source/passdb/pdb_ldap.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 2.9.
   4    LDAP protocol helper functions for SAMBA
   5    Copyright (C) Shahms King 2001
   6    Copyright (C) Jean François Micouleau 1998
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21
  22 */
  23
  24 #include "includes.h"
  25
  26 #ifdef WITH_LDAP_SAM
  27 /* TODO:
  28 *  persistent connections: if using NSS LDAP, many connections are made
  29 *      however, using only one within Samba would be nice
  30 *
  31 *  Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
  32 *
  33 *  Other LDAP based login attributes: accountExpires, etc.
  34 *  (should be the domain of Samba proper, but the sam_password/SAM_ACCOUNT
  35 *  structures don't have fields for some of these attributes)
  36 *
  37 *  SSL is done, but can't get the certificate based authentication to work
  38 *  against on my test platform (Linux 2.4, OpenLDAP 2.x)
  39 */
  40
  41 /* NOTE: this will NOT work against an Active Directory server
  42 *  due to the fact that the two password fields cannot be retrieved
  43 *  from a server; recommend using security = domain in this situation
  44 *  and/or winbind
  45 */
  46
  47 #include <lber.h>
  48 #include <ldap.h>
  49
  50 #ifndef SAM_ACCOUNT
  51 #define SAM_ACCOUNT struct sam_passwd
  52 #endif
  53
  54 struct ldap_enum_info
  55 {
  56         LDAP *ldap_struct;
  57         LDAPMessage *result;
  58         LDAPMessage *entry;
  59 };
  60
  61 static struct ldap_enum_info global_ldap_ent;
  62
  63
  64 /*******************************************************************
  65  open a connection to the ldap server.
  66 ******************************************************************/
  67 static BOOL
  68 ldap_open_connection (LDAP ** ldap_struct)
  69 {
  70         int port;
  71         int version, rc;
  72         int tls = LDAP_OPT_X_TLS_HARD;
  73
  74         if (lp_ldap_ssl() == LDAP_SSL_ON && lp_ldap_port() == 389) {
  75                 port = 636;
  76         }
  77         else {
  78                 port = lp_ldap_port();
  79         }
  80
  81         if ((*ldap_struct = ldap_init(lp_ldap_server(), port)) == NULL) {
  82                 DEBUG(0, ("The LDAP server is not responding !\n"));
  83                 return (False);
  84         }
  85
  86         /* Connect to older servers using SSL and V2 rather than Start TLS */
  87         if (ldap_get_option(*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS)
  88         {
  89                 if (version != LDAP_VERSION2)
  90                 {
  91                         version = LDAP_VERSION2;
  92                         ldap_set_option (*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version);
  93                 }
  94         }
  95
  96         switch (lp_ldap_ssl())
  97         {
  98                 case LDAP_SSL_START_TLS:
  99                         if (ldap_get_option (*ldap_struct, LDAP_OPT_PROTOCOL_VERSION,
 100                                 &version) == LDAP_OPT_SUCCESS)
 101                         {
 102                                 if (version < LDAP_VERSION3)
 103                                 {
 104                                         version = LDAP_VERSION3;
 105                                         ldap_set_option (*ldap_struct, LDAP_OPT_PROTOCOL_VERSION,
 106                                                         &version);
 107                                 }
 108                         }
 109                         if ((rc = ldap_start_tls_s (*ldap_struct, NULL, NULL)) != LDAP_SUCCESS)
 110                         {
 111                                 DEBUG(0,
 112                                       ("Failed to issue the StartTLS instruction: %s\n",
 113                                        ldap_err2string(rc)));
 114                                 return False;
 115                         }
 116                         DEBUG (2, ("StartTLS issued: using a TLS connection\n"));
 117                         break;
 118                 case LDAP_SSL_ON:
 119                         if (ldap_set_option (*ldap_struct, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS)
 120                         {
 121                                 DEBUG(0, ("Failed to setup a TLS session\n"));
 122                         }
 123                         break;
 124                 case LDAP_SSL_OFF:
 125                 default:
 126                         /* What is meant here ? JRA. */
 127                         break;
 128         }
 129
 130         DEBUG(2, ("ldap_open_connection: connection opened\n"));
 131         return (True);
 132 }
 133
 134 /*******************************************************************
 135  connect to the ldap server under system privilege.
 136 ******************************************************************/
 137 static BOOL ldap_connect_system(LDAP * ldap_struct)
 138 {
 139         int rc;
 140         static BOOL got_pw = False;
 141         static pstring ldap_secret;
 142
 143         /* get the password if we don't have it already */
 144         if (!got_pw && !(got_pw=fetch_ldap_pw(lp_ldap_admin_dn(), ldap_secret, sizeof(pstring))))
 145         {
 146                 DEBUG(0, ("ldap_connect_system: Failed to retrieve password for %s from secrets.tdb\n",
 147                         lp_ldap_admin_dn()));
 148                 return False;
 149         }
 150
 151         /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite
 152            (OpenLDAP) doesnt' seem to support it */
 153         DEBUG(10,("ldap_connect_system: Binding to ldap server as \"%s\"\n",
 154                 lp_ldap_admin_dn()));
 155         if ((rc = ldap_simple_bind_s(ldap_struct, lp_ldap_admin_dn(),
 156                 ldap_secret)) != LDAP_SUCCESS)
 157         {
 158                 DEBUG(0, ("Bind failed: %s\n", ldap_err2string(rc)));
 159                 return (False);
 160         }
 161
 162         DEBUG(2, ("ldap_connect_system: succesful connection to the LDAP server\n"));
 163         return (True);
 164 }
 165
 166 /*******************************************************************
 167  run the search by name.
 168 ******************************************************************/
 169 static int ldap_search_one_user (LDAP * ldap_struct, const char *filter, LDAPMessage ** result)
 170 {
 171         int scope = LDAP_SCOPE_SUBTREE;
 172         int rc;
 173
 174         DEBUG(2, ("ldap_search_one_user: searching for:[%s]\n", filter));
 175
 176         rc = ldap_search_s (ldap_struct, lp_ldap_suffix (), scope,
 177                 filter, NULL, 0, result);
 178
 179         if (rc != LDAP_SUCCESS) {
 180                 DEBUG(0,("ldap_search_one_user: Problem during the LDAP search: %s\n",
 181                         ldap_err2string (rc)));
 182                 DEBUG(3,("ldap_search_one_user: Query was: %s, %s\n", lp_ldap_suffix(),
 183                         filter));
 184         }
 185         return (rc);
 186 }
 187
 188 /*******************************************************************
 189  run the search by name.
 190 ******************************************************************/
 191 static int ldap_search_one_user_by_name (LDAP * ldap_struct, const char *user,
 192                              LDAPMessage ** result)
 193 {
 194         pstring filter;
 195
 196         /*
 197            in the filter expression, replace %u with the real name
 198            so in ldap filter, %u MUST exist :-)
 199          */
 200         pstrcpy(filter, lp_ldap_filter());
 201
 202         /* have to use this here because $ is filtered out
 203            * in pstring_sub
 204          */
 205         all_string_sub(filter, "%u", user, sizeof(pstring));
 206
 207         return ldap_search_one_user(ldap_struct, filter, result);
 208 }
 209
 210 /*******************************************************************
 211  run the search by uid.
 212 ******************************************************************/
 213 static int ldap_search_one_user_by_uid(LDAP * ldap_struct, int uid,
 214                             LDAPMessage ** result)
 215 {
 216         struct passwd *user;
 217         pstring filter;
 218
 219         /* Get the username from the system and look that up in the LDAP */
 220         user = sys_getpwuid(uid);
 221         pstrcpy(filter, lp_ldap_filter());
 222         all_string_sub(filter, "%u", user->pw_name, sizeof(pstring));
 223
 224         return ldap_search_one_user(ldap_struct, filter, result);
 225 }
 226
 227 /*******************************************************************
 228  run the search by rid.
 229 ******************************************************************/
 230 static int ldap_search_one_user_by_rid (LDAP * ldap_struct, uint32 rid,
 231                             LDAPMessage ** result)
 232 {
 233         pstring filter;
 234         int rc;
 235
 236         /* check if the user rid exsists, if not, try searching on the uid */
 237         snprintf(filter, sizeof(filter) - 1, "rid=%i", rid);
 238         rc = ldap_search_one_user(ldap_struct, filter, result);
 239
 240         if (rc != LDAP_SUCCESS)
 241                 rc = ldap_search_one_user_by_uid(ldap_struct,
 242                         pdb_user_rid_to_uid(rid), result);
 243
 244         return rc;
 245 }
 246
 247 /*******************************************************************
 248 search an attribute and return the first value found.
 249 ******************************************************************/
 250 static void get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry,
 251                      char *attribute, char *value)
 252 {
 253         char **valeurs;
 254
 255         if ((valeurs = ldap_get_values (ldap_struct, entry, attribute)) != NULL) {
 256                 pstrcpy(value, valeurs[0]);
 257                 ldap_value_free(valeurs);
 258                 DEBUG (2, ("get_single_attribute: [%s] = [%s]\n", attribute, value));
 259         }
 260         else {
 261                 value = NULL;
 262                 DEBUG (2, ("get_single_attribute: [%s] = [NULL]\n", attribute));
 263         }
 264 }
 265
 266 /************************************************************************
 267 Routine to manage the LDAPMod structure array
 268 manage memory used by the array, by each struct, and values
 269
 270 ************************************************************************/
 271 static void make_a_mod (LDAPMod *** modlist, int modop, char *attribute, char *value)
 272 {
 273         LDAPMod **mods;
 274         int i;
 275         int j;
 276
 277         mods = *modlist;
 278
 279         if (attribute == NULL || *attribute == '\0')
 280                 return;
 281
 282         if (value == NULL || *value == '\0')
 283                 return;
 284
 285         if (mods == NULL)
 286         {
 287                 mods = (LDAPMod **) malloc(sizeof(LDAPMod *));
 288                 if (mods == NULL)
 289                 {
 290                         DEBUG(0, ("make_a_mod: out of memory!\n"));
 291                         return;
 292                 }
 293                 mods[0] = NULL;
 294         }
 295
 296         for (i = 0; mods[i] != NULL; ++i) {
 297                 if (mods[i]->mod_op == modop && !strcasecmp(mods[i]->mod_type, attribute))
 298                         break;
 299         }
 300
 301         if (mods[i] == NULL)
 302         {
 303                 mods = (LDAPMod **) realloc (mods, (i + 2) * sizeof (LDAPMod *));
 304                 if (mods == NULL)
 305                 {
 306                         DEBUG(0, ("make_a_mod: out of memory!\n"));
 307                         return;
 308                 }
 309                 mods[i] = (LDAPMod *) malloc(sizeof(LDAPMod));
 310                 if (mods[i] == NULL)
 311                 {
 312                         DEBUG(0, ("make_a_mod: out of memory!\n"));
 313                         return;
 314                 }
 315                 mods[i]->mod_op = modop;
 316                 mods[i]->mod_values = NULL;
 317                 mods[i]->mod_type = strdup(attribute);
 318                 mods[i + 1] = NULL;
 319         }
 320
 321         if (value != NULL)
 322         {
 323                 j = 0;
 324                 if (mods[i]->mod_values != NULL) {
 325                         for (; mods[i]->mod_values[j] != NULL; j++);
 326                 }
 327                 mods[i]->mod_values = (char **)realloc(mods[i]->mod_values,
 328                                                (j + 2) * sizeof (char *));
 329
 330                 if (mods[i]->mod_values == NULL) {
 331                         DEBUG (0, ("make_a_mod: Memory allocation failure!\n"));
 332                         return;
 333                 }
 334                 mods[i]->mod_values[j] = strdup(value);
 335                 mods[i]->mod_values[j + 1] = NULL;
 336         }
 337         *modlist = mods;
 338 }
 339
 340 /* New Interface is being implemented here */
 341
 342 /**********************************************************************
 343 Initialize SAM_ACCOUNT from an LDAP query
 344 (Based on init_sam_from_buffer in pdb_tdb.c)
 345 *********************************************************************/
 346 static BOOL init_sam_from_ldap (SAM_ACCOUNT * sampass,
 347                    LDAP * ldap_struct, LDAPMessage * entry)
 348 {
 349         time_t  logon_time,
 350                         logoff_time,
 351                         kickoff_time,
 352                         pass_last_set_time,
 353                         pass_can_change_time,
 354                         pass_must_change_time;
 355         static pstring username;
 356         static pstring domain;
 357         static pstring nt_username;
 358         static pstring fullname;
 359         static pstring homedir;
 360         static pstring dir_drive;
 361         static pstring logon_script;
 362         static pstring profile_path;
 363         static pstring acct_desc;
 364         static pstring munged_dial;
 365         static pstring workstations;
 366         struct passwd *sys_user;
 367         uint32 user_rid, group_rid;
 368         static uint8 smblmpwd[16];
 369         static uint8 smbntpwd[16];
 370         uint16 acct_ctrl, logon_divs;
 371         uint32 hours_len;
 372         uint8 *hours;
 373         pstring temp;
 374
 375         get_single_attribute(ldap_struct, entry, "uid", username);
 376         DEBUG(2, ("Entry found for user: %s\n", username));
 377
 378         pstrcpy(nt_username, username);
 379
 380         get_single_attribute(ldap_struct, entry, "sambaDomain", domain);
 381         if (!domain)
 382                 pstrcpy(domain, lp_workgroup());
 383
 384         get_single_attribute(ldap_struct, entry, "pwdLastSet", temp);
 385         pass_last_set_time = (time_t) strtol(temp, NULL, 16);
 386
 387         get_single_attribute(ldap_struct, entry, "logonTime", temp);
 388         logon_time = (time_t) strtol(temp, NULL, 16);
 389
 390         get_single_attribute(ldap_struct, entry, "logoffTime", temp);
 391         logoff_time = (time_t) strtol(temp, NULL, 16);
 392
 393         get_single_attribute(ldap_struct, entry, "kickoffTime", temp);
 394         kickoff_time = (time_t) strtol(temp, NULL, 16);
 395
 396         get_single_attribute(ldap_struct, entry, "pwdCanChange", temp);
 397         pass_can_change_time = (time_t) strtol(temp, NULL, 16);
 398
 399         get_single_attribute(ldap_struct, entry, "pwdMustChange", temp);
 400         pass_must_change_time = (time_t) strtol(temp, NULL, 16);
 401
 402         /* recommend that 'gecos' and 'displayName' should refer to the same
 403            * attribute OID.  userFullName depreciated, only used by Samba
 404            * primary rules of LDAP: don't make a new attribute when one is already defined
 405            * that fits your needs; using gecos then displayName then cn rather than 'userFullName'
 406          */
 407
 408         get_single_attribute(ldap_struct, entry, "gecos", fullname);
 409
 410         if (!fullname) {
 411                 get_single_attribute(ldap_struct, entry, "displayName", fullname);
 412                 get_single_attribute(ldap_struct, entry, "cn", fullname);
 413         }
 414
 415         get_single_attribute(ldap_struct, entry, "homeDrive", dir_drive);
 416         DEBUG(5,("homeDrive is set to %s\n",dir_drive));
 417         if (!*dir_drive) {
 418                 pstrcpy(dir_drive, lp_logon_drive());
 419                 DEBUG(5,("homeDrive fell back to %s\n",dir_drive));
 420         }
 421
 422         get_single_attribute(ldap_struct, entry, "smbHome", homedir);
 423         DEBUG(5,("smbHome is set to %s\n",homedir));
 424         if (!*homedir) {
 425                 pstrcpy(homedir, lp_logon_home());
 426                 DEBUG(5,("smbHome fell back to %s\n",homedir));
 427         }
 428
 429         get_single_attribute(ldap_struct, entry, "scriptPath", logon_script);
 430         DEBUG(5,("scriptPath is set to %s\n",logon_script));
 431         if (!*logon_script) {
 432                 pstrcpy(logon_script, lp_logon_script());
 433                 DEBUG(5,("scriptPath fell back to %s\n",logon_script));
 434         }
 435
 436         get_single_attribute(ldap_struct, entry, "profilePath", profile_path);
 437         DEBUG(5,("profilePath is set to %s\n",profile_path));
 438         if (!*profile_path) {
 439                 pstrcpy(profile_path, lp_logon_path());
 440                 DEBUG(5,("profilePath fell back to %s\n",profile_path));
 441         }
 442
 443         get_single_attribute(ldap_struct, entry, "description", acct_desc);
 444         get_single_attribute(ldap_struct, entry, "userWorkstations", workstations);
 445         get_single_attribute(ldap_struct, entry, "rid", temp);
 446         user_rid = (uint32)strtol(temp, NULL, 10);
 447         get_single_attribute(ldap_struct, entry, "primaryGroupID", temp);
 448         group_rid = (uint32)strtol(temp, NULL, 10);
 449
 450
 451         /* These values MAY be in LDAP, but they can also be retrieved through
 452            *  sys_getpw*() which is how we're doing it (if you use nss_ldap, then
 453            *  these values will be stored in LDAP as well, but if not, we want the
 454            *  local values to override the LDAP for this anyway
 455            *  homeDirectory attribute
 456          */
 457         sys_user = sys_getpwnam(username);
 458         if (sys_user == NULL)
 459                 return False;
 460
 461
 462         /* FIXME: hours stuff should be cleaner */
 463         logon_divs = 168;
 464         hours_len = 21;
 465         hours = malloc(sizeof(hours) * hours_len);
 466         memset(hours, 0xff, hours_len);
 467
 468         get_single_attribute (ldap_struct, entry, "lmPassword", temp);
 469         pdb_gethexpwd(temp, smblmpwd);
 470         memset((char *)temp, '\0', sizeof(temp));
 471         get_single_attribute (ldap_struct, entry, "ntPassword", temp);
 472         pdb_gethexpwd(temp, smbntpwd);
 473         memset((char *)temp, '\0', sizeof(temp));
 474         get_single_attribute (ldap_struct, entry, "acctFlags", temp);
 475         acct_ctrl = pdb_decode_acct_ctrl(temp);
 476
 477         if (acct_ctrl == 0)
 478                 acct_ctrl |= ACB_NORMAL;
 479
 480
 481         pdb_set_acct_ctrl(sampass, acct_ctrl);
 482         pdb_set_logon_time(sampass, logon_time);
 483         pdb_set_logoff_time(sampass, logoff_time);
 484         pdb_set_kickoff_time(sampass, kickoff_time);
 485         pdb_set_pass_can_change_time(sampass, pass_can_change_time);
 486         pdb_set_pass_must_change_time(sampass, pass_must_change_time);
 487         pdb_set_pass_last_set_time(sampass, pass_last_set_time);
 488
 489         pdb_set_hours_len(sampass, hours_len);
 490         pdb_set_logons_divs(sampass, logon_divs);
 491
 492         pdb_set_uid(sampass, sys_user->pw_uid);
 493         pdb_set_gid(sampass, sys_user->pw_gid);
 494         pdb_set_user_rid(sampass, user_rid);
 495         pdb_set_group_rid(sampass, group_rid);
 496
 497         pdb_set_username(sampass, username);
 498
 499         pdb_set_domain(sampass, domain);
 500         pdb_set_nt_username(sampass, nt_username);
 501
 502         pdb_set_fullname(sampass, fullname);
 503
 504         pdb_set_logon_script(sampass, logon_script);
 505         pdb_set_profile_path(sampass, profile_path);
 506         pdb_set_dir_drive(sampass, dir_drive);
 507         pdb_set_homedir(sampass, homedir);
 508         pdb_set_acct_desc(sampass, acct_desc);
 509         pdb_set_workstations(sampass, workstations);
 510         pdb_set_munged_dial(sampass, munged_dial);
 511         if (!pdb_set_nt_passwd(sampass, smbntpwd))
 512                 return False;
 513         if (!pdb_set_lanman_passwd(sampass, smblmpwd))
 514                 return False;
 515
 516         /* pdb_set_unknown_3(sampass, unknown3); */
 517         /* pdb_set_unknown_5(sampass, unknown5); */
 518         /* pdb_set_unknown_6(sampass, unknown6); */
 519
 520         pdb_set_hours(sampass, hours);
 521
 522         return True;
 523 }
 524
 525 /**********************************************************************
 526 Initialize SAM_ACCOUNT from an LDAP query
 527 (Based on init_buffer_from_sam in pdb_tdb.c)
 528 *********************************************************************/
 529 static BOOL init_ldap_from_sam (LDAPMod *** mods, int ldap_state, SAM_ACCOUNT * sampass)
 530 {
 531         pstring temp;
 532
 533         *mods = NULL;
 534
 535         /*
 536          * took out adding "objectclass: sambaAccount"
 537          * do this on a per-mod basis
 538          */
 539
 540
 541         make_a_mod(mods, ldap_state, "uid", pdb_get_username(sampass));
 542         DEBUG(2, ("Setting entry for user: %s\n", pdb_get_username(sampass)));
 543
 544         slprintf(temp, sizeof(temp) - 1, "%i", pdb_get_uid(sampass));
 545         make_a_mod(mods, ldap_state, "uidNumber", temp);
 546
 547         slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_last_set_time(sampass));
 548         make_a_mod(mods, ldap_state, "pwdLastSet", temp);
 549
 550         slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logon_time(sampass));
 551         make_a_mod(mods, ldap_state, "logonTime", temp);
 552
 553         slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logoff_time(sampass));
 554         make_a_mod(mods, ldap_state, "logoffTime", temp);
 555
 556         slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_kickoff_time(sampass));
 557         make_a_mod(mods, ldap_state, "kickoffTime", temp);
 558
 559         slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_can_change_time(sampass));
 560         make_a_mod(mods, ldap_state, "pwdCanChange", temp);
 561
 562         slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_must_change_time(sampass));
 563         make_a_mod(mods, ldap_state, "pwdMustChange", temp);
 564
 565         /* displayName, cn, and gecos should all be the same
 566            *  most easily accomplished by giving them the same OID
 567            *  gecos isn't set here b/c it should be handled by the
 568            *  add-user script
 569          */
 570
 571         make_a_mod(mods, ldap_state, "displayName", pdb_get_fullname(sampass));
 572         make_a_mod(mods, ldap_state, "cn", pdb_get_fullname(sampass));
 573
 574         make_a_mod(mods, ldap_state, "smbHome", pdb_get_homedir(sampass));
 575         make_a_mod(mods, ldap_state, "homeDrive", pdb_get_dirdrive(sampass));
 576         make_a_mod(mods, ldap_state, "scriptPath", pdb_get_logon_script(sampass));
 577         make_a_mod(mods, ldap_state, "profilePath", pdb_get_profile_path(sampass));
 578         make_a_mod(mods, ldap_state, "description", pdb_get_acct_desc(sampass));
 579         make_a_mod(mods, ldap_state, "userWorkstations", pdb_get_workstations(sampass));
 580
 581         if ( !sampass->user_rid)
 582                 sampass->user_rid = pdb_uid_to_user_rid(pdb_get_uid(sampass));
 583         slprintf(temp, sizeof(temp) - 1, "%i", sampass->user_rid);
 584         make_a_mod(mods, ldap_state, "rid", temp);
 585
 586         if ( !sampass->group_rid)
 587                 sampass->group_rid = pdb_gid_to_group_rid(pdb_get_gid(sampass));
 588         slprintf(temp, sizeof(temp) - 1, "%i", sampass->group_rid);
 589         make_a_mod(mods, ldap_state, "primaryGroupID", temp);
 590
 591         /* FIXME: Hours stuff goes in LDAP  */
 592         pdb_sethexpwd (temp, pdb_get_lanman_passwd(sampass), pdb_get_acct_ctrl(sampass));
 593         make_a_mod (mods, ldap_state, "lmPassword", temp);
 594         pdb_sethexpwd (temp, pdb_get_nt_passwd(sampass), pdb_get_acct_ctrl(sampass));
 595         make_a_mod (mods, ldap_state, "ntPassword", temp);
 596         make_a_mod (mods, ldap_state, "acctFlags", pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass),
 597                 NEW_PW_FORMAT_SPACE_PADDED_LEN));
 598
 599         return True;
 600 }
 601
 602 /**********************************************************************
 603 Connect to LDAP server for password enumeration
 604 *********************************************************************/
 605 BOOL pdb_setsampwent(BOOL update)
 606 {
 607         int rc;
 608         pstring filter;
 609
 610         if (!ldap_open_connection(&global_ldap_ent.ldap_struct))
 611         {
 612                 return False;
 613         }
 614         if (!ldap_connect_system(global_ldap_ent.ldap_struct))
 615         {
 616                 ldap_unbind(global_ldap_ent.ldap_struct);
 617                 return False;
 618         }
 619
 620         pstrcpy(filter, lp_ldap_filter());
 621         all_string_sub(filter, "%u", "*", sizeof(pstring));
 622
 623         rc = ldap_search_s(global_ldap_ent.ldap_struct, lp_ldap_suffix(),
 624                            LDAP_SCOPE_SUBTREE, filter, NULL, 0,
 625                            &global_ldap_ent.result);
 626
 627         if (rc != LDAP_SUCCESS)
 628         {
 629                 DEBUG(0, ("LDAP search failed: %s\n", ldap_err2string(rc)));
 630                 DEBUG(3, ("Query was: %s, %s\n", lp_ldap_suffix(), filter));
 631                 ldap_msgfree(global_ldap_ent.result);
 632                 ldap_unbind(global_ldap_ent.ldap_struct);
 633                 global_ldap_ent.ldap_struct = NULL;
 634                 global_ldap_ent.result = NULL;
 635                 return False;
 636         }
 637
 638         DEBUG(2, ("pdb_setsampwent: %d entries in the base!\n",
 639                 ldap_count_entries(global_ldap_ent.ldap_struct,
 640                 global_ldap_ent.result)));
 641
 642         global_ldap_ent.entry = ldap_first_entry(global_ldap_ent.ldap_struct,
 643                                  global_ldap_ent.result);
 644
 645         return True;
 646 }
 647
 648 /**********************************************************************
 649 End enumeration of the LDAP password list
 650 *********************************************************************/
 651 void pdb_endsampwent(void)
 652 {
 653         if (global_ldap_ent.ldap_struct && global_ldap_ent.result)
 654         {
 655                 ldap_msgfree(global_ldap_ent.result);
 656                 ldap_unbind(global_ldap_ent.ldap_struct);
 657                 global_ldap_ent.ldap_struct = NULL;
 658                 global_ldap_ent.result = NULL;
 659         }
 660 }
 661
 662 /**********************************************************************
 663 Get the next entry in the LDAP password database
 664 *********************************************************************/
 665 BOOL pdb_getsampwent(SAM_ACCOUNT * user)
 666 {
 667         if (!global_ldap_ent.entry)
 668                 return False;
 669
 670         global_ldap_ent.entry = ldap_next_entry(global_ldap_ent.ldap_struct,
 671                                 global_ldap_ent.entry);
 672
 673         if (global_ldap_ent.entry != NULL)
 674         {
 675                 return init_sam_from_ldap(user, global_ldap_ent.ldap_struct,
 676                                           global_ldap_ent.entry);
 677         }
 678         return False;
 679 }
 680
 681 /**********************************************************************
 682 Get SAM_ACCOUNT entry from LDAP by username
 683 *********************************************************************/
 684 BOOL pdb_getsampwnam(SAM_ACCOUNT * user, char *sname)
 685 {
 686         LDAP *ldap_struct;
 687         LDAPMessage *result;
 688         LDAPMessage *entry;
 689
 690         if (!ldap_open_connection(&ldap_struct))
 691                 return False;
 692         if (!ldap_connect_system(ldap_struct))
 693         {
 694                 ldap_unbind(ldap_struct);
 695                 return False;
 696         }
 697         if (ldap_search_one_user_by_name(ldap_struct, sname, &result) !=
 698             LDAP_SUCCESS)
 699         {
 700                 ldap_unbind(ldap_struct);
 701                 return False;
 702         }
 703         if (ldap_count_entries(ldap_struct, result) < 1)
 704         {
 705                 DEBUG(0,
 706                       ("We don't find this user [%s] count=%d\n", sname,
 707                        ldap_count_entries(ldap_struct, result)));
 708                 ldap_unbind(ldap_struct);
 709                 return False;
 710         }
 711         entry = ldap_first_entry(ldap_struct, result);
 712         if (entry)
 713         {
 714                 init_sam_from_ldap(user, ldap_struct, entry);
 715                 ldap_msgfree(result);
 716                 ldap_unbind(ldap_struct);
 717                 return True;
 718         }
 719         else
 720         {
 721                 ldap_msgfree(result);
 722                 ldap_unbind(ldap_struct);
 723                 return False;
 724         }
 725 }
 726
 727 /**********************************************************************
 728 Get SAM_ACCOUNT entry from LDAP by rid
 729 *********************************************************************/
 730 BOOL pdb_getsampwrid(SAM_ACCOUNT * user, uint32 rid)
 731 {
 732         LDAP *ldap_struct;
 733         LDAPMessage *result;
 734         LDAPMessage *entry;
 735
 736         if (!ldap_open_connection(&ldap_struct))
 737                 return False;
 738
 739         if (!ldap_connect_system(ldap_struct))
 740         {
 741                 ldap_unbind(ldap_struct);
 742                 return False;
 743         }
 744         if (ldap_search_one_user_by_rid(ldap_struct, rid, &result) !=
 745             LDAP_SUCCESS)
 746         {
 747                 ldap_unbind(ldap_struct);
 748                 return False;
 749         }
 750
 751         if (ldap_count_entries(ldap_struct, result) < 1)
 752         {
 753                 DEBUG(0,
 754                       ("We don't find this rid [%i] count=%d\n", rid,
 755                        ldap_count_entries(ldap_struct, result)));
 756                 ldap_unbind(ldap_struct);
 757                 return False;
 758         }
 759
 760         entry = ldap_first_entry(ldap_struct, result);
 761         if (entry)
 762         {
 763                 init_sam_from_ldap(user, ldap_struct, entry);
 764                 ldap_msgfree(result);
 765                 ldap_unbind(ldap_struct);
 766                 return True;
 767         }
 768         else
 769         {
 770                 ldap_msgfree(result);
 771                 ldap_unbind(ldap_struct);
 772                 return False;
 773         }
 774 }
 775
 776 /**********************************************************************
 777  Get SAM_ACCOUNT entry from LDAP by uid
 778 *********************************************************************/
 779 BOOL pdb_getsampwuid(SAM_ACCOUNT * user, uid_t uid)
 780 {
 781         LDAP *ldap_struct;
 782         LDAPMessage *result;
 783         LDAPMessage *entry;
 784
 785         if (!ldap_open_connection(&ldap_struct))
 786                 return False;
 787
 788         if (!ldap_connect_system(ldap_struct))
 789         {
 790                 ldap_unbind(ldap_struct);
 791                 return False;
 792         }
 793         if (ldap_search_one_user_by_uid(ldap_struct, uid, &result) !=
 794             LDAP_SUCCESS)
 795         {
 796                 ldap_unbind(ldap_struct);
 797                 return False;
 798         }
 799
 800         if (ldap_count_entries(ldap_struct, result) < 1)
 801         {
 802                 DEBUG(0,
 803                       ("We don't find this uid [%i] count=%d\n", uid,
 804                        ldap_count_entries(ldap_struct, result)));
 805                 ldap_unbind(ldap_struct);
 806                 return False;
 807         }
 808         entry = ldap_first_entry(ldap_struct, result);
 809         if (entry)
 810         {
 811                 init_sam_from_ldap(user, ldap_struct, entry);
 812                 ldap_msgfree(result);
 813                 ldap_unbind(ldap_struct);
 814                 return True;
 815         }
 816         else
 817         {
 818                 ldap_msgfree(result);
 819                 ldap_unbind(ldap_struct);
 820                 return False;
 821         }
 822 }
 823
 824
 825 /**********************************************************************
 826 Delete entry from LDAP for username
 827 *********************************************************************/
 828 BOOL pdb_delete_sam_account(char *sname)
 829 {
 830         int rc;
 831         char *dn;
 832         LDAP *ldap_struct;
 833         LDAPMessage *entry;
 834         LDAPMessage *result;
 835
 836         if (!ldap_open_connection (&ldap_struct))
 837                 return False;
 838
 839         DEBUG (3, ("Deleting user %s from LDAP.\n", sname));
 840
 841         if (!ldap_connect_system (ldap_struct)) {
 842                 ldap_unbind (ldap_struct);
 843                 DEBUG(0, ("Failed to delete user %s from LDAP.\n", sname));
 844                 return False;
 845         }
 846
 847         rc = ldap_search_one_user_by_name (ldap_struct, sname, &result);
 848         if (ldap_count_entries (ldap_struct, result) == 0) {
 849                 DEBUG (0, ("User doesn't exit!\n"));
 850                 ldap_msgfree (result);
 851                 ldap_unbind (ldap_struct);
 852                 return False;
 853         }
 854
 855         entry = ldap_first_entry (ldap_struct, result);
 856         dn = ldap_get_dn (ldap_struct, entry);
 857
 858         rc = ldap_delete_s (ldap_struct, dn);
 859
 860         ldap_memfree (dn);
 861         if (rc != LDAP_SUCCESS) {
 862                 char *ld_error;
 863                 ldap_get_option (ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error);
 864                 DEBUG (0,("failed to delete user with uid = %s with: %s\n\t%s\n",
 865                         sname, ldap_err2string (rc), ld_error));
 866                 free (ld_error);
 867                 ldap_unbind (ldap_struct);
 868                 return False;
 869         }
 870
 871         DEBUG (2,("successfully deleted uid = %s from the LDAP database\n", sname));
 872         ldap_unbind (ldap_struct);
 873         return True;
 874 }
 875
 876 /**********************************************************************
 877 Update SAM_ACCOUNT
 878 *********************************************************************/
 879 BOOL pdb_update_sam_account(SAM_ACCOUNT * newpwd, BOOL override)
 880 {
 881         int rc;
 882         char *dn;
 883         LDAP *ldap_struct;
 884         LDAPMessage *result;
 885         LDAPMessage *entry;
 886         LDAPMod **mods;
 887
 888         if (!ldap_open_connection(&ldap_struct)) /* open a connection to the server */
 889                 return False;
 890
 891         if (!ldap_connect_system(ldap_struct))  /* connect as system account */
 892         {
 893                 ldap_unbind(ldap_struct);
 894                 return False;
 895         }
 896
 897         rc = ldap_search_one_user_by_name(ldap_struct,
 898                                           pdb_get_username(newpwd), &result);
 899
 900         if (ldap_count_entries(ldap_struct, result) == 0)
 901         {
 902                 DEBUG(0, ("No user to modify!\n"));
 903                 ldap_msgfree(result);
 904                 ldap_unbind(ldap_struct);
 905                 return False;
 906         }
 907
 908         init_ldap_from_sam(&mods, LDAP_MOD_REPLACE, newpwd);
 909
 910         entry = ldap_first_entry(ldap_struct, result);
 911         dn = ldap_get_dn(ldap_struct, entry);
 912
 913         rc = ldap_modify_s(ldap_struct, dn, mods);
 914
 915         if (rc != LDAP_SUCCESS)
 916         {
 917                 char *ld_error;
 918                 ldap_get_option(ldap_struct, LDAP_OPT_ERROR_STRING,
 919                                 &ld_error);
 920                 DEBUG(0,
 921                       ("failed to modify user with uid = %s with: %s\n\t%s\n",
 922                        pdb_get_username(newpwd), ldap_err2string(rc),
 923                        ld_error));
 924                 free(ld_error);
 925                 ldap_unbind(ldap_struct);
 926                 return False;
 927         }
 928
 929         DEBUG(2,
 930               ("successfully modified uid = %s in the LDAP database\n",
 931                pdb_get_username(newpwd)));
 932         ldap_mods_free(mods, 1);
 933         ldap_unbind(ldap_struct);
 934         return True;
 935 }
 936
 937 /**********************************************************************
 938 Add SAM_ACCOUNT to LDAP
 939 *********************************************************************/
 940 BOOL pdb_add_sam_account(SAM_ACCOUNT * newpwd)
 941 {
 942         int             rc;
 943         pstring         filter;
 944         LDAP            *ldap_struct;
 945         LDAPMessage     *result;
 946         pstring         dn;
 947         LDAPMod         **mods;
 948         int             ldap_op;
 949         uint32          num_result;
 950
 951         if (!ldap_open_connection(&ldap_struct))        /* open a connection to the server */
 952         {
 953                 return False;
 954         }
 955
 956         if (!ldap_connect_system(ldap_struct))  /* connect as system account */
 957         {
 958                 ldap_unbind(ldap_struct);
 959                 return False;
 960         }
 961
 962         rc = ldap_search_one_user_by_name (ldap_struct, pdb_get_username(newpwd), &result);
 963
 964         if (ldap_count_entries(ldap_struct, result) != 0)
 965         {
 966                 DEBUG(0,("User already in the base, with samba properties\n"));
 967                 ldap_msgfree(result);
 968                 ldap_unbind(ldap_struct);
 969                 return False;
 970         }
 971         ldap_msgfree(result);
 972
 973         slprintf (filter, sizeof (filter) - 1, "uid=%s", pdb_get_username(newpwd));
 974         rc = ldap_search_one_user(ldap_struct, filter, &result);
 975         num_result = ldap_count_entries(ldap_struct, result);
 976
 977         if (num_result > 1) {
 978                 DEBUG (0, ("More than one user with that uid exists: bailing out!\n"));
 979                 return False;
 980         }
 981
 982         /* Check if we need to update an existing entry */
 983         if (num_result == 1) {
 984                 char *tmp;
 985                 LDAPMessage *entry;
 986
 987                 DEBUG(3,("User exists without samba properties: adding them\n"));
 988                 ldap_op = LDAP_MOD_REPLACE;
 989                 entry = ldap_first_entry (ldap_struct, result);
 990                 tmp = ldap_get_dn (ldap_struct, entry);
 991                 slprintf (dn, sizeof (dn) - 1, "%s", tmp);
 992                 ldap_memfree (tmp);
 993         }
 994         else {
 995                 /* Check if we need to add an entry */
 996                 DEBUG(3,("Adding new user\n"));
 997                 ldap_op = LDAP_MOD_ADD;
 998                 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", pdb_get_username(newpwd), lp_ldap_suffix ());
 999         }
1000
1001         ldap_msgfree(result);
1002
1003         init_ldap_from_sam(&mods, ldap_op, newpwd);
1004         make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", "sambaAccount");
1005
1006         if (ldap_op == LDAP_MOD_REPLACE) {
1007                 rc = ldap_modify_s(ldap_struct, dn, mods);
1008         }
1009         else {
1010                 rc = ldap_add_s(ldap_struct, dn, mods);
1011         }
1012
1013         if (rc != LDAP_SUCCESS)
1014         {
1015                 char *ld_error;
1016
1017                 ldap_get_option (ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error);
1018                 DEBUG(0,("failed to modify user with uid = %s with: %s\n\t%s\n",
1019                         pdb_get_username(newpwd), ldap_err2string (rc), ld_error));
1020                 free(ld_error);
1021                 ldap_mods_free(mods, 1);
1022                 ldap_unbind(ldap_struct);
1023                 return False;
1024         }
1025
1026         DEBUG(2,("added: uid = %s in the LDAP database\n", pdb_get_username(newpwd)));
1027         ldap_mods_free(mods, 1);
1028         ldap_unbind(ldap_struct);
1029         return True;
1030 }
1031
1032 #else
1033 void dummy_function(void);
1034 void
1035 dummy_function (void)
1036 {
1037 }                               /* stop some compilers complaining */
1038 #endif