?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r5957: BUGS 2478, 2093: compiler warning patches from Jason Mader
[Samba/gbeck.git] / source / passdb / pdb_ldap.c
blobafbd488b855f45171bd0161c3a8177769ef79a95
1 /*
2 Unix SMB/CIFS implementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean François Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002-2003
8 Copyright (C) Stefan (metze) Metzmacher 2002-2003
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23
24 */
25
26 /* TODO:
27 * persistent connections: if using NSS LDAP, many connections are made
28 * however, using only one within Samba would be nice
29 *
30 * Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
31 *
32 * Other LDAP based login attributes: accountExpires, etc.
33 * (should be the domain of Samba proper, but the sam_password/SAM_ACCOUNT
34 * structures don't have fields for some of these attributes)
35 *
36 * SSL is done, but can't get the certificate based authentication to work
37 * against on my test platform (Linux 2.4, OpenLDAP 2.x)
38 */
39
40 /* NOTE: this will NOT work against an Active Directory server
41 * due to the fact that the two password fields cannot be retrieved
42 * from a server; recommend using security = domain in this situation
43 * and/or winbind
44 */
45
46 #include "includes.h"
47
48 #undef DBGC_CLASS
49 #define DBGC_CLASS DBGC_PASSDB
50
51 #include <lber.h>
52 #include <ldap.h>
53
54 /*
55 * Work around versions of the LDAP client libs that don't have the OIDs
56 * defined, or have them defined under the old name.
57 * This functionality is really a factor of the server, not the client
58 *
59 */
60
61 #if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD)
62 #define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD
63 #elif !defined(LDAP_EXOP_MODIFY_PASSWD)
64 #define LDAP_EXOP_MODIFY_PASSWD "1.3.6.1.4.1.4203.1.11.1"
65 #endif
66
67 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
68 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID
69 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
70 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID ((ber_tag_t) 0x80U)
71 #endif
72
73 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
74 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW
75 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
76 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ((ber_tag_t) 0x82U)
77 #endif
78
79
80 #ifndef SAM_ACCOUNT
81 #define SAM_ACCOUNT struct sam_passwd
82 #endif
83
84 #include "smbldap.h"
85
86 /**********************************************************************
87 Free a LDAPMessage (one is stored on the SAM_ACCOUNT).
88 **********************************************************************/
89
90 void private_data_free_fn(void **result)
91 {
92 ldap_msgfree(*result);
93 *result = NULL;
94 }
95
96 /**********************************************************************
97 Get the attribute name given a user schame version.
98 **********************************************************************/
99
100 static const char* get_userattr_key2string( int schema_ver, int key )
101 {
102 switch ( schema_ver ) {
103 case SCHEMAVER_SAMBAACCOUNT:
104 return get_attr_key2string( attrib_map_v22, key );
105
106 case SCHEMAVER_SAMBASAMACCOUNT:
107 return get_attr_key2string( attrib_map_v30, key );
108
109 default:
110 DEBUG(0,("get_userattr_key2string: unknown schema version specified\n"));
111 break;
112 }
113 return NULL;
114 }
115
116 /**********************************************************************
117 Return the list of attribute names given a user schema version.
118 **********************************************************************/
119
120 const char** get_userattr_list( int schema_ver )
121 {
122 switch ( schema_ver ) {
123 case SCHEMAVER_SAMBAACCOUNT:
124 return get_attr_list( attrib_map_v22 );
125
126 case SCHEMAVER_SAMBASAMACCOUNT:
127 return get_attr_list( attrib_map_v30 );
128 default:
129 DEBUG(0,("get_userattr_list: unknown schema version specified!\n"));
130 break;
131 }
132
133 return NULL;
134 }
135
136 /**************************************************************************
137 Return the list of attribute names to delete given a user schema version.
138 **************************************************************************/
139
140 static const char** get_userattr_delete_list( int schema_ver )
141 {
142 switch ( schema_ver ) {
143 case SCHEMAVER_SAMBAACCOUNT:
144 return get_attr_list( attrib_map_to_delete_v22 );
145
146 case SCHEMAVER_SAMBASAMACCOUNT:
147 return get_attr_list( attrib_map_to_delete_v30 );
148 default:
149 DEBUG(0,("get_userattr_delete_list: unknown schema version specified!\n"));
150 break;
151 }
152
153 return NULL;
154 }
155
156
157 /*******************************************************************
158 Generate the LDAP search filter for the objectclass based on the
159 version of the schema we are using.
160 ******************************************************************/
161
162 static const char* get_objclass_filter( int schema_ver )
163 {
164 static fstring objclass_filter;
165
166 switch( schema_ver ) {
167 case SCHEMAVER_SAMBAACCOUNT:
168 fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT );
169 break;
170 case SCHEMAVER_SAMBASAMACCOUNT:
171 fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT );
172 break;
173 default:
174 DEBUG(0,("get_objclass_filter: Invalid schema version specified!\n"));
175 break;
176 }
177
178 return objclass_filter;
179 }
180
181 /*******************************************************************
182 Run the search by name.
183 ******************************************************************/
184
185 int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
186 const char *user,
187 LDAPMessage ** result,
188 const char **attr)
189 {
190 pstring filter;
191 char *escape_user = escape_ldap_string_alloc(user);
192
193 if (!escape_user) {
194 return LDAP_NO_MEMORY;
195 }
196
197 /*
198 * in the filter expression, replace %u with the real name
199 * so in ldap filter, %u MUST exist :-)
200 */
201 pstr_sprintf(filter, "(&%s%s)", lp_ldap_filter(),
202 get_objclass_filter(ldap_state->schema_ver));
203
204 /*
205 * have to use this here because $ is filtered out
206 * in pstring_sub
207 */
208
209
210 all_string_sub(filter, "%u", escape_user, sizeof(pstring));
211 SAFE_FREE(escape_user);
212
213 return smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
214 }
215
216 /*******************************************************************
217 Run the search by rid.
218 ******************************************************************/
219
220 static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
221 uint32 rid, LDAPMessage ** result,
222 const char **attr)
223 {
224 pstring filter;
225 int rc;
226
227 pstr_sprintf(filter, "(&(rid=%i)%s)", rid,
228 get_objclass_filter(ldap_state->schema_ver));
229
230 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
231
232 return rc;
233 }
234
235 /*******************************************************************
236 Run the search by SID.
237 ******************************************************************/
238
239 static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
240 const DOM_SID *sid, LDAPMessage ** result,
241 const char **attr)
242 {
243 pstring filter;
244 int rc;
245 fstring sid_string;
246
247 pstr_sprintf(filter, "(&(%s=%s)%s)",
248 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
249 sid_to_string(sid_string, sid),
250 get_objclass_filter(ldap_state->schema_ver));
251
252 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
253
254 return rc;
255 }
256
257 /*******************************************************************
258 Delete complete object or objectclass and attrs from
259 object found in search_result depending on lp_ldap_delete_dn
260 ******************************************************************/
261
262 static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state,
263 LDAPMessage *result,
264 const char *objectclass,
265 const char **attrs)
266 {
267 int rc;
268 LDAPMessage *entry = NULL;
269 LDAPMod **mods = NULL;
270 char *name, *dn;
271 BerElement *ptr = NULL;
272
273 rc = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
274
275 if (rc != 1) {
276 DEBUG(0, ("ldapsam_delete_entry: Entry must exist exactly once!\n"));
277 return NT_STATUS_UNSUCCESSFUL;
278 }
279
280 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
281 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
282 if (!dn) {
283 return NT_STATUS_UNSUCCESSFUL;
284 }
285
286 if (lp_ldap_delete_dn()) {
287 NTSTATUS ret = NT_STATUS_OK;
288 rc = smbldap_delete(ldap_state->smbldap_state, dn);
289
290 if (rc != LDAP_SUCCESS) {
291 DEBUG(0, ("ldapsam_delete_entry: Could not delete object %s\n", dn));
292 ret = NT_STATUS_UNSUCCESSFUL;
293 }
294 SAFE_FREE(dn);
295 return ret;
296 }
297
298 /* Ok, delete only the SAM attributes */
299
300 for (name = ldap_first_attribute(ldap_state->smbldap_state->ldap_struct, entry, &ptr);
301 name != NULL;
302 name = ldap_next_attribute(ldap_state->smbldap_state->ldap_struct, entry, ptr)) {
303 const char **attrib;
304
305 /* We are only allowed to delete the attributes that
306 really exist. */
307
308 for (attrib = attrs; *attrib != NULL; attrib++) {
309 /* Don't delete LDAP_ATTR_MOD_TIMESTAMP attribute. */
310 if (strequal(*attrib, get_userattr_key2string(ldap_state->schema_ver,
311 LDAP_ATTR_MOD_TIMESTAMP))) {
312 continue;
313 }
314 if (strequal(*attrib, name)) {
315 DEBUG(10, ("ldapsam_delete_entry: deleting "
316 "attribute %s\n", name));
317 smbldap_set_mod(&mods, LDAP_MOD_DELETE, name,
318 NULL);
319 }
320 }
321
322 ldap_memfree(name);
323 }
324
325 if (ptr != NULL) {
326 ber_free(ptr, 0);
327 }
328
329 smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
330
331 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
332 ldap_mods_free(mods, True);
333
334 if (rc != LDAP_SUCCESS) {
335 char *ld_error = NULL;
336 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
337 &ld_error);
338
339 DEBUG(0, ("ldapsam_delete_entry: Could not delete attributes for %s, error: %s (%s)\n",
340 dn, ldap_err2string(rc), ld_error?ld_error:"unknown"));
341 SAFE_FREE(ld_error);
342 SAFE_FREE(dn);
343 return NT_STATUS_UNSUCCESSFUL;
344 }
345
346 SAFE_FREE(dn);
347 return NT_STATUS_OK;
348 }
349
350 /* New Interface is being implemented here */
351
352 #if 0 /* JERRY - not uesed anymore */
353
354 /**********************************************************************
355 Initialize SAM_ACCOUNT from an LDAP query (unix attributes only)
356 *********************************************************************/
357 static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state,
358 SAM_ACCOUNT * sampass,
359 LDAPMessage * entry,
360 gid_t *gid)
361 {
362 pstring homedir;
363 pstring temp;
364 char **ldap_values;
365 char **values;
366
367 if ((ldap_values = ldap_get_values (ldap_state->smbldap_state->ldap_struct, entry, "objectClass")) == NULL) {
368 DEBUG (1, ("get_unix_attributes: no objectClass! \n"));
369 return False;
370 }
371
372 for (values=ldap_values;*values;values++) {
373 if (strequal(*values, LDAP_OBJ_POSIXACCOUNT )) {
374 break;
375 }
376 }
377
378 if (!*values) { /*end of array, no posixAccount */
379 DEBUG(10, ("user does not have %s attributes\n", LDAP_OBJ_POSIXACCOUNT));
380 ldap_value_free(ldap_values);
381 return False;
382 }
383 ldap_value_free(ldap_values);
384
385 if ( !smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
386 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_UNIX_HOME), homedir) )
387 {
388 return False;
389 }
390
391 if ( !smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
392 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_GIDNUMBER), temp) )
393 {
394 return False;
395 }
396
397 *gid = (gid_t)atol(temp);
398
399 pdb_set_unix_homedir(sampass, homedir, PDB_SET);
400
401 DEBUG(10, ("user has %s attributes\n", LDAP_OBJ_POSIXACCOUNT));
402
403 return True;
404 }
405
406 #endif
407
408 static time_t ldapsam_get_entry_timestamp(
409 struct ldapsam_privates *ldap_state,
410 LDAPMessage * entry)
411 {
412 pstring temp;
413 struct tm tm;
414
415 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
416 get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
417 temp))
418 return (time_t) 0;
419
420 strptime(temp, "%Y%m%d%H%M%SZ", &tm);
421 tzset();
422 return timegm(&tm);
423 }
424
425 /**********************************************************************
426 Initialize SAM_ACCOUNT from an LDAP query.
427 (Based on init_sam_from_buffer in pdb_tdb.c)
428 *********************************************************************/
429
430 static BOOL init_sam_from_ldap(struct ldapsam_privates *ldap_state,
431 SAM_ACCOUNT * sampass,
432 LDAPMessage * entry)
433 {
434 time_t logon_time,
435 logoff_time,
436 kickoff_time,
437 pass_last_set_time,
438 pass_can_change_time,
439 pass_must_change_time,
440 ldap_entry_time,
441 bad_password_time;
442 pstring username,
443 domain,
444 nt_username,
445 fullname,
446 homedir,
447 dir_drive,
448 logon_script,
449 profile_path,
450 acct_desc,
451 workstations;
452 char munged_dial[2048];
453 uint32 user_rid;
454 uint8 smblmpwd[LM_HASH_LEN],
455 smbntpwd[NT_HASH_LEN];
456 BOOL use_samba_attrs = True;
457 uint16 acct_ctrl = 0,
458 logon_divs;
459 uint16 bad_password_count = 0,
460 logon_count = 0;
461 uint32 hours_len;
462 uint8 hours[MAX_HOURS_LEN];
463 pstring temp;
464 LOGIN_CACHE *cache_entry = NULL;
465 uint32 pwHistLen;
466 pstring tmpstring;
467
468 /*
469 * do a little initialization
470 */
471 username[0] = '\0';
472 domain[0] = '\0';
473 nt_username[0] = '\0';
474 fullname[0] = '\0';
475 homedir[0] = '\0';
476 dir_drive[0] = '\0';
477 logon_script[0] = '\0';
478 profile_path[0] = '\0';
479 acct_desc[0] = '\0';
480 munged_dial[0] = '\0';
481 workstations[0] = '\0';
482
483
484 if (sampass == NULL || ldap_state == NULL || entry == NULL) {
485 DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
486 return False;
487 }
488
489 if (ldap_state->smbldap_state->ldap_struct == NULL) {
490 DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->ldap_struct is NULL!\n"));
491 return False;
492 }
493
494 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, "uid", username)) {
495 DEBUG(1, ("init_sam_from_ldap: No uid attribute found for this user!\n"));
496 return False;
497 }
498
499 DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
500
501 pstrcpy(nt_username, username);
502
503 pstrcpy(domain, ldap_state->domain_name);
504
505 pdb_set_username(sampass, username, PDB_SET);
506
507 pdb_set_domain(sampass, domain, PDB_DEFAULT);
508 pdb_set_nt_username(sampass, nt_username, PDB_SET);
509
510 /* deal with different attributes between the schema first */
511
512 if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
513 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
514 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp)) {
515 pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
516 }
517
518 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
519 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_SID), temp)) {
520 pdb_set_group_sid_from_string(sampass, temp, PDB_SET);
521 } else {
522 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
523 }
524 } else {
525 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
526 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp)) {
527 user_rid = (uint32)atol(temp);
528 pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
529 }
530
531 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
532 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_RID), temp)) {
533 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
534 } else {
535 uint32 group_rid;
536
537 group_rid = (uint32)atol(temp);
538
539 /* for some reason, we often have 0 as a primary group RID.
540 Make sure that we treat this just as a 'default' value */
541
542 if ( group_rid > 0 )
543 pdb_set_group_sid_from_rid(sampass, group_rid, PDB_SET);
544 else
545 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
546 }
547 }
548
549 if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
550 DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
551 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
552 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
553 username));
554 return False;
555 }
556
557 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
558 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) {
559 /* leave as default */
560 } else {
561 pass_last_set_time = (time_t) atol(temp);
562 pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
563 }
564
565 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
566 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp)) {
567 /* leave as default */
568 } else {
569 logon_time = (time_t) atol(temp);
570 pdb_set_logon_time(sampass, logon_time, PDB_SET);
571 }
572
573 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
574 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp)) {
575 /* leave as default */
576 } else {
577 logoff_time = (time_t) atol(temp);
578 pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
579 }
580
581 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
582 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp)) {
583 /* leave as default */
584 } else {
585 kickoff_time = (time_t) atol(temp);
586 pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
587 }
588
589 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
590 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp)) {
591 /* leave as default */
592 } else {
593 pass_can_change_time = (time_t) atol(temp);
594 pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
595 }
596
597 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
598 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp)) {
599 /* leave as default */
600 } else {
601 pass_must_change_time = (time_t) atol(temp);
602 pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
603 }
604
605 /* recommend that 'gecos' and 'displayName' should refer to the same
606 * attribute OID. userFullName depreciated, only used by Samba
607 * primary rules of LDAP: don't make a new attribute when one is already defined
608 * that fits your needs; using cn then displayName rather than 'userFullName'
609 */
610
611 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
612 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname)) {
613 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
614 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname)) {
615 /* leave as default */
616 } else {
617 pdb_set_fullname(sampass, fullname, PDB_SET);
618 }
619 } else {
620 pdb_set_fullname(sampass, fullname, PDB_SET);
621 }
622
623 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
624 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive))
625 {
626 pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
627 } else {
628 pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
629 }
630
631 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
632 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir))
633 {
634 pdb_set_homedir( sampass,
635 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_home()),
636 PDB_DEFAULT );
637 } else {
638 pstrcpy( tmpstring, homedir );
639 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
640 pdb_set_homedir(sampass, tmpstring, PDB_SET);
641 }
642
643 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
644 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script))
645 {
646 pdb_set_logon_script( sampass,
647 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_script()),
648 PDB_DEFAULT );
649 } else {
650 pstrcpy( tmpstring, logon_script );
651 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
652 pdb_set_logon_script(sampass, tmpstring, PDB_SET);
653 }
654
655 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
656 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path))
657 {
658 pdb_set_profile_path( sampass,
659 talloc_sub_basic( sampass->mem_ctx, username, lp_logon_path()),
660 PDB_DEFAULT );
661 } else {
662 pstrcpy( tmpstring, profile_path );
663 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
664 pdb_set_profile_path(sampass, tmpstring, PDB_SET);
665 }
666
667 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
668 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC), acct_desc))
669 {
670 /* leave as default */
671 } else {
672 pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
673 }
674
675 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
676 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations)) {
677 /* leave as default */;
678 } else {
679 pdb_set_workstations(sampass, workstations, PDB_SET);
680 }
681
682 if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
683 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL), munged_dial, sizeof(munged_dial))) {
684 /* leave as default */;
685 } else {
686 pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
687 }
688
689 /* FIXME: hours stuff should be cleaner */
690
691 logon_divs = 168;
692 hours_len = 21;
693 memset(hours, 0xff, hours_len);
694
695 if (ldap_state->is_nds_ldap) {
696 char *user_dn;
697 int pwd_len;
698 char clear_text_pw[512];
699
700 /* Make call to Novell eDirectory ldap extension to get clear text password.
701 NOTE: This will only work if we have an SSL connection to eDirectory. */
702 user_dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
703 if (user_dn != NULL) {
704 DEBUG(3, ("init_sam_from_ldap: smbldap_get_dn(%s) returned '%s'\n", username, user_dn));
705
706 pwd_len = sizeof(clear_text_pw);
707 if (pdb_nds_get_password(ldap_state->smbldap_state, user_dn, &pwd_len, clear_text_pw) == LDAP_SUCCESS) {
708 nt_lm_owf_gen(clear_text_pw, smbntpwd, smblmpwd);
709 if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
710 return False;
711 ZERO_STRUCT(smblmpwd);
712 if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
713 return False;
714 ZERO_STRUCT(smbntpwd);
715 use_samba_attrs = False;
716 }
717 } else {
718 DEBUG(0, ("init_sam_from_ldap: failed to get user_dn for '%s'\n", username));
719 }
720 }
721
722 if (use_samba_attrs) {
723 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
724 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp)) {
725 /* leave as default */
726 } else {
727 pdb_gethexpwd(temp, smblmpwd);
728 memset((char *)temp, '\0', strlen(temp)+1);
729 if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
730 return False;
731 ZERO_STRUCT(smblmpwd);
732 }
733
734 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
735 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp)) {
736 /* leave as default */
737 } else {
738 pdb_gethexpwd(temp, smbntpwd);
739 memset((char *)temp, '\0', strlen(temp)+1);
740 if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
741 return False;
742 ZERO_STRUCT(smbntpwd);
743 }
744 }
745
746 account_policy_get(AP_PASSWORD_HISTORY, &pwHistLen);
747 if (pwHistLen > 0){
748 uint8 *pwhist = NULL;
749 int i;
750
751 /* We can only store (sizeof(pstring)-1)/64 password history entries. */
752 pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));
753
754 if ((pwhist = SMB_MALLOC(pwHistLen * PW_HISTORY_ENTRY_LEN)) == NULL){
755 DEBUG(0, ("init_sam_from_ldap: malloc failed!\n"));
756 return False;
757 }
758 memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
759
760 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
761 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY), temp)) {
762 /* leave as default - zeros */
763 } else {
764 BOOL hex_failed = False;
765 for (i = 0; i < pwHistLen; i++){
766 /* Get the 16 byte salt. */
767 if (!pdb_gethexpwd(&temp[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN])) {
768 hex_failed = True;
769 break;
770 }
771 /* Get the 16 byte MD5 hash of salt+passwd. */
772 if (!pdb_gethexpwd(&temp[(i*64)+32],
773 &pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN])) {
774 hex_failed = True;
775 break;
776 }
777 }
778 if (hex_failed) {
779 DEBUG(0,("init_sam_from_ldap: Failed to get password history for user %s\n",
780 username));
781 memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
782 }
783 }
784 if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
785 SAFE_FREE(pwhist);
786 return False;
787 }
788 SAFE_FREE(pwhist);
789 }
790
791 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
792 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp)) {
793 acct_ctrl |= ACB_NORMAL;
794 } else {
795 acct_ctrl = pdb_decode_acct_ctrl(temp);
796
797 if (acct_ctrl == 0)
798 acct_ctrl |= ACB_NORMAL;
799
800 pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
801 }
802
803 pdb_set_hours_len(sampass, hours_len, PDB_SET);
804 pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
805
806 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
807 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_COUNT), temp)) {
808 /* leave as default */
809 } else {
810 bad_password_count = (uint32) atol(temp);
811 pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET);
812 }
813
814 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
815 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_TIME), temp)) {
816 /* leave as default */
817 } else {
818 bad_password_time = (time_t) atol(temp);
819 pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
820 }
821
822
823 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
824 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_COUNT), temp)) {
825 /* leave as default */
826 } else {
827 logon_count = (uint32) atol(temp);
828 pdb_set_logon_count(sampass, logon_count, PDB_SET);
829 }
830
831 /* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
832
833 if(!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
834 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_HOURS), temp)) {
835 /* leave as default */
836 } else {
837 pdb_gethexhours(temp, hours);
838 memset((char *)temp, '\0', strlen(temp) +1);
839 pdb_set_hours(sampass, hours, PDB_SET);
840 ZERO_STRUCT(hours);
841 }
842
843 /* check the timestamp of the cache vs ldap entry */
844 if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
845 entry)))
846 return True;
847
848 /* see if we have newer updates */
849 if (!(cache_entry = login_cache_read(sampass))) {
850 DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
851 (unsigned int)pdb_get_bad_password_count(sampass),
852 (unsigned int)pdb_get_bad_password_time(sampass)));
853 return True;
854 }
855
856 DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
857 (unsigned int)ldap_entry_time, (unsigned int)cache_entry->entry_timestamp,
858 (unsigned int)cache_entry->bad_password_time));
859
860 if (ldap_entry_time > cache_entry->entry_timestamp) {
861 /* cache is older than directory , so
862 we need to delete the entry but allow the
863 fields to be written out */
864 login_cache_delentry(sampass);
865 } else {
866 /* read cache in */
867 pdb_set_acct_ctrl(sampass,
868 pdb_get_acct_ctrl(sampass) |
869 (cache_entry->acct_ctrl & ACB_AUTOLOCK),
870 PDB_SET);
871 pdb_set_bad_password_count(sampass,
872 cache_entry->bad_password_count,
873 PDB_SET);
874 pdb_set_bad_password_time(sampass,
875 cache_entry->bad_password_time,
876 PDB_SET);
877 }
878
879 SAFE_FREE(cache_entry);
880 return True;
881 }
882
883 /**********************************************************************
884 Initialize the ldap db from a SAM_ACCOUNT. Called on update.
885 (Based on init_buffer_from_sam in pdb_tdb.c)
886 *********************************************************************/
887
888 static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state,
889 LDAPMessage *existing,
890 LDAPMod *** mods, SAM_ACCOUNT * sampass,
891 BOOL (*need_update)(const SAM_ACCOUNT *,
892 enum pdb_elements))
893 {
894 pstring temp;
895 uint32 rid;
896
897 if (mods == NULL || sampass == NULL) {
898 DEBUG(0, ("init_ldap_from_sam: NULL parameters found!\n"));
899 return False;
900 }
901
902 *mods = NULL;
903
904 /*
905 * took out adding "objectclass: sambaAccount"
906 * do this on a per-mod basis
907 */
908 if (need_update(sampass, PDB_USERNAME))
909 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
910 "uid", pdb_get_username(sampass));
911
912 DEBUG(2, ("init_ldap_from_sam: Setting entry for user: %s\n", pdb_get_username(sampass)));
913
914 /* only update the RID if we actually need to */
915 if (need_update(sampass, PDB_USERSID)) {
916 fstring sid_string;
917 fstring dom_sid_string;
918 const DOM_SID *user_sid = pdb_get_user_sid(sampass);
919
920 switch ( ldap_state->schema_ver ) {
921 case SCHEMAVER_SAMBAACCOUNT:
922 if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
923 DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
924 sid_to_string(sid_string, user_sid),
925 sid_to_string(dom_sid_string, &ldap_state->domain_sid)));
926 return False;
927 }
928 slprintf(temp, sizeof(temp) - 1, "%i", rid);
929 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
930 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
931 temp);
932 break;
933
934 case SCHEMAVER_SAMBASAMACCOUNT:
935 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
936 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
937 sid_to_string(sid_string, user_sid));
938 break;
939
940 default:
941 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
942 break;
943 }
944 }
945
946 /* we don't need to store the primary group RID - so leaving it
947 'free' to hang off the unix primary group makes life easier */
948
949 if (need_update(sampass, PDB_GROUPSID)) {
950 fstring sid_string;
951 fstring dom_sid_string;
952 const DOM_SID *group_sid = pdb_get_group_sid(sampass);
953
954 switch ( ldap_state->schema_ver ) {
955 case SCHEMAVER_SAMBAACCOUNT:
956 if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
957 DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
958 sid_to_string(sid_string, group_sid),
959 sid_to_string(dom_sid_string, &ldap_state->domain_sid)));
960 return False;
961 }
962
963 slprintf(temp, sizeof(temp) - 1, "%i", rid);
964 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
965 get_userattr_key2string(ldap_state->schema_ver,
966 LDAP_ATTR_PRIMARY_GROUP_RID), temp);
967 break;
968
969 case SCHEMAVER_SAMBASAMACCOUNT:
970 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
971 get_userattr_key2string(ldap_state->schema_ver,
972 LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_string(sid_string, group_sid));
973 break;
974
975 default:
976 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
977 break;
978 }
979
980 }
981
982 /* displayName, cn, and gecos should all be the same
983 * most easily accomplished by giving them the same OID
984 * gecos isn't set here b/c it should be handled by the
985 * add-user script
986 * We change displayName only and fall back to cn if
987 * it does not exist.
988 */
989
990 if (need_update(sampass, PDB_FULLNAME))
991 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
992 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME),
993 pdb_get_fullname(sampass));
994
995 if (need_update(sampass, PDB_ACCTDESC))
996 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
997 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC),
998 pdb_get_acct_desc(sampass));
999
1000 if (need_update(sampass, PDB_WORKSTATIONS))
1001 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1002 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
1003 pdb_get_workstations(sampass));
1004
1005 if (need_update(sampass, PDB_MUNGEDDIAL))
1006 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1007 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL),
1008 pdb_get_munged_dial(sampass));
1009
1010 if (need_update(sampass, PDB_SMBHOME))
1011 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1012 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
1013 pdb_get_homedir(sampass));
1014
1015 if (need_update(sampass, PDB_DRIVE))
1016 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1017 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
1018 pdb_get_dir_drive(sampass));
1019
1020 if (need_update(sampass, PDB_LOGONSCRIPT))
1021 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1022 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT),
1023 pdb_get_logon_script(sampass));
1024
1025 if (need_update(sampass, PDB_PROFILE))
1026 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1027 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
1028 pdb_get_profile_path(sampass));
1029
1030 slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logon_time(sampass));
1031 if (need_update(sampass, PDB_LOGONTIME))
1032 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1033 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
1034
1035 slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logoff_time(sampass));
1036 if (need_update(sampass, PDB_LOGOFFTIME))
1037 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1038 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
1039
1040 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_kickoff_time(sampass));
1041 if (need_update(sampass, PDB_KICKOFFTIME))
1042 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1043 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
1044
1045 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_can_change_time(sampass));
1046 if (need_update(sampass, PDB_CANCHANGETIME))
1047 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1048 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
1049
1050 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_must_change_time(sampass));
1051 if (need_update(sampass, PDB_MUSTCHANGETIME))
1052 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1053 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
1054
1055
1056 if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST))
1057 || (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
1058
1059 if (need_update(sampass, PDB_LMPASSWD)) {
1060 const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
1061 if (lm_pw) {
1062 pdb_sethexpwd(temp, lm_pw,
1063 pdb_get_acct_ctrl(sampass));
1064 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1065 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1066 temp);
1067 } else {
1068 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1069 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1070 NULL);
1071 }
1072 }
1073 if (need_update(sampass, PDB_NTPASSWD)) {
1074 const uchar *nt_pw = pdb_get_nt_passwd(sampass);
1075 if (nt_pw) {
1076 pdb_sethexpwd(temp, nt_pw,
1077 pdb_get_acct_ctrl(sampass));
1078 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1079 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1080 temp);
1081 } else {
1082 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1083 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1084 NULL);
1085 }
1086 }
1087
1088 if (need_update(sampass, PDB_PWHISTORY)) {
1089 uint32 pwHistLen = 0;
1090 account_policy_get(AP_PASSWORD_HISTORY, &pwHistLen);
1091 if (pwHistLen == 0) {
1092 /* Remove any password history from the LDAP store. */
1093 memset(temp, '0', 64); /* NOTE !!!! '0' *NOT '\0' */
1094 temp[64] = '\0';
1095 } else {
1096 int i;
1097 uint32 currHistLen = 0;
1098 const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
1099 if (pwhist != NULL) {
1100 /* We can only store (sizeof(pstring)-1)/64 password history entries. */
1101 pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));
1102 for (i=0; i< pwHistLen && i < currHistLen; i++) {
1103 /* Store the salt. */
1104 pdb_sethexpwd(&temp[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN], 0);
1105 /* Followed by the md5 hash of salt + md4 hash */
1106 pdb_sethexpwd(&temp[(i*64)+32],
1107 &pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
1108 DEBUG(100, ("temp=%s\n", temp));
1109 }
1110 }
1111 }
1112 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1113 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
1114 temp);
1115 }
1116
1117 if (need_update(sampass, PDB_PASSLASTSET)) {
1118 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_last_set_time(sampass));
1119 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1120 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
1121 temp);
1122 }
1123 }
1124
1125 if (need_update(sampass, PDB_HOURS)) {
1126 const uint8 *hours = pdb_get_hours(sampass);
1127 if (hours) {
1128 pdb_sethexhours(temp, hours);
1129 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
1130 existing,
1131 mods,
1132 get_userattr_key2string(ldap_state->schema_ver,
1133 LDAP_ATTR_LOGON_HOURS),
1134 temp);
1135 }
1136 }
1137
1138 if (need_update(sampass, PDB_ACCTCTRL))
1139 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1140 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
1141 pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
1142
1143 /* password lockout cache:
1144 - If we are now autolocking or clearing, we write to ldap
1145 - If we are clearing, we delete the cache entry
1146 - If the count is > 0, we update the cache
1147
1148 This even means when autolocking, we cache, just in case the
1149 update doesn't work, and we have to cache the autolock flag */
1150
1151 if (need_update(sampass, PDB_BAD_PASSWORD_COUNT)) /* &&
1152 need_update(sampass, PDB_BAD_PASSWORD_TIME)) */ {
1153 uint16 badcount = pdb_get_bad_password_count(sampass);
1154 time_t badtime = pdb_get_bad_password_time(sampass);
1155 uint32 pol;
1156 account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &pol);
1157
1158 DEBUG(3, ("updating bad password fields, policy=%u, count=%u, time=%u\n",
1159 (unsigned int)pol, (unsigned int)badcount, (unsigned int)badtime));
1160
1161 if ((badcount >= pol) || (badcount == 0)) {
1162 DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
1163 (unsigned int)badcount, (unsigned int)badtime));
1164 slprintf (temp, sizeof (temp) - 1, "%li", (long)badcount);
1165 smbldap_make_mod(
1166 ldap_state->smbldap_state->ldap_struct,
1167 existing, mods,
1168 get_userattr_key2string(
1169 ldap_state->schema_ver,
1170 LDAP_ATTR_BAD_PASSWORD_COUNT),
1171 temp);
1172
1173 slprintf (temp, sizeof (temp) - 1, "%li", badtime);
1174 smbldap_make_mod(
1175 ldap_state->smbldap_state->ldap_struct,
1176 existing, mods,
1177 get_userattr_key2string(
1178 ldap_state->schema_ver,
1179 LDAP_ATTR_BAD_PASSWORD_TIME),
1180 temp);
1181 }
1182 if (badcount == 0) {
1183 DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
1184 login_cache_delentry(sampass);
1185 } else {
1186 LOGIN_CACHE cache_entry;
1187
1188 cache_entry.entry_timestamp = time(NULL);
1189 cache_entry.acct_ctrl = pdb_get_acct_ctrl(sampass);
1190 cache_entry.bad_password_count = badcount;
1191 cache_entry.bad_password_time = badtime;
1192
1193 DEBUG(7, ("Updating bad password count and time in login cache\n"));
1194 login_cache_write(sampass, cache_entry);
1195 }
1196 }
1197
1198 return True;
1199 }
1200
1201 /**********************************************************************
1202 Connect to LDAP server for password enumeration.
1203 *********************************************************************/
1204
1205 static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update, uint16 acb_mask)
1206 {
1207 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1208 int rc;
1209 pstring filter, suffix;
1210 const char **attr_list;
1211 BOOL machine_mask = False, user_mask = False;
1212
1213 pstr_sprintf( filter, "(&%s%s)", lp_ldap_filter(),
1214 get_objclass_filter(ldap_state->schema_ver));
1215 all_string_sub(filter, "%u", "*", sizeof(pstring));
1216
1217 machine_mask = ((acb_mask != 0) && (acb_mask & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)));
1218 user_mask = ((acb_mask != 0) && (acb_mask & ACB_NORMAL));
1219
1220 if (machine_mask) {
1221 pstrcpy(suffix, lp_ldap_machine_suffix());
1222 } else if (user_mask) {
1223 pstrcpy(suffix, lp_ldap_user_suffix());
1224 } else {
1225 pstrcpy(suffix, lp_ldap_suffix());
1226 }
1227
1228 DEBUG(10,("ldapsam_setsampwent: LDAP Query for acb_mask 0x%x will use suffix %s\n",
1229 acb_mask, suffix));
1230
1231 attr_list = get_userattr_list(ldap_state->schema_ver);
1232 rc = smbldap_search(ldap_state->smbldap_state, suffix, LDAP_SCOPE_SUBTREE, filter,
1233 attr_list, 0, &ldap_state->result);
1234 free_attr_list( attr_list );
1235
1236 if (rc != LDAP_SUCCESS) {
1237 DEBUG(0, ("ldapsam_setsampwent: LDAP search failed: %s\n", ldap_err2string(rc)));
1238 DEBUG(3, ("ldapsam_setsampwent: Query was: %s, %s\n", suffix, filter));
1239 ldap_msgfree(ldap_state->result);
1240 ldap_state->result = NULL;
1241 return NT_STATUS_UNSUCCESSFUL;
1242 }
1243
1244 DEBUG(2, ("ldapsam_setsampwent: %d entries in the base %s\n",
1245 ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
1246 ldap_state->result), suffix));
1247
1248 ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
1249 ldap_state->result);
1250 ldap_state->index = 0;
1251
1252 return NT_STATUS_OK;
1253 }
1254
1255 /**********************************************************************
1256 End enumeration of the LDAP password list.
1257 *********************************************************************/
1258
1259 static void ldapsam_endsampwent(struct pdb_methods *my_methods)
1260 {
1261 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1262 if (ldap_state->result) {
1263 ldap_msgfree(ldap_state->result);
1264 ldap_state->result = NULL;
1265 }
1266 }
1267
1268 /**********************************************************************
1269 Get the next entry in the LDAP password database.
1270 *********************************************************************/
1271
1272 static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT *user)
1273 {
1274 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1275 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1276 BOOL bret = False;
1277
1278 while (!bret) {
1279 if (!ldap_state->entry)
1280 return ret;
1281
1282 ldap_state->index++;
1283 bret = init_sam_from_ldap(ldap_state, user, ldap_state->entry);
1284
1285 ldap_state->entry = ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
1286 ldap_state->entry);
1287 }
1288
1289 return NT_STATUS_OK;
1290 }
1291
1292 static void append_attr(const char ***attr_list, const char *new_attr)
1293 {
1294 int i;
1295
1296 if (new_attr == NULL) {
1297 return;
1298 }
1299
1300 for (i=0; (*attr_list)[i] != NULL; i++) {
1301 ;
1302 }
1303
1304 (*attr_list) = SMB_REALLOC_ARRAY((*attr_list), const char *, i+2);
1305 SMB_ASSERT((*attr_list) != NULL);
1306 (*attr_list)[i] = SMB_STRDUP(new_attr);
1307 (*attr_list)[i+1] = NULL;
1308 }
1309
1310 /**********************************************************************
1311 Get SAM_ACCOUNT entry from LDAP by username.
1312 *********************************************************************/
1313
1314 static NTSTATUS ldapsam_getsampwnam(struct pdb_methods *my_methods, SAM_ACCOUNT *user, const char *sname)
1315 {
1316 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1317 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1318 LDAPMessage *result = NULL;
1319 LDAPMessage *entry = NULL;
1320 int count;
1321 const char ** attr_list;
1322 int rc;
1323
1324 attr_list = get_userattr_list( ldap_state->schema_ver );
1325 append_attr(&attr_list, get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP));
1326 rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result, attr_list);
1327 free_attr_list( attr_list );
1328
1329 if ( rc != LDAP_SUCCESS )
1330 return NT_STATUS_NO_SUCH_USER;
1331
1332 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1333
1334 if (count < 1) {
1335 DEBUG(4, ("ldapsam_getsampwnam: Unable to locate user [%s] count=%d\n", sname, count));
1336 ldap_msgfree(result);
1337 return NT_STATUS_NO_SUCH_USER;
1338 } else if (count > 1) {
1339 DEBUG(1, ("ldapsam_getsampwnam: Duplicate entries for this user [%s] Failing. count=%d\n", sname, count));
1340 ldap_msgfree(result);
1341 return NT_STATUS_NO_SUCH_USER;
1342 }
1343
1344 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1345 if (entry) {
1346 if (!init_sam_from_ldap(ldap_state, user, entry)) {
1347 DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname));
1348 ldap_msgfree(result);
1349 return NT_STATUS_NO_SUCH_USER;
1350 }
1351 pdb_set_backend_private_data(user, result,
1352 private_data_free_fn,
1353 my_methods, PDB_CHANGED);
1354 ret = NT_STATUS_OK;
1355 } else {
1356 ldap_msgfree(result);
1357 }
1358 return ret;
1359 }
1360
1361 static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state,
1362 const DOM_SID *sid, LDAPMessage **result)
1363 {
1364 int rc = -1;
1365 const char ** attr_list;
1366 uint32 rid;
1367
1368 switch ( ldap_state->schema_ver ) {
1369 case SCHEMAVER_SAMBASAMACCOUNT:
1370 attr_list = get_userattr_list(ldap_state->schema_ver);
1371 append_attr(&attr_list, get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP));
1372 rc = ldapsam_search_suffix_by_sid(ldap_state, sid, result, attr_list);
1373 free_attr_list( attr_list );
1374
1375 if ( rc != LDAP_SUCCESS )
1376 return rc;
1377 break;
1378
1379 case SCHEMAVER_SAMBAACCOUNT:
1380 if (!sid_peek_check_rid(&ldap_state->domain_sid, sid, &rid)) {
1381 return rc;
1382 }
1383
1384 attr_list = get_userattr_list(ldap_state->schema_ver);
1385 rc = ldapsam_search_suffix_by_rid(ldap_state, rid, result, attr_list );
1386 free_attr_list( attr_list );
1387
1388 if ( rc != LDAP_SUCCESS )
1389 return rc;
1390 break;
1391 }
1392 return rc;
1393 }
1394
1395 /**********************************************************************
1396 Get SAM_ACCOUNT entry from LDAP by SID.
1397 *********************************************************************/
1398
1399 static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT * user, const DOM_SID *sid)
1400 {
1401 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1402 LDAPMessage *result = NULL;
1403 LDAPMessage *entry = NULL;
1404 int count;
1405 int rc;
1406 fstring sid_string;
1407
1408 rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1409 sid, &result);
1410 if (rc != LDAP_SUCCESS)
1411 return NT_STATUS_NO_SUCH_USER;
1412
1413 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1414
1415 if (count < 1) {
1416 DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string, sid),
1417 count));
1418 ldap_msgfree(result);
1419 return NT_STATUS_NO_SUCH_USER;
1420 } else if (count > 1) {
1421 DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string, sid),
1422 count));
1423 ldap_msgfree(result);
1424 return NT_STATUS_NO_SUCH_USER;
1425 }
1426
1427 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1428 if (!entry) {
1429 ldap_msgfree(result);
1430 return NT_STATUS_NO_SUCH_USER;
1431 }
1432
1433 if (!init_sam_from_ldap(ldap_state, user, entry)) {
1434 DEBUG(1,("ldapsam_getsampwsid: init_sam_from_ldap failed!\n"));
1435 ldap_msgfree(result);
1436 return NT_STATUS_NO_SUCH_USER;
1437 }
1438
1439 pdb_set_backend_private_data(user, result,
1440 private_data_free_fn,
1441 my_methods, PDB_CHANGED);
1442 return NT_STATUS_OK;
1443 }
1444
1445 static BOOL ldapsam_can_pwchange_exop(struct smbldap_state *ldap_state)
1446 {
1447 return smbldap_has_extension(ldap_state, LDAP_EXOP_MODIFY_PASSWD);
1448 }
1449
1450 /********************************************************************
1451 Do the actual modification - also change a plaintext passord if
1452 it it set.
1453 **********************************************************************/
1454
1455 static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods,
1456 SAM_ACCOUNT *newpwd, char *dn,
1457 LDAPMod **mods, int ldap_op,
1458 BOOL (*need_update)(const SAM_ACCOUNT *, enum pdb_elements))
1459 {
1460 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1461 int rc;
1462
1463 if (!my_methods || !newpwd || !dn) {
1464 return NT_STATUS_INVALID_PARAMETER;
1465 }
1466
1467 if (!mods) {
1468 DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
1469 /* may be password change below however */
1470 } else {
1471 switch(ldap_op) {
1472 case LDAP_MOD_ADD:
1473 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1474 "objectclass",
1475 LDAP_OBJ_ACCOUNT);
1476 rc = smbldap_add(ldap_state->smbldap_state,
1477 dn, mods);
1478 break;
1479 case LDAP_MOD_REPLACE:
1480 rc = smbldap_modify(ldap_state->smbldap_state,
1481 dn ,mods);
1482 break;
1483 default:
1484 DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n",
1485 ldap_op));
1486 return NT_STATUS_INVALID_PARAMETER;
1487 }
1488
1489 if (rc!=LDAP_SUCCESS) {
1490 char *ld_error = NULL;
1491 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1492 &ld_error);
1493 DEBUG(1, ("ldapsam_modify_entry: Failed to %s user dn= %s with: %s\n\t%s\n",
1494 ldap_op == LDAP_MOD_ADD ? "add" : "modify",
1495 dn, ldap_err2string(rc),
1496 ld_error?ld_error:"unknown"));
1497 SAFE_FREE(ld_error);
1498 return NT_STATUS_UNSUCCESSFUL;
1499 }
1500 }
1501
1502 if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) &&
1503 (lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) &&
1504 need_update(newpwd, PDB_PLAINTEXT_PW) &&
1505 (pdb_get_plaintext_passwd(newpwd)!=NULL)) {
1506 BerElement *ber;
1507 struct berval *bv;
1508 char *retoid = NULL;
1509 struct berval *retdata = NULL;
1510 char *utf8_password;
1511 char *utf8_dn;
1512
1513 if (!ldap_state->is_nds_ldap) {
1514 if (!ldapsam_can_pwchange_exop(ldap_state->smbldap_state)) {
1515 DEBUG(2, ("ldap password change requested, but LDAP "
1516 "server does not support it -- ignoring\n"));
1517 return NT_STATUS_OK;
1518 }
1519 }
1520
1521 if (push_utf8_allocate(&utf8_password, pdb_get_plaintext_passwd(newpwd)) == (size_t)-1) {
1522 return NT_STATUS_NO_MEMORY;
1523 }
1524
1525 if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) {
1526 return NT_STATUS_NO_MEMORY;
1527 }
1528
1529 if ((ber = ber_alloc_t(LBER_USE_DER))==NULL) {
1530 DEBUG(0,("ber_alloc_t returns NULL\n"));
1531 SAFE_FREE(utf8_password);
1532 return NT_STATUS_UNSUCCESSFUL;
1533 }
1534
1535 ber_printf (ber, "{");
1536 ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, utf8_dn);
1537 ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, utf8_password);
1538 ber_printf (ber, "N}");
1539
1540 if ((rc = ber_flatten (ber, &bv))<0) {
1541 DEBUG(0,("ldapsam_modify_entry: ber_flatten returns a value <0\n"));
1542 ber_free(ber,1);
1543 SAFE_FREE(utf8_dn);
1544 SAFE_FREE(utf8_password);
1545 return NT_STATUS_UNSUCCESSFUL;
1546 }
1547
1548 SAFE_FREE(utf8_dn);
1549 SAFE_FREE(utf8_password);
1550 ber_free(ber, 1);
1551
1552 if (!ldap_state->is_nds_ldap) {
1553 rc = smbldap_extended_operation(ldap_state->smbldap_state,
1554 LDAP_EXOP_MODIFY_PASSWD,
1555 bv, NULL, NULL, &retoid,
1556 &retdata);
1557 } else {
1558 rc = pdb_nds_set_password(ldap_state->smbldap_state, dn,
1559 pdb_get_plaintext_passwd(newpwd));
1560 }
1561 if (rc != LDAP_SUCCESS) {
1562 char *ld_error = NULL;
1563
1564 if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
1565 DEBUG(3, ("Could not set userPassword "
1566 "attribute due to an objectClass "
1567 "violation -- ignoring\n"));
1568 ber_bvfree(bv);
1569 return NT_STATUS_OK;
1570 }
1571
1572 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1573 &ld_error);
1574 DEBUG(0,("ldapsam_modify_entry: LDAP Password could not be changed for user %s: %s\n\t%s\n",
1575 pdb_get_username(newpwd), ldap_err2string(rc), ld_error?ld_error:"unknown"));
1576 SAFE_FREE(ld_error);
1577 ber_bvfree(bv);
1578 return NT_STATUS_UNSUCCESSFUL;
1579 } else {
1580 DEBUG(3,("ldapsam_modify_entry: LDAP Password changed for user %s\n",pdb_get_username(newpwd)));
1581 #ifdef DEBUG_PASSWORD
1582 DEBUG(100,("ldapsam_modify_entry: LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd)));
1583 #endif
1584 if (retdata)
1585 ber_bvfree(retdata);
1586 if (retoid)
1587 ber_memfree(retoid);
1588 }
1589 ber_bvfree(bv);
1590 }
1591 return NT_STATUS_OK;
1592 }
1593
1594 /**********************************************************************
1595 Delete entry from LDAP for username.
1596 *********************************************************************/
1597
1598 static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * sam_acct)
1599 {
1600 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1601 const char *sname;
1602 int rc;
1603 LDAPMessage *result = NULL;
1604 NTSTATUS ret;
1605 const char **attr_list;
1606 fstring objclass;
1607
1608 if (!sam_acct) {
1609 DEBUG(0, ("ldapsam_delete_sam_account: sam_acct was NULL!\n"));
1610 return NT_STATUS_INVALID_PARAMETER;
1611 }
1612
1613 sname = pdb_get_username(sam_acct);
1614
1615 DEBUG (3, ("ldapsam_delete_sam_account: Deleting user %s from LDAP.\n", sname));
1616
1617 attr_list= get_userattr_delete_list( ldap_state->schema_ver );
1618 rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result, attr_list);
1619
1620 if (rc != LDAP_SUCCESS) {
1621 free_attr_list( attr_list );
1622 return NT_STATUS_NO_SUCH_USER;
1623 }
1624
1625 switch ( ldap_state->schema_ver ) {
1626 case SCHEMAVER_SAMBASAMACCOUNT:
1627 fstrcpy( objclass, LDAP_OBJ_SAMBASAMACCOUNT );
1628 break;
1629
1630 case SCHEMAVER_SAMBAACCOUNT:
1631 fstrcpy( objclass, LDAP_OBJ_SAMBAACCOUNT );
1632 break;
1633 default:
1634 fstrcpy( objclass, "UNKNOWN" );
1635 DEBUG(0,("ldapsam_delete_sam_account: Unknown schema version specified!\n"));
1636 break;
1637 }
1638
1639 ret = ldapsam_delete_entry(ldap_state, result, objclass, attr_list );
1640 ldap_msgfree(result);
1641 free_attr_list( attr_list );
1642
1643 return ret;
1644 }
1645
1646 /**********************************************************************
1647 Helper function to determine for update_sam_account whether
1648 we need LDAP modification.
1649 *********************************************************************/
1650
1651 static BOOL element_is_changed(const SAM_ACCOUNT *sampass,
1652 enum pdb_elements element)
1653 {
1654 return IS_SAM_CHANGED(sampass, element);
1655 }
1656
1657 /**********************************************************************
1658 Update SAM_ACCOUNT.
1659 *********************************************************************/
1660
1661 static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd)
1662 {
1663 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1664 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1665 int rc = 0;
1666 char *dn;
1667 LDAPMessage *result = NULL;
1668 LDAPMessage *entry = NULL;
1669 LDAPMod **mods = NULL;
1670 const char **attr_list;
1671
1672 result = pdb_get_backend_private_data(newpwd, my_methods);
1673 if (!result) {
1674 attr_list = get_userattr_list(ldap_state->schema_ver);
1675 rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list );
1676 free_attr_list( attr_list );
1677 if (rc != LDAP_SUCCESS) {
1678 return NT_STATUS_UNSUCCESSFUL;
1679 }
1680 pdb_set_backend_private_data(newpwd, result, private_data_free_fn, my_methods, PDB_CHANGED);
1681 }
1682
1683 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
1684 DEBUG(0, ("ldapsam_update_sam_account: No user to modify!\n"));
1685 return NT_STATUS_UNSUCCESSFUL;
1686 }
1687
1688 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1689 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
1690 if (!dn) {
1691 return NT_STATUS_UNSUCCESSFUL;
1692 }
1693
1694 DEBUG(4, ("ldapsam_update_sam_account: user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn));
1695
1696 if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
1697 element_is_changed)) {
1698 DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
1699 SAFE_FREE(dn);
1700 if (mods != NULL)
1701 ldap_mods_free(mods,True);
1702 return NT_STATUS_UNSUCCESSFUL;
1703 }
1704
1705 if (mods == NULL) {
1706 DEBUG(4,("ldapsam_update_sam_account: mods is empty: nothing to update for user: %s\n",
1707 pdb_get_username(newpwd)));
1708 SAFE_FREE(dn);
1709 return NT_STATUS_OK;
1710 }
1711
1712 ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed);
1713 ldap_mods_free(mods,True);
1714 SAFE_FREE(dn);
1715
1716 if (!NT_STATUS_IS_OK(ret)) {
1717 char *ld_error = NULL;
1718 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1719 &ld_error);
1720 DEBUG(0,("ldapsam_update_sam_account: failed to modify user with uid = %s, error: %s (%s)\n",
1721 pdb_get_username(newpwd), ld_error?ld_error:"(unknwon)", ldap_err2string(rc)));
1722 SAFE_FREE(ld_error);
1723 return ret;
1724 }
1725
1726 DEBUG(2, ("ldapsam_update_sam_account: successfully modified uid = %s in the LDAP database\n",
1727 pdb_get_username(newpwd)));
1728 return NT_STATUS_OK;
1729 }
1730
1731 /**********************************************************************
1732 Helper function to determine for update_sam_account whether
1733 we need LDAP modification.
1734 *********************************************************************/
1735
1736 static BOOL element_is_set_or_changed(const SAM_ACCOUNT *sampass,
1737 enum pdb_elements element)
1738 {
1739 return (IS_SAM_SET(sampass, element) ||
1740 IS_SAM_CHANGED(sampass, element));
1741 }
1742
1743 /**********************************************************************
1744 Add SAM_ACCOUNT to LDAP.
1745 *********************************************************************/
1746
1747 static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd)
1748 {
1749 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1750 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1751 int rc;
1752 LDAPMessage *result = NULL;
1753 LDAPMessage *entry = NULL;
1754 pstring dn;
1755 LDAPMod **mods = NULL;
1756 int ldap_op = LDAP_MOD_REPLACE;
1757 uint32 num_result;
1758 const char **attr_list;
1759 char *escape_user;
1760 const char *username = pdb_get_username(newpwd);
1761 const DOM_SID *sid = pdb_get_user_sid(newpwd);
1762 pstring filter;
1763 fstring sid_string;
1764
1765 if (!username || !*username) {
1766 DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
1767 return NT_STATUS_INVALID_PARAMETER;
1768 }
1769
1770 /* free this list after the second search or in case we exit on failure */
1771 attr_list = get_userattr_list(ldap_state->schema_ver);
1772
1773 rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
1774
1775 if (rc != LDAP_SUCCESS) {
1776 free_attr_list( attr_list );
1777 return NT_STATUS_UNSUCCESSFUL;
1778 }
1779
1780 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
1781 DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
1782 username));
1783 ldap_msgfree(result);
1784 free_attr_list( attr_list );
1785 return NT_STATUS_UNSUCCESSFUL;
1786 }
1787 ldap_msgfree(result);
1788 result = NULL;
1789
1790 if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
1791 rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1792 sid, &result);
1793 if (rc == LDAP_SUCCESS) {
1794 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
1795 DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n",
1796 sid_to_string(sid_string, sid)));
1797 free_attr_list( attr_list );
1798 ldap_msgfree(result);
1799 return NT_STATUS_UNSUCCESSFUL;
1800 }
1801 ldap_msgfree(result);
1802 }
1803 }
1804
1805 /* does the entry already exist but without a samba attributes?
1806 we need to return the samba attributes here */
1807
1808 escape_user = escape_ldap_string_alloc( username );
1809 pstrcpy( filter, lp_ldap_filter() );
1810 all_string_sub( filter, "%u", escape_user, sizeof(filter) );
1811 SAFE_FREE( escape_user );
1812
1813 rc = smbldap_search_suffix(ldap_state->smbldap_state,
1814 filter, attr_list, &result);
1815 if ( rc != LDAP_SUCCESS ) {
1816 free_attr_list( attr_list );
1817 return NT_STATUS_UNSUCCESSFUL;
1818 }
1819
1820 num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1821
1822 if (num_result > 1) {
1823 DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
1824 free_attr_list( attr_list );
1825 ldap_msgfree(result);
1826 return NT_STATUS_UNSUCCESSFUL;
1827 }
1828
1829 /* Check if we need to update an existing entry */
1830 if (num_result == 1) {
1831 char *tmp;
1832
1833 DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
1834 ldap_op = LDAP_MOD_REPLACE;
1835 entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
1836 tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
1837 if (!tmp) {
1838 free_attr_list( attr_list );
1839 ldap_msgfree(result);
1840 return NT_STATUS_UNSUCCESSFUL;
1841 }
1842 slprintf (dn, sizeof (dn) - 1, "%s", tmp);
1843 SAFE_FREE(tmp);
1844
1845 } else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
1846
1847 /* There might be a SID for this account already - say an idmap entry */
1848
1849 pstr_sprintf(filter, "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))",
1850 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
1851 sid_to_string(sid_string, sid),
1852 LDAP_OBJ_IDMAP_ENTRY,
1853 LDAP_OBJ_SID_ENTRY);
1854
1855 /* free old result before doing a new search */
1856 if (result != NULL) {
1857 ldap_msgfree(result);
1858 result = NULL;
1859 }
1860 rc = smbldap_search_suffix(ldap_state->smbldap_state,
1861 filter, attr_list, &result);
1862
1863 if ( rc != LDAP_SUCCESS ) {
1864 free_attr_list( attr_list );
1865 return NT_STATUS_UNSUCCESSFUL;
1866 }
1867
1868 num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1869
1870 if (num_result > 1) {
1871 DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
1872 free_attr_list( attr_list );
1873 ldap_msgfree(result);
1874 return NT_STATUS_UNSUCCESSFUL;
1875 }
1876
1877 /* Check if we need to update an existing entry */
1878 if (num_result == 1) {
1879 char *tmp;
1880
1881 DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
1882 ldap_op = LDAP_MOD_REPLACE;
1883 entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
1884 tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
1885 if (!tmp) {
1886 free_attr_list( attr_list );
1887 ldap_msgfree(result);
1888 return NT_STATUS_UNSUCCESSFUL;
1889 }
1890 slprintf (dn, sizeof (dn) - 1, "%s", tmp);
1891 SAFE_FREE(tmp);
1892 }
1893 }
1894
1895 free_attr_list( attr_list );
1896
1897 if (num_result == 0) {
1898 /* Check if we need to add an entry */
1899 DEBUG(3,("ldapsam_add_sam_account: Adding new user\n"));
1900 ldap_op = LDAP_MOD_ADD;
1901 if (username[strlen(username)-1] == '$') {
1902 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_machine_suffix ());
1903 } else {
1904 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_user_suffix ());
1905 }
1906 }
1907
1908 if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
1909 element_is_set_or_changed)) {
1910 DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
1911 ldap_msgfree(result);
1912 if (mods != NULL)
1913 ldap_mods_free(mods,True);
1914 return NT_STATUS_UNSUCCESSFUL;
1915 }
1916
1917 ldap_msgfree(result);
1918
1919 if (mods == NULL) {
1920 DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
1921 return NT_STATUS_UNSUCCESSFUL;
1922 }
1923 switch ( ldap_state->schema_ver ) {
1924 case SCHEMAVER_SAMBAACCOUNT:
1925 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT);
1926 break;
1927 case SCHEMAVER_SAMBASAMACCOUNT:
1928 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT);
1929 break;
1930 default:
1931 DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n"));
1932 break;
1933 }
1934
1935 ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed);
1936 if (!NT_STATUS_IS_OK(ret)) {
1937 DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
1938 pdb_get_username(newpwd),dn));
1939 ldap_mods_free(mods, True);
1940 return ret;
1941 }
1942
1943 DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
1944 ldap_mods_free(mods, True);
1945
1946 return NT_STATUS_OK;
1947 }
1948
1949 /**********************************************************************
1950 *********************************************************************/
1951
1952 static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
1953 const char *filter,
1954 LDAPMessage ** result)
1955 {
1956 int scope = LDAP_SCOPE_SUBTREE;
1957 int rc;
1958 const char **attr_list;
1959
1960 attr_list = get_attr_list(groupmap_attr_list);
1961 rc = smbldap_search(ldap_state->smbldap_state,
1962 lp_ldap_group_suffix (), scope,
1963 filter, attr_list, 0, result);
1964 free_attr_list( attr_list );
1965
1966 if (rc != LDAP_SUCCESS) {
1967 char *ld_error = NULL;
1968 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1969 &ld_error);
1970 DEBUG(0, ("ldapsam_search_one_group: "
1971 "Problem during the LDAP search: LDAP error: %s (%s)\n",
1972 ld_error?ld_error:"(unknown)", ldap_err2string(rc)));
1973 DEBUGADD(3, ("ldapsam_search_one_group: Query was: %s, %s\n",
1974 lp_ldap_group_suffix(), filter));
1975 SAFE_FREE(ld_error);
1976 }
1977
1978 return rc;
1979 }
1980
1981 /**********************************************************************
1982 *********************************************************************/
1983
1984 static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state,
1985 GROUP_MAP *map, LDAPMessage *entry)
1986 {
1987 pstring temp;
1988
1989 if (ldap_state == NULL || map == NULL || entry == NULL ||
1990 ldap_state->smbldap_state->ldap_struct == NULL) {
1991 DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
1992 return False;
1993 }
1994
1995 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
1996 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp)) {
1997 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
1998 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
1999 return False;
2000 }
2001 DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
2002
2003 map->gid = (gid_t)atol(temp);
2004
2005 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2006 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp)) {
2007 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2008 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
2009 return False;
2010 }
2011
2012 if (!string_to_sid(&map->sid, temp)) {
2013 DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
2014 return False;
2015 }
2016
2017 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2018 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) {
2019 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2020 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
2021 return False;
2022 }
2023 map->sid_name_use = (enum SID_NAME_USE)atol(temp);
2024
2025 if ((map->sid_name_use < SID_NAME_USER) ||
2026 (map->sid_name_use > SID_NAME_UNKNOWN)) {
2027 DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
2028 return False;
2029 }
2030
2031 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2032 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp)) {
2033 temp[0] = '\0';
2034 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2035 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp))
2036 {
2037 DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
2038 for gidNumber(%lu)\n",(unsigned long)map->gid));
2039 return False;
2040 }
2041 }
2042 fstrcpy(map->nt_name, temp);
2043
2044 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2045 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp)) {
2046 temp[0] = '\0';
2047 }
2048 fstrcpy(map->comment, temp);
2049
2050 return True;
2051 }
2052
2053 /**********************************************************************
2054 *********************************************************************/
2055
2056 static BOOL init_ldap_from_group(LDAP *ldap_struct,
2057 LDAPMessage *existing,
2058 LDAPMod ***mods,
2059 const GROUP_MAP *map)
2060 {
2061 pstring tmp;
2062
2063 if (mods == NULL || map == NULL) {
2064 DEBUG(0, ("init_ldap_from_group: NULL parameters found!\n"));
2065 return False;
2066 }
2067
2068 *mods = NULL;
2069
2070 sid_to_string(tmp, &map->sid);
2071
2072 smbldap_make_mod(ldap_struct, existing, mods,
2073 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID), tmp);
2074 pstr_sprintf(tmp, "%i", map->sid_name_use);
2075 smbldap_make_mod(ldap_struct, existing, mods,
2076 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), tmp);
2077
2078 smbldap_make_mod(ldap_struct, existing, mods,
2079 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), map->nt_name);
2080 smbldap_make_mod(ldap_struct, existing, mods,
2081 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), map->comment);
2082
2083 return True;
2084 }
2085
2086 /**********************************************************************
2087 *********************************************************************/
2088
2089 static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods,
2090 const char *filter,
2091 GROUP_MAP *map)
2092 {
2093 struct ldapsam_privates *ldap_state =
2094 (struct ldapsam_privates *)methods->private_data;
2095 LDAPMessage *result = NULL;
2096 LDAPMessage *entry = NULL;
2097 int count;
2098
2099 if (ldapsam_search_one_group(ldap_state, filter, &result)
2100 != LDAP_SUCCESS) {
2101 return NT_STATUS_NO_SUCH_GROUP;
2102 }
2103
2104 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2105
2106 if (count < 1) {
2107 DEBUG(4, ("ldapsam_getgroup: Did not find group\n"));
2108 ldap_msgfree(result);
2109 return NT_STATUS_NO_SUCH_GROUP;
2110 }
2111
2112 if (count > 1) {
2113 DEBUG(1, ("ldapsam_getgroup: Duplicate entries for filter %s: count=%d\n",
2114 filter, count));
2115 ldap_msgfree(result);
2116 return NT_STATUS_NO_SUCH_GROUP;
2117 }
2118
2119 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
2120
2121 if (!entry) {
2122 ldap_msgfree(result);
2123 return NT_STATUS_UNSUCCESSFUL;
2124 }
2125
2126 if (!init_group_from_ldap(ldap_state, map, entry)) {
2127 DEBUG(1, ("ldapsam_getgroup: init_group_from_ldap failed for group filter %s\n",
2128 filter));
2129 ldap_msgfree(result);
2130 return NT_STATUS_NO_SUCH_GROUP;
2131 }
2132
2133 ldap_msgfree(result);
2134 return NT_STATUS_OK;
2135 }
2136
2137 /**********************************************************************
2138 *********************************************************************/
2139
2140 static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
2141 DOM_SID sid)
2142 {
2143 pstring filter;
2144
2145 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
2146 LDAP_OBJ_GROUPMAP,
2147 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
2148 sid_string_static(&sid));
2149
2150 return ldapsam_getgroup(methods, filter, map);
2151 }
2152
2153 /**********************************************************************
2154 *********************************************************************/
2155
2156 static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
2157 gid_t gid)
2158 {
2159 pstring filter;
2160
2161 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%d))",
2162 LDAP_OBJ_GROUPMAP,
2163 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2164 gid);
2165
2166 return ldapsam_getgroup(methods, filter, map);
2167 }
2168
2169 /**********************************************************************
2170 *********************************************************************/
2171
2172 static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
2173 const char *name)
2174 {
2175 pstring filter;
2176 char *escape_name = escape_ldap_string_alloc(name);
2177
2178 if (!escape_name) {
2179 return NT_STATUS_NO_MEMORY;
2180 }
2181
2182 pstr_sprintf(filter, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
2183 LDAP_OBJ_GROUPMAP,
2184 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
2185 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), escape_name);
2186
2187 SAFE_FREE(escape_name);
2188
2189 return ldapsam_getgroup(methods, filter, map);
2190 }
2191
2192 static void add_rid_to_array_unique(TALLOC_CTX *mem_ctx,
2193 uint32 rid, uint32 **rids, int *num)
2194 {
2195 int i;
2196
2197 for (i=0; i<*num; i++) {
2198 if ((*rids)[i] == rid)
2199 return;
2200 }
2201
2202 *rids = TALLOC_REALLOC_ARRAY(mem_ctx, *rids, uint32, *num+1);
2203
2204 if (*rids == NULL)
2205 return;
2206
2207 (*rids)[*num] = rid;
2208 *num += 1;
2209 }
2210
2211 static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
2212 TALLOC_CTX *mem_ctx,
2213 const DOM_SID *group,
2214 uint32 **member_rids,
2215 int *num_members)
2216 {
2217 struct ldapsam_privates *ldap_state =
2218 (struct ldapsam_privates *)methods->private_data;
2219 struct smbldap_state *conn = ldap_state->smbldap_state;
2220 pstring filter;
2221 int rc, count;
2222 LDAPMessage *msg = NULL;
2223 LDAPMessage *entry;
2224 char **values = NULL;
2225 char **memberuid;
2226 char *sid_filter = NULL;
2227 char *tmp;
2228 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2229
2230 if (!lp_parm_bool(-1, "ldapsam", "trusted", False))
2231 return pdb_default_enum_group_members(methods, mem_ctx, group,
2232 member_rids,
2233 num_members);
2234
2235 *member_rids = NULL;
2236 *num_members = 0;
2237
2238 pstr_sprintf(filter,
2239 "(&(objectClass=sambaSamAccount)"
2240 "(sambaPrimaryGroupSid=%s))",
2241 sid_string_static(group));
2242
2243 {
2244 const char *attrs[] = { "sambaSID", NULL };
2245 rc = smbldap_search(conn, lp_ldap_user_suffix(),
2246 LDAP_SCOPE_SUBTREE, filter, attrs, 0,
2247 &msg);
2248 }
2249
2250 if (rc != LDAP_SUCCESS)
2251 goto done;
2252
2253 for (entry = ldap_first_entry(conn->ldap_struct, msg);
2254 entry != NULL;
2255 entry = ldap_next_entry(conn->ldap_struct, entry))
2256 {
2257 fstring str;
2258 DOM_SID sid;
2259 uint32 rid;
2260
2261 if (!smbldap_get_single_attribute(conn->ldap_struct,
2262 entry, "sambaSID",
2263 str, sizeof(str)-1))
2264 continue;
2265
2266 if (!string_to_sid(&sid, str))
2267 goto done;
2268
2269 if (!sid_check_is_in_our_domain(&sid)) {
2270 DEBUG(1, ("Inconsistent SAM -- group member uid not "
2271 "in our domain\n"));
2272 continue;
2273 }
2274
2275 sid_peek_rid(&sid, &rid);
2276
2277 add_rid_to_array_unique(mem_ctx, rid, member_rids,
2278 num_members);
2279 }
2280
2281 if (msg != NULL)
2282 ldap_msgfree(msg);
2283
2284 pstr_sprintf(filter,
2285 "(&(objectClass=sambaGroupMapping)"
2286 "(objectClass=posixGroup)"
2287 "(sambaSID=%s))",
2288 sid_string_static(group));
2289
2290 {
2291 const char *attrs[] = { "memberUid", NULL };
2292 rc = smbldap_search(conn, lp_ldap_group_suffix(),
2293 LDAP_SCOPE_SUBTREE, filter, attrs, 0,
2294 &msg);
2295 }
2296
2297 if (rc != LDAP_SUCCESS)
2298 goto done;
2299
2300 count = ldap_count_entries(conn->ldap_struct, msg);
2301
2302 if (count > 1) {
2303 DEBUG(1, ("Found more than one groupmap entry for %s\n",
2304 sid_string_static(group)));
2305 goto done;
2306 }
2307
2308 if (count == 0) {
2309 result = NT_STATUS_OK;
2310 goto done;
2311 }
2312
2313 entry = ldap_first_entry(conn->ldap_struct, msg);
2314 if (entry == NULL)
2315 goto done;
2316
2317 values = ldap_get_values(conn->ldap_struct, msg, "memberUid");
2318 if (values == NULL) {
2319 result = NT_STATUS_OK;
2320 goto done;
2321 }
2322
2323 sid_filter = strdup("(&(objectClass=sambaSamAccount)(|");
2324 if (sid_filter == NULL) {
2325 result = NT_STATUS_NO_MEMORY;
2326 goto done;
2327 }
2328
2329 for (memberuid = values; *memberuid != NULL; memberuid += 1) {
2330 tmp = sid_filter;
2331 asprintf(&sid_filter, "%s(uid=%s)", tmp, *memberuid);
2332 free(tmp);
2333 if (sid_filter == NULL) {
2334 result = NT_STATUS_NO_MEMORY;
2335 goto done;
2336 }
2337 }
2338
2339 tmp = sid_filter;
2340 asprintf(&sid_filter, "%s))", sid_filter);
2341 free(tmp);
2342 if (sid_filter == NULL) {
2343 result = NT_STATUS_NO_MEMORY;
2344 goto done;
2345 }
2346
2347 {
2348 const char *attrs[] = { "sambaSID", NULL };
2349 rc = smbldap_search(conn, lp_ldap_user_suffix(),
2350 LDAP_SCOPE_SUBTREE, sid_filter, attrs, 0,
2351 &msg);
2352 }
2353
2354 if (rc != LDAP_SUCCESS)
2355 goto done;
2356
2357 for (entry = ldap_first_entry(conn->ldap_struct, msg);
2358 entry != NULL;
2359 entry = ldap_next_entry(conn->ldap_struct, entry))
2360 {
2361 fstring str;
2362 DOM_SID sid;
2363 uint32 rid;
2364
2365 if (!smbldap_get_single_attribute(conn->ldap_struct,
2366 entry, "sambaSID",
2367 str, sizeof(str)-1))
2368 continue;
2369
2370 if (!string_to_sid(&sid, str))
2371 goto done;
2372
2373 if (!sid_check_is_in_our_domain(&sid)) {
2374 DEBUG(1, ("Inconsistent SAM -- group member uid not "
2375 "in our domain\n"));
2376 continue;
2377 }
2378
2379 sid_peek_rid(&sid, &rid);
2380
2381 add_rid_to_array_unique(mem_ctx, rid, member_rids,
2382 num_members);
2383 }
2384
2385 result = NT_STATUS_OK;
2386
2387 done:
2388 SAFE_FREE(sid_filter);
2389
2390 if (values != NULL)
2391 ldap_value_free(values);
2392
2393 if (msg != NULL)
2394 ldap_msgfree(msg);
2395
2396 return result;
2397 }
2398
2399 static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
2400 const char *username,
2401 gid_t primary_gid,
2402 DOM_SID **sids, gid_t **gids,
2403 int *num_groups)
2404 {
2405 struct ldapsam_privates *ldap_state =
2406 (struct ldapsam_privates *)methods->private_data;
2407 struct smbldap_state *conn = ldap_state->smbldap_state;
2408 pstring filter;
2409 const char *attrs[] = { "gidNumber", "sambaSID", NULL };
2410 char *escape_name;
2411 int rc;
2412 LDAPMessage *msg = NULL;
2413 LDAPMessage *entry;
2414 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2415 int num_sids, num_gids;
2416 extern DOM_SID global_sid_NULL;
2417
2418 if (!lp_parm_bool(-1, "ldapsam", "trusted", False))
2419 return pdb_default_enum_group_memberships(methods, username,
2420 primary_gid, sids,
2421 gids, num_groups);
2422
2423 *sids = NULL;
2424 num_sids = 0;
2425
2426 escape_name = escape_ldap_string_alloc(username);
2427
2428 if (escape_name == NULL)
2429 return NT_STATUS_NO_MEMORY;
2430
2431 pstr_sprintf(filter, "(&(objectClass=posixGroup)"
2432 "(|(memberUid=%s)(gidNumber=%d)))",
2433 username, primary_gid);
2434
2435 rc = smbldap_search(conn, lp_ldap_group_suffix(),
2436 LDAP_SCOPE_SUBTREE, filter, attrs, 0, &msg);
2437
2438 if (rc != LDAP_SUCCESS)
2439 goto done;
2440
2441 num_gids = 0;
2442 *gids = NULL;
2443
2444 num_sids = 0;
2445 *sids = NULL;
2446
2447 /* We need to add the primary group as the first gid/sid */
2448
2449 add_gid_to_array_unique(primary_gid, gids, &num_gids);
2450
2451 /* This sid will be replaced later */
2452
2453 add_sid_to_array_unique(&global_sid_NULL, sids, &num_sids);
2454
2455 for (entry = ldap_first_entry(conn->ldap_struct, msg);
2456 entry != NULL;
2457 entry = ldap_next_entry(conn->ldap_struct, entry))
2458 {
2459 fstring str;
2460 DOM_SID sid;
2461 gid_t gid;
2462 char *end;
2463
2464 if (!smbldap_get_single_attribute(conn->ldap_struct,
2465 entry, "sambaSID",
2466 str, sizeof(str)-1))
2467 continue;
2468
2469 if (!string_to_sid(&sid, str))
2470 goto done;
2471
2472 if (!smbldap_get_single_attribute(conn->ldap_struct,
2473 entry, "gidNumber",
2474 str, sizeof(str)-1))
2475 continue;
2476
2477 gid = strtoul(str, &end, 10);
2478
2479 if (PTR_DIFF(end, str) != strlen(str))
2480 goto done;
2481
2482 if (gid == primary_gid) {
2483 sid_copy(&(*sids)[0], &sid);
2484 } else {
2485 add_gid_to_array_unique(gid, gids, &num_gids);
2486 add_sid_to_array_unique(&sid, sids, &num_sids);
2487 }
2488 }
2489
2490 if (sid_compare(&global_sid_NULL, &(*sids)[0]) == 0) {
2491 DEBUG(3, ("primary group of [%s] not found\n", username));
2492 goto done;
2493 }
2494
2495 *num_groups = num_sids;
2496
2497 result = NT_STATUS_OK;
2498
2499 done:
2500
2501 SAFE_FREE(escape_name);
2502 if (msg != NULL)
2503 ldap_msgfree(msg);
2504
2505 return result;
2506 }
2507
2508 /**********************************************************************
2509 *********************************************************************/
2510
2511 static int ldapsam_search_one_group_by_gid(struct ldapsam_privates *ldap_state,
2512 gid_t gid,
2513 LDAPMessage **result)
2514 {
2515 pstring filter;
2516
2517 pstr_sprintf(filter, "(&(|(objectClass=%s)(objectclass=%s))(%s=%d))",
2518 LDAP_OBJ_POSIXGROUP, LDAP_OBJ_IDMAP_ENTRY,
2519 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2520 gid);
2521
2522 return ldapsam_search_one_group(ldap_state, filter, result);
2523 }
2524
2525 /**********************************************************************
2526 *********************************************************************/
2527
2528 static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
2529 GROUP_MAP *map)
2530 {
2531 struct ldapsam_privates *ldap_state =
2532 (struct ldapsam_privates *)methods->private_data;
2533 LDAPMessage *result = NULL;
2534 LDAPMod **mods = NULL;
2535 int count;
2536
2537 char *tmp;
2538 pstring dn;
2539 LDAPMessage *entry;
2540
2541 GROUP_MAP dummy;
2542
2543 int rc;
2544
2545 if (NT_STATUS_IS_OK(ldapsam_getgrgid(methods, &dummy,
2546 map->gid))) {
2547 DEBUG(0, ("ldapsam_add_group_mapping_entry: Group %ld already exists in LDAP\n", (unsigned long)map->gid));
2548 return NT_STATUS_UNSUCCESSFUL;
2549 }
2550
2551 rc = ldapsam_search_one_group_by_gid(ldap_state, map->gid, &result);
2552 if (rc != LDAP_SUCCESS) {
2553 ldap_msgfree(result);
2554 return NT_STATUS_UNSUCCESSFUL;
2555 }
2556
2557 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2558
2559 if ( count == 0 ) {
2560 /* There's no posixGroup account, let's try to find an
2561 * appropriate idmap entry for aliases */
2562
2563 pstring suffix;
2564 pstring filter;
2565 const char **attr_list;
2566
2567 ldap_msgfree(result);
2568
2569 pstrcpy( suffix, lp_ldap_idmap_suffix() );
2570 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%d))",
2571 LDAP_OBJ_IDMAP_ENTRY, LDAP_ATTRIBUTE_GIDNUMBER,
2572 map->gid);
2573
2574 attr_list = get_attr_list( sidmap_attr_list );
2575 rc = smbldap_search(ldap_state->smbldap_state, suffix,
2576 LDAP_SCOPE_SUBTREE, filter, attr_list,
2577 0, &result);
2578
2579 free_attr_list(attr_list);
2580
2581 if (rc != LDAP_SUCCESS) {
2582 DEBUG(3,("Failure looking up entry (%s)\n",
2583 ldap_err2string(rc) ));
2584 ldap_msgfree(result);
2585 return NT_STATUS_UNSUCCESSFUL;
2586 }
2587 }
2588
2589 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2590 if ( count == 0 ) {
2591 ldap_msgfree(result);
2592 return NT_STATUS_UNSUCCESSFUL;
2593 }
2594
2595 if (count > 1) {
2596 DEBUG(2, ("ldapsam_add_group_mapping_entry: Group %lu must exist exactly once in LDAP\n",
2597 (unsigned long)map->gid));
2598 ldap_msgfree(result);
2599 return NT_STATUS_UNSUCCESSFUL;
2600 }
2601
2602 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
2603 tmp = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
2604 if (!tmp) {
2605 ldap_msgfree(result);
2606 return NT_STATUS_UNSUCCESSFUL;
2607 }
2608 pstrcpy(dn, tmp);
2609 SAFE_FREE(tmp);
2610
2611 if (!init_ldap_from_group(ldap_state->smbldap_state->ldap_struct,
2612 result, &mods, map)) {
2613 DEBUG(0, ("ldapsam_add_group_mapping_entry: init_ldap_from_group failed!\n"));
2614 ldap_mods_free(mods, True);
2615 ldap_msgfree(result);
2616 return NT_STATUS_UNSUCCESSFUL;
2617 }
2618
2619 ldap_msgfree(result);
2620
2621 if (mods == NULL) {
2622 DEBUG(0, ("ldapsam_add_group_mapping_entry: mods is empty\n"));
2623 return NT_STATUS_UNSUCCESSFUL;
2624 }
2625
2626 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP );
2627
2628 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2629 ldap_mods_free(mods, True);
2630
2631 if (rc != LDAP_SUCCESS) {
2632 char *ld_error = NULL;
2633 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
2634 &ld_error);
2635 DEBUG(0, ("ldapsam_add_group_mapping_entry: failed to add group %lu error: %s (%s)\n", (unsigned long)map->gid,
2636 ld_error ? ld_error : "(unknown)", ldap_err2string(rc)));
2637 SAFE_FREE(ld_error);
2638 return NT_STATUS_UNSUCCESSFUL;
2639 }
2640
2641 DEBUG(2, ("ldapsam_add_group_mapping_entry: successfully modified group %lu in LDAP\n", (unsigned long)map->gid));
2642 return NT_STATUS_OK;
2643 }
2644
2645 /**********************************************************************
2646 *********************************************************************/
2647
2648 static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods,
2649 GROUP_MAP *map)
2650 {
2651 struct ldapsam_privates *ldap_state =
2652 (struct ldapsam_privates *)methods->private_data;
2653 int rc;
2654 char *dn = NULL;
2655 LDAPMessage *result = NULL;
2656 LDAPMessage *entry = NULL;
2657 LDAPMod **mods = NULL;
2658
2659 rc = ldapsam_search_one_group_by_gid(ldap_state, map->gid, &result);
2660
2661 if (rc != LDAP_SUCCESS) {
2662 return NT_STATUS_UNSUCCESSFUL;
2663 }
2664
2665 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
2666 DEBUG(0, ("ldapsam_update_group_mapping_entry: No group to modify!\n"));
2667 ldap_msgfree(result);
2668 return NT_STATUS_UNSUCCESSFUL;
2669 }
2670
2671 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
2672
2673 if (!init_ldap_from_group(ldap_state->smbldap_state->ldap_struct,
2674 result, &mods, map)) {
2675 DEBUG(0, ("ldapsam_update_group_mapping_entry: init_ldap_from_group failed\n"));
2676 ldap_msgfree(result);
2677 if (mods != NULL)
2678 ldap_mods_free(mods,True);
2679 return NT_STATUS_UNSUCCESSFUL;
2680 }
2681
2682 if (mods == NULL) {
2683 DEBUG(4, ("ldapsam_update_group_mapping_entry: mods is empty: nothing to do\n"));
2684 ldap_msgfree(result);
2685 return NT_STATUS_OK;
2686 }
2687
2688 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
2689 if (!dn) {
2690 ldap_msgfree(result);
2691 return NT_STATUS_UNSUCCESSFUL;
2692 }
2693 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2694 SAFE_FREE(dn);
2695
2696 ldap_mods_free(mods, True);
2697 ldap_msgfree(result);
2698
2699 if (rc != LDAP_SUCCESS) {
2700 char *ld_error = NULL;
2701 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
2702 &ld_error);
2703 DEBUG(0, ("ldapsam_update_group_mapping_entry: failed to modify group %lu error: %s (%s)\n", (unsigned long)map->gid,
2704 ld_error ? ld_error : "(unknown)", ldap_err2string(rc)));
2705 SAFE_FREE(ld_error);
2706 return NT_STATUS_UNSUCCESSFUL;
2707 }
2708
2709 DEBUG(2, ("ldapsam_update_group_mapping_entry: successfully modified group %lu in LDAP\n", (unsigned long)map->gid));
2710 return NT_STATUS_OK;
2711 }
2712
2713 /**********************************************************************
2714 *********************************************************************/
2715
2716 static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods,
2717 DOM_SID sid)
2718 {
2719 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)methods->private_data;
2720 pstring sidstring, filter;
2721 LDAPMessage *result = NULL;
2722 int rc;
2723 NTSTATUS ret;
2724 const char **attr_list;
2725
2726 sid_to_string(sidstring, &sid);
2727
2728 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
2729 LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID, sidstring);
2730
2731 rc = ldapsam_search_one_group(ldap_state, filter, &result);
2732
2733 if (rc != LDAP_SUCCESS) {
2734 return NT_STATUS_NO_SUCH_GROUP;
2735 }
2736
2737 attr_list = get_attr_list( groupmap_attr_list_to_delete );
2738 ret = ldapsam_delete_entry(ldap_state, result, LDAP_OBJ_GROUPMAP, attr_list);
2739 free_attr_list ( attr_list );
2740
2741 ldap_msgfree(result);
2742
2743 return ret;
2744 }
2745
2746 /**********************************************************************
2747 *********************************************************************/
2748
2749 static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods, BOOL update)
2750 {
2751 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2752 fstring filter;
2753 int rc;
2754 const char **attr_list;
2755
2756 pstr_sprintf( filter, "(objectclass=%s)", LDAP_OBJ_GROUPMAP);
2757 attr_list = get_attr_list( groupmap_attr_list );
2758 rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
2759 LDAP_SCOPE_SUBTREE, filter,
2760 attr_list, 0, &ldap_state->result);
2761 free_attr_list( attr_list );
2762
2763 if (rc != LDAP_SUCCESS) {
2764 DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n", ldap_err2string(rc)));
2765 DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n", lp_ldap_group_suffix(), filter));
2766 ldap_msgfree(ldap_state->result);
2767 ldap_state->result = NULL;
2768 return NT_STATUS_UNSUCCESSFUL;
2769 }
2770
2771 DEBUG(2, ("ldapsam_setsamgrent: %d entries in the base!\n",
2772 ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
2773 ldap_state->result)));
2774
2775 ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, ldap_state->result);
2776 ldap_state->index = 0;
2777
2778 return NT_STATUS_OK;
2779 }
2780
2781 /**********************************************************************
2782 *********************************************************************/
2783
2784 static void ldapsam_endsamgrent(struct pdb_methods *my_methods)
2785 {
2786 ldapsam_endsampwent(my_methods);
2787 }
2788
2789 /**********************************************************************
2790 *********************************************************************/
2791
2792 static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods,
2793 GROUP_MAP *map)
2794 {
2795 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2796 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2797 BOOL bret = False;
2798
2799 while (!bret) {
2800 if (!ldap_state->entry)
2801 return ret;
2802
2803 ldap_state->index++;
2804 bret = init_group_from_ldap(ldap_state, map, ldap_state->entry);
2805
2806 ldap_state->entry = ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
2807 ldap_state->entry);
2808 }
2809
2810 return NT_STATUS_OK;
2811 }
2812
2813 /**********************************************************************
2814 *********************************************************************/
2815
2816 static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
2817 enum SID_NAME_USE sid_name_use,
2818 GROUP_MAP **rmap, int *num_entries,
2819 BOOL unix_only)
2820 {
2821 GROUP_MAP map;
2822 GROUP_MAP *mapt;
2823 int entries = 0;
2824
2825 *num_entries = 0;
2826 *rmap = NULL;
2827
2828 if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods, False))) {
2829 DEBUG(0, ("ldapsam_enum_group_mapping: Unable to open passdb\n"));
2830 return NT_STATUS_ACCESS_DENIED;
2831 }
2832
2833 while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) {
2834 if (sid_name_use != SID_NAME_UNKNOWN &&
2835 sid_name_use != map.sid_name_use) {
2836 DEBUG(11,("ldapsam_enum_group_mapping: group %s is not of the requested type\n", map.nt_name));
2837 continue;
2838 }
2839 if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
2840 DEBUG(11,("ldapsam_enum_group_mapping: group %s is non mapped\n", map.nt_name));
2841 continue;
2842 }
2843
2844 mapt=SMB_REALLOC_ARRAY((*rmap), GROUP_MAP, entries+1);
2845 if (!mapt) {
2846 DEBUG(0,("ldapsam_enum_group_mapping: Unable to enlarge group map!\n"));
2847 SAFE_FREE(*rmap);
2848 return NT_STATUS_UNSUCCESSFUL;
2849 }
2850 else
2851 (*rmap) = mapt;
2852
2853 mapt[entries] = map;
2854
2855 entries += 1;
2856
2857 }
2858 ldapsam_endsamgrent(methods);
2859
2860 *num_entries = entries;
2861
2862 return NT_STATUS_OK;
2863 }
2864
2865 static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
2866 const DOM_SID *alias,
2867 const DOM_SID *member,
2868 int modop)
2869 {
2870 struct ldapsam_privates *ldap_state =
2871 (struct ldapsam_privates *)methods->private_data;
2872 char *dn;
2873 LDAPMessage *result = NULL;
2874 LDAPMessage *entry = NULL;
2875 int count;
2876 LDAPMod **mods = NULL;
2877 int rc;
2878
2879 pstring filter;
2880
2881 pstr_sprintf(filter, "(&(|(objectClass=%s)(objectclass=%s))(%s=%s))",
2882 LDAP_OBJ_GROUPMAP, LDAP_OBJ_IDMAP_ENTRY,
2883 get_attr_key2string(groupmap_attr_list,
2884 LDAP_ATTR_GROUP_SID),
2885 sid_string_static(alias));
2886
2887 if (ldapsam_search_one_group(ldap_state, filter,
2888 &result) != LDAP_SUCCESS)
2889 return NT_STATUS_NO_SUCH_ALIAS;
2890
2891 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
2892 result);
2893
2894 if (count < 1) {
2895 DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
2896 ldap_msgfree(result);
2897 return NT_STATUS_NO_SUCH_ALIAS;
2898 }
2899
2900 if (count > 1) {
2901 DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for filter %s: "
2902 "count=%d\n", filter, count));
2903 ldap_msgfree(result);
2904 return NT_STATUS_NO_SUCH_ALIAS;
2905 }
2906
2907 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
2908 result);
2909
2910 if (!entry) {
2911 ldap_msgfree(result);
2912 return NT_STATUS_UNSUCCESSFUL;
2913 }
2914
2915 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
2916 if (!dn) {
2917 ldap_msgfree(result);
2918 return NT_STATUS_UNSUCCESSFUL;
2919 }
2920
2921 smbldap_set_mod(&mods, modop,
2922 get_attr_key2string(groupmap_attr_list,
2923 LDAP_ATTR_SID_LIST),
2924 sid_string_static(member));
2925
2926 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2927
2928 ldap_mods_free(mods, True);
2929 ldap_msgfree(result);
2930
2931 if (rc != LDAP_SUCCESS) {
2932 char *ld_error = NULL;
2933 ldap_get_option(ldap_state->smbldap_state->ldap_struct,
2934 LDAP_OPT_ERROR_STRING,&ld_error);
2935
2936 DEBUG(0, ("ldapsam_modify_aliasmem: Could not modify alias "
2937 "for %s, error: %s (%s)\n", dn, ldap_err2string(rc),
2938 ld_error?ld_error:"unknown"));
2939 SAFE_FREE(ld_error);
2940 SAFE_FREE(dn);
2941 return NT_STATUS_UNSUCCESSFUL;
2942 }
2943
2944 SAFE_FREE(dn);
2945
2946 return NT_STATUS_OK;
2947 }
2948
2949 static NTSTATUS ldapsam_add_aliasmem(struct pdb_methods *methods,
2950 const DOM_SID *alias,
2951 const DOM_SID *member)
2952 {
2953 return ldapsam_modify_aliasmem(methods, alias, member, LDAP_MOD_ADD);
2954 }
2955
2956 static NTSTATUS ldapsam_del_aliasmem(struct pdb_methods *methods,
2957 const DOM_SID *alias,
2958 const DOM_SID *member)
2959 {
2960 return ldapsam_modify_aliasmem(methods, alias, member,
2961 LDAP_MOD_DELETE);
2962 }
2963
2964 static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
2965 const DOM_SID *alias, DOM_SID **members,
2966 int *num_members)
2967 {
2968 struct ldapsam_privates *ldap_state =
2969 (struct ldapsam_privates *)methods->private_data;
2970 LDAPMessage *result = NULL;
2971 LDAPMessage *entry = NULL;
2972 int count;
2973 char **values;
2974 int i;
2975 pstring filter;
2976
2977 *members = NULL;
2978 *num_members = 0;
2979
2980 pstr_sprintf(filter, "(&(|(objectClass=%s)(objectclass=%s))(%s=%s))",
2981 LDAP_OBJ_GROUPMAP, LDAP_OBJ_IDMAP_ENTRY,
2982 get_attr_key2string(groupmap_attr_list,
2983 LDAP_ATTR_GROUP_SID),
2984 sid_string_static(alias));
2985
2986 if (ldapsam_search_one_group(ldap_state, filter,
2987 &result) != LDAP_SUCCESS)
2988 return NT_STATUS_NO_SUCH_ALIAS;
2989
2990 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
2991 result);
2992
2993 if (count < 1) {
2994 DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
2995 ldap_msgfree(result);
2996 return NT_STATUS_NO_SUCH_ALIAS;
2997 }
2998
2999 if (count > 1) {
3000 DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for filter %s: "
3001 "count=%d\n", filter, count));
3002 ldap_msgfree(result);
3003 return NT_STATUS_NO_SUCH_ALIAS;
3004 }
3005
3006 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3007 result);
3008
3009 if (!entry) {
3010 ldap_msgfree(result);
3011 return NT_STATUS_UNSUCCESSFUL;
3012 }
3013
3014 values = ldap_get_values(ldap_state->smbldap_state->ldap_struct,
3015 entry,
3016 get_attr_key2string(groupmap_attr_list,
3017 LDAP_ATTR_SID_LIST));
3018
3019 if (values == NULL) {
3020 ldap_msgfree(result);
3021 return NT_STATUS_OK;
3022 }
3023
3024 count = ldap_count_values(values);
3025
3026 for (i=0; i<count; i++) {
3027 DOM_SID member;
3028
3029 if (!string_to_sid(&member, values[i]))
3030 continue;
3031
3032 add_sid_to_array(&member, members, num_members);
3033 }
3034
3035 ldap_value_free(values);
3036 ldap_msgfree(result);
3037
3038 return NT_STATUS_OK;
3039 }
3040
3041 static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
3042 const DOM_SID *members,
3043 int num_members,
3044 DOM_SID **aliases, int *num_aliases)
3045 {
3046 struct ldapsam_privates *ldap_state =
3047 (struct ldapsam_privates *)methods->private_data;
3048 LDAP *ldap_struct;
3049
3050 const char *attrs[] = { LDAP_ATTRIBUTE_SID, NULL };
3051
3052 LDAPMessage *result = NULL;
3053 LDAPMessage *entry = NULL;
3054 int i;
3055 int rc;
3056 char *filter;
3057 TALLOC_CTX *mem_ctx;
3058
3059 mem_ctx = talloc_init("ldapsam_alias_memberships");
3060
3061 if (mem_ctx == NULL)
3062 return NT_STATUS_NO_MEMORY;
3063
3064 /* This query could be further optimized by adding a
3065 (&(sambaSID=<domain-sid>*)) so that only those aliases that are
3066 asked for in the getuseraliases are returned. */
3067
3068 filter = talloc_asprintf(mem_ctx,
3069 "(&(|(objectclass=%s)(objectclass=%s))(|",
3070 LDAP_OBJ_GROUPMAP, LDAP_OBJ_IDMAP_ENTRY);
3071
3072 for (i=0; i<num_members; i++)
3073 filter = talloc_asprintf(mem_ctx, "%s(sambaSIDList=%s)",
3074 filter,
3075 sid_string_static(&members[i]));
3076
3077 filter = talloc_asprintf(mem_ctx, "%s))", filter);
3078
3079 rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
3080 LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
3081
3082 talloc_destroy(mem_ctx);
3083
3084 if (rc != LDAP_SUCCESS)
3085 return NT_STATUS_UNSUCCESSFUL;
3086
3087 *aliases = NULL;
3088 *num_aliases = 0;
3089
3090 ldap_struct = ldap_state->smbldap_state->ldap_struct;
3091
3092 for (entry = ldap_first_entry(ldap_struct, result);
3093 entry != NULL;
3094 entry = ldap_next_entry(ldap_struct, entry))
3095 {
3096 fstring sid_str;
3097 DOM_SID sid;
3098
3099 if (!smbldap_get_single_attribute(ldap_struct, entry,
3100 LDAP_ATTRIBUTE_SID,
3101 sid_str,
3102 sizeof(sid_str)-1))
3103 continue;
3104
3105 if (!string_to_sid(&sid, sid_str))
3106 continue;
3107
3108 add_sid_to_array_unique(&sid, aliases, num_aliases);
3109 }
3110
3111 ldap_msgfree(result);
3112 return NT_STATUS_OK;
3113 }
3114
3115 /**********************************************************************
3116 Housekeeping
3117 *********************************************************************/
3118
3119 static void free_private_data(void **vp)
3120 {
3121 struct ldapsam_privates **ldap_state = (struct ldapsam_privates **)vp;
3122
3123 smbldap_free_struct(&(*ldap_state)->smbldap_state);
3124
3125 if ((*ldap_state)->result != NULL) {
3126 ldap_msgfree((*ldap_state)->result);
3127 (*ldap_state)->result = NULL;
3128 }
3129 if ((*ldap_state)->domain_dn != NULL) {
3130 SAFE_FREE((*ldap_state)->domain_dn);
3131 }
3132
3133 *ldap_state = NULL;
3134
3135 /* No need to free any further, as it is talloc()ed */
3136 }
3137
3138 /**********************************************************************
3139 Intitalise the parts of the pdb_context that are common to all pdb_ldap modes
3140 *********************************************************************/
3141
3142 static NTSTATUS pdb_init_ldapsam_common(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method,
3143 const char *location)
3144 {
3145 NTSTATUS nt_status;
3146 struct ldapsam_privates *ldap_state;
3147
3148 if (!NT_STATUS_IS_OK(nt_status = make_pdb_methods(pdb_context->mem_ctx, pdb_method))) {
3149 return nt_status;
3150 }
3151
3152 (*pdb_method)->name = "ldapsam";
3153
3154 (*pdb_method)->setsampwent = ldapsam_setsampwent;
3155 (*pdb_method)->endsampwent = ldapsam_endsampwent;
3156 (*pdb_method)->getsampwent = ldapsam_getsampwent;
3157 (*pdb_method)->getsampwnam = ldapsam_getsampwnam;
3158 (*pdb_method)->getsampwsid = ldapsam_getsampwsid;
3159 (*pdb_method)->add_sam_account = ldapsam_add_sam_account;
3160 (*pdb_method)->update_sam_account = ldapsam_update_sam_account;
3161 (*pdb_method)->delete_sam_account = ldapsam_delete_sam_account;
3162
3163 (*pdb_method)->getgrsid = ldapsam_getgrsid;
3164 (*pdb_method)->getgrgid = ldapsam_getgrgid;
3165 (*pdb_method)->getgrnam = ldapsam_getgrnam;
3166 (*pdb_method)->add_group_mapping_entry = ldapsam_add_group_mapping_entry;
3167 (*pdb_method)->update_group_mapping_entry = ldapsam_update_group_mapping_entry;
3168 (*pdb_method)->delete_group_mapping_entry = ldapsam_delete_group_mapping_entry;
3169 (*pdb_method)->enum_group_mapping = ldapsam_enum_group_mapping;
3170 (*pdb_method)->enum_group_members = ldapsam_enum_group_members;
3171 (*pdb_method)->enum_group_memberships = ldapsam_enum_group_memberships;
3172
3173 /* TODO: Setup private data and free */
3174
3175 ldap_state = TALLOC_ZERO_P(pdb_context->mem_ctx, struct ldapsam_privates);
3176 if (!ldap_state) {
3177 DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
3178 return NT_STATUS_NO_MEMORY;
3179 }
3180
3181 if (!NT_STATUS_IS_OK(nt_status =
3182 smbldap_init(pdb_context->mem_ctx, location,
3183 &ldap_state->smbldap_state)));
3184
3185 ldap_state->domain_name = talloc_strdup(pdb_context->mem_ctx, get_global_sam_name());
3186 if (!ldap_state->domain_name) {
3187 return NT_STATUS_NO_MEMORY;
3188 }
3189
3190 (*pdb_method)->private_data = ldap_state;
3191
3192 (*pdb_method)->free_private_data = free_private_data;
3193
3194 return NT_STATUS_OK;
3195 }
3196
3197 /**********************************************************************
3198 Initialise the 'compat' mode for pdb_ldap
3199 *********************************************************************/
3200
3201 NTSTATUS pdb_init_ldapsam_compat(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location)
3202 {
3203 NTSTATUS nt_status;
3204 struct ldapsam_privates *ldap_state;
3205
3206 #ifdef WITH_LDAP_SAMCONFIG
3207 if (!location) {
3208 int ldap_port = lp_ldap_port();
3209
3210 /* remap default port if not using SSL (ie clear or TLS) */
3211 if ( (lp_ldap_ssl() != LDAP_SSL_ON) && (ldap_port == 636) ) {
3212 ldap_port = 389;
3213 }
3214
3215 location = talloc_asprintf(pdb_context->mem_ctx, "%s://%s:%d", lp_ldap_ssl() == LDAP_SSL_ON ? "ldaps" : "ldap", lp_ldap_server(), ldap_port);
3216 if (!location) {
3217 return NT_STATUS_NO_MEMORY;
3218 }
3219 }
3220 #endif
3221
3222 if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) {
3223 return nt_status;
3224 }
3225
3226 (*pdb_method)->name = "ldapsam_compat";
3227
3228 ldap_state = (*pdb_method)->private_data;
3229 ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT;
3230
3231 sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
3232
3233 return NT_STATUS_OK;
3234 }
3235
3236 /**********************************************************************
3237 Initialise the normal mode for pdb_ldap
3238 *********************************************************************/
3239
3240 NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location)
3241 {
3242 NTSTATUS nt_status;
3243 struct ldapsam_privates *ldap_state;
3244 uint32 alg_rid_base;
3245 pstring alg_rid_base_string;
3246 LDAPMessage *result = NULL;
3247 LDAPMessage *entry = NULL;
3248 DOM_SID ldap_domain_sid;
3249 DOM_SID secrets_domain_sid;
3250 pstring domain_sid_string;
3251 char *dn;
3252
3253 if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) {
3254 return nt_status;
3255 }
3256
3257 (*pdb_method)->name = "ldapsam";
3258
3259 (*pdb_method)->add_aliasmem = ldapsam_add_aliasmem;
3260 (*pdb_method)->del_aliasmem = ldapsam_del_aliasmem;
3261 (*pdb_method)->enum_aliasmem = ldapsam_enum_aliasmem;
3262 (*pdb_method)->enum_alias_memberships = ldapsam_alias_memberships;
3263
3264 ldap_state = (*pdb_method)->private_data;
3265 ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
3266
3267 /* Try to setup the Domain Name, Domain SID, algorithmic rid base */
3268
3269 nt_status = smbldap_search_domain_info(ldap_state->smbldap_state, &result,
3270 ldap_state->domain_name, True);
3271
3272 if ( !NT_STATUS_IS_OK(nt_status) ) {
3273 DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain info, nor add one to the domain\n"));
3274 DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, will be unable to allocate new users/groups, \
3275 and will risk BDCs having inconsistant SIDs\n"));
3276 sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
3277 return NT_STATUS_OK;
3278 }
3279
3280 /* Given that the above might fail, everything below this must be optional */
3281
3282 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
3283 if (!entry) {
3284 DEBUG(0, ("pdb_init_ldapsam: Could not get domain info entry\n"));
3285 ldap_msgfree(result);
3286 return NT_STATUS_UNSUCCESSFUL;
3287 }
3288
3289 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
3290 if (!dn) {
3291 return NT_STATUS_UNSUCCESSFUL;
3292 }
3293
3294 ldap_state->domain_dn = smb_xstrdup(dn);
3295 ldap_memfree(dn);
3296
3297 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
3298 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
3299 domain_sid_string)) {
3300 BOOL found_sid;
3301 if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
3302 DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be read as a valid SID\n", domain_sid_string));
3303 return NT_STATUS_INVALID_PARAMETER;
3304 }
3305 found_sid = secrets_fetch_domain_sid(ldap_state->domain_name, &secrets_domain_sid);
3306 if (!found_sid || !sid_equal(&secrets_domain_sid, &ldap_domain_sid)) {
3307 fstring new_sid_str, old_sid_str;
3308 DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain %s based on pdb_ldap results %s -> %s\n",
3309 ldap_state->domain_name,
3310 sid_to_string(old_sid_str, &secrets_domain_sid),
3311 sid_to_string(new_sid_str, &ldap_domain_sid)));
3312
3313 /* reset secrets.tdb sid */
3314 secrets_store_domain_sid(ldap_state->domain_name, &ldap_domain_sid);
3315 DEBUG(1, ("New global sam SID: %s\n", sid_to_string(new_sid_str, get_global_sam_sid())));
3316 }
3317 sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
3318 }
3319
3320 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
3321 get_attr_key2string( dominfo_attr_list, LDAP_ATTR_ALGORITHMIC_RID_BASE ),
3322 alg_rid_base_string)) {
3323 alg_rid_base = (uint32)atol(alg_rid_base_string);
3324 if (alg_rid_base != algorithmic_rid_base()) {
3325 DEBUG(0, ("The value of 'algorithmic RID base' has changed since the LDAP\n"
3326 "database was initialised. Aborting. \n"));
3327 ldap_msgfree(result);
3328 return NT_STATUS_UNSUCCESSFUL;
3329 }
3330 }
3331 ldap_msgfree(result);
3332
3333 return NT_STATUS_OK;
3334 }
3335
3336 NTSTATUS pdb_ldap_init(void)
3337 {
3338 NTSTATUS nt_status;
3339 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam)))
3340 return nt_status;
3341
3342 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_compat", pdb_init_ldapsam_compat)))
3343 return nt_status;
3344
3345 /* Let pdb_nds register backends */
3346 pdb_nds_init();
3347
3348 return NT_STATUS_OK;
3349 }
WIP