2 Unix SMB/CIFS mplementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean François Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002-2003
8 Copyright (C) Stefan (metze) Metzmacher 2002-2003
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 /**********************************************************************
30 Add the account-policies below the sambaDomain object to LDAP,
31 *********************************************************************/
33 static NTSTATUS
add_new_domain_account_policies(struct smbldap_state
*ldap_state
,
34 const char *domain_name
)
36 NTSTATUS ntstatus
= NT_STATUS_UNSUCCESSFUL
;
38 uint32 policy_default
;
39 const char *policy_attr
= NULL
;
41 LDAPMod
**mods
= NULL
;
43 DEBUG(3,("add_new_domain_account_policies: Adding new account policies for domain\n"));
45 pstr_sprintf(dn
, "%s=%s,%s",
46 get_attr_key2string(dominfo_attr_list
, LDAP_ATTR_DOMAIN
),
47 domain_name
, lp_ldap_suffix());
49 for (i
=1; decode_account_policy_name(i
) != NULL
; i
++) {
53 policy_attr
= get_account_policy_attr(i
);
55 DEBUG(0,("add_new_domain_account_policies: ops. no policy!\n"));
59 if (!account_policy_get_default(i
, &policy_default
)) {
60 DEBUG(0,("add_new_domain_account_policies: failed to get default account policy\n"));
64 DEBUG(10,("add_new_domain_account_policies: adding \"%s\" with value: %d\n", policy_attr
, policy_default
));
66 pstr_sprintf(val
, "%d", policy_default
);
68 smbldap_set_mod( &mods
, LDAP_MOD_REPLACE
, policy_attr
, val
);
70 rc
= smbldap_modify(ldap_state
, dn
, mods
);
72 if (rc
!=LDAP_SUCCESS
) {
73 char *ld_error
= NULL
;
74 ldap_get_option(ldap_state
->ldap_struct
, LDAP_OPT_ERROR_STRING
, &ld_error
);
75 DEBUG(1,("add_new_domain_account_policies: failed to add account policies to dn= %s with: %s\n\t%s\n",
76 dn
, ldap_err2string(rc
),
77 ld_error
? ld_error
: "unknown"));
79 ldap_mods_free(mods
, True
);
84 ldap_mods_free(mods
, True
);
89 /**********************************************************************
90 Add the sambaDomain to LDAP, so we don't have to search for this stuff
91 again. This is a once-add operation for now.
93 TODO: Add other attributes, and allow modification.
94 *********************************************************************/
96 static NTSTATUS
add_new_domain_info(struct smbldap_state
*ldap_state
,
97 const char *domain_name
)
100 fstring algorithmic_rid_base_string
;
102 LDAPMod
**mods
= NULL
;
104 LDAPMessage
*result
= NULL
;
106 const char **attr_list
;
108 slprintf (filter
, sizeof (filter
) - 1, "(&(%s=%s)(objectclass=%s))",
109 get_attr_key2string(dominfo_attr_list
, LDAP_ATTR_DOMAIN
),
110 domain_name
, LDAP_OBJ_DOMINFO
);
112 attr_list
= get_attr_list( NULL
, dominfo_attr_list
);
113 rc
= smbldap_search_suffix(ldap_state
, filter
, attr_list
, &result
);
114 TALLOC_FREE( attr_list
);
116 if (rc
!= LDAP_SUCCESS
) {
117 return NT_STATUS_UNSUCCESSFUL
;
120 num_result
= ldap_count_entries(ldap_state
->ldap_struct
, result
);
122 if (num_result
> 1) {
123 DEBUG (0, ("add_new_domain_info: More than domain with that name exists: bailing "
125 ldap_msgfree(result
);
126 return NT_STATUS_UNSUCCESSFUL
;
129 /* Check if we need to add an entry */
130 DEBUG(3,("add_new_domain_info: Adding new domain\n"));
132 pstr_sprintf(dn
, "%s=%s,%s",
133 get_attr_key2string(dominfo_attr_list
, LDAP_ATTR_DOMAIN
),
134 domain_name
, lp_ldap_suffix());
136 /* Free original search */
137 ldap_msgfree(result
);
139 /* make the changes - the entry *must* not already have samba
142 smbldap_set_mod(&mods
, LDAP_MOD_ADD
,
143 get_attr_key2string(dominfo_attr_list
,
147 /* If we don't have an entry, then ask secrets.tdb for what it thinks.
148 It may choose to make it up */
150 sid_to_string(sid_string
, get_global_sam_sid());
151 smbldap_set_mod(&mods
, LDAP_MOD_ADD
,
152 get_attr_key2string(dominfo_attr_list
,
156 slprintf(algorithmic_rid_base_string
,
157 sizeof(algorithmic_rid_base_string
) - 1, "%i",
158 algorithmic_rid_base());
159 smbldap_set_mod(&mods
, LDAP_MOD_ADD
,
160 get_attr_key2string(dominfo_attr_list
,
161 LDAP_ATTR_ALGORITHMIC_RID_BASE
),
162 algorithmic_rid_base_string
);
163 smbldap_set_mod(&mods
, LDAP_MOD_ADD
, "objectclass", LDAP_OBJ_DOMINFO
);
165 /* add the sambaNextUserRid attributes. */
168 uint32 rid
= BASE_RID
;
171 fstr_sprintf( rid_str
, "%i", rid
);
172 DEBUG(10,("add_new_domain_info: setting next available user rid [%s]\n", rid_str
));
173 smbldap_set_mod(&mods
, LDAP_MOD_ADD
,
174 get_attr_key2string(dominfo_attr_list
,
175 LDAP_ATTR_NEXT_USERRID
),
180 rc
= smbldap_add(ldap_state
, dn
, mods
);
182 if (rc
!=LDAP_SUCCESS
) {
183 char *ld_error
= NULL
;
184 ldap_get_option(ldap_state
->ldap_struct
,
185 LDAP_OPT_ERROR_STRING
, &ld_error
);
186 DEBUG(1,("add_new_domain_info: failed to add domain dn= %s with: %s\n\t%s\n",
187 dn
, ldap_err2string(rc
),
188 ld_error
?ld_error
:"unknown"));
191 ldap_mods_free(mods
, True
);
192 return NT_STATUS_UNSUCCESSFUL
;
195 DEBUG(2,("add_new_domain_info: added: domain = %s in the LDAP database\n", domain_name
));
196 ldap_mods_free(mods
, True
);
200 /**********************************************************************
201 Search for the domain info entry
202 *********************************************************************/
204 NTSTATUS
smbldap_search_domain_info(struct smbldap_state
*ldap_state
,
205 LDAPMessage
** result
, const char *domain_name
,
208 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
211 const char **attr_list
;
214 pstr_sprintf(filter
, "(&(objectClass=%s)(%s=%s))",
216 get_attr_key2string(dominfo_attr_list
, LDAP_ATTR_DOMAIN
),
219 DEBUG(2, ("smbldap_search_domain_info: Searching for:[%s]\n", filter
));
221 attr_list
= get_attr_list( NULL
, dominfo_attr_list
);
222 rc
= smbldap_search_suffix(ldap_state
, filter
, attr_list
, result
);
223 TALLOC_FREE( attr_list
);
225 if (rc
!= LDAP_SUCCESS
) {
226 DEBUG(2,("smbldap_search_domain_info: Problem during LDAPsearch: %s\n", ldap_err2string (rc
)));
227 DEBUG(2,("smbldap_search_domain_info: Query was: %s, %s\n", lp_ldap_suffix(), filter
));
231 count
= ldap_count_entries(ldap_state
->ldap_struct
, *result
);
236 ldap_msgfree(*result
);
241 DEBUG(3, ("smbldap_search_domain_info: Got no domain info entries for domain\n"));
246 status
= add_new_domain_info(ldap_state
, domain_name
);
247 if (!NT_STATUS_IS_OK(status
)) {
248 DEBUG(0, ("smbldap_search_domain_info: Adding domain info for %s failed with %s\n",
249 domain_name
, nt_errstr(status
)));
253 status
= add_new_domain_account_policies(ldap_state
, domain_name
);
254 if (!NT_STATUS_IS_OK(status
)) {
255 DEBUG(0, ("smbldap_search_domain_info: Adding domain account policies for %s failed with %s\n",
256 domain_name
, nt_errstr(status
)));
260 return smbldap_search_domain_info(ldap_state
, result
, domain_name
, False
);
266 DEBUG(0, ("smbldap_search_domain_info: Got too many (%d) domain info entries for domain %s\n",
267 count
, domain_name
));