source3/include/smbldap.h

   1 /*
   2    Unix SMB/CIFS mplementation.
   3    LDAP protocol helper functions for SAMBA
   4    Copyright (C) Gerald Carter                  2001-2003
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18
  19 */
  20
  21 #ifndef _SMBLDAP_H
  22 #define _SMBLDAP_H
  23
  24 struct smbldap_state;
  25
  26 #include "smb_ldap.h"
  27
  28 #ifdef HAVE_LDAP
  29
  30 /* specify schema versions between 2.2. and 3.0 */
  31
  32 #define SCHEMAVER_SAMBAACCOUNT          1
  33 #define SCHEMAVER_SAMBASAMACCOUNT       2
  34
  35 /* objectclass names */
  36
  37 #define LDAP_OBJ_SAMBASAMACCOUNT        "sambaSamAccount"
  38 #define LDAP_OBJ_SAMBAACCOUNT           "sambaAccount"
  39 #define LDAP_OBJ_GROUPMAP               "sambaGroupMapping"
  40 #define LDAP_OBJ_DOMINFO                "sambaDomain"
  41 #define LDAP_OBJ_IDPOOL                 "sambaUnixIdPool"
  42 #define LDAP_OBJ_IDMAP_ENTRY            "sambaIdmapEntry"
  43 #define LDAP_OBJ_SID_ENTRY              "sambaSidEntry"
  44 #define LDAP_OBJ_TRUST_PASSWORD         "sambaTrustPassword"
  45 #define LDAP_OBJ_TRUSTDOM_PASSWORD      "sambaTrustedDomainPassword"
  46 #define LDAP_OBJ_TRUSTED_DOMAIN         "sambaTrustedDomain"
  47
  48 #define LDAP_OBJ_ACCOUNT                "account"
  49 #define LDAP_OBJ_POSIXACCOUNT           "posixAccount"
  50 #define LDAP_OBJ_POSIXGROUP             "posixGroup"
  51 #define LDAP_OBJ_OU                     "organizationalUnit"
  52
  53 /* some generic attributes that get reused a lot */
  54
  55 #define LDAP_ATTRIBUTE_SID              "sambaSID"
  56 #define LDAP_ATTRIBUTE_UIDNUMBER        "uidNumber"
  57 #define LDAP_ATTRIBUTE_GIDNUMBER        "gidNumber"
  58 #define LDAP_ATTRIBUTE_SID_LIST         "sambaSIDList"
  59
  60 /* attribute map table indexes */
  61
  62 #define LDAP_ATTR_LIST_END              0
  63 #define LDAP_ATTR_UID                   1
  64 #define LDAP_ATTR_UIDNUMBER             2
  65 #define LDAP_ATTR_GIDNUMBER             3
  66 #define LDAP_ATTR_UNIX_HOME             4
  67 #define LDAP_ATTR_PWD_LAST_SET          5
  68 #define LDAP_ATTR_PWD_CAN_CHANGE        6
  69 #define LDAP_ATTR_PWD_MUST_CHANGE       7
  70 #define LDAP_ATTR_LOGON_TIME            8
  71 #define LDAP_ATTR_LOGOFF_TIME           9
  72 #define LDAP_ATTR_KICKOFF_TIME          10
  73 #define LDAP_ATTR_CN                    11
  74 #define LDAP_ATTR_DISPLAY_NAME          12
  75 #define LDAP_ATTR_HOME_PATH             13
  76 #define LDAP_ATTR_LOGON_SCRIPT          14
  77 #define LDAP_ATTR_PROFILE_PATH          15
  78 #define LDAP_ATTR_DESC                  16
  79 #define LDAP_ATTR_USER_WKS              17
  80 #define LDAP_ATTR_USER_SID              18
  81 #define LDAP_ATTR_USER_RID              18
  82 #define LDAP_ATTR_PRIMARY_GROUP_SID     19
  83 #define LDAP_ATTR_PRIMARY_GROUP_RID     20
  84 #define LDAP_ATTR_LMPW                  21
  85 #define LDAP_ATTR_NTPW                  22
  86 #define LDAP_ATTR_DOMAIN                23
  87 #define LDAP_ATTR_OBJCLASS              24
  88 #define LDAP_ATTR_ACB_INFO              25
  89 #define LDAP_ATTR_NEXT_USERRID          26
  90 #define LDAP_ATTR_NEXT_GROUPRID         27
  91 #define LDAP_ATTR_DOM_SID               28
  92 #define LDAP_ATTR_HOME_DRIVE            29
  93 #define LDAP_ATTR_GROUP_SID             30
  94 #define LDAP_ATTR_GROUP_TYPE            31
  95 #define LDAP_ATTR_SID                   32
  96 #define LDAP_ATTR_ALGORITHMIC_RID_BASE  33
  97 #define LDAP_ATTR_NEXT_RID              34
  98 #define LDAP_ATTR_BAD_PASSWORD_COUNT    35
  99 #define LDAP_ATTR_LOGON_COUNT           36
 100 #define LDAP_ATTR_MUNGED_DIAL           37
 101 #define LDAP_ATTR_BAD_PASSWORD_TIME     38
 102 #define LDAP_ATTR_PWD_HISTORY           39
 103 #define LDAP_ATTR_SID_LIST              40
 104 #define LDAP_ATTR_MOD_TIMESTAMP         41
 105 #define LDAP_ATTR_LOGON_HOURS           42
 106 #define LDAP_ATTR_TRUST_PASSWD_FLAGS    43
 107 #define LDAP_ATTR_SN                    44
 108
 109
 110 typedef struct _attrib_map_entry {
 111         int             attrib;
 112         const char      *name;
 113 } ATTRIB_MAP_ENTRY;
 114
 115
 116 /* structures */
 117
 118 extern ATTRIB_MAP_ENTRY attrib_map_v22[];
 119 extern ATTRIB_MAP_ENTRY attrib_map_to_delete_v22[];
 120 extern ATTRIB_MAP_ENTRY attrib_map_v30[];
 121 extern ATTRIB_MAP_ENTRY attrib_map_to_delete_v30[];
 122 extern ATTRIB_MAP_ENTRY dominfo_attr_list[];
 123 extern ATTRIB_MAP_ENTRY groupmap_attr_list[];
 124 extern ATTRIB_MAP_ENTRY groupmap_attr_list_to_delete[];
 125 extern ATTRIB_MAP_ENTRY idpool_attr_list[];
 126 extern ATTRIB_MAP_ENTRY sidmap_attr_list[];
 127 extern ATTRIB_MAP_ENTRY trustpw_attr_list[];
 128
 129
 130 /* Function declarations -- not included in proto.h so we don't
 131    have to worry about LDAP structure types */
 132
 133 NTSTATUS smbldap_init(TALLOC_CTX *mem_ctx,
 134                       struct event_context *event_ctx,
 135                       const char *location,
 136                       struct smbldap_state **smbldap_state);
 137
 138 const char* get_attr_key2string( ATTRIB_MAP_ENTRY table[], int key );
 139 const char** get_attr_list( TALLOC_CTX *mem_ctx, ATTRIB_MAP_ENTRY table[] );
 140 void smbldap_set_mod (LDAPMod *** modlist, int modop, const char *attribute, const char *value);
 141 void smbldap_set_mod_blob(LDAPMod *** modlist, int modop, const char *attribute, const DATA_BLOB *newblob);
 142 void smbldap_make_mod(LDAP *ldap_struct, LDAPMessage *existing,
 143                       LDAPMod ***mods,
 144                       const char *attribute, const char *newval);
 145 void smbldap_make_mod_blob(LDAP *ldap_struct, LDAPMessage *existing,
 146                            LDAPMod ***mods,
 147                            const char *attribute, const DATA_BLOB *newblob);
 148 bool smbldap_get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry,
 149                                    const char *attribute, char *value,
 150                                    int max_len);
 151 int smbldap_modify(struct smbldap_state *ldap_state,
 152                    const char *dn,
 153                    LDAPMod *attrs[]);
 154
 155 /**
 156  * Struct to keep the state for all the ldap stuff
 157  *
 158  */
 159
 160 struct smbldap_state {
 161         LDAP *ldap_struct;
 162         pid_t pid;
 163         time_t last_ping; /* monotonic */
 164         /* retrive-once info */
 165         const char *uri;
 166
 167         /* credentials */
 168         bool anonymous;
 169         char *bind_dn;
 170         char *bind_secret;
 171
 172         bool paged_results;
 173
 174         unsigned int num_failures;
 175
 176         time_t last_use; /* monotonic */
 177         struct event_context *event_context;
 178         struct timed_event *idle_event;
 179
 180         struct timeval last_rebind; /* monotonic */
 181 };
 182
 183 /* struct used by both pdb_ldap.c and pdb_nds.c */
 184
 185 struct ipasam_privates;
 186
 187 struct ldapsam_privates {
 188         struct smbldap_state *smbldap_state;
 189
 190         /* Former statics */
 191         LDAPMessage *result;
 192         LDAPMessage *entry;
 193         int index;
 194
 195         const char *domain_name;
 196         struct dom_sid domain_sid;
 197
 198         /* configuration items */
 199         int schema_ver;
 200
 201         char *domain_dn;
 202
 203         /* Is this NDS ldap? */
 204         int is_nds_ldap;
 205
 206         /* Is this IPA ldap? */
 207         int is_ipa_ldap;
 208         struct ipasam_privates *ipasam_privates;
 209
 210         /* ldap server location parameter */
 211         char *location;
 212
 213         struct {
 214                 char *filter;
 215                 LDAPMessage *result;
 216         } search_cache;
 217 };
 218
 219 /* Functions shared between pdb_ldap.c and pdb_nds.c. */
 220 struct pdb_methods;
 221 NTSTATUS pdb_init_ldapsam_compat( struct pdb_methods **pdb_method, const char *location);
 222 void private_data_free_fn(void **result);
 223 int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
 224                                   const char *user,
 225                                   LDAPMessage ** result,
 226                                   const char **attr);
 227 NTSTATUS pdb_init_ldapsam( struct pdb_methods **pdb_method, const char *location);
 228 const char** get_userattr_list( TALLOC_CTX *mem_ctx, int schema_ver );
 229
 230 char * smbldap_talloc_single_attribute(LDAP *ldap_struct, LDAPMessage *entry,
 231                                        const char *attribute,
 232                                        TALLOC_CTX *mem_ctx);
 233 char * smbldap_talloc_first_attribute(LDAP *ldap_struct, LDAPMessage *entry,
 234                                       const char *attribute,
 235                                       TALLOC_CTX *mem_ctx);
 236 char * smbldap_talloc_smallest_attribute(LDAP *ldap_struct, LDAPMessage *entry,
 237                                          const char *attribute,
 238                                          TALLOC_CTX *mem_ctx);
 239 bool smbldap_talloc_single_blob(TALLOC_CTX *mem_ctx, LDAP *ld,
 240                                 LDAPMessage *msg, const char *attrib,
 241                                 DATA_BLOB *blob);
 242 bool smbldap_pull_sid(LDAP *ld, LDAPMessage *msg, const char *attrib,
 243                       struct dom_sid *sid);
 244 void talloc_autofree_ldapmsg(TALLOC_CTX *mem_ctx, LDAPMessage *result);
 245 void talloc_autofree_ldapmod(TALLOC_CTX *mem_ctx, LDAPMod **mod);
 246 char *smbldap_talloc_dn(TALLOC_CTX *mem_ctx, LDAP *ld,
 247                               LDAPMessage *entry);
 248 LDAP *priv2ld(struct ldapsam_privates *priv);
 249
 250 /* The following definitions come from lib/smbldap.c  */
 251
 252 int smb_ldap_start_tls(LDAP *ldap_struct, int version);
 253 int smb_ldap_setup_full_conn(LDAP **ldap_struct, const char *uri);
 254 int smbldap_search(struct smbldap_state *ldap_state,
 255                    const char *base, int scope, const char *filter,
 256                    const char *attrs[], int attrsonly,
 257                    LDAPMessage **res);
 258 int smbldap_search_paged(struct smbldap_state *ldap_state,
 259                          const char *base, int scope, const char *filter,
 260                          const char **attrs, int attrsonly, int pagesize,
 261                          LDAPMessage **res, void **cookie);
 262 int smbldap_modify(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs[]);
 263 int smbldap_add(struct smbldap_state *ldap_state, const char *dn, LDAPMod *attrs[]);
 264 int smbldap_delete(struct smbldap_state *ldap_state, const char *dn);
 265 int smbldap_extended_operation(struct smbldap_state *ldap_state,
 266                                LDAP_CONST char *reqoid, struct berval *reqdata,
 267                                LDAPControl **serverctrls, LDAPControl **clientctrls,
 268                                char **retoidp, struct berval **retdatap);
 269 int smbldap_search_suffix (struct smbldap_state *ldap_state,
 270                            const char *filter, const char **search_attr,
 271                            LDAPMessage ** result);
 272 void smbldap_free_struct(struct smbldap_state **ldap_state) ;
 273 NTSTATUS smbldap_init(TALLOC_CTX *mem_ctx, struct event_context *event_ctx,
 274                       const char *location,
 275                       struct smbldap_state **smbldap_state);
 276 bool smbldap_has_control(LDAP *ld, const char *control);
 277 bool smbldap_has_extension(LDAP *ld, const char *extension);
 278 bool smbldap_has_naming_context(LDAP *ld, const char *naming_context);
 279 bool smbldap_set_creds(struct smbldap_state *ldap_state, bool anon, const char *dn, const char *secret);
 280
 281 /* The following definitions come from lib/smbldap_util.c  */
 282
 283 NTSTATUS smbldap_search_domain_info(struct smbldap_state *ldap_state,
 284                                     LDAPMessage ** result, const char *domain_name,
 285                                     bool try_add);
 286
 287 #endif  /* HAVE_LDAP */
 288
 289 #define LDAP_DEFAULT_TIMEOUT   15
 290 #define LDAP_CONNECTION_DEFAULT_TIMEOUT 2
 291 #define LDAP_PAGE_SIZE 1024
 292
 293 #define ADS_PAGE_CTL_OID        "1.2.840.113556.1.4.319"
 294
 295 /*
 296  * Work around versions of the LDAP client libs that don't have the OIDs
 297  * defined, or have them defined under the old name.
 298  * This functionality is really a factor of the server, not the client
 299  *
 300  */
 301
 302 #if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD)
 303 #define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD
 304 #elif !defined(LDAP_EXOP_MODIFY_PASSWD)
 305 #define LDAP_EXOP_MODIFY_PASSWD "1.3.6.1.4.1.4203.1.11.1"
 306 #endif
 307
 308 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
 309 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID
 310 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
 311 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID        ((ber_tag_t) 0x80U)
 312 #endif
 313
 314 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
 315 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW
 316 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
 317 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW       ((ber_tag_t) 0x82U)
 318 #endif
 319
 320 #endif  /* _SMBLDAP_H */