ldap/libkdb_ldap/ldap_create.c

2N/A/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2N/A/*
2N/A * lib/kdb/kdb_ldap/ldap_create.c
2N/A *
2N/A * Copyright (c) 2004-2005, Novell, Inc.
2N/A * All rights reserved.
2N/A *
2N/A * Redistribution and use in source and binary forms, with or without
2N/A * modification, are permitted provided that the following conditions are met:
2N/A *
2N/A *   * Redistributions of source code must retain the above copyright notice,
2N/A *       this list of conditions and the following disclaimer.
2N/A *   * Redistributions in binary form must reproduce the above copyright
2N/A *       notice, this list of conditions and the following disclaimer in the
2N/A *       documentation and/or other materials provided with the distribution.
2N/A *   * The copyright holder's name is not used to endorse or promote products
2N/A *       derived from this software without specific prior written permission.
2N/A *
2N/A * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
2N/A * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
2N/A * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
2N/A * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
2N/A * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
2N/A * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
2N/A * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
2N/A * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
2N/A * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
2N/A * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
2N/A * POSSIBILITY OF SUCH DAMAGE.
2N/A */
2N/A
2N/A/*
2N/A * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
2N/A * Use is subject to license terms.
2N/A */
2N/A
2N/A/*
2N/A * Copyright (c) 2006, 2011, Oracle and/or its affiliates. All rights reserved.
2N/A */
2N/A
2N/A#include "ldap_main.h"
2N/A#include "ldap_realm.h"
2N/A#include "ldap_principal.h"
2N/A#include "ldap_krbcontainer.h"
2N/A#include "ldap_err.h"
2N/A
2N/A#include <libintl.h> /* Solaris Kerberos */
2N/A
2N/A/*
2N/A * ******************************************************************************
2N/A * DAL functions
2N/A * ******************************************************************************
2N/A */
2N/A
2N/A/*
2N/A * This function will create a krbcontainer and realm on the LDAP Server, with
2N/A * the specified attributes.
2N/A */
2N/Akrb5_error_code
2N/Akrb5_ldap_create(krb5_context context, char *conf_section, char **db_args)
2N/A{
2N/A    krb5_error_code status = 0;
2N/A    char  **t_ptr = db_args;
2N/A    krb5_ldap_realm_params *rparams = NULL;
2N/A    kdb5_dal_handle *dal_handle = NULL;
2N/A    krb5_ldap_context *ldap_context=NULL;
2N/A    krb5_boolean realm_obj_created = FALSE;
2N/A    krb5_boolean krbcontainer_obj_created = FALSE;
2N/A    krb5_ldap_krbcontainer_params kparams = {0};
2N/A    int srv_cnt = 0;
2N/A    int mask = 0;
2N/A#ifdef HAVE_EDIRECTORY
2N/A    int i = 0, rightsmask = 0;
2N/A#endif
2N/A
2N/A    /* Clear the global error string */
2N/A    krb5_clear_error_message(context);
2N/A
2N/A    ldap_context = malloc(sizeof(krb5_ldap_context));
2N/A    if (ldap_context == NULL) {
2N/A        status = ENOMEM;
2N/A        goto cleanup;
2N/A    }
2N/A    memset(ldap_context, 0, sizeof(*ldap_context));
2N/A
2N/A    ldap_context->kcontext = context;
2N/A
2N/A    /* populate ldap_context with ldap specific options */
2N/A    while (t_ptr && *t_ptr) {
2N/A        char *opt = NULL, *val = NULL;
2N/A
2N/A        if ((status = krb5_ldap_get_db_opt(*t_ptr, &opt, &val)) != 0) {
2N/A            goto cleanup;
2N/A        }
2N/A        if (opt && !strcmp(opt, "binddn")) {
2N/A            if (ldap_context->bind_dn) {
2N/A                free (opt);
2N/A                free (val);
2N/A                status = EINVAL;
2N/A                krb5_set_error_message (context, status, gettext("'binddn' missing"));
2N/A                goto cleanup;
2N/A            }
2N/A            if (val == NULL) {
2N/A                status = EINVAL;
2N/A                krb5_set_error_message (context, status, gettext("'binddn' value missing"));
2N/A                free(opt);
2N/A                goto cleanup;
2N/A            }
2N/A            ldap_context->bind_dn = strdup(val);
2N/A            if (ldap_context->bind_dn == NULL) {
2N/A                free (opt);
2N/A                free (val);
2N/A                status = ENOMEM;
2N/A                goto cleanup;
2N/A            }
2N/A        } else if (opt && !strcmp(opt, "nconns")) {
2N/A            if (ldap_context->max_server_conns) {
2N/A                free (opt);
2N/A                free (val);
2N/A                status = EINVAL;
2N/A                krb5_set_error_message (context, status, gettext("'nconns' missing"));
2N/A                goto cleanup;
2N/A            }
2N/A            if (val == NULL) {
2N/A                status = EINVAL;
2N/A                krb5_set_error_message (context, status, gettext("'nconns' value missing"));
2N/A                free(opt);
2N/A                goto cleanup;
2N/A            }
2N/A            ldap_context->max_server_conns = atoi(val) ? atoi(val) : DEFAULT_CONNS_PER_SERVER;
2N/A        } else if (opt && !strcmp(opt, "bindpwd")) {
2N/A            if (ldap_context->bind_pwd) {
2N/A                free (opt);
2N/A                free (val);
2N/A                status = EINVAL;
2N/A                krb5_set_error_message (context, status, gettext("'bindpwd' missing"));
2N/A                goto cleanup;
2N/A            }
2N/A            if (val == NULL) {
2N/A                status = EINVAL;
2N/A                krb5_set_error_message (context, status, gettext("'bindpwd' value missing"));
2N/A                free(opt);
2N/A                goto cleanup;
2N/A            }
2N/A            ldap_context->bind_pwd = strdup(val);
2N/A            if (ldap_context->bind_pwd == NULL) {
2N/A                free (opt);
2N/A                free (val);
2N/A                status = ENOMEM;
2N/A                goto cleanup;
2N/A            }
2N/A        } else if (opt && !strcmp(opt, "host")) {
2N/A            if (val == NULL) {
2N/A                status = EINVAL;
2N/A                krb5_set_error_message (context, status, gettext("'host' value missing"));
2N/A                free(opt);
2N/A                goto cleanup;
2N/A            }
2N/A            if (ldap_context->server_info_list == NULL)
2N/A                ldap_context->server_info_list =
2N/A                    (krb5_ldap_server_info **) calloc(SERV_COUNT+1, sizeof(krb5_ldap_server_info *));
2N/A
2N/A            if (ldap_context->server_info_list == NULL) {
2N/A                free (opt);
2N/A                free (val);
2N/A                status = ENOMEM;
2N/A                goto cleanup;
2N/A            }
2N/A
2N/A            ldap_context->server_info_list[srv_cnt] =
2N/A                (krb5_ldap_server_info *) calloc(1, sizeof(krb5_ldap_server_info));
2N/A            if (ldap_context->server_info_list[srv_cnt] == NULL) {
2N/A                free (opt);
2N/A                free (val);
2N/A                status = ENOMEM;
2N/A                goto cleanup;
2N/A            }
2N/A
2N/A            ldap_context->server_info_list[srv_cnt]->server_status = NOTSET;
2N/A
2N/A            ldap_context->server_info_list[srv_cnt]->server_name = strdup(val);
2N/A            if (ldap_context->server_info_list[srv_cnt]->server_name == NULL) {
2N/A                free (opt);
2N/A                free (val);
2N/A                status = ENOMEM;
2N/A                goto cleanup;
2N/A            }
2N/A
2N/A            srv_cnt++;
2N/A#ifdef HAVE_EDIRECTORY
2N/A        } else if (opt && !strcmp(opt, "cert")) {
2N/A            if (val == NULL) {
2N/A                status = EINVAL;
2N/A                krb5_set_error_message (context, status, gettext("'cert' value missing"));
2N/A                free(opt);
2N/A                goto cleanup;
2N/A            }
2N/A
2N/A            if (ldap_context->root_certificate_file == NULL) {
2N/A                ldap_context->root_certificate_file = strdup(val);
2N/A                if (ldap_context->root_certificate_file == NULL) {
2N/A                    free (opt);
2N/A                    free (val);
2N/A                    status = ENOMEM;
2N/A                    goto cleanup;
2N/A                }
2N/A            } else {
2N/A                char *newstr;
2N/A
2N/A                if (asprintf(&newstr, "%s %s",
2N/A                             ldap_context->root_certificate_file, val) < 0) {
2N/A                    free (opt);
2N/A                    free (val);
2N/A                    status = ENOMEM;
2N/A                    goto cleanup;
2N/A                }
2N/A                ldap_context->root_certificate_file = newstr;
2N/A            }
2N/A#endif
2N/A        } else {
2N/A            /* ignore hash argument. Might have been passed from create */
2N/A            status = EINVAL;
2N/A            if (opt && !strcmp(opt, "temporary")) {
2N/A                /*
2N/A                 * temporary is passed in when kdb5_util load without -update is done.
2N/A                 * This is unsupported by the LDAP plugin.
2N/A                 */
2N/A                krb5_set_error_message (context, status,
2N/A                                        gettext("creation of LDAP entries aborted, plugin requires -update argument"));
2N/A            } else {
2N/A                krb5_set_error_message (context, status, "unknown option \'%s\'",
2N/A                                        opt?opt:val);
2N/A            }
2N/A            free(opt);
2N/A            free(val);
2N/A            goto cleanup;
2N/A        }
2N/A
2N/A        free(opt);
2N/A        free(val);
2N/A        t_ptr++;
2N/A    }
2N/A
2N/A    dal_handle = context->dal_handle;
2N/A    dal_handle->db_context = (kdb5_dal_handle *) ldap_context;
2N/A
2N/A    status = krb5_ldap_read_server_params(context, conf_section, KRB5_KDB_SRV_TYPE_ADMIN);
2N/A    if (status) {
2N/A        dal_handle->db_context = NULL;
2N/A        prepend_err_str (context, gettext("Error reading LDAP server params: "), status, status);
2N/A        goto cleanup;
2N/A    }
2N/A    status = krb5_ldap_db_init(context, ldap_context);
2N/A    if (status) {
2N/A        goto cleanup;
2N/A    }
2N/A
2N/A    /* read the kerberos container */
2N/A    if ((status = krb5_ldap_read_krbcontainer_params(context,
2N/A                                                     &(ldap_context->krbcontainer))) == KRB5_KDB_NOENTRY) {
2N/A
2N/A        /* Read the kerberos container location from configuration file */
2N/A        if (ldap_context->conf_section) {
2N/A            if ((status = profile_get_string(context->profile,
2N/A                                             KDB_MODULE_SECTION, ldap_context->conf_section,
2N/A                                             "ldap_kerberos_container_dn", NULL,
2N/A                                             &kparams.DN)) != 0) {
2N/A                goto cleanup;
2N/A            }
2N/A        }
2N/A        if (kparams.DN == NULL) {
2N/A            if ((status = profile_get_string(context->profile,
2N/A                                             KDB_MODULE_DEF_SECTION,
2N/A                                             "ldap_kerberos_container_dn", NULL,
2N/A                                             NULL, &kparams.DN)) != 0) {
2N/A                goto cleanup;
2N/A            }
2N/A        }
2N/A
2N/A        /* create the kerberos container */
2N/A        status = krb5_ldap_create_krbcontainer(context,
2N/A                                               ((kparams.DN != NULL) ? &kparams : NULL));
2N/A        if (status)
2N/A            goto cleanup;
2N/A
2N/A        krbcontainer_obj_created = TRUE;
2N/A
2N/A        status = krb5_ldap_read_krbcontainer_params(context,
2N/A                                                    &(ldap_context->krbcontainer));
2N/A        if (status)
2N/A            goto cleanup;
2N/A
2N/A    } else if (status) {
2N/A        goto cleanup;
2N/A    }
2N/A
2N/A    rparams = (krb5_ldap_realm_params *) malloc(sizeof(krb5_ldap_realm_params));
2N/A    if (rparams == NULL) {
2N/A        status = ENOMEM;
2N/A        goto cleanup;
2N/A    }
2N/A    memset(rparams, 0, sizeof(*rparams));
2N/A    rparams->realm_name = strdup(context->default_realm);
2N/A    if (rparams->realm_name == NULL) {
2N/A        status = ENOMEM;
2N/A        goto cleanup;
2N/A    }
2N/A
2N/A    if ((status = krb5_ldap_create_realm(context, rparams, mask)))
2N/A        goto cleanup;
2N/A
2N/A    /* We just created the Realm container. Here starts our transaction tracking */
2N/A    realm_obj_created = TRUE;
2N/A
2N/A    /* verify realm object */
2N/A    if ((status = krb5_ldap_read_realm_params(context,
2N/A                                              rparams->realm_name,
2N/A                                              &(ldap_context->lrparams),
2N/A                                              &mask)))
2N/A        goto cleanup;
2N/A
2N/A#ifdef HAVE_EDIRECTORY
2N/A    if ((mask & LDAP_REALM_KDCSERVERS) || (mask & LDAP_REALM_ADMINSERVERS) ||
2N/A        (mask & LDAP_REALM_PASSWDSERVERS)) {
2N/A
2N/A        rightsmask =0;
2N/A        rightsmask |= LDAP_REALM_RIGHTS;
2N/A        rightsmask |= LDAP_SUBTREE_RIGHTS;
2N/A        if ((rparams != NULL) && (rparams->kdcservers != NULL)) {
2N/A            for (i=0; (rparams->kdcservers[i] != NULL); i++) {
2N/A                if ((status=krb5_ldap_add_service_rights(context,
2N/A                                                         LDAP_KDC_SERVICE, rparams->kdcservers[i],
2N/A                                                         rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
2N/A                    goto cleanup;
2N/A                }
2N/A            }
2N/A        }
2N/A
2N/A        rightsmask = 0;
2N/A        rightsmask |= LDAP_REALM_RIGHTS;
2N/A        rightsmask |= LDAP_SUBTREE_RIGHTS;
2N/A        if ((rparams != NULL) && (rparams->adminservers != NULL)) {
2N/A            for (i=0; (rparams->adminservers[i] != NULL); i++) {
2N/A                if ((status=krb5_ldap_add_service_rights(context,
2N/A                                                         LDAP_ADMIN_SERVICE, rparams->adminservers[i],
2N/A                                                         rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
2N/A                    goto cleanup;
2N/A                }
2N/A            }
2N/A        }
2N/A
2N/A        rightsmask = 0;
2N/A        rightsmask |= LDAP_REALM_RIGHTS;
2N/A        rightsmask |= LDAP_SUBTREE_RIGHTS;
2N/A        if ((rparams != NULL) && (rparams->passwdservers != NULL)) {
2N/A            for (i=0; (rparams->passwdservers[i] != NULL); i++) {
2N/A                if ((status=krb5_ldap_add_service_rights(context,
2N/A                                                         LDAP_PASSWD_SERVICE, rparams->passwdservers[i],
2N/A                                                         rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
2N/A                    goto cleanup;
2N/A                }
2N/A            }
2N/A        }
2N/A    }
2N/A#endif
2N/A
2N/Acleanup:
2N/A
2N/A    /* If the krbcontainer/realm creation is not complete, do the roll-back here */
2N/A    if ((krbcontainer_obj_created) && (!realm_obj_created)) {
2N/A        int rc;
2N/A        rc = krb5_ldap_delete_krbcontainer(context,
2N/A                                           ((kparams.DN != NULL) ? &kparams : NULL));
2N/A        krb5_set_error_message(context, rc,
2N/A                               gettext("could not complete roll-back, error deleting Kerberos Container"));
2N/A    }
2N/A
2N/A    /* should call krb5_ldap_free_krbcontainer_params() but can't */
2N/A    if (kparams.DN != NULL)
2N/A        krb5_xfree(kparams.DN);
2N/A
2N/A    if (rparams)
2N/A        krb5_ldap_free_realm_params(rparams);
2N/A
2N/A    /* Solaris Kerberos */
2N/A    if (status != 0) {
2N/A    krb5_ldap_free_ldap_context(ldap_context);
2N/A    dal_handle->db_context = NULL;
2N/A    }
2N/A
2N/A    return(status);
2N/A}