54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#pragma ident "%Z%%M% %I% %E% SMI"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/*
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * lib/kdb/kdb_ldap/ldap_create.c
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * Copyright (c) 2004-2005, Novell, Inc.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * All rights reserved.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * Redistribution and use in source and binary forms, with or without
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * modification, are permitted provided that the following conditions are met:
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * * Redistributions of source code must retain the above copyright notice,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * this list of conditions and the following disclaimer.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * * Redistributions in binary form must reproduce the above copyright
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * notice, this list of conditions and the following disclaimer in the
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * documentation and/or other materials provided with the distribution.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * * The copyright holder's name is not used to endorse or promote products
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * derived from this software without specific prior written permission.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * POSSIBILITY OF SUCH DAMAGE.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/*
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * Use is subject to license terms.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "ldap_main.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "ldap_realm.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "ldap_principal.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "ldap_krbcontainer.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "ldap_err.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include <libintl.h>
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/*
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * ******************************************************************************
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * DAL functions
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * ******************************************************************************
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/*
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * This function will create a krbcontainer and realm on the LDAP Server, with
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * the specified attributes.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_create (krb5_context context, char *conf_section, char **db_args)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf{
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_error_code status = 0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char **t_ptr = db_args;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_realm_params *rparams = NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf kdb5_dal_handle *dal_handle = NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_context *ldap_context=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_boolean realm_obj_created = FALSE;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_boolean krbcontainer_obj_created = FALSE;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_krbcontainer_params kparams = {0};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int srv_cnt = 0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int mask = 0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#ifdef HAVE_EDIRECTORY
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int i = 0, rightsmask = 0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Clear the global error string */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_clear_error_message(context);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context = malloc(sizeof(krb5_ldap_context));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf memset(ldap_context, 0, sizeof(*ldap_context));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->kcontext = context;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* populate ldap_context with ldap specific options */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf while (t_ptr && *t_ptr) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *opt = NULL, *val = NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((status = krb5_ldap_get_db_opt(*t_ptr, &opt, &val)) != 0) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (opt && !strcmp(opt, "binddn")) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->bind_dn) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = EINVAL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message (context, status, gettext("'binddn' missing"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (val == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = EINVAL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message (context, status, gettext("'binddn' value missing"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->bind_dn = strdup(val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->bind_dn == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (opt && !strcmp(opt, "nconns")) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->max_server_conns) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = EINVAL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message (context, status, gettext("'nconns' missing"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (val == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = EINVAL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message (context, status, gettext("'nconns' value missing"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->max_server_conns = atoi(val) ? atoi(val) : DEFAULT_CONNS_PER_SERVER;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (opt && !strcmp(opt, "bindpwd")) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->bind_pwd) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = EINVAL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message (context, status, gettext("'bindpwd' missing"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (val == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = EINVAL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message (context, status, gettext("'bindpwd' value missing"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->bind_pwd = strdup(val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->bind_pwd == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (opt && !strcmp(opt, "host")) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (val == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = EINVAL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message (context, status, gettext("'host' value missing"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->server_info_list == NULL)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->server_info_list =
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf (krb5_ldap_server_info **) calloc(SERV_COUNT+1, sizeof(krb5_ldap_server_info *));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->server_info_list == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->server_info_list[srv_cnt] =
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf (krb5_ldap_server_info *) calloc(1, sizeof(krb5_ldap_server_info));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->server_info_list[srv_cnt] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->server_info_list[srv_cnt]->server_status = NOTSET;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->server_info_list[srv_cnt]->server_name = strdup(val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->server_info_list[srv_cnt]->server_name == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf srv_cnt++;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#ifdef HAVE_EDIRECTORY
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (opt && !strcmp(opt, "cert")) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (val == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = EINVAL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message (context, status, gettext("'cert' value missing"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->root_certificate_file == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->root_certificate_file = strdup(val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->root_certificate_file == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf void *tmp=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *oldstr = NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf unsigned int len=0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf oldstr = strdup(ldap_context->root_certificate_file);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (oldstr == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf tmp = ldap_context->root_certificate_file;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf len = strlen(ldap_context->root_certificate_file) + 2 + strlen(val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->root_certificate_file = realloc(ldap_context->root_certificate_file,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf len);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->root_certificate_file == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (tmp);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf memset(ldap_context->root_certificate_file, 0, len);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(ldap_context->root_certificate_file,"%s %s", oldstr, val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free (oldstr);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* ignore hash argument. Might have been passed from create */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = EINVAL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (opt && !strcmp(opt, "temporary")) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /*
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * temporary is passed in when kdb5_util load without -update is done.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * This is unsupported by the LDAP plugin.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message (context, status,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf gettext("creation of LDAP entries aborted, plugin requires -update argument"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message (context, status, gettext("unknown option \'%s\'"),
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf opt?opt:val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(opt);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(val);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf t_ptr++;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf dal_handle = (kdb5_dal_handle *) context->db_context;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf dal_handle->db_context = (kdb5_dal_handle *) ldap_context;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = krb5_ldap_read_server_params(context, conf_section, KRB5_KDB_SRV_TYPE_ADMIN);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (status) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf dal_handle->db_context = NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf prepend_err_str (context, gettext("Error reading LDAP server params: "), status, status);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = krb5_ldap_db_init(context, ldap_context);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (status) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* read the kerberos container */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((status = krb5_ldap_read_krbcontainer_params(context,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf &(ldap_context->krbcontainer))) == KRB5_KDB_NOENTRY) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Read the kerberos container location from configuration file */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (ldap_context->conf_section) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((status = profile_get_string(context->profile,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf KDB_MODULE_SECTION, ldap_context->conf_section,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf "ldap_kerberos_container_dn", NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf &kparams.DN)) != 0) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (kparams.DN == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((status = profile_get_string(context->profile,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf KDB_MODULE_DEF_SECTION,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf "ldap_kerberos_container_dn", NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL, &kparams.DN)) != 0) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* create the kerberos container */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = krb5_ldap_create_krbcontainer(context,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ((kparams.DN != NULL) ? &kparams : NULL));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (status)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krbcontainer_obj_created = TRUE;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = krb5_ldap_read_krbcontainer_params(context,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf &(ldap_context->krbcontainer));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (status) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message(context, status, gettext("while reading kerberos container information"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (status) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message(context, status, gettext("while reading kerberos container information"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rparams = (krb5_ldap_realm_params *) malloc(sizeof(krb5_ldap_realm_params));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (rparams == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf memset(rparams, 0, sizeof(*rparams));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rparams->realm_name = strdup(context->default_realm);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (rparams->realm_name == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf status = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((status = krb5_ldap_create_realm(context, rparams, mask))) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message(context, status, gettext("while creating realm object entry"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* We just created the Realm container. Here starts our transaction tracking */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realm_obj_created = TRUE;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* verify realm object */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((status = krb5_ldap_read_realm_params(context,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rparams->realm_name,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf &(ldap_context->lrparams),
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf &mask))) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message(context, status, gettext("while reading realm object entry"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#ifdef HAVE_EDIRECTORY
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((mask & LDAP_REALM_KDCSERVERS) || (mask & LDAP_REALM_ADMINSERVERS) ||
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf (mask & LDAP_REALM_PASSWDSERVERS)) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rightsmask =0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rightsmask |= LDAP_REALM_RIGHTS;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rightsmask |= LDAP_SUBTREE_RIGHTS;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((rparams != NULL) && (rparams->kdcservers != NULL)) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; (rparams->kdcservers[i] != NULL); i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((status=krb5_ldap_add_service_rights(context,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf LDAP_KDC_SERVICE, rparams->kdcservers[i],
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rparams->realm_name, rparams->subtree, rightsmask)) != 0) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rightsmask = 0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rightsmask |= LDAP_REALM_RIGHTS;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rightsmask |= LDAP_SUBTREE_RIGHTS;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((rparams != NULL) && (rparams->adminservers != NULL)) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; (rparams->adminservers[i] != NULL); i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((status=krb5_ldap_add_service_rights(context,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf LDAP_ADMIN_SERVICE, rparams->adminservers[i],
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rparams->realm_name, rparams->subtree, rightsmask)) != 0) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rightsmask = 0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rightsmask |= LDAP_REALM_RIGHTS;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rightsmask |= LDAP_SUBTREE_RIGHTS;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((rparams != NULL) && (rparams->passwdservers != NULL)) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; (rparams->passwdservers[i] != NULL); i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((status=krb5_ldap_add_service_rights(context,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf LDAP_PASSWD_SERVICE, rparams->passwdservers[i],
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rparams->realm_name, rparams->subtree, rightsmask)) != 0) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfcleanup:
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* If the krbcontainer/realm creation is not complete, do the roll-back here */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((krbcontainer_obj_created) && (!realm_obj_created)) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int rc;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf rc = krb5_ldap_delete_krbcontainer(context,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ((kparams.DN != NULL) ? &kparams : NULL));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_set_error_message(context, rc,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf gettext("could not complete roll-back, error deleting Kerberos Container"));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* should call krb5_ldap_free_krbcontainer_params() but can't */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (kparams.DN != NULL)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_xfree(kparams.DN);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (rparams)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_free_realm_params(rparams);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf return(status);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf}