c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * CDDL HEADER START
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * The contents of this file are subject to the terms of the
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * Common Development and Distribution License (the "License").
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * You may not use this file except in compliance with the License.
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * See the License for the specific language governing permissions
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * and limitations under the License.
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * When distributing Covered Code, include this CDDL HEADER in each
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * If applicable, add the following below this CDDL HEADER, with the
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * fields enclosed by brackets "[]" replaced with your own identifying
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * information: Portions Copyright [yyyy] [name of copyright owner]
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * CDDL HEADER END
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Copyright 2014 Nexenta Systems, Inc. All rights reserved.
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw * Config routines common to idmap(1M) and idmapd(1M)
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross * Default cache timeouts. Can override via svccfg
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross * config/id_cache_timeout = count: seconds
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross * config/name_cache_timeout = count: seconds
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Default maximum time between rediscovery runs.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * config/rediscovery_interval = count: seconds
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Mininum time between rediscovery runs, in case adutils gives us a
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * really short TTL (which it never should, but be defensive)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * (not configurable) seconds.
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai EVENT_ROUTING, /* An interesting routing event happened */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross EVENT_KICKED, /* Force rediscovery, i.e. DC failed. */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Rossstatic void idmapd_set_krb5_realm(char *);
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desaistruct enum_lookup_map directory_mapping_map[] = {
12b65585e720714b31036daaa2b30eb76014048eGordon Ross *machine_uuid = calloc(1, UUID_PRINTABLE_STRING_LENGTH + 1);
8edda6281c84e0632a22f9c8dbf0d6f1558878ebbaban return (-1);
12b65585e720714b31036daaa2b30eb76014048eGordon Rossgenerate_machine_sid(char **machine_sid, char *machine_uuid)
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * Split the 128-bit machine UUID into three 32-bit values
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * we'll use as the "sub-authorities" of the machine SID.
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * The machine_sid will have the form S-1-5-21-J-K-L
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * (that's four sub-authorities altogether) where:
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * J = last 4 bytes of node_addr,
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * K = time_mid, time_hi_and_version
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * L = time_low
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * (see struct uuid)
12b65585e720714b31036daaa2b30eb76014048eGordon Ross len = asprintf(machine_sid, "S-1-5-21-%u-%u-%u",
12b65585e720714b31036daaa2b30eb76014048eGordon Ross return (-1);
8edda6281c84e0632a22f9c8dbf0d6f1558878ebbaban return (0);
479ac37569625bae44ffb80071d4bc865fc710eddm/* In the case of error, exists is set to FALSE anyway */
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desaiprop_exists(idmap_cfg_handles_t *handles, const char *name, boolean_t *exists)
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapdlog(LOG_ERR, "scf_property_create() failed: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright return (-1);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright if (scf_pg_get_property(handles->config_pg, name, scf_prop) == 0)
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wrightget_debug(idmap_cfg_handles_t *handles, const char *name)
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapdlog(LOG_ERR, "scf_property_create() failed: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapdlog(LOG_ERR, "scf_value_create() failed: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright if (scf_pg_get_property(handles->debug_pg, name, scf_prop) < 0) {
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* this is OK: the property is just undefined */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright if (scf_property_get_value(scf_prop, value) < 0) {
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* It is still OK when a property doesn't have any value */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapdlog(LOG_ERR, "Can not retrieve %s/%s: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright return ((int)i64);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wrightget_val_bool(idmap_cfg_handles_t *handles, const char *name,
479ac37569625bae44ffb80071d4bc865fc710eddm return (-1);
479ac37569625bae44ffb80071d4bc865fc710eddm return (-1);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* It is OK if the property is undefined */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright if (scf_pg_get_property(handles->config_pg, name, scf_prop) < 0)
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* It is still OK when a property doesn't have any value */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright if (scf_property_get_value(scf_prop, value) < 0)
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desaiget_val_int(idmap_cfg_handles_t *handles, const char *name,
4aa0a5e7deb6e3c2696f52132d8a07062ffd5814nw switch (type) {
479ac37569625bae44ffb80071d4bc865fc710eddm return (-1);
479ac37569625bae44ffb80071d4bc865fc710eddm return (-1);
c8e261054d98729a8718903716b9b8a512d8b693jp if (scf_pg_get_property(handles->config_pg, name, scf_prop) < 0)
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw /* this is OK: the property is just undefined */
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw /* It is still OK when a property doesn't have any value */
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw switch (type) {
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai /* NOTREACHED */
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai idmapdlog(LOG_ERR, "Can not retrieve config/%s: %s",
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw return (rc);
c5c4113dfcabb1eed3d4bdf7609de5170027a794nwstatic char *
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desaiscf_value2string(const char *name, scf_value_t *value)
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai max_val = scf_limit(SCF_LIMIT_MAX_VALUE_LENGTH);
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai if (scf_value_get_astring(value, buf, max_val + 1) < 0) {
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai idmapdlog(LOG_ERR, "Can not retrieve config/%s: %s",
c8e261054d98729a8718903716b9b8a512d8b693jpget_val_ds(idmap_cfg_handles_t *handles, const char *name, int defport,
479ac37569625bae44ffb80071d4bc865fc710eddm return (-1);
479ac37569625bae44ffb80071d4bc865fc710eddm return (-1);
479ac37569625bae44ffb80071d4bc865fc710eddm return (-1);
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw if (scf_pg_get_property(handles->config_pg, name, scf_prop) < 0) {
c8e261054d98729a8718903716b9b8a512d8b693jp /* this is OK: the property is just undefined */
71590c90e239661c113497da3ca8b7301dfbe24cnw "scf_iter_property_values(%s) failed: %s",
c8e261054d98729a8718903716b9b8a512d8b693jp /* Workaround scf bugs -- can't reset an iteration */
c8e261054d98729a8718903716b9b8a512d8b693jp if (count == 0) {
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw if (count == 0) {
c8e261054d98729a8718903716b9b8a512d8b693jp /* no values */
c8e261054d98729a8718903716b9b8a512d8b693jp if ((servers = calloc(count + 1, sizeof (*servers))) == NULL) {
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw while (i < count && scf_iter_next_value(iter, value) > 0) {
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross if ((host = scf_value2string(name, value)) == NULL)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Ignore this server if the hostname is too long
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * or empty (continue without i++)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmapdlog(LOG_ERR, "Host name too long: %s", host);
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Get the host address too. If we can't, then
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * log an error and skip this host.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmapdlog(LOG_ERR, "No address for host: %s (%s)",
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross (void) memcpy(&servers[i].addr, ai->ai_addr, ai->ai_addrlen);
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross /* Added a DS to the array. */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross if (i == 0) {
c8e261054d98729a8718903716b9b8a512d8b693jp if (rc < 0) {
c8e261054d98729a8718903716b9b8a512d8b693jp return (rc);
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desaiget_val_astring(idmap_cfg_handles_t *handles, const char *name, char **val)
479ac37569625bae44ffb80071d4bc865fc710eddm return (-1);
479ac37569625bae44ffb80071d4bc865fc710eddm return (-1);
c8e261054d98729a8718903716b9b8a512d8b693jp if (scf_pg_get_property(handles->config_pg, name, scf_prop) < 0)
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw /* this is OK: the property is just undefined */
71590c90e239661c113497da3ca8b7301dfbe24cnw "scf_property_get_value(%s) failed: %s",
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw if (rc < 0) {
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw return (rc);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright const char *name)
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai if ((tx = scf_transaction_create(handles->main)) == NULL) {
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "scf_transaction_create() failed: %s",
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai if ((ent = scf_entry_create(handles->main)) == NULL) {
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "scf_entry_create() failed: %s",
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "scf_pg_update(%s) failed: %s",
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "scf_transaction_start(%s) failed: %s",
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai if (scf_transaction_property_delete(tx, ent, name) != 0) {
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai /* Don't complain if it already doesn't exist. */
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "scf_transaction_property_delete() failed:"
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai } while (ret == 0);
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "scf_transaction_commit(%s) failed: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright const char *name,
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright if ((prop = scf_property_create(handles->main)) == NULL ||
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright for (i = 0; i < MAX_TRIES; i++) {
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "scf_pg_update() failed: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "scf_transaction_start(%s) failed: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright if (scf_transaction_property_change_type(tx, ent, name,
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "scf_transaction_property_change_type(%s)"
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright " failed: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright } else if (scf_error() == SCF_ERROR_NOT_FOUND) {
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "scf_transaction_property_new() failed: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "scf_pg_get_property(%s) failed: %s",
71590c90e239661c113497da3ca8b7301dfbe24cnw "scf_entry_add_value() failed: %s",
8edda6281c84e0632a22f9c8dbf0d6f1558878ebbaban * Property group set in scf_transaction_start()
8edda6281c84e0632a22f9c8dbf0d6f1558878ebbaban * is not the most recent. Update pg, reset tx and
8edda6281c84e0632a22f9c8dbf0d6f1558878ebbaban * retry tx.
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "scf_transaction_commit(%s) failed: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "scf_transaction_commit(%s) failed: %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* Success! */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright const char *name,
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright if ((value = scf_value_create(handles->main)) == NULL) {
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright return (-1);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright const char *name,
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright const char *val)
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright if ((value = scf_value_create(handles->main)) == NULL) {
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "scf_value_set_astring() failed: %s",
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * This function updates a boolean value.
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * If nothing has changed it returns 0 else 1
7a8a68f5e3efbaec1a375c2d50bd20b566631755Julian Pullenupdate_bool(boolean_t *value, boolean_t *new, char *name)
4aa0a5e7deb6e3c2696f52132d8a07062ffd5814nw return (0);
4aa0a5e7deb6e3c2696f52132d8a07062ffd5814nw return (1);
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross * This function updates a uint64_t value.
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross * If nothing has changed it returns 0 else 1
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Rossupdate_uint64(uint64_t *value, uint64_t *new, char *name)
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross idmapdlog(LOG_INFO, "change %s=%llu", name, *new);
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * This function updates a string value.
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * If nothing has changed it returns 0 else 1
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright else if (*new != NULL && *value != NULL && strcmp(*new, *value) != 0)
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * Note that even if unchanged we can't just return; we must free one
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * of the values.
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapdlog(LOG_INFO, "change %s=%s", name, CHECK_NULL(*new));
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desaiupdate_enum(int *value, int *new, char *name, struct enum_lookup_map *map)
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * This function updates a directory service structure.
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * If nothing has changed it returns 0 else 1
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Rossupdate_dirs(ad_disc_ds_t **value, ad_disc_ds_t **new, char *name)
0dcc71495bad040a0c83830efc85acf8d897350dnw /* Nothing to do */
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (0);
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (0);
0dcc71495bad040a0c83830efc85acf8d897350dnw /* We're unsetting this DS property */
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (1);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* List all the new DSs */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross if (ad_disc_getnameinfo(buf, sizeof (buf), &ds->addr))
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmapdlog(LOG_INFO, "change %s=%s addr=%s port=%d",
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (1);
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * This function updates a trusted domains structure.
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * If nothing has changed it returns 0 else 1
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullenupdate_trusted_domains(ad_disc_trusteddomains_t **value,
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen /* Nothing to do */
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen ad_disc_compare_trusteddomains(*value, *new) == 0) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen /* We're unsetting this DS property */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* List all the new domains */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright for (i = 0; (*value)[i].domain[0] != '\0'; i++) {
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapdlog(LOG_INFO, "change %s=%s direction=%s", name,
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright enum_lookup((*value)[i].direction, trust_dir_map));
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * This function updates a domains in a forest structure.
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * If nothing has changed it returns 0 else 1
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullenupdate_domains_in_forest(ad_disc_domainsinforest_t **value,
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen /* Nothing to do */
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen ad_disc_compare_domainsinforest(*value, *new) == 0) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen /* We're unsetting this DS property */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* List all the new domains */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright for (i = 0; (*value)[i].domain[0] != '\0'; i++) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullenfree_trusted_forests(idmap_trustedforest_t **value, int *num_values)
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen for (i = 0; i < *num_values; i++) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullencompare_trusteddomainsinforest(ad_disc_domainsinforest_t *df1,
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * This function updates trusted forest structure.
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * If nothing has changed it returns 0 else 1
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullenupdate_trusted_forest(idmap_trustedforest_t **value, int *num_value,
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen idmap_trustedforest_t **new, int *num_new, char *name)
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen /* Nothing to do */
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen for (i = 0; i < *num_value; i++) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen for (j = 0; j < *num_new; j++) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen /* We're unsetting this DS property */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* List all the trusted forests */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright for (i = 0; i < *num_value; i++) {
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* List trusted Domains in the forest. */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "change %s=%s domain=%s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright /* List the hosts */
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "change %s=%s host=%s port=%d",
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desaienum_lookup(int value, struct enum_lookup_map *map)
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai return ("(invalid)");
0dcc71495bad040a0c83830efc85acf8d897350dnw * Returns 1 if the PF_ROUTE socket event indicates that we should rescan the
0dcc71495bad040a0c83830efc85acf8d897350dnw * interfaces.
0dcc71495bad040a0c83830efc85acf8d897350dnw * Shamelessly based on smb_nics_changed() and other PF_ROUTE uses in ON.
0dcc71495bad040a0c83830efc85acf8d897350dnw for (;;) {
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * Wait for an event, and report what kind of event occurred.
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * Note that there are cases where we are awoken but don't care about
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * the lower-level event. We can't just loop here because we can't
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * readily calculate how long to sleep the next time. We return
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * EVENT_NOTHING and let the caller loop.
c8e261054d98729a8718903716b9b8a512d8b693jp switch (errno) {
c8e261054d98729a8718903716b9b8a512d8b693jp /* Timeout */
0dcc71495bad040a0c83830efc85acf8d897350dnw /* EBADF, EBADFD, EFAULT, EINVAL (end of time?)? */
0dcc71495bad040a0c83830efc85acf8d897350dnw /* NOTREACHED */
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * This isn't documented, but seems to be what you get if
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * the timeout is zero seconds and there are no events
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * PF_ROUTE socket read event:
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * re-associate fd
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * handle event
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai if (port_associate(idmapd_ev_port, PORT_SOURCE_FD,
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai idmapdlog(LOG_ERR, "Failed to re-associate the "
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai "routing socket with the event port: %s",
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * The network configuration may still be in flux.
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * No matter, the resolver will re-transmit and
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * timeout if need be.
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "Interesting routing event");
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "Boring routing event");
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai /* Event on an FD other than the routing FD? Ignore it. */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmap_pg_config_t *pgcfg = &_idmapdstate.cfg->pgcfg;
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai const ad_disc_t ad_ctx = _idmapdstate.cfg->handles.ad_ctx;
7a8a68f5e3efbaec1a375c2d50bd20b566631755Julian Pullen idmapdlog(LOG_ERR, "Fatal errors while reading "
349d5d8f2e43f7f425bc3d025dda555187160ab7nw "SMF properties");
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai "Errors re-loading configuration may cause AD "
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai "lookups to fail");
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * Wait for an interesting event. Note that we might get
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * boring events between interesting events. If so, we loop.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * If we don't know our domain name, don't bother
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * with rediscovery until the next config change.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Avoids hourly noise in workgroup mode.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross "_cfg_update_thread waiting");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Forget any DC we had previously.
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * Blow away the ccache, we might have
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * re-joined the domain or joined a new one
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai /* Already logged to DEBUG */
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai /* An interesting event! */
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * Lint isn't happy with the concept of a function declared to
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * return something, that doesn't return. Of course, merely adding
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai * the return isn't enough, because it's never reached...
c8e261054d98729a8718903716b9b8a512d8b693jp /*NOTREACHED*/
c8e261054d98729a8718903716b9b8a512d8b693jp return (-1);
0dcc71495bad040a0c83830efc85acf8d897350dnw return (-1);
71590c90e239661c113497da3ca8b7301dfbe24cnw idmapdlog(LOG_ERR, "Failed to set routing socket flags: %s",
0dcc71495bad040a0c83830efc85acf8d897350dnw return (-1);
0dcc71495bad040a0c83830efc85acf8d897350dnw return (-1);
0dcc71495bad040a0c83830efc85acf8d897350dnw (void) port_dissociate(idmapd_ev_port, PORT_SOURCE_FD, rt_sock);
0dcc71495bad040a0c83830efc85acf8d897350dnw return (-1);
0dcc71495bad040a0c83830efc85acf8d897350dnw return (0);
479ac37569625bae44ffb80071d4bc865fc710eddm * Reject attribute names with invalid characters.
479ac37569625bae44ffb80071d4bc865fc710eddm return (0);
479ac37569625bae44ffb80071d4bc865fc710eddm return (1);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright const char *name)
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapdlog(LOG_DEBUG, "%s/%s = %d", DEBUG_PG, name, val);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wrightcheck_smf_debug_mode(idmap_cfg_handles_t *handles)
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapd_set_debug(handles, IDMAPD_DEBUG_ALL, "all");
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapd_set_debug(handles, IDMAPD_DEBUG_CONFIG, "config");
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapd_set_debug(handles, IDMAPD_DEBUG_MAPPING, "mapping");
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapd_set_debug(handles, IDMAPD_DEBUG_DISC, "discovery");
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapd_set_debug(handles, IDMAPD_DEBUG_DNS, "dns");
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapd_set_debug(handles, IDMAPD_DEBUG_LDAP, "ldap");
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright adutils_set_debug(AD_DEBUG_ALL, _idmapdstate.debug[IDMAPD_DEBUG_ALL]);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright adutils_set_debug(AD_DEBUG_DISC, _idmapdstate.debug[IDMAPD_DEBUG_DISC]);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright adutils_set_debug(AD_DEBUG_DNS, _idmapdstate.debug[IDMAPD_DEBUG_DNS]);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright adutils_set_debug(AD_DEBUG_LDAP, _idmapdstate.debug[IDMAPD_DEBUG_LDAP]);
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * This is the half of idmap_cfg_load() that loads property values from
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * SMF (using the config/ property group of the idmap FMRI).
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * Return values: 0 -> success, -1 -> failure, -2 -> hard failures
479ac37569625bae44ffb80071d4bc865fc710eddm * -3 -> hard smf config failures
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * reading from SMF.
349d5d8f2e43f7f425bc3d025dda555187160ab7nwidmap_cfg_load_smf(idmap_cfg_handles_t *handles, idmap_pg_config_t *pgcfg,
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (-2);
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (-2);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright rc = get_val_bool(handles, "unresolvable_sid_mapping",
479ac37569625bae44ffb80071d4bc865fc710eddm if (rc != 0)
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright rc = get_val_bool(handles, "disable_cross_forest_trusts",
4aa0a5e7deb6e3c2696f52132d8a07062ffd5814nw if (rc != 0)
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai rc = get_val_astring(handles, "directory_based_mapping", &s);
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai else if (s == NULL || strcasecmp(s, "none") == 0)
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai pgcfg->directory_based_mapping = DIRECTORY_MAPPING_NONE;
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai pgcfg->directory_based_mapping = DIRECTORY_MAPPING_NAME;
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai pgcfg->directory_based_mapping = DIRECTORY_MAPPING_IDMU;
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai pgcfg->directory_based_mapping = DIRECTORY_MAPPING_NONE;
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "config/directory_based_mapping: invalid value \"%s\" ignored",
4aa0a5e7deb6e3c2696f52132d8a07062ffd5814nw if (rc != 0)
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross pgcfg->name_cache_timeout = NAME_CACHE_TMO_DEFAULT;
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross rc = get_val_int(handles, "rediscovery_interval",
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross pgcfg->rediscovery_interval = REDISCOVERY_INTERVAL_DEFAULT;
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw if (rc != 0)
c8e261054d98729a8718903716b9b8a512d8b693jp if (rc != 0) {
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw * SCF failures fetching config/default_domain we treat
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw * as fatal as they may leave ID mapping rules that
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw * match unqualified winnames flapping in the wind.
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (-2);
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai if (pgcfg->default_domain == NULL && pgcfg->domain_name != NULL) {
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai pgcfg->default_domain = strdup(pgcfg->domain_name);
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross rc = get_val_astring(handles, "domain_guid", &s);
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross /* OK, not set. */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross if (uuid_parse(s, u) != 0) {
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross "config/domain_guid: invalid value \"%s\" ignored", s);
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross (void) ad_disc_set_DomainGUID(handles->ad_ctx, u);
12b65585e720714b31036daaa2b30eb76014048eGordon Ross rc = get_val_astring(handles, "machine_uuid", &pgcfg->machine_uuid);
12b65585e720714b31036daaa2b30eb76014048eGordon Ross /* If machine_uuid not configured, generate one */
12b65585e720714b31036daaa2b30eb76014048eGordon Ross if (generate_machine_uuid(&pgcfg->machine_uuid) < 0)
12b65585e720714b31036daaa2b30eb76014048eGordon Ross return (-2);
12b65585e720714b31036daaa2b30eb76014048eGordon Ross rc = set_val_astring(handles, handles->config_pg,
c8e261054d98729a8718903716b9b8a512d8b693jp rc = get_val_astring(handles, "machine_sid", &pgcfg->machine_sid);
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw if (rc != 0)
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * If machine_sid not configured, generate one
12b65585e720714b31036daaa2b30eb76014048eGordon Ross * from the machine UUID.
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (-2);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright rc = set_val_astring(handles, handles->config_pg,
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw if (rc != 0)
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw if (rc != 0)
c8e261054d98729a8718903716b9b8a512d8b693jp rc = get_val_astring(handles, "forest_name", &pgcfg->forest_name);
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw if (rc != 0)
c8e261054d98729a8718903716b9b8a512d8b693jp rc = get_val_astring(handles, "site_name", &pgcfg->site_name);
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw if (rc != 0)
349d5d8f2e43f7f425bc3d025dda555187160ab7nw (void) ad_disc_set_SiteName(handles->ad_ctx, pgcfg->site_name);
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw if (rc != 0)
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai /* Unless we're doing directory-based name mapping, we're done. */
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai if (pgcfg->directory_based_mapping != DIRECTORY_MAPPING_NAME)
349d5d8f2e43f7f425bc3d025dda555187160ab7nw if (rc != 0)
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (-2);
479ac37569625bae44ffb80071d4bc865fc710eddm idmapdlog(LOG_ERR, "config/ad_unixuser_attr=%s is not a "
479ac37569625bae44ffb80071d4bc865fc710eddm return (-3);
349d5d8f2e43f7f425bc3d025dda555187160ab7nw if (rc != 0)
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (-2);
479ac37569625bae44ffb80071d4bc865fc710eddm idmapdlog(LOG_ERR, "config/ad_unixgroup_attr=%s is not a "
479ac37569625bae44ffb80071d4bc865fc710eddm return (-3);
349d5d8f2e43f7f425bc3d025dda555187160ab7nw if (rc != 0)
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (-2);
479ac37569625bae44ffb80071d4bc865fc710eddm idmapdlog(LOG_ERR, "config/nldap_winname_attr=%s is not a "
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (-3);
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "If config/directory_based_mapping property is set to "
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "\"name\" then at least one of the following name mapping "
349d5d8f2e43f7f425bc3d025dda555187160ab7nw "attributes must be specified. (config/ad_unixuser_attr OR "
479ac37569625bae44ffb80071d4bc865fc710eddm "config/ad_unixgroup_attr OR config/nldap_winname_attr)");
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (-3);
349d5d8f2e43f7f425bc3d025dda555187160ab7nw return (rc);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapdlog(LOG_DEBUG, "unable to discover %s", what);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wrightdiscover_trusted_domains(idmap_pg_config_t *pgcfg, ad_disc_t ad_ctx)
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen int i, j, k, l;
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen if (pgcfg->forest_name != NULL && pgcfg->trusted_domains != NULL &&
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen pgcfg->trusted_domains[0].domain[0] != '\0') {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * We have trusted domains. We need to go through every
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * one and find its forest. If it is a new forest we then need
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * to find its Global Catalog and the domains in the forest
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen for (i = 0; pgcfg->trusted_domains[i].domain[0] != '\0'; i++)
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen for (i = 0; pgcfg->trusted_domains[i].domain[0] != '\0'; i++) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen trusteddomain = pgcfg->trusted_domains[i].domain;
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "unable to discover Forest Name"
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright " for the trusted domain %s",
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen if (strcasecmp(forestname, pgcfg->forest_name) == 0) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * Ignore the domain as it is part of
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * the primary forest
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen /* Is this a new forest? */
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen for (k = 0; k < j; k++) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen /* Mark the domain as trusted */
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * Get the Global Catalog and the domains in
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen * this new forest.
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "unable to discover Global Catalog"
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright " for the trusted domain %s",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "unable to discover Domains in the"
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright " Forest for the trusted domain %s",
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen trustedforests[j].global_catalog = globalcatalog;
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen trustedforests[j].domains_in_forest = domainsinforest;
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen /* Mark the domain as trusted */
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen for (l = 0; domainsinforest[l].domain[0] != '\0';
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * This is the half of idmap_cfg_load() that auto-discovers values of
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * discoverable properties that weren't already set via SMF properties.
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * idmap_cfg_discover() is called *after* idmap_cfg_load_smf(), so it
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * needs to be careful not to overwrite any properties set in SMF.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Rossidmap_cfg_discover1(idmap_cfg_handles_t *handles, idmap_pg_config_t *pgcfg)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmapdlog(LOG_DEBUG, "Running domain discovery.");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status_fp = fopen(IDMAP_CACHEDIR "/discovery.log", "w");
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapdlog(LOG_DEBUG, "No domain name specified.");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross (void) fprintf(status_fp, "(no domain name)\n");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross pgcfg->forest_name = ad_disc_get_ForestName(ad_ctx,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross log_if_unable(pgcfg->domain_name, "Domain Name");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross "Domain Controller");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross log_if_unable(pgcfg->domain_guid, "Domain GUID");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross log_if_unable(pgcfg->forest_name, "Forest Name");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Log when this took more than 15 sec.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmapdlog(LOG_NOTICE, "Domain discovery took %d sec.",
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmapdlog(LOG_NOTICE, "Check the DNS configuration.");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * This is the second part of discovery, which can take a while.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * We don't want to hold up parties who just want to know what
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * domain controller we're using (like smbd), so this part runs
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * after we've updated that info in the "live" config and told
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * such consumers to go ahead.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * This is a lot like idmap_cfg_discover(), but used LDAP queries
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * get the forest information from the global catalog servers.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Note: the previous update_* calls have usually nuked any
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * useful information from pgcfg before we get here, so we
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * can only use it store discovery results, not to read.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Rossidmap_cfg_discover2(idmap_cfg_handles_t *handles, idmap_pg_config_t *pgcfg)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmapdlog(LOG_DEBUG, "Running forest discovery.");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status_fp = fopen(IDMAP_CACHEDIR "/discovery.log", "a");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross log_if_unable(pgcfg->global_catalog, "Global Catalog");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross "Domains in the Forest");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross /* Empty trusted domains list is OK. */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Log when this took more than 30 sec.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmapdlog(LOG_NOTICE, "Forest discovery took %d sec.",
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * idmap_cfg_load() is called at startup, and periodically via the
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * update thread when the auto-discovery TTLs expire, as well as part of
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * the refresh method, to update the current configuration. It always
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * reads from SMF, but you still have to refresh the service after
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * changing the config pg in order for the changes to take effect.
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * There is one flag:
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * - CFG_DISCOVER
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * If CFG_DISCOVER is set then idmap_cfg_load() calls
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * idmap_cfg_discover() to discover, via DNS and LDAP lookups, property
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * values that weren't set in SMF.
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * idmap_cfg_load() will log (to LOG_NOTICE) whether the configuration
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * Return values: 0 -> success, -1 -> failure, -2 -> hard failures
349d5d8f2e43f7f425bc3d025dda555187160ab7nw * reading from SMF.
349d5d8f2e43f7f425bc3d025dda555187160ab7nw if ((rc = idmap_cfg_load_smf(&cfg->handles, &new_pgcfg, &errors)) < -1)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Unless we've been asked to forget the current DC,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * give preference (in order) to the preferred DC if
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * configured, or the current DC. These preferences
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * reduce undesirable DC changes.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross } else if (live_pgcfg->domain_controller != NULL) {
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * We want a way to tell adspriv_getdcname_1_svc()
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * (and others) that discovery is running and therefore
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * they may want to wait a bit or return an error...
349d5d8f2e43f7f425bc3d025dda555187160ab7nw /* Non-discoverable props updated here */
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross changed += update_uint64(&live_pgcfg->list_size_limit,
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross changed += update_uint64(&live_pgcfg->id_cache_timeout,
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross &new_pgcfg.id_cache_timeout, "id_cache_timeout");
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross changed += update_uint64(&live_pgcfg->name_cache_timeout,
48cd229b73530d4ff90bcaca099aec95e2126239Gordon Ross &new_pgcfg.name_cache_timeout, "name_cache_timeout");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross changed += update_uint64(&live_pgcfg->rediscovery_interval,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross &new_pgcfg.rediscovery_interval, "rediscovery_interval");
4aa0a5e7deb6e3c2696f52132d8a07062ffd5814nw &new_pgcfg.eph_map_unres_sids, "unresolvable_sid_mapping");
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright changed += update_bool(&live_pgcfg->disable_cross_forest_trusts,
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "disable_cross_forest_trusts");
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai changed += update_enum(&live_pgcfg->directory_based_mapping,
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai &new_pgcfg.directory_based_mapping, "directory_based_mapping",
4aa0a5e7deb6e3c2696f52132d8a07062ffd5814nw changed += update_string(&live_pgcfg->nldap_winname_attr,
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai changed += update_string(&live_pgcfg->default_domain,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross changed += update_dirs(&live_pgcfg->preferred_dc,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross /* Props that can be discovered or set in SMF updated here */
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen live_pgcfg->domain_name_auto_disc = new_pgcfg.domain_name_auto_disc;
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross changed += update_string(&live_pgcfg->domain_guid,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross live_pgcfg->domain_guid_auto_disc = new_pgcfg.domain_guid_auto_disc;
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross dc_changed = update_dirs(&live_pgcfg->domain_controller,
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen live_pgcfg->forest_name_auto_disc = new_pgcfg.forest_name_auto_disc;
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen live_pgcfg->site_name_auto_disc = new_pgcfg.site_name_auto_disc;
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmapdlog(LOG_NOTICE, "Configuration unchanged");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Discovery2 can take a while.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross /* More props that can be discovered or set in SMF */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross changed += update_dirs(&live_pgcfg->global_catalog,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross /* Props that are only discovered (never in SMF) */
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen if (update_domains_in_forest(&live_pgcfg->domains_in_forest,
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen &new_pgcfg.domains_in_forest, "domains_in_forest")) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen if (update_trusted_domains(&live_pgcfg->trusted_domains,
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen &new_pgcfg.trusted_domains, "trusted_domains")) {
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen live_pgcfg->trusted_domains[0].domain[0] != '\0')
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen if (update_trusted_forest(&live_pgcfg->trusted_forests,
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen &live_pgcfg->num_trusted_forests, &new_pgcfg.trusted_forests,
4d61c878ad5fbf36c5338bef5994cc5fe88a589aJulian Pullen &new_pgcfg.num_trusted_forests, "trusted_forest")) {
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright idmapdlog(LOG_NOTICE, "Configuration unchanged");
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright (void) pthread_mutex_unlock(&cfg->handles.mutex);
e3c2d6aa3bc760b22fad3c83f876553f0d2c5b66nw return (rc);
651c0131ccc65381cbda174bee44a4fd7a518d6bbaban * Initialize 'cfg'.
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw /* First the smf repository handles: */
c8e261054d98729a8718903716b9b8a512d8b693jp if (!(handles->service = scf_service_create(handles->main)) ||
c8e261054d98729a8718903716b9b8a512d8b693jp !(handles->instance = scf_instance_create(handles->main)) ||
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright !(handles->debug_pg = scf_pg_create(handles->main))) {
71590c90e239661c113497da3ca8b7301dfbe24cnw idmapdlog(LOG_ERR, "scf_handle_decode_fmri() failed: %s",
c8e261054d98729a8718903716b9b8a512d8b693jp /* Initialize AD Auto Discovery context */
c5c4113dfcabb1eed3d4bdf7609de5170027a794nw return (0);
349d5d8f2e43f7f425bc3d025dda555187160ab7nw (void) port_send(idmapd_ev_port, POKE_AUTO_DISCOVERY, NULL);
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross idmapdlog(LOG_INFO, "idmap_cfg_force_rediscovery");
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross (void) port_send(idmapd_ev_port, KICK_AUTO_DISCOVERY, NULL);
0dcc71495bad040a0c83830efc85acf8d897350dnw/*ARGSUSED*/
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * Upgrade the debug flags.
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * We're replacing a single debug flag with a fine-grained mechanism that
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * is also capable of considerably more verbosity. We'll take a stab at
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * producing roughly the same level of output.
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright rc = prop_exists(handles, DEBUG_PROP, &debug_present);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright "Upgrading old %s/%s setting to %s/* settings.",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright rc = set_val_integer(handles, handles->debug_pg, "config", 1);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright rc = set_val_integer(handles, handles->debug_pg, "discovery", 1);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright rc = del_val(handles, handles->config_pg, DEBUG_PROP);
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai * Upgrade the DS mapping flags.
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai * If the old ds_name_mapping_enabled flag is present, then
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai * if the new directory_based_mapping value is present, then
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai * if the two are compatible, delete the old and note it
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai * else delete the old and warn
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai * set the new based on the old, and note it
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai * delete the old
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desaiupgrade_directory_mapping(idmap_cfg_handles_t *handles)
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai const char DS_NAME_MAPPING_ENABLED[] = "ds_name_mapping_enabled";
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai const char DIRECTORY_BASED_MAPPING[] = "directory_based_mapping";
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai rc = prop_exists(handles, DS_NAME_MAPPING_ENABLED,
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright rc = get_val_bool(handles, DS_NAME_MAPPING_ENABLED,
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai rc = get_val_astring(handles, DIRECTORY_BASED_MAPPING,
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "Upgrading old %s=%s setting\n"
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "to %s=%s.",
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright rc = set_val_astring(handles, handles->config_pg,
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai if (strcasecmp(directory_based_mapping, "name") == 0)
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai if (legacy_ds_name_mapping_enabled == new_name_mapping) {
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "Automatically removing old %s=%s setting\n"
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "in favor of %s=%s.",
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai DIRECTORY_BASED_MAPPING, directory_based_mapping);
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "Removing conflicting %s=%s setting\n"
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai "in favor of %s=%s.",
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai DIRECTORY_BASED_MAPPING, directory_based_mapping);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright rc = del_val(handles, handles->config_pg, DS_NAME_MAPPING_ENABLED);
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai * Do whatever is necessary to upgrade idmap's configuration before
e3f2c991a8548408db0a2787bd8b43d5124821d3Keyur Desai * we load it.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * The LDAP code passes principal names lacking any
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * realm information, which causes mech_krb5 to do
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * awful things trying to figure out the realm.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Avoid that by making sure it has a default,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * even when krb5.conf is not configured.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross /* Convert to upper case, in place. */