could do paged
3421 * searches when it could not. */
3422 state
->connection
->paged_results
= False
;
3425 ld
= state
->connection
->ldap_struct
;
3427 DEBUG(5, ("Don't have an LDAP connection right after a "
3431 state
->current_entry
= ldap_first_entry(ld
, state
->entries
);
3433 if (state
->current_entry
== NULL
) {
3434 ldap_msgfree(state
->entries
);
3435 state
->entries
= NULL
;
3441 static BOOL
ldapsam_search_nextpage(struct pdb_search
*search
)
3443 struct ldap_search_state
*state
= search
->private_data
;
3444 LDAP
*ld
= state
->connection
->ldap_struct
;
3447 if (!state
->connection
->paged_results
) {
3448 /* There is no next page when there are no paged results */
3452 rc
= smbldap_search_paged(state
->connection
, state
->base
,
3453 state
->scope
, state
->filter
, state
->attrs
,
3454 state
->attrsonly
, lp_ldap_page_size(),
3456 &state
->pagedresults_cookie
);
3458 if ((rc
!= LDAP_SUCCESS
) || (state
->entries
== NULL
))
3461 state
->current_entry
= ldap_first_entry(ld
, state
->entries
);
3463 if (state
->current_entry
== NULL
) {
3464 ldap_msgfree(state
->entries
);
3465 state
->entries
= NULL
;
3471 static BOOL
ldapsam_search_next_entry(struct pdb_search
*search
,
3472 struct samr_displayentry
*entry
)
3474 struct ldap_search_state
*state
= search
->private_data
;
3475 LDAP
*ld
= state
->connection
->ldap_struct
;
3479 if ((state
->entries
== NULL
) && (state
->pagedresults_cookie
== NULL
))
3482 if ((state
->entries
== NULL
) &&
3483 !ldapsam_search_nextpage(search
))
3486 result
= state
->ldap2displayentry(state
, search
->mem_ctx
, ld
,
3487 state
->current_entry
, entry
);
3491 dn
= ldap_get_dn(ld
, state
->current_entry
);
3492 DEBUG(5, ("Skipping entry %s\n", dn
!= NULL
? dn
: "<NULL>"));
3493 if (dn
!= NULL
) ldap_memfree(dn
);
3496 state
->current_entry
= ldap_next_entry(ld
, state
->current_entry
);
3498 if (state
->current_entry
== NULL
) {
3499 ldap_msgfree(state
->entries
);
3500 state
->entries
= NULL
;
3503 if (!result
) goto retry
;
3508 static void ldapsam_search_end(struct pdb_search
*search
)
3510 struct ldap_search_state
*state
= search
->private_data
;
3513 if (state
->pagedresults_cookie
== NULL
)
3516 if (state
->entries
!= NULL
)
3517 ldap_msgfree(state
->entries
);
3519 state
->entries
= NULL
;
3520 state
->current_entry
= NULL
;
3522 if (!state
->connection
->paged_results
)
3525 /* Tell the LDAP server we're not interested in the rest anymore. */
3527 rc
= smbldap_search_paged(state
->connection
, state
->base
, state
->scope
,
3528 state
->filter
, state
->attrs
,
3529 state
->attrsonly
, 0, &state
->entries
,
3530 &state
->pagedresults_cookie
);
3532 if (rc
!= LDAP_SUCCESS
)
3533 DEBUG(5, ("Could not end search properly\n"));
3538 static BOOL
ldapuser2displayentry(struct ldap_search_state
*state
,
3539 TALLOC_CTX
*mem_ctx
,
3540 LDAP
*ld
, LDAPMessage
*entry
,
3541 struct samr_displayentry
*result
)
3547 vals
= ldap_get_values(ld
, entry
, "sambaAcctFlags");
3548 if ((vals
== NULL
) || (vals
[0] == NULL
)) {
3549 DEBUG(5, ("\"sambaAcctFlags\" not found\n"));
3552 acct_flags
= pdb_decode_acct_ctrl(vals
[0]);
3553 ldap_value_free(vals
);
3555 if ((state
->acct_flags
!= 0) &&
3556 ((state
->acct_flags
& acct_flags
) == 0))
3559 result
->acct_flags
= acct_flags
;
3560 result
->account_name
= "";
3561 result
->fullname
= "";
3562 result
->description
= "";
3564 vals
= ldap_get_values(ld
, entry
, "uid");
3565 if ((vals
== NULL
) || (vals
[0] == NULL
)) {
3566 DEBUG(5, ("\"uid\" not found\n"));
3569 pull_utf8_talloc(mem_ctx
,
3570 CONST_DISCARD(char **, &result
->account_name
),
3572 ldap_value_free(vals
);
3574 vals
= ldap_get_values(ld
, entry
, "displayName");
3575 if ((vals
== NULL
) || (vals
[0] == NULL
))
3576 DEBUG(8, ("\"displayName\" not found\n"));
3578 pull_utf8_talloc(mem_ctx
,
3579 CONST_DISCARD(char **, &result
->fullname
),
3581 ldap_value_free(vals
);
3583 vals
= ldap_get_values(ld
, entry
, "description");
3584 if ((vals
== NULL
) || (vals
[0] == NULL
))
3585 DEBUG(8, ("\"description\" not found\n"));
3587 pull_utf8_talloc(mem_ctx
,
3588 CONST_DISCARD(char **, &result
->description
),
3590 ldap_value_free(vals
);
3592 if ((result
->account_name
== NULL
) ||
3593 (result
->fullname
== NULL
) ||
3594 (result
->description
== NULL
)) {
3595 DEBUG(0, ("talloc failed\n"));
3599 vals
= ldap_get_values(ld
, entry
, "sambaSid");
3600 if ((vals
== NULL
) || (vals
[0] == NULL
)) {
3601 DEBUG(0, ("\"objectSid\" not found\n"));
3605 if (!string_to_sid(&sid
, vals
[0])) {
3606 DEBUG(0, ("Could not convert %s to SID\n", vals
[0]));
3607 ldap_value_free(vals
);
3610 ldap_value_free(vals
);
3612 if (!sid_peek_check_rid(get_global_sam_sid(), &sid
, &result
->rid
)) {
3613 DEBUG(0, ("sid %s does not belong to our domain\n", sid_string_static(&sid
)));
3621 static BOOL
ldapsam_search_users(struct pdb_methods
*methods
,
3622 struct pdb_search
*search
,
3625 struct ldapsam_privates
*ldap_state
= methods
->private_data
;
3626 struct ldap_search_state
*state
;
3628 state
= TALLOC_P(search
->mem_ctx
, struct ldap_search_state
);
3629 if (state
== NULL
) {
3630 DEBUG(0, ("talloc failed\n"));
3634 state
->connection
= ldap_state
->smbldap_state
;
3636 if ((acct_flags
!= 0) && ((acct_flags
& ACB_NORMAL
) != 0))
3637 state
->base
= lp_ldap_user_suffix();
3638 else if ((acct_flags
!= 0) &&
3639 ((acct_flags
& (ACB_WSTRUST
|ACB_SVRTRUST
|ACB_DOMTRUST
)) != 0))
3640 state
->base
= lp_ldap_machine_suffix();
3642 state
->base
= lp_ldap_suffix();
3644 state
->acct_flags
= acct_flags
;
3645 state
->base
= talloc_strdup(search
->mem_ctx
, state
->base
);
3646 state
->scope
= LDAP_SCOPE_SUBTREE
;
3647 state
->filter
= get_ldap_filter(search
->mem_ctx
, "*");
3648 state
->attrs
= talloc_attrs(search
->mem_ctx
, "uid", "sambaSid",
3649 "displayName", "description",
3650 "sambaAcctFlags", NULL
);
3651 state
->attrsonly
= 0;
3652 state
->pagedresults_cookie
= NULL
;
3653 state
->entries
= NULL
;
3654 state
->ldap2displayentry
= ldapuser2displayentry
;
3656 if ((state
->filter
== NULL
) || (state
->attrs
== NULL
)) {
3657 DEBUG(0, ("talloc failed\n"));
3661 search
->private_data
= state
;
3662 search
->next_entry
= ldapsam_search_next_entry
;
3663 search
->search_end
= ldapsam_search_end
;
3665 return ldapsam_search_firstpage(search
);
3668 static BOOL
ldapgroup2displayentry(struct ldap_search_state
*state
,
3669 TALLOC_CTX
*mem_ctx
,
3670 LDAP
*ld
, LDAPMessage
*entry
,
3671 struct samr_displayentry
*result
)
3677 result
->account_name
= "";
3678 result
->fullname
= "";
3679 result
->description
= "";
3682 vals
= ldap_get_values(ld
, entry
, "sambaGroupType");
3683 if ((vals
== NULL
) || (vals
[0] == NULL
)) {
3684 DEBUG(5, ("\"sambaGroupType\" not found\n"));
3688 group_type
= atoi(vals
[0]);
3690 if ((state
->group_type
!= 0) &&
3691 ((state
->group_type
!= group_type
))) {
3695 vals
= ldap_get_values(ld
, entry
, "cn");
3696 if ((vals
== NULL
) || (vals
[0] == NULL
)) {
3697 DEBUG(5, ("\"cn\" not found\n"));
3700 pull_utf8_talloc(mem_ctx
,
3701 CONST_DISCARD(char **, &result
->account_name
),
3703 ldap_value_free(vals
);
3705 vals
= ldap_get_values(ld
, entry
, "displayName");
3706 if ((vals
== NULL
) || (vals
[0] == NULL
))
3707 DEBUG(8, ("\"displayName\" not found\n"));
3709 pull_utf8_talloc(mem_ctx
,
3710 CONST_DISCARD(char **, &result
->fullname
),
3712 ldap_value_free(vals
);
3714 vals
= ldap_get_values(ld
, entry
, "description");
3715 if ((vals
== NULL
) || (vals
[0] == NULL
))
3716 DEBUG(8, ("\"description\" not found\n"));
3718 pull_utf8_talloc(mem_ctx
,
3719 CONST_DISCARD(char **, &result
->description
),
3721 ldap_value_free(vals
);
3723 if ((result
->account_name
== NULL
) ||
3724 (result
->fullname
== NULL
) ||
3725 (result
->description
== NULL
)) {
3726 DEBUG(0, ("talloc failed\n"));
3730 vals
= ldap_get_values(ld
, entry
, "sambaSid");
3731 if ((vals
== NULL
) || (vals
[0] == NULL
)) {
3732 DEBUG(0, ("\"objectSid\" not found\n"));
3736 if (!string_to_sid(&sid
, vals
[0])) {
3737 DEBUG(0, ("Could not convert %s to SID\n", vals
[0]));
3741 ldap_value_free(vals
);
3743 switch (group_type
) {
3744 case SID_NAME_DOM_GRP
:
3745 case SID_NAME_ALIAS
:
3747 if (!sid_peek_check_rid(get_global_sam_sid(), &sid
, &result
->rid
)) {
3748 DEBUG(0, ("%s is not in our domain\n", sid_string_static(&sid
)));
3753 case SID_NAME_WKN_GRP
:
3755 if (!sid_peek_check_rid(&global_sid_Builtin
, &sid
, &result
->rid
)) {
3757 DEBUG(0, ("%s is not in builtin sid\n", sid_string_static(&sid
)));
3763 DEBUG(0,("unkown group type: %d\n", group_type
));
3770 static BOOL
ldapsam_search_grouptype(struct pdb_methods
*methods
,
3771 struct pdb_search
*search
,
3772 enum SID_NAME_USE type
)
3774 struct ldapsam_privates
*ldap_state
= methods
->private_data
;
3775 struct ldap_search_state
*state
;
3777 state
= TALLOC_P(search
->mem_ctx
, struct ldap_search_state
);
3778 if (state
== NULL
) {
3779 DEBUG(0, ("talloc failed\n"));
3783 state
->connection
= ldap_state
->smbldap_state
;
3785 state
->base
= talloc_strdup(search
->mem_ctx
, lp_ldap_group_suffix());
3786 state
->connection
= ldap_state
->smbldap_state
;
3787 state
->scope
= LDAP_SCOPE_SUBTREE
;
3788 state
->filter
= talloc_asprintf(search
->mem_ctx
,
3789 "(&(objectclass=sambaGroupMapping)"
3790 "(sambaGroupType=%d))", type
);
3791 state
->attrs
= talloc_attrs(search
->mem_ctx
, "cn", "sambaSid",
3792 "displayName", "description", "sambaGroupType", NULL
);
3793 state
->attrsonly
= 0;
3794 state
->pagedresults_cookie
= NULL
;
3795 state
->entries
= NULL
;
3796 state
->group_type
= type
;
3797 state
->ldap2displayentry
= ldapgroup2displayentry
;
3799 if ((state
->filter
== NULL
) || (state
->attrs
== NULL
)) {
3800 DEBUG(0, ("talloc failed\n"));
3804 search
->private_data
= state
;
3805 search
->next_entry
= ldapsam_search_next_entry
;
3806 search
->search_end
= ldapsam_search_end
;
3808 return ldapsam_search_firstpage(search
);
3811 static BOOL
ldapsam_search_groups(struct pdb_methods
*methods
,
3812 struct pdb_search
*search
)
3814 return ldapsam_search_grouptype(methods
, search
, SID_NAME_DOM_GRP
);
3817 static BOOL
ldapsam_search_aliases(struct pdb_methods
*methods
,
3818 struct pdb_search
*search
,
3821 if (sid_check_is_domain(sid
))
3822 return ldapsam_search_grouptype(methods
, search
,
3825 if (sid_check_is_builtin(sid
))
3826 return ldapsam_search_grouptype(methods
, search
,
3829 DEBUG(5, ("Don't know SID %s\n", sid_string_static(sid
)));
3833 /**********************************************************************
3835 *********************************************************************/
3837 static void free_private_data(void **vp
)
3839 struct ldapsam_privates
**ldap_state
= (struct ldapsam_privates
**)vp
;
3841 smbldap_free_struct(&(*ldap_state
)->smbldap_state
);
3843 if ((*ldap_state
)->result
!= NULL
) {
3844 ldap_msgfree((*ldap_state
)->result
);
3845 (*ldap_state
)->result
= NULL
;
3847 if ((*ldap_state
)->domain_dn
!= NULL
) {
3848 SAFE_FREE((*ldap_state
)->domain_dn
);
3853 /* No need to free any further, as it is talloc()ed */
3856 /**********************************************************************
3857 Intitalise the parts of the pdb_context that are common to all pdb_ldap modes
3858 *********************************************************************/
3860 static NTSTATUS
pdb_init_ldapsam_common(PDB_CONTEXT
*pdb_context
, PDB_METHODS
**pdb_method
,
3861 const char *location
)
3864 struct ldapsam_privates
*ldap_state
;
3866 if (!NT_STATUS_IS_OK(nt_status
= make_pdb_methods(pdb_context
->mem_ctx
, pdb_method
))) {
3870 (*pdb_method
)->name
= "ldapsam";
3872 (*pdb_method
)->setsampwent
= ldapsam_setsampwent
;
3873 (*pdb_method
)->endsampwent
= ldapsam_endsampwent
;
3874 (*pdb_method
)->getsampwent
= ldapsam_getsampwent
;
3875 (*pdb_method
)->getsampwnam
= ldapsam_getsampwnam
;
3876 (*pdb_method
)->getsampwsid
= ldapsam_getsampwsid
;
3877 (*pdb_method
)->add_sam_account
= ldapsam_add_sam_account
;
3878 (*pdb_method
)->update_sam_account
= ldapsam_update_sam_account
;
3879 (*pdb_method
)->delete_sam_account
= ldapsam_delete_sam_account
;
3881 (*pdb_method
)->getgrsid
= ldapsam_getgrsid
;
3882 (*pdb_method
)->getgrgid
= ldapsam_getgrgid
;
3883 (*pdb_method
)->getgrnam
= ldapsam_getgrnam
;
3884 (*pdb_method
)->add_group_mapping_entry
= ldapsam_add_group_mapping_entry
;
3885 (*pdb_method
)->update_group_mapping_entry
= ldapsam_update_group_mapping_entry
;
3886 (*pdb_method
)->delete_group_mapping_entry
= ldapsam_delete_group_mapping_entry
;
3887 (*pdb_method
)->enum_group_mapping
= ldapsam_enum_group_mapping
;
3888 (*pdb_method
)->enum_group_members
= ldapsam_enum_group_members
;
3889 (*pdb_method
)->enum_group_memberships
= ldapsam_enum_group_memberships
;
3890 (*pdb_method
)->lookup_rids
= ldapsam_lookup_rids
;
3892 /* TODO: Setup private data and free */
3894 ldap_state
= TALLOC_ZERO_P(pdb_context
->mem_ctx
, struct ldapsam_privates
);
3896 DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
3897 return NT_STATUS_NO_MEMORY
;
3900 if (!NT_STATUS_IS_OK(nt_status
=
3901 smbldap_init(pdb_context
->mem_ctx
, location
,
3902 &ldap_state
->smbldap_state
)));
3904 ldap_state
->domain_name
= talloc_strdup(pdb_context
->mem_ctx
, get_global_sam_name());
3905 if (!ldap_state
->domain_name
) {
3906 return NT_STATUS_NO_MEMORY
;
3909 (*pdb_method
)->private_data
= ldap_state
;
3911 (*pdb_method
)->free_private_data
= free_private_data
;
3913 return NT_STATUS_OK
;
3916 /**********************************************************************
3917 Initialise the 'compat' mode for pdb_ldap
3918 *********************************************************************/
3920 NTSTATUS
pdb_init_ldapsam_compat(PDB_CONTEXT
*pdb_context
, PDB_METHODS
**pdb_method
, const char *location
)
3923 struct ldapsam_privates
*ldap_state
;
3925 #ifdef WITH_LDAP_SAMCONFIG
3927 int ldap_port
= lp_ldap_port();
3929 /* remap default port if not using SSL (ie clear or TLS) */
3930 if ( (lp_ldap_ssl() != LDAP_SSL_ON
) && (ldap_port
== 636) ) {
3934 location
= talloc_asprintf(pdb_context
->mem_ctx
, "%s://%s:%d", lp_ldap_ssl() == LDAP_SSL_ON
? "ldaps" : "ldap", lp_ldap_server(), ldap_port
);
3936 return NT_STATUS_NO_MEMORY
;
3941 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_ldapsam_common(pdb_context
, pdb_method
, location
))) {
3945 (*pdb_method
)->name
= "ldapsam_compat";
3947 ldap_state
= (*pdb_method
)->private_data
;
3948 ldap_state
->schema_ver
= SCHEMAVER_SAMBAACCOUNT
;
3950 sid_copy(&ldap_state
->domain_sid
, get_global_sam_sid());
3952 return NT_STATUS_OK
;
3955 /**********************************************************************
3956 Initialise the normal mode for pdb_ldap
3957 *********************************************************************/
3959 NTSTATUS
pdb_init_ldapsam(PDB_CONTEXT
*pdb_context
, PDB_METHODS
**pdb_method
, const char *location
)
3962 struct ldapsam_privates
*ldap_state
;
3963 uint32 alg_rid_base
;
3964 pstring alg_rid_base_string
;
3965 LDAPMessage
*result
= NULL
;
3966 LDAPMessage
*entry
= NULL
;
3967 DOM_SID ldap_domain_sid
;
3968 DOM_SID secrets_domain_sid
;
3969 pstring domain_sid_string
;
3972 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_ldapsam_common(pdb_context
, pdb_method
, location
))) {
3976 (*pdb_method
)->name
= "ldapsam";
3978 (*pdb_method
)->add_aliasmem
= ldapsam_add_aliasmem
;
3979 (*pdb_method
)->del_aliasmem
= ldapsam_del_aliasmem
;
3980 (*pdb_method
)->enum_aliasmem
= ldapsam_enum_aliasmem
;
3981 (*pdb_method
)->enum_alias_memberships
= ldapsam_alias_memberships
;
3982 (*pdb_method
)->search_users
= ldapsam_search_users
;
3983 (*pdb_method
)->search_groups
= ldapsam_search_groups
;
3984 (*pdb_method
)->search_aliases
= ldapsam_search_aliases
;
3986 ldap_state
= (*pdb_method
)->private_data
;
3987 ldap_state
->schema_ver
= SCHEMAVER_SAMBASAMACCOUNT
;
3989 /* Try to setup the Domain Name, Domain SID, algorithmic rid base */
3991 nt_status
= smbldap_search_domain_info(ldap_state
->smbldap_state
, &result
,
3992 ldap_state
->domain_name
, True
);
3994 if ( !NT_STATUS_IS_OK(nt_status
) ) {
3995 DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain info, nor add one to the domain\n"));
3996 DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, will be unable to allocate new users/groups, \
3997 and will risk BDCs having inconsistant SIDs\n"));
3998 sid_copy(&ldap_state
->domain_sid
, get_global_sam_sid());
3999 return NT_STATUS_OK
;
4002 /* Given that the above might fail, everything below this must be optional */
4004 entry
= ldap_first_entry(ldap_state
->smbldap_state
->ldap_struct
, result
);
4006 DEBUG(0, ("pdb_init_ldapsam: Could not get domain info entry\n"));
4007 ldap_msgfree(result
);
4008 return NT_STATUS_UNSUCCESSFUL
;
4011 dn
= smbldap_get_dn(ldap_state
->smbldap_state
->ldap_struct
, entry
);
4013 return NT_STATUS_UNSUCCESSFUL
;
4016 ldap_state
->domain_dn
= smb_xstrdup(dn
);
4019 if (smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
4020 get_userattr_key2string(ldap_state
->schema_ver
, LDAP_ATTR_USER_SID
),
4021 domain_sid_string
)) {
4023 if (!string_to_sid(&ldap_domain_sid
, domain_sid_string
)) {
4024 DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be read as a valid SID\n", domain_sid_string
));
4025 return NT_STATUS_INVALID_PARAMETER
;
4027 found_sid
= secrets_fetch_domain_sid(ldap_state
->domain_name
, &secrets_domain_sid
);
4028 if (!found_sid
|| !sid_equal(&secrets_domain_sid
, &ldap_domain_sid
)) {
4029 fstring new_sid_str
, old_sid_str
;
4030 DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain %s based on pdb_ldap results %s -> %s\n",
4031 ldap_state
->domain_name
,
4032 sid_to_string(old_sid_str
, &secrets_domain_sid
),
4033 sid_to_string(new_sid_str
, &ldap_domain_sid
)));
4035 /* reset secrets.tdb sid */
4036 secrets_store_domain_sid(ldap_state
->domain_name
, &ldap_domain_sid
);
4037 DEBUG(1, ("New global sam SID: %s\n", sid_to_string(new_sid_str
, get_global_sam_sid())));
4039 sid_copy(&ldap_state
->domain_sid
, &ldap_domain_sid
);
4042 if (smbldap_get_single_pstring(ldap_state
->smbldap_state
->ldap_struct
, entry
,
4043 get_attr_key2string( dominfo_attr_list
, LDAP_ATTR_ALGORITHMIC_RID_BASE
),
4044 alg_rid_base_string
)) {
4045 alg_rid_base
= (uint32
)atol(alg_rid_base_string
);
4046 if (alg_rid_base
!= algorithmic_rid_base()) {
4047 DEBUG(0, ("The value of 'algorithmic RID base' has changed since the LDAP\n"
4048 "database was initialised. Aborting. \n"));
4049 ldap_msgfree(result
);
4050 return NT_STATUS_UNSUCCESSFUL
;
4053 ldap_msgfree(result
);
4055 return NT_STATUS_OK
;
4058 NTSTATUS
pdb_ldap_init(void)
4061 if (!NT_STATUS_IS_OK(nt_status
= smb_register_passdb(PASSDB_INTERFACE_VERSION
, "ldapsam", pdb_init_ldapsam
)))
4064 if (!NT_STATUS_IS_OK(nt_status
= smb_register_passdb(PASSDB_INTERFACE_VERSION
, "ldapsam_compat", pdb_init_ldapsam_compat
)))
4067 /* Let pdb_nds register backends */
4070 return NT_STATUS_OK
;