54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/*
159d09a20817016f09b3ea28d1bdada4a336bb91Mark Phalan * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * Use is subject to license terms.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/*
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * lib/kdb/kdb_ldap/kdb_ldap.h
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * Copyright (c) 2004-2005, Novell, Inc.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * All rights reserved.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * Redistribution and use in source and binary forms, with or without
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * modification, are permitted provided that the following conditions are met:
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * * Redistributions of source code must retain the above copyright notice,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * this list of conditions and the following disclaimer.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * * Redistributions in binary form must reproduce the above copyright
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * notice, this list of conditions and the following disclaimer in the
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * documentation and/or other materials provided with the distribution.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * * The copyright holder's name is not used to endorse or promote products
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * derived from this software without specific prior written permission.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * POSSIBILITY OF SUCH DAMAGE.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#ifndef _KDB_LDAP_H
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define _KDB_LDAP_H 1
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* We want the interfaces marked "deprecated" in OpenLDAP. */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define LDAP_DEPRECATED 1
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include <ldap.h>
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* Check for acceptable versions.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf OpenLDAP version 2.2.6 is known to have some kind of problem that
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf is tickled by the use of multiple handles in this code. Version
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf 2.2.19 in Mac OS 10.4.7 seems to be buggy as well. Version 2.2.24
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf doesn't have this problem. Other in-between versions have not been
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf tested. */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#ifndef BUILD_WITH_BROKEN_LDAP
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf# if defined(LDAP_API_FEATURE_X_OPENLDAP)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf# if LDAP_VENDOR_VERSION < 20224
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf# error This code triggers bugs in old OpenLDAP implementations. Please update to 2.2.24 or later.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf# endif
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf# endif
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif /* BUILD_WITH_BROKEN_LDAP */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include <k5-thread.h>
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include <k5-platform.h> /* Solaris Kerberos */
159d09a20817016f09b3ea28d1bdada4a336bb91Mark Phalan#include <k5-platform-store_16.h>
159d09a20817016f09b3ea28d1bdada4a336bb91Mark Phalan#include <k5-platform-store_32.h>
159d09a20817016f09b3ea28d1bdada4a336bb91Mark Phalan#include <k5-platform-load_16.h>
159d09a20817016f09b3ea28d1bdada4a336bb91Mark Phalan#include <k5-platform-load_32.h>
159d09a20817016f09b3ea28d1bdada4a336bb91Mark Phalan
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include <kdb5.h>
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "k5-int.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "ldap_krbcontainer.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "ldap_realm.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfextern struct timeval timelimit;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* Solaris Kerberos: need this define to get around sccs keyword expansion */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define DATE_FORMAT "%Y" "%m" "%d" "%H" "%M" "%SZ"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define SERV_COUNT 100
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define DEFAULT_CONNS_PER_SERVER 5
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define REALM_READ_REFRESH_INTERVAL (5 * 60)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#ifdef HAVE_EDIRECTORY
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define SECURITY_CONTAINER "cn=Security"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KERBEROS_CONTAINER "cn=Kerberos,cn=Security"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#if !defined(LDAP_OPT_RESULT_CODE) && defined(LDAP_OPT_ERROR_NUMBER)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define LDAP_OPT_RESULT_CODE LDAP_OPT_ERROR_NUMBER
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define NEG(val) (val <0) ? abs(val) : -val ;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define MAXINTLEN 10
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define IGNORE_STATUS 0
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define CHECK_STATUS 1
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define SETUP_CONTEXT() if (context == NULL || context->db_context == NULL \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf || ((kdb5_dal_handle *)context->db_context)->db_context == NULL) { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf return EINVAL; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf dal_handle = (kdb5_dal_handle *)context->db_context; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context = (krb5_ldap_context *) dal_handle->db_context; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context == NULL || ldap_context->server_info_list == NULL) \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf return KRB5_KDB_DBNOTINITED;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define GET_HANDLE() ld = NULL; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = krb5_ldap_request_handle_from_pool(ldap_context, &ldap_server_handle); \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != 0) { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf prepend_err_str(context, "LDAP handle unavailable: ", KRB5_KDB_ACCESS_ERROR, st); \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = KRB5_KDB_ACCESS_ERROR; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ld = ldap_server_handle->ldap_handle;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfextern int set_ldap_error (krb5_context ctx, int st, int op);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfextern void prepend_err_str (krb5_context ctx, const char *s, krb5_error_code err, krb5_error_code oerr);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define LDAP_SEARCH(base, scope, filter, attrs) LDAP_SEARCH_1(base, scope, filter, attrs, CHECK_STATUS)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define LDAP_SEARCH_1(base, scope, filter, attrs, status_check) \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf do { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_search_ext_s(ld, base, scope, filter, attrs, 0, NULL, NULL, &timelimit, LDAP_NO_LIMIT, &result); \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (translate_ldap_error(st, OP_SEARCH) == KRB5_KDB_ACCESS_ERROR) { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf tempst = krb5_ldap_rebind(ldap_context, &ldap_server_handle); \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_server_handle) \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ld = ldap_server_handle->ldap_handle; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }while (translate_ldap_error(st, OP_SEARCH) == KRB5_KDB_ACCESS_ERROR && tempst == 0); \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (status_check != IGNORE_STATUS) { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (tempst != 0) { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf prepend_err_str(context, "LDAP handle unavailable: ", KRB5_KDB_ACCESS_ERROR, st); \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = KRB5_KDB_ACCESS_ERROR; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS) { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error(context, st, OP_SEARCH); \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define CHECK_CLASS_VALIDITY(st, mask, str) \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != 0 || mask == 0) { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st == 0 && mask == 0) { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error(context, LDAP_OBJECT_CLASS_VIOLATION, OP_SEARCH); \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf prepend_err_str(context, str, st, st); \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define CHECK_NULL(ptr) if (ptr == NULL) { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define STORE16_INT(ptr, val) store_16_be(val, ptr)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define STORE32_INT(ptr, val) store_32_be(val, ptr)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define UNSTORE16_INT(ptr, val) (val = load_16_be(ptr))
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define UNSTORE32_INT(ptr, val) (val = load_32_be(ptr))
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KRB5_CONF_KDC_BIND_DN "ldap_kdc_dn"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KRB5_CONF_ADMIN_BIND_DN "ldap_kadmind_dn"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KRB5_CONF_PWD_BIND_DN "ldap_passwd_dn"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KDB_TL_USER_INFO 0x7ffe
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KDB_TL_PRINCTYPE 0x01
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KDB_TL_PRINCCOUNT 0x02
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KDB_TL_USERDN 0x03
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KDB_TL_KEYINFO 0x04
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KDB_TL_MASK 0x05
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KDB_TL_CONTAINERDN 0x06
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define KDB_TL_LINKDN 0x07
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define CHECK_LDAP_HANDLE(lcontext) if (!(ldap_context \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf && ldap_context->server_info_list)) { \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf return KRB5_KDB_DBNOTINITED; \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define HNDL_LOCK(lcontext) k5_mutex_lock(&lcontext->hndl_lock)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define HNDL_UNLOCK(lcontext) k5_mutex_unlock(&lcontext->hndl_lock)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* To be used later */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillftypedef struct _krb5_ldap_certificates{
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *certificate;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int certtype;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf}krb5_ldap_certificates;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* ldap server info structure */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillftypedef enum _server_type {PRIMARY, SECONDARY} krb5_ldap_server_type;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillftypedef enum _server_status {OFF, ON, NOTSET} krb5_ldap_server_status;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillftypedef struct _krb5_ldap_server_info krb5_ldap_server_info;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillftypedef struct _krb5_ldap_server_handle {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int msgid;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf LDAP *ldap_handle;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_boolean server_info_update_pending;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_server_info *server_info;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf struct _krb5_ldap_server_handle *next;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf} krb5_ldap_server_handle;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfstruct _krb5_ldap_server_info {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_server_type server_type;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_server_status server_status;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ui_4 num_conns;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_server_handle *ldap_server_handles;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf time_t downtime;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *server_name;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#ifdef HAVE_EDIRECTORY
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *root_certificate_file;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf struct _krb5_ldap_server_info *next;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* ldap server structure */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillftypedef enum {SERVICE_DN_TYPE_SERVER, SERVICE_DN_TYPE_CLIENT} krb5_ldap_servicetype;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillftypedef struct _krb5_ldap_context {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_servicetype service_type;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_server_info **server_info_list;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ui_4 max_server_conns;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *conf_section;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *bind_dn;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *bind_pwd;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *service_password_file;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *root_certificate_file;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *service_cert_path;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *service_cert_pass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_certificates **certificates;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ui_4 cert_count; /* certificate count */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf k5_mutex_t hndl_lock;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_krbcontainer_params *krbcontainer;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_realm_params *lrparams;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_context kcontext; /* to set the error code and message */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf} krb5_ldap_context;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillftypedef struct {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int nkey;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf struct berval **keys;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf}KEY;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#define k5ldap_inited(c) (c && c->db_context \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf && ((kdb5_dal_handle*)c->db_context)->db_context \
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf && ((krb5_ldap_context *) ((kdb5_dal_handle*)c->db_context)->db_context))
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* misc functions */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_db_init(krb5_context, krb5_ldap_context *);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_db_single_init(krb5_ldap_context *);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_rebind(krb5_ldap_context *, krb5_ldap_server_handle **);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_db_get_age(krb5_context, char *, time_t *);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_lib_init(void);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_lib_cleanup(void);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfvoid *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_alloc( krb5_context kcontext, void *ptr, size_t size );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfvoid
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_free( krb5_context kcontext, void *ptr );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_get_mkey(krb5_context, krb5_keyblock **);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_set_mkey(krb5_context, char *, krb5_keyblock *);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_create(krb5_context , char *, char **);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_open( krb5_context , char *,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char **db_args,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int mode );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_close( krb5_context );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_free_ldap_context(krb5_ldap_context *);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_read_startup_information(krb5_context );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfint
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfhas_sasl_external_mech(krb5_context, char *);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* DAL functions */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_set_option( krb5_context, int, void * );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_lock( krb5_context, int );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_unlock( krb5_context );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_supported_realms( krb5_context, char ** );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_free_supported_realms( krb5_context, char ** );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfconst char *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_errcode_2_string( krb5_context, long );
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfvoid
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_release_errcode_string (krb5_context, const char *);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#ifndef HAVE_LDAP_INITIALIZE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* Solaris Kerberos: added a use_SSL parameter */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfint
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfldap_initialize(LDAP **, char *, int, char **);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#ifndef HAVE_LDAP_UNBIND_EXT_S
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfint
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfldap_unbind_ext_s(LDAP *, LDAPControl **, LDAPControl **);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif