54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#pragma ident "%Z%%M% %I% %E% SMI"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/*
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * lib/kdb/kdb_ldap/ldap_service_rights.c
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * Copyright (c) 2004-2005, Novell, Inc.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * All rights reserved.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * Redistribution and use in source and binary forms, with or without
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * modification, are permitted provided that the following conditions are met:
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * * Redistributions of source code must retain the above copyright notice,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * this list of conditions and the following disclaimer.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * * Redistributions in binary form must reproduce the above copyright
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * notice, this list of conditions and the following disclaimer in the
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * documentation and/or other materials provided with the distribution.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * * The copyright holder's name is not used to endorse or promote products
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * derived from this software without specific prior written permission.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * POSSIBILITY OF SUCH DAMAGE.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "ldap_main.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "ldap_services.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#include "ldap_err.h"
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/* NOTE: add appropriate rights for krbpasswordexpiration attribute */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#ifdef HAVE_EDIRECTORY
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfstatic char *kdcrights_subtree[][2] = {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"1#subtree#","#[Entry Rights]"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#CN"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#ObjectClass"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbTicketPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbUPEnabled"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbHostServer"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbServiceFlags"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbRealmReferences"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbTicketFlags"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxTicketLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxRenewableAge"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincipalName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPrincipalKey"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincipalExpiration"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxPwdLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#ModifiersName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#PasswordExpirationTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#PasswordExpirationInterval"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#PasswordMinimumLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#PasswordAllowChange"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LoginDisabled"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LastLoginTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LoginExpirationTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LoginIntruderAttempts"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#IntruderAttemptResetInterval"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LoginIntruderLimit"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LoginIntruderResetTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#DetectIntruder"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LockoutAfterDetection"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LockedByIntruder"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincipalReferences"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf { "", "" }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfstatic char *adminrights_subtree[][2]={
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"15#subtree#","#[Entry Rights]"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#CN"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#ObjectClass"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbTicketPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbUPEnabled"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbHostServer"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbServiceFlags"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbRealmReferences"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbTicketFlags"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbMaxTicketLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbMaxRenewableAge"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPrincipalName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPrincipalKey"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPrincipalExpiration"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#ModifiersName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#PasswordExpirationTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#PasswordExpirationInterval"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#PasswordMinimumLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#PasswordAllowChange"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LoginDisabled"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LastLoginTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LoginExpirationTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LoginIntruderAttempts"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#IntruderAttemptResetInterval"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LoginIntruderLimit"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LoginIntruderResetTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#DetectIntruder"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LockoutAfterDetection"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LockedByIntruder"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincipalReferences"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#Surname"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"4#subtree#","#passwordManagement"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPwdHistoryLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbMinPwdLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbMaxPwdLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPwdMinDiffChars"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPwdMinLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPwdPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf { "","" }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfstatic char *pwdrights_subtree[][2] = {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"1#subtree#","#[Entry Rights]"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#CN"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#ObjectClass"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbTicketPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbUPEnabled"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbHostServer"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbServiceFlags"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbRealmReferences"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbTicketFlags"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxTicketLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxRenewableAge"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincipalName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPrincipalKey"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincipalExpiration"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"4#subtree#","#passwordManagement"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#ModifiersName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdHistoryLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMinPwdLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxPwdLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdMinDiffChars"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdMinLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf { "", "" }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfstatic char *kdcrights_realmcontainer[][2]={
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"1#subtree#","#[Entry Rights]"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#CN"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#ObjectClass"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbTicketPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMKey"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbUPEnabled"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbSubTrees"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincContainerRef"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbSearchScope"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbLdapServers"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbSupportedEncSaltTypes"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbDefaultEncSaltTypes"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbKdcServers"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdServers"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbTicketFlags"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxTicketLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxRenewableAge"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincipalName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPrincipalKey"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincipalExpiration"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxPwdLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#ModifiersName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#PasswordExpirationTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#PasswordExpirationInterval"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#PasswordMinimumLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#PasswordAllowChange"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LoginDisabled"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LastLoginTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LoginExpirationTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LoginIntruderAttempts"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#IntruderAttemptResetInterval"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LoginIntruderLimit"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LoginIntruderResetTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#DetectIntruder"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LockoutAfterDetection"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LockedByIntruder"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf { "", "" }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfstatic char *adminrights_realmcontainer[][2]={
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"15#subtree#","#[Entry Rights]"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#CN"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#ObjectClass"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbTicketPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMKey"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbUPEnabled"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbSubTrees"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincContainerRef"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbSearchScope"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbLdapServers"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbSupportedEncSaltTypes"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbDefaultEncSaltTypes"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbKdcServers"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdServers"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbTicketFlags"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbMaxTicketLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbMaxRenewableAge"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPrincipalName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPrincipalKey"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPrincipalExpiration"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#ModifiersName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#PasswordExpirationTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#PasswordExpirationInterval"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#PasswordMinimumLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#PasswordAllowChange"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LoginDisabled"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LastLoginTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LoginExpirationTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LoginIntruderAttempts"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#IntruderAttemptResetInterval"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LoginIntruderLimit"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LoginIntruderResetTime"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#DetectIntruder"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#LockoutAfterDetection"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#LockedByIntruder"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#Surname"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPwdHistoryLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbMinPwdLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbMaxPwdLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPwdMinDiffChars"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPwdMinLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPwdPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf { "","" }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfstatic char *pwdrights_realmcontainer[][2]={
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"1#subtree#","#[Entry Rights]"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#CN"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#ObjectClass"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbTicketPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMKey"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbUPEnabled"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbSubTrees"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincContainerRef"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbSearchScope"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbLdapServers"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbSupportedEncSaltTypes"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbDefaultEncSaltTypes"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbKdcServers"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdServers"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbTicketFlags"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxTicketLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxRenewableAge"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincipalName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#krbPrincipalKey"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPrincipalExpiration"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"6#subtree#","#ModifiersName"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdHistoryLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMinPwdLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbMaxPwdLife"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdMinDiffChars"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdMinLength"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbPwdPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf { "", "" }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfstatic char *security_container[][2] = {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"1#subtree#","#[Entry Rights]"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbContainerReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf { "", "" }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfstatic char *kerberos_container[][2] = {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"1#subtree#","#[Entry Rights]"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf {"2#subtree#","#krbTicketPolicyReference"},
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf { "", "" }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/*
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * This will set the rights for the Kerberos service objects.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * The function will read the subtree attribute from the specified
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * realm name and will the appropriate rights on both the realm
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * container and the subtree. The kerberos context passed should
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * have a valid ldap handle, with appropriate rights to write acl
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * attributes.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf * krb5_context - IN The Kerberos context with valid ldap handle
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf *
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_add_service_rights(context, servicetype, serviceobjdn, realmname, subtreeparam, mask)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_context context;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int servicetype;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *serviceobjdn;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *realmname;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char **subtreeparam;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int mask;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf{
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int st=0,i=0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *realmacls[2]={NULL}, *subtreeacls[2]={NULL}, *seccontacls[2]={NULL}, *krbcontacls[2]={NULL};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf LDAP *ld;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf LDAPMod realmclass, subtreeclass, seccontclass, krbcontclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf LDAPMod *realmarr[3]={NULL}, *subtreearr[3]={NULL}, *seccontarr[3]={NULL}, *krbcontarr[3]={NULL};
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *realmdn=NULL, **subtree=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf kdb5_dal_handle *dal_handle=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_context *ldap_context=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_server_handle *ldap_server_handle=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int subtreecount=0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf SETUP_CONTEXT();
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf GET_HANDLE();
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((serviceobjdn == NULL) || (realmname == NULL) || (servicetype < 0) || (servicetype > 4)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf || (ldap_context->krbcontainer->DN == NULL)) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st=-1;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreecount=ldap_context->lrparams->subtreecount;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree = (char **) malloc(sizeof(char *) * (subtreecount + 1));
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if(subtree == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* If the subtree is null, set the value to root */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if(subtreeparam == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree[0] = strdup("");
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if(subtree[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf else {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; subtree[i] != NULL && i<subtreecount; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree[i] = strdup(subtreeparam[i]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if(subtree[i] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Set the rights for the service object on the security container */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf seccontclass.mod_op = LDAP_MOD_ADD;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf seccontclass.mod_type = "ACL";
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(security_container[i][0], "") != 0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf seccontacls[0] = (char *)malloc(strlen(security_container[i][0]) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(serviceobjdn) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(security_container[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (seccontacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(seccontacls[0], "%s%s%s", security_container[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf security_container[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf seccontclass.mod_values = seccontacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf seccontarr[0] = &seccontclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf SECURITY_CONTAINER,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf seccontarr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_TYPE_OR_VALUE_EXISTS && st != LDAP_OTHER) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(seccontacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(seccontacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Set the rights for the service object on the kerberos container */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krbcontclass.mod_op = LDAP_MOD_ADD;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krbcontclass.mod_type = "ACL";
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(kerberos_container[i][0], "") != 0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krbcontacls[0] = (char *)malloc(strlen(kerberos_container[i][0]) + strlen(serviceobjdn)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(kerberos_container[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (krbcontacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(krbcontacls[0], "%s%s%s", kerberos_container[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf kerberos_container[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krbcontclass.mod_values = krbcontacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krbcontarr[0] = &krbcontclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf ldap_context->krbcontainer->DN,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krbcontarr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_TYPE_OR_VALUE_EXISTS && st != LDAP_OTHER) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(krbcontacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(krbcontacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Set the rights for the realm */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (mask & LDAP_REALM_RIGHTS) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Construct the realm dn from realm name */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmdn = (char *)malloc(strlen("cn=") + strlen(realmname) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(ldap_context->krbcontainer->DN) + 2);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (realmdn == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(realmdn,"cn=%s,%s", realmname, ldap_context->krbcontainer->DN);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmclass.mod_op = LDAP_MOD_ADD;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmclass.mod_type = "ACL";
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (servicetype == LDAP_KDC_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(kdcrights_realmcontainer[i][0], "") != 0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmacls[0] = (char *)malloc(strlen(kdcrights_realmcontainer[i][0])
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(serviceobjdn) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(kdcrights_realmcontainer[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (realmacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(realmacls[0], "%s%s%s", kdcrights_realmcontainer[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf kdcrights_realmcontainer[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmclass.mod_values = realmacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr[0] = &realmclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_TYPE_OR_VALUE_EXISTS && st != LDAP_OTHER) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (servicetype == LDAP_ADMIN_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(adminrights_realmcontainer[i][0], "") != 0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmacls[0] = (char *) malloc(strlen(adminrights_realmcontainer[i][0]) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(serviceobjdn) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(adminrights_realmcontainer[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (realmacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(realmacls[0], "%s%s%s", adminrights_realmcontainer[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf adminrights_realmcontainer[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmclass.mod_values = realmacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr[0] = &realmclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_TYPE_OR_VALUE_EXISTS && st != LDAP_OTHER) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (servicetype == LDAP_PASSWD_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(pwdrights_realmcontainer[i][0], "")!=0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmacls[0] = (char *) malloc(strlen(pwdrights_realmcontainer[i][0]) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(serviceobjdn) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(pwdrights_realmcontainer[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (realmacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(realmacls[0], "%s%s%s", pwdrights_realmcontainer[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf pwdrights_realmcontainer[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmclass.mod_values = realmacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr[0] = &realmclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_TYPE_OR_VALUE_EXISTS && st != LDAP_OTHER) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } /* Realm rights settings ends here */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Subtree rights to be set */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (mask & LDAP_SUBTREE_RIGHTS) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Populate the acl data to be added to the subtree */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeclass.mod_op = LDAP_MOD_ADD;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeclass.mod_type = "ACL";
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (servicetype == LDAP_KDC_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(kdcrights_subtree[i][0], "")!=0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeacls[0] = (char *) malloc(strlen(kdcrights_subtree[i][0]) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(serviceobjdn) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(kdcrights_subtree[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (subtreeacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(subtreeacls[0], "%s%s%s", kdcrights_subtree[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf kdcrights_subtree[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeclass.mod_values = subtreeacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr[0] = &subtreeclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* set rights to a list of subtrees */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for(i=0; subtree[i]!=NULL && i<subtreecount;i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree[i],
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_TYPE_OR_VALUE_EXISTS && st != LDAP_OTHER) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (servicetype == LDAP_ADMIN_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(adminrights_subtree[i][0], "")!=0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeacls[0] = (char *) malloc(strlen(adminrights_subtree[i][0])
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(serviceobjdn)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(adminrights_subtree[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (subtreeacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(subtreeacls[0], "%s%s%s", adminrights_subtree[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf adminrights_subtree[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeclass.mod_values = subtreeacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr[0] = &subtreeclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* set rights to a list of subtrees */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for(i=0; subtree[i]!=NULL && i<subtreecount;i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree[i],
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st !=LDAP_TYPE_OR_VALUE_EXISTS && st != LDAP_OTHER) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (servicetype == LDAP_PASSWD_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(pwdrights_subtree[i][0], "") != 0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeacls[0] = (char *)malloc(strlen(pwdrights_subtree[i][0])
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(serviceobjdn)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(pwdrights_subtree[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (subtreeacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(subtreeacls[0], "%s%s%s", pwdrights_subtree[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf pwdrights_subtree[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeclass.mod_values = subtreeacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr[0] = &subtreeclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* set rights to a list of subtrees */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for(i=0; subtree[i]!=NULL && i<subtreecount;i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree[i],
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_TYPE_OR_VALUE_EXISTS && st != LDAP_OTHER) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } /* Subtree rights settings ends here */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = 0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfcleanup:
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (realmdn)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmdn);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (subtree)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtree);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_put_handle_to_pool(ldap_context, ldap_server_handle);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf return st;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf}
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf/*
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf This will set the rights for the Kerberos service objects.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf The function will read the subtree attribute from the specified
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realm name and will the appropriate rights on both the realm
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf container and the subtree. The kerberos context passed should
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf have a valid ldap handle, with appropriate rights to write acl
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf attributes.
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_context - IN The Kerberos context with valid ldap handle
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf*/
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_error_code
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfkrb5_ldap_delete_service_rights(context, servicetype, serviceobjdn, realmname, subtreeparam, mask)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_context context;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int servicetype;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *serviceobjdn;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *realmname;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char **subtreeparam;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int mask;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf{
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int st=0,i=0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *realmacls[2] = { NULL }, *subtreeacls[2] = { NULL };
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf LDAP *ld;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf LDAPMod realmclass, subtreeclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf LDAPMod *realmarr[3] = { NULL }, *subtreearr[3] = { NULL };
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char *realmdn=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf char **subtree=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf kdb5_dal_handle *dal_handle=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_context *ldap_context=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_server_handle *ldap_server_handle=NULL;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf int subtreecount = 0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf SETUP_CONTEXT();
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf GET_HANDLE();
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if ((serviceobjdn == NULL) || (realmname == NULL) || (servicetype < 0) || (servicetype > 4)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf || (ldap_context->krbcontainer->DN == NULL)) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = -1;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreecount = 1;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf while(subtreeparam[subtreecount])
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreecount++;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree = (char **) malloc(sizeof(char *) * subtreecount + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if(subtree == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* If the subtree is null, set the value to root */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if(subtreeparam == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree[0] = strdup("");
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if(subtree[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf else {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for(i=0; subtreeparam[i]!=NULL && i<subtreecount; i++)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree[i] = strdup(subtreeparam[i]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if(subtree[i] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Set the rights for the realm */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (mask & LDAP_REALM_RIGHTS) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Construct the realm dn from realm name */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmdn = (char *) malloc(strlen("cn=") + strlen(realmname) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(ldap_context->krbcontainer->DN) + 2);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (realmdn == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(realmdn,"cn=%s,%s", realmname, ldap_context->krbcontainer->DN);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmclass.mod_op=LDAP_MOD_DELETE;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmclass.mod_type="ACL";
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (servicetype == LDAP_KDC_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(kdcrights_realmcontainer[i][0], "") != 0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmacls[0] = (char *) malloc(strlen(kdcrights_realmcontainer[i][0])
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(serviceobjdn) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(kdcrights_realmcontainer[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (realmacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(realmacls[0], "%s%s%s", kdcrights_realmcontainer[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf kdcrights_realmcontainer[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmclass.mod_values= realmacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr[0]=&realmclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_NO_SUCH_ATTRIBUTE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (servicetype == LDAP_ADMIN_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(adminrights_realmcontainer[i][0], "") != 0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmacls[0] = (char *) malloc(strlen(adminrights_realmcontainer[i][0]) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(serviceobjdn) +
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf strlen(adminrights_realmcontainer[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (realmacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(realmacls[0], "%s%s%s", adminrights_realmcontainer[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf adminrights_realmcontainer[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmclass.mod_values= realmacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr[0]=&realmclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_NO_SUCH_ATTRIBUTE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (servicetype == LDAP_PASSWD_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(pwdrights_realmcontainer[i][0], "") != 0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmacls[0]=(char *)malloc(strlen(pwdrights_realmcontainer[i][0])
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(serviceobjdn)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(pwdrights_realmcontainer[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (realmacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(realmacls[0], "%s%s%s", pwdrights_realmcontainer[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf pwdrights_realmcontainer[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmclass.mod_values= realmacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr[0]=&realmclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf realmarr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_NO_SUCH_ATTRIBUTE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } /* Realm rights setting ends here */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Set the rights for the subtree */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (mask & LDAP_SUBTREE_RIGHTS) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf /* Populate the acl data to be added to the subtree */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeclass.mod_op=LDAP_MOD_DELETE;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeclass.mod_type="ACL";
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (servicetype == LDAP_KDC_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(kdcrights_subtree[i][0], "")!=0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeacls[0] = (char *) malloc(strlen(kdcrights_subtree[i][0])
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(serviceobjdn)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(kdcrights_subtree[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (subtreeacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(subtreeacls[0], "%s%s%s", kdcrights_subtree[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf kdcrights_subtree[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeclass.mod_values= subtreeacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr[0]=&subtreeclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for(i=0; subtree[i]!=NULL && i<subtreecount; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree[i],
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_NO_SUCH_ATTRIBUTE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (servicetype == LDAP_ADMIN_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(adminrights_subtree[i][0], "") != 0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeacls[0] = (char *) malloc(strlen(adminrights_subtree[i][0])
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(serviceobjdn)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(adminrights_subtree[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (subtreeacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(subtreeacls[0], "%s%s%s", adminrights_subtree[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf adminrights_subtree[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeclass.mod_values= subtreeacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr[0]=&subtreeclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for(i=0; subtree[i]!=NULL && i<subtreecount; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree[i],
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_NO_SUCH_ATTRIBUTE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } else if (servicetype == LDAP_PASSWD_SERVICE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for (i=0; strcmp(pwdrights_subtree[i][0], "") != 0; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeacls[0] = (char *) malloc(strlen(pwdrights_subtree[i][0])
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(serviceobjdn)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf + strlen(pwdrights_subtree[i][1]) + 1);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (subtreeacls[0] == NULL) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ENOMEM;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf sprintf(subtreeacls[0], "%s%s%s", pwdrights_subtree[i][0], serviceobjdn,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf pwdrights_subtree[i][1]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreeclass.mod_values= subtreeacls;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr[0]=&subtreeclass;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf for(i=0; subtree[i]!=NULL && i<subtreecount; i++) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = ldap_modify_ext_s(ld,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtree[i],
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf subtreearr,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL,
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf NULL);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (st != LDAP_SUCCESS && st != LDAP_NO_SUCH_ATTRIBUTE) {
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = set_ldap_error (context, st, OP_MOD);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf goto cleanup;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtreeacls[0]);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf }
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf } /* Subtree rights setting ends here */
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf st = 0;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillfcleanup:
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (realmdn)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(realmdn);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf if (subtree)
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf free(subtree);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf krb5_ldap_put_handle_to_pool(ldap_context, ldap_server_handle);
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf return st;
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf}
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf
54925bf60766fbb4f1f2d7c843721406a7b7a3fbwillf#endif