?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r15837: starting sync up for 3.0.23rc1 (in sync with SAMBA_3_0 r15822)
[Samba.git] / source / passdb / pdb_ldap.c
blob70d9e6024c8591f2f8253c70f6b5f7788ea5f5b5
1 /*
2 Unix SMB/CIFS implementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean François Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002-2003
8 Copyright (C) Stefan (metze) Metzmacher 2002-2003
9 Copyright (C) Simo Sorce 2006
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 2 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
20
21 You should have received a copy of the GNU General Public License
22 along with this program; if not, write to the Free Software
23 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24
25 */
26
27 /* TODO:
28 * persistent connections: if using NSS LDAP, many connections are made
29 * however, using only one within Samba would be nice
30 *
31 * Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
32 *
33 * Other LDAP based login attributes: accountExpires, etc.
34 * (should be the domain of Samba proper, but the sam_password/struct samu
35 * structures don't have fields for some of these attributes)
36 *
37 * SSL is done, but can't get the certificate based authentication to work
38 * against on my test platform (Linux 2.4, OpenLDAP 2.x)
39 */
40
41 /* NOTE: this will NOT work against an Active Directory server
42 * due to the fact that the two password fields cannot be retrieved
43 * from a server; recommend using security = domain in this situation
44 * and/or winbind
45 */
46
47 #include "includes.h"
48
49 #undef DBGC_CLASS
50 #define DBGC_CLASS DBGC_PASSDB
51
52 #include <lber.h>
53 #include <ldap.h>
54
55 /*
56 * Work around versions of the LDAP client libs that don't have the OIDs
57 * defined, or have them defined under the old name.
58 * This functionality is really a factor of the server, not the client
59 *
60 */
61
62 #if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD)
63 #define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD
64 #elif !defined(LDAP_EXOP_MODIFY_PASSWD)
65 #define LDAP_EXOP_MODIFY_PASSWD "1.3.6.1.4.1.4203.1.11.1"
66 #endif
67
68 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
69 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID
70 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
71 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID ((ber_tag_t) 0x80U)
72 #endif
73
74 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
75 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW
76 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
77 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ((ber_tag_t) 0x82U)
78 #endif
79
80
81 #include "smbldap.h"
82
83 /**********************************************************************
84 Simple helper function to make stuff better readable
85 **********************************************************************/
86
87 static LDAP *priv2ld(struct ldapsam_privates *priv)
88 {
89 return priv->smbldap_state->ldap_struct;
90 }
91
92 /**********************************************************************
93 Get the attribute name given a user schame version.
94 **********************************************************************/
95
96 static const char* get_userattr_key2string( int schema_ver, int key )
97 {
98 switch ( schema_ver ) {
99 case SCHEMAVER_SAMBAACCOUNT:
100 return get_attr_key2string( attrib_map_v22, key );
101
102 case SCHEMAVER_SAMBASAMACCOUNT:
103 return get_attr_key2string( attrib_map_v30, key );
104
105 default:
106 DEBUG(0,("get_userattr_key2string: unknown schema version specified\n"));
107 break;
108 }
109 return NULL;
110 }
111
112 /**********************************************************************
113 Return the list of attribute names given a user schema version.
114 **********************************************************************/
115
116 const char** get_userattr_list( TALLOC_CTX *mem_ctx, int schema_ver )
117 {
118 switch ( schema_ver ) {
119 case SCHEMAVER_SAMBAACCOUNT:
120 return get_attr_list( mem_ctx, attrib_map_v22 );
121
122 case SCHEMAVER_SAMBASAMACCOUNT:
123 return get_attr_list( mem_ctx, attrib_map_v30 );
124 default:
125 DEBUG(0,("get_userattr_list: unknown schema version specified!\n"));
126 break;
127 }
128
129 return NULL;
130 }
131
132 /**************************************************************************
133 Return the list of attribute names to delete given a user schema version.
134 **************************************************************************/
135
136 static const char** get_userattr_delete_list( TALLOC_CTX *mem_ctx,
137 int schema_ver )
138 {
139 switch ( schema_ver ) {
140 case SCHEMAVER_SAMBAACCOUNT:
141 return get_attr_list( mem_ctx,
142 attrib_map_to_delete_v22 );
143
144 case SCHEMAVER_SAMBASAMACCOUNT:
145 return get_attr_list( mem_ctx,
146 attrib_map_to_delete_v30 );
147 default:
148 DEBUG(0,("get_userattr_delete_list: unknown schema version specified!\n"));
149 break;
150 }
151
152 return NULL;
153 }
154
155
156 /*******************************************************************
157 Generate the LDAP search filter for the objectclass based on the
158 version of the schema we are using.
159 ******************************************************************/
160
161 static const char* get_objclass_filter( int schema_ver )
162 {
163 static fstring objclass_filter;
164
165 switch( schema_ver ) {
166 case SCHEMAVER_SAMBAACCOUNT:
167 fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT );
168 break;
169 case SCHEMAVER_SAMBASAMACCOUNT:
170 fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT );
171 break;
172 default:
173 DEBUG(0,("get_objclass_filter: Invalid schema version specified!\n"));
174 break;
175 }
176
177 return objclass_filter;
178 }
179
180 /*****************************************************************
181 Scan a sequence number off OpenLDAP's syncrepl contextCSN
182 ******************************************************************/
183
184 static NTSTATUS ldapsam_get_seq_num(struct pdb_methods *my_methods, time_t *seq_num)
185 {
186 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
187 NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
188 LDAPMessage *msg = NULL;
189 LDAPMessage *entry = NULL;
190 TALLOC_CTX *mem_ctx;
191 char **values = NULL;
192 int rc, num_result, num_values, rid;
193 pstring suffix;
194 fstring tok;
195 const char *p;
196 const char **attrs;
197
198 /* Unfortunatly there is no proper way to detect syncrepl-support in
199 * smbldap_connect_system(). The syncrepl OIDs are submitted for publication
200 * but do not show up in the root-DSE yet. Neither we can query the
201 * subschema-context for the syncProviderSubentry or syncConsumerSubentry
202 * objectclass. Currently we require lp_ldap_suffix() to show up as
203 * namingContext. - Guenther
204 */
205
206 if (!lp_parm_bool(-1, "ldapsam", "syncrepl_seqnum", False)) {
207 return ntstatus;
208 }
209
210 if (!seq_num) {
211 DEBUG(3,("ldapsam_get_seq_num: no sequence_number\n"));
212 return ntstatus;
213 }
214
215 if (!smbldap_has_naming_context(ldap_state->smbldap_state->ldap_struct, lp_ldap_suffix())) {
216 DEBUG(3,("ldapsam_get_seq_num: DIT not configured to hold %s "
217 "as top-level namingContext\n", lp_ldap_suffix()));
218 return ntstatus;
219 }
220
221 mem_ctx = talloc_init("ldapsam_get_seq_num");
222
223 if (mem_ctx == NULL)
224 return NT_STATUS_NO_MEMORY;
225
226 attrs = TALLOC_ARRAY(mem_ctx, const char *, 2);
227
228 /* if we got a syncrepl-rid (up to three digits long) we speak with a consumer */
229 rid = lp_parm_int(-1, "ldapsam", "syncrepl_rid", -1);
230 if (rid > 0) {
231
232 /* consumer syncreplCookie: */
233 /* csn=20050126161620Z#0000001#00#00000 */
234 attrs[0] = talloc_strdup(mem_ctx, "syncreplCookie");
235 attrs[1] = NULL;
236 pstr_sprintf( suffix, "cn=syncrepl%d,%s", rid, lp_ldap_suffix());
237
238 } else {
239
240 /* provider contextCSN */
241 /* 20050126161620Z#000009#00#000000 */
242 attrs[0] = talloc_strdup(mem_ctx, "contextCSN");
243 attrs[1] = NULL;
244 pstr_sprintf( suffix, "cn=ldapsync,%s", lp_ldap_suffix());
245
246 }
247
248 rc = smbldap_search(ldap_state->smbldap_state, suffix,
249 LDAP_SCOPE_BASE, "(objectclass=*)", attrs, 0, &msg);
250
251 if (rc != LDAP_SUCCESS) {
252 goto done;
253 }
254
255 num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg);
256 if (num_result != 1) {
257 DEBUG(3,("ldapsam_get_seq_num: Expected one entry, got %d\n", num_result));
258 goto done;
259 }
260
261 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg);
262 if (entry == NULL) {
263 DEBUG(3,("ldapsam_get_seq_num: Could not retrieve entry\n"));
264 goto done;
265 }
266
267 values = ldap_get_values(ldap_state->smbldap_state->ldap_struct, entry, attrs[0]);
268 if (values == NULL) {
269 DEBUG(3,("ldapsam_get_seq_num: no values\n"));
270 goto done;
271 }
272
273 num_values = ldap_count_values(values);
274 if (num_values == 0) {
275 DEBUG(3,("ldapsam_get_seq_num: not a single value\n"));
276 goto done;
277 }
278
279 p = values[0];
280 if (!next_token(&p, tok, "#", sizeof(tok))) {
281 DEBUG(0,("ldapsam_get_seq_num: failed to parse sequence number\n"));
282 goto done;
283 }
284
285 p = tok;
286 if (!strncmp(p, "csn=", strlen("csn=")))
287 p += strlen("csn=");
288
289 DEBUG(10,("ldapsam_get_seq_num: got %s: %s\n", attrs[0], p));
290
291 *seq_num = generalized_to_unix_time(p);
292
293 /* very basic sanity check */
294 if (*seq_num <= 0) {
295 DEBUG(3,("ldapsam_get_seq_num: invalid sequence number: %d\n",
296 (int)*seq_num));
297 goto done;
298 }
299
300 ntstatus = NT_STATUS_OK;
301
302 done:
303 if (values != NULL)
304 ldap_value_free(values);
305 if (msg != NULL)
306 ldap_msgfree(msg);
307 if (mem_ctx)
308 talloc_destroy(mem_ctx);
309
310 return ntstatus;
311 }
312
313 /*******************************************************************
314 Run the search by name.
315 ******************************************************************/
316
317 int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
318 const char *user,
319 LDAPMessage ** result,
320 const char **attr)
321 {
322 pstring filter;
323 char *escape_user = escape_ldap_string_alloc(user);
324
325 if (!escape_user) {
326 return LDAP_NO_MEMORY;
327 }
328
329 /*
330 * in the filter expression, replace %u with the real name
331 * so in ldap filter, %u MUST exist :-)
332 */
333 pstr_sprintf(filter, "(&%s%s)", "(uid=%u)",
334 get_objclass_filter(ldap_state->schema_ver));
335
336 /*
337 * have to use this here because $ is filtered out
338 * in pstring_sub
339 */
340
341
342 all_string_sub(filter, "%u", escape_user, sizeof(pstring));
343 SAFE_FREE(escape_user);
344
345 return smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
346 }
347
348 /*******************************************************************
349 Run the search by rid.
350 ******************************************************************/
351
352 static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
353 uint32 rid, LDAPMessage ** result,
354 const char **attr)
355 {
356 pstring filter;
357 int rc;
358
359 pstr_sprintf(filter, "(&(rid=%i)%s)", rid,
360 get_objclass_filter(ldap_state->schema_ver));
361
362 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
363
364 return rc;
365 }
366
367 /*******************************************************************
368 Run the search by SID.
369 ******************************************************************/
370
371 static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
372 const DOM_SID *sid, LDAPMessage ** result,
373 const char **attr)
374 {
375 pstring filter;
376 int rc;
377 fstring sid_string;
378
379 pstr_sprintf(filter, "(&(%s=%s)%s)",
380 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
381 sid_to_string(sid_string, sid),
382 get_objclass_filter(ldap_state->schema_ver));
383
384 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
385
386 return rc;
387 }
388
389 /*******************************************************************
390 Delete complete object or objectclass and attrs from
391 object found in search_result depending on lp_ldap_delete_dn
392 ******************************************************************/
393
394 static int ldapsam_delete_entry(struct ldapsam_privates *priv,
395 TALLOC_CTX *mem_ctx,
396 LDAPMessage *entry,
397 const char *objectclass,
398 const char **attrs)
399 {
400 LDAPMod **mods = NULL;
401 char *name;
402 const char *dn;
403 BerElement *ptr = NULL;
404
405 dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry);
406 if (dn == NULL) {
407 return LDAP_NO_MEMORY;
408 }
409
410 if (lp_ldap_delete_dn()) {
411 return smbldap_delete(priv->smbldap_state, dn);
412 }
413
414 /* Ok, delete only the SAM attributes */
415
416 for (name = ldap_first_attribute(priv2ld(priv), entry, &ptr);
417 name != NULL;
418 name = ldap_next_attribute(priv2ld(priv), entry, ptr)) {
419 const char **attrib;
420
421 /* We are only allowed to delete the attributes that
422 really exist. */
423
424 for (attrib = attrs; *attrib != NULL; attrib++) {
425 if (strequal(*attrib, name)) {
426 DEBUG(10, ("ldapsam_delete_entry: deleting "
427 "attribute %s\n", name));
428 smbldap_set_mod(&mods, LDAP_MOD_DELETE, name,
429 NULL);
430 }
431 }
432 ldap_memfree(name);
433 }
434
435 if (ptr != NULL) {
436 ber_free(ptr, 0);
437 }
438
439 smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
440 talloc_autofree_ldapmod(mem_ctx, mods);
441
442 return smbldap_modify(priv->smbldap_state, dn, mods);
443 }
444
445 static time_t ldapsam_get_entry_timestamp( struct ldapsam_privates *ldap_state, LDAPMessage * entry)
446 {
447 pstring temp;
448 struct tm tm;
449
450 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
451 get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
452 temp))
453 return (time_t) 0;
454
455 strptime(temp, "%Y%m%d%H%M%SZ", &tm);
456 tzset();
457 return timegm(&tm);
458 }
459
460 /**********************************************************************
461 Initialize struct samu from an LDAP query.
462 (Based on init_sam_from_buffer in pdb_tdb.c)
463 *********************************************************************/
464
465 static BOOL init_sam_from_ldap(struct ldapsam_privates *ldap_state,
466 struct samu * sampass,
467 LDAPMessage * entry)
468 {
469 time_t logon_time,
470 logoff_time,
471 kickoff_time,
472 pass_last_set_time,
473 pass_can_change_time,
474 pass_must_change_time,
475 ldap_entry_time,
476 bad_password_time;
477 pstring username,
478 domain,
479 nt_username,
480 fullname,
481 homedir,
482 dir_drive,
483 logon_script,
484 profile_path,
485 acct_desc,
486 workstations;
487 char munged_dial[2048];
488 uint32 user_rid;
489 uint8 smblmpwd[LM_HASH_LEN],
490 smbntpwd[NT_HASH_LEN];
491 BOOL use_samba_attrs = True;
492 uint32 acct_ctrl = 0;
493 uint16 logon_divs;
494 uint16 bad_password_count = 0,
495 logon_count = 0;
496 uint32 hours_len;
497 uint8 hours[MAX_HOURS_LEN];
498 pstring temp;
499 LOGIN_CACHE *cache_entry = NULL;
500 uint32 pwHistLen;
501 pstring tmpstring;
502 BOOL expand_explicit = lp_passdb_expand_explicit();
503
504 /*
505 * do a little initialization
506 */
507 username[0] = '\0';
508 domain[0] = '\0';
509 nt_username[0] = '\0';
510 fullname[0] = '\0';
511 homedir[0] = '\0';
512 dir_drive[0] = '\0';
513 logon_script[0] = '\0';
514 profile_path[0] = '\0';
515 acct_desc[0] = '\0';
516 munged_dial[0] = '\0';
517 workstations[0] = '\0';
518
519
520 if (sampass == NULL || ldap_state == NULL || entry == NULL) {
521 DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
522 return False;
523 }
524
525 if (priv2ld(ldap_state) == NULL) {
526 DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->"
527 "ldap_struct is NULL!\n"));
528 return False;
529 }
530
531 if (!smbldap_get_single_pstring(priv2ld(ldap_state), entry, "uid",
532 username)) {
533 DEBUG(1, ("init_sam_from_ldap: No uid attribute found for "
534 "this user!\n"));
535 return False;
536 }
537
538 DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
539
540 pstrcpy(nt_username, username);
541
542 pstrcpy(domain, ldap_state->domain_name);
543
544 pdb_set_username(sampass, username, PDB_SET);
545
546 pdb_set_domain(sampass, domain, PDB_DEFAULT);
547 pdb_set_nt_username(sampass, nt_username, PDB_SET);
548
549 /* deal with different attributes between the schema first */
550
551 if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
552 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
553 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp)) {
554 pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
555 }
556 } else {
557 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
558 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp)) {
559 user_rid = (uint32)atol(temp);
560 pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
561 }
562 }
563
564 if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
565 DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
566 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
567 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
568 username));
569 return False;
570 }
571
572 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
573 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) {
574 /* leave as default */
575 } else {
576 pass_last_set_time = (time_t) atol(temp);
577 pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
578 }
579
580 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
581 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp)) {
582 /* leave as default */
583 } else {
584 logon_time = (time_t) atol(temp);
585 pdb_set_logon_time(sampass, logon_time, PDB_SET);
586 }
587
588 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
589 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp)) {
590 /* leave as default */
591 } else {
592 logoff_time = (time_t) atol(temp);
593 pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
594 }
595
596 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
597 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp)) {
598 /* leave as default */
599 } else {
600 kickoff_time = (time_t) atol(temp);
601 pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
602 }
603
604 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
605 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp)) {
606 /* leave as default */
607 } else {
608 pass_can_change_time = (time_t) atol(temp);
609 pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
610 }
611
612 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
613 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp)) {
614 /* leave as default */
615 } else {
616 pass_must_change_time = (time_t) atol(temp);
617 pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
618 }
619
620 /* recommend that 'gecos' and 'displayName' should refer to the same
621 * attribute OID. userFullName depreciated, only used by Samba
622 * primary rules of LDAP: don't make a new attribute when one is already defined
623 * that fits your needs; using cn then displayName rather than 'userFullName'
624 */
625
626 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
627 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname)) {
628 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
629 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname)) {
630 /* leave as default */
631 } else {
632 pdb_set_fullname(sampass, fullname, PDB_SET);
633 }
634 } else {
635 pdb_set_fullname(sampass, fullname, PDB_SET);
636 }
637
638 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
639 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive))
640 {
641 pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
642 } else {
643 pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
644 }
645
646 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
647 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir))
648 {
649 pdb_set_homedir( sampass,
650 talloc_sub_basic(sampass, username, lp_logon_home()),
651 PDB_DEFAULT );
652 } else {
653 pstrcpy( tmpstring, homedir );
654 if (expand_explicit) {
655 standard_sub_basic( username, tmpstring,
656 sizeof(tmpstring) );
657 }
658 pdb_set_homedir(sampass, tmpstring, PDB_SET);
659 }
660
661 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
662 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script))
663 {
664 pdb_set_logon_script( sampass,
665 talloc_sub_basic(sampass, username, lp_logon_script()),
666 PDB_DEFAULT );
667 } else {
668 pstrcpy( tmpstring, logon_script );
669 if (expand_explicit) {
670 standard_sub_basic( username, tmpstring,
671 sizeof(tmpstring) );
672 }
673 pdb_set_logon_script(sampass, tmpstring, PDB_SET);
674 }
675
676 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
677 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path))
678 {
679 pdb_set_profile_path( sampass,
680 talloc_sub_basic( sampass, username, lp_logon_path()),
681 PDB_DEFAULT );
682 } else {
683 pstrcpy( tmpstring, profile_path );
684 if (expand_explicit) {
685 standard_sub_basic( username, tmpstring,
686 sizeof(tmpstring) );
687 }
688 pdb_set_profile_path(sampass, tmpstring, PDB_SET);
689 }
690
691 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
692 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC), acct_desc))
693 {
694 /* leave as default */
695 } else {
696 pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
697 }
698
699 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
700 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations)) {
701 /* leave as default */;
702 } else {
703 pdb_set_workstations(sampass, workstations, PDB_SET);
704 }
705
706 if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
707 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL), munged_dial, sizeof(munged_dial))) {
708 /* leave as default */;
709 } else {
710 pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
711 }
712
713 /* FIXME: hours stuff should be cleaner */
714
715 logon_divs = 168;
716 hours_len = 21;
717 memset(hours, 0xff, hours_len);
718
719 if (ldap_state->is_nds_ldap) {
720 char *user_dn;
721 size_t pwd_len;
722 char clear_text_pw[512];
723
724 /* Make call to Novell eDirectory ldap extension to get clear text password.
725 NOTE: This will only work if we have an SSL connection to eDirectory. */
726 user_dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
727 if (user_dn != NULL) {
728 DEBUG(3, ("init_sam_from_ldap: smbldap_get_dn(%s) returned '%s'\n", username, user_dn));
729
730 pwd_len = sizeof(clear_text_pw);
731 if (pdb_nds_get_password(ldap_state->smbldap_state, user_dn, &pwd_len, clear_text_pw) == LDAP_SUCCESS) {
732 nt_lm_owf_gen(clear_text_pw, smbntpwd, smblmpwd);
733 if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
734 return False;
735 ZERO_STRUCT(smblmpwd);
736 if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
737 return False;
738 ZERO_STRUCT(smbntpwd);
739 use_samba_attrs = False;
740 }
741 } else {
742 DEBUG(0, ("init_sam_from_ldap: failed to get user_dn for '%s'\n", username));
743 }
744 }
745
746 if (use_samba_attrs) {
747 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
748 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp)) {
749 /* leave as default */
750 } else {
751 pdb_gethexpwd(temp, smblmpwd);
752 memset((char *)temp, '\0', strlen(temp)+1);
753 if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
754 return False;
755 ZERO_STRUCT(smblmpwd);
756 }
757
758 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
759 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp)) {
760 /* leave as default */
761 } else {
762 pdb_gethexpwd(temp, smbntpwd);
763 memset((char *)temp, '\0', strlen(temp)+1);
764 if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
765 return False;
766 ZERO_STRUCT(smbntpwd);
767 }
768 }
769
770 pwHistLen = 0;
771
772 pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
773 if (pwHistLen > 0){
774 uint8 *pwhist = NULL;
775 int i;
776 char history_string[MAX_PW_HISTORY_LEN*64];
777
778 pwHistLen = MIN(pwHistLen, MAX_PW_HISTORY_LEN);
779
780 if ((pwhist = SMB_MALLOC(pwHistLen * PW_HISTORY_ENTRY_LEN)) == NULL){
781 DEBUG(0, ("init_sam_from_ldap: malloc failed!\n"));
782 return False;
783 }
784 memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
785
786 if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
787 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
788 history_string, sizeof(history_string))) {
789 /* leave as default - zeros */
790 } else {
791 BOOL hex_failed = False;
792 for (i = 0; i < pwHistLen; i++){
793 /* Get the 16 byte salt. */
794 if (!pdb_gethexpwd(&history_string[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN])) {
795 hex_failed = True;
796 break;
797 }
798 /* Get the 16 byte MD5 hash of salt+passwd. */
799 if (!pdb_gethexpwd(&history_string[(i*64)+32],
800 &pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN])) {
801 hex_failed = True;
802 break;
803 }
804 }
805 if (hex_failed) {
806 DEBUG(0,("init_sam_from_ldap: Failed to get password history for user %s\n",
807 username));
808 memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
809 }
810 }
811 if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
812 SAFE_FREE(pwhist);
813 return False;
814 }
815 SAFE_FREE(pwhist);
816 }
817
818 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
819 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp)) {
820 acct_ctrl |= ACB_NORMAL;
821 } else {
822 acct_ctrl = pdb_decode_acct_ctrl(temp);
823
824 if (acct_ctrl == 0)
825 acct_ctrl |= ACB_NORMAL;
826
827 pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
828 }
829
830 pdb_set_hours_len(sampass, hours_len, PDB_SET);
831 pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
832
833 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
834 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_COUNT), temp)) {
835 /* leave as default */
836 } else {
837 bad_password_count = (uint32) atol(temp);
838 pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET);
839 }
840
841 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
842 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_TIME), temp)) {
843 /* leave as default */
844 } else {
845 bad_password_time = (time_t) atol(temp);
846 pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
847 }
848
849
850 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
851 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_COUNT), temp)) {
852 /* leave as default */
853 } else {
854 logon_count = (uint32) atol(temp);
855 pdb_set_logon_count(sampass, logon_count, PDB_SET);
856 }
857
858 /* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
859
860 if(!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
861 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_HOURS), temp)) {
862 /* leave as default */
863 } else {
864 pdb_gethexhours(temp, hours);
865 memset((char *)temp, '\0', strlen(temp) +1);
866 pdb_set_hours(sampass, hours, PDB_SET);
867 ZERO_STRUCT(hours);
868 }
869
870 if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
871 if (smbldap_get_single_pstring(priv2ld(ldap_state), entry,
872 "uidNumber", temp)) {
873 /* We've got a uid, feed the cache */
874 uid_t uid = strtoul(temp, NULL, 10);
875 store_uid_sid_cache(pdb_get_user_sid(sampass), uid);
876 }
877 }
878
879 /* check the timestamp of the cache vs ldap entry */
880 if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
881 entry)))
882 return True;
883
884 /* see if we have newer updates */
885 if (!(cache_entry = login_cache_read(sampass))) {
886 DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
887 (unsigned int)pdb_get_bad_password_count(sampass),
888 (unsigned int)pdb_get_bad_password_time(sampass)));
889 return True;
890 }
891
892 DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
893 (unsigned int)ldap_entry_time, (unsigned int)cache_entry->entry_timestamp,
894 (unsigned int)cache_entry->bad_password_time));
895
896 if (ldap_entry_time > cache_entry->entry_timestamp) {
897 /* cache is older than directory , so
898 we need to delete the entry but allow the
899 fields to be written out */
900 login_cache_delentry(sampass);
901 } else {
902 /* read cache in */
903 pdb_set_acct_ctrl(sampass,
904 pdb_get_acct_ctrl(sampass) |
905 (cache_entry->acct_ctrl & ACB_AUTOLOCK),
906 PDB_SET);
907 pdb_set_bad_password_count(sampass,
908 cache_entry->bad_password_count,
909 PDB_SET);
910 pdb_set_bad_password_time(sampass,
911 cache_entry->bad_password_time,
912 PDB_SET);
913 }
914
915 SAFE_FREE(cache_entry);
916 return True;
917 }
918
919 /**********************************************************************
920 Initialize the ldap db from a struct samu. Called on update.
921 (Based on init_buffer_from_sam in pdb_tdb.c)
922 *********************************************************************/
923
924 static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state,
925 LDAPMessage *existing,
926 LDAPMod *** mods, struct samu * sampass,
927 BOOL (*need_update)(const struct samu *,
928 enum pdb_elements))
929 {
930 pstring temp;
931 uint32 rid;
932
933 if (mods == NULL || sampass == NULL) {
934 DEBUG(0, ("init_ldap_from_sam: NULL parameters found!\n"));
935 return False;
936 }
937
938 *mods = NULL;
939
940 /*
941 * took out adding "objectclass: sambaAccount"
942 * do this on a per-mod basis
943 */
944 if (need_update(sampass, PDB_USERNAME)) {
945 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
946 "uid", pdb_get_username(sampass));
947 if (ldap_state->is_nds_ldap) {
948 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
949 "cn", pdb_get_username(sampass));
950 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
951 "sn", pdb_get_username(sampass));
952 }
953 }
954
955 DEBUG(2, ("init_ldap_from_sam: Setting entry for user: %s\n", pdb_get_username(sampass)));
956
957 /* only update the RID if we actually need to */
958 if (need_update(sampass, PDB_USERSID)) {
959 fstring sid_string;
960 fstring dom_sid_string;
961 const DOM_SID *user_sid = pdb_get_user_sid(sampass);
962
963 switch ( ldap_state->schema_ver ) {
964 case SCHEMAVER_SAMBAACCOUNT:
965 if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
966 DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
967 sid_to_string(sid_string, user_sid),
968 sid_to_string(dom_sid_string, &ldap_state->domain_sid)));
969 return False;
970 }
971 slprintf(temp, sizeof(temp) - 1, "%i", rid);
972 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
973 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
974 temp);
975 break;
976
977 case SCHEMAVER_SAMBASAMACCOUNT:
978 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
979 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
980 sid_to_string(sid_string, user_sid));
981 break;
982
983 default:
984 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
985 break;
986 }
987 }
988
989 /* we don't need to store the primary group RID - so leaving it
990 'free' to hang off the unix primary group makes life easier */
991
992 if (need_update(sampass, PDB_GROUPSID)) {
993 fstring sid_string;
994 fstring dom_sid_string;
995 const DOM_SID *group_sid = pdb_get_group_sid(sampass);
996
997 switch ( ldap_state->schema_ver ) {
998 case SCHEMAVER_SAMBAACCOUNT:
999 if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
1000 DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
1001 sid_to_string(sid_string, group_sid),
1002 sid_to_string(dom_sid_string, &ldap_state->domain_sid)));
1003 return False;
1004 }
1005
1006 slprintf(temp, sizeof(temp) - 1, "%i", rid);
1007 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1008 get_userattr_key2string(ldap_state->schema_ver,
1009 LDAP_ATTR_PRIMARY_GROUP_RID), temp);
1010 break;
1011
1012 case SCHEMAVER_SAMBASAMACCOUNT:
1013 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1014 get_userattr_key2string(ldap_state->schema_ver,
1015 LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_string(sid_string, group_sid));
1016 break;
1017
1018 default:
1019 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
1020 break;
1021 }
1022
1023 }
1024
1025 /* displayName, cn, and gecos should all be the same
1026 * most easily accomplished by giving them the same OID
1027 * gecos isn't set here b/c it should be handled by the
1028 * add-user script
1029 * We change displayName only and fall back to cn if
1030 * it does not exist.
1031 */
1032
1033 if (need_update(sampass, PDB_FULLNAME))
1034 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1035 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME),
1036 pdb_get_fullname(sampass));
1037
1038 if (need_update(sampass, PDB_ACCTDESC))
1039 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1040 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC),
1041 pdb_get_acct_desc(sampass));
1042
1043 if (need_update(sampass, PDB_WORKSTATIONS))
1044 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1045 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
1046 pdb_get_workstations(sampass));
1047
1048 if (need_update(sampass, PDB_MUNGEDDIAL))
1049 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1050 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL),
1051 pdb_get_munged_dial(sampass));
1052
1053 if (need_update(sampass, PDB_SMBHOME))
1054 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1055 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
1056 pdb_get_homedir(sampass));
1057
1058 if (need_update(sampass, PDB_DRIVE))
1059 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1060 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
1061 pdb_get_dir_drive(sampass));
1062
1063 if (need_update(sampass, PDB_LOGONSCRIPT))
1064 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1065 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT),
1066 pdb_get_logon_script(sampass));
1067
1068 if (need_update(sampass, PDB_PROFILE))
1069 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1070 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
1071 pdb_get_profile_path(sampass));
1072
1073 slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logon_time(sampass));
1074 if (need_update(sampass, PDB_LOGONTIME))
1075 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1076 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
1077
1078 slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logoff_time(sampass));
1079 if (need_update(sampass, PDB_LOGOFFTIME))
1080 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1081 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
1082
1083 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_kickoff_time(sampass));
1084 if (need_update(sampass, PDB_KICKOFFTIME))
1085 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1086 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
1087
1088 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_can_change_time(sampass));
1089 if (need_update(sampass, PDB_CANCHANGETIME))
1090 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1091 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
1092
1093 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_must_change_time(sampass));
1094 if (need_update(sampass, PDB_MUSTCHANGETIME))
1095 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1096 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
1097
1098
1099 if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST))
1100 || (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
1101
1102 if (need_update(sampass, PDB_LMPASSWD)) {
1103 const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
1104 if (lm_pw) {
1105 pdb_sethexpwd(temp, lm_pw,
1106 pdb_get_acct_ctrl(sampass));
1107 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1108 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1109 temp);
1110 } else {
1111 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1112 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1113 NULL);
1114 }
1115 }
1116 if (need_update(sampass, PDB_NTPASSWD)) {
1117 const uchar *nt_pw = pdb_get_nt_passwd(sampass);
1118 if (nt_pw) {
1119 pdb_sethexpwd(temp, nt_pw,
1120 pdb_get_acct_ctrl(sampass));
1121 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1122 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1123 temp);
1124 } else {
1125 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1126 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1127 NULL);
1128 }
1129 }
1130
1131 if (need_update(sampass, PDB_PWHISTORY)) {
1132 uint32 pwHistLen = 0;
1133 pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
1134 if (pwHistLen == 0) {
1135 /* Remove any password history from the LDAP store. */
1136 memset(temp, '0', 64); /* NOTE !!!! '0' *NOT '\0' */
1137 temp[64] = '\0';
1138 } else {
1139 int i;
1140 uint32 currHistLen = 0;
1141 const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
1142 if (pwhist != NULL) {
1143 /* We can only store (sizeof(pstring)-1)/64 password history entries. */
1144 pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));
1145 for (i=0; i< pwHistLen && i < currHistLen; i++) {
1146 /* Store the salt. */
1147 pdb_sethexpwd(&temp[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN], 0);
1148 /* Followed by the md5 hash of salt + md4 hash */
1149 pdb_sethexpwd(&temp[(i*64)+32],
1150 &pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
1151 DEBUG(100, ("temp=%s\n", temp));
1152 }
1153 }
1154 }
1155 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1156 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
1157 temp);
1158 }
1159
1160 if (need_update(sampass, PDB_PASSLASTSET)) {
1161 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_last_set_time(sampass));
1162 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1163 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
1164 temp);
1165 }
1166 }
1167
1168 if (need_update(sampass, PDB_HOURS)) {
1169 const uint8 *hours = pdb_get_hours(sampass);
1170 if (hours) {
1171 pdb_sethexhours(temp, hours);
1172 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
1173 existing,
1174 mods,
1175 get_userattr_key2string(ldap_state->schema_ver,
1176 LDAP_ATTR_LOGON_HOURS),
1177 temp);
1178 }
1179 }
1180
1181 if (need_update(sampass, PDB_ACCTCTRL))
1182 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1183 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
1184 pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
1185
1186 /* password lockout cache:
1187 - If we are now autolocking or clearing, we write to ldap
1188 - If we are clearing, we delete the cache entry
1189 - If the count is > 0, we update the cache
1190
1191 This even means when autolocking, we cache, just in case the
1192 update doesn't work, and we have to cache the autolock flag */
1193
1194 if (need_update(sampass, PDB_BAD_PASSWORD_COUNT)) /* &&
1195 need_update(sampass, PDB_BAD_PASSWORD_TIME)) */ {
1196 uint16 badcount = pdb_get_bad_password_count(sampass);
1197 time_t badtime = pdb_get_bad_password_time(sampass);
1198 uint32 pol;
1199 pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT, &pol);
1200
1201 DEBUG(3, ("updating bad password fields, policy=%u, count=%u, time=%u\n",
1202 (unsigned int)pol, (unsigned int)badcount, (unsigned int)badtime));
1203
1204 if ((badcount >= pol) || (badcount == 0)) {
1205 DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
1206 (unsigned int)badcount, (unsigned int)badtime));
1207 slprintf (temp, sizeof (temp) - 1, "%li", (long)badcount);
1208 smbldap_make_mod(
1209 ldap_state->smbldap_state->ldap_struct,
1210 existing, mods,
1211 get_userattr_key2string(
1212 ldap_state->schema_ver,
1213 LDAP_ATTR_BAD_PASSWORD_COUNT),
1214 temp);
1215
1216 slprintf (temp, sizeof (temp) - 1, "%li", badtime);
1217 smbldap_make_mod(
1218 ldap_state->smbldap_state->ldap_struct,
1219 existing, mods,
1220 get_userattr_key2string(
1221 ldap_state->schema_ver,
1222 LDAP_ATTR_BAD_PASSWORD_TIME),
1223 temp);
1224 }
1225 if (badcount == 0) {
1226 DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
1227 login_cache_delentry(sampass);
1228 } else {
1229 LOGIN_CACHE cache_entry;
1230
1231 cache_entry.entry_timestamp = time(NULL);
1232 cache_entry.acct_ctrl = pdb_get_acct_ctrl(sampass);
1233 cache_entry.bad_password_count = badcount;
1234 cache_entry.bad_password_time = badtime;
1235
1236 DEBUG(7, ("Updating bad password count and time in login cache\n"));
1237 login_cache_write(sampass, cache_entry);
1238 }
1239 }
1240
1241 return True;
1242 }
1243
1244 /**********************************************************************
1245 Connect to LDAP server for password enumeration.
1246 *********************************************************************/
1247
1248 static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update, uint32 acb_mask)
1249 {
1250 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1251 int rc;
1252 pstring filter, suffix;
1253 const char **attr_list;
1254 BOOL machine_mask = False, user_mask = False;
1255
1256 pstr_sprintf( filter, "(&%s%s)", "(uid=%u)",
1257 get_objclass_filter(ldap_state->schema_ver));
1258 all_string_sub(filter, "%u", "*", sizeof(pstring));
1259
1260 machine_mask = ((acb_mask != 0) && (acb_mask & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)));
1261 user_mask = ((acb_mask != 0) && (acb_mask & ACB_NORMAL));
1262
1263 if (machine_mask) {
1264 pstrcpy(suffix, lp_ldap_machine_suffix());
1265 } else if (user_mask) {
1266 pstrcpy(suffix, lp_ldap_user_suffix());
1267 } else {
1268 pstrcpy(suffix, lp_ldap_suffix());
1269 }
1270
1271 DEBUG(10,("ldapsam_setsampwent: LDAP Query for acb_mask 0x%x will use suffix %s\n",
1272 acb_mask, suffix));
1273
1274 attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
1275 rc = smbldap_search(ldap_state->smbldap_state, suffix, LDAP_SCOPE_SUBTREE, filter,
1276 attr_list, 0, &ldap_state->result);
1277 TALLOC_FREE( attr_list );
1278
1279 if (rc != LDAP_SUCCESS) {
1280 DEBUG(0, ("ldapsam_setsampwent: LDAP search failed: %s\n", ldap_err2string(rc)));
1281 DEBUG(3, ("ldapsam_setsampwent: Query was: %s, %s\n", suffix, filter));
1282 ldap_msgfree(ldap_state->result);
1283 ldap_state->result = NULL;
1284 return NT_STATUS_UNSUCCESSFUL;
1285 }
1286
1287 DEBUG(2, ("ldapsam_setsampwent: %d entries in the base %s\n",
1288 ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
1289 ldap_state->result), suffix));
1290
1291 ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
1292 ldap_state->result);
1293 ldap_state->index = 0;
1294
1295 return NT_STATUS_OK;
1296 }
1297
1298 /**********************************************************************
1299 End enumeration of the LDAP password list.
1300 *********************************************************************/
1301
1302 static void ldapsam_endsampwent(struct pdb_methods *my_methods)
1303 {
1304 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1305 if (ldap_state->result) {
1306 ldap_msgfree(ldap_state->result);
1307 ldap_state->result = NULL;
1308 }
1309 }
1310
1311 /**********************************************************************
1312 Get the next entry in the LDAP password database.
1313 *********************************************************************/
1314
1315 static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods,
1316 struct samu *user)
1317 {
1318 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1319 struct ldapsam_privates *ldap_state =
1320 (struct ldapsam_privates *)my_methods->private_data;
1321 BOOL bret = False;
1322
1323 while (!bret) {
1324 if (!ldap_state->entry)
1325 return ret;
1326
1327 ldap_state->index++;
1328 bret = init_sam_from_ldap(ldap_state, user, ldap_state->entry);
1329
1330 ldap_state->entry = ldap_next_entry(priv2ld(ldap_state),
1331 ldap_state->entry);
1332 }
1333
1334 return NT_STATUS_OK;
1335 }
1336
1337 static void append_attr(TALLOC_CTX *mem_ctx, const char ***attr_list,
1338 const char *new_attr)
1339 {
1340 int i;
1341
1342 if (new_attr == NULL) {
1343 return;
1344 }
1345
1346 for (i=0; (*attr_list)[i] != NULL; i++) {
1347 ;
1348 }
1349
1350 (*attr_list) = TALLOC_REALLOC_ARRAY(mem_ctx, (*attr_list),
1351 const char *, i+2);
1352 SMB_ASSERT((*attr_list) != NULL);
1353 (*attr_list)[i] = talloc_strdup((*attr_list), new_attr);
1354 (*attr_list)[i+1] = NULL;
1355 }
1356
1357 /**********************************************************************
1358 Get struct samu entry from LDAP by username.
1359 *********************************************************************/
1360
1361 static NTSTATUS ldapsam_getsampwnam(struct pdb_methods *my_methods, struct samu *user, const char *sname)
1362 {
1363 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1364 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1365 LDAPMessage *result = NULL;
1366 LDAPMessage *entry = NULL;
1367 int count;
1368 const char ** attr_list;
1369 int rc;
1370
1371 attr_list = get_userattr_list( user, ldap_state->schema_ver );
1372 append_attr(user, &attr_list,
1373 get_userattr_key2string(ldap_state->schema_ver,
1374 LDAP_ATTR_MOD_TIMESTAMP));
1375 append_attr(user, &attr_list, "uidNumber");
1376 rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result,
1377 attr_list);
1378 TALLOC_FREE( attr_list );
1379
1380 if ( rc != LDAP_SUCCESS )
1381 return NT_STATUS_NO_SUCH_USER;
1382
1383 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1384
1385 if (count < 1) {
1386 DEBUG(4, ("ldapsam_getsampwnam: Unable to locate user [%s] count=%d\n", sname, count));
1387 ldap_msgfree(result);
1388 return NT_STATUS_NO_SUCH_USER;
1389 } else if (count > 1) {
1390 DEBUG(1, ("ldapsam_getsampwnam: Duplicate entries for this user [%s] Failing. count=%d\n", sname, count));
1391 ldap_msgfree(result);
1392 return NT_STATUS_NO_SUCH_USER;
1393 }
1394
1395 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1396 if (entry) {
1397 if (!init_sam_from_ldap(ldap_state, user, entry)) {
1398 DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname));
1399 ldap_msgfree(result);
1400 return NT_STATUS_NO_SUCH_USER;
1401 }
1402 pdb_set_backend_private_data(user, result, NULL,
1403 my_methods, PDB_CHANGED);
1404 talloc_autofree_ldapmsg(user, result);
1405 ret = NT_STATUS_OK;
1406 } else {
1407 ldap_msgfree(result);
1408 }
1409 return ret;
1410 }
1411
1412 static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state,
1413 const DOM_SID *sid, LDAPMessage **result)
1414 {
1415 int rc = -1;
1416 const char ** attr_list;
1417 uint32 rid;
1418
1419 switch ( ldap_state->schema_ver ) {
1420 case SCHEMAVER_SAMBASAMACCOUNT: {
1421 TALLOC_CTX *tmp_ctx = talloc_new(NULL);
1422 if (tmp_ctx == NULL) {
1423 return LDAP_NO_MEMORY;
1424 }
1425
1426 attr_list = get_userattr_list(tmp_ctx,
1427 ldap_state->schema_ver);
1428 append_attr(tmp_ctx, &attr_list,
1429 get_userattr_key2string(
1430 ldap_state->schema_ver,
1431 LDAP_ATTR_MOD_TIMESTAMP));
1432 append_attr(tmp_ctx, &attr_list, "uidNumber");
1433 rc = ldapsam_search_suffix_by_sid(ldap_state, sid,
1434 result, attr_list);
1435 TALLOC_FREE(tmp_ctx);
1436
1437 if ( rc != LDAP_SUCCESS )
1438 return rc;
1439 break;
1440 }
1441
1442 case SCHEMAVER_SAMBAACCOUNT:
1443 if (!sid_peek_check_rid(&ldap_state->domain_sid, sid, &rid)) {
1444 return rc;
1445 }
1446
1447 attr_list = get_userattr_list(NULL,
1448 ldap_state->schema_ver);
1449 rc = ldapsam_search_suffix_by_rid(ldap_state, rid, result, attr_list );
1450 TALLOC_FREE( attr_list );
1451
1452 if ( rc != LDAP_SUCCESS )
1453 return rc;
1454 break;
1455 }
1456 return rc;
1457 }
1458
1459 /**********************************************************************
1460 Get struct samu entry from LDAP by SID.
1461 *********************************************************************/
1462
1463 static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, struct samu * user, const DOM_SID *sid)
1464 {
1465 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1466 LDAPMessage *result = NULL;
1467 LDAPMessage *entry = NULL;
1468 int count;
1469 int rc;
1470 fstring sid_string;
1471
1472 rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1473 sid, &result);
1474 if (rc != LDAP_SUCCESS)
1475 return NT_STATUS_NO_SUCH_USER;
1476
1477 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1478
1479 if (count < 1) {
1480 DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string, sid),
1481 count));
1482 ldap_msgfree(result);
1483 return NT_STATUS_NO_SUCH_USER;
1484 } else if (count > 1) {
1485 DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string, sid),
1486 count));
1487 ldap_msgfree(result);
1488 return NT_STATUS_NO_SUCH_USER;
1489 }
1490
1491 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1492 if (!entry) {
1493 ldap_msgfree(result);
1494 return NT_STATUS_NO_SUCH_USER;
1495 }
1496
1497 if (!init_sam_from_ldap(ldap_state, user, entry)) {
1498 DEBUG(1,("ldapsam_getsampwsid: init_sam_from_ldap failed!\n"));
1499 ldap_msgfree(result);
1500 return NT_STATUS_NO_SUCH_USER;
1501 }
1502
1503 pdb_set_backend_private_data(user, result, NULL,
1504 my_methods, PDB_CHANGED);
1505 talloc_autofree_ldapmsg(user, result);
1506 return NT_STATUS_OK;
1507 }
1508
1509 /********************************************************************
1510 Do the actual modification - also change a plaintext passord if
1511 it it set.
1512 **********************************************************************/
1513
1514 static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods,
1515 struct samu *newpwd, char *dn,
1516 LDAPMod **mods, int ldap_op,
1517 BOOL (*need_update)(const struct samu *, enum pdb_elements))
1518 {
1519 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1520 int rc;
1521
1522 if (!newpwd || !dn) {
1523 return NT_STATUS_INVALID_PARAMETER;
1524 }
1525
1526 if (!mods) {
1527 DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
1528 /* may be password change below however */
1529 } else {
1530 switch(ldap_op) {
1531 case LDAP_MOD_ADD:
1532 if (ldap_state->is_nds_ldap) {
1533 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1534 "objectclass",
1535 "inetOrgPerson");
1536 } else {
1537 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1538 "objectclass",
1539 LDAP_OBJ_ACCOUNT);
1540 }
1541 rc = smbldap_add(ldap_state->smbldap_state,
1542 dn, mods);
1543 break;
1544 case LDAP_MOD_REPLACE:
1545 rc = smbldap_modify(ldap_state->smbldap_state,
1546 dn ,mods);
1547 break;
1548 default:
1549 DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n",
1550 ldap_op));
1551 return NT_STATUS_INVALID_PARAMETER;
1552 }
1553
1554 if (rc!=LDAP_SUCCESS) {
1555 return NT_STATUS_UNSUCCESSFUL;
1556 }
1557 }
1558
1559 if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) &&
1560 (lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) &&
1561 need_update(newpwd, PDB_PLAINTEXT_PW) &&
1562 (pdb_get_plaintext_passwd(newpwd)!=NULL)) {
1563 BerElement *ber;
1564 struct berval *bv;
1565 char *retoid = NULL;
1566 struct berval *retdata = NULL;
1567 char *utf8_password;
1568 char *utf8_dn;
1569
1570 if (!ldap_state->is_nds_ldap) {
1571
1572 if (!smbldap_has_extension(ldap_state->smbldap_state->ldap_struct,
1573 LDAP_EXOP_MODIFY_PASSWD)) {
1574 DEBUG(2, ("ldap password change requested, but LDAP "
1575 "server does not support it -- ignoring\n"));
1576 return NT_STATUS_OK;
1577 }
1578 }
1579
1580 if (push_utf8_allocate(&utf8_password, pdb_get_plaintext_passwd(newpwd)) == (size_t)-1) {
1581 return NT_STATUS_NO_MEMORY;
1582 }
1583
1584 if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) {
1585 return NT_STATUS_NO_MEMORY;
1586 }
1587
1588 if ((ber = ber_alloc_t(LBER_USE_DER))==NULL) {
1589 DEBUG(0,("ber_alloc_t returns NULL\n"));
1590 SAFE_FREE(utf8_password);
1591 return NT_STATUS_UNSUCCESSFUL;
1592 }
1593
1594 ber_printf (ber, "{");
1595 ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, utf8_dn);
1596 ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, utf8_password);
1597 ber_printf (ber, "N}");
1598
1599 if ((rc = ber_flatten (ber, &bv))<0) {
1600 DEBUG(0,("ldapsam_modify_entry: ber_flatten returns a value <0\n"));
1601 ber_free(ber,1);
1602 SAFE_FREE(utf8_dn);
1603 SAFE_FREE(utf8_password);
1604 return NT_STATUS_UNSUCCESSFUL;
1605 }
1606
1607 SAFE_FREE(utf8_dn);
1608 SAFE_FREE(utf8_password);
1609 ber_free(ber, 1);
1610
1611 if (!ldap_state->is_nds_ldap) {
1612 rc = smbldap_extended_operation(ldap_state->smbldap_state,
1613 LDAP_EXOP_MODIFY_PASSWD,
1614 bv, NULL, NULL, &retoid,
1615 &retdata);
1616 } else {
1617 rc = pdb_nds_set_password(ldap_state->smbldap_state, dn,
1618 pdb_get_plaintext_passwd(newpwd));
1619 }
1620 if (rc != LDAP_SUCCESS) {
1621 char *ld_error = NULL;
1622
1623 if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
1624 DEBUG(3, ("Could not set userPassword "
1625 "attribute due to an objectClass "
1626 "violation -- ignoring\n"));
1627 ber_bvfree(bv);
1628 return NT_STATUS_OK;
1629 }
1630
1631 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1632 &ld_error);
1633 DEBUG(0,("ldapsam_modify_entry: LDAP Password could not be changed for user %s: %s\n\t%s\n",
1634 pdb_get_username(newpwd), ldap_err2string(rc), ld_error?ld_error:"unknown"));
1635 SAFE_FREE(ld_error);
1636 ber_bvfree(bv);
1637 return NT_STATUS_UNSUCCESSFUL;
1638 } else {
1639 DEBUG(3,("ldapsam_modify_entry: LDAP Password changed for user %s\n",pdb_get_username(newpwd)));
1640 #ifdef DEBUG_PASSWORD
1641 DEBUG(100,("ldapsam_modify_entry: LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd)));
1642 #endif
1643 if (retdata)
1644 ber_bvfree(retdata);
1645 if (retoid)
1646 ldap_memfree(retoid);
1647 }
1648 ber_bvfree(bv);
1649 }
1650 return NT_STATUS_OK;
1651 }
1652
1653 /**********************************************************************
1654 Delete entry from LDAP for username.
1655 *********************************************************************/
1656
1657 static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods,
1658 struct samu * sam_acct)
1659 {
1660 struct ldapsam_privates *priv =
1661 (struct ldapsam_privates *)my_methods->private_data;
1662 const char *sname;
1663 int rc;
1664 LDAPMessage *msg, *entry;
1665 NTSTATUS result = NT_STATUS_NO_MEMORY;
1666 const char **attr_list;
1667 TALLOC_CTX *mem_ctx;
1668
1669 if (!sam_acct) {
1670 DEBUG(0, ("ldapsam_delete_sam_account: sam_acct was NULL!\n"));
1671 return NT_STATUS_INVALID_PARAMETER;
1672 }
1673
1674 sname = pdb_get_username(sam_acct);
1675
1676 DEBUG(3, ("ldapsam_delete_sam_account: Deleting user %s from "
1677 "LDAP.\n", sname));
1678
1679 mem_ctx = talloc_new(NULL);
1680 if (mem_ctx == NULL) {
1681 DEBUG(0, ("talloc_new failed\n"));
1682 goto done;
1683 }
1684
1685 attr_list = get_userattr_delete_list(mem_ctx, priv->schema_ver );
1686 if (attr_list == NULL) {
1687 goto done;
1688 }
1689
1690 rc = ldapsam_search_suffix_by_name(priv, sname, &msg, attr_list);
1691
1692 if ((rc != LDAP_SUCCESS) ||
1693 (ldap_count_entries(priv2ld(priv), msg) != 1) ||
1694 ((entry = ldap_first_entry(priv2ld(priv), msg)) == NULL)) {
1695 DEBUG(5, ("Could not find user %s\n", sname));
1696 result = NT_STATUS_NO_SUCH_USER;
1697 goto done;
1698 }
1699
1700 rc = ldapsam_delete_entry(
1701 priv, mem_ctx, entry,
1702 priv->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ?
1703 LDAP_OBJ_SAMBASAMACCOUNT : LDAP_OBJ_SAMBAACCOUNT,
1704 attr_list);
1705
1706 result = (rc == LDAP_SUCCESS) ?
1707 NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
1708
1709 done:
1710 TALLOC_FREE(mem_ctx);
1711 return result;
1712 }
1713
1714 /**********************************************************************
1715 Helper function to determine for update_sam_account whether
1716 we need LDAP modification.
1717 *********************************************************************/
1718
1719 static BOOL element_is_changed(const struct samu *sampass,
1720 enum pdb_elements element)
1721 {
1722 return IS_SAM_CHANGED(sampass, element);
1723 }
1724
1725 /**********************************************************************
1726 Update struct samu.
1727 *********************************************************************/
1728
1729 static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, struct samu * newpwd)
1730 {
1731 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1732 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1733 int rc = 0;
1734 char *dn;
1735 LDAPMessage *result = NULL;
1736 LDAPMessage *entry = NULL;
1737 LDAPMod **mods = NULL;
1738 const char **attr_list;
1739
1740 result = pdb_get_backend_private_data(newpwd, my_methods);
1741 if (!result) {
1742 attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
1743 rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list );
1744 TALLOC_FREE( attr_list );
1745 if (rc != LDAP_SUCCESS) {
1746 return NT_STATUS_UNSUCCESSFUL;
1747 }
1748 pdb_set_backend_private_data(newpwd, result, NULL,
1749 my_methods, PDB_CHANGED);
1750 talloc_autofree_ldapmsg(newpwd, result);
1751 }
1752
1753 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
1754 DEBUG(0, ("ldapsam_update_sam_account: No user to modify!\n"));
1755 return NT_STATUS_UNSUCCESSFUL;
1756 }
1757
1758 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1759 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
1760 if (!dn) {
1761 return NT_STATUS_UNSUCCESSFUL;
1762 }
1763
1764 DEBUG(4, ("ldapsam_update_sam_account: user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn));
1765
1766 if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
1767 element_is_changed)) {
1768 DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
1769 SAFE_FREE(dn);
1770 if (mods != NULL)
1771 ldap_mods_free(mods,True);
1772 return NT_STATUS_UNSUCCESSFUL;
1773 }
1774
1775 if (mods == NULL) {
1776 DEBUG(4,("ldapsam_update_sam_account: mods is empty: nothing to update for user: %s\n",
1777 pdb_get_username(newpwd)));
1778 SAFE_FREE(dn);
1779 return NT_STATUS_OK;
1780 }
1781
1782 ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed);
1783 ldap_mods_free(mods,True);
1784 SAFE_FREE(dn);
1785
1786 if (!NT_STATUS_IS_OK(ret)) {
1787 return ret;
1788 }
1789
1790 DEBUG(2, ("ldapsam_update_sam_account: successfully modified uid = %s in the LDAP database\n",
1791 pdb_get_username(newpwd)));
1792 return NT_STATUS_OK;
1793 }
1794
1795 /***************************************************************************
1796 Renames a struct samu
1797 - The "rename user script" has full responsibility for changing everything
1798 ***************************************************************************/
1799
1800 static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
1801 struct samu *old_acct,
1802 const char *newname)
1803 {
1804 const char *oldname;
1805 int rc;
1806 pstring rename_script;
1807
1808 if (!old_acct) {
1809 DEBUG(0, ("ldapsam_rename_sam_account: old_acct was NULL!\n"));
1810 return NT_STATUS_INVALID_PARAMETER;
1811 }
1812 if (!newname) {
1813 DEBUG(0, ("ldapsam_rename_sam_account: newname was NULL!\n"));
1814 return NT_STATUS_INVALID_PARAMETER;
1815 }
1816
1817 oldname = pdb_get_username(old_acct);
1818
1819 /* rename the posix user */
1820 pstrcpy(rename_script, lp_renameuser_script());
1821
1822 if (!(*rename_script))
1823 return NT_STATUS_ACCESS_DENIED;
1824
1825 DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n",
1826 oldname, newname));
1827
1828 /* we have to allow the account name to end with a '$' */
1829 string_sub2(rename_script, "%unew", newname, sizeof(pstring),
1830 True, False, True);
1831 string_sub2(rename_script, "%uold", oldname, sizeof(pstring),
1832 True, False, True);
1833 rc = smbrun(rename_script, NULL);
1834
1835 DEBUG(rc ? 0 : 3,("Running the command `%s' gave %d\n",
1836 rename_script, rc));
1837
1838 if (rc)
1839 return NT_STATUS_UNSUCCESSFUL;
1840
1841 return NT_STATUS_OK;
1842 }
1843
1844 /**********************************************************************
1845 Helper function to determine for update_sam_account whether
1846 we need LDAP modification.
1847 *********************************************************************/
1848
1849 static BOOL element_is_set_or_changed(const struct samu *sampass,
1850 enum pdb_elements element)
1851 {
1852 return (IS_SAM_SET(sampass, element) ||
1853 IS_SAM_CHANGED(sampass, element));
1854 }
1855
1856 /**********************************************************************
1857 Add struct samu to LDAP.
1858 *********************************************************************/
1859
1860 static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, struct samu * newpwd)
1861 {
1862 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1863 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1864 int rc;
1865 LDAPMessage *result = NULL;
1866 LDAPMessage *entry = NULL;
1867 pstring dn;
1868 LDAPMod **mods = NULL;
1869 int ldap_op = LDAP_MOD_REPLACE;
1870 uint32 num_result;
1871 const char **attr_list;
1872 char *escape_user;
1873 const char *username = pdb_get_username(newpwd);
1874 const DOM_SID *sid = pdb_get_user_sid(newpwd);
1875 pstring filter;
1876 fstring sid_string;
1877
1878 if (!username || !*username) {
1879 DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
1880 return NT_STATUS_INVALID_PARAMETER;
1881 }
1882
1883 /* free this list after the second search or in case we exit on failure */
1884 attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
1885
1886 rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
1887
1888 if (rc != LDAP_SUCCESS) {
1889 TALLOC_FREE( attr_list );
1890 return NT_STATUS_UNSUCCESSFUL;
1891 }
1892
1893 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
1894 DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
1895 username));
1896 ldap_msgfree(result);
1897 TALLOC_FREE( attr_list );
1898 return NT_STATUS_UNSUCCESSFUL;
1899 }
1900 ldap_msgfree(result);
1901 result = NULL;
1902
1903 if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
1904 rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1905 sid, &result);
1906 if (rc == LDAP_SUCCESS) {
1907 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
1908 DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n",
1909 sid_to_string(sid_string, sid)));
1910 TALLOC_FREE( attr_list );
1911 ldap_msgfree(result);
1912 return NT_STATUS_UNSUCCESSFUL;
1913 }
1914 ldap_msgfree(result);
1915 }
1916 }
1917
1918 /* does the entry already exist but without a samba attributes?
1919 we need to return the samba attributes here */
1920
1921 escape_user = escape_ldap_string_alloc( username );
1922 pstrcpy( filter, "(uid=%u)" );
1923 all_string_sub( filter, "%u", escape_user, sizeof(filter) );
1924 SAFE_FREE( escape_user );
1925
1926 rc = smbldap_search_suffix(ldap_state->smbldap_state,
1927 filter, attr_list, &result);
1928 if ( rc != LDAP_SUCCESS ) {
1929 TALLOC_FREE( attr_list );
1930 return NT_STATUS_UNSUCCESSFUL;
1931 }
1932
1933 num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1934
1935 if (num_result > 1) {
1936 DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
1937 TALLOC_FREE( attr_list );
1938 ldap_msgfree(result);
1939 return NT_STATUS_UNSUCCESSFUL;
1940 }
1941
1942 /* Check if we need to update an existing entry */
1943 if (num_result == 1) {
1944 char *tmp;
1945
1946 DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
1947 ldap_op = LDAP_MOD_REPLACE;
1948 entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
1949 tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
1950 if (!tmp) {
1951 TALLOC_FREE( attr_list );
1952 ldap_msgfree(result);
1953 return NT_STATUS_UNSUCCESSFUL;
1954 }
1955 slprintf (dn, sizeof (dn) - 1, "%s", tmp);
1956 SAFE_FREE(tmp);
1957
1958 } else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
1959
1960 /* There might be a SID for this account already - say an idmap entry */
1961
1962 pstr_sprintf(filter, "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))",
1963 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
1964 sid_to_string(sid_string, sid),
1965 LDAP_OBJ_IDMAP_ENTRY,
1966 LDAP_OBJ_SID_ENTRY);
1967
1968 /* free old result before doing a new search */
1969 if (result != NULL) {
1970 ldap_msgfree(result);
1971 result = NULL;
1972 }
1973 rc = smbldap_search_suffix(ldap_state->smbldap_state,
1974 filter, attr_list, &result);
1975
1976 if ( rc != LDAP_SUCCESS ) {
1977 TALLOC_FREE( attr_list );
1978 return NT_STATUS_UNSUCCESSFUL;
1979 }
1980
1981 num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1982
1983 if (num_result > 1) {
1984 DEBUG (0, ("ldapsam_add_sam_account: More than one user with specified Sid exists: bailing out!\n"));
1985 TALLOC_FREE( attr_list );
1986 ldap_msgfree(result);
1987 return NT_STATUS_UNSUCCESSFUL;
1988 }
1989
1990 /* Check if we need to update an existing entry */
1991 if (num_result == 1) {
1992 char *tmp;
1993
1994 DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
1995 ldap_op = LDAP_MOD_REPLACE;
1996 entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
1997 tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
1998 if (!tmp) {
1999 TALLOC_FREE( attr_list );
2000 ldap_msgfree(result);
2001 return NT_STATUS_UNSUCCESSFUL;
2002 }
2003 slprintf (dn, sizeof (dn) - 1, "%s", tmp);
2004 SAFE_FREE(tmp);
2005 }
2006 }
2007
2008 TALLOC_FREE( attr_list );
2009
2010 if (num_result == 0) {
2011 /* Check if we need to add an entry */
2012 DEBUG(3,("ldapsam_add_sam_account: Adding new user\n"));
2013 ldap_op = LDAP_MOD_ADD;
2014 if (username[strlen(username)-1] == '$') {
2015 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_machine_suffix ());
2016 } else {
2017 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_user_suffix ());
2018 }
2019 }
2020
2021 if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
2022 element_is_set_or_changed)) {
2023 DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
2024 ldap_msgfree(result);
2025 if (mods != NULL)
2026 ldap_mods_free(mods,True);
2027 return NT_STATUS_UNSUCCESSFUL;
2028 }
2029
2030 ldap_msgfree(result);
2031
2032 if (mods == NULL) {
2033 DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
2034 return NT_STATUS_UNSUCCESSFUL;
2035 }
2036 switch ( ldap_state->schema_ver ) {
2037 case SCHEMAVER_SAMBAACCOUNT:
2038 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT);
2039 break;
2040 case SCHEMAVER_SAMBASAMACCOUNT:
2041 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT);
2042 break;
2043 default:
2044 DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n"));
2045 break;
2046 }
2047
2048 ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed);
2049 if (!NT_STATUS_IS_OK(ret)) {
2050 DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
2051 pdb_get_username(newpwd),dn));
2052 ldap_mods_free(mods, True);
2053 return ret;
2054 }
2055
2056 DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
2057 ldap_mods_free(mods, True);
2058
2059 return NT_STATUS_OK;
2060 }
2061
2062 /**********************************************************************
2063 *********************************************************************/
2064
2065 static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
2066 const char *filter,
2067 LDAPMessage ** result)
2068 {
2069 int scope = LDAP_SCOPE_SUBTREE;
2070 int rc;
2071 const char **attr_list;
2072
2073 attr_list = get_attr_list(NULL, groupmap_attr_list);
2074 rc = smbldap_search(ldap_state->smbldap_state,
2075 lp_ldap_group_suffix (), scope,
2076 filter, attr_list, 0, result);
2077 TALLOC_FREE(attr_list);
2078
2079 return rc;
2080 }
2081
2082 /**********************************************************************
2083 *********************************************************************/
2084
2085 static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state,
2086 GROUP_MAP *map, LDAPMessage *entry)
2087 {
2088 pstring temp;
2089
2090 if (ldap_state == NULL || map == NULL || entry == NULL ||
2091 ldap_state->smbldap_state->ldap_struct == NULL) {
2092 DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
2093 return False;
2094 }
2095
2096 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2097 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp)) {
2098 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2099 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
2100 return False;
2101 }
2102 DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
2103
2104 map->gid = (gid_t)atol(temp);
2105
2106 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2107 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp)) {
2108 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2109 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
2110 return False;
2111 }
2112
2113 if (!string_to_sid(&map->sid, temp)) {
2114 DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
2115 return False;
2116 }
2117
2118 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2119 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) {
2120 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2121 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
2122 return False;
2123 }
2124 map->sid_name_use = (enum SID_NAME_USE)atol(temp);
2125
2126 if ((map->sid_name_use < SID_NAME_USER) ||
2127 (map->sid_name_use > SID_NAME_UNKNOWN)) {
2128 DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
2129 return False;
2130 }
2131
2132 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2133 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp)) {
2134 temp[0] = '\0';
2135 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2136 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp))
2137 {
2138 DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
2139 for gidNumber(%lu)\n",(unsigned long)map->gid));
2140 return False;
2141 }
2142 }
2143 fstrcpy(map->nt_name, temp);
2144
2145 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2146 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp)) {
2147 temp[0] = '\0';
2148 }
2149 fstrcpy(map->comment, temp);
2150
2151 if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
2152 store_gid_sid_cache(&map->sid, map->gid);
2153 }
2154
2155 return True;
2156 }
2157
2158 /**********************************************************************
2159 *********************************************************************/
2160
2161 static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods,
2162 const char *filter,
2163 GROUP_MAP *map)
2164 {
2165 struct ldapsam_privates *ldap_state =
2166 (struct ldapsam_privates *)methods->private_data;
2167 LDAPMessage *result = NULL;
2168 LDAPMessage *entry = NULL;
2169 int count;
2170
2171 if (ldapsam_search_one_group(ldap_state, filter, &result)
2172 != LDAP_SUCCESS) {
2173 return NT_STATUS_NO_SUCH_GROUP;
2174 }
2175
2176 count = ldap_count_entries(priv2ld(ldap_state), result);
2177
2178 if (count < 1) {
2179 DEBUG(4, ("ldapsam_getgroup: Did not find group\n"));
2180 ldap_msgfree(result);
2181 return NT_STATUS_NO_SUCH_GROUP;
2182 }
2183
2184 if (count > 1) {
2185 DEBUG(1, ("ldapsam_getgroup: Duplicate entries for filter %s: "
2186 "count=%d\n", filter, count));
2187 ldap_msgfree(result);
2188 return NT_STATUS_NO_SUCH_GROUP;
2189 }
2190
2191 entry = ldap_first_entry(priv2ld(ldap_state), result);
2192
2193 if (!entry) {
2194 ldap_msgfree(result);
2195 return NT_STATUS_UNSUCCESSFUL;
2196 }
2197
2198 if (!init_group_from_ldap(ldap_state, map, entry)) {
2199 DEBUG(1, ("ldapsam_getgroup: init_group_from_ldap failed for "
2200 "group filter %s\n", filter));
2201 ldap_msgfree(result);
2202 return NT_STATUS_NO_SUCH_GROUP;
2203 }
2204
2205 ldap_msgfree(result);
2206 return NT_STATUS_OK;
2207 }
2208
2209 /**********************************************************************
2210 *********************************************************************/
2211
2212 static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
2213 DOM_SID sid)
2214 {
2215 pstring filter;
2216
2217 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
2218 LDAP_OBJ_GROUPMAP,
2219 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
2220 sid_string_static(&sid));
2221
2222 return ldapsam_getgroup(methods, filter, map);
2223 }
2224
2225 /**********************************************************************
2226 *********************************************************************/
2227
2228 static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
2229 gid_t gid)
2230 {
2231 pstring filter;
2232
2233 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))",
2234 LDAP_OBJ_GROUPMAP,
2235 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2236 (unsigned long)gid);
2237
2238 return ldapsam_getgroup(methods, filter, map);
2239 }
2240
2241 /**********************************************************************
2242 *********************************************************************/
2243
2244 static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
2245 const char *name)
2246 {
2247 pstring filter;
2248 char *escape_name = escape_ldap_string_alloc(name);
2249
2250 if (!escape_name) {
2251 return NT_STATUS_NO_MEMORY;
2252 }
2253
2254 pstr_sprintf(filter, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
2255 LDAP_OBJ_GROUPMAP,
2256 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
2257 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), escape_name);
2258
2259 SAFE_FREE(escape_name);
2260
2261 return ldapsam_getgroup(methods, filter, map);
2262 }
2263
2264 static void add_rid_to_array_unique(TALLOC_CTX *mem_ctx,
2265 uint32 rid, uint32 **pp_rids, size_t *p_num)
2266 {
2267 size_t i;
2268
2269 for (i=0; i<*p_num; i++) {
2270 if ((*pp_rids)[i] == rid)
2271 return;
2272 }
2273
2274 *pp_rids = TALLOC_REALLOC_ARRAY(mem_ctx, *pp_rids, uint32, *p_num+1);
2275
2276 if (*pp_rids == NULL)
2277 return;
2278
2279 (*pp_rids)[*p_num] = rid;
2280 *p_num += 1;
2281 }
2282
2283 static BOOL ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
2284 LDAPMessage *entry,
2285 const DOM_SID *domain_sid,
2286 uint32 *rid)
2287 {
2288 fstring str;
2289 DOM_SID sid;
2290
2291 if (!smbldap_get_single_attribute(ldap_struct, entry, "sambaSID",
2292 str, sizeof(str)-1)) {
2293 DEBUG(10, ("Could not find sambaSID attribute\n"));
2294 return False;
2295 }
2296
2297 if (!string_to_sid(&sid, str)) {
2298 DEBUG(10, ("Could not convert string %s to sid\n", str));
2299 return False;
2300 }
2301
2302 if (sid_compare_domain(&sid, domain_sid) != 0) {
2303 DEBUG(10, ("SID %s is not in expected domain %s\n",
2304 str, sid_string_static(domain_sid)));
2305 return False;
2306 }
2307
2308 if (!sid_peek_rid(&sid, rid)) {
2309 DEBUG(10, ("Could not peek into RID\n"));
2310 return False;
2311 }
2312
2313 return True;
2314 }
2315
2316 static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
2317 TALLOC_CTX *mem_ctx,
2318 const DOM_SID *group,
2319 uint32 **pp_member_rids,
2320 size_t *p_num_members)
2321 {
2322 struct ldapsam_privates *ldap_state =
2323 (struct ldapsam_privates *)methods->private_data;
2324 struct smbldap_state *conn = ldap_state->smbldap_state;
2325 const char *id_attrs[] = { "memberUid", "gidNumber", NULL };
2326 const char *sid_attrs[] = { "sambaSID", NULL };
2327 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2328 LDAPMessage *result = NULL;
2329 LDAPMessage *entry;
2330 char *filter;
2331 char **values = NULL;
2332 char **memberuid;
2333 char *gidstr;
2334 int rc, count;
2335
2336 *pp_member_rids = NULL;
2337 *p_num_members = 0;
2338
2339 filter = talloc_asprintf(mem_ctx,
2340 "(&(objectClass=%s)"
2341 "(objectClass=%s)"
2342 "(sambaSID=%s))",
2343 LDAP_OBJ_POSIXGROUP,
2344 LDAP_OBJ_GROUPMAP,
2345 sid_string_static(group));
2346
2347 rc = smbldap_search(conn, lp_ldap_group_suffix(),
2348 LDAP_SCOPE_SUBTREE, filter, id_attrs, 0,
2349 &result);
2350
2351 if (rc != LDAP_SUCCESS)
2352 goto done;
2353
2354 talloc_autofree_ldapmsg(mem_ctx, result);
2355
2356 count = ldap_count_entries(conn->ldap_struct, result);
2357
2358 if (count > 1) {
2359 DEBUG(1, ("Found more than one groupmap entry for %s\n",
2360 sid_string_static(group)));
2361 ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2362 goto done;
2363 }
2364
2365 if (count == 0) {
2366 ret = NT_STATUS_NO_SUCH_GROUP;
2367 goto done;
2368 }
2369
2370 entry = ldap_first_entry(conn->ldap_struct, result);
2371 if (entry == NULL)
2372 goto done;
2373
2374 gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", mem_ctx);
2375 if (!gidstr) {
2376 DEBUG (0, ("ldapsam_enum_group_members: Unable to find the group's gid!\n"));
2377 ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2378 goto done;
2379 }
2380
2381 values = ldap_get_values(conn->ldap_struct, entry, "memberUid");
2382
2383 if (values) {
2384
2385 filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(|", LDAP_OBJ_SAMBAACCOUNT);
2386 if (filter == NULL) {
2387 ret = NT_STATUS_NO_MEMORY;
2388 goto done;
2389 }
2390
2391 for (memberuid = values; *memberuid != NULL; memberuid += 1) {
2392 filter = talloc_asprintf_append(filter, "(uid=%s)", *memberuid);
2393 if (filter == NULL) {
2394 ret = NT_STATUS_NO_MEMORY;
2395 goto done;
2396 }
2397 }
2398
2399 filter = talloc_asprintf_append(filter, "))");
2400 if (filter == NULL) {
2401 ret = NT_STATUS_NO_MEMORY;
2402 goto done;
2403 }
2404
2405 rc = smbldap_search(conn, lp_ldap_user_suffix(),
2406 LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
2407 &result);
2408
2409 if (rc != LDAP_SUCCESS)
2410 goto done;
2411
2412 count = ldap_count_entries(conn->ldap_struct, result);
2413 DEBUG(10,("ldapsam_enum_group_members: found %d accounts\n", count));
2414
2415 talloc_autofree_ldapmsg(mem_ctx, result);
2416
2417 for (entry = ldap_first_entry(conn->ldap_struct, result);
2418 entry != NULL;
2419 entry = ldap_next_entry(conn->ldap_struct, entry))
2420 {
2421 char *sidstr;
2422 DOM_SID sid;
2423 uint32 rid;
2424
2425 sidstr = smbldap_talloc_single_attribute(conn->ldap_struct,
2426 entry, "sambaSID",
2427 mem_ctx);
2428 if (!sidstr) {
2429 DEBUG(0, ("Severe DB error, sambaSamAccount can't miss "
2430 "the sambaSID attribute\n"));
2431 ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2432 goto done;
2433 }
2434
2435 if (!string_to_sid(&sid, sidstr))
2436 goto done;
2437
2438 if (!sid_check_is_in_our_domain(&sid)) {
2439 DEBUG(0, ("Inconsistent SAM -- group member uid not "
2440 "in our domain\n"));
2441 ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2442 goto done;
2443 }
2444
2445 sid_peek_rid(&sid, &rid);
2446
2447 add_rid_to_array_unique(mem_ctx, rid, pp_member_rids,
2448 p_num_members);
2449 }
2450 }
2451
2452 filter = talloc_asprintf(mem_ctx,
2453 "(&(objectClass=%s)"
2454 "(gidNumber=%s))",
2455 LDAP_OBJ_SAMBASAMACCOUNT,
2456 gidstr);
2457
2458 rc = smbldap_search(conn, lp_ldap_user_suffix(),
2459 LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
2460 &result);
2461
2462 if (rc != LDAP_SUCCESS)
2463 goto done;
2464
2465 talloc_autofree_ldapmsg(mem_ctx, result);
2466
2467 for (entry = ldap_first_entry(conn->ldap_struct, result);
2468 entry != NULL;
2469 entry = ldap_next_entry(conn->ldap_struct, entry))
2470 {
2471 uint32 rid;
2472
2473 if (!ldapsam_extract_rid_from_entry(conn->ldap_struct,
2474 entry,
2475 get_global_sam_sid(),
2476 &rid)) {
2477 DEBUG(0, ("Severe DB error, sambaSamAccount can't miss "
2478 "the sambaSID attribute\n"));
2479 ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2480 goto done;
2481 }
2482
2483 add_rid_to_array_unique(mem_ctx, rid, pp_member_rids,
2484 p_num_members);
2485 }
2486
2487 ret = NT_STATUS_OK;
2488
2489 done:
2490
2491 if (values)
2492 ldap_value_free(values);
2493
2494 return ret;
2495 }
2496
2497 static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
2498 TALLOC_CTX *mem_ctx,
2499 struct samu *user,
2500 DOM_SID **pp_sids,
2501 gid_t **pp_gids,
2502 size_t *p_num_groups)
2503 {
2504 struct ldapsam_privates *ldap_state =
2505 (struct ldapsam_privates *)methods->private_data;
2506 struct smbldap_state *conn = ldap_state->smbldap_state;
2507 char *filter;
2508 const char *attrs[] = { "gidNumber", "sambaSID", NULL };
2509 char *escape_name;
2510 int rc, count;
2511 LDAPMessage *result = NULL;
2512 LDAPMessage *entry;
2513 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2514 size_t num_sids, num_gids;
2515 char *gidstr;
2516 gid_t primary_gid = -1;
2517
2518 *pp_sids = NULL;
2519 num_sids = 0;
2520
2521 escape_name = escape_ldap_string_alloc(pdb_get_username(user));
2522 if (escape_name == NULL)
2523 return NT_STATUS_NO_MEMORY;
2524
2525 /* retrieve the users primary gid */
2526 filter = talloc_asprintf(mem_ctx,
2527 "(&(objectClass=%s)(uid=%s))",
2528 LDAP_OBJ_SAMBASAMACCOUNT,
2529 escape_name);
2530
2531 rc = smbldap_search(conn, lp_ldap_user_suffix(),
2532 LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
2533
2534 if (rc != LDAP_SUCCESS)
2535 goto done;
2536
2537 talloc_autofree_ldapmsg(mem_ctx, result);
2538
2539 count = ldap_count_entries(priv2ld(ldap_state), result);
2540
2541 switch (count) {
2542 case 0:
2543 DEBUG(1, ("User account [%s] not found!\n", pdb_get_username(user)));
2544 ret = NT_STATUS_NO_SUCH_USER;
2545 goto done;
2546 case 1:
2547 entry = ldap_first_entry(priv2ld(ldap_state), result);
2548
2549 gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", mem_ctx);
2550 if (!gidstr) {
2551 DEBUG (1, ("Unable to find the member's gid!\n"));
2552 ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2553 goto done;
2554 }
2555 primary_gid = strtoul(gidstr, NULL, 10);
2556 break;
2557 default:
2558 DEBUG(1, ("found more than one accoutn with the same user name ?!\n"));
2559 ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2560 goto done;
2561 }
2562
2563 filter = talloc_asprintf(mem_ctx,
2564 "(&(objectClass=%s)(|(memberUid=%s)(gidNumber=%d)))",
2565 LDAP_OBJ_POSIXGROUP, escape_name, primary_gid);
2566
2567 rc = smbldap_search(conn, lp_ldap_group_suffix(),
2568 LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
2569
2570 if (rc != LDAP_SUCCESS)
2571 goto done;
2572
2573 talloc_autofree_ldapmsg(mem_ctx, result);
2574
2575 num_gids = 0;
2576 *pp_gids = NULL;
2577
2578 num_sids = 0;
2579 *pp_sids = NULL;
2580
2581 /* We need to add the primary group as the first gid/sid */
2582
2583 add_gid_to_array_unique(mem_ctx, primary_gid, pp_gids, &num_gids);
2584
2585 /* This sid will be replaced later */
2586
2587 add_sid_to_array_unique(mem_ctx, &global_sid_NULL, pp_sids, &num_sids);
2588
2589 for (entry = ldap_first_entry(conn->ldap_struct, result);
2590 entry != NULL;
2591 entry = ldap_next_entry(conn->ldap_struct, entry))
2592 {
2593 fstring str;
2594 DOM_SID sid;
2595 gid_t gid;
2596 char *end;
2597
2598 if (!smbldap_get_single_attribute(conn->ldap_struct,
2599 entry, "sambaSID",
2600 str, sizeof(str)-1))
2601 continue;
2602
2603 if (!string_to_sid(&sid, str))
2604 goto done;
2605
2606 if (!smbldap_get_single_attribute(conn->ldap_struct,
2607 entry, "gidNumber",
2608 str, sizeof(str)-1))
2609 continue;
2610
2611 gid = strtoul(str, &end, 10);
2612
2613 if (PTR_DIFF(end, str) != strlen(str))
2614 goto done;
2615
2616 if (gid == primary_gid) {
2617 sid_copy(&(*pp_sids)[0], &sid);
2618 } else {
2619 add_gid_to_array_unique(mem_ctx, gid, pp_gids,
2620 &num_gids);
2621 add_sid_to_array_unique(mem_ctx, &sid, pp_sids,
2622 &num_sids);
2623 }
2624 }
2625
2626 if (sid_compare(&global_sid_NULL, &(*pp_sids)[0]) == 0) {
2627 DEBUG(3, ("primary group of [%s] not found\n",
2628 pdb_get_username(user)));
2629 goto done;
2630 }
2631
2632 *p_num_groups = num_sids;
2633
2634 ret = NT_STATUS_OK;
2635
2636 done:
2637
2638 SAFE_FREE(escape_name);
2639 return ret;
2640 }
2641
2642 /**********************************************************************
2643 * Augment a posixGroup object with a sambaGroupMapping domgroup
2644 *********************************************************************/
2645
2646 static NTSTATUS ldapsam_map_posixgroup(TALLOC_CTX *mem_ctx,
2647 struct ldapsam_privates *ldap_state,
2648 GROUP_MAP *map)
2649 {
2650 const char *filter, *dn;
2651 LDAPMessage *msg, *entry;
2652 LDAPMod **mods;
2653 int rc;
2654
2655 filter = talloc_asprintf(mem_ctx,
2656 "(&(objectClass=posixGroup)(gidNumber=%u))",
2657 map->gid);
2658 if (filter == NULL) {
2659 return NT_STATUS_NO_MEMORY;
2660 }
2661
2662 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter,
2663 get_attr_list(mem_ctx, groupmap_attr_list),
2664 &msg);
2665 talloc_autofree_ldapmsg(mem_ctx, msg);
2666
2667 if ((rc != LDAP_SUCCESS) ||
2668 (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) != 1) ||
2669 ((entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg)) == NULL)) {
2670 return NT_STATUS_NO_SUCH_GROUP;
2671 }
2672
2673 dn = smbldap_talloc_dn(mem_ctx, ldap_state->smbldap_state->ldap_struct, entry);
2674 if (dn == NULL) {
2675 return NT_STATUS_NO_MEMORY;
2676 }
2677
2678 mods = NULL;
2679 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass",
2680 "sambaGroupMapping");
2681 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "sambaSid",
2682 sid_string_static(&map->sid));
2683 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "sambaGroupType",
2684 talloc_asprintf(mem_ctx, "%d", map->sid_name_use));
2685 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "displayName",
2686 map->nt_name);
2687 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
2688 map->comment);
2689 talloc_autofree_ldapmod(mem_ctx, mods);
2690
2691 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2692 if (rc != LDAP_SUCCESS) {
2693 return NT_STATUS_ACCESS_DENIED;
2694 }
2695
2696 return NT_STATUS_OK;
2697 }
2698
2699 static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
2700 GROUP_MAP *map)
2701 {
2702 struct ldapsam_privates *ldap_state =
2703 (struct ldapsam_privates *)methods->private_data;
2704 LDAPMessage *msg = NULL;
2705 LDAPMod **mods = NULL;
2706 const char *attrs[] = { NULL };
2707 char *filter;
2708
2709 char *dn;
2710 TALLOC_CTX *mem_ctx;
2711 NTSTATUS result;
2712
2713 DOM_SID sid;
2714
2715 int rc;
2716
2717 mem_ctx = talloc_new(NULL);
2718 if (mem_ctx == NULL) {
2719 DEBUG(0, ("talloc_new failed\n"));
2720 return NT_STATUS_NO_MEMORY;
2721 }
2722
2723 filter = talloc_asprintf(mem_ctx, "(sambaSid=%s)",
2724 sid_string_static(&map->sid));
2725 if (filter == NULL) {
2726 result = NT_STATUS_NO_MEMORY;
2727 goto done;
2728 }
2729
2730 rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
2731 LDAP_SCOPE_SUBTREE, filter, attrs, True, &msg);
2732 talloc_autofree_ldapmsg(mem_ctx, msg);
2733
2734 if ((rc == LDAP_SUCCESS) &&
2735 (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) > 0)) {
2736
2737 DEBUG(3, ("SID %s already present in LDAP, refusing to add "
2738 "group mapping entry\n",
2739 sid_string_static(&map->sid)));
2740 result = NT_STATUS_GROUP_EXISTS;
2741 goto done;
2742 }
2743
2744 switch (map->sid_name_use) {
2745
2746 case SID_NAME_DOM_GRP:
2747 /* To map a domain group we need to have a posix group
2748 to attach to. */
2749 result = ldapsam_map_posixgroup(mem_ctx, ldap_state, map);
2750 goto done;
2751 break;
2752
2753 case SID_NAME_ALIAS:
2754 if (!sid_check_is_in_our_domain(&map->sid)
2755 && !sid_check_is_in_builtin(&map->sid) )
2756 {
2757 DEBUG(3, ("Refusing to map sid %s as an alias, not in our domain\n",
2758 sid_string_static(&map->sid)));
2759 result = NT_STATUS_INVALID_PARAMETER;
2760 goto done;
2761 }
2762 break;
2763
2764 default:
2765 DEBUG(3, ("Got invalid use '%s' for mapping\n",
2766 sid_type_lookup(map->sid_name_use)));
2767 result = NT_STATUS_INVALID_PARAMETER;
2768 goto done;
2769 }
2770
2771 /* Domain groups have been mapped in a separate routine, we have to
2772 * create an alias now */
2773
2774 if (map->gid == -1) {
2775 DEBUG(10, ("Refusing to map gid==-1\n"));
2776 result = NT_STATUS_INVALID_PARAMETER;
2777 goto done;
2778 }
2779
2780 if (pdb_gid_to_sid(map->gid, &sid)) {
2781 DEBUG(3, ("Gid %d is already mapped to SID %s, refusing to "
2782 "add\n", map->gid, sid_string_static(&sid)));
2783 result = NT_STATUS_GROUP_EXISTS;
2784 goto done;
2785 }
2786
2787 /* Ok, enough checks done. It's still racy to go ahead now, but that's
2788 * the best we can get out of LDAP. */
2789
2790 dn = talloc_asprintf(mem_ctx, "sambaSid=%s,%s",
2791 sid_string_static(&map->sid),
2792 lp_ldap_group_suffix());
2793 if (dn == NULL) {
2794 result = NT_STATUS_NO_MEMORY;
2795 goto done;
2796 }
2797
2798 mods = NULL;
2799
2800 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "objectClass",
2801 "sambaSidEntry");
2802 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "objectClass",
2803 "sambaGroupMapping");
2804
2805 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "sambaSid",
2806 sid_string_static(&map->sid));
2807 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "sambaGroupType",
2808 talloc_asprintf(mem_ctx, "%d", map->sid_name_use));
2809 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "displayName",
2810 map->nt_name);
2811 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "description",
2812 map->comment);
2813 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "gidNumber",
2814 talloc_asprintf(mem_ctx, "%u", map->gid));
2815 talloc_autofree_ldapmod(mem_ctx, mods);
2816
2817 rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
2818
2819 result = (rc == LDAP_SUCCESS) ?
2820 NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
2821
2822 done:
2823 TALLOC_FREE(mem_ctx);
2824 return result;
2825 }
2826
2827 /**********************************************************************
2828 * Update a group mapping entry. We're quite strict about what can be changed:
2829 * Only the description and displayname may be changed. It simply does not
2830 * make any sense to change the SID, gid or the type in a mapping.
2831 *********************************************************************/
2832
2833 static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods,
2834 GROUP_MAP *map)
2835 {
2836 struct ldapsam_privates *ldap_state =
2837 (struct ldapsam_privates *)methods->private_data;
2838 int rc;
2839 const char *filter, *dn;
2840 LDAPMessage *msg = NULL;
2841 LDAPMessage *entry = NULL;
2842 LDAPMod **mods = NULL;
2843 TALLOC_CTX *mem_ctx;
2844 NTSTATUS result;
2845
2846 mem_ctx = talloc_new(NULL);
2847 if (mem_ctx == NULL) {
2848 DEBUG(0, ("talloc_new failed\n"));
2849 return NT_STATUS_NO_MEMORY;
2850 }
2851
2852 /* Make 100% sure that sid, gid and type are not changed by looking up
2853 * exactly the values we're given in LDAP. */
2854
2855 filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)"
2856 "(sambaSid=%s)(gidNumber=%u)"
2857 "(sambaGroupType=%d))",
2858 LDAP_OBJ_GROUPMAP,
2859 sid_string_static(&map->sid), map->gid,
2860 map->sid_name_use);
2861 if (filter == NULL) {
2862 result = NT_STATUS_NO_MEMORY;
2863 goto done;
2864 }
2865
2866 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter,
2867 get_attr_list(mem_ctx, groupmap_attr_list),
2868 &msg);
2869 talloc_autofree_ldapmsg(mem_ctx, msg);
2870
2871 if ((rc != LDAP_SUCCESS) ||
2872 (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) != 1) ||
2873 ((entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg)) == NULL)) {
2874 result = NT_STATUS_NO_SUCH_GROUP;
2875 goto done;
2876 }
2877
2878 dn = smbldap_talloc_dn(mem_ctx, ldap_state->smbldap_state->ldap_struct, entry);
2879
2880 if (dn == NULL) {
2881 result = NT_STATUS_NO_MEMORY;
2882 goto done;
2883 }
2884
2885 mods = NULL;
2886 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "displayName",
2887 map->nt_name);
2888 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
2889 map->comment);
2890 talloc_autofree_ldapmod(mem_ctx, mods);
2891
2892 if (mods == NULL) {
2893 DEBUG(4, ("ldapsam_update_group_mapping_entry: mods is empty: "
2894 "nothing to do\n"));
2895 result = NT_STATUS_OK;
2896 goto done;
2897 }
2898
2899 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2900
2901 if (rc != LDAP_SUCCESS) {
2902 result = NT_STATUS_ACCESS_DENIED;
2903 goto done;
2904 }
2905
2906 DEBUG(2, ("ldapsam_update_group_mapping_entry: successfully modified "
2907 "group %lu in LDAP\n", (unsigned long)map->gid));
2908
2909 result = NT_STATUS_OK;
2910
2911 done:
2912 TALLOC_FREE(mem_ctx);
2913 return result;
2914 }
2915
2916 /**********************************************************************
2917 *********************************************************************/
2918
2919 static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods,
2920 DOM_SID sid)
2921 {
2922 struct ldapsam_privates *priv =
2923 (struct ldapsam_privates *)methods->private_data;
2924 LDAPMessage *msg, *entry;
2925 int rc;
2926 NTSTATUS result;
2927 TALLOC_CTX *mem_ctx;
2928 char *filter;
2929
2930 mem_ctx = talloc_new(NULL);
2931 if (mem_ctx == NULL) {
2932 DEBUG(0, ("talloc_new failed\n"));
2933 return NT_STATUS_NO_MEMORY;
2934 }
2935
2936 filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(%s=%s))",
2937 LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID,
2938 sid_string_static(&sid));
2939 if (filter == NULL) {
2940 result = NT_STATUS_NO_MEMORY;
2941 goto done;
2942 }
2943 rc = smbldap_search_suffix(priv->smbldap_state, filter,
2944 get_attr_list(mem_ctx, groupmap_attr_list),
2945 &msg);
2946 talloc_autofree_ldapmsg(mem_ctx, msg);
2947
2948 if ((rc != LDAP_SUCCESS) ||
2949 (ldap_count_entries(priv2ld(priv), msg) != 1) ||
2950 ((entry = ldap_first_entry(priv2ld(priv), msg)) == NULL)) {
2951 result = NT_STATUS_NO_SUCH_GROUP;
2952 goto done;
2953 }
2954
2955 rc = ldapsam_delete_entry(priv, mem_ctx, entry, LDAP_OBJ_GROUPMAP,
2956 get_attr_list(mem_ctx,
2957 groupmap_attr_list_to_delete));
2958
2959 if ((rc == LDAP_NAMING_VIOLATION) ||
2960 (rc == LDAP_OBJECT_CLASS_VIOLATION)) {
2961 const char *attrs[] = { "sambaGroupType", "description",
2962 "displayName", "sambaSIDList",
2963 NULL };
2964
2965 /* Second try. Don't delete the sambaSID attribute, this is
2966 for "old" entries that are tacked on a winbind
2967 sambaIdmapEntry. */
2968
2969 rc = ldapsam_delete_entry(priv, mem_ctx, entry,
2970 LDAP_OBJ_GROUPMAP, attrs);
2971 }
2972
2973 if ((rc == LDAP_NAMING_VIOLATION) ||
2974 (rc == LDAP_OBJECT_CLASS_VIOLATION)) {
2975 const char *attrs[] = { "sambaGroupType", "description",
2976 "displayName", "sambaSIDList",
2977 "gidNumber", NULL };
2978
2979 /* Third try. This is a post-3.0.21 alias (containing only
2980 * sambaSidEntry and sambaGroupMapping classes), we also have
2981 * to delete the gidNumber attribute, only the sambaSidEntry
2982 * remains */
2983
2984 rc = ldapsam_delete_entry(priv, mem_ctx, entry,
2985 LDAP_OBJ_GROUPMAP, attrs);
2986 }
2987
2988 result = (rc == LDAP_SUCCESS) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
2989
2990 done:
2991 TALLOC_FREE(mem_ctx);
2992 return result;
2993 }
2994
2995 /**********************************************************************
2996 *********************************************************************/
2997
2998 static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods,
2999 BOOL update)
3000 {
3001 struct ldapsam_privates *ldap_state =
3002 (struct ldapsam_privates *)my_methods->private_data;
3003 fstring filter;
3004 int rc;
3005 const char **attr_list;
3006
3007 pstr_sprintf( filter, "(objectclass=%s)", LDAP_OBJ_GROUPMAP);
3008 attr_list = get_attr_list( NULL, groupmap_attr_list );
3009 rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
3010 LDAP_SCOPE_SUBTREE, filter,
3011 attr_list, 0, &ldap_state->result);
3012 TALLOC_FREE(attr_list);
3013
3014 if (rc != LDAP_SUCCESS) {
3015 DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n",
3016 ldap_err2string(rc)));
3017 DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n",
3018 lp_ldap_group_suffix(), filter));
3019 ldap_msgfree(ldap_state->result);
3020 ldap_state->result = NULL;
3021 return NT_STATUS_UNSUCCESSFUL;
3022 }
3023
3024 DEBUG(2, ("ldapsam_setsamgrent: %d entries in the base!\n",
3025 ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3026 ldap_state->result)));
3027
3028 ldap_state->entry =
3029 ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3030 ldap_state->result);
3031 ldap_state->index = 0;
3032
3033 return NT_STATUS_OK;
3034 }
3035
3036 /**********************************************************************
3037 *********************************************************************/
3038
3039 static void ldapsam_endsamgrent(struct pdb_methods *my_methods)
3040 {
3041 ldapsam_endsampwent(my_methods);
3042 }
3043
3044 /**********************************************************************
3045 *********************************************************************/
3046
3047 static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods,
3048 GROUP_MAP *map)
3049 {
3050 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
3051 struct ldapsam_privates *ldap_state =
3052 (struct ldapsam_privates *)my_methods->private_data;
3053 BOOL bret = False;
3054
3055 while (!bret) {
3056 if (!ldap_state->entry)
3057 return ret;
3058
3059 ldap_state->index++;
3060 bret = init_group_from_ldap(ldap_state, map,
3061 ldap_state->entry);
3062
3063 ldap_state->entry =
3064 ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
3065 ldap_state->entry);
3066 }
3067
3068 return NT_STATUS_OK;
3069 }
3070
3071 /**********************************************************************
3072 *********************************************************************/
3073
3074 static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
3075 const DOM_SID *domsid, enum SID_NAME_USE sid_name_use,
3076 GROUP_MAP **pp_rmap,
3077 size_t *p_num_entries,
3078 BOOL unix_only)
3079 {
3080 GROUP_MAP map;
3081 size_t entries = 0;
3082
3083 *p_num_entries = 0;
3084 *pp_rmap = NULL;
3085
3086 if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods, False))) {
3087 DEBUG(0, ("ldapsam_enum_group_mapping: Unable to open "
3088 "passdb\n"));
3089 return NT_STATUS_ACCESS_DENIED;
3090 }
3091
3092 while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) {
3093 if (sid_name_use != SID_NAME_UNKNOWN &&
3094 sid_name_use != map.sid_name_use) {
3095 DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
3096 "not of the requested type\n", map.nt_name));
3097 continue;
3098 }
3099 if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
3100 DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
3101 "non mapped\n", map.nt_name));
3102 continue;
3103 }
3104
3105 (*pp_rmap)=SMB_REALLOC_ARRAY((*pp_rmap), GROUP_MAP, entries+1);
3106 if (!(*pp_rmap)) {
3107 DEBUG(0,("ldapsam_enum_group_mapping: Unable to "
3108 "enlarge group map!\n"));
3109 return NT_STATUS_UNSUCCESSFUL;
3110 }
3111
3112 (*pp_rmap)[entries] = map;
3113
3114 entries += 1;
3115
3116 }
3117 ldapsam_endsamgrent(methods);
3118
3119 *p_num_entries = entries;
3120
3121 return NT_STATUS_OK;
3122 }
3123
3124 static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
3125 const DOM_SID *alias,
3126 const DOM_SID *member,
3127 int modop)
3128 {
3129 struct ldapsam_privates *ldap_state =
3130 (struct ldapsam_privates *)methods->private_data;
3131 char *dn;
3132 LDAPMessage *result = NULL;
3133 LDAPMessage *entry = NULL;
3134 int count;
3135 LDAPMod **mods = NULL;
3136 int rc;
3137 enum SID_NAME_USE type = SID_NAME_USE_NONE;
3138
3139 pstring filter;
3140
3141 if (sid_check_is_in_builtin(alias)) {
3142 type = SID_NAME_ALIAS;
3143 }
3144
3145 if (sid_check_is_in_our_domain(alias)) {
3146 type = SID_NAME_ALIAS;
3147 }
3148
3149 if (type == SID_NAME_USE_NONE) {
3150 DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
3151 sid_string_static(alias)));
3152 return NT_STATUS_NO_SUCH_ALIAS;
3153 }
3154
3155 pstr_sprintf(filter,
3156 "(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
3157 LDAP_OBJ_GROUPMAP, sid_string_static(alias),
3158 type);
3159
3160 if (ldapsam_search_one_group(ldap_state, filter,
3161 &result) != LDAP_SUCCESS)
3162 return NT_STATUS_NO_SUCH_ALIAS;
3163
3164 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3165 result);
3166
3167 if (count < 1) {
3168 DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
3169 ldap_msgfree(result);
3170 return NT_STATUS_NO_SUCH_ALIAS;
3171 }
3172
3173 if (count > 1) {
3174 DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for "
3175 "filter %s: count=%d\n", filter, count));
3176 ldap_msgfree(result);
3177 return NT_STATUS_NO_SUCH_ALIAS;
3178 }
3179
3180 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3181 result);
3182
3183 if (!entry) {
3184 ldap_msgfree(result);
3185 return NT_STATUS_UNSUCCESSFUL;
3186 }
3187
3188 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
3189 if (!dn) {
3190 ldap_msgfree(result);
3191 return NT_STATUS_UNSUCCESSFUL;
3192 }
3193
3194 smbldap_set_mod(&mods, modop,
3195 get_attr_key2string(groupmap_attr_list,
3196 LDAP_ATTR_SID_LIST),
3197 sid_string_static(member));
3198
3199 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3200
3201 ldap_mods_free(mods, True);
3202 ldap_msgfree(result);
3203 SAFE_FREE(dn);
3204
3205 if (rc == LDAP_TYPE_OR_VALUE_EXISTS) {
3206 return NT_STATUS_MEMBER_IN_ALIAS;
3207 }
3208
3209 if (rc == LDAP_NO_SUCH_ATTRIBUTE) {
3210 return NT_STATUS_MEMBER_NOT_IN_ALIAS;
3211 }
3212
3213 if (rc != LDAP_SUCCESS) {
3214 return NT_STATUS_UNSUCCESSFUL;
3215 }
3216
3217 return NT_STATUS_OK;
3218 }
3219
3220 static NTSTATUS ldapsam_add_aliasmem(struct pdb_methods *methods,
3221 const DOM_SID *alias,
3222 const DOM_SID *member)
3223 {
3224 return ldapsam_modify_aliasmem(methods, alias, member, LDAP_MOD_ADD);
3225 }
3226
3227 static NTSTATUS ldapsam_del_aliasmem(struct pdb_methods *methods,
3228 const DOM_SID *alias,
3229 const DOM_SID *member)
3230 {
3231 return ldapsam_modify_aliasmem(methods, alias, member,
3232 LDAP_MOD_DELETE);
3233 }
3234
3235 static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
3236 const DOM_SID *alias,
3237 DOM_SID **pp_members,
3238 size_t *p_num_members)
3239 {
3240 struct ldapsam_privates *ldap_state =
3241 (struct ldapsam_privates *)methods->private_data;
3242 LDAPMessage *result = NULL;
3243 LDAPMessage *entry = NULL;
3244 int count;
3245 char **values;
3246 int i;
3247 pstring filter;
3248 size_t num_members = 0;
3249 enum SID_NAME_USE type = SID_NAME_USE_NONE;
3250
3251 *pp_members = NULL;
3252 *p_num_members = 0;
3253
3254 if (sid_check_is_in_builtin(alias)) {
3255 type = SID_NAME_ALIAS;
3256 }
3257
3258 if (sid_check_is_in_our_domain(alias)) {
3259 type = SID_NAME_ALIAS;
3260 }
3261
3262 if (type == SID_NAME_USE_NONE) {
3263 DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
3264 sid_string_static(alias)));
3265 return NT_STATUS_NO_SUCH_ALIAS;
3266 }
3267
3268 pstr_sprintf(filter,
3269 "(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
3270 LDAP_OBJ_GROUPMAP, sid_string_static(alias),
3271 type);
3272
3273 if (ldapsam_search_one_group(ldap_state, filter,
3274 &result) != LDAP_SUCCESS)
3275 return NT_STATUS_NO_SUCH_ALIAS;
3276
3277 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3278 result);
3279
3280 if (count < 1) {
3281 DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
3282 ldap_msgfree(result);
3283 return NT_STATUS_NO_SUCH_ALIAS;
3284 }
3285
3286 if (count > 1) {
3287 DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for "
3288 "filter %s: count=%d\n", filter, count));
3289 ldap_msgfree(result);
3290 return NT_STATUS_NO_SUCH_ALIAS;
3291 }
3292
3293 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3294 result);
3295
3296 if (!entry) {
3297 ldap_msgfree(result);
3298 return NT_STATUS_UNSUCCESSFUL;
3299 }
3300
3301 values = ldap_get_values(ldap_state->smbldap_state->ldap_struct,
3302 entry,
3303 get_attr_key2string(groupmap_attr_list,
3304 LDAP_ATTR_SID_LIST));
3305
3306 if (values == NULL) {
3307 ldap_msgfree(result);
3308 return NT_STATUS_OK;
3309 }
3310
3311 count = ldap_count_values(values);
3312
3313 for (i=0; i<count; i++) {
3314 DOM_SID member;
3315
3316 if (!string_to_sid(&member, values[i]))
3317 continue;
3318
3319 add_sid_to_array(NULL, &member, pp_members, &num_members);
3320 }
3321
3322 *p_num_members = num_members;
3323 ldap_value_free(values);
3324 ldap_msgfree(result);
3325
3326 return NT_STATUS_OK;
3327 }
3328
3329 static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
3330 TALLOC_CTX *mem_ctx,
3331 const DOM_SID *domain_sid,
3332 const DOM_SID *members,
3333 size_t num_members,
3334 uint32 **pp_alias_rids,
3335 size_t *p_num_alias_rids)
3336 {
3337 struct ldapsam_privates *ldap_state =
3338 (struct ldapsam_privates *)methods->private_data;
3339 LDAP *ldap_struct;
3340
3341 const char *attrs[] = { LDAP_ATTRIBUTE_SID, NULL };
3342
3343 LDAPMessage *result = NULL;
3344 LDAPMessage *entry = NULL;
3345 int i;
3346 int rc;
3347 char *filter;
3348 enum SID_NAME_USE type = SID_NAME_USE_NONE;
3349
3350 if (sid_check_is_builtin(domain_sid)) {
3351 type = SID_NAME_ALIAS;
3352 }
3353
3354 if (sid_check_is_domain(domain_sid)) {
3355 type = SID_NAME_ALIAS;
3356 }
3357
3358 if (type == SID_NAME_USE_NONE) {
3359 DEBUG(5, ("SID %s is neither builtin nor domain!\n",
3360 sid_string_static(domain_sid)));
3361 return NT_STATUS_UNSUCCESSFUL;
3362 }
3363
3364 filter = talloc_asprintf(mem_ctx,
3365 "(&(|(objectclass=%s)(sambaGroupType=%d))(|",
3366 LDAP_OBJ_GROUPMAP, type);
3367
3368 for (i=0; i<num_members; i++)
3369 filter = talloc_asprintf(mem_ctx, "%s(sambaSIDList=%s)",
3370 filter,
3371 sid_string_static(&members[i]));
3372
3373 filter = talloc_asprintf(mem_ctx, "%s))", filter);
3374
3375 rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
3376 LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
3377
3378 if (rc != LDAP_SUCCESS)
3379 return NT_STATUS_UNSUCCESSFUL;
3380
3381 ldap_struct = ldap_state->smbldap_state->ldap_struct;
3382
3383 for (entry = ldap_first_entry(ldap_struct, result);
3384 entry != NULL;
3385 entry = ldap_next_entry(ldap_struct, entry))
3386 {
3387 fstring sid_str;
3388 DOM_SID sid;
3389 uint32 rid;
3390
3391 if (!smbldap_get_single_attribute(ldap_struct, entry,
3392 LDAP_ATTRIBUTE_SID,
3393 sid_str,
3394 sizeof(sid_str)-1))
3395 continue;
3396
3397 if (!string_to_sid(&sid, sid_str))
3398 continue;
3399
3400 if (!sid_peek_check_rid(domain_sid, &sid, &rid))
3401 continue;
3402
3403 add_rid_to_array_unique(mem_ctx, rid, pp_alias_rids,
3404 p_num_alias_rids);
3405 }
3406
3407 ldap_msgfree(result);
3408 return NT_STATUS_OK;
3409 }
3410
3411 static NTSTATUS ldapsam_set_account_policy_in_ldap(struct pdb_methods *methods,
3412 int policy_index,
3413 uint32 value)
3414 {
3415 NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3416 int rc;
3417 LDAPMod **mods = NULL;
3418 fstring value_string;
3419 const char *policy_attr = NULL;
3420
3421 struct ldapsam_privates *ldap_state =
3422 (struct ldapsam_privates *)methods->private_data;
3423
3424 const char *attrs[2];
3425
3426 DEBUG(10,("ldapsam_set_account_policy_in_ldap\n"));
3427
3428 if (!ldap_state->domain_dn) {
3429 return NT_STATUS_INVALID_PARAMETER;
3430 }
3431
3432 policy_attr = get_account_policy_attr(policy_index);
3433 if (policy_attr == NULL) {
3434 DEBUG(0,("ldapsam_set_account_policy_in_ldap: invalid "
3435 "policy\n"));
3436 return ntstatus;
3437 }
3438
3439 attrs[0] = policy_attr;
3440 attrs[1] = NULL;
3441
3442 slprintf(value_string, sizeof(value_string) - 1, "%i", value);
3443
3444 smbldap_set_mod(&mods, LDAP_MOD_REPLACE, policy_attr, value_string);
3445
3446 rc = smbldap_modify(ldap_state->smbldap_state, ldap_state->domain_dn,
3447 mods);
3448
3449 ldap_mods_free(mods, True);
3450
3451 if (rc != LDAP_SUCCESS) {
3452 return ntstatus;
3453 }
3454
3455 if (!cache_account_policy_set(policy_index, value)) {
3456 DEBUG(0,("ldapsam_set_account_policy_in_ldap: failed to "
3457 "update local tdb cache\n"));
3458 return ntstatus;
3459 }
3460
3461 return NT_STATUS_OK;
3462 }
3463
3464 static NTSTATUS ldapsam_set_account_policy(struct pdb_methods *methods,
3465 int policy_index, uint32 value)
3466 {
3467 if (!account_policy_migrated(False)) {
3468 return (account_policy_set(policy_index, value)) ?
3469 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
3470 }
3471
3472 return ldapsam_set_account_policy_in_ldap(methods, policy_index,
3473 value);
3474 }
3475
3476 static NTSTATUS ldapsam_get_account_policy_from_ldap(struct pdb_methods *methods,
3477 int policy_index,
3478 uint32 *value)
3479 {
3480 NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3481 LDAPMessage *result = NULL;
3482 LDAPMessage *entry = NULL;
3483 int count;
3484 int rc;
3485 char **vals = NULL;
3486 const char *policy_attr = NULL;
3487
3488 struct ldapsam_privates *ldap_state =
3489 (struct ldapsam_privates *)methods->private_data;
3490
3491 const char *attrs[2];
3492
3493 DEBUG(10,("ldapsam_get_account_policy_from_ldap\n"));
3494
3495 if (!ldap_state->domain_dn) {
3496 return NT_STATUS_INVALID_PARAMETER;
3497 }
3498
3499 policy_attr = get_account_policy_attr(policy_index);
3500 if (!policy_attr) {
3501 DEBUG(0,("ldapsam_get_account_policy_from_ldap: invalid "
3502 "policy index: %d\n", policy_index));
3503 return ntstatus;
3504 }
3505
3506 attrs[0] = policy_attr;
3507 attrs[1] = NULL;
3508
3509 rc = smbldap_search(ldap_state->smbldap_state, ldap_state->domain_dn,
3510 LDAP_SCOPE_BASE, "(objectclass=*)", attrs, 0,
3511 &result);
3512
3513 if (rc != LDAP_SUCCESS) {
3514 return ntstatus;
3515 }
3516
3517 count = ldap_count_entries(priv2ld(ldap_state), result);
3518 if (count < 1) {
3519 goto out;
3520 }
3521
3522 entry = ldap_first_entry(priv2ld(ldap_state), result);
3523 if (entry == NULL) {
3524 goto out;
3525 }
3526
3527 vals = ldap_get_values(priv2ld(ldap_state), entry, policy_attr);
3528 if (vals == NULL) {
3529 goto out;
3530 }
3531
3532 *value = (uint32)atol(vals[0]);
3533
3534 ntstatus = NT_STATUS_OK;
3535
3536 out:
3537 if (vals)
3538 ldap_value_free(vals);
3539 ldap_msgfree(result);
3540
3541 return ntstatus;
3542 }
3543
3544 /* wrapper around ldapsam_get_account_policy_from_ldap(), handles tdb as cache
3545
3546 - if user hasn't decided to use account policies inside LDAP just reuse the
3547 old tdb values
3548
3549 - if there is a valid cache entry, return that
3550 - if there is an LDAP entry, update cache and return
3551 - otherwise set to default, update cache and return
3552
3553 Guenther
3554 */
3555 static NTSTATUS ldapsam_get_account_policy(struct pdb_methods *methods,
3556 int policy_index, uint32 *value)
3557 {
3558 NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3559
3560 if (!account_policy_migrated(False)) {
3561 return (account_policy_get(policy_index, value))
3562 ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
3563 }
3564
3565 if (cache_account_policy_get(policy_index, value)) {
3566 DEBUG(11,("ldapsam_get_account_policy: got valid value from "
3567 "cache\n"));
3568 return NT_STATUS_OK;
3569 }
3570
3571 ntstatus = ldapsam_get_account_policy_from_ldap(methods, policy_index,
3572 value);
3573 if (NT_STATUS_IS_OK(ntstatus)) {
3574 goto update_cache;
3575 }
3576
3577 DEBUG(10,("ldapsam_get_account_policy: failed to retrieve from "
3578 "ldap\n"));
3579
3580 #if 0
3581 /* should we automagically migrate old tdb value here ? */
3582 if (account_policy_get(policy_index, value))
3583 goto update_ldap;
3584
3585 DEBUG(10,("ldapsam_get_account_policy: no tdb for %d, trying "
3586 "default\n", policy_index));
3587 #endif
3588
3589 if (!account_policy_get_default(policy_index, value)) {
3590 return ntstatus;
3591 }
3592
3593 /* update_ldap: */
3594
3595 ntstatus = ldapsam_set_account_policy(methods, policy_index, *value);
3596 if (!NT_STATUS_IS_OK(ntstatus)) {
3597 return ntstatus;
3598 }
3599
3600 update_cache:
3601
3602 if (!cache_account_policy_set(policy_index, *value)) {
3603 DEBUG(0,("ldapsam_get_account_policy: failed to update local "
3604 "tdb as a cache\n"));
3605 return NT_STATUS_UNSUCCESSFUL;
3606 }
3607
3608 return NT_STATUS_OK;
3609 }
3610
3611 static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
3612 const DOM_SID *domain_sid,
3613 int num_rids,
3614 uint32 *rids,
3615 const char **names,
3616 uint32 *attrs)
3617 {
3618 struct ldapsam_privates *ldap_state =
3619 (struct ldapsam_privates *)methods->private_data;
3620 LDAPMessage *msg = NULL;
3621 LDAPMessage *entry;
3622 char *allsids = NULL;
3623 int i, rc, num_mapped;
3624 NTSTATUS result = NT_STATUS_NO_MEMORY;
3625 TALLOC_CTX *mem_ctx;
3626 LDAP *ld;
3627 BOOL is_builtin;
3628
3629 mem_ctx = talloc_new(NULL);
3630 if (mem_ctx == NULL) {
3631 DEBUG(0, ("talloc_new failed\n"));
3632 goto done;
3633 }
3634
3635 if (!sid_check_is_builtin(domain_sid) &&
3636 !sid_check_is_domain(domain_sid)) {
3637 result = NT_STATUS_INVALID_PARAMETER;
3638 goto done;
3639 }
3640
3641 for (i=0; i<num_rids; i++)
3642 attrs[i] = SID_NAME_UNKNOWN;
3643
3644 allsids = talloc_strdup(mem_ctx, "");
3645 if (allsids == NULL) {
3646 goto done;
3647 }
3648
3649 for (i=0; i<num_rids; i++) {
3650 DOM_SID sid;
3651 sid_compose(&sid, domain_sid, rids[i]);
3652 allsids = talloc_asprintf_append(allsids, "(sambaSid=%s)",
3653 sid_string_static(&sid));
3654 if (allsids == NULL) {
3655 goto done;
3656 }
3657 }
3658
3659 /* First look for users */
3660
3661 {
3662 char *filter;
3663 const char *ldap_attrs[] = { "uid", "sambaSid", NULL };
3664
3665 filter = talloc_asprintf(
3666 mem_ctx, ("(&(objectClass=%s)(|%s))"),
3667 LDAP_OBJ_SAMBASAMACCOUNT, allsids);
3668
3669 if (filter == NULL) {
3670 goto done;
3671 }
3672
3673 rc = smbldap_search(ldap_state->smbldap_state,
3674 lp_ldap_user_suffix(),
3675 LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
3676 &msg);
3677 talloc_autofree_ldapmsg(mem_ctx, msg);
3678 }
3679
3680 if (rc != LDAP_SUCCESS)
3681 goto done;
3682
3683 ld = ldap_state->smbldap_state->ldap_struct;
3684 num_mapped = 0;
3685
3686 for (entry = ldap_first_entry(ld, msg);
3687 entry != NULL;
3688 entry = ldap_next_entry(ld, entry)) {
3689 uint32 rid;
3690 int rid_index;
3691 const char *name;
3692
3693 if (!ldapsam_extract_rid_from_entry(ld, entry, domain_sid,
3694 &rid)) {
3695 DEBUG(2, ("Could not find sid from ldap entry\n"));
3696 continue;
3697 }
3698
3699 name = smbldap_talloc_single_attribute(ld, entry, "uid",
3700 names);
3701 if (name == NULL) {
3702 DEBUG(2, ("Could not retrieve uid attribute\n"));
3703 continue;
3704 }
3705
3706 for (rid_index = 0; rid_index < num_rids; rid_index++) {
3707 if (rid == rids[rid_index])
3708 break;
3709 }
3710
3711 if (rid_index == num_rids) {
3712 DEBUG(2, ("Got a RID not asked for: %d\n", rid));
3713 continue;
3714 }
3715
3716 attrs[rid_index] = SID_NAME_USER;
3717 names[rid_index] = name;
3718 num_mapped += 1;
3719 }
3720
3721 if (num_mapped == num_rids) {
3722 /* No need to look for groups anymore -- we're done */
3723 result = NT_STATUS_OK;
3724 goto done;
3725 }
3726
3727 /* Same game for groups */
3728
3729 {
3730 char *filter;
3731 const char *ldap_attrs[] = { "cn", "displayName", "sambaSid",
3732 "sambaGroupType", NULL };
3733
3734 filter = talloc_asprintf(
3735 mem_ctx, "(&(objectClass=%s)(|%s))",
3736 LDAP_OBJ_GROUPMAP, allsids);
3737 if (filter == NULL) {
3738 goto done;
3739 }
3740
3741 rc = smbldap_search(ldap_state->smbldap_state,
3742 lp_ldap_group_suffix(),
3743 LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
3744 &msg);
3745 talloc_autofree_ldapmsg(mem_ctx, msg);
3746 }
3747
3748 if (rc != LDAP_SUCCESS)
3749 goto done;
3750
3751 /* ldap_struct might have changed due to a reconnect */
3752
3753 ld = ldap_state->smbldap_state->ldap_struct;
3754
3755 /* For consistency checks, we already checked we're only domain or builtin */
3756
3757 is_builtin = sid_check_is_builtin(domain_sid);
3758
3759 for (entry = ldap_first_entry(ld, msg);
3760 entry != NULL;
3761 entry = ldap_next_entry(ld, entry))
3762 {
3763 uint32 rid;
3764 int rid_index;
3765 const char *attr;
3766 enum SID_NAME_USE type;
3767 const char *dn = smbldap_talloc_dn(mem_ctx, ld, entry);
3768
3769 attr = smbldap_talloc_single_attribute(ld, entry, "sambaGroupType",
3770 mem_ctx);
3771 if (attr == NULL) {
3772 DEBUG(2, ("Could not extract type from ldap entry %s\n",
3773 dn));
3774 continue;
3775 }
3776
3777 type = atol(attr);
3778
3779 /* Consistency checks */
3780 if ((is_builtin && (type != SID_NAME_ALIAS)) ||
3781 (!is_builtin && ((type != SID_NAME_ALIAS) &&
3782 (type != SID_NAME_DOM_GRP)))) {
3783 DEBUG(2, ("Rejecting invalid group mapping entry %s\n", dn));
3784 }
3785
3786 if (!ldapsam_extract_rid_from_entry(ld, entry, domain_sid,
3787 &rid)) {
3788 DEBUG(2, ("Could not find sid from ldap entry %s\n", dn));
3789 continue;
3790 }
3791
3792 attr = smbldap_talloc_single_attribute(ld, entry, "displayName", names);
3793
3794 if (attr == NULL) {
3795 DEBUG(10, ("Could not retrieve 'displayName' attribute from %s\n",
3796 dn));
3797 attr = smbldap_talloc_single_attribute(ld, entry, "cn", names);
3798 }
3799
3800 if (attr == NULL) {
3801 DEBUG(2, ("Could not retrieve naming attribute from %s\n",
3802 dn));
3803 continue;
3804 }
3805
3806 for (rid_index = 0; rid_index < num_rids; rid_index++) {
3807 if (rid == rids[rid_index])
3808 break;
3809 }
3810
3811 if (rid_index == num_rids) {
3812 DEBUG(2, ("Got a RID not asked for: %d\n", rid));
3813 continue;
3814 }
3815
3816 attrs[rid_index] = type;
3817 names[rid_index] = attr;
3818 num_mapped += 1;
3819 }
3820
3821 result = NT_STATUS_NONE_MAPPED;
3822
3823 if (num_mapped > 0)
3824 result = (num_mapped == num_rids) ?
3825 NT_STATUS_OK : STATUS_SOME_UNMAPPED;
3826 done:
3827 TALLOC_FREE(mem_ctx);
3828 return result;
3829 }
3830
3831 static char *get_ldap_filter(TALLOC_CTX *mem_ctx, const char *username)
3832 {
3833 char *filter = NULL;
3834 char *escaped = NULL;
3835 char *result = NULL;
3836
3837 asprintf(&filter, "(&%s(objectclass=sambaSamAccount))",
3838 "(uid=%u)");
3839 if (filter == NULL) goto done;
3840
3841 escaped = escape_ldap_string_alloc(username);
3842 if (escaped == NULL) goto done;
3843
3844 result = talloc_string_sub(mem_ctx, filter, "%u", username);
3845
3846 done:
3847 SAFE_FREE(filter);
3848 SAFE_FREE(escaped);
3849
3850 return result;
3851 }
3852
3853 const char **talloc_attrs(TALLOC_CTX *mem_ctx, ...)
3854 {
3855 int i, num = 0;
3856 va_list ap;
3857 const char **result;
3858
3859 va_start(ap, mem_ctx);
3860 while (va_arg(ap, const char *) != NULL)
3861 num += 1;
3862 va_end(ap);
3863
3864 result = TALLOC_ARRAY(mem_ctx, const char *, num+1);
3865
3866 va_start(ap, mem_ctx);
3867 for (i=0; i<num; i++)
3868 result[i] = talloc_strdup(mem_ctx, va_arg(ap, const char*));
3869 va_end(ap);
3870
3871 result[num] = NULL;
3872 return result;
3873 }
3874
3875 struct ldap_search_state {
3876 struct smbldap_state *connection;
3877
3878 uint32 acct_flags;
3879 uint16 group_type;
3880
3881 const char *base;
3882 int scope;
3883 const char *filter;
3884 const char **attrs;
3885 int attrsonly;
3886 void *pagedresults_cookie;
3887
3888 LDAPMessage *entries, *current_entry;
3889 BOOL (*ldap2displayentry)(struct ldap_search_state *state,
3890 TALLOC_CTX *mem_ctx,
3891 LDAP *ld, LDAPMessage *entry,
3892 struct samr_displayentry *result);
3893 };
3894
3895 static BOOL ldapsam_search_firstpage(struct pdb_search *search)
3896 {
3897 struct ldap_search_state *state = search->private_data;
3898 LDAP *ld;
3899 int rc = LDAP_OPERATIONS_ERROR;
3900
3901 state->entries = NULL;
3902
3903 if (state->connection->paged_results) {
3904 rc = smbldap_search_paged(state->connection, state->base,
3905 state->scope, state->filter,
3906 state->attrs, state->attrsonly,
3907 lp_ldap_page_size(), &state->entries,
3908 &state->pagedresults_cookie);
3909 }
3910
3911 if ((rc != LDAP_SUCCESS) || (state->entries == NULL)) {
3912
3913 if (state->entries != NULL) {
3914 /* Left over from unsuccessful paged attempt */
3915 ldap_msgfree(state->entries);
3916 state->entries = NULL;
3917 }
3918
3919 rc = smbldap_search(state->connection, state->base,
3920 state->scope, state->filter, state->attrs,
3921 state->attrsonly, &state->entries);
3922
3923 if ((rc != LDAP_SUCCESS) || (state->entries == NULL))
3924 return False;
3925
3926 /* Ok, the server was lying. It told us it could do paged
3927 * searches when it could not. */
3928 state->connection->paged_results = False;
3929 }
3930
3931 ld = state->connection->ldap_struct;
3932 if ( ld == NULL) {
3933 DEBUG(5, ("Don't have an LDAP connection right after a "
3934 "search\n"));
3935 return False;
3936 }
3937 state->current_entry = ldap_first_entry(ld, state->entries);
3938
3939 if (state->current_entry == NULL) {
3940 ldap_msgfree(state->entries);
3941 state->entries = NULL;
3942 }
3943
3944 return True;
3945 }
3946
3947 static BOOL ldapsam_search_nextpage(struct pdb_search *search)
3948 {
3949 struct ldap_search_state *state = search->private_data;
3950 int rc;
3951
3952 if (!state->connection->paged_results) {
3953 /* There is no next page when there are no paged results */
3954 return False;
3955 }
3956
3957 rc = smbldap_search_paged(state->connection, state->base,
3958 state->scope, state->filter, state->attrs,
3959 state->attrsonly, lp_ldap_page_size(),
3960 &state->entries,
3961 &state->pagedresults_cookie);
3962
3963 if ((rc != LDAP_SUCCESS) || (state->entries == NULL))
3964 return False;
3965
3966 state->current_entry = ldap_first_entry(state->connection->ldap_struct, state->entries);
3967
3968 if (state->current_entry == NULL) {
3969 ldap_msgfree(state->entries);
3970 state->entries = NULL;
3971 }
3972
3973 return True;
3974 }
3975
3976 static BOOL ldapsam_search_next_entry(struct pdb_search *search,
3977 struct samr_displayentry *entry)
3978 {
3979 struct ldap_search_state *state = search->private_data;
3980 BOOL result;
3981
3982 retry:
3983 if ((state->entries == NULL) && (state->pagedresults_cookie == NULL))
3984 return False;
3985
3986 if ((state->entries == NULL) &&
3987 !ldapsam_search_nextpage(search))
3988 return False;
3989
3990 result = state->ldap2displayentry(state, search->mem_ctx, state->connection->ldap_struct,
3991 state->current_entry, entry);
3992
3993 if (!result) {
3994 char *dn;
3995 dn = ldap_get_dn(state->connection->ldap_struct, state->current_entry);
3996 DEBUG(5, ("Skipping entry %s\n", dn != NULL ? dn : "<NULL>"));
3997 if (dn != NULL) ldap_memfree(dn);
3998 }
3999
4000 state->current_entry = ldap_next_entry(state->connection->ldap_struct, state->current_entry);
4001
4002 if (state->current_entry == NULL) {
4003 ldap_msgfree(state->entries);
4004 state->entries = NULL;
4005 }
4006
4007 if (!result) goto retry;
4008
4009 return True;
4010 }
4011
4012 static void ldapsam_search_end(struct pdb_search *search)
4013 {
4014 struct ldap_search_state *state = search->private_data;
4015 int rc;
4016
4017 if (state->pagedresults_cookie == NULL)
4018 return;
4019
4020 if (state->entries != NULL)
4021 ldap_msgfree(state->entries);
4022
4023 state->entries = NULL;
4024 state->current_entry = NULL;
4025
4026 if (!state->connection->paged_results)
4027 return;
4028
4029 /* Tell the LDAP server we're not interested in the rest anymore. */
4030
4031 rc = smbldap_search_paged(state->connection, state->base, state->scope,
4032 state->filter, state->attrs,
4033 state->attrsonly, 0, &state->entries,
4034 &state->pagedresults_cookie);
4035
4036 if (rc != LDAP_SUCCESS)
4037 DEBUG(5, ("Could not end search properly\n"));
4038
4039 return;
4040 }
4041
4042 static BOOL ldapuser2displayentry(struct ldap_search_state *state,
4043 TALLOC_CTX *mem_ctx,
4044 LDAP *ld, LDAPMessage *entry,
4045 struct samr_displayentry *result)
4046 {
4047 char **vals;
4048 DOM_SID sid;
4049 uint32 acct_flags;
4050
4051 vals = ldap_get_values(ld, entry, "sambaAcctFlags");
4052 if ((vals == NULL) || (vals[0] == NULL)) {
4053 DEBUG(5, ("\"sambaAcctFlags\" not found\n"));
4054 return False;
4055 }
4056 acct_flags = pdb_decode_acct_ctrl(vals[0]);
4057 ldap_value_free(vals);
4058
4059 if ((state->acct_flags != 0) &&
4060 ((state->acct_flags & acct_flags) == 0))
4061 return False;
4062
4063 result->acct_flags = acct_flags;
4064 result->account_name = "";
4065 result->fullname = "";
4066 result->description = "";
4067
4068 vals = ldap_get_values(ld, entry, "uid");
4069 if ((vals == NULL) || (vals[0] == NULL)) {
4070 DEBUG(5, ("\"uid\" not found\n"));
4071 return False;
4072 }
4073 pull_utf8_talloc(mem_ctx,
4074 CONST_DISCARD(char **, &result->account_name),
4075 vals[0]);
4076 ldap_value_free(vals);
4077
4078 vals = ldap_get_values(ld, entry, "displayName");
4079 if ((vals == NULL) || (vals[0] == NULL))
4080 DEBUG(8, ("\"displayName\" not found\n"));
4081 else
4082 pull_utf8_talloc(mem_ctx,
4083 CONST_DISCARD(char **, &result->fullname),
4084 vals[0]);
4085 ldap_value_free(vals);
4086
4087 vals = ldap_get_values(ld, entry, "description");
4088 if ((vals == NULL) || (vals[0] == NULL))
4089 DEBUG(8, ("\"description\" not found\n"));
4090 else
4091 pull_utf8_talloc(mem_ctx,
4092 CONST_DISCARD(char **, &result->description),
4093 vals[0]);
4094 ldap_value_free(vals);
4095
4096 if ((result->account_name == NULL) ||
4097 (result->fullname == NULL) ||
4098 (result->description == NULL)) {
4099 DEBUG(0, ("talloc failed\n"));
4100 return False;
4101 }
4102
4103 vals = ldap_get_values(ld, entry, "sambaSid");
4104 if ((vals == NULL) || (vals[0] == NULL)) {
4105 DEBUG(0, ("\"objectSid\" not found\n"));
4106 return False;
4107 }
4108
4109 if (!string_to_sid(&sid, vals[0])) {
4110 DEBUG(0, ("Could not convert %s to SID\n", vals[0]));
4111 ldap_value_free(vals);
4112 return False;
4113 }
4114 ldap_value_free(vals);
4115
4116 if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)) {
4117 DEBUG(0, ("sid %s does not belong to our domain\n",
4118 sid_string_static(&sid)));
4119 return False;
4120 }
4121
4122 return True;
4123 }
4124
4125
4126 static BOOL ldapsam_search_users(struct pdb_methods *methods,
4127 struct pdb_search *search,
4128 uint32 acct_flags)
4129 {
4130 struct ldapsam_privates *ldap_state = methods->private_data;
4131 struct ldap_search_state *state;
4132
4133 state = TALLOC_P(search->mem_ctx, struct ldap_search_state);
4134 if (state == NULL) {
4135 DEBUG(0, ("talloc failed\n"));
4136 return False;
4137 }
4138
4139 state->connection = ldap_state->smbldap_state;
4140
4141 if ((acct_flags != 0) && ((acct_flags & ACB_NORMAL) != 0))
4142 state->base = lp_ldap_user_suffix();
4143 else if ((acct_flags != 0) &&
4144 ((acct_flags & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) != 0))
4145 state->base = lp_ldap_machine_suffix();
4146 else
4147 state->base = lp_ldap_suffix();
4148
4149 state->acct_flags = acct_flags;
4150 state->base = talloc_strdup(search->mem_ctx, state->base);
4151 state->scope = LDAP_SCOPE_SUBTREE;
4152 state->filter = get_ldap_filter(search->mem_ctx, "*");
4153 state->attrs = talloc_attrs(search->mem_ctx, "uid", "sambaSid",
4154 "displayName", "description",
4155 "sambaAcctFlags", NULL);
4156 state->attrsonly = 0;
4157 state->pagedresults_cookie = NULL;
4158 state->entries = NULL;
4159 state->ldap2displayentry = ldapuser2displayentry;
4160
4161 if ((state->filter == NULL) || (state->attrs == NULL)) {
4162 DEBUG(0, ("talloc failed\n"));
4163 return False;
4164 }
4165
4166 search->private_data = state;
4167 search->next_entry = ldapsam_search_next_entry;
4168 search->search_end = ldapsam_search_end;
4169
4170 return ldapsam_search_firstpage(search);
4171 }
4172
4173 static BOOL ldapgroup2displayentry(struct ldap_search_state *state,
4174 TALLOC_CTX *mem_ctx,
4175 LDAP *ld, LDAPMessage *entry,
4176 struct samr_displayentry *result)
4177 {
4178 char **vals;
4179 DOM_SID sid;
4180 uint16 group_type;
4181
4182 result->account_name = "";
4183 result->fullname = "";
4184 result->description = "";
4185
4186
4187 vals = ldap_get_values(ld, entry, "sambaGroupType");
4188 if ((vals == NULL) || (vals[0] == NULL)) {
4189 DEBUG(5, ("\"sambaGroupType\" not found\n"));
4190 if (vals != NULL) {
4191 ldap_value_free(vals);
4192 }
4193 return False;
4194 }
4195
4196 group_type = atoi(vals[0]);
4197
4198 if ((state->group_type != 0) &&
4199 ((state->group_type != group_type))) {
4200 ldap_value_free(vals);
4201 return False;
4202 }
4203
4204 ldap_value_free(vals);
4205
4206 /* display name is the NT group name */
4207
4208 vals = ldap_get_values(ld, entry, "displayName");
4209 if ((vals == NULL) || (vals[0] == NULL)) {
4210 DEBUG(8, ("\"displayName\" not found\n"));
4211
4212 /* fallback to the 'cn' attribute */
4213 vals = ldap_get_values(ld, entry, "cn");
4214 if ((vals == NULL) || (vals[0] == NULL)) {
4215 DEBUG(5, ("\"cn\" not found\n"));
4216 return False;
4217 }
4218 pull_utf8_talloc(mem_ctx,
4219 CONST_DISCARD(char **, &result->account_name),
4220 vals[0]);
4221 }
4222 else {
4223 pull_utf8_talloc(mem_ctx,
4224 CONST_DISCARD(char **, &result->account_name),
4225 vals[0]);
4226 }
4227
4228 ldap_value_free(vals);
4229
4230 vals = ldap_get_values(ld, entry, "description");
4231 if ((vals == NULL) || (vals[0] == NULL))
4232 DEBUG(8, ("\"description\" not found\n"));
4233 else
4234 pull_utf8_talloc(mem_ctx,
4235 CONST_DISCARD(char **, &result->description),
4236 vals[0]);
4237 ldap_value_free(vals);
4238
4239 if ((result->account_name == NULL) ||
4240 (result->fullname == NULL) ||
4241 (result->description == NULL)) {
4242 DEBUG(0, ("talloc failed\n"));
4243 return False;
4244 }
4245
4246 vals = ldap_get_values(ld, entry, "sambaSid");
4247 if ((vals == NULL) || (vals[0] == NULL)) {
4248 DEBUG(0, ("\"objectSid\" not found\n"));
4249 if (vals != NULL) {
4250 ldap_value_free(vals);
4251 }
4252 return False;
4253 }
4254
4255 if (!string_to_sid(&sid, vals[0])) {
4256 DEBUG(0, ("Could not convert %s to SID\n", vals[0]));
4257 return False;
4258 }
4259
4260 ldap_value_free(vals);
4261
4262 switch (group_type) {
4263 case SID_NAME_DOM_GRP:
4264 case SID_NAME_ALIAS:
4265
4266 if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)
4267 && !sid_peek_check_rid(&global_sid_Builtin, &sid, &result->rid))
4268 {
4269 DEBUG(0, ("%s is not in our domain\n",
4270 sid_string_static(&sid)));
4271 return False;
4272 }
4273 break;
4274
4275 default:
4276 DEBUG(0,("unkown group type: %d\n", group_type));
4277 return False;
4278 }
4279
4280 return True;
4281 }
4282
4283 static BOOL ldapsam_search_grouptype(struct pdb_methods *methods,
4284 struct pdb_search *search,
4285 const DOM_SID *sid,
4286 enum SID_NAME_USE type)
4287 {
4288 struct ldapsam_privates *ldap_state = methods->private_data;
4289 struct ldap_search_state *state;
4290
4291 state = TALLOC_P(search->mem_ctx, struct ldap_search_state);
4292 if (state == NULL) {
4293 DEBUG(0, ("talloc failed\n"));
4294 return False;
4295 }
4296
4297 state->connection = ldap_state->smbldap_state;
4298
4299 state->base = talloc_strdup(search->mem_ctx, lp_ldap_group_suffix());
4300 state->connection = ldap_state->smbldap_state;
4301 state->scope = LDAP_SCOPE_SUBTREE;
4302 state->filter = talloc_asprintf(search->mem_ctx,
4303 "(&(objectclass=sambaGroupMapping)"
4304 "(sambaGroupType=%d)(sambaSID=%s*))",
4305 type, sid_string_static(sid));
4306 state->attrs = talloc_attrs(search->mem_ctx, "cn", "sambaSid",
4307 "displayName", "description",
4308 "sambaGroupType", NULL);
4309 state->attrsonly = 0;
4310 state->pagedresults_cookie = NULL;
4311 state->entries = NULL;
4312 state->group_type = type;
4313 state->ldap2displayentry = ldapgroup2displayentry;
4314
4315 if ((state->filter == NULL) || (state->attrs == NULL)) {
4316 DEBUG(0, ("talloc failed\n"));
4317 return False;
4318 }
4319
4320 search->private_data = state;
4321 search->next_entry = ldapsam_search_next_entry;
4322 search->search_end = ldapsam_search_end;
4323
4324 return ldapsam_search_firstpage(search);
4325 }
4326
4327 static BOOL ldapsam_search_groups(struct pdb_methods *methods,
4328 struct pdb_search *search)
4329 {
4330 return ldapsam_search_grouptype(methods, search, get_global_sam_sid(), SID_NAME_DOM_GRP);
4331 }
4332
4333 static BOOL ldapsam_search_aliases(struct pdb_methods *methods,
4334 struct pdb_search *search,
4335 const DOM_SID *sid)
4336 {
4337 return ldapsam_search_grouptype(methods, search, sid, SID_NAME_ALIAS);
4338 }
4339
4340 static BOOL ldapsam_rid_algorithm(struct pdb_methods *methods)
4341 {
4342 return False;
4343 }
4344
4345 static NTSTATUS ldapsam_get_new_rid(struct ldapsam_privates *priv,
4346 uint32 *rid)
4347 {
4348 struct smbldap_state *smbldap_state = priv->smbldap_state;
4349
4350 LDAPMessage *result = NULL;
4351 LDAPMessage *entry = NULL;
4352 LDAPMod **mods = NULL;
4353 NTSTATUS status;
4354 char *value;
4355 int rc;
4356 uint32 nextRid = 0;
4357 const char *dn;
4358
4359 TALLOC_CTX *mem_ctx;
4360
4361 mem_ctx = talloc_new(NULL);
4362 if (mem_ctx == NULL) {
4363 DEBUG(0, ("talloc_new failed\n"));
4364 return NT_STATUS_NO_MEMORY;
4365 }
4366
4367 status = smbldap_search_domain_info(smbldap_state, &result,
4368 get_global_sam_name(), False);
4369 if (!NT_STATUS_IS_OK(status)) {
4370 DEBUG(3, ("Could not get domain info: %s\n",
4371 nt_errstr(status)));
4372 goto done;
4373 }
4374
4375 talloc_autofree_ldapmsg(mem_ctx, result);
4376
4377 entry = ldap_first_entry(priv2ld(priv), result);
4378 if (entry == NULL) {
4379 DEBUG(0, ("Could not get domain info entry\n"));
4380 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
4381 goto done;
4382 }
4383
4384 /* Find the largest of the three attributes "sambaNextRid",
4385 "sambaNextGroupRid" and "sambaNextUserRid". I gave up on the
4386 concept of differentiating between user and group rids, and will
4387 use only "sambaNextRid" in the future. But for compatibility
4388 reasons I look if others have chosen different strategies -- VL */
4389
4390 value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4391 "sambaNextRid", mem_ctx);
4392 if (value != NULL) {
4393 uint32 tmp = (uint32)strtoul(value, NULL, 10);
4394 nextRid = MAX(nextRid, tmp);
4395 }
4396
4397 value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4398 "sambaNextUserRid", mem_ctx);
4399 if (value != NULL) {
4400 uint32 tmp = (uint32)strtoul(value, NULL, 10);
4401 nextRid = MAX(nextRid, tmp);
4402 }
4403
4404 value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4405 "sambaNextGroupRid", mem_ctx);
4406 if (value != NULL) {
4407 uint32 tmp = (uint32)strtoul(value, NULL, 10);
4408 nextRid = MAX(nextRid, tmp);
4409 }
4410
4411 if (nextRid == 0) {
4412 nextRid = BASE_RID-1;
4413 }
4414
4415 nextRid += 1;
4416
4417 smbldap_make_mod(priv2ld(priv), entry, &mods, "sambaNextRid",
4418 talloc_asprintf(mem_ctx, "%d", nextRid));
4419 talloc_autofree_ldapmod(mem_ctx, mods);
4420
4421 if ((dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)) == NULL) {
4422 status = NT_STATUS_NO_MEMORY;
4423 goto done;
4424 }
4425
4426 rc = smbldap_modify(smbldap_state, dn, mods);
4427
4428 /* ACCESS_DENIED is used as a placeholder for "the modify failed,
4429 * please retry" */
4430
4431 status = (rc == LDAP_SUCCESS) ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
4432
4433 done:
4434 if (NT_STATUS_IS_OK(status)) {
4435 *rid = nextRid;
4436 }
4437
4438 TALLOC_FREE(mem_ctx);
4439 return status;
4440 }
4441
4442 static BOOL ldapsam_new_rid(struct pdb_methods *methods, uint32 *rid)
4443 {
4444 int i;
4445
4446 for (i=0; i<10; i++) {
4447 NTSTATUS result = ldapsam_get_new_rid(methods->private_data,
4448 rid);
4449 if (NT_STATUS_IS_OK(result)) {
4450 return True;
4451 }
4452
4453 if (!NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
4454 return False;
4455 }
4456
4457 /* The ldap update failed (maybe a race condition), retry */
4458 }
4459
4460 /* Tried 10 times, fail. */
4461 return False;
4462 }
4463
4464 static BOOL ldapsam_sid_to_id(struct pdb_methods *methods,
4465 const DOM_SID *sid,
4466 union unid_t *id, enum SID_NAME_USE *type)
4467 {
4468 struct ldapsam_privates *priv = methods->private_data;
4469 char *filter;
4470 const char *attrs[] = { "sambaGroupType", "gidNumber", "uidNumber",
4471 NULL };
4472 LDAPMessage *result = NULL;
4473 LDAPMessage *entry = NULL;
4474 BOOL ret = False;
4475 char *value;
4476 int rc;
4477
4478 TALLOC_CTX *mem_ctx;
4479
4480 mem_ctx = talloc_new(NULL);
4481 if (mem_ctx == NULL) {
4482 DEBUG(0, ("talloc_new failed\n"));
4483 return False;
4484 }
4485
4486 filter = talloc_asprintf(mem_ctx,
4487 "(&(sambaSid=%s)"
4488 "(|(objectClass=%s)(objectClass=%s)))",
4489 sid_string_static(sid),
4490 LDAP_OBJ_GROUPMAP, LDAP_OBJ_SAMBASAMACCOUNT);
4491 if (filter == NULL) {
4492 DEBUG(5, ("talloc_asprintf failed\n"));
4493 goto done;
4494 }
4495
4496 rc = smbldap_search_suffix(priv->smbldap_state, filter,
4497 attrs, &result);
4498 if (rc != LDAP_SUCCESS) {
4499 goto done;
4500 }
4501 talloc_autofree_ldapmsg(mem_ctx, result);
4502
4503 if (ldap_count_entries(priv2ld(priv), result) != 1) {
4504 DEBUG(10, ("Got %d entries, expected one\n",
4505 ldap_count_entries(priv2ld(priv), result)));
4506 goto done;
4507 }
4508
4509 entry = ldap_first_entry(priv2ld(priv), result);
4510
4511 value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4512 "sambaGroupType", mem_ctx);
4513
4514 if (value != NULL) {
4515 const char *gid_str;
4516 /* It's a group */
4517
4518 gid_str = smbldap_talloc_single_attribute(
4519 priv2ld(priv), entry, "gidNumber", mem_ctx);
4520 if (gid_str == NULL) {
4521 DEBUG(1, ("%s has sambaGroupType but no gidNumber\n",
4522 smbldap_talloc_dn(mem_ctx, priv2ld(priv),
4523 entry)));
4524 goto done;
4525 }
4526
4527 id->gid = strtoul(gid_str, NULL, 10);
4528 *type = strtoul(value, NULL, 10);
4529 ret = True;
4530 goto done;
4531 }
4532
4533 /* It must be a user */
4534
4535 value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4536 "uidNumber", mem_ctx);
4537 if (value == NULL) {
4538 DEBUG(1, ("Could not find uidNumber in %s\n",
4539 smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)));
4540 goto done;
4541 }
4542
4543 id->uid = strtoul(value, NULL, 10);
4544 *type = SID_NAME_USER;
4545
4546 ret = True;
4547 done:
4548 TALLOC_FREE(mem_ctx);
4549 return ret;
4550 }
4551
4552 /*
4553 * The following functions is called only if
4554 * ldapsam:trusted and ldapsam:editposix are
4555 * set to true
4556 */
4557
4558 /*
4559 * ldapsam_create_user creates a new
4560 * posixAccount and sambaSamAccount object
4561 * in the ldap users subtree
4562 *
4563 * The uid is allocated by winbindd.
4564 */
4565
4566 static NTSTATUS ldapsam_create_user(struct pdb_methods *my_methods,
4567 TALLOC_CTX *tmp_ctx, const char *name,
4568 uint32 acb_info, uint32 *rid)
4569 {
4570 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
4571 LDAPMessage *entry = NULL;
4572 LDAPMessage *result = NULL;
4573 uint32 num_result;
4574 BOOL is_machine = False;
4575 BOOL add_posix = False;
4576 LDAPMod **mods = NULL;
4577 struct samu *user;
4578 char *filter;
4579 char *username;
4580 char *homedir;
4581 char *gidstr;
4582 char *uidstr;
4583 char *shell;
4584 const char *dn = NULL;
4585 DOM_SID group_sid;
4586 DOM_SID user_sid;
4587 gid_t gid = -1;
4588 uid_t uid = -1;
4589 NTSTATUS ret;
4590 int rc;
4591
4592 if (((acb_info & ACB_NORMAL) && name[strlen(name)-1] == '$') ||
4593 acb_info & ACB_WSTRUST ||
4594 acb_info & ACB_SVRTRUST ||
4595 acb_info & ACB_DOMTRUST) {
4596 is_machine = True;
4597 }
4598
4599 username = escape_ldap_string_alloc(name);
4600 filter = talloc_asprintf(tmp_ctx, "(&(uid=%s)(objectClass=%s))",
4601 username, LDAP_OBJ_POSIXACCOUNT);
4602 SAFE_FREE(username);
4603
4604 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
4605 if (rc != LDAP_SUCCESS) {
4606 DEBUG(0,("ldapsam_create_user: ldap search failed!\n"));
4607 return NT_STATUS_UNSUCCESSFUL;
4608 }
4609 talloc_autofree_ldapmsg(tmp_ctx, result);
4610
4611 num_result = ldap_count_entries(priv2ld(ldap_state), result);
4612
4613 if (num_result > 1) {
4614 DEBUG (0, ("ldapsam_create_user: More than one user with name [%s] ?!\n", name));
4615 return NT_STATUS_INTERNAL_DB_CORRUPTION;
4616 }
4617
4618 if (num_result == 1) {
4619 char *tmp;
4620 /* check if it is just a posix account.
4621 * or if there is a sid attached to this entry
4622 */
4623
4624 entry = ldap_first_entry(priv2ld(ldap_state), result);
4625 if (!entry) {
4626 return NT_STATUS_UNSUCCESSFUL;
4627 }
4628
4629 tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "sambaSID", tmp_ctx);
4630 if (tmp) {
4631 DEBUG (1, ("ldapsam_create_user: The user [%s] already exist!\n", name));
4632 return NT_STATUS_USER_EXISTS;
4633 }
4634
4635 /* it is just a posix account, retrieve the dn for later use */
4636 dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
4637 if (!dn) {
4638 DEBUG(0,("ldapsam_create_user: Out of memory!\n"));
4639 return NT_STATUS_NO_MEMORY;
4640 }
4641 }
4642
4643 if (num_result == 0) {
4644 add_posix = True;
4645 }
4646
4647 /* Create the basic samu structure and generate the mods for the ldap commit */
4648 if (!NT_STATUS_IS_OK((ret = ldapsam_get_new_rid(ldap_state, rid)))) {
4649 DEBUG(1, ("ldapsam_create_user: Could not allocate a new RID\n"));
4650 return ret;
4651 }
4652
4653 sid_compose(&user_sid, get_global_sam_sid(), *rid);
4654
4655 user = samu_new(tmp_ctx);
4656 if (!user) {
4657 DEBUG(1,("ldapsam_create_user: Unable to allocate user struct\n"));
4658 return NT_STATUS_NO_MEMORY;
4659 }
4660
4661 if (!pdb_set_username(user, name, PDB_SET)) {
4662 DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4663 return NT_STATUS_UNSUCCESSFUL;
4664 }
4665 if (!pdb_set_domain(user, get_global_sam_name(), PDB_SET)) {
4666 DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4667 return NT_STATUS_UNSUCCESSFUL;
4668 }
4669 if (is_machine) {
4670 if (acb_info & ACB_NORMAL) {
4671 if (!pdb_set_acct_ctrl(user, ACB_WSTRUST, PDB_SET)) {
4672 DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4673 return NT_STATUS_UNSUCCESSFUL;
4674 }
4675 } else {
4676 if (!pdb_set_acct_ctrl(user, acb_info, PDB_SET)) {
4677 DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4678 return NT_STATUS_UNSUCCESSFUL;
4679 }
4680 }
4681 } else {
4682 if (!pdb_set_acct_ctrl(user, ACB_NORMAL | ACB_DISABLED, PDB_SET)) {
4683 DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4684 return NT_STATUS_UNSUCCESSFUL;
4685 }
4686 }
4687
4688 if (!pdb_set_user_sid(user, &user_sid, PDB_SET)) {
4689 DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4690 return NT_STATUS_UNSUCCESSFUL;
4691 }
4692
4693 if (!init_ldap_from_sam(ldap_state, NULL, &mods, user, element_is_set_or_changed)) {
4694 DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4695 return NT_STATUS_UNSUCCESSFUL;
4696 }
4697
4698 if (ldap_state->schema_ver != SCHEMAVER_SAMBASAMACCOUNT) {
4699 DEBUG(1,("ldapsam_create_user: Unsupported schema version\n"));
4700 }
4701 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
4702
4703 if (add_posix) {
4704 DEBUG(3,("ldapsam_create_user: Creating new posix user\n"));
4705
4706 /* retrieve the Domain Users group gid */
4707 if (!sid_compose(&group_sid, get_global_sam_sid(), DOMAIN_GROUP_RID_USERS) ||
4708 !sid_to_gid(&group_sid, &gid)) {
4709 DEBUG (0, ("ldapsam_create_user: Unable to get the Domain Users gid: bailing out!\n"));
4710 return NT_STATUS_INVALID_PRIMARY_GROUP;
4711 }
4712
4713 /* lets allocate a new userid for this user */
4714 if (!winbind_allocate_uid(&uid)) {
4715 DEBUG (0, ("ldapsam_create_user: Unable to allocate a new user id: bailing out!\n"));
4716 return NT_STATUS_UNSUCCESSFUL;
4717 }
4718
4719
4720 if (is_machine) {
4721 /* TODO: choose a more appropriate default for machines */
4722 homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), "SMB_workstations_home", ldap_state->domain_name, uid, gid);
4723 shell = talloc_strdup(tmp_ctx, "/bin/false");
4724 } else {
4725 homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), name, ldap_state->domain_name, uid, gid);
4726 shell = talloc_sub_specified(tmp_ctx, lp_template_shell(), name, ldap_state->domain_name, uid, gid);
4727 }
4728 uidstr = talloc_asprintf(tmp_ctx, "%d", uid);
4729 gidstr = talloc_asprintf(tmp_ctx, "%d", gid);
4730 if (is_machine) {
4731 dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", name, lp_ldap_machine_suffix ());
4732 } else {
4733 dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", name, lp_ldap_user_suffix ());
4734 }
4735
4736 if (!homedir || !shell || !uidstr || !gidstr || !dn) {
4737 DEBUG (0, ("ldapsam_create_user: Out of memory!\n"));
4738 return NT_STATUS_NO_MEMORY;
4739 }
4740
4741 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
4742 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
4743 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
4744 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
4745 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
4746 smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", homedir);
4747 smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", shell);
4748 }
4749
4750 talloc_autofree_ldapmod(tmp_ctx, mods);
4751
4752 if (add_posix) {
4753 rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
4754 } else {
4755 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
4756 }
4757
4758 if (rc != LDAP_SUCCESS) {
4759 DEBUG(0,("ldapsam_create_user: failed to create a new user [%s] (dn = %s)\n", name ,dn));
4760 return NT_STATUS_UNSUCCESSFUL;
4761 }
4762
4763 DEBUG(2,("ldapsam_create_user: added account [%s] in the LDAP database\n", name));
4764
4765 flush_pwnam_cache();
4766
4767 return NT_STATUS_OK;
4768 }
4769
4770 static NTSTATUS ldapsam_delete_user(struct pdb_methods *my_methods, TALLOC_CTX *tmp_ctx, struct samu *sam_acct)
4771 {
4772 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
4773 LDAPMessage *result = NULL;
4774 LDAPMessage *entry = NULL;
4775 int num_result;
4776 const char *dn;
4777 char *filter;
4778 int rc;
4779
4780 DEBUG(0,("ldapsam_delete_user: Attempt to delete user [%s]\n", pdb_get_username(sam_acct)));
4781
4782 filter = talloc_asprintf(tmp_ctx,
4783 "(&(uid=%s)"
4784 "(objectClass=%s)"
4785 "(objectClass=%s))",
4786 pdb_get_username(sam_acct),
4787 LDAP_OBJ_POSIXACCOUNT,
4788 LDAP_OBJ_SAMBASAMACCOUNT);
4789
4790 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
4791 if (rc != LDAP_SUCCESS) {
4792 DEBUG(0,("ldapsam_delete_user: user search failed!\n"));
4793 return NT_STATUS_UNSUCCESSFUL;
4794 }
4795 talloc_autofree_ldapmsg(tmp_ctx, result);
4796
4797 num_result = ldap_count_entries(priv2ld(ldap_state), result);
4798
4799 if (num_result == 0) {
4800 DEBUG(0,("ldapsam_delete_user: user not found!\n"));
4801 return NT_STATUS_NO_SUCH_USER;
4802 }
4803
4804 if (num_result > 1) {
4805 DEBUG (0, ("ldapsam_delete_user: More than one user with name [%s] ?!\n", pdb_get_username(sam_acct)));
4806 return NT_STATUS_INTERNAL_DB_CORRUPTION;
4807 }
4808
4809 entry = ldap_first_entry(priv2ld(ldap_state), result);
4810 if (!entry) {
4811 return NT_STATUS_UNSUCCESSFUL;
4812 }
4813
4814 /* it is just a posix account, retrieve the dn for later use */
4815 dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
4816 if (!dn) {
4817 DEBUG(0,("ldapsam_delete_user: Out of memory!\n"));
4818 return NT_STATUS_NO_MEMORY;
4819 }
4820
4821 rc = smbldap_delete(ldap_state->smbldap_state, dn);
4822 if (rc != LDAP_SUCCESS) {
4823 return NT_STATUS_UNSUCCESSFUL;
4824 }
4825
4826 flush_pwnam_cache();
4827
4828 return NT_STATUS_OK;
4829 }
4830
4831 /*
4832 * ldapsam_create_group creates a new
4833 * posixGroup and sambaGroupMapping object
4834 * in the ldap groups subtree
4835 *
4836 * The gid is allocated by winbindd.
4837 */
4838
4839 static NTSTATUS ldapsam_create_dom_group(struct pdb_methods *my_methods,
4840 TALLOC_CTX *tmp_ctx,
4841 const char *name,
4842 uint32 *rid)
4843 {
4844 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
4845 NTSTATUS ret;
4846 LDAPMessage *entry = NULL;
4847 LDAPMessage *result = NULL;
4848 uint32 num_result;
4849 BOOL is_new_entry = False;
4850 LDAPMod **mods = NULL;
4851 char *filter;
4852 char *groupsidstr;
4853 char *groupname;
4854 char *grouptype;
4855 char *gidstr;
4856 const char *dn = NULL;
4857 DOM_SID group_sid;
4858 gid_t gid = -1;
4859 int rc;
4860
4861 groupname = escape_ldap_string_alloc(name);
4862 filter = talloc_asprintf(tmp_ctx, "(&(cn=%s)(objectClass=%s))",
4863 groupname, LDAP_OBJ_POSIXGROUP);
4864 SAFE_FREE(groupname);
4865
4866 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
4867 if (rc != LDAP_SUCCESS) {
4868 DEBUG(0,("ldapsam_create_group: ldap search failed!\n"));
4869 return NT_STATUS_UNSUCCESSFUL;
4870 }
4871 talloc_autofree_ldapmsg(tmp_ctx, result);
4872
4873 num_result = ldap_count_entries(priv2ld(ldap_state), result);
4874
4875 if (num_result > 1) {
4876 DEBUG (0, ("ldapsam_create_group: There exists more than one group with name [%s]: bailing out!\n", name));
4877 return NT_STATUS_INTERNAL_DB_CORRUPTION;
4878 }
4879
4880 if (num_result == 1) {
4881 char *tmp;
4882 /* check if it is just a posix group.
4883 * or if there is a sid attached to this entry
4884 */
4885
4886 entry = ldap_first_entry(priv2ld(ldap_state), result);
4887 if (!entry) {
4888 return NT_STATUS_UNSUCCESSFUL;
4889 }
4890
4891 tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "sambaSID", tmp_ctx);
4892 if (tmp) {
4893 DEBUG (1, ("ldapsam_create_group: The group [%s] already exist!\n", name));
4894 return NT_STATUS_GROUP_EXISTS;
4895 }
4896
4897 /* it is just a posix group, retrieve the gid and the dn for later use */
4898 tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
4899 if (!tmp) {
4900 DEBUG (1, ("ldapsam_create_group: Couldn't retrieve the gidNumber for [%s]?!?!\n", name));
4901 return NT_STATUS_INTERNAL_DB_CORRUPTION;
4902 }
4903
4904 gid = strtoul(tmp, NULL, 10);
4905
4906 dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
4907 if (!dn) {
4908 DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
4909 return NT_STATUS_NO_MEMORY;
4910 }
4911 }
4912
4913 if (num_result == 0) {
4914 DEBUG(3,("ldapsam_create_user: Creating new posix group\n"));
4915
4916 is_new_entry = True;
4917
4918 /* lets allocate a new groupid for this group */
4919 if (!winbind_allocate_gid(&gid)) {
4920 DEBUG (0, ("ldapsam_create_group: Unable to allocate a new group id: bailing out!\n"));
4921 return NT_STATUS_UNSUCCESSFUL;
4922 }
4923
4924 gidstr = talloc_asprintf(tmp_ctx, "%d", gid);
4925 dn = talloc_asprintf(tmp_ctx, "cn=%s,%s", name, lp_ldap_group_suffix());
4926
4927 if (!gidstr || !dn) {
4928 DEBUG (0, ("ldapsam_create_group: Out of memory!\n"));
4929 return NT_STATUS_NO_MEMORY;
4930 }
4931
4932 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_POSIXGROUP);
4933 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
4934 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
4935 }
4936
4937 if (!NT_STATUS_IS_OK((ret = ldapsam_get_new_rid(ldap_state, rid)))) {
4938 DEBUG(1, ("ldapsam_create_group: Could not allocate a new RID\n"));
4939 return ret;
4940 }
4941
4942 sid_compose(&group_sid, get_global_sam_sid(), *rid);
4943
4944 groupsidstr = talloc_strdup(tmp_ctx, sid_string_static(&group_sid));
4945 grouptype = talloc_asprintf(tmp_ctx, "%d", SID_NAME_DOM_GRP);
4946
4947 if (!groupsidstr || !grouptype) {
4948 DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
4949 return NT_STATUS_NO_MEMORY;
4950 }
4951
4952 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
4953 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid", groupsidstr);
4954 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", grouptype);
4955 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
4956 talloc_autofree_ldapmod(tmp_ctx, mods);
4957
4958 if (is_new_entry) {
4959 rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
4960 #if 0
4961 if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
4962 /* This call may fail with rfc2307bis schema */
4963 /* Retry adding a structural class */
4964 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "????");
4965 rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
4966 }
4967 #endif
4968 } else {
4969 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
4970 }
4971
4972 if (rc != LDAP_SUCCESS) {
4973 DEBUG(0,("ldapsam_create_group: failed to create a new group [%s] (dn = %s)\n", name ,dn));
4974 return NT_STATUS_UNSUCCESSFUL;
4975 }
4976
4977 DEBUG(2,("ldapsam_create_group: added group [%s] in the LDAP database\n", name));
4978
4979 return NT_STATUS_OK;
4980 }
4981
4982 static NTSTATUS ldapsam_delete_dom_group(struct pdb_methods *my_methods, TALLOC_CTX *tmp_ctx, uint32 rid)
4983 {
4984 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
4985 LDAPMessage *result = NULL;
4986 LDAPMessage *entry = NULL;
4987 int num_result;
4988 const char *dn;
4989 char *gidstr;
4990 char *filter;
4991 DOM_SID group_sid;
4992 int rc;
4993
4994 /* get the group sid */
4995 sid_compose(&group_sid, get_global_sam_sid(), rid);
4996
4997 filter = talloc_asprintf(tmp_ctx,
4998 "(&(sambaSID=%s)"
4999 "(objectClass=%s)"
5000 "(objectClass=%s))",
5001 sid_string_static(&group_sid),
5002 LDAP_OBJ_POSIXGROUP,
5003 LDAP_OBJ_GROUPMAP);
5004
5005 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5006 if (rc != LDAP_SUCCESS) {
5007 DEBUG(1,("ldapsam_delete_dom_group: group search failed!\n"));
5008 return NT_STATUS_UNSUCCESSFUL;
5009 }
5010 talloc_autofree_ldapmsg(tmp_ctx, result);
5011
5012 num_result = ldap_count_entries(priv2ld(ldap_state), result);
5013
5014 if (num_result == 0) {
5015 DEBUG(1,("ldapsam_delete_dom_group: group not found!\n"));
5016 return NT_STATUS_NO_SUCH_GROUP;
5017 }
5018
5019 if (num_result > 1) {
5020 DEBUG (0, ("ldapsam_delete_dom_group: More than one group with the same SID ?!\n"));
5021 return NT_STATUS_INTERNAL_DB_CORRUPTION;
5022 }
5023
5024 entry = ldap_first_entry(priv2ld(ldap_state), result);
5025 if (!entry) {
5026 return NT_STATUS_UNSUCCESSFUL;
5027 }
5028
5029 /* here it is, retrieve the dn for later use */
5030 dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5031 if (!dn) {
5032 DEBUG(0,("ldapsam_delete_dom_group: Out of memory!\n"));
5033 return NT_STATUS_NO_MEMORY;
5034 }
5035
5036 gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5037 if (!gidstr) {
5038 DEBUG (0, ("ldapsam_delete_dom_group: Unable to find the group's gid!\n"));
5039 return NT_STATUS_INTERNAL_DB_CORRUPTION;
5040 }
5041
5042 /* check no user have this group marked as primary group */
5043 filter = talloc_asprintf(tmp_ctx,
5044 "(&(gidNumber=%s)"
5045 "(objectClass=%s)"
5046 "(objectClass=%s))",
5047 gidstr,
5048 LDAP_OBJ_POSIXACCOUNT,
5049 LDAP_OBJ_SAMBASAMACCOUNT);
5050
5051 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5052 if (rc != LDAP_SUCCESS) {
5053 DEBUG(1,("ldapsam_delete_dom_group: accounts search failed!\n"));
5054 return NT_STATUS_UNSUCCESSFUL;
5055 }
5056 talloc_autofree_ldapmsg(tmp_ctx, result);
5057
5058 num_result = ldap_count_entries(priv2ld(ldap_state), result);
5059
5060 if (num_result != 0) {
5061 DEBUG(3,("ldapsam_delete_dom_group: Can't delete group, it is a primary group for %d users\n", num_result));
5062 return NT_STATUS_MEMBERS_PRIMARY_GROUP;
5063 }
5064
5065 rc = smbldap_delete(ldap_state->smbldap_state, dn);
5066 if (rc != LDAP_SUCCESS) {
5067 return NT_STATUS_UNSUCCESSFUL;
5068 }
5069
5070 return NT_STATUS_OK;
5071 }
5072
5073 static NTSTATUS ldapsam_change_groupmem(struct pdb_methods *my_methods,
5074 TALLOC_CTX *tmp_ctx,
5075 uint32 group_rid,
5076 uint32 member_rid,
5077 int modop)
5078 {
5079 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
5080 LDAPMessage *entry = NULL;
5081 LDAPMessage *result = NULL;
5082 uint32 num_result;
5083 LDAPMod **mods = NULL;
5084 char *filter;
5085 char *uidstr;
5086 const char *dn = NULL;
5087 DOM_SID group_sid;
5088 DOM_SID member_sid;
5089 int rc;
5090
5091 switch (modop) {
5092 case LDAP_MOD_ADD:
5093 DEBUG(1,("ldapsam_change_groupmem: add new member(rid=%d) to a domain group(rid=%d)", member_rid, group_rid));
5094 break;
5095 case LDAP_MOD_DELETE:
5096 DEBUG(1,("ldapsam_change_groupmem: delete member(rid=%d) from a domain group(rid=%d)", member_rid, group_rid));
5097 break;
5098 default:
5099 return NT_STATUS_UNSUCCESSFUL;
5100 }
5101
5102 /* get member sid */
5103 sid_compose(&member_sid, get_global_sam_sid(), member_rid);
5104
5105 /* get the group sid */
5106 sid_compose(&group_sid, get_global_sam_sid(), group_rid);
5107
5108 filter = talloc_asprintf(tmp_ctx,
5109 "(&(sambaSID=%s)"
5110 "(objectClass=%s)"
5111 "(objectClass=%s))",
5112 sid_string_static(&member_sid),
5113 LDAP_OBJ_POSIXACCOUNT,
5114 LDAP_OBJ_SAMBASAMACCOUNT);
5115
5116 /* get the member uid */
5117 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5118 if (rc != LDAP_SUCCESS) {
5119 DEBUG(1,("ldapsam_change_groupmem: member search failed!\n"));
5120 return NT_STATUS_UNSUCCESSFUL;
5121 }
5122 talloc_autofree_ldapmsg(tmp_ctx, result);
5123
5124 num_result = ldap_count_entries(priv2ld(ldap_state), result);
5125
5126 if (num_result == 0) {
5127 DEBUG(1,("ldapsam_change_groupmem: member not found!\n"));
5128 return NT_STATUS_NO_SUCH_MEMBER;
5129 }
5130
5131 if (num_result > 1) {
5132 DEBUG (0, ("ldapsam_change_groupmem: More than one account with the same SID ?!\n"));
5133 return NT_STATUS_INTERNAL_DB_CORRUPTION;
5134 }
5135
5136 entry = ldap_first_entry(priv2ld(ldap_state), result);
5137 if (!entry) {
5138 return NT_STATUS_UNSUCCESSFUL;
5139 }
5140
5141 if (modop == LDAP_MOD_DELETE) {
5142 /* check if we are trying to remove the member from his primary group */
5143 char *gidstr;
5144 gid_t user_gid, group_gid;
5145
5146 gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5147 if (!gidstr) {
5148 DEBUG (0, ("ldapsam_change_groupmem: Unable to find the member's gid!\n"));
5149 return NT_STATUS_INTERNAL_DB_CORRUPTION;
5150 }
5151
5152 user_gid = strtoul(gidstr, NULL, 10);
5153
5154 if (!sid_to_gid(&group_sid, &group_gid)) {
5155 DEBUG (0, ("ldapsam_change_groupmem: Unable to get group gid from SID!\n"));
5156 return NT_STATUS_UNSUCCESSFUL;
5157 }
5158
5159 if (user_gid == group_gid) {
5160 DEBUG (3, ("ldapsam_change_groupmem: can't remove user from it's own primary group!\n"));
5161 return NT_STATUS_MEMBERS_PRIMARY_GROUP;
5162 }
5163 }
5164
5165 /* here it is, retrieve the uid for later use */
5166 uidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "uid", tmp_ctx);
5167 if (!uidstr) {
5168 DEBUG (0, ("ldapsam_change_groupmem: Unable to find the member's name!\n"));
5169 return NT_STATUS_INTERNAL_DB_CORRUPTION;
5170 }
5171
5172 filter = talloc_asprintf(tmp_ctx,
5173 "(&(sambaSID=%s)"
5174 "(objectClass=%s)"
5175 "(objectClass=%s))",
5176 sid_string_static(&group_sid),
5177 LDAP_OBJ_POSIXGROUP,
5178 LDAP_OBJ_GROUPMAP);
5179
5180 /* get the group */
5181 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5182 if (rc != LDAP_SUCCESS) {
5183 DEBUG(1,("ldapsam_change_groupmem: group search failed!\n"));
5184 return NT_STATUS_UNSUCCESSFUL;
5185 }
5186 talloc_autofree_ldapmsg(tmp_ctx, result);
5187
5188 num_result = ldap_count_entries(priv2ld(ldap_state), result);
5189
5190 if (num_result == 0) {
5191 DEBUG(1,("ldapsam_change_groupmem: group not found!\n"));
5192 return NT_STATUS_NO_SUCH_GROUP;
5193 }
5194
5195 if (num_result > 1) {
5196 DEBUG (0, ("ldapsam_change_groupmem: More than one group with the same SID ?!\n"));
5197 return NT_STATUS_INTERNAL_DB_CORRUPTION;
5198 }
5199
5200 entry = ldap_first_entry(priv2ld(ldap_state), result);
5201 if (!entry) {
5202 return NT_STATUS_UNSUCCESSFUL;
5203 }
5204
5205 /* here it is, retrieve the dn for later use */
5206 dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5207 if (!dn) {
5208 DEBUG(0,("ldapsam_change_groupmem: Out of memory!\n"));
5209 return NT_STATUS_NO_MEMORY;
5210 }
5211
5212 smbldap_set_mod(&mods, modop, "memberUid", uidstr);
5213
5214 talloc_autofree_ldapmod(tmp_ctx, mods);
5215
5216 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5217 if (rc != LDAP_SUCCESS) {
5218 if (rc == LDAP_TYPE_OR_VALUE_EXISTS && modop == LDAP_MOD_ADD) {
5219 DEBUG(1,("ldapsam_change_groupmem: member is already in group, add failed!\n"));
5220 return NT_STATUS_MEMBER_IN_GROUP;
5221 }
5222 if (rc == LDAP_NO_SUCH_ATTRIBUTE && modop == LDAP_MOD_DELETE) {
5223 DEBUG(1,("ldapsam_change_groupmem: member is not in group, delete failed!\n"));
5224 return NT_STATUS_MEMBER_NOT_IN_GROUP;
5225 }
5226 return NT_STATUS_UNSUCCESSFUL;
5227 }
5228
5229 return NT_STATUS_OK;
5230 }
5231
5232 static NTSTATUS ldapsam_add_groupmem(struct pdb_methods *my_methods,
5233 TALLOC_CTX *tmp_ctx,
5234 uint32 group_rid,
5235 uint32 member_rid)
5236 {
5237 return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_ADD);
5238 }
5239 static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
5240 TALLOC_CTX *tmp_ctx,
5241 uint32 group_rid,
5242 uint32 member_rid)
5243 {
5244 return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_DELETE);
5245 }
5246
5247 static NTSTATUS ldapsam_set_primary_group(struct pdb_methods *my_methods,
5248 TALLOC_CTX *mem_ctx,
5249 struct samu *sampass)
5250 {
5251 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
5252 LDAPMessage *entry = NULL;
5253 LDAPMessage *result = NULL;
5254 uint32 num_result;
5255 LDAPMod **mods = NULL;
5256 char *filter;
5257 char *gidstr;
5258 const char *dn = NULL;
5259 gid_t gid;
5260 int rc;
5261
5262 DEBUG(0,("ldapsam_set_primary_group: Attempt to set primary group for user [%s]\n", pdb_get_username(sampass)));
5263
5264 if (!sid_to_gid(pdb_get_group_sid(sampass), &gid)) {
5265 DEBUG(0,("ldapsam_set_primary_group: failed to retieve gid from user's group SID!\n"));
5266 return NT_STATUS_UNSUCCESSFUL;
5267 }
5268 gidstr = talloc_asprintf(mem_ctx, "%d", gid);
5269 if (!gidstr) {
5270 DEBUG(0,("ldapsam_set_primary_group: Out of Memory!\n"));
5271 return NT_STATUS_NO_MEMORY;
5272 }
5273
5274 filter = talloc_asprintf(mem_ctx,
5275 "(&(uid=%s)"
5276 "(objectClass=%s)"
5277 "(objectClass=%s))",
5278 pdb_get_username(sampass),
5279 LDAP_OBJ_POSIXACCOUNT,
5280 LDAP_OBJ_SAMBASAMACCOUNT);
5281
5282 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5283 if (rc != LDAP_SUCCESS) {
5284 DEBUG(0,("ldapsam_set_primary_group: user search failed!\n"));
5285 return NT_STATUS_UNSUCCESSFUL;
5286 }
5287 talloc_autofree_ldapmsg(mem_ctx, result);
5288
5289 num_result = ldap_count_entries(priv2ld(ldap_state), result);
5290
5291 if (num_result == 0) {
5292 DEBUG(0,("ldapsam_set_primary_group: user not found!\n"));
5293 return NT_STATUS_NO_SUCH_USER;
5294 }
5295
5296 if (num_result > 1) {
5297 DEBUG (0, ("ldapsam_set_primary_group: More than one user with name [%s] ?!\n", pdb_get_username(sampass)));
5298 return NT_STATUS_INTERNAL_DB_CORRUPTION;
5299 }
5300
5301 entry = ldap_first_entry(priv2ld(ldap_state), result);
5302 if (!entry) {
5303 return NT_STATUS_UNSUCCESSFUL;
5304 }
5305
5306 /* retrieve the dn for later use */
5307 dn = smbldap_talloc_dn(mem_ctx, priv2ld(ldap_state), entry);
5308 if (!dn) {
5309 DEBUG(0,("ldapsam_set_primary_group: Out of memory!\n"));
5310 return NT_STATUS_NO_MEMORY;
5311 }
5312
5313 /* remove the old one, and add the new one, this way we do not risk races */
5314 smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "gidNumber", gidstr);
5315
5316 if (mods == NULL) {
5317 return NT_STATUS_OK;
5318 }
5319
5320 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5321
5322 if (rc != LDAP_SUCCESS) {
5323 DEBUG(0,("ldapsam_set_primary_group: failed to modify [%s] primary group to [%s]\n",
5324 pdb_get_username(sampass), gidstr));
5325 return NT_STATUS_UNSUCCESSFUL;
5326 }
5327
5328 flush_pwnam_cache();
5329
5330 return NT_STATUS_OK;
5331 }
5332
5333 /**********************************************************************
5334 Housekeeping
5335 *********************************************************************/
5336
5337 static void free_private_data(void **vp)
5338 {
5339 struct ldapsam_privates **ldap_state = (struct ldapsam_privates **)vp;
5340
5341 smbldap_free_struct(&(*ldap_state)->smbldap_state);
5342
5343 if ((*ldap_state)->result != NULL) {
5344 ldap_msgfree((*ldap_state)->result);
5345 (*ldap_state)->result = NULL;
5346 }
5347 if ((*ldap_state)->domain_dn != NULL) {
5348 SAFE_FREE((*ldap_state)->domain_dn);
5349 }
5350
5351 *ldap_state = NULL;
5352
5353 /* No need to free any further, as it is talloc()ed */
5354 }
5355
5356 /*********************************************************************
5357 Intitalise the parts of the pdb_methods structure that are common to
5358 all pdb_ldap modes
5359 *********************************************************************/
5360
5361 static NTSTATUS pdb_init_ldapsam_common(struct pdb_methods **pdb_method, const char *location)
5362 {
5363 NTSTATUS nt_status;
5364 struct ldapsam_privates *ldap_state;
5365
5366 if (!NT_STATUS_IS_OK(nt_status = make_pdb_method( pdb_method ))) {
5367 return nt_status;
5368 }
5369
5370 (*pdb_method)->name = "ldapsam";
5371
5372 (*pdb_method)->setsampwent = ldapsam_setsampwent;
5373 (*pdb_method)->endsampwent = ldapsam_endsampwent;
5374 (*pdb_method)->getsampwent = ldapsam_getsampwent;
5375 (*pdb_method)->getsampwnam = ldapsam_getsampwnam;
5376 (*pdb_method)->getsampwsid = ldapsam_getsampwsid;
5377 (*pdb_method)->add_sam_account = ldapsam_add_sam_account;
5378 (*pdb_method)->update_sam_account = ldapsam_update_sam_account;
5379 (*pdb_method)->delete_sam_account = ldapsam_delete_sam_account;
5380 (*pdb_method)->rename_sam_account = ldapsam_rename_sam_account;
5381
5382 (*pdb_method)->getgrsid = ldapsam_getgrsid;
5383 (*pdb_method)->getgrgid = ldapsam_getgrgid;
5384 (*pdb_method)->getgrnam = ldapsam_getgrnam;
5385 (*pdb_method)->add_group_mapping_entry = ldapsam_add_group_mapping_entry;
5386 (*pdb_method)->update_group_mapping_entry = ldapsam_update_group_mapping_entry;
5387 (*pdb_method)->delete_group_mapping_entry = ldapsam_delete_group_mapping_entry;
5388 (*pdb_method)->enum_group_mapping = ldapsam_enum_group_mapping;
5389
5390 (*pdb_method)->get_account_policy = ldapsam_get_account_policy;
5391 (*pdb_method)->set_account_policy = ldapsam_set_account_policy;
5392
5393 (*pdb_method)->get_seq_num = ldapsam_get_seq_num;
5394
5395 (*pdb_method)->rid_algorithm = ldapsam_rid_algorithm;
5396 (*pdb_method)->new_rid = ldapsam_new_rid;
5397
5398 /* TODO: Setup private data and free */
5399
5400 if ( !(ldap_state = TALLOC_ZERO_P(*pdb_method, struct ldapsam_privates)) ) {
5401 DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
5402 return NT_STATUS_NO_MEMORY;
5403 }
5404
5405 nt_status = smbldap_init(*pdb_method, location, &ldap_state->smbldap_state);
5406
5407 if ( !NT_STATUS_IS_OK(nt_status) ) {
5408 return nt_status;
5409 }
5410
5411 if ( !(ldap_state->domain_name = talloc_strdup(*pdb_method, get_global_sam_name()) ) ) {
5412 return NT_STATUS_NO_MEMORY;
5413 }
5414
5415 (*pdb_method)->private_data = ldap_state;
5416
5417 (*pdb_method)->free_private_data = free_private_data;
5418
5419 return NT_STATUS_OK;
5420 }
5421
5422 /**********************************************************************
5423 Initialise the 'compat' mode for pdb_ldap
5424 *********************************************************************/
5425
5426 NTSTATUS pdb_init_ldapsam_compat(struct pdb_methods **pdb_method, const char *location)
5427 {
5428 NTSTATUS nt_status;
5429 struct ldapsam_privates *ldap_state;
5430 char *uri = talloc_strdup( NULL, location );
5431
5432 if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common( pdb_method, uri ))) {
5433 return nt_status;
5434 }
5435
5436 /* the module itself stores a copy of the location so throw this one away */
5437
5438 if ( uri )
5439 TALLOC_FREE( uri );
5440
5441 (*pdb_method)->name = "ldapsam_compat";
5442
5443 ldap_state = (*pdb_method)->private_data;
5444 ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT;
5445
5446 sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
5447
5448 return NT_STATUS_OK;
5449 }
5450
5451 /**********************************************************************
5452 Initialise the normal mode for pdb_ldap
5453 *********************************************************************/
5454
5455 NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
5456 {
5457 NTSTATUS nt_status;
5458 struct ldapsam_privates *ldap_state;
5459 uint32 alg_rid_base;
5460 pstring alg_rid_base_string;
5461 LDAPMessage *result = NULL;
5462 LDAPMessage *entry = NULL;
5463 DOM_SID ldap_domain_sid;
5464 DOM_SID secrets_domain_sid;
5465 pstring domain_sid_string;
5466 char *dn;
5467
5468 nt_status = pdb_init_ldapsam_common(pdb_method, location);
5469 if (!NT_STATUS_IS_OK(nt_status)) {
5470 return nt_status;
5471 }
5472
5473 (*pdb_method)->name = "ldapsam";
5474
5475 (*pdb_method)->add_aliasmem = ldapsam_add_aliasmem;
5476 (*pdb_method)->del_aliasmem = ldapsam_del_aliasmem;
5477 (*pdb_method)->enum_aliasmem = ldapsam_enum_aliasmem;
5478 (*pdb_method)->enum_alias_memberships = ldapsam_alias_memberships;
5479 (*pdb_method)->search_users = ldapsam_search_users;
5480 (*pdb_method)->search_groups = ldapsam_search_groups;
5481 (*pdb_method)->search_aliases = ldapsam_search_aliases;
5482
5483 if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
5484 (*pdb_method)->enum_group_members = ldapsam_enum_group_members;
5485 (*pdb_method)->enum_group_memberships =
5486 ldapsam_enum_group_memberships;
5487 (*pdb_method)->lookup_rids = ldapsam_lookup_rids;
5488 (*pdb_method)->sid_to_id = ldapsam_sid_to_id;
5489
5490 if (lp_parm_bool(-1, "ldapsam", "editposix", False)) {
5491 (*pdb_method)->create_user = ldapsam_create_user;
5492 (*pdb_method)->delete_user = ldapsam_delete_user;
5493 (*pdb_method)->create_dom_group = ldapsam_create_dom_group;
5494 (*pdb_method)->delete_dom_group = ldapsam_delete_dom_group;
5495 (*pdb_method)->add_groupmem = ldapsam_add_groupmem;
5496 (*pdb_method)->del_groupmem = ldapsam_del_groupmem;
5497 (*pdb_method)->set_unix_primary_group = ldapsam_set_primary_group;
5498 }
5499 }
5500
5501 ldap_state = (*pdb_method)->private_data;
5502 ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
5503
5504 /* Try to setup the Domain Name, Domain SID, algorithmic rid base */
5505
5506 nt_status = smbldap_search_domain_info(ldap_state->smbldap_state,
5507 &result,
5508 ldap_state->domain_name, True);
5509
5510 if ( !NT_STATUS_IS_OK(nt_status) ) {
5511 DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain "
5512 "info, nor add one to the domain\n"));
5513 DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, "
5514 "will be unable to allocate new users/groups, "
5515 "and will risk BDCs having inconsistant SIDs\n"));
5516 sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
5517 return NT_STATUS_OK;
5518 }
5519
5520 /* Given that the above might fail, everything below this must be
5521 * optional */
5522
5523 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
5524 result);
5525 if (!entry) {
5526 DEBUG(0, ("pdb_init_ldapsam: Could not get domain info "
5527 "entry\n"));
5528 ldap_msgfree(result);
5529 return NT_STATUS_UNSUCCESSFUL;
5530 }
5531
5532 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
5533 if (!dn) {
5534 return NT_STATUS_UNSUCCESSFUL;
5535 }
5536
5537 ldap_state->domain_dn = smb_xstrdup(dn);
5538 ldap_memfree(dn);
5539
5540 if (smbldap_get_single_pstring(
5541 ldap_state->smbldap_state->ldap_struct,
5542 entry,
5543 get_userattr_key2string(ldap_state->schema_ver,
5544 LDAP_ATTR_USER_SID),
5545 domain_sid_string)) {
5546 BOOL found_sid;
5547 if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
5548 DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be "
5549 "read as a valid SID\n", domain_sid_string));
5550 return NT_STATUS_INVALID_PARAMETER;
5551 }
5552 found_sid = secrets_fetch_domain_sid(ldap_state->domain_name,
5553 &secrets_domain_sid);
5554 if (!found_sid || !sid_equal(&secrets_domain_sid,
5555 &ldap_domain_sid)) {
5556 fstring new_sid_str, old_sid_str;
5557 DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain "
5558 "%s based on pdb_ldap results %s -> %s\n",
5559 ldap_state->domain_name,
5560 sid_to_string(old_sid_str,
5561 &secrets_domain_sid),
5562 sid_to_string(new_sid_str,
5563 &ldap_domain_sid)));
5564
5565 /* reset secrets.tdb sid */
5566 secrets_store_domain_sid(ldap_state->domain_name,
5567 &ldap_domain_sid);
5568 DEBUG(1, ("New global sam SID: %s\n",
5569 sid_to_string(new_sid_str,
5570 get_global_sam_sid())));
5571 }
5572 sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
5573 }
5574
5575 if (smbldap_get_single_pstring(
5576 ldap_state->smbldap_state->ldap_struct,
5577 entry,
5578 get_attr_key2string( dominfo_attr_list,
5579 LDAP_ATTR_ALGORITHMIC_RID_BASE ),
5580 alg_rid_base_string)) {
5581 alg_rid_base = (uint32)atol(alg_rid_base_string);
5582 if (alg_rid_base != algorithmic_rid_base()) {
5583 DEBUG(0, ("The value of 'algorithmic RID base' has "
5584 "changed since the LDAP\n"
5585 "database was initialised. Aborting. \n"));
5586 ldap_msgfree(result);
5587 return NT_STATUS_UNSUCCESSFUL;
5588 }
5589 }
5590 ldap_msgfree(result);
5591
5592 return NT_STATUS_OK;
5593 }
5594
5595 NTSTATUS pdb_ldap_init(void)
5596 {
5597 NTSTATUS nt_status;
5598 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam)))
5599 return nt_status;
5600
5601 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_compat", pdb_init_ldapsam_compat)))
5602 return nt_status;
5603
5604 /* Let pdb_nds register backends */
5605 pdb_nds_init();
5606
5607 return NT_STATUS_OK;
5608 }
Samba GIT mirror