2 Unix SMB/CIFS mplementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean François Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002-2003
8 Copyright (C) Stefan (metze) Metzmacher 2002-2003
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 /**********************************************************************
29 Add the account-policies below the sambaDomain object to LDAP,
30 *********************************************************************/
32 static NTSTATUS
add_new_domain_account_policies(struct smbldap_state
*ldap_state
,
33 const char *domain_name
)
35 NTSTATUS ntstatus
= NT_STATUS_UNSUCCESSFUL
;
37 uint32 policy_default
;
38 const char *policy_attr
= NULL
;
40 LDAPMod
**mods
= NULL
;
41 char *escape_domain_name
;
43 DEBUG(3,("add_new_domain_account_policies: Adding new account policies for domain\n"));
45 escape_domain_name
= escape_rdn_val_string_alloc(domain_name
);
46 if (!escape_domain_name
) {
47 DEBUG(0, ("Out of memory!\n"));
48 return NT_STATUS_NO_MEMORY
;
51 pstr_sprintf(dn
, "%s=%s,%s",
52 get_attr_key2string(dominfo_attr_list
, LDAP_ATTR_DOMAIN
),
53 escape_domain_name
, lp_ldap_suffix());
55 SAFE_FREE(escape_domain_name
);
57 for (i
=1; decode_account_policy_name(i
) != NULL
; i
++) {
61 policy_attr
= get_account_policy_attr(i
);
63 DEBUG(0,("add_new_domain_account_policies: ops. no policy!\n"));
67 if (!account_policy_get_default(i
, &policy_default
)) {
68 DEBUG(0,("add_new_domain_account_policies: failed to get default account policy\n"));
72 DEBUG(10,("add_new_domain_account_policies: adding \"%s\" with value: %d\n", policy_attr
, policy_default
));
74 pstr_sprintf(val
, "%d", policy_default
);
76 smbldap_set_mod( &mods
, LDAP_MOD_REPLACE
, policy_attr
, val
);
78 rc
= smbldap_modify(ldap_state
, dn
, mods
);
80 if (rc
!=LDAP_SUCCESS
) {
81 char *ld_error
= NULL
;
82 ldap_get_option(ldap_state
->ldap_struct
, LDAP_OPT_ERROR_STRING
, &ld_error
);
83 DEBUG(1,("add_new_domain_account_policies: failed to add account policies to dn= %s with: %s\n\t%s\n",
84 dn
, ldap_err2string(rc
),
85 ld_error
? ld_error
: "unknown"));
87 ldap_mods_free(mods
, True
);
92 ldap_mods_free(mods
, True
);
97 /**********************************************************************
98 Add the sambaDomain to LDAP, so we don't have to search for this stuff
99 again. This is a once-add operation for now.
101 TODO: Add other attributes, and allow modification.
102 *********************************************************************/
104 static NTSTATUS
add_new_domain_info(struct smbldap_state
*ldap_state
,
105 const char *domain_name
)
108 fstring algorithmic_rid_base_string
;
110 LDAPMod
**mods
= NULL
;
112 LDAPMessage
*result
= NULL
;
114 const char **attr_list
;
115 char *escape_domain_name
;
117 /* escape for filter */
118 escape_domain_name
= escape_ldap_string_alloc(domain_name
);
119 if (!escape_domain_name
) {
120 DEBUG(0, ("Out of memory!\n"));
121 return NT_STATUS_NO_MEMORY
;
124 slprintf (filter
, sizeof (filter
) - 1, "(&(%s=%s)(objectclass=%s))",
125 get_attr_key2string(dominfo_attr_list
, LDAP_ATTR_DOMAIN
),
126 escape_domain_name
, LDAP_OBJ_DOMINFO
);
128 SAFE_FREE(escape_domain_name
);
130 attr_list
= get_attr_list( NULL
, dominfo_attr_list
);
131 rc
= smbldap_search_suffix(ldap_state
, filter
, attr_list
, &result
);
132 TALLOC_FREE( attr_list
);
134 if (rc
!= LDAP_SUCCESS
) {
135 return NT_STATUS_UNSUCCESSFUL
;
138 num_result
= ldap_count_entries(ldap_state
->ldap_struct
, result
);
140 if (num_result
> 1) {
141 DEBUG (0, ("add_new_domain_info: More than domain with that name exists: bailing "
143 ldap_msgfree(result
);
144 return NT_STATUS_UNSUCCESSFUL
;
147 /* Check if we need to add an entry */
148 DEBUG(3,("add_new_domain_info: Adding new domain\n"));
150 /* this time escape for DN */
151 escape_domain_name
= escape_rdn_val_string_alloc(domain_name
);
152 if (!escape_domain_name
) {
153 DEBUG(0, ("Out of memory!\n"));
154 return NT_STATUS_NO_MEMORY
;
157 pstr_sprintf(dn
, "%s=%s,%s",
158 get_attr_key2string(dominfo_attr_list
, LDAP_ATTR_DOMAIN
),
159 escape_domain_name
, lp_ldap_suffix());
161 SAFE_FREE(escape_domain_name
);
163 /* Free original search */
164 ldap_msgfree(result
);
166 /* make the changes - the entry *must* not already have samba
169 smbldap_set_mod(&mods
, LDAP_MOD_ADD
,
170 get_attr_key2string(dominfo_attr_list
,
174 /* If we don't have an entry, then ask secrets.tdb for what it thinks.
175 It may choose to make it up */
177 sid_to_string(sid_string
, get_global_sam_sid());
178 smbldap_set_mod(&mods
, LDAP_MOD_ADD
,
179 get_attr_key2string(dominfo_attr_list
,
183 slprintf(algorithmic_rid_base_string
,
184 sizeof(algorithmic_rid_base_string
) - 1, "%i",
185 algorithmic_rid_base());
186 smbldap_set_mod(&mods
, LDAP_MOD_ADD
,
187 get_attr_key2string(dominfo_attr_list
,
188 LDAP_ATTR_ALGORITHMIC_RID_BASE
),
189 algorithmic_rid_base_string
);
190 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectclass", LDAP_OBJ_DOMINFO
);
192 /* add the sambaNextUserRid attributes. */
195 uint32 rid
= BASE_RID
;
198 fstr_sprintf( rid_str
, "%i", rid
);
199 DEBUG(10,("add_new_domain_info: setting next available user rid [%s]\n", rid_str
));
200 smbldap_set_mod(&mods
, LDAP_MOD_ADD
,
201 get_attr_key2string(dominfo_attr_list
,
202 LDAP_ATTR_NEXT_USERRID
),
207 rc
= smbldap_add(ldap_state
, dn
, mods
);
209 if (rc
!=LDAP_SUCCESS
) {
210 char *ld_error
= NULL
;
211 ldap_get_option(ldap_state
->ldap_struct
,
212 LDAP_OPT_ERROR_STRING
, &ld_error
);
213 DEBUG(1,("add_new_domain_info: failed to add domain dn= %s with: %s\n\t%s\n",
214 dn
, ldap_err2string(rc
),
215 ld_error
?ld_error
:"unknown"));
218 ldap_mods_free(mods
, True
);
219 return NT_STATUS_UNSUCCESSFUL
;
222 DEBUG(2,("add_new_domain_info: added: domain = %s in the LDAP database\n", domain_name
));
223 ldap_mods_free(mods
, True
);
227 /**********************************************************************
228 Search for the domain info entry
229 *********************************************************************/
231 NTSTATUS
smbldap_search_domain_info(struct smbldap_state
*ldap_state
,
232 LDAPMessage
** result
, const char *domain_name
,
235 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
238 const char **attr_list
;
240 char *escape_domain_name
;
242 escape_domain_name
= escape_ldap_string_alloc(domain_name
);
243 if (!escape_domain_name
) {
244 DEBUG(0, ("Out of memory!\n"));
245 return NT_STATUS_NO_MEMORY
;
248 pstr_sprintf(filter
, "(&(objectClass=%s)(%s=%s))",
250 get_attr_key2string(dominfo_attr_list
, LDAP_ATTR_DOMAIN
),
253 SAFE_FREE(escape_domain_name
);
255 DEBUG(2, ("smbldap_search_domain_info: Searching for:[%s]\n", filter
));
257 attr_list
= get_attr_list( NULL
, dominfo_attr_list
);
258 rc
= smbldap_search_suffix(ldap_state
, filter
, attr_list
, result
);
259 TALLOC_FREE( attr_list
);
261 if (rc
!= LDAP_SUCCESS
) {
262 DEBUG(2,("smbldap_search_domain_info: Problem during LDAPsearch: %s\n", ldap_err2string (rc
)));
263 DEBUG(2,("smbldap_search_domain_info: Query was: %s, %s\n", lp_ldap_suffix(), filter
));
267 count
= ldap_count_entries(ldap_state
->ldap_struct
, *result
);
272 ldap_msgfree(*result
);
277 DEBUG(3, ("smbldap_search_domain_info: Got no domain info entries for domain\n"));
282 status
= add_new_domain_info(ldap_state
, domain_name
);
283 if (!NT_STATUS_IS_OK(status
)) {
284 DEBUG(0, ("smbldap_search_domain_info: Adding domain info for %s failed with %s\n",
285 domain_name
, nt_errstr(status
)));
289 status
= add_new_domain_account_policies(ldap_state
, domain_name
);
290 if (!NT_STATUS_IS_OK(status
)) {
291 DEBUG(0, ("smbldap_search_domain_info: Adding domain account policies for %s failed with %s\n",
292 domain_name
, nt_errstr(status
)));
296 return smbldap_search_domain_info(ldap_state
, result
, domain_name
, False
);
302 DEBUG(0, ("smbldap_search_domain_info: Got too many (%d) domain info entries for domain %s\n",
303 count
, domain_name
));