s4:lib/messaging: terminate the irpc_servers_byname() result with server_id_set_disco...
[Samba/gebeck_regimport.git] / source3 / passdb / pdb_ldap_util.c
blob522c64fb5d9aa55db55fbc97c5db743df82facab
1 /*
2 Unix SMB/CIFS mplementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean Fran├žois Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002-2003
8 Copyright (C) Stefan (metze) Metzmacher 2002-2003
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "includes.h"
26 #include "smbldap.h"
27 #include "passdb.h"
28 #include "passdb/pdb_ldap_util.h"
29 #include "passdb/pdb_ldap_schema.h"
31 /**********************************************************************
32 Add the account-policies below the sambaDomain object to LDAP,
33 *********************************************************************/
35 static NTSTATUS add_new_domain_account_policies(struct smbldap_state *ldap_state,
36 const char *domain_name)
38 NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
39 int i, rc;
40 uint32 policy_default;
41 const char *policy_attr = NULL;
42 char *dn = NULL;
43 LDAPMod **mods = NULL;
44 char *escape_domain_name;
46 DEBUG(3,("add_new_domain_account_policies: Adding new account policies for domain\n"));
48 escape_domain_name = escape_rdn_val_string_alloc(domain_name);
49 if (!escape_domain_name) {
50 DEBUG(0, ("Out of memory!\n"));
51 return NT_STATUS_NO_MEMORY;
54 if (asprintf(&dn, "%s=%s,%s",
55 get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN),
56 escape_domain_name, lp_ldap_suffix(talloc_tos())) < 0) {
57 SAFE_FREE(escape_domain_name);
58 return NT_STATUS_NO_MEMORY;
61 SAFE_FREE(escape_domain_name);
63 for (i=1; decode_account_policy_name(i) != NULL; i++) {
64 char *val = NULL;
66 policy_attr = get_account_policy_attr(i);
67 if (!policy_attr) {
68 DEBUG(0,("add_new_domain_account_policies: ops. no policy!\n"));
69 continue;
72 if (!account_policy_get_default(i, &policy_default)) {
73 DEBUG(0,("add_new_domain_account_policies: failed to get default account policy\n"));
74 SAFE_FREE(dn);
75 return ntstatus;
78 DEBUG(10,("add_new_domain_account_policies: adding \"%s\" with value: %d\n", policy_attr, policy_default));
80 if (asprintf(&val, "%d", policy_default) < 0) {
81 SAFE_FREE(dn);
82 return NT_STATUS_NO_MEMORY;
85 smbldap_set_mod( &mods, LDAP_MOD_REPLACE, policy_attr, val);
87 rc = smbldap_modify(ldap_state, dn, mods);
89 SAFE_FREE(val);
91 if (rc!=LDAP_SUCCESS) {
92 char *ld_error = NULL;
93 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error);
94 DEBUG(1,("add_new_domain_account_policies: failed to add account policies to dn= %s with: %s\n\t%s\n",
95 dn, ldap_err2string(rc),
96 ld_error ? ld_error : "unknown"));
97 SAFE_FREE(ld_error);
98 SAFE_FREE(dn);
99 ldap_mods_free(mods, True);
100 return ntstatus;
104 SAFE_FREE(dn);
105 ldap_mods_free(mods, True);
107 return NT_STATUS_OK;
110 /**********************************************************************
111 Add the sambaDomain to LDAP, so we don't have to search for this stuff
112 again. This is a once-add operation for now.
114 TODO: Add other attributes, and allow modification.
115 *********************************************************************/
117 static NTSTATUS add_new_domain_info(struct smbldap_state *ldap_state,
118 const char *domain_name)
120 fstring sid_string;
121 fstring algorithmic_rid_base_string;
122 char *filter = NULL;
123 char *dn = NULL;
124 LDAPMod **mods = NULL;
125 int rc;
126 LDAPMessage *result = NULL;
127 int num_result;
128 const char **attr_list;
129 char *escape_domain_name;
131 /* escape for filter */
132 escape_domain_name = escape_ldap_string(talloc_tos(), domain_name);
133 if (!escape_domain_name) {
134 DEBUG(0, ("Out of memory!\n"));
135 return NT_STATUS_NO_MEMORY;
138 if (asprintf(&filter, "(&(%s=%s)(objectclass=%s))",
139 get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN),
140 escape_domain_name, LDAP_OBJ_DOMINFO) < 0) {
141 TALLOC_FREE(escape_domain_name);
142 return NT_STATUS_NO_MEMORY;
145 TALLOC_FREE(escape_domain_name);
147 attr_list = get_attr_list(NULL, dominfo_attr_list );
148 rc = smbldap_search_suffix(ldap_state, filter, attr_list, &result);
149 TALLOC_FREE( attr_list );
150 SAFE_FREE(filter);
152 if (rc != LDAP_SUCCESS) {
153 return NT_STATUS_UNSUCCESSFUL;
156 num_result = ldap_count_entries(ldap_state->ldap_struct, result);
158 if (num_result > 1) {
159 DEBUG (0, ("add_new_domain_info: More than domain with that name exists: bailing "
160 "out!\n"));
161 ldap_msgfree(result);
162 return NT_STATUS_UNSUCCESSFUL;
165 /* Check if we need to add an entry */
166 DEBUG(3,("add_new_domain_info: Adding new domain\n"));
168 /* this time escape for DN */
169 escape_domain_name = escape_rdn_val_string_alloc(domain_name);
170 if (!escape_domain_name) {
171 DEBUG(0, ("Out of memory!\n"));
172 return NT_STATUS_NO_MEMORY;
175 if (asprintf(&dn, "%s=%s,%s",
176 get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN),
177 escape_domain_name, lp_ldap_suffix(talloc_tos())) < 0) {
178 SAFE_FREE(escape_domain_name);
179 return NT_STATUS_NO_MEMORY;
182 SAFE_FREE(escape_domain_name);
184 /* Free original search */
185 ldap_msgfree(result);
187 /* make the changes - the entry *must* not already have samba
188 * attributes */
190 smbldap_set_mod(&mods, LDAP_MOD_ADD,
191 get_attr_key2string(dominfo_attr_list,
192 LDAP_ATTR_DOMAIN),
193 domain_name);
195 /* If we don't have an entry, then ask secrets.tdb for what it thinks.
196 It may choose to make it up */
198 sid_to_fstring(sid_string, get_global_sam_sid());
199 smbldap_set_mod(&mods, LDAP_MOD_ADD,
200 get_attr_key2string(dominfo_attr_list,
201 LDAP_ATTR_DOM_SID),
202 sid_string);
204 slprintf(algorithmic_rid_base_string,
205 sizeof(algorithmic_rid_base_string) - 1, "%i",
206 algorithmic_rid_base());
207 smbldap_set_mod(&mods, LDAP_MOD_ADD,
208 get_attr_key2string(dominfo_attr_list,
209 LDAP_ATTR_ALGORITHMIC_RID_BASE),
210 algorithmic_rid_base_string);
211 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_DOMINFO);
213 /* add the sambaNextUserRid attributes. */
216 uint32 rid = BASE_RID;
217 fstring rid_str;
219 fstr_sprintf( rid_str, "%i", rid );
220 DEBUG(10,("add_new_domain_info: setting next available user rid [%s]\n", rid_str));
221 smbldap_set_mod(&mods, LDAP_MOD_ADD,
222 get_attr_key2string(dominfo_attr_list,
223 LDAP_ATTR_NEXT_USERRID),
224 rid_str);
228 rc = smbldap_add(ldap_state, dn, mods);
230 if (rc!=LDAP_SUCCESS) {
231 char *ld_error = NULL;
232 ldap_get_option(ldap_state->ldap_struct,
233 LDAP_OPT_ERROR_STRING, &ld_error);
234 DEBUG(1,("add_new_domain_info: failed to add domain dn= %s with: %s\n\t%s\n",
235 dn, ldap_err2string(rc),
236 ld_error?ld_error:"unknown"));
237 SAFE_FREE(ld_error);
238 SAFE_FREE(dn);
239 ldap_mods_free(mods, True);
240 return NT_STATUS_UNSUCCESSFUL;
243 DEBUG(2,("add_new_domain_info: added: domain = %s in the LDAP database\n", domain_name));
244 ldap_mods_free(mods, True);
245 SAFE_FREE(dn);
246 return NT_STATUS_OK;
249 /**********************************************************************
250 Search for the domain info entry
251 *********************************************************************/
253 NTSTATUS smbldap_search_domain_info(struct smbldap_state *ldap_state,
254 LDAPMessage ** result, const char *domain_name,
255 bool try_add)
257 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
258 char *filter = NULL;
259 int rc;
260 const char **attr_list;
261 int count;
262 char *escape_domain_name;
264 escape_domain_name = escape_ldap_string(talloc_tos(), domain_name);
265 if (!escape_domain_name) {
266 DEBUG(0, ("Out of memory!\n"));
267 return NT_STATUS_NO_MEMORY;
270 if (asprintf(&filter, "(&(objectClass=%s)(%s=%s))",
271 LDAP_OBJ_DOMINFO,
272 get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN),
273 escape_domain_name) < 0) {
274 TALLOC_FREE(escape_domain_name);
275 return NT_STATUS_NO_MEMORY;
278 TALLOC_FREE(escape_domain_name);
280 DEBUG(2, ("smbldap_search_domain_info: Searching for:[%s]\n", filter));
282 attr_list = get_attr_list( NULL, dominfo_attr_list );
283 rc = smbldap_search_suffix(ldap_state, filter, attr_list , result);
284 TALLOC_FREE( attr_list );
286 if (rc != LDAP_SUCCESS) {
287 DEBUG(2,("smbldap_search_domain_info: Problem during LDAPsearch: %s\n", ldap_err2string (rc)));
288 DEBUG(2,("smbldap_search_domain_info: Query was: %s, %s\n", lp_ldap_suffix(talloc_tos()), filter));
289 goto failed;
292 SAFE_FREE(filter);
294 count = ldap_count_entries(ldap_state->ldap_struct, *result);
296 if (count == 1) {
297 return NT_STATUS_OK;
300 ldap_msgfree(*result);
301 *result = NULL;
303 if (count < 1) {
305 DEBUG(3, ("smbldap_search_domain_info: Got no domain info entries for domain\n"));
307 if (!try_add)
308 goto failed;
310 status = add_new_domain_info(ldap_state, domain_name);
311 if (!NT_STATUS_IS_OK(status)) {
312 DEBUG(0, ("smbldap_search_domain_info: Adding domain info for %s failed with %s\n",
313 domain_name, nt_errstr(status)));
314 goto failed;
317 status = add_new_domain_account_policies(ldap_state, domain_name);
318 if (!NT_STATUS_IS_OK(status)) {
319 DEBUG(0, ("smbldap_search_domain_info: Adding domain account policies for %s failed with %s\n",
320 domain_name, nt_errstr(status)));
321 goto failed;
324 return smbldap_search_domain_info(ldap_state, result, domain_name, False);
328 if (count > 1 ) {
330 DEBUG(0, ("smbldap_search_domain_info: Got too many (%d) domain info entries for domain %s\n",
331 count, domain_name));
332 goto failed;
335 failed:
336 return status;