?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix from Alex Deiter <tiamat@komi.mts.ru>
[Samba/nascimento.git] / source / passdb / pdb_ldap.c
blob1ae706f6f065753aedede7ddbf73ab9831a31285
1 /*
2 Unix SMB/CIFS mplementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean François Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002
8 Copyright (C) Stefan (metze) Metzmacher 2002
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23
24 */
25
26 /* TODO:
27 * persistent connections: if using NSS LDAP, many connections are made
28 * however, using only one within Samba would be nice
29 *
30 * Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
31 *
32 * Other LDAP based login attributes: accountExpires, etc.
33 * (should be the domain of Samba proper, but the sam_password/SAM_ACCOUNT
34 * structures don't have fields for some of these attributes)
35 *
36 * SSL is done, but can't get the certificate based authentication to work
37 * against on my test platform (Linux 2.4, OpenLDAP 2.x)
38 */
39
40 /* NOTE: this will NOT work against an Active Directory server
41 * due to the fact that the two password fields cannot be retrieved
42 * from a server; recommend using security = domain in this situation
43 * and/or winbind
44 */
45
46 #include "includes.h"
47
48 #undef DBGC_CLASS
49 #define DBGC_CLASS DBGC_PASSDB
50
51 #include <lber.h>
52 #include <ldap.h>
53
54 #ifndef LDAP_OPT_SUCCESS
55 #define LDAP_OPT_SUCCESS 0
56 #endif
57
58 #ifndef SAM_ACCOUNT
59 #define SAM_ACCOUNT struct sam_passwd
60 #endif
61
62 struct ldapsam_privates {
63 /* Former statics */
64 LDAP *ldap_struct;
65 LDAPMessage *result;
66 LDAPMessage *entry;
67 int index;
68
69 time_t last_ping;
70 /* retrive-once info */
71 const char *uri;
72 const char *domain_name;
73 DOM_SID domain_sid;
74
75 /* configuration items */
76 int schema_ver;
77
78 BOOL permit_non_unix_accounts;
79
80 uint32 low_allocated_user_rid;
81 uint32 high_allocated_user_rid;
82
83 uint32 low_allocated_group_rid;
84 uint32 high_allocated_group_rid;
85
86 char *bind_dn;
87 char *bind_secret;
88
89 unsigned int num_failures;
90 };
91
92 #define LDAPSAM_DONT_PING_TIME 10 /* ping only all 10 seconds */
93
94 static struct ldapsam_privates *static_ldap_state;
95
96 /* specify schema versions between 2.2. and 3.0 */
97
98 #define SCHEMAVER_SAMBAACCOUNT 1
99 #define SCHEMAVER_SAMBASAMACCOUNT 2
100
101 /* objectclass names */
102
103 #define LDAP_OBJ_SAMBASAMACCOUNT "sambaSamAccount"
104 #define LDAP_OBJ_SAMBAACCOUNT "sambaAccount"
105 #define LDAP_OBJ_GROUPMAP "sambaGroupMapping"
106 #define LDAP_OBJ_DOMINFO "sambaDomain"
107
108 #define LDAP_OBJ_ACCOUNT "account"
109 #define LDAP_OBJ_POSIXACCOUNT "posixAccount"
110 #define LDAP_OBJ_POSIXGROUP "posixGroup"
111
112 /* some generic attributes that get reused a lot */
113
114 #define LDAP_ATTRIBUTE_SID "sambaSID"
115
116 /* attribute map table indexes */
117
118 #define LDAP_ATTR_LIST_END 0
119 #define LDAP_ATTR_UID 1
120 #define LDAP_ATTR_UIDNUMBER 2
121 #define LDAP_ATTR_GIDNUMBER 3
122 #define LDAP_ATTR_UNIX_HOME 4
123 #define LDAP_ATTR_PWD_LAST_SET 5
124 #define LDAP_ATTR_PWD_CAN_CHANGE 6
125 #define LDAP_ATTR_PWD_MUST_CHANGE 7
126 #define LDAP_ATTR_LOGON_TIME 8
127 #define LDAP_ATTR_LOGOFF_TIME 9
128 #define LDAP_ATTR_KICKOFF_TIME 10
129 #define LDAP_ATTR_CN 11
130 #define LDAP_ATTR_DISPLAY_NAME 12
131 #define LDAP_ATTR_HOME_PATH 13
132 #define LDAP_ATTR_LOGON_SCRIPT 14
133 #define LDAP_ATTR_PROFILE_PATH 15
134 #define LDAP_ATTR_DESC 16
135 #define LDAP_ATTR_USER_WKS 17
136 #define LDAP_ATTR_USER_SID 18
137 #define LDAP_ATTR_USER_RID 18
138 #define LDAP_ATTR_PRIMARY_GROUP_SID 19
139 #define LDAP_ATTR_PRIMARY_GROUP_RID 20
140 #define LDAP_ATTR_LMPW 21
141 #define LDAP_ATTR_NTPW 22
142 #define LDAP_ATTR_DOMAIN 23
143 #define LDAP_ATTR_OBJCLASS 24
144 #define LDAP_ATTR_ACB_INFO 25
145 #define LDAP_ATTR_NEXT_USERRID 26
146 #define LDAP_ATTR_NEXT_GROUPRID 27
147 #define LDAP_ATTR_DOM_SID 28
148 #define LDAP_ATTR_HOME_DRIVE 29
149 #define LDAP_ATTR_GROUP_SID 30
150 #define LDAP_ATTR_GROUP_TYPE 31
151
152
153 typedef struct _attrib_map_entry {
154 int attrib;
155 const char *name;
156 } ATTRIB_MAP_ENTRY;
157
158
159 /* attributes used by Samba 2.2 */
160
161 static ATTRIB_MAP_ENTRY attrib_map_v22[] = {
162 { LDAP_ATTR_UID, "uid" },
163 { LDAP_ATTR_UIDNUMBER, "uidNumber" },
164 { LDAP_ATTR_GIDNUMBER, "gidNumber" },
165 { LDAP_ATTR_UNIX_HOME, "homeDirectory" },
166 { LDAP_ATTR_PWD_LAST_SET, "pwdLastSet" },
167 { LDAP_ATTR_PWD_CAN_CHANGE, "pwdCanChange" },
168 { LDAP_ATTR_PWD_MUST_CHANGE, "pwdMustChange" },
169 { LDAP_ATTR_LOGON_TIME, "logonTime" },
170 { LDAP_ATTR_LOGOFF_TIME, "logoffTime" },
171 { LDAP_ATTR_KICKOFF_TIME, "kickoffTime" },
172 { LDAP_ATTR_CN, "cn" },
173 { LDAP_ATTR_DISPLAY_NAME, "displayName" },
174 { LDAP_ATTR_HOME_PATH, "smbHome" },
175 { LDAP_ATTR_HOME_DRIVE, "homeDrives" },
176 { LDAP_ATTR_LOGON_SCRIPT, "scriptPath" },
177 { LDAP_ATTR_PROFILE_PATH, "profilePath" },
178 { LDAP_ATTR_DESC, "description" },
179 { LDAP_ATTR_USER_WKS, "userWorkstations"},
180 { LDAP_ATTR_USER_RID, "rid" },
181 { LDAP_ATTR_PRIMARY_GROUP_RID, "primaryGroupID"},
182 { LDAP_ATTR_LMPW, "lmPassword" },
183 { LDAP_ATTR_NTPW, "ntPassword" },
184 { LDAP_ATTR_DOMAIN, "domain" },
185 { LDAP_ATTR_OBJCLASS, "objectClass" },
186 { LDAP_ATTR_ACB_INFO, "acctFlags" },
187 { LDAP_ATTR_LIST_END, NULL }
188 };
189
190 /* attributes used by Samba 3.0's sambaSamAccount */
191
192 static ATTRIB_MAP_ENTRY attrib_map_v30[] = {
193 { LDAP_ATTR_UID, "uid" },
194 { LDAP_ATTR_UIDNUMBER, "uidNumber" },
195 { LDAP_ATTR_GIDNUMBER, "gidNumber" },
196 { LDAP_ATTR_UNIX_HOME, "homeDirectory" },
197 { LDAP_ATTR_PWD_LAST_SET, "sambaPwdLastSet" },
198 { LDAP_ATTR_PWD_CAN_CHANGE, "sambaPwdCanChange" },
199 { LDAP_ATTR_PWD_MUST_CHANGE, "sambaPwdMustChange" },
200 { LDAP_ATTR_LOGON_TIME, "sambaLogonTime" },
201 { LDAP_ATTR_LOGOFF_TIME, "sambaLogoffTime" },
202 { LDAP_ATTR_KICKOFF_TIME, "sambaKickoffTime" },
203 { LDAP_ATTR_CN, "cn" },
204 { LDAP_ATTR_DISPLAY_NAME, "displayName" },
205 { LDAP_ATTR_HOME_DRIVE, "sambaHoneDrive" },
206 { LDAP_ATTR_HOME_PATH, "sambaHomePath" },
207 { LDAP_ATTR_LOGON_SCRIPT, "sambaLogonScript" },
208 { LDAP_ATTR_PROFILE_PATH, "sambaProfilePath" },
209 { LDAP_ATTR_DESC, "description" },
210 { LDAP_ATTR_USER_WKS, "sambaUserWorkstations" },
211 { LDAP_ATTR_USER_SID, "sambaSID" },
212 { LDAP_ATTR_PRIMARY_GROUP_SID, "sambaPrimaryGroupSID" },
213 { LDAP_ATTR_LMPW, "sambaLMPassword" },
214 { LDAP_ATTR_NTPW, "sambaNTPassword" },
215 { LDAP_ATTR_DOMAIN, "sambaDomainName" },
216 { LDAP_ATTR_OBJCLASS, "objectClass" },
217 { LDAP_ATTR_ACB_INFO, "sambaAcctFlags" },
218 { LDAP_ATTR_LIST_END, NULL }
219 };
220
221 /* attributes used for alalocating RIDs */
222
223 static ATTRIB_MAP_ENTRY dominfo_attr_list[] = {
224 { LDAP_ATTR_DOMAIN, "sambaDomainName" },
225 { LDAP_ATTR_NEXT_USERRID, "sambaNextUserRid" },
226 { LDAP_ATTR_NEXT_GROUPRID, "sambaNextGroupRid" },
227 { LDAP_ATTR_DOM_SID, "sambaSID" },
228 { LDAP_ATTR_LIST_END, NULL },
229 };
230
231 /* Samba 3.0 group mapping attributes */
232
233 static ATTRIB_MAP_ENTRY groupmap_attr_list[] = {
234 { LDAP_ATTR_GIDNUMBER, "gidNumber" },
235 { LDAP_ATTR_GROUP_SID, "sambaSID" },
236 { LDAP_ATTR_GROUP_TYPE, "sambaGroupType" },
237 { LDAP_ATTR_DESC, "description" },
238 { LDAP_ATTR_DISPLAY_NAME, "displayName" },
239 { LDAP_ATTR_CN, "cn" },
240 { LDAP_ATTR_LIST_END, NULL }
241 };
242
243 static ATTRIB_MAP_ENTRY groupmap_attr_list_to_delete[] = {
244 { LDAP_ATTR_GROUP_SID, "sambaSID" },
245 { LDAP_ATTR_GROUP_TYPE, "sambaGroupType" },
246 { LDAP_ATTR_DESC, "description" },
247 { LDAP_ATTR_DISPLAY_NAME, "displayName" },
248 { LDAP_ATTR_LIST_END, NULL }
249 };
250
251 /**********************************************************************
252 perform a simple table lookup and return the attribute name
253 **********************************************************************/
254
255 static const char* get_attr_key2string( ATTRIB_MAP_ENTRY table[], int key )
256 {
257 int i = 0;
258
259 while ( table[i].attrib != LDAP_ATTR_LIST_END ) {
260 if ( table[i].attrib == key )
261 return table[i].name;
262 i++;
263 }
264
265 return NULL;
266 }
267
268 /**********************************************************************
269 get the attribute name given a user schame version
270 **********************************************************************/
271
272 static const char* get_userattr_key2string( int schema_ver, int key )
273 {
274 switch ( schema_ver )
275 {
276 case SCHEMAVER_SAMBAACCOUNT:
277 return get_attr_key2string( attrib_map_v22, key );
278
279 case SCHEMAVER_SAMBASAMACCOUNT:
280 return get_attr_key2string( attrib_map_v30, key );
281
282 default:
283 DEBUG(0,("get_userattr_key2string: unknown schema version specified\n"));
284 break;
285 }
286 return NULL;
287 }
288
289 /**********************************************************************
290 Return the list of attribute names from a mapping table
291 **********************************************************************/
292
293 static char** get_attr_list( ATTRIB_MAP_ENTRY table[] )
294 {
295 char **names;
296 int i = 0;
297
298 while ( table[i].attrib != LDAP_ATTR_LIST_END )
299 i++;
300 i++;
301
302 names = (char**)malloc( sizeof(char*)*i );
303 if ( !names ) {
304 DEBUG(0,("get_attr_list: out of memory\n"));
305 return NULL;
306 }
307
308 i = 0;
309 while ( table[i].attrib != LDAP_ATTR_LIST_END ) {
310 names[i] = strdup( table[i].name );
311 i++;
312 }
313 names[i] = NULL;
314
315 return names;
316 }
317
318 /*********************************************************************
319 Cleanup
320 ********************************************************************/
321
322 static void free_attr_list( char **list )
323 {
324 int i = 0;
325
326 if ( !list )
327 return;
328
329 while ( list[i] )
330 SAFE_FREE( list[i] );
331
332 SAFE_FREE( list );
333 }
334
335 /**********************************************************************
336 return the list of attribute names given a user schema version
337 **********************************************************************/
338
339 static char** get_userattr_list( int schema_ver )
340 {
341 switch ( schema_ver )
342 {
343 case SCHEMAVER_SAMBAACCOUNT:
344 return get_attr_list( attrib_map_v22 );
345
346 case SCHEMAVER_SAMBASAMACCOUNT:
347 return get_attr_list( attrib_map_v30 );
348 default:
349 DEBUG(0,("get_userattr_list: unknown schema version specified!\n"));
350 break;
351 }
352
353 return NULL;
354 }
355
356 /*******************************************************************
357 find the ldap password
358 ******************************************************************/
359 static BOOL fetch_ldapsam_pw(char **dn, char** pw)
360 {
361 char *key = NULL;
362 size_t size;
363
364 *dn = smb_xstrdup(lp_ldap_admin_dn());
365
366 if (asprintf(&key, "%s/%s", SECRETS_LDAP_BIND_PW, *dn) < 0) {
367 SAFE_FREE(*dn);
368 DEBUG(0, ("fetch_ldapsam_pw: asprintf failed!\n"));
369 }
370
371 *pw=secrets_fetch(key, &size);
372 SAFE_FREE(key);
373
374 if (!size) {
375 /* Upgrade 2.2 style entry */
376 char *p;
377 char* old_style_key = strdup(*dn);
378 char *data;
379 fstring old_style_pw;
380
381 if (!old_style_key) {
382 DEBUG(0, ("fetch_ldapsam_pw: strdup failed!\n"));
383 return False;
384 }
385
386 for (p=old_style_key; *p; p++)
387 if (*p == ',') *p = '/';
388
389 data=secrets_fetch(old_style_key, &size);
390 if (!size && size < sizeof(old_style_pw)) {
391 DEBUG(0,("fetch_ldap_pw: neither ldap secret retrieved!\n"));
392 SAFE_FREE(old_style_key);
393 SAFE_FREE(*dn);
394 return False;
395 }
396
397 strncpy(old_style_pw, data, size);
398 old_style_pw[size] = 0;
399
400 SAFE_FREE(data);
401
402 if (!secrets_store_ldap_pw(*dn, old_style_pw)) {
403 DEBUG(0,("fetch_ldap_pw: ldap secret could not be upgraded!\n"));
404 SAFE_FREE(old_style_key);
405 SAFE_FREE(*dn);
406 return False;
407 }
408 if (!secrets_delete(old_style_key)) {
409 DEBUG(0,("fetch_ldap_pw: old ldap secret could not be deleted!\n"));
410 }
411
412 SAFE_FREE(old_style_key);
413
414 *pw = smb_xstrdup(old_style_pw);
415 }
416
417 return True;
418 }
419
420 /*******************************************************************
421 open a connection to the ldap server.
422 ******************************************************************/
423 static int ldapsam_open_connection (struct ldapsam_privates *ldap_state, LDAP ** ldap_struct)
424 {
425 int rc = LDAP_SUCCESS;
426 int version;
427 BOOL ldap_v3 = False;
428
429 #ifdef HAVE_LDAP_INITIALIZE
430 DEBUG(10, ("ldapsam_open_connection: %s\n", ldap_state->uri));
431
432 if ((rc = ldap_initialize(ldap_struct, ldap_state->uri)) != LDAP_SUCCESS) {
433 DEBUG(0, ("ldap_initialize: %s\n", ldap_err2string(rc)));
434 return rc;
435 }
436
437 #else
438
439 /* Parse the string manually */
440
441 {
442 int port = 0;
443 fstring protocol;
444 fstring host;
445 const char *p = ldap_state->uri;
446 SMB_ASSERT(sizeof(protocol)>10 && sizeof(host)>254);
447
448 /* skip leading "URL:" (if any) */
449 if ( strncasecmp( p, "URL:", 4 ) == 0 ) {
450 p += 4;
451 }
452
453 sscanf(p, "%10[^:]://%254s[^:]:%d", protocol, host, &port);
454
455 if (port == 0) {
456 if (strequal(protocol, "ldap")) {
457 port = LDAP_PORT;
458 } else if (strequal(protocol, "ldaps")) {
459 port = LDAPS_PORT;
460 } else {
461 DEBUG(0, ("unrecognised protocol (%s)!\n", protocol));
462 }
463 }
464
465 if ((*ldap_struct = ldap_init(host, port)) == NULL) {
466 DEBUG(0, ("ldap_init failed !\n"));
467 return LDAP_OPERATIONS_ERROR;
468 }
469
470 if (strequal(protocol, "ldaps")) {
471 #ifdef LDAP_OPT_X_TLS
472 int tls = LDAP_OPT_X_TLS_HARD;
473 if (ldap_set_option (*ldap_struct, LDAP_OPT_X_TLS, &tls) != LDAP_SUCCESS)
474 {
475 DEBUG(0, ("Failed to setup a TLS session\n"));
476 }
477
478 DEBUG(3,("LDAPS option set...!\n"));
479 #else
480 DEBUG(0,("ldapsam_open_connection: Secure connection not supported by LDAP client libraries!\n"));
481 return LDAP_OPERATIONS_ERROR;
482 #endif
483 }
484 }
485 #endif
486
487 if (ldap_get_option(*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS)
488 {
489 if (version != LDAP_VERSION3)
490 {
491 version = LDAP_VERSION3;
492 if (ldap_set_option (*ldap_struct, LDAP_OPT_PROTOCOL_VERSION, &version) == LDAP_OPT_SUCCESS) {
493 ldap_v3 = True;
494 }
495 } else {
496 ldap_v3 = True;
497 }
498 }
499
500 if (lp_ldap_ssl() == LDAP_SSL_START_TLS) {
501 #ifdef LDAP_OPT_X_TLS
502 if (ldap_v3) {
503 if ((rc = ldap_start_tls_s (*ldap_struct, NULL, NULL)) != LDAP_SUCCESS)
504 {
505 DEBUG(0,("Failed to issue the StartTLS instruction: %s\n",
506 ldap_err2string(rc)));
507 return rc;
508 }
509 DEBUG (3, ("StartTLS issued: using a TLS connection\n"));
510 } else {
511
512 DEBUG(0, ("Need LDAPv3 for Start TLS\n"));
513 return LDAP_OPERATIONS_ERROR;
514 }
515 #else
516 DEBUG(0,("ldapsam_open_connection: StartTLS not supported by LDAP client libraries!\n"));
517 return LDAP_OPERATIONS_ERROR;
518 #endif
519 }
520
521 DEBUG(2, ("ldapsam_open_connection: connection opened\n"));
522 return rc;
523 }
524
525
526 /*******************************************************************
527 a rebind function for authenticated referrals
528 This version takes a void* that we can shove useful stuff in :-)
529 ******************************************************************/
530 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
531 #else
532 static int rebindproc_with_state (LDAP * ld, char **whop, char **credp,
533 int *methodp, int freeit, void *arg)
534 {
535 struct ldapsam_privates *ldap_state = arg;
536
537 /** @TODO Should we be doing something to check what servers we rebind to?
538 Could we get a referral to a machine that we don't want to give our
539 username and password to? */
540
541 if (freeit) {
542 SAFE_FREE(*whop);
543 memset(*credp, '\0', strlen(*credp));
544 SAFE_FREE(*credp);
545 } else {
546 DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n",
547 ldap_state->bind_dn));
548
549 *whop = strdup(ldap_state->bind_dn);
550 if (!*whop) {
551 return LDAP_NO_MEMORY;
552 }
553 *credp = strdup(ldap_state->bind_secret);
554 if (!*credp) {
555 SAFE_FREE(*whop);
556 return LDAP_NO_MEMORY;
557 }
558 *methodp = LDAP_AUTH_SIMPLE;
559 }
560 return 0;
561 }
562 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
563
564 /*******************************************************************
565 a rebind function for authenticated referrals
566 This version takes a void* that we can shove useful stuff in :-)
567 and actually does the connection.
568 ******************************************************************/
569 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
570 static int rebindproc_connect_with_state (LDAP *ldap_struct,
571 LDAP_CONST char *url,
572 ber_tag_t request,
573 ber_int_t msgid, void *arg)
574 {
575 struct ldapsam_privates *ldap_state = arg;
576 int rc;
577 DEBUG(5,("rebindproc_connect_with_state: Rebinding as \"%s\"\n",
578 ldap_state->bind_dn));
579
580 /** @TODO Should we be doing something to check what servers we rebind to?
581 Could we get a referral to a machine that we don't want to give our
582 username and password to? */
583
584 rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret);
585
586 return rc;
587 }
588 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
589
590 /*******************************************************************
591 Add a rebind function for authenticated referrals
592 ******************************************************************/
593 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
594 #else
595 # if LDAP_SET_REBIND_PROC_ARGS == 2
596 static int rebindproc (LDAP *ldap_struct, char **whop, char **credp,
597 int *method, int freeit )
598 {
599 return rebindproc_with_state(ldap_struct, whop, credp,
600 method, freeit, static_ldap_state);
601
602 }
603 # endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/
604 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
605
606 /*******************************************************************
607 a rebind function for authenticated referrals
608 this also does the connection, but no void*.
609 ******************************************************************/
610 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
611 # if LDAP_SET_REBIND_PROC_ARGS == 2
612 static int rebindproc_connect (LDAP * ld, LDAP_CONST char *url, int request,
613 ber_int_t msgid)
614 {
615 return rebindproc_connect_with_state(ld, url, (ber_tag_t)request, msgid,
616 static_ldap_state);
617 }
618 # endif /*LDAP_SET_REBIND_PROC_ARGS == 2*/
619 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
620
621 /*******************************************************************
622 connect to the ldap server under system privilege.
623 ******************************************************************/
624 static int ldapsam_connect_system(struct ldapsam_privates *ldap_state, LDAP * ldap_struct)
625 {
626 int rc;
627 char *ldap_dn;
628 char *ldap_secret;
629
630 /* The rebind proc needs this *HACK*. We are not multithreaded, so
631 this will work, but it's not nice. */
632 static_ldap_state = ldap_state;
633
634 /* get the password */
635 if (!fetch_ldapsam_pw(&ldap_dn, &ldap_secret))
636 {
637 DEBUG(0, ("ldap_connect_system: Failed to retrieve password from secrets.tdb\n"));
638 return LDAP_INVALID_CREDENTIALS;
639 }
640
641 ldap_state->bind_dn = ldap_dn;
642 ldap_state->bind_secret = ldap_secret;
643
644 /* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite
645 (OpenLDAP) doesnt' seem to support it */
646
647 DEBUG(10,("ldap_connect_system: Binding to ldap server %s as \"%s\"\n",
648 ldap_state->uri, ldap_dn));
649
650 #if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
651 # if LDAP_SET_REBIND_PROC_ARGS == 2
652 ldap_set_rebind_proc(ldap_struct, &rebindproc_connect);
653 # endif
654 # if LDAP_SET_REBIND_PROC_ARGS == 3
655 ldap_set_rebind_proc(ldap_struct, &rebindproc_connect_with_state, (void *)ldap_state);
656 # endif
657 #else /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
658 # if LDAP_SET_REBIND_PROC_ARGS == 2
659 ldap_set_rebind_proc(ldap_struct, &rebindproc);
660 # endif
661 # if LDAP_SET_REBIND_PROC_ARGS == 3
662 ldap_set_rebind_proc(ldap_struct, &rebindproc_with_state, (void *)ldap_state);
663 # endif
664 #endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
665
666 rc = ldap_simple_bind_s(ldap_struct, ldap_dn, ldap_secret);
667
668 if (rc != LDAP_SUCCESS) {
669 char *ld_error = NULL;
670 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
671 &ld_error);
672 DEBUG(ldap_state->num_failures ? 2 : 0,
673 ("failed to bind to server with dn= %s Error: %s\n\t%s\n",
674 ldap_dn ? ld_error : "(unknown)", ldap_err2string(rc),
675 ld_error));
676 SAFE_FREE(ld_error);
677 ldap_state->num_failures++;
678 return rc;
679 }
680
681 ldap_state->num_failures = 0;
682
683 DEBUG(3, ("ldap_connect_system: succesful connection to the LDAP server\n"));
684 return rc;
685 }
686
687 /**********************************************************************
688 Connect to LDAP server
689 *********************************************************************/
690 static int ldapsam_open(struct ldapsam_privates *ldap_state)
691 {
692 int rc;
693 SMB_ASSERT(ldap_state);
694
695 #ifndef NO_LDAP_SECURITY
696 if (geteuid() != 0) {
697 DEBUG(0, ("ldapsam_open: cannot access LDAP when not root..\n"));
698 return LDAP_INSUFFICIENT_ACCESS;
699 }
700 #endif
701
702 if ((ldap_state->ldap_struct != NULL) && ((ldap_state->last_ping + LDAPSAM_DONT_PING_TIME) < time(NULL))) {
703 struct sockaddr_un addr;
704 socklen_t len = sizeof(addr);
705 int sd;
706 if (ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_DESC, &sd) == 0 &&
707 getpeername(sd, (struct sockaddr *) &addr, &len) < 0) {
708 /* the other end has died. reopen. */
709 ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL);
710 ldap_state->ldap_struct = NULL;
711 ldap_state->last_ping = (time_t)0;
712 } else {
713 ldap_state->last_ping = time(NULL);
714 }
715 }
716
717 if (ldap_state->ldap_struct != NULL) {
718 DEBUG(5,("ldapsam_open: already connected to the LDAP server\n"));
719 return LDAP_SUCCESS;
720 }
721
722 if ((rc = ldapsam_open_connection(ldap_state, &ldap_state->ldap_struct))) {
723 return rc;
724 }
725
726 if ((rc = ldapsam_connect_system(ldap_state, ldap_state->ldap_struct))) {
727 ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL);
728 ldap_state->ldap_struct = NULL;
729 return rc;
730 }
731
732
733 ldap_state->last_ping = time(NULL);
734 DEBUG(4,("The LDAP server is succesful connected\n"));
735
736 return LDAP_SUCCESS;
737 }
738
739 /**********************************************************************
740 Disconnect from LDAP server
741 *********************************************************************/
742 static NTSTATUS ldapsam_close(struct ldapsam_privates *ldap_state)
743 {
744 if (!ldap_state)
745 return NT_STATUS_INVALID_PARAMETER;
746
747 if (ldap_state->ldap_struct != NULL) {
748 ldap_unbind_ext(ldap_state->ldap_struct, NULL, NULL);
749 ldap_state->ldap_struct = NULL;
750 }
751
752 DEBUG(5,("The connection to the LDAP server was closed\n"));
753 /* maybe free the results here --metze */
754
755 return NT_STATUS_OK;
756 }
757
758 static int ldapsam_retry_open(struct ldapsam_privates *ldap_state, int *attempts)
759 {
760 int rc;
761
762 SMB_ASSERT(ldap_state && attempts);
763
764 if (*attempts != 0) {
765 unsigned int sleep_time;
766 uint8 rand_byte;
767
768 /* Sleep for a random timeout */
769 rand_byte = (char)(sys_random());
770
771 sleep_time = (((*attempts)*(*attempts))/2)*rand_byte*2;
772 /* we retry after (0.5, 1, 2, 3, 4.5, 6) seconds
773 on average.
774 */
775 DEBUG(3, ("Sleeping for %u milliseconds before reconnecting\n",
776 sleep_time));
777 msleep(sleep_time);
778 }
779 (*attempts)++;
780
781 if ((rc = ldapsam_open(ldap_state))) {
782 DEBUG(1,("Connection to LDAP Server failed for the %d try!\n",*attempts));
783 return rc;
784 }
785
786 return LDAP_SUCCESS;
787 }
788
789
790 /*********************************************************************
791 ********************************************************************/
792
793 static int ldapsam_search(struct ldapsam_privates *ldap_state,
794 const char *base, int scope, const char *filter,
795 char *attrs[], int attrsonly,
796 LDAPMessage **res)
797 {
798 int rc = LDAP_SERVER_DOWN;
799 int attempts = 0;
800 char *utf8_filter;
801
802 SMB_ASSERT(ldap_state);
803
804 if (push_utf8_allocate(&utf8_filter, filter) == (size_t)-1) {
805 return LDAP_NO_MEMORY;
806 }
807
808 while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) {
809
810 if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS)
811 continue;
812
813 rc = ldap_search_s(ldap_state->ldap_struct, base, scope,
814 utf8_filter, attrs, attrsonly, res);
815 }
816
817 if (rc == LDAP_SERVER_DOWN) {
818 DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO));
819 ldapsam_close(ldap_state);
820 }
821
822 SAFE_FREE(utf8_filter);
823 return rc;
824 }
825
826 static int ldapsam_modify(struct ldapsam_privates *ldap_state, const char *dn, LDAPMod *attrs[])
827 {
828 int rc = LDAP_SERVER_DOWN;
829 int attempts = 0;
830 char *utf8_dn;
831
832 SMB_ASSERT(ldap_state);
833
834 if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) {
835 return LDAP_NO_MEMORY;
836 }
837
838 while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) {
839
840 if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS)
841 continue;
842
843 rc = ldap_modify_s(ldap_state->ldap_struct, utf8_dn, attrs);
844 }
845
846 if (rc == LDAP_SERVER_DOWN) {
847 DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO));
848 ldapsam_close(ldap_state);
849 }
850
851 SAFE_FREE(utf8_dn);
852 return rc;
853 }
854
855 static int ldapsam_add(struct ldapsam_privates *ldap_state, const char *dn, LDAPMod *attrs[])
856 {
857 int rc = LDAP_SERVER_DOWN;
858 int attempts = 0;
859 char *utf8_dn;
860
861 SMB_ASSERT(ldap_state);
862
863 if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) {
864 return LDAP_NO_MEMORY;
865 }
866
867 while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) {
868
869 if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS)
870 continue;
871
872 rc = ldap_add_s(ldap_state->ldap_struct, utf8_dn, attrs);
873 }
874
875 if (rc == LDAP_SERVER_DOWN) {
876 DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO));
877 ldapsam_close(ldap_state);
878 }
879
880 SAFE_FREE(utf8_dn);
881 return rc;
882 }
883
884 static int ldapsam_delete(struct ldapsam_privates *ldap_state, char *dn)
885 {
886 int rc = LDAP_SERVER_DOWN;
887 int attempts = 0;
888 char *utf8_dn;
889
890 SMB_ASSERT(ldap_state);
891
892 if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) {
893 return LDAP_NO_MEMORY;
894 }
895
896 while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) {
897
898 if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS)
899 continue;
900
901 rc = ldap_delete_s(ldap_state->ldap_struct, utf8_dn);
902 }
903
904 if (rc == LDAP_SERVER_DOWN) {
905 DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO));
906 ldapsam_close(ldap_state);
907 }
908
909 SAFE_FREE(utf8_dn);
910 return rc;
911 }
912
913 #ifdef LDAP_EXOP_X_MODIFY_PASSWD
914 static int ldapsam_extended_operation(struct ldapsam_privates *ldap_state, LDAP_CONST char *reqoid, struct berval *reqdata, LDAPControl **serverctrls, LDAPControl **clientctrls, char **retoidp, struct berval **retdatap)
915 {
916 int rc = LDAP_SERVER_DOWN;
917 int attempts = 0;
918
919 if (!ldap_state)
920 return (-1);
921
922 while ((rc == LDAP_SERVER_DOWN) && (attempts < 8)) {
923
924 if ((rc = ldapsam_retry_open(ldap_state,&attempts)) != LDAP_SUCCESS)
925 continue;
926
927 rc = ldap_extended_operation_s(ldap_state->ldap_struct, reqoid, reqdata, serverctrls, clientctrls, retoidp, retdatap);
928 }
929
930 if (rc == LDAP_SERVER_DOWN) {
931 DEBUG(0,("%s: LDAP server is down!\n",FUNCTION_MACRO));
932 ldapsam_close(ldap_state);
933 }
934
935 return rc;
936 }
937 #endif
938
939 /*******************************************************************
940 run the search by name.
941 ******************************************************************/
942 static int ldapsam_search_suffix (struct ldapsam_privates *ldap_state, const char *filter,
943 char **search_attr, LDAPMessage ** result)
944 {
945 int scope = LDAP_SCOPE_SUBTREE;
946 int rc;
947
948 DEBUG(2, ("ldapsam_search_suffix: searching for:[%s]\n", filter));
949
950 rc = ldapsam_search(ldap_state, lp_ldap_suffix(), scope, filter, search_attr, 0, result);
951
952 if (rc != LDAP_SUCCESS) {
953 char *ld_error = NULL;
954 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
955 &ld_error);
956 DEBUG(0,("ldapsam_search_suffix: Problem during the LDAP search: %s (%s)\n",
957 ld_error?ld_error:"(unknown)", ldap_err2string (rc)));
958 DEBUG(3,("ldapsam_search_suffix: Query was: %s, %s\n", lp_ldap_suffix(),
959 filter));
960 SAFE_FREE(ld_error);
961 }
962
963 return rc;
964 }
965
966 /*******************************************************************
967 generate the LDAP search filter for the objectclass based on the
968 version of the schema we are using
969 ******************************************************************/
970
971 static const char* get_objclass_filter( int schema_ver )
972 {
973 static fstring objclass_filter;
974
975 switch( schema_ver )
976 {
977 case SCHEMAVER_SAMBAACCOUNT:
978 snprintf( objclass_filter, sizeof(objclass_filter)-1, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT );
979 break;
980 case SCHEMAVER_SAMBASAMACCOUNT:
981 snprintf( objclass_filter, sizeof(objclass_filter)-1, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT );
982 break;
983 default:
984 DEBUG(0,("ldapsam_search_suffix_by_name(): Invalid schema version specified!\n"));
985 break;
986 }
987
988 return objclass_filter;
989 }
990
991 /*******************************************************************
992 run the search by name.
993 ******************************************************************/
994 static int ldapsam_search_suffix_by_name (struct ldapsam_privates *ldap_state, const char *user,
995 LDAPMessage ** result, char **attr)
996 {
997 pstring filter;
998 char *escape_user = escape_ldap_string_alloc(user);
999
1000 if (!escape_user) {
1001 return LDAP_NO_MEMORY;
1002 }
1003
1004 /*
1005 * in the filter expression, replace %u with the real name
1006 * so in ldap filter, %u MUST exist :-)
1007 */
1008 snprintf(filter, sizeof(filter)-1, "(&%s%s)", lp_ldap_filter(),
1009 get_objclass_filter(ldap_state->schema_ver));
1010
1011 /*
1012 * have to use this here because $ is filtered out
1013 * in pstring_sub
1014 */
1015
1016
1017 all_string_sub(filter, "%u", escape_user, sizeof(pstring));
1018 SAFE_FREE(escape_user);
1019
1020 return ldapsam_search_suffix(ldap_state, filter, attr, result);
1021 }
1022
1023 /*******************************************************************
1024 run the search by rid.
1025 ******************************************************************/
1026 static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
1027 uint32 rid, LDAPMessage ** result,
1028 char **attr)
1029 {
1030 pstring filter;
1031 int rc;
1032
1033 /* check if the user rid exists, if not, try searching on the uid */
1034
1035 snprintf(filter, sizeof(filter)-1, "(&(rid=%i)%s)", rid,
1036 get_objclass_filter(ldap_state->schema_ver));
1037
1038 rc = ldapsam_search_suffix(ldap_state, filter, attr, result);
1039
1040 return rc;
1041 }
1042
1043 /*******************************************************************
1044 run the search by SID.
1045 ******************************************************************/
1046 static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
1047 const DOM_SID *sid, LDAPMessage ** result,
1048 char **attr)
1049 {
1050 pstring filter;
1051 int rc;
1052 fstring sid_string;
1053
1054 /* check if the user rid exsists, if not, try searching on the uid */
1055
1056 snprintf(filter, sizeof(filter)-1, "(&(%s=%s)%s)",
1057 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
1058 sid_to_string(sid_string, sid),
1059 get_objclass_filter(ldap_state->schema_ver));
1060
1061 rc = ldapsam_search_suffix(ldap_state, filter, attr, result);
1062
1063 return rc;
1064 }
1065
1066 /*******************************************************************
1067 search an attribute and return the first value found.
1068 ******************************************************************/
1069 static BOOL get_single_attribute (LDAP * ldap_struct, LDAPMessage * entry,
1070 const char *attribute, pstring value)
1071 {
1072 char **values;
1073
1074 if ( !attribute )
1075 return False;
1076
1077 value[0] = '\0';
1078
1079 if ((values = ldap_get_values (ldap_struct, entry, attribute)) == NULL) {
1080 DEBUG (10, ("get_single_attribute: [%s] = [<does not exist>]\n", attribute));
1081
1082 return False;
1083 }
1084
1085 if (convert_string(CH_UTF8, CH_UNIX,values[0], -1, value, sizeof(pstring)) == (size_t)-1)
1086 {
1087 DEBUG(1, ("get_single_attribute: string conversion of [%s] = [%s] failed!\n",
1088 attribute, values[0]));
1089 ldap_value_free(values);
1090 return False;
1091 }
1092
1093 ldap_value_free(values);
1094 #ifdef DEBUG_PASSWORDS
1095 DEBUG (100, ("get_single_attribute: [%s] = [%s]\n", attribute, value));
1096 #endif
1097 return True;
1098 }
1099
1100 /************************************************************************
1101 Routine to manage the LDAPMod structure array
1102 manage memory used by the array, by each struct, and values
1103
1104 ************************************************************************/
1105 static void make_a_mod (LDAPMod *** modlist, int modop, const char *attribute, const char *value)
1106 {
1107 LDAPMod **mods;
1108 int i;
1109 int j;
1110
1111 mods = *modlist;
1112
1113 /* sanity checks on the mod values */
1114
1115 if (attribute == NULL || *attribute == '\0')
1116 return;
1117 #if 0 /* commented out after discussion with abartlet. Do not reenable.
1118 left here so other so re-add similar code --jerry */
1119 if (value == NULL || *value == '\0')
1120 return;
1121 #endif
1122
1123 if (mods == NULL)
1124 {
1125 mods = (LDAPMod **) malloc(sizeof(LDAPMod *));
1126 if (mods == NULL)
1127 {
1128 DEBUG(0, ("make_a_mod: out of memory!\n"));
1129 return;
1130 }
1131 mods[0] = NULL;
1132 }
1133
1134 for (i = 0; mods[i] != NULL; ++i) {
1135 if (mods[i]->mod_op == modop && !strcasecmp(mods[i]->mod_type, attribute))
1136 break;
1137 }
1138
1139 if (mods[i] == NULL)
1140 {
1141 mods = (LDAPMod **) Realloc (mods, (i + 2) * sizeof (LDAPMod *));
1142 if (mods == NULL)
1143 {
1144 DEBUG(0, ("make_a_mod: out of memory!\n"));
1145 return;
1146 }
1147 mods[i] = (LDAPMod *) malloc(sizeof(LDAPMod));
1148 if (mods[i] == NULL)
1149 {
1150 DEBUG(0, ("make_a_mod: out of memory!\n"));
1151 return;
1152 }
1153 mods[i]->mod_op = modop;
1154 mods[i]->mod_values = NULL;
1155 mods[i]->mod_type = strdup(attribute);
1156 mods[i + 1] = NULL;
1157 }
1158
1159 if (value != NULL)
1160 {
1161 char *utf8_value = NULL;
1162
1163 j = 0;
1164 if (mods[i]->mod_values != NULL) {
1165 for (; mods[i]->mod_values[j] != NULL; j++);
1166 }
1167 mods[i]->mod_values = (char **)Realloc(mods[i]->mod_values,
1168 (j + 2) * sizeof (char *));
1169
1170 if (mods[i]->mod_values == NULL) {
1171 DEBUG (0, ("make_a_mod: Memory allocation failure!\n"));
1172 return;
1173 }
1174
1175 if (push_utf8_allocate(&utf8_value, value) == (size_t)-1) {
1176 DEBUG (0, ("make_a_mod: String conversion failure!\n"));
1177 return;
1178 }
1179
1180 mods[i]->mod_values[j] = utf8_value;
1181
1182 mods[i]->mod_values[j + 1] = NULL;
1183 }
1184 *modlist = mods;
1185 }
1186
1187 /**********************************************************************
1188 Set attribute to newval in LDAP, regardless of what value the
1189 attribute had in LDAP before.
1190 *********************************************************************/
1191 static void make_ldap_mod(LDAP *ldap_struct, LDAPMessage *existing,
1192 LDAPMod ***mods,
1193 const char *attribute, const char *newval)
1194 {
1195 char **values = NULL;
1196
1197 if (existing != NULL) {
1198 values = ldap_get_values(ldap_struct, existing, attribute);
1199 }
1200
1201 if ((values != NULL) && (values[0] != NULL) &&
1202 strcmp(values[0], newval) == 0) {
1203
1204 /* Believe it or not, but LDAP will deny a delete and
1205 an add at the same time if the values are the
1206 same... */
1207
1208 ldap_value_free(values);
1209 return;
1210 }
1211
1212 /* Regardless of the real operation (add or modify)
1213 we add the new value here. We rely on deleting
1214 the old value, should it exist. */
1215
1216 if ((newval != NULL) && (strlen(newval) > 0)) {
1217 make_a_mod(mods, LDAP_MOD_ADD, attribute, newval);
1218 }
1219
1220 if (values == NULL) {
1221 /* There has been no value before, so don't delete it.
1222 Here's a possible race: We might end up with
1223 duplicate attributes */
1224 return;
1225 }
1226
1227 /* By deleting exactly the value we found in the entry this
1228 should be race-free in the sense that the LDAP-Server will
1229 deny the complete operation if somebody changed the
1230 attribute behind our back. */
1231
1232 make_a_mod(mods, LDAP_MOD_DELETE, attribute, values[0]);
1233 ldap_value_free(values);
1234 }
1235
1236 /*******************************************************************
1237 Delete complete object or objectclass and attrs from
1238 object found in search_result depending on lp_ldap_delete_dn
1239 ******************************************************************/
1240 static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state,
1241 LDAPMessage *result,
1242 const char *objectclass,
1243 char **attrs)
1244 {
1245 int rc;
1246 LDAPMessage *entry;
1247 LDAPMod **mods = NULL;
1248 char *name, *dn;
1249 BerElement *ptr = NULL;
1250
1251 rc = ldap_count_entries(ldap_state->ldap_struct, result);
1252
1253 if (rc != 1) {
1254 DEBUG(0, ("Entry must exist exactly once!\n"));
1255 return NT_STATUS_UNSUCCESSFUL;
1256 }
1257
1258 entry = ldap_first_entry(ldap_state->ldap_struct, result);
1259 dn = ldap_get_dn(ldap_state->ldap_struct, entry);
1260
1261 if (lp_ldap_delete_dn()) {
1262 NTSTATUS ret = NT_STATUS_OK;
1263 rc = ldapsam_delete(ldap_state, dn);
1264
1265 if (rc != LDAP_SUCCESS) {
1266 DEBUG(0, ("Could not delete object %s\n", dn));
1267 ret = NT_STATUS_UNSUCCESSFUL;
1268 }
1269 ldap_memfree(dn);
1270 return ret;
1271 }
1272
1273 /* Ok, delete only the SAM attributes */
1274
1275 for (name = ldap_first_attribute(ldap_state->ldap_struct, entry, &ptr);
1276 name != NULL;
1277 name = ldap_next_attribute(ldap_state->ldap_struct, entry, ptr))
1278 {
1279 char **attrib;
1280
1281 /* We are only allowed to delete the attributes that
1282 really exist. */
1283
1284 for (attrib = attrs; *attrib != NULL; attrib++)
1285 {
1286 if (StrCaseCmp(*attrib, name) == 0) {
1287 DEBUG(10, ("deleting attribute %s\n", name));
1288 make_a_mod(&mods, LDAP_MOD_DELETE, name, NULL);
1289 }
1290 }
1291
1292 ldap_memfree(name);
1293 }
1294
1295 if (ptr != NULL) {
1296 ber_free(ptr, 0);
1297 }
1298
1299 make_a_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
1300
1301 rc = ldapsam_modify(ldap_state, dn, mods);
1302 ldap_mods_free(mods, 1);
1303
1304 if (rc != LDAP_SUCCESS) {
1305 char *ld_error = NULL;
1306 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1307 &ld_error);
1308
1309 DEBUG(0, ("could not delete attributes for %s, error: %s (%s)\n",
1310 dn, ldap_err2string(rc), ld_error?ld_error:"unknown"));
1311 SAFE_FREE(ld_error);
1312 ldap_memfree(dn);
1313 return NT_STATUS_UNSUCCESSFUL;
1314 }
1315
1316 ldap_memfree(dn);
1317 return NT_STATUS_OK;
1318 }
1319
1320 /**********************************************************************
1321 Search for the domain info entry
1322 *********************************************************************/
1323 static int ldapsam_search_domain_info(struct ldapsam_privates *ldap_state,
1324 LDAPMessage ** result)
1325 {
1326 pstring filter;
1327 int rc;
1328 char **attr_list;
1329
1330 snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%s))",
1331 LDAP_OBJ_DOMINFO,
1332 get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN),
1333 ldap_state->domain_name);
1334
1335 DEBUG(2, ("Searching for:[%s]\n", filter));
1336
1337
1338 attr_list = get_attr_list( dominfo_attr_list );
1339 rc = ldapsam_search_suffix(ldap_state, filter, attr_list , result);
1340 free_attr_list( attr_list );
1341
1342 if (rc != LDAP_SUCCESS) {
1343 DEBUG(2,("Problem during LDAPsearch: %s\n", ldap_err2string (rc)));
1344 DEBUG(2,("Query was: %s, %s\n", lp_ldap_suffix(), filter));
1345 }
1346
1347 return rc;
1348 }
1349
1350 /**********************************************************************
1351 If this entry is is the 'allocated' range, extract the RID and return
1352 it, so we can find the 'next' rid to allocate.
1353
1354 Do this, no matter what type of object holds the RID - be it a user,
1355 group or somthing else.
1356 *********************************************************************/
1357 static uint32 entry_to_rid(struct ldapsam_privates *ldap_state, LDAPMessage *entry, int rid_type)
1358 {
1359 pstring sid_string;
1360 DOM_SID dom_sid;
1361 uint32 rid;
1362
1363 if (!get_single_attribute(ldap_state->ldap_struct, entry,
1364 LDAP_ATTRIBUTE_SID, sid_string))
1365 {
1366 return 0;
1367 }
1368
1369 if (!string_to_sid(&dom_sid, sid_string)) {
1370 return 0;
1371 }
1372
1373 if (!sid_peek_check_rid(&dom_sid, get_global_sam_sid(), &rid)) {
1374 /* not our domain, so we don't care */
1375 return 0;
1376 }
1377
1378 switch (rid_type) {
1379 case USER_RID_TYPE:
1380 if (rid >= ldap_state->low_allocated_user_rid &&
1381 rid <= ldap_state->high_allocated_user_rid) {
1382 return rid;
1383 }
1384 break;
1385 case GROUP_RID_TYPE:
1386 if (rid >= ldap_state->low_allocated_group_rid &&
1387 rid <= ldap_state->high_allocated_group_rid) {
1388 return rid;
1389 }
1390 break;
1391 }
1392 return 0;
1393 }
1394
1395
1396 /**********************************************************************
1397 Connect to LDAP server and find the next available 'allocated' RID.
1398
1399 The search is done 'per type' as we allocate seperate pools for the
1400 EVEN and ODD (user and group) RIDs.
1401
1402 This is only done once, so that we can fill out the sambaDomain.
1403 *********************************************************************/
1404 static uint32 search_next_allocated_rid(struct ldapsam_privates *ldap_state, int rid_type)
1405 {
1406 int rc;
1407 LDAPMessage *result;
1408 LDAPMessage *entry;
1409 uint32 top_rid = 0;
1410 uint32 next_rid;
1411 uint32 count;
1412 uint32 rid;
1413 char *sid_attr[] = {LDAP_ATTRIBUTE_SID, NULL};
1414 fstring filter;
1415
1416 snprintf( filter, sizeof(filter)-1, "(%s=*)", LDAP_ATTRIBUTE_SID );
1417
1418 DEBUG(2, ("search_top_allocated_rid: searching for:[%s]\n", filter));
1419
1420 rc = ldapsam_search_suffix(ldap_state, filter, sid_attr, &result);
1421
1422 if (rc != LDAP_SUCCESS) {
1423 DEBUG(3, ("LDAP search failed! cannot find base for NUA RIDs: %s\n", ldap_err2string(rc)));
1424 DEBUGADD(3, ("Query was: %s, %s\n", lp_ldap_suffix(), filter));
1425
1426 result = NULL;
1427 return 0;
1428 }
1429
1430 count = ldap_count_entries(ldap_state->ldap_struct, result);
1431 DEBUG(2, ("search_top_allocated_rid: %d entries in the base!\n", count));
1432
1433 if (count == 0) {
1434 DEBUG(3, ("LDAP search returned no records, assuming no allocated RIDs present!: %s\n", ldap_err2string(rc)));
1435 DEBUGADD(3, ("Query was: %s, %s\n", lp_ldap_suffix(), filter));
1436 } else {
1437 entry = ldap_first_entry(ldap_state->ldap_struct,result);
1438
1439 top_rid = entry_to_rid(ldap_state, entry, rid_type);
1440
1441 while ((entry = ldap_next_entry(ldap_state->ldap_struct, entry))) {
1442
1443 rid = entry_to_rid(ldap_state, entry, rid_type);
1444 if (((rid & ~RID_TYPE_MASK) == rid_type) && (rid > top_rid)) {
1445 top_rid = rid;
1446 }
1447 }
1448 }
1449
1450 switch (rid_type) {
1451 case USER_RID_TYPE:
1452 if (top_rid < ldap_state->low_allocated_user_rid) {
1453 return ldap_state->low_allocated_user_rid;
1454 }
1455 break;
1456 case GROUP_RID_TYPE:
1457 if (top_rid < ldap_state->low_allocated_group_rid)
1458 return ldap_state->low_allocated_group_rid;
1459 break;
1460 }
1461
1462 next_rid = (top_rid & ~RID_TYPE_MASK) + rid_type + RID_MULTIPLIER;
1463
1464 switch (rid_type) {
1465 case USER_RID_TYPE:
1466 if (next_rid > ldap_state->high_allocated_user_rid) {
1467 return 0;
1468 }
1469 break;
1470 case GROUP_RID_TYPE:
1471 if (next_rid > ldap_state->high_allocated_group_rid) {
1472 return 0;
1473 }
1474 break;
1475 }
1476 return next_rid;
1477 }
1478
1479 /**********************************************************************
1480 Add the sambaDomain to LDAP, so we don't have to search for this stuff
1481 again. This is a once-add operation for now.
1482
1483 TODO: Add other attributes, and allow modification.
1484 *********************************************************************/
1485 static NTSTATUS add_new_domain_info(struct ldapsam_privates *ldap_state)
1486 {
1487 pstring tmp;
1488 pstring filter;
1489 LDAPMod **mods = NULL;
1490 int rc;
1491 int ldap_op;
1492 LDAPMessage *result = NULL;
1493 char *dn = NULL;
1494 int num_result;
1495 char **attr_list;
1496
1497 uint32 next_allocated_user_rid;
1498 uint32 next_allocated_group_rid;
1499
1500 next_allocated_user_rid = search_next_allocated_rid(ldap_state, USER_RID_TYPE);
1501 if (!next_allocated_user_rid) {
1502 return NT_STATUS_UNSUCCESSFUL;
1503 }
1504
1505 next_allocated_group_rid = search_next_allocated_rid(ldap_state, GROUP_RID_TYPE);
1506 if (!next_allocated_group_rid) {
1507 return NT_STATUS_UNSUCCESSFUL;
1508 }
1509
1510 slprintf (filter, sizeof (filter) - 1, "(&(%s=%s)(objectclass=%s))",
1511 get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN),
1512 ldap_state->domain_name, LDAP_OBJ_DOMINFO);
1513
1514 attr_list = get_attr_list( dominfo_attr_list );
1515 rc = ldapsam_search_suffix(ldap_state, filter, attr_list, &result);
1516 free_attr_list( attr_list );
1517
1518 if (rc != LDAP_SUCCESS) {
1519 return NT_STATUS_UNSUCCESSFUL;
1520 }
1521
1522 num_result = ldap_count_entries(ldap_state->ldap_struct, result);
1523
1524 if (num_result > 1) {
1525 DEBUG (0, ("More than domain with that name exists: bailing out!\n"));
1526 ldap_msgfree(result);
1527 return NT_STATUS_UNSUCCESSFUL;
1528 }
1529
1530 /* Check if we need to add an entry */
1531 DEBUG(3,("Adding new domain\n"));
1532 ldap_op = LDAP_MOD_ADD;
1533 asprintf (&dn, "%s=%s,%s", get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN),
1534 ldap_state->domain_name, lp_ldap_suffix());
1535
1536 /* Free original search */
1537 ldap_msgfree(result);
1538
1539 if (!dn)
1540 return NT_STATUS_NO_MEMORY;
1541
1542 /* make the changes - the entry *must* not already have samba attributes */
1543 make_a_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOMAIN),
1544 ldap_state->domain_name);
1545
1546 sid_to_string(tmp, &ldap_state->domain_sid);
1547 make_a_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOM_SID), tmp);
1548
1549 snprintf(tmp, sizeof(tmp)-1, "%i", next_allocated_user_rid);
1550 make_a_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_USERRID), tmp);
1551
1552 snprintf(tmp, sizeof(tmp)-1, "%i", next_allocated_group_rid);
1553 make_a_mod(&mods, LDAP_MOD_ADD, get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_GROUPRID), tmp);
1554
1555 make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_DOMINFO);
1556
1557 switch(ldap_op)
1558 {
1559 case LDAP_MOD_ADD:
1560 rc = ldapsam_add(ldap_state, dn, mods);
1561 break;
1562 case LDAP_MOD_REPLACE:
1563 rc = ldapsam_modify(ldap_state, dn, mods);
1564 break;
1565 default:
1566 DEBUG(0,("Wrong LDAP operation type: %d!\n", ldap_op));
1567 return NT_STATUS_INVALID_PARAMETER;
1568 }
1569
1570 if (rc!=LDAP_SUCCESS) {
1571 char *ld_error = NULL;
1572 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1573 &ld_error);
1574 DEBUG(1,
1575 ("failed to %s domain dn= %s with: %s\n\t%s\n",
1576 ldap_op == LDAP_MOD_ADD ? "add" : "modify",
1577 dn, ldap_err2string(rc),
1578 ld_error?ld_error:"unknown"));
1579 SAFE_FREE(ld_error);
1580
1581 ldap_mods_free(mods,1);
1582 return NT_STATUS_UNSUCCESSFUL;
1583 }
1584
1585 DEBUG(2,("added: domain = %s in the LDAP database\n", ldap_state->domain_name));
1586 ldap_mods_free(mods, 1);
1587 return NT_STATUS_OK;
1588 }
1589
1590 /**********************************************************************
1591 Even if the sambaAccount attribute in LDAP tells us that this RID is
1592 safe to use, always check before use.
1593 *********************************************************************/
1594 static BOOL sid_in_use(struct ldapsam_privates *ldap_state,
1595 const DOM_SID *sid, int *error)
1596 {
1597 fstring filter;
1598 fstring sid_string;
1599 LDAPMessage *result = NULL;
1600 int count;
1601 int rc;
1602 char *sid_attr[] = {LDAP_ATTRIBUTE_SID, NULL};
1603
1604 slprintf(filter, sizeof(filter)-1, "(%s=%s)", LDAP_ATTRIBUTE_SID, sid_to_string(sid_string, sid));
1605
1606 rc = ldapsam_search_suffix(ldap_state, filter, sid_attr, &result);
1607
1608 if (rc != LDAP_SUCCESS) {
1609 char *ld_error = NULL;
1610 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error);
1611 DEBUG(2, ("Failed to check if sid %s is alredy in use: %s\n",
1612 sid_string, ld_error));
1613 SAFE_FREE(ld_error);
1614
1615 *error = rc;
1616 return True;
1617 }
1618
1619 if ((count = ldap_count_entries(ldap_state->ldap_struct, result)) > 0) {
1620 DEBUG(3, ("Sid %s already in use - trying next RID\n",
1621 sid_string));
1622 ldap_msgfree(result);
1623 return True;
1624 }
1625
1626 ldap_msgfree(result);
1627
1628 /* good, sid is not in use */
1629 return False;
1630 }
1631
1632 /**********************************************************************
1633 Set the new nextRid attribute, and return one we can use.
1634
1635 This also checks that this RID is actually free - in case the admin
1636 manually stole it :-).
1637 *********************************************************************/
1638 static NTSTATUS ldapsam_next_rid(struct ldapsam_privates *ldap_state, uint32 *rid, int rid_type)
1639 {
1640 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1641 int rc;
1642 LDAPMessage *result = NULL;
1643 LDAPMessage *entry = NULL;
1644 char *dn;
1645 LDAPMod **mods = NULL;
1646 int count;
1647 fstring old_rid_string;
1648 fstring next_rid_string;
1649 uint32 next_rid;
1650 int attempts = 0;
1651
1652 if ( ldap_state->schema_ver != SCHEMAVER_SAMBASAMACCOUNT ) {
1653 DEBUG(0, ("Allocated RIDs require the %s objectclass used by 'ldapsam'\n",
1654 LDAP_OBJ_SAMBASAMACCOUNT));
1655 return NT_STATUS_UNSUCCESSFUL;
1656 }
1657
1658 while (attempts < 10)
1659 {
1660 char *ld_error;
1661 if (ldapsam_search_domain_info(ldap_state, &result)) {
1662 return ret;
1663 }
1664
1665 if (ldap_count_entries(ldap_state->ldap_struct, result) < 1) {
1666 DEBUG(3, ("Got no domain info entries for domain %s\n",
1667 ldap_state->domain_name));
1668 ldap_msgfree(result);
1669 if (NT_STATUS_IS_OK(ret = add_new_domain_info(ldap_state))) {
1670 continue;
1671 } else {
1672 DEBUG(0, ("Adding domain info failed with %s\n", nt_errstr(ret)));
1673 return ret;
1674 }
1675 }
1676
1677 if ((count = ldap_count_entries(ldap_state->ldap_struct, result)) > 1) {
1678 DEBUG(0, ("Got too many (%d) domain info entries for domain %s\n",
1679 count, ldap_state->domain_name));
1680 ldap_msgfree(result);
1681 return ret;
1682 }
1683
1684 entry = ldap_first_entry(ldap_state->ldap_struct, result);
1685 if (!entry) {
1686 ldap_msgfree(result);
1687 return ret;
1688 }
1689
1690 if ((dn = ldap_get_dn(ldap_state->ldap_struct, entry)) == NULL) {
1691 DEBUG(0, ("Could not get domain info DN\n"));
1692 ldap_msgfree(result);
1693 return ret;
1694 }
1695
1696 /* yes, we keep 2 seperate counters, to avoid stomping on the two
1697 different sets of algorithmic RIDs */
1698
1699 switch (rid_type) {
1700 case USER_RID_TYPE:
1701 if (!get_single_attribute(ldap_state->ldap_struct,
1702 entry, "nextUserRid",
1703 old_rid_string)) {
1704 ldap_memfree(dn);
1705 ldap_msgfree(result);
1706 return ret;
1707 }
1708 break;
1709 case GROUP_RID_TYPE:
1710 if (!get_single_attribute(ldap_state->ldap_struct,
1711 entry, "nextGroupRid",
1712 old_rid_string)) {
1713 ldap_memfree(dn);
1714 ldap_msgfree(result);
1715 return ret;
1716 }
1717 break;
1718 }
1719
1720 /* This is the core of the whole routine. If we had
1721 scheme-style closures, there would be a *lot* less code
1722 duplication... */
1723 *rid = (uint32)atol(old_rid_string);
1724 next_rid = *rid+RID_MULTIPLIER;
1725
1726 slprintf(next_rid_string, sizeof(next_rid_string)-1, "%d", next_rid);
1727
1728 switch (rid_type) {
1729 case USER_RID_TYPE:
1730 if (next_rid > ldap_state->high_allocated_user_rid) {
1731 return NT_STATUS_UNSUCCESSFUL;
1732 }
1733
1734 /* Try to make the modification atomically by enforcing the
1735 old value in the delete mod. */
1736 make_ldap_mod(ldap_state->ldap_struct, entry, &mods,
1737 get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_USERRID),
1738 next_rid_string);
1739 break;
1740
1741 case GROUP_RID_TYPE:
1742 if (next_rid > ldap_state->high_allocated_group_rid) {
1743 return NT_STATUS_UNSUCCESSFUL;
1744 }
1745
1746 /* Try to make the modification atomically by enforcing the
1747 old value in the delete mod. */
1748 make_ldap_mod(ldap_state->ldap_struct, entry, &mods,
1749 get_attr_key2string(dominfo_attr_list, LDAP_ATTR_NEXT_GROUPRID),
1750 next_rid_string);
1751 break;
1752 }
1753
1754 if ((rc = ldap_modify_s(ldap_state->ldap_struct, dn, mods)) == LDAP_SUCCESS) {
1755 DOM_SID dom_sid;
1756 DOM_SID sid;
1757 pstring domain_sid_string;
1758 int error = 0;
1759
1760 if (!get_single_attribute(ldap_state->ldap_struct, result,
1761 get_attr_key2string(dominfo_attr_list, LDAP_ATTR_DOM_SID),
1762 domain_sid_string))
1763 {
1764 ldap_mods_free(mods, 1);
1765 ldap_memfree(dn);
1766 ldap_msgfree(result);
1767 return ret;
1768 }
1769
1770 if (!string_to_sid(&dom_sid, domain_sid_string)) {
1771 ldap_mods_free(mods, 1);
1772 ldap_memfree(dn);
1773 ldap_msgfree(result);
1774 return ret;
1775 }
1776
1777 ldap_mods_free(mods, 1);
1778 mods = NULL;
1779 ldap_memfree(dn);
1780 ldap_msgfree(result);
1781
1782 sid_copy(&sid, &dom_sid);
1783 sid_append_rid(&sid, *rid);
1784
1785 /* check RID is not in use */
1786 if (sid_in_use(ldap_state, &sid, &error)) {
1787 if (error) {
1788 return ret;
1789 }
1790 continue;
1791 }
1792
1793 return NT_STATUS_OK;
1794 }
1795
1796 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error);
1797 DEBUG(2, ("Failed to modify rid: %s\n", ld_error));
1798 SAFE_FREE(ld_error);
1799
1800 ldap_mods_free(mods, 1);
1801 mods = NULL;
1802
1803 ldap_memfree(dn);
1804 dn = NULL;
1805
1806 ldap_msgfree(result);
1807 result = NULL;
1808
1809 {
1810 /* Sleep for a random timeout */
1811 unsigned sleeptime = (sys_random()*sys_getpid()*attempts);
1812 attempts += 1;
1813
1814 sleeptime %= 100;
1815 msleep(sleeptime);
1816 }
1817 }
1818
1819 DEBUG(0, ("Failed to set new RID\n"));
1820 return ret;
1821 }
1822
1823 /* New Interface is being implemented here */
1824
1825 /**********************************************************************
1826 Initialize SAM_ACCOUNT from an LDAP query (unix attributes only)
1827 *********************************************************************/
1828 static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state,
1829 SAM_ACCOUNT * sampass,
1830 LDAPMessage * entry,
1831 gid_t *gid)
1832 {
1833 pstring homedir;
1834 pstring temp;
1835 char **ldap_values;
1836 char **values;
1837
1838 if ((ldap_values = ldap_get_values (ldap_state->ldap_struct, entry, "objectClass")) == NULL) {
1839 DEBUG (1, ("get_unix_attributes: no objectClass! \n"));
1840 return False;
1841 }
1842
1843 for (values=ldap_values;*values;values++) {
1844 if (strcasecmp(*values, LDAP_OBJ_POSIXACCOUNT ) == 0) {
1845 break;
1846 }
1847 }
1848
1849 if (!*values) { /*end of array, no posixAccount */
1850 DEBUG(10, ("user does not have %s attributes\n", LDAP_OBJ_POSIXACCOUNT));
1851 ldap_value_free(ldap_values);
1852 return False;
1853 }
1854 ldap_value_free(ldap_values);
1855
1856 if ( !get_single_attribute(ldap_state->ldap_struct, entry,
1857 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_UNIX_HOME), homedir) )
1858 {
1859 return False;
1860 }
1861
1862 if ( !get_single_attribute(ldap_state->ldap_struct, entry,
1863 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_GIDNUMBER), temp) )
1864 {
1865 return False;
1866 }
1867
1868 *gid = (gid_t)atol(temp);
1869
1870 pdb_set_unix_homedir(sampass, homedir, PDB_SET);
1871
1872 DEBUG(10, ("user has %s attributes\n", LDAP_OBJ_POSIXACCOUNT));
1873
1874 return True;
1875 }
1876
1877
1878 /**********************************************************************
1879 Initialize SAM_ACCOUNT from an LDAP query
1880 (Based on init_sam_from_buffer in pdb_tdb.c)
1881 *********************************************************************/
1882 static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state,
1883 SAM_ACCOUNT * sampass,
1884 LDAPMessage * entry)
1885 {
1886 time_t logon_time,
1887 logoff_time,
1888 kickoff_time,
1889 pass_last_set_time,
1890 pass_can_change_time,
1891 pass_must_change_time;
1892 pstring username,
1893 domain,
1894 nt_username,
1895 fullname,
1896 homedir,
1897 dir_drive,
1898 logon_script,
1899 profile_path,
1900 acct_desc,
1901 munged_dial,
1902 workstations;
1903 uint32 user_rid;
1904 uint8 smblmpwd[LM_HASH_LEN],
1905 smbntpwd[NT_HASH_LEN];
1906 uint16 acct_ctrl = 0,
1907 logon_divs;
1908 uint32 hours_len;
1909 uint8 hours[MAX_HOURS_LEN];
1910 pstring temp;
1911 uid_t uid = -1;
1912 gid_t gid = getegid();
1913
1914 /*
1915 * do a little initialization
1916 */
1917 username[0] = '\0';
1918 domain[0] = '\0';
1919 nt_username[0] = '\0';
1920 fullname[0] = '\0';
1921 homedir[0] = '\0';
1922 dir_drive[0] = '\0';
1923 logon_script[0] = '\0';
1924 profile_path[0] = '\0';
1925 acct_desc[0] = '\0';
1926 munged_dial[0] = '\0';
1927 workstations[0] = '\0';
1928
1929
1930 if (sampass == NULL || ldap_state == NULL || entry == NULL) {
1931 DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
1932 return False;
1933 }
1934
1935 if (ldap_state->ldap_struct == NULL) {
1936 DEBUG(0, ("init_sam_from_ldap: ldap_state->ldap_struct is NULL!\n"));
1937 return False;
1938 }
1939
1940 if (!get_single_attribute(ldap_state->ldap_struct, entry, "uid", username)) {
1941 DEBUG(1, ("No uid attribute found for this user!\n"));
1942 return False;
1943 }
1944
1945 DEBUG(2, ("Entry found for user: %s\n", username));
1946
1947 pstrcpy(nt_username, username);
1948
1949 pstrcpy(domain, ldap_state->domain_name);
1950
1951 pdb_set_username(sampass, username, PDB_SET);
1952
1953 pdb_set_domain(sampass, domain, PDB_DEFAULT);
1954 pdb_set_nt_username(sampass, nt_username, PDB_SET);
1955
1956 /* deal with different attributes between the schema first */
1957
1958 if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT )
1959 {
1960 if (get_single_attribute(ldap_state->ldap_struct, entry,
1961 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp))
1962 {
1963 pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
1964 }
1965
1966 if (get_single_attribute(ldap_state->ldap_struct, entry,
1967 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_SID), temp))
1968 {
1969 pdb_set_group_sid_from_string(sampass, temp, PDB_SET);
1970 }
1971 else
1972 {
1973 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
1974 }
1975
1976
1977 }
1978 else
1979 {
1980 if (get_single_attribute(ldap_state->ldap_struct, entry,
1981 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp))
1982 {
1983 user_rid = (uint32)atol(temp);
1984 pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
1985 }
1986
1987 if (!get_single_attribute(ldap_state->ldap_struct, entry,
1988 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_RID), temp))
1989 {
1990 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
1991 } else {
1992 uint32 group_rid;
1993
1994 group_rid = (uint32)atol(temp);
1995
1996 /* for some reason, we often have 0 as a primary group RID.
1997 Make sure that we treat this just as a 'default' value */
1998
1999 if ( group_rid > 0 )
2000 pdb_set_group_sid_from_rid(sampass, group_rid, PDB_SET);
2001 else
2002 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
2003 }
2004 }
2005
2006 if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
2007 DEBUG(1, ("no %s or %s attribute found for this user %s\n",
2008 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
2009 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
2010 username));
2011 return False;
2012 }
2013
2014
2015 /*
2016 * If so configured, try and get the values from LDAP
2017 */
2018
2019 if (lp_ldap_trust_ids() && (get_unix_attributes(ldap_state, sampass, entry, &gid)))
2020 {
2021 if (pdb_get_init_flags(sampass,PDB_GROUPSID) == PDB_DEFAULT)
2022 {
2023 GROUP_MAP map;
2024 /* call the mapping code here */
2025 if(pdb_getgrgid(&map, gid, MAPPING_WITHOUT_PRIV)) {
2026 pdb_set_group_sid(sampass, &map.sid, PDB_SET);
2027 }
2028 else {
2029 pdb_set_group_sid_from_rid(sampass, pdb_gid_to_group_rid(gid), PDB_SET);
2030 }
2031 }
2032 }
2033
2034 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2035 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp))
2036 {
2037 /* leave as default */
2038 } else {
2039 pass_last_set_time = (time_t) atol(temp);
2040 pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
2041 }
2042
2043 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2044 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp))
2045 {
2046 /* leave as default */
2047 } else {
2048 logon_time = (time_t) atol(temp);
2049 pdb_set_logon_time(sampass, logon_time, PDB_SET);
2050 }
2051
2052 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2053 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp))
2054 {
2055 /* leave as default */
2056 } else {
2057 logoff_time = (time_t) atol(temp);
2058 pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
2059 }
2060
2061 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2062 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp))
2063 {
2064 /* leave as default */
2065 } else {
2066 kickoff_time = (time_t) atol(temp);
2067 pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
2068 }
2069
2070 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2071 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp))
2072 {
2073 /* leave as default */
2074 } else {
2075 pass_can_change_time = (time_t) atol(temp);
2076 pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
2077 }
2078
2079 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2080 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp))
2081 {
2082 /* leave as default */
2083 } else {
2084 pass_must_change_time = (time_t) atol(temp);
2085 pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
2086 }
2087
2088 /* recommend that 'gecos' and 'displayName' should refer to the same
2089 * attribute OID. userFullName depreciated, only used by Samba
2090 * primary rules of LDAP: don't make a new attribute when one is already defined
2091 * that fits your needs; using cn then displayName rather than 'userFullName'
2092 */
2093
2094 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2095 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname))
2096 {
2097 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2098 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname))
2099 {
2100 /* leave as default */
2101 } else {
2102 pdb_set_fullname(sampass, fullname, PDB_SET);
2103 }
2104 } else {
2105 pdb_set_fullname(sampass, fullname, PDB_SET);
2106 }
2107
2108 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2109 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive))
2110 {
2111 pdb_set_dir_drive(sampass, talloc_sub_specified(sampass->mem_ctx,
2112 lp_logon_drive(),
2113 username, domain,
2114 uid, gid),
2115 PDB_DEFAULT);
2116 } else {
2117 pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
2118 }
2119
2120 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2121 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir))
2122 {
2123 pdb_set_homedir(sampass, talloc_sub_specified(sampass->mem_ctx,
2124 lp_logon_home(),
2125 username, domain,
2126 uid, gid),
2127 PDB_DEFAULT);
2128 } else {
2129 pdb_set_homedir(sampass, homedir, PDB_SET);
2130 }
2131
2132 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2133 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script))
2134 {
2135 pdb_set_logon_script(sampass, talloc_sub_specified(sampass->mem_ctx,
2136 lp_logon_script(),
2137 username, domain,
2138 uid, gid),
2139 PDB_DEFAULT);
2140 } else {
2141 pdb_set_logon_script(sampass, logon_script, PDB_SET);
2142 }
2143
2144 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2145 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path))
2146 {
2147 pdb_set_profile_path(sampass, talloc_sub_specified(sampass->mem_ctx,
2148 lp_logon_path(),
2149 username, domain,
2150 uid, gid),
2151 PDB_DEFAULT);
2152 } else {
2153 pdb_set_profile_path(sampass, profile_path, PDB_SET);
2154 }
2155
2156 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2157 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC), acct_desc))
2158 {
2159 /* leave as default */
2160 } else {
2161 pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
2162 }
2163
2164 if (!get_single_attribute(ldap_state->ldap_struct, entry,
2165 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations))
2166 {
2167 /* leave as default */;
2168 } else {
2169 pdb_set_workstations(sampass, workstations, PDB_SET);
2170 }
2171
2172 /* FIXME: hours stuff should be cleaner */
2173
2174 logon_divs = 168;
2175 hours_len = 21;
2176 memset(hours, 0xff, hours_len);
2177
2178 if (!get_single_attribute (ldap_state->ldap_struct, entry,
2179 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp))
2180 {
2181 /* leave as default */
2182 } else {
2183 pdb_gethexpwd(temp, smblmpwd);
2184 memset((char *)temp, '\0', strlen(temp)+1);
2185 if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
2186 return False;
2187 ZERO_STRUCT(smblmpwd);
2188 }
2189
2190 if (!get_single_attribute (ldap_state->ldap_struct, entry,
2191 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp))
2192 {
2193 /* leave as default */
2194 } else {
2195 pdb_gethexpwd(temp, smbntpwd);
2196 memset((char *)temp, '\0', strlen(temp)+1);
2197 if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
2198 return False;
2199 ZERO_STRUCT(smbntpwd);
2200 }
2201
2202 if (!get_single_attribute (ldap_state->ldap_struct, entry,
2203 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp))
2204 {
2205 acct_ctrl |= ACB_NORMAL;
2206 } else {
2207 acct_ctrl = pdb_decode_acct_ctrl(temp);
2208
2209 if (acct_ctrl == 0)
2210 acct_ctrl |= ACB_NORMAL;
2211
2212 pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
2213 }
2214
2215 pdb_set_hours_len(sampass, hours_len, PDB_SET);
2216 pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
2217
2218 pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
2219
2220 /* pdb_set_unknown_3(sampass, unknown3, PDB_SET); */
2221 /* pdb_set_unknown_5(sampass, unknown5, PDB_SET); */
2222 /* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
2223
2224 pdb_set_hours(sampass, hours, PDB_SET);
2225
2226 return True;
2227 }
2228
2229 /**********************************************************************
2230 Initialize SAM_ACCOUNT from an LDAP query
2231 (Based on init_buffer_from_sam in pdb_tdb.c)
2232 *********************************************************************/
2233 static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state,
2234 LDAPMessage *existing,
2235 LDAPMod *** mods, SAM_ACCOUNT * sampass,
2236 BOOL (*need_update)(const SAM_ACCOUNT *,
2237 enum pdb_elements))
2238 {
2239 pstring temp;
2240 uint32 rid;
2241
2242 if (mods == NULL || sampass == NULL) {
2243 DEBUG(0, ("init_ldap_from_sam: NULL parameters found!\n"));
2244 return False;
2245 }
2246
2247 *mods = NULL;
2248
2249 /*
2250 * took out adding "objectclass: sambaAccount"
2251 * do this on a per-mod basis
2252 */
2253 if (need_update(sampass, PDB_USERNAME))
2254 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2255 "uid", pdb_get_username(sampass));
2256
2257 DEBUG(2, ("Setting entry for user: %s\n", pdb_get_username(sampass)));
2258
2259 if (pdb_get_init_flags(sampass, PDB_USERSID) == PDB_DEFAULT) {
2260 if (ldap_state->permit_non_unix_accounts) {
2261 if (!NT_STATUS_IS_OK(ldapsam_next_rid(ldap_state, &rid, USER_RID_TYPE))) {
2262 DEBUG(0, ("NO user RID specified on account %s, and "
2263 "finding next available NUA RID failed, "
2264 "cannot store!\n",
2265 pdb_get_username(sampass)));
2266 ldap_mods_free(*mods, 1);
2267 return False;
2268 }
2269 } else {
2270 DEBUG(0, ("NO user RID specified on account %s, "
2271 "cannot store!\n", pdb_get_username(sampass)));
2272 ldap_mods_free(*mods, 1);
2273 return False;
2274 }
2275
2276 /* now that we have figured out the RID, always store it, as
2277 the schema requires it (either as a SID or a RID) */
2278
2279 if (!pdb_set_user_sid_from_rid(sampass, rid, PDB_CHANGED)) {
2280 DEBUG(0, ("Could not store RID back onto SAM_ACCOUNT for user %s!\n",
2281 pdb_get_username(sampass)));
2282 ldap_mods_free(*mods, 1);
2283 return False;
2284 }
2285 }
2286
2287 /* only update the RID if we actually need to */
2288 if (need_update(sampass, PDB_USERSID))
2289 {
2290 fstring sid_string;
2291 fstring dom_sid_string;
2292 const DOM_SID *user_sid = pdb_get_user_sid(sampass);
2293
2294 switch ( ldap_state->schema_ver )
2295 {
2296 case SCHEMAVER_SAMBAACCOUNT:
2297 if (!sid_peek_check_rid(get_global_sam_sid(), user_sid, &rid)) {
2298 DEBUG(1, ("User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
2299 sid_to_string(sid_string, user_sid),
2300 sid_to_string(dom_sid_string, get_global_sam_sid())));
2301 return False;
2302 }
2303 slprintf(temp, sizeof(temp) - 1, "%i", rid);
2304 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2305 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
2306 temp);
2307 break;
2308
2309 case SCHEMAVER_SAMBASAMACCOUNT:
2310 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2311 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
2312 sid_to_string(sid_string, user_sid));
2313 break;
2314
2315 default:
2316 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
2317 break;
2318 }
2319 }
2320
2321 /* we don't need to store the primary group RID - so leaving it
2322 'free' to hang off the unix primary group makes life easier */
2323
2324 if (need_update(sampass, PDB_GROUPSID))
2325 {
2326 fstring sid_string;
2327 fstring dom_sid_string;
2328 const DOM_SID *group_sid = pdb_get_group_sid(sampass);
2329
2330 switch ( ldap_state->schema_ver )
2331 {
2332 case SCHEMAVER_SAMBAACCOUNT:
2333 if (!sid_peek_check_rid(get_global_sam_sid(), group_sid, &rid)) {
2334 DEBUG(1, ("User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
2335 sid_to_string(sid_string, group_sid),
2336 sid_to_string(dom_sid_string, get_global_sam_sid())));
2337 return False;
2338 }
2339
2340 slprintf(temp, sizeof(temp) - 1, "%i", rid);
2341 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2342 get_userattr_key2string(ldap_state->schema_ver,
2343 LDAP_ATTR_PRIMARY_GROUP_RID), temp);
2344 break;
2345
2346 case SCHEMAVER_SAMBASAMACCOUNT:
2347 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2348 get_userattr_key2string(ldap_state->schema_ver,
2349 LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_string(sid_string, group_sid));
2350 break;
2351
2352 default:
2353 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
2354 break;
2355 }
2356
2357 }
2358
2359 /* displayName, cn, and gecos should all be the same
2360 * most easily accomplished by giving them the same OID
2361 * gecos isn't set here b/c it should be handled by the
2362 * add-user script
2363 * We change displayName only and fall back to cn if
2364 * it does not exist.
2365 */
2366
2367 if (need_update(sampass, PDB_FULLNAME))
2368 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2369 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME),
2370 pdb_get_fullname(sampass));
2371
2372 if (need_update(sampass, PDB_ACCTDESC))
2373 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2374 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC),
2375 pdb_get_acct_desc(sampass));
2376
2377 if (need_update(sampass, PDB_WORKSTATIONS))
2378 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2379 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
2380 pdb_get_workstations(sampass));
2381
2382 if (need_update(sampass, PDB_SMBHOME))
2383 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2384 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
2385 pdb_get_homedir(sampass));
2386
2387 if (need_update(sampass, PDB_DRIVE))
2388 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2389 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
2390 pdb_get_dir_drive(sampass));
2391
2392 if (need_update(sampass, PDB_LOGONSCRIPT))
2393 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2394 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT),
2395 pdb_get_logon_script(sampass));
2396
2397 if (need_update(sampass, PDB_PROFILE))
2398 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2399 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
2400 pdb_get_profile_path(sampass));
2401
2402 slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logon_time(sampass));
2403 if (need_update(sampass, PDB_LOGONTIME))
2404 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2405 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
2406
2407 slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logoff_time(sampass));
2408 if (need_update(sampass, PDB_LOGOFFTIME))
2409 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2410 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
2411
2412 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_kickoff_time(sampass));
2413 if (need_update(sampass, PDB_KICKOFFTIME))
2414 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2415 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
2416
2417 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_can_change_time(sampass));
2418 if (need_update(sampass, PDB_CANCHANGETIME))
2419 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2420 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
2421
2422 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_must_change_time(sampass));
2423 if (need_update(sampass, PDB_MUSTCHANGETIME))
2424 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2425 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
2426
2427 if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST))
2428 || (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY))
2429 {
2430
2431 pdb_sethexpwd(temp, pdb_get_lanman_passwd(sampass),
2432 pdb_get_acct_ctrl(sampass));
2433
2434 if (need_update(sampass, PDB_LMPASSWD))
2435 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2436 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
2437 temp);
2438
2439 pdb_sethexpwd (temp, pdb_get_nt_passwd(sampass),
2440 pdb_get_acct_ctrl(sampass));
2441
2442 if (need_update(sampass, PDB_NTPASSWD))
2443 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2444 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
2445 temp);
2446
2447 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_last_set_time(sampass));
2448 if (need_update(sampass, PDB_PASSLASTSET))
2449 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2450 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
2451 temp);
2452 }
2453
2454 /* FIXME: Hours stuff goes in LDAP */
2455
2456 if (need_update(sampass, PDB_ACCTCTRL))
2457 make_ldap_mod(ldap_state->ldap_struct, existing, mods,
2458 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
2459 pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
2460
2461 return True;
2462 }
2463
2464
2465
2466 /**********************************************************************
2467 Connect to LDAP server for password enumeration
2468 *********************************************************************/
2469 static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update)
2470 {
2471 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2472 int rc;
2473 pstring filter;
2474 char **attr_list;
2475
2476 snprintf( filter, sizeof(filter)-1, "(&%s%s)", lp_ldap_filter(),
2477 get_objclass_filter(ldap_state->schema_ver));
2478 all_string_sub(filter, "%u", "*", sizeof(pstring));
2479
2480 attr_list = get_userattr_list(ldap_state->schema_ver);
2481 rc = ldapsam_search_suffix(ldap_state, filter, attr_list, &ldap_state->result);
2482 free_attr_list( attr_list );
2483
2484 if (rc != LDAP_SUCCESS) {
2485 DEBUG(0, ("LDAP search failed: %s\n", ldap_err2string(rc)));
2486 DEBUG(3, ("Query was: %s, %s\n", lp_ldap_suffix(), filter));
2487 ldap_msgfree(ldap_state->result);
2488 ldap_state->result = NULL;
2489 return NT_STATUS_UNSUCCESSFUL;
2490 }
2491
2492 DEBUG(2, ("ldapsam_setsampwent: %d entries in the base!\n",
2493 ldap_count_entries(ldap_state->ldap_struct,
2494 ldap_state->result)));
2495
2496 ldap_state->entry = ldap_first_entry(ldap_state->ldap_struct,
2497 ldap_state->result);
2498 ldap_state->index = 0;
2499
2500 return NT_STATUS_OK;
2501 }
2502
2503 /**********************************************************************
2504 End enumeration of the LDAP password list
2505 *********************************************************************/
2506 static void ldapsam_endsampwent(struct pdb_methods *my_methods)
2507 {
2508 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2509 if (ldap_state->result) {
2510 ldap_msgfree(ldap_state->result);
2511 ldap_state->result = NULL;
2512 }
2513 }
2514
2515 /**********************************************************************
2516 Get the next entry in the LDAP password database
2517 *********************************************************************/
2518 static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT *user)
2519 {
2520 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2521 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2522 BOOL bret = False;
2523
2524 /* The rebind proc needs this *HACK*. We are not multithreaded, so
2525 this will work, but it's not nice. */
2526 static_ldap_state = ldap_state;
2527
2528 while (!bret) {
2529 if (!ldap_state->entry)
2530 return ret;
2531
2532 ldap_state->index++;
2533 bret = init_sam_from_ldap(ldap_state, user, ldap_state->entry);
2534
2535 ldap_state->entry = ldap_next_entry(ldap_state->ldap_struct,
2536 ldap_state->entry);
2537 }
2538
2539 return NT_STATUS_OK;
2540 }
2541
2542 /**********************************************************************
2543 Get SAM_ACCOUNT entry from LDAP by username
2544 *********************************************************************/
2545 static NTSTATUS ldapsam_getsampwnam(struct pdb_methods *my_methods, SAM_ACCOUNT *user, const char *sname)
2546 {
2547 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2548 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2549 LDAPMessage *result;
2550 LDAPMessage *entry;
2551 int count;
2552 char ** attr_list;
2553 int rc;
2554
2555 attr_list = get_userattr_list( ldap_state->schema_ver );
2556 rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result, attr_list);
2557 free_attr_list( attr_list );
2558
2559 if ( rc != LDAP_SUCCESS )
2560 return NT_STATUS_NO_SUCH_USER;
2561
2562 count = ldap_count_entries(ldap_state->ldap_struct, result);
2563
2564 if (count < 1) {
2565 DEBUG(4,
2566 ("Unable to locate user [%s] count=%d\n", sname,
2567 count));
2568 return NT_STATUS_NO_SUCH_USER;
2569 } else if (count > 1) {
2570 DEBUG(1,
2571 ("Duplicate entries for this user [%s] Failing. count=%d\n", sname,
2572 count));
2573 return NT_STATUS_NO_SUCH_USER;
2574 }
2575
2576 entry = ldap_first_entry(ldap_state->ldap_struct, result);
2577 if (entry) {
2578 if (!init_sam_from_ldap(ldap_state, user, entry)) {
2579 DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname));
2580 ldap_msgfree(result);
2581 return NT_STATUS_NO_SUCH_USER;
2582 }
2583 ldap_msgfree(result);
2584 ret = NT_STATUS_OK;
2585 } else {
2586 ldap_msgfree(result);
2587 }
2588 return ret;
2589 }
2590
2591 /**********************************************************************
2592 Get SAM_ACCOUNT entry from LDAP by SID
2593 *********************************************************************/
2594 static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT * user, const DOM_SID *sid)
2595 {
2596 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2597 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2598 LDAPMessage *result;
2599 LDAPMessage *entry;
2600 fstring sid_string;
2601 int count;
2602 int rc;
2603 char ** attr_list;
2604
2605 switch ( ldap_state->schema_ver )
2606 {
2607 case SCHEMAVER_SAMBASAMACCOUNT:
2608 attr_list = get_userattr_list(ldap_state->schema_ver);
2609 rc = ldapsam_search_suffix_by_sid(ldap_state, sid, &result, attr_list);
2610 free_attr_list( attr_list );
2611
2612 if ( rc != LDAP_SUCCESS )
2613 return NT_STATUS_NO_SUCH_USER;
2614 break;
2615
2616 case SCHEMAVER_SAMBAACCOUNT:
2617 {
2618 uint32 rid;
2619 if (!sid_peek_check_rid(get_global_sam_sid(), sid, &rid)) {
2620 return NT_STATUS_NO_SUCH_USER;
2621 }
2622
2623 attr_list = get_userattr_list(ldap_state->schema_ver);
2624 rc = ldapsam_search_suffix_by_rid(ldap_state, rid, &result, attr_list );
2625 free_attr_list( attr_list );
2626
2627 if ( rc != LDAP_SUCCESS )
2628 return NT_STATUS_NO_SUCH_USER;
2629 }
2630 break;
2631 }
2632
2633 count = ldap_count_entries(ldap_state->ldap_struct, result);
2634
2635 if (count < 1)
2636 {
2637 DEBUG(4,
2638 ("Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string, sid),
2639 count));
2640 return NT_STATUS_NO_SUCH_USER;
2641 }
2642 else if (count > 1)
2643 {
2644 DEBUG(1,
2645 ("More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string, sid),
2646 count));
2647 return NT_STATUS_NO_SUCH_USER;
2648 }
2649
2650 entry = ldap_first_entry(ldap_state->ldap_struct, result);
2651 if (entry)
2652 {
2653 if (!init_sam_from_ldap(ldap_state, user, entry)) {
2654 DEBUG(1,("ldapsam_getsampwrid: init_sam_from_ldap failed!\n"));
2655 ldap_msgfree(result);
2656 return NT_STATUS_NO_SUCH_USER;
2657 }
2658 ldap_msgfree(result);
2659 ret = NT_STATUS_OK;
2660 } else {
2661 ldap_msgfree(result);
2662 }
2663 return ret;
2664 }
2665
2666 /********************************************************************
2667 Do the actual modification - also change a plaittext passord if
2668 it it set.
2669 **********************************************************************/
2670
2671 static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods,
2672 SAM_ACCOUNT *newpwd, char *dn,
2673 LDAPMod **mods, int ldap_op,
2674 BOOL (*need_update)(const SAM_ACCOUNT *,
2675 enum pdb_elements))
2676 {
2677 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2678 int rc;
2679
2680 if (!my_methods || !newpwd || !dn) {
2681 return NT_STATUS_INVALID_PARAMETER;
2682 }
2683
2684 if (!mods) {
2685 DEBUG(5,("mods is empty: nothing to modify\n"));
2686 /* may be password change below however */
2687 } else {
2688 switch(ldap_op)
2689 {
2690 case LDAP_MOD_ADD:
2691 make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_ACCOUNT);
2692 rc = ldapsam_add(ldap_state, dn, mods);
2693 break;
2694 case LDAP_MOD_REPLACE:
2695 rc = ldapsam_modify(ldap_state, dn ,mods);
2696 break;
2697 default:
2698 DEBUG(0,("Wrong LDAP operation type: %d!\n", ldap_op));
2699 return NT_STATUS_INVALID_PARAMETER;
2700 }
2701
2702 if (rc!=LDAP_SUCCESS) {
2703 char *ld_error = NULL;
2704 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
2705 &ld_error);
2706 DEBUG(1,
2707 ("failed to %s user dn= %s with: %s\n\t%s\n",
2708 ldap_op == LDAP_MOD_ADD ? "add" : "modify",
2709 dn, ldap_err2string(rc),
2710 ld_error?ld_error:"unknown"));
2711 SAFE_FREE(ld_error);
2712 return NT_STATUS_UNSUCCESSFUL;
2713 }
2714 }
2715
2716 #ifdef LDAP_EXOP_X_MODIFY_PASSWD
2717 if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) &&
2718 (lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) &&
2719 need_update(newpwd, PDB_PLAINTEXT_PW) &&
2720 (pdb_get_plaintext_passwd(newpwd)!=NULL)) {
2721 BerElement *ber;
2722 struct berval *bv;
2723 char *retoid;
2724 struct berval *retdata;
2725 char *utf8_password;
2726 char *utf8_dn;
2727
2728 if (push_utf8_allocate(&utf8_password, pdb_get_plaintext_passwd(newpwd)) == (size_t)-1) {
2729 return NT_STATUS_NO_MEMORY;
2730 }
2731
2732 if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) {
2733 return NT_STATUS_NO_MEMORY;
2734 }
2735
2736 if ((ber = ber_alloc_t(LBER_USE_DER))==NULL) {
2737 DEBUG(0,("ber_alloc_t returns NULL\n"));
2738 SAFE_FREE(utf8_password);
2739 return NT_STATUS_UNSUCCESSFUL;
2740 }
2741
2742 ber_printf (ber, "{");
2743 ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, utf8_dn);
2744 ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW, utf8_password);
2745 ber_printf (ber, "N}");
2746
2747 if ((rc = ber_flatten (ber, &bv))<0) {
2748 DEBUG(0,("ber_flatten returns a value <0\n"));
2749 ber_free(ber,1);
2750 SAFE_FREE(utf8_dn);
2751 SAFE_FREE(utf8_password);
2752 return NT_STATUS_UNSUCCESSFUL;
2753 }
2754
2755 SAFE_FREE(utf8_dn);
2756 SAFE_FREE(utf8_password);
2757 ber_free(ber, 1);
2758
2759 if ((rc = ldapsam_extended_operation(ldap_state, LDAP_EXOP_X_MODIFY_PASSWD,
2760 bv, NULL, NULL, &retoid, &retdata))!=LDAP_SUCCESS) {
2761 DEBUG(0,("LDAP Password could not be changed for user %s: %s\n",
2762 pdb_get_username(newpwd),ldap_err2string(rc)));
2763 } else {
2764 DEBUG(3,("LDAP Password changed for user %s\n",pdb_get_username(newpwd)));
2765 #ifdef DEBUG_PASSWORD
2766 DEBUG(100,("LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd)));
2767 #endif
2768 ber_bvfree(retdata);
2769 ber_memfree(retoid);
2770 }
2771 ber_bvfree(bv);
2772 }
2773 #else
2774 DEBUG(10,("LDAP PASSWORD SYNC is not supported!\n"));
2775 #endif /* LDAP_EXOP_X_MODIFY_PASSWD */
2776 return NT_STATUS_OK;
2777 }
2778
2779 /**********************************************************************
2780 Delete entry from LDAP for username
2781 *********************************************************************/
2782 static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * sam_acct)
2783 {
2784 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2785 const char *sname;
2786 int rc;
2787 LDAPMessage *result;
2788 NTSTATUS ret;
2789 char **attr_list;
2790 fstring objclass;
2791
2792 if (!sam_acct) {
2793 DEBUG(0, ("sam_acct was NULL!\n"));
2794 return NT_STATUS_INVALID_PARAMETER;
2795 }
2796
2797 sname = pdb_get_username(sam_acct);
2798
2799 DEBUG (3, ("Deleting user %s from LDAP.\n", sname));
2800
2801 attr_list= get_userattr_list( ldap_state->schema_ver );
2802 rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result, attr_list);
2803
2804 if (rc != LDAP_SUCCESS) {
2805 free_attr_list( attr_list );
2806 return NT_STATUS_NO_SUCH_USER;
2807 }
2808
2809 switch ( ldap_state->schema_ver )
2810 {
2811 case SCHEMAVER_SAMBASAMACCOUNT:
2812 fstrcpy( objclass, LDAP_OBJ_SAMBASAMACCOUNT );
2813 break;
2814
2815 case SCHEMAVER_SAMBAACCOUNT:
2816 fstrcpy( objclass, LDAP_OBJ_SAMBAACCOUNT );
2817 break;
2818 default:
2819 fstrcpy( objclass, "UNKNOWN" );
2820 DEBUG(0,("ldapsam_delete_sam_account: Unknown schema version specified!\n"));
2821 break;
2822 }
2823
2824 ret = ldapsam_delete_entry(ldap_state, result, objclass, attr_list );
2825 ldap_msgfree(result);
2826 free_attr_list( attr_list );
2827
2828 return ret;
2829 }
2830
2831 /**********************************************************************
2832 Helper function to determine for update_sam_account whether
2833 we need LDAP modification.
2834 *********************************************************************/
2835 static BOOL element_is_changed(const SAM_ACCOUNT *sampass,
2836 enum pdb_elements element)
2837 {
2838 return IS_SAM_CHANGED(sampass, element);
2839 }
2840
2841 /**********************************************************************
2842 Update SAM_ACCOUNT
2843 *********************************************************************/
2844 static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd)
2845 {
2846 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2847 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2848 int rc;
2849 char *dn;
2850 LDAPMessage *result;
2851 LDAPMessage *entry;
2852 LDAPMod **mods;
2853 char **attr_list;
2854
2855 attr_list = get_userattr_list(ldap_state->schema_ver);
2856 rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list );
2857 free_attr_list( attr_list );
2858 if (rc != LDAP_SUCCESS)
2859 return NT_STATUS_UNSUCCESSFUL;
2860
2861 if (ldap_count_entries(ldap_state->ldap_struct, result) == 0) {
2862 DEBUG(0, ("No user to modify!\n"));
2863 ldap_msgfree(result);
2864 return NT_STATUS_UNSUCCESSFUL;
2865 }
2866
2867 entry = ldap_first_entry(ldap_state->ldap_struct, result);
2868 dn = ldap_get_dn(ldap_state->ldap_struct, entry);
2869
2870 if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
2871 element_is_changed)) {
2872 DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
2873 ldap_msgfree(result);
2874 return NT_STATUS_UNSUCCESSFUL;
2875 }
2876
2877 ldap_msgfree(result);
2878
2879 if (mods == NULL) {
2880 DEBUG(4,("mods is empty: nothing to update for user: %s\n",
2881 pdb_get_username(newpwd)));
2882 ldap_mods_free(mods, 1);
2883 return NT_STATUS_OK;
2884 }
2885
2886 ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed);
2887 ldap_mods_free(mods,1);
2888
2889 if (!NT_STATUS_IS_OK(ret)) {
2890 char *ld_error = NULL;
2891 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
2892 &ld_error);
2893 DEBUG(0,("failed to modify user with uid = %s, error: %s (%s)\n",
2894 pdb_get_username(newpwd), ld_error?ld_error:"(unknwon)", ldap_err2string(rc)));
2895 SAFE_FREE(ld_error);
2896 return ret;
2897 }
2898
2899 DEBUG(2, ("successfully modified uid = %s in the LDAP database\n",
2900 pdb_get_username(newpwd)));
2901 return NT_STATUS_OK;
2902 }
2903
2904 /**********************************************************************
2905 Helper function to determine for update_sam_account whether
2906 we need LDAP modification.
2907 *********************************************************************/
2908 static BOOL element_is_set_or_changed(const SAM_ACCOUNT *sampass,
2909 enum pdb_elements element)
2910 {
2911 return (IS_SAM_SET(sampass, element) ||
2912 IS_SAM_CHANGED(sampass, element));
2913 }
2914
2915 /**********************************************************************
2916 Add SAM_ACCOUNT to LDAP
2917 *********************************************************************/
2918
2919 static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd)
2920 {
2921 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2922 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2923 int rc;
2924 LDAPMessage *result = NULL;
2925 LDAPMessage *entry = NULL;
2926 pstring dn;
2927 LDAPMod **mods = NULL;
2928 int ldap_op;
2929 uint32 num_result;
2930 char **attr_list;
2931 char *escape_user;
2932 const char *username = pdb_get_username(newpwd);
2933 pstring filter;
2934
2935 if (!username || !*username) {
2936 DEBUG(0, ("Cannot add user without a username!\n"));
2937 return NT_STATUS_INVALID_PARAMETER;
2938 }
2939
2940 /* free this list after the second search or in case we exit on failure */
2941
2942 attr_list = get_userattr_list(ldap_state->schema_ver);
2943 rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
2944
2945 if (rc != LDAP_SUCCESS) {
2946 free_attr_list( attr_list );
2947 return NT_STATUS_UNSUCCESSFUL;
2948 }
2949
2950 if (ldap_count_entries(ldap_state->ldap_struct, result) != 0) {
2951 DEBUG(0,("User '%s' already in the base, with samba attributes\n",
2952 username));
2953 ldap_msgfree(result);
2954 free_attr_list( attr_list );
2955 return NT_STATUS_UNSUCCESSFUL;
2956 }
2957 ldap_msgfree(result);
2958
2959 /* does the entry already exist but without a samba rttibutes?
2960 we don't really care what attributes are returned here */
2961
2962 escape_user = escape_ldap_string_alloc( username );
2963 pstrcpy( filter, lp_ldap_filter() );
2964 all_string_sub( filter, "%u", escape_user, sizeof(filter) );
2965 SAFE_FREE( escape_user );
2966
2967 rc = ldapsam_search_suffix(ldap_state, filter, attr_list, &result);
2968 free_attr_list( attr_list );
2969
2970 if ( rc != LDAP_SUCCESS )
2971 return NT_STATUS_UNSUCCESSFUL;
2972
2973 num_result = ldap_count_entries(ldap_state->ldap_struct, result);
2974
2975 if (num_result > 1) {
2976 DEBUG (0, ("More than one user with that uid exists: bailing out!\n"));
2977 ldap_msgfree(result);
2978 return NT_STATUS_UNSUCCESSFUL;
2979 }
2980
2981 /* Check if we need to update an existing entry */
2982 if (num_result == 1) {
2983 char *tmp;
2984
2985 DEBUG(3,("User exists without samba attributes: adding them\n"));
2986 ldap_op = LDAP_MOD_REPLACE;
2987 entry = ldap_first_entry (ldap_state->ldap_struct, result);
2988 tmp = ldap_get_dn (ldap_state->ldap_struct, entry);
2989 slprintf (dn, sizeof (dn) - 1, "%s", tmp);
2990 ldap_memfree (tmp);
2991 } else {
2992 /* Check if we need to add an entry */
2993 DEBUG(3,("Adding new user\n"));
2994 ldap_op = LDAP_MOD_ADD;
2995 if (username[strlen(username)-1] == '$') {
2996 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_machine_suffix ());
2997 } else {
2998 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_user_suffix ());
2999 }
3000 }
3001
3002 if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
3003 element_is_set_or_changed)) {
3004 DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
3005 ldap_msgfree(result);
3006 return NT_STATUS_UNSUCCESSFUL;
3007 }
3008
3009 ldap_msgfree(result);
3010
3011 if (mods == NULL) {
3012 DEBUG(0,("mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
3013 return NT_STATUS_UNSUCCESSFUL;
3014 }
3015 switch ( ldap_state->schema_ver )
3016 {
3017 case SCHEMAVER_SAMBAACCOUNT:
3018 make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT);
3019 break;
3020 case SCHEMAVER_SAMBASAMACCOUNT:
3021 make_a_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT);
3022 break;
3023 default:
3024 DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n"));
3025 break;
3026 }
3027
3028 ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed);
3029 if (NT_STATUS_IS_ERR(ret)) {
3030 DEBUG(0,("failed to modify/add user with uid = %s (dn = %s)\n",
3031 pdb_get_username(newpwd),dn));
3032 ldap_mods_free(mods,1);
3033 return ret;
3034 }
3035
3036 DEBUG(2,("added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
3037 ldap_mods_free(mods, 1);
3038
3039 return NT_STATUS_OK;
3040 }
3041
3042 /**********************************************************************
3043 Housekeeping
3044 *********************************************************************/
3045
3046 static void free_private_data(void **vp)
3047 {
3048 struct ldapsam_privates **ldap_state = (struct ldapsam_privates **)vp;
3049
3050 ldapsam_close(*ldap_state);
3051
3052 if ((*ldap_state)->bind_secret) {
3053 memset((*ldap_state)->bind_secret, '\0', strlen((*ldap_state)->bind_secret));
3054 }
3055
3056 ldapsam_close(*ldap_state);
3057
3058 SAFE_FREE((*ldap_state)->bind_dn);
3059 SAFE_FREE((*ldap_state)->bind_secret);
3060
3061 *ldap_state = NULL;
3062
3063 /* No need to free any further, as it is talloc()ed */
3064 }
3065
3066 /**********************************************************************
3067 *********************************************************************/
3068
3069 static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
3070 const char *filter,
3071 LDAPMessage ** result)
3072 {
3073 int scope = LDAP_SCOPE_SUBTREE;
3074 int rc;
3075 char **attr_list;
3076
3077 DEBUG(2, ("ldapsam_search_one_group: searching for:[%s]\n", filter));
3078
3079
3080 attr_list = get_attr_list(groupmap_attr_list);
3081 rc = ldapsam_search(ldap_state, lp_ldap_suffix (), scope,
3082 filter, attr_list, 0, result);
3083 free_attr_list( attr_list );
3084
3085 if (rc != LDAP_SUCCESS) {
3086 char *ld_error = NULL;
3087 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
3088 &ld_error);
3089 DEBUG(0, ("ldapsam_search_one_group: "
3090 "Problem during the LDAP search: LDAP error: %s (%s)",
3091 ld_error?ld_error:"(unknown)", ldap_err2string(rc)));
3092 DEBUG(3, ("ldapsam_search_one_group: Query was: %s, %s\n",
3093 lp_ldap_suffix(), filter));
3094 SAFE_FREE(ld_error);
3095 }
3096
3097 return rc;
3098 }
3099
3100 /**********************************************************************
3101 *********************************************************************/
3102
3103 static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state,
3104 GROUP_MAP *map, LDAPMessage *entry)
3105 {
3106 pstring temp;
3107
3108 if (ldap_state == NULL || map == NULL || entry == NULL ||
3109 ldap_state->ldap_struct == NULL)
3110 {
3111 DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
3112 return False;
3113 }
3114
3115 if (!get_single_attribute(ldap_state->ldap_struct, entry,
3116 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp))
3117 {
3118 DEBUG(0, ("Mandatory attribute %s not found\n",
3119 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
3120 return False;
3121 }
3122 DEBUG(2, ("Entry found for group: %s\n", temp));
3123
3124 map->gid = (gid_t)atol(temp);
3125
3126 if (!get_single_attribute(ldap_state->ldap_struct, entry,
3127 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp))
3128 {
3129 DEBUG(0, ("Mandatory attribute %s not found\n",
3130 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
3131 return False;
3132 }
3133 string_to_sid(&map->sid, temp);
3134
3135 if (!get_single_attribute(ldap_state->ldap_struct, entry,
3136 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp))
3137 {
3138 DEBUG(0, ("Mandatory attribute %s not found\n",
3139 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
3140 return False;
3141 }
3142 map->sid_name_use = (uint32)atol(temp);
3143
3144 if ((map->sid_name_use < SID_NAME_USER) ||
3145 (map->sid_name_use > SID_NAME_UNKNOWN)) {
3146 DEBUG(0, ("Unknown Group type: %d\n", map->sid_name_use));
3147 return False;
3148 }
3149
3150 if (!get_single_attribute(ldap_state->ldap_struct, entry,
3151 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp))
3152 {
3153 temp[0] = '\0';
3154 if (!get_single_attribute(ldap_state->ldap_struct, entry,
3155 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp))
3156 {
3157 DEBUG(0, ("Attributes cn not found either "
3158 "for gidNumber(%i)\n",map->gid));
3159 return False;
3160 }
3161 }
3162 fstrcpy(map->nt_name, temp);
3163
3164 if (!get_single_attribute(ldap_state->ldap_struct, entry,
3165 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp))
3166 {
3167 temp[0] = '\0';
3168 }
3169 fstrcpy(map->comment, temp);
3170
3171 map->systemaccount = 0;
3172 init_privilege(&map->priv_set);
3173
3174 return True;
3175 }
3176
3177 /**********************************************************************
3178 *********************************************************************/
3179
3180 static BOOL init_ldap_from_group(LDAP *ldap_struct,
3181 LDAPMessage *existing,
3182 LDAPMod ***mods,
3183 const GROUP_MAP *map)
3184 {
3185 pstring tmp;
3186
3187 if (mods == NULL || map == NULL) {
3188 DEBUG(0, ("init_ldap_from_group: NULL parameters found!\n"));
3189 return False;
3190 }
3191
3192 *mods = NULL;
3193
3194 sid_to_string(tmp, &map->sid);
3195 make_ldap_mod(ldap_struct, existing, mods,
3196 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID), tmp);
3197 snprintf(tmp, sizeof(tmp)-1, "%i", map->sid_name_use);
3198 make_ldap_mod(ldap_struct, existing, mods,
3199 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), tmp);
3200
3201 make_ldap_mod(ldap_struct, existing, mods,
3202 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), map->nt_name);
3203 make_ldap_mod(ldap_struct, existing, mods,
3204 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), map->comment);
3205
3206 return True;
3207 }
3208
3209 /**********************************************************************
3210 *********************************************************************/
3211
3212 static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods,
3213 const char *filter,
3214 GROUP_MAP *map)
3215 {
3216 struct ldapsam_privates *ldap_state =
3217 (struct ldapsam_privates *)methods->private_data;
3218 LDAPMessage *result;
3219 LDAPMessage *entry;
3220 int count;
3221
3222 if (ldapsam_search_one_group(ldap_state, filter, &result)
3223 != LDAP_SUCCESS) {
3224 return NT_STATUS_NO_SUCH_GROUP;
3225 }
3226
3227 count = ldap_count_entries(ldap_state->ldap_struct, result);
3228
3229 if (count < 1) {
3230 DEBUG(4, ("Did not find group for filter %s\n", filter));
3231 return NT_STATUS_NO_SUCH_GROUP;
3232 }
3233
3234 if (count > 1) {
3235 DEBUG(1, ("Duplicate entries for filter %s: count=%d\n",
3236 filter, count));
3237 return NT_STATUS_NO_SUCH_GROUP;
3238 }
3239
3240 entry = ldap_first_entry(ldap_state->ldap_struct, result);
3241
3242 if (!entry) {
3243 ldap_msgfree(result);
3244 return NT_STATUS_UNSUCCESSFUL;
3245 }
3246
3247 if (!init_group_from_ldap(ldap_state, map, entry)) {
3248 DEBUG(1, ("init_group_from_ldap failed for group filter %s\n",
3249 filter));
3250 ldap_msgfree(result);
3251 return NT_STATUS_NO_SUCH_GROUP;
3252 }
3253
3254 ldap_msgfree(result);
3255 return NT_STATUS_OK;
3256 }
3257
3258 /**********************************************************************
3259 *********************************************************************/
3260
3261 static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
3262 DOM_SID sid, BOOL with_priv)
3263 {
3264 pstring filter;
3265
3266 snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%s))",
3267 LDAP_OBJ_GROUPMAP,
3268 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
3269 sid_string_static(&sid));
3270
3271 return ldapsam_getgroup(methods, filter, map);
3272 }
3273
3274 /**********************************************************************
3275 *********************************************************************/
3276
3277 static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
3278 gid_t gid, BOOL with_priv)
3279 {
3280 pstring filter;
3281
3282 snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%d))",
3283 LDAP_OBJ_GROUPMAP,
3284 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
3285 gid);
3286
3287 return ldapsam_getgroup(methods, filter, map);
3288 }
3289
3290 /**********************************************************************
3291 *********************************************************************/
3292
3293 static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
3294 char *name, BOOL with_priv)
3295 {
3296 pstring filter;
3297
3298 /* TODO: Escaping of name? */
3299
3300 snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
3301 LDAP_OBJ_GROUPMAP,
3302 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), name,
3303 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), name);
3304
3305 return ldapsam_getgroup(methods, filter, map);
3306 }
3307
3308 /**********************************************************************
3309 *********************************************************************/
3310
3311 static int ldapsam_search_one_group_by_gid(struct ldapsam_privates *ldap_state,
3312 gid_t gid,
3313 LDAPMessage **result)
3314 {
3315 pstring filter;
3316
3317 snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%i))",
3318 LDAP_OBJ_POSIXGROUP,
3319 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
3320 gid);
3321
3322 return ldapsam_search_one_group(ldap_state, filter, result);
3323 }
3324
3325 /**********************************************************************
3326 *********************************************************************/
3327
3328 static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
3329 GROUP_MAP *map)
3330 {
3331 struct ldapsam_privates *ldap_state =
3332 (struct ldapsam_privates *)methods->private_data;
3333 LDAPMessage *result = NULL;
3334 LDAPMod **mods = NULL;
3335
3336 char *tmp;
3337 pstring dn;
3338 LDAPMessage *entry;
3339
3340 GROUP_MAP dummy;
3341
3342 int rc;
3343
3344 if (NT_STATUS_IS_OK(ldapsam_getgrgid(methods, &dummy,
3345 map->gid, False))) {
3346 DEBUG(0, ("Group %i already exists in LDAP\n", map->gid));
3347 return NT_STATUS_UNSUCCESSFUL;
3348 }
3349
3350 rc = ldapsam_search_one_group_by_gid(ldap_state, map->gid, &result);
3351 if (rc != LDAP_SUCCESS) {
3352 return NT_STATUS_UNSUCCESSFUL;
3353 }
3354
3355 if (ldap_count_entries(ldap_state->ldap_struct, result) != 1) {
3356 DEBUG(2, ("Group %i must exist exactly once in LDAP\n",
3357 map->gid));
3358 ldap_msgfree(result);
3359 return NT_STATUS_UNSUCCESSFUL;
3360 }
3361
3362 entry = ldap_first_entry(ldap_state->ldap_struct, result);
3363 tmp = ldap_get_dn(ldap_state->ldap_struct, entry);
3364 pstrcpy(dn, tmp);
3365 ldap_memfree(tmp);
3366
3367 if (!init_ldap_from_group(ldap_state->ldap_struct,
3368 result, &mods, map)) {
3369 DEBUG(0, ("init_ldap_from_group failed!\n"));
3370 ldap_mods_free(mods, 1);
3371 ldap_msgfree(result);
3372 return NT_STATUS_UNSUCCESSFUL;
3373 }
3374
3375 ldap_msgfree(result);
3376
3377 if (mods == NULL) {
3378 DEBUG(0, ("mods is empty\n"));
3379 return NT_STATUS_UNSUCCESSFUL;
3380 }
3381
3382 make_a_mod(&mods, LDAP_MOD_ADD, "objectClass",
3383 "sambaGroupMapping");
3384
3385 rc = ldapsam_modify(ldap_state, dn, mods);
3386 ldap_mods_free(mods, 1);
3387
3388 if (rc != LDAP_SUCCESS) {
3389 char *ld_error = NULL;
3390 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
3391 &ld_error);
3392 DEBUG(0, ("failed to add group %i error: %s (%s)\n", map->gid,
3393 ld_error ? ld_error : "(unknown)", ldap_err2string(rc)));
3394 SAFE_FREE(ld_error);
3395 return NT_STATUS_UNSUCCESSFUL;
3396 }
3397
3398 DEBUG(2, ("successfully modified group %i in LDAP\n", map->gid));
3399 return NT_STATUS_OK;
3400 }
3401
3402 /**********************************************************************
3403 *********************************************************************/
3404
3405 static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods,
3406 GROUP_MAP *map)
3407 {
3408 struct ldapsam_privates *ldap_state =
3409 (struct ldapsam_privates *)methods->private_data;
3410 int rc;
3411 char *dn;
3412 LDAPMessage *result;
3413 LDAPMessage *entry;
3414 LDAPMod **mods;
3415
3416 rc = ldapsam_search_one_group_by_gid(ldap_state, map->gid, &result);
3417
3418 if (rc != LDAP_SUCCESS) {
3419 return NT_STATUS_UNSUCCESSFUL;
3420 }
3421
3422 if (ldap_count_entries(ldap_state->ldap_struct, result) == 0) {
3423 DEBUG(0, ("No group to modify!\n"));
3424 ldap_msgfree(result);
3425 return NT_STATUS_UNSUCCESSFUL;
3426 }
3427
3428 entry = ldap_first_entry(ldap_state->ldap_struct, result);
3429 dn = ldap_get_dn(ldap_state->ldap_struct, entry);
3430
3431 if (!init_ldap_from_group(ldap_state->ldap_struct,
3432 result, &mods, map)) {
3433 DEBUG(0, ("init_ldap_from_group failed\n"));
3434 ldap_msgfree(result);
3435 return NT_STATUS_UNSUCCESSFUL;
3436 }
3437
3438 ldap_msgfree(result);
3439
3440 if (mods == NULL) {
3441 DEBUG(4, ("mods is empty: nothing to do\n"));
3442 return NT_STATUS_UNSUCCESSFUL;
3443 }
3444
3445 rc = ldapsam_modify(ldap_state, dn, mods);
3446
3447 ldap_mods_free(mods, 1);
3448
3449 if (rc != LDAP_SUCCESS) {
3450 char *ld_error = NULL;
3451 ldap_get_option(ldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
3452 &ld_error);
3453 DEBUG(0, ("failed to modify group %i error: %s (%s)\n", map->gid,
3454 ld_error ? ld_error : "(unknown)", ldap_err2string(rc)));
3455 SAFE_FREE(ld_error);
3456 }
3457
3458 DEBUG(2, ("successfully modified group %i in LDAP\n", map->gid));
3459 return NT_STATUS_OK;
3460 }
3461
3462 /**********************************************************************
3463 *********************************************************************/
3464
3465 static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods,
3466 DOM_SID sid)
3467 {
3468 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)methods->private_data;
3469 pstring sidstring, filter;
3470 LDAPMessage *result;
3471 int rc;
3472 NTSTATUS ret;
3473 char **attr_list;
3474
3475 sid_to_string(sidstring, &sid);
3476
3477 snprintf(filter, sizeof(filter)-1, "(&(objectClass=%s)(%s=%s))",
3478 LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID, sidstring);
3479
3480 rc = ldapsam_search_one_group(ldap_state, filter, &result);
3481
3482 if (rc != LDAP_SUCCESS) {
3483 return NT_STATUS_NO_SUCH_GROUP;
3484 }
3485
3486 attr_list = get_attr_list( groupmap_attr_list_to_delete );
3487 ret = ldapsam_delete_entry(ldap_state, result, LDAP_OBJ_GROUPMAP, attr_list);
3488 free_attr_list ( attr_list );
3489
3490 ldap_msgfree(result);
3491
3492 return ret;
3493 }
3494
3495 /**********************************************************************
3496 *********************************************************************/
3497
3498 static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods, BOOL update)
3499 {
3500 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
3501 fstring filter;
3502 int rc;
3503 char **attr_list;
3504
3505 snprintf( filter, sizeof(filter)-1, "(objectclass=%s)", LDAP_OBJ_GROUPMAP);
3506 attr_list = get_attr_list( groupmap_attr_list );
3507 rc = ldapsam_search(ldap_state, lp_ldap_suffix(),
3508 LDAP_SCOPE_SUBTREE, filter,
3509 attr_list, 0, &ldap_state->result);
3510 free_attr_list( attr_list );
3511
3512 if (rc != LDAP_SUCCESS) {
3513 DEBUG(0, ("LDAP search failed: %s\n", ldap_err2string(rc)));
3514 DEBUG(3, ("Query was: %s, %s\n", lp_ldap_suffix(), filter));
3515 ldap_msgfree(ldap_state->result);
3516 ldap_state->result = NULL;
3517 return NT_STATUS_UNSUCCESSFUL;
3518 }
3519
3520 DEBUG(2, ("ldapsam_setsampwent: %d entries in the base!\n",
3521 ldap_count_entries(ldap_state->ldap_struct,
3522 ldap_state->result)));
3523
3524 ldap_state->entry = ldap_first_entry(ldap_state->ldap_struct, ldap_state->result);
3525 ldap_state->index = 0;
3526
3527 return NT_STATUS_OK;
3528 }
3529
3530 /**********************************************************************
3531 *********************************************************************/
3532
3533 static void ldapsam_endsamgrent(struct pdb_methods *my_methods)
3534 {
3535 ldapsam_endsampwent(my_methods);
3536 }
3537
3538 /**********************************************************************
3539 *********************************************************************/
3540
3541 static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods,
3542 GROUP_MAP *map)
3543 {
3544 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
3545 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
3546 BOOL bret = False;
3547
3548 /* The rebind proc needs this *HACK*. We are not multithreaded, so
3549 this will work, but it's not nice. */
3550 static_ldap_state = ldap_state;
3551
3552 while (!bret) {
3553 if (!ldap_state->entry)
3554 return ret;
3555
3556 ldap_state->index++;
3557 bret = init_group_from_ldap(ldap_state, map, ldap_state->entry);
3558
3559 ldap_state->entry = ldap_next_entry(ldap_state->ldap_struct,
3560 ldap_state->entry);
3561 }
3562
3563 return NT_STATUS_OK;
3564 }
3565
3566 /**********************************************************************
3567 *********************************************************************/
3568
3569 static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
3570 enum SID_NAME_USE sid_name_use,
3571 GROUP_MAP **rmap, int *num_entries,
3572 BOOL unix_only, BOOL with_priv)
3573 {
3574 GROUP_MAP map;
3575 GROUP_MAP *mapt;
3576 int entries = 0;
3577 NTSTATUS nt_status;
3578
3579 *num_entries = 0;
3580 *rmap = NULL;
3581
3582 if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods, False))) {
3583 DEBUG(0, ("Unable to open passdb\n"));
3584 return NT_STATUS_ACCESS_DENIED;
3585 }
3586
3587 while (NT_STATUS_IS_OK(nt_status = ldapsam_getsamgrent(methods, &map))) {
3588 if (sid_name_use != SID_NAME_UNKNOWN &&
3589 sid_name_use != map.sid_name_use) {
3590 DEBUG(11,("enum_group_mapping: group %s is not of the requested type\n", map.nt_name));
3591 continue;
3592 }
3593 if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
3594 DEBUG(11,("enum_group_mapping: group %s is non mapped\n", map.nt_name));
3595 continue;
3596 }
3597
3598 mapt=(GROUP_MAP *)Realloc((*rmap), (entries+1)*sizeof(GROUP_MAP));
3599 if (!mapt) {
3600 DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n"));
3601 SAFE_FREE(*rmap);
3602 return NT_STATUS_UNSUCCESSFUL;
3603 }
3604 else
3605 (*rmap) = mapt;
3606
3607 mapt[entries] = map;
3608
3609 entries += 1;
3610
3611 }
3612 ldapsam_endsamgrent(methods);
3613
3614 *num_entries = entries;
3615
3616 return NT_STATUS_OK;
3617 }
3618
3619 /**********************************************************************
3620 *********************************************************************/
3621
3622 static NTSTATUS pdb_init_ldapsam_common(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method,
3623 const char *location)
3624 {
3625 NTSTATUS nt_status;
3626 struct ldapsam_privates *ldap_state;
3627
3628 if (!NT_STATUS_IS_OK(nt_status = make_pdb_methods(pdb_context->mem_ctx, pdb_method))) {
3629 return nt_status;
3630 }
3631
3632 (*pdb_method)->name = "ldapsam";
3633
3634 (*pdb_method)->setsampwent = ldapsam_setsampwent;
3635 (*pdb_method)->endsampwent = ldapsam_endsampwent;
3636 (*pdb_method)->getsampwent = ldapsam_getsampwent;
3637 (*pdb_method)->getsampwnam = ldapsam_getsampwnam;
3638 (*pdb_method)->getsampwsid = ldapsam_getsampwsid;
3639 (*pdb_method)->add_sam_account = ldapsam_add_sam_account;
3640 (*pdb_method)->update_sam_account = ldapsam_update_sam_account;
3641 (*pdb_method)->delete_sam_account = ldapsam_delete_sam_account;
3642
3643 (*pdb_method)->getgrsid = ldapsam_getgrsid;
3644 (*pdb_method)->getgrgid = ldapsam_getgrgid;
3645 (*pdb_method)->getgrnam = ldapsam_getgrnam;
3646 (*pdb_method)->add_group_mapping_entry = ldapsam_add_group_mapping_entry;
3647 (*pdb_method)->update_group_mapping_entry = ldapsam_update_group_mapping_entry;
3648 (*pdb_method)->delete_group_mapping_entry = ldapsam_delete_group_mapping_entry;
3649 (*pdb_method)->enum_group_mapping = ldapsam_enum_group_mapping;
3650
3651 /* TODO: Setup private data and free */
3652
3653 ldap_state = talloc_zero(pdb_context->mem_ctx, sizeof(struct ldapsam_privates));
3654
3655 if (!ldap_state) {
3656 DEBUG(0, ("talloc() failed for ldapsam private_data!\n"));
3657 return NT_STATUS_NO_MEMORY;
3658 }
3659
3660 if (location) {
3661 ldap_state->uri = talloc_strdup(pdb_context->mem_ctx, location);
3662 } else {
3663 ldap_state->uri = "ldap://localhost";
3664 }
3665
3666 ldap_state->domain_name = talloc_strdup(pdb_context->mem_ctx, get_global_sam_name());
3667 if (!ldap_state->domain_name) {
3668 return NT_STATUS_NO_MEMORY;
3669 }
3670
3671 sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
3672
3673 (*pdb_method)->private_data = ldap_state;
3674
3675 (*pdb_method)->free_private_data = free_private_data;
3676
3677 return NT_STATUS_OK;
3678 }
3679
3680 /**********************************************************************
3681 *********************************************************************/
3682
3683 static NTSTATUS pdb_init_ldapsam_compat(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location)
3684 {
3685 NTSTATUS nt_status;
3686 struct ldapsam_privates *ldap_state;
3687
3688 if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) {
3689 return nt_status;
3690 }
3691
3692 (*pdb_method)->name = "ldapsam_compat";
3693
3694 ldap_state = (*pdb_method)->private_data;
3695 ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT;
3696
3697 if (location) {
3698 ldap_state->uri = talloc_strdup(pdb_context->mem_ctx, location);
3699 } else {
3700 #ifndef WITH_LDAP_SAMCONFIG
3701 ldap_state->uri = "ldap://localhost";
3702 #else
3703 int ldap_port = lp_ldap_port();
3704
3705 /* remap default port if not using SSL (ie clear or TLS) */
3706 if ( (lp_ldap_ssl() != LDAP_SSL_ON) && (ldap_port == 636) ) {
3707 ldap_port = 389;
3708 }
3709
3710 ldap_state->uri = talloc_asprintf(pdb_context->mem_ctx, "%s://%s:%d", lp_ldap_ssl() == LDAP_SSL_ON ? "ldaps" : "ldap", lp_ldap_server(), ldap_port);
3711 if (!ldap_state->uri) {
3712 return NT_STATUS_NO_MEMORY;
3713 }
3714 #endif
3715 }
3716
3717 return NT_STATUS_OK;
3718 }
3719
3720 /**********************************************************************
3721 *********************************************************************/
3722
3723 static NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location)
3724 {
3725 NTSTATUS nt_status;
3726 struct ldapsam_privates *ldap_state;
3727 uint32 low_idmap_uid, high_idmap_uid;
3728 uint32 low_idmap_gid, high_idmap_gid;
3729
3730 if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) {
3731 return nt_status;
3732 }
3733
3734 (*pdb_method)->name = "ldapsam";
3735
3736 ldap_state = (*pdb_method)->private_data;
3737 ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
3738 ldap_state->permit_non_unix_accounts = False;
3739
3740 /* check for non-unix account ranges */
3741
3742 if (lp_idmap_uid(&low_idmap_uid, &high_idmap_uid)
3743 && lp_idmap_gid(&low_idmap_gid, &high_idmap_gid))
3744 {
3745 DEBUG(2, ("Enabling non-unix account ranges\n"));
3746
3747 ldap_state->permit_non_unix_accounts = True;
3748
3749 ldap_state->low_allocated_user_rid = fallback_pdb_uid_to_user_rid(low_idmap_uid);
3750 ldap_state->high_allocated_user_rid = fallback_pdb_uid_to_user_rid(high_idmap_uid);
3751 ldap_state->low_allocated_group_rid = pdb_gid_to_group_rid(low_idmap_gid);
3752 ldap_state->high_allocated_group_rid = pdb_gid_to_group_rid(high_idmap_gid);
3753 }
3754
3755 return NT_STATUS_OK;
3756 }
3757
3758 NTSTATUS pdb_ldap_init(void)
3759 {
3760 NTSTATUS nt_status;
3761 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam)))
3762 return nt_status;
3763
3764 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_compat", pdb_init_ldapsam_compat)))
3765 return nt_status;
3766
3767 return NT_STATUS_OK;
3768 }
3769
3770