ad_opts.h revision 35872dc24058c5e8028cb4082fd405a27835dcd1
565N/A/*
565N/A SSSD
565N/A
565N/A Authors:
565N/A Stephen Gallagher <sgallagh@redhat.com>
565N/A
565N/A Copyright (C) 2012 Red Hat
565N/A
565N/A This program is free software; you can redistribute it and/or modify
565N/A it under the terms of the GNU General Public License as published by
565N/A the Free Software Foundation; either version 3 of the License, or
565N/A (at your option) any later version.
565N/A
565N/A This program is distributed in the hope that it will be useful,
565N/A but WITHOUT ANY WARRANTY; without even the implied warranty of
565N/A MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
565N/A GNU General Public License for more details.
565N/A
565N/A You should have received a copy of the GNU General Public License
565N/A along with this program. If not, see <http://www.gnu.org/licenses/>.
565N/A*/
926N/A
926N/A#ifndef AD_OPTS_H_
835N/A#define AD_OPTS_H_
565N/A
926N/A#include "src/providers/data_provider.h"
565N/A#include "db/sysdb_services.h"
941N/A#include "db/sysdb_autofs.h"
941N/A
926N/Astruct dp_option ad_basic_opts[] = {
926N/A { "ad_domain", DP_OPT_STRING, NULL_STRING, NULL_STRING },
926N/A { "ad_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
926N/A { "ad_backup_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
926N/A { "ad_hostname", DP_OPT_STRING, NULL_STRING, NULL_STRING },
838N/A { "krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING},
565N/A { "ad_enable_dns_sites", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
565N/A DP_OPTION_TERMINATOR
565N/A};
565N/A
565N/Astruct dp_option ad_def_ldap_opts[] = {
565N/A { "ldap_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_backup_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_default_bind_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_default_authtok_type", DP_OPT_STRING, { "password" }, NULL_STRING},
565N/A { "ldap_default_authtok", DP_OPT_BLOB, NULL_BLOB, NULL_BLOB },
565N/A { "ldap_search_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
565N/A { "ldap_network_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
565N/A { "ldap_opt_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
565N/A { "ldap_tls_reqcert", DP_OPT_STRING, { "hard" }, NULL_STRING },
565N/A { "ldap_user_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_user_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING },
565N/A { "ldap_user_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_group_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_group_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING },
565N/A { "ldap_group_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_service_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_sudo_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_sudo_full_refresh_interval", DP_OPT_NUMBER, { .number = 21600 }, NULL_NUMBER }, /* 360 mins */
565N/A { "ldap_sudo_smart_refresh_interval", DP_OPT_NUMBER, { .number = 900 }, NULL_NUMBER }, /* 15 mins */
565N/A { "ldap_sudo_use_host_filter", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
565N/A { "ldap_sudo_hostnames", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_sudo_ip", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_sudo_include_netgroups", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
1019N/A { "ldap_sudo_include_regexp", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
1019N/A { "ldap_autofs_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
1019N/A { "ldap_schema", DP_OPT_STRING, { "ad" }, NULL_STRING },
1019N/A { "ldap_offline_timeout", DP_OPT_NUMBER, { .number = 60 }, NULL_NUMBER },
1019N/A { "ldap_force_upper_case_realm", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
1019N/A { "ldap_enumeration_refresh_timeout", DP_OPT_NUMBER, { .number = 300 }, NULL_NUMBER },
1019N/A { "ldap_purge_cache_timeout", DP_OPT_NUMBER, { .number = 10800 }, NULL_NUMBER },
1019N/A { "ldap_tls_cacert", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_tls_cacertdir", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_tls_cert", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_tls_key", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_tls_cipher_suite", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_id_use_start_tls", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
565N/A { "ldap_id_mapping", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
565N/A { "ldap_sasl_mech", DP_OPT_STRING, { "gssapi" }, NULL_STRING },
565N/A { "ldap_sasl_authid", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_sasl_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_sasl_minssf", DP_OPT_NUMBER, { .number = -1 }, NULL_NUMBER },
565N/A { "ldap_krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_krb5_init_creds", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
565N/A /* use the same parm name as the krb5 module so we set it only once */
565N/A { "krb5_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "krb5_backup_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "krb5_canonicalize", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
565N/A { "krb5_use_kdcinfo", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
565N/A { "ldap_pwd_policy", DP_OPT_STRING, { "none" }, NULL_STRING },
565N/A { "ldap_referrals", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
565N/A { "account_cache_expiration", DP_OPT_NUMBER, { .number = 0 }, NULL_NUMBER },
565N/A { "ldap_dns_service_name", DP_OPT_STRING, { SSS_LDAP_SRV_NAME }, NULL_STRING },
565N/A { "ldap_krb5_ticket_lifetime", DP_OPT_NUMBER, { .number = (24 * 60 * 60) }, NULL_NUMBER },
565N/A { "ldap_access_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_netgroup_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_group_nesting_level", DP_OPT_NUMBER, { .number = 2 }, NULL_NUMBER },
565N/A { "ldap_deref", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "ldap_account_expire_policy", DP_OPT_STRING, { "ad" }, NULL_STRING },
565N/A { "ldap_access_order", DP_OPT_STRING, { "filter" }, NULL_STRING },
685N/A { "ldap_chpass_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
685N/A { "ldap_chpass_backup_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
685N/A { "ldap_chpass_dns_service_name", DP_OPT_STRING, NULL_STRING, NULL_STRING },
685N/A { "ldap_chpass_update_last_change", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
685N/A { "ldap_enumeration_search_timeout", DP_OPT_NUMBER, { .number = 60 }, NULL_NUMBER },
685N/A /* Do not include ldap_auth_disable_tls_never_use_in_production in the
685N/A * manpages or SSSDConfig API
926N/A */
926N/A { "ldap_auth_disable_tls_never_use_in_production", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
926N/A { "ldap_page_size", DP_OPT_NUMBER, { .number = 1000 }, NULL_NUMBER },
926N/A { "ldap_deref_threshold", DP_OPT_NUMBER, { .number = 10 }, NULL_NUMBER },
685N/A { "ldap_sasl_canonicalize", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
685N/A { "ldap_connection_expire_timeout", DP_OPT_NUMBER, { .number = 900 }, NULL_NUMBER },
685N/A { "ldap_disable_paging", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
926N/A { "ldap_idmap_range_min", DP_OPT_NUMBER, { .number = 200000 }, NULL_NUMBER },
685N/A { "ldap_idmap_range_max", DP_OPT_NUMBER, { .number = 2000200000LL }, NULL_NUMBER },
685N/A { "ldap_idmap_range_size", DP_OPT_NUMBER, { .number = 200000 }, NULL_NUMBER },
879N/A { "ldap_idmap_autorid_compat", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
879N/A { "ldap_idmap_default_domain", DP_OPT_STRING, NULL_STRING, NULL_STRING },
879N/A { "ldap_idmap_default_domain_sid", DP_OPT_STRING, NULL_STRING, NULL_STRING },
879N/A { "ldap_groups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
879N/A { "ldap_initgroups_use_matching_rule_in_chain", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
879N/A { "ldap_rfc2307_fallback_to_local_users", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
879N/A { "ldap_disable_range_retrieval", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
879N/A { "ldap_min_id", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER},
879N/A { "ldap_max_id", DP_OPT_NUMBER, NULL_NUMBER, NULL_NUMBER},
879N/A DP_OPTION_TERMINATOR
565N/A};
838N/A
926N/Astruct dp_option ad_def_krb5_opts[] = {
926N/A { "krb5_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "krb5_backup_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
838N/A { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
838N/A { "krb5_ccachedir", DP_OPT_STRING, { DEFAULT_CCACHE_DIR }, NULL_STRING },
838N/A { "krb5_ccname_template", DP_OPT_STRING, { DEFAULT_CCNAME_TEMPLATE }, NULL_STRING},
838N/A { "krb5_auth_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
838N/A { "krb5_keytab", DP_OPT_STRING, { "/etc/krb5.keytab" }, NULL_STRING },
838N/A { "krb5_validate", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
838N/A { "krb5_kpasswd", DP_OPT_STRING, NULL_STRING, NULL_STRING },
565N/A { "krb5_backup_kpasswd", DP_OPT_STRING, NULL_STRING, NULL_STRING },
616N/A { "krb5_store_password_if_offline", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
616N/A { "krb5_renewable_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
616N/A { "krb5_lifetime", DP_OPT_STRING, NULL_STRING, NULL_STRING },
988N/A { "krb5_renew_interval", DP_OPT_STRING, NULL_STRING, NULL_STRING },
988N/A { "krb5_use_fast", DP_OPT_STRING, NULL_STRING, NULL_STRING },
926N/A { "krb5_fast_principal", DP_OPT_STRING, NULL_STRING, NULL_STRING },
926N/A { "krb5_canonicalize", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
565N/A { "krb5_use_enterprise_principal", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
565N/A { "krb5_use_kdcinfo", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
988N/A DP_OPTION_TERMINATOR
565N/A};
922N/A
922N/Astruct sdap_attr_map ad_2008r2_attr_map[] = {
633N/A { "ldap_entry_usn", SDAP_AD_USN, SYSDB_USN, NULL },
616N/A { "ldap_rootdse_last_usn", SDAP_AD_LAST_USN, SYSDB_HIGH_USN, NULL },
988N/A SDAP_ATTR_MAP_TERMINATOR
616N/A};
616N/A
988N/Astruct sdap_attr_map ad_2008r2_user_map[] = {
616N/A { "ldap_user_object_class", "user", SYSDB_USER_CLASS, NULL },
616N/A { "ldap_user_name", "sAMAccountName", SYSDB_NAME, NULL },
655N/A { "ldap_user_pwd", "unixUserPassword", SYSDB_PWD, NULL },
988N/A { "ldap_user_uid_number", "uidNumber", SYSDB_UIDNUM, NULL },
1027N/A { "ldap_user_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
926N/A { "ldap_user_gecos", "gecos", SYSDB_GECOS, NULL },
655N/A { "ldap_user_home_directory", "unixHomeDirectory", SYSDB_HOMEDIR, NULL },
838N/A { "ldap_user_shell", "loginShell", SYSDB_SHELL, NULL },
838N/A { "ldap_user_principal", "userPrincipalName", SYSDB_UPN, NULL },
838N/A { "ldap_user_fullname", "name", SYSDB_FULLNAME, NULL },
1027N/A { "ldap_user_member_of", "memberOf", SYSDB_MEMBEROF, NULL },
838N/A { "ldap_user_uuid", "objectGUID", SYSDB_UUID, NULL },
838N/A { "ldap_user_objectsid", "objectSID", SYSDB_SID, NULL },
838N/A { "ldap_user_primary_group", "primaryGroupID", SYSDB_PRIMARY_GROUP, NULL },
565N/A { "ldap_user_modify_timestamp", "whenChanged", SYSDB_ORIG_MODSTAMP, NULL },
565N/A { "ldap_user_entry_usn", SDAP_AD_USN, SYSDB_USN, NULL },
565N/A { "ldap_user_shadow_last_change", NULL, SYSDB_SHADOWPW_LASTCHANGE, NULL },
565N/A { "ldap_user_shadow_min", NULL, SYSDB_SHADOWPW_MIN, NULL },
565N/A { "ldap_user_shadow_max", NULL, SYSDB_SHADOWPW_MAX, NULL },
565N/A { "ldap_user_shadow_warning", NULL, SYSDB_SHADOWPW_WARNING, NULL },
565N/A { "ldap_user_shadow_inactive", NULL, SYSDB_SHADOWPW_INACTIVE, NULL },
565N/A { "ldap_user_shadow_expire", NULL, SYSDB_SHADOWPW_EXPIRE, NULL },
565N/A { "ldap_user_shadow_flag", NULL, SYSDB_SHADOWPW_FLAG, NULL },
565N/A { "ldap_user_krb_last_pwd_change", NULL, SYSDB_KRBPW_LASTCHANGE, NULL },
565N/A { "ldap_user_krb_password_expiration", NULL, SYSDB_KRBPW_EXPIRATION, NULL },
838N/A { "ldap_pwd_attribute", NULL, SYSDB_PWD_ATTRIBUTE, NULL },
565N/A { "ldap_user_authorized_service", NULL, SYSDB_AUTHORIZED_SERVICE, NULL },
838N/A { "ldap_user_ad_account_expires", "accountExpires", SYSDB_AD_ACCOUNT_EXPIRES, NULL},
838N/A { "ldap_user_ad_user_account_control", "userAccountControl", SYSDB_AD_USER_ACCOUNT_CONTROL, NULL},
565N/A { "ldap_ns_account_lock", NULL, SYSDB_NS_ACCOUNT_LOCK, NULL},
565N/A { "ldap_user_authorized_host", NULL, SYSDB_AUTHORIZED_HOST, NULL },
596N/A { "ldap_user_nds_login_disabled", NULL, SYSDB_NDS_LOGIN_DISABLED, NULL },
596N/A { "ldap_user_nds_login_expiration_time", NULL, SYSDB_NDS_LOGIN_EXPIRATION_TIME, NULL },
596N/A { "ldap_user_nds_login_allowed_time_map", NULL, SYSDB_NDS_LOGIN_ALLOWED_TIME_MAP, NULL },
596N/A { "ldap_user_ssh_public_key", NULL, SYSDB_SSH_PUBKEY, NULL },
596N/A SDAP_ATTR_MAP_TERMINATOR
614N/A};
614N/A
614N/Astruct sdap_attr_map ad_2008r2_group_map[] = {
614N/A { "ldap_group_object_class", "group", SYSDB_GROUP_CLASS, NULL },
926N/A { "ldap_group_name", "name", SYSDB_NAME, NULL },
614N/A { "ldap_group_pwd", NULL, SYSDB_PWD, NULL },
614N/A { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
614N/A { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
614N/A { "ldap_group_uuid", "objectGUID", SYSDB_UUID, NULL },
596N/A { "ldap_group_objectsid", "objectSID", SYSDB_SID, NULL },
565N/A { "ldap_group_modify_timestamp", "whenChanged", SYSDB_ORIG_MODSTAMP, NULL },
1027N/A { "ldap_group_entry_usn", SDAP_AD_USN, SYSDB_USN, NULL },
1027N/A SDAP_ATTR_MAP_TERMINATOR
1027N/A};
1027N/A
1027N/Astruct sdap_attr_map ad_netgroup_map[] = {
1027N/A { "ldap_netgroup_object_class", "nisNetgroup", SYSDB_NETGROUP_CLASS, NULL },
1027N/A { "ldap_netgroup_name", "cn", SYSDB_NAME, NULL },
565N/A { "ldap_netgroup_member", "memberNisNetgroup", SYSDB_ORIG_NETGROUP_MEMBER, NULL },
1027N/A { "ldap_netgroup_triple", "nisNetgroupTriple", SYSDB_NETGROUP_TRIPLE, NULL },
565N/A /* FIXME: this is 389ds specific */
1027N/A { "ldap_netgroup_uuid", "nsUniqueId", SYSDB_UUID, NULL },
565N/A { "ldap_netgroup_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
565N/A SDAP_ATTR_MAP_TERMINATOR
1027N/A};
565N/A
565N/Astruct sdap_attr_map ad_service_map[] = {
565N/A { "ldap_service_object_class", "ipService", SYSDB_SVC_CLASS, NULL },
565N/A { "ldap_service_name", "cn", SYSDB_NAME, NULL },
1027N/A { "ldap_service_port", "ipServicePort", SYSDB_SVC_PORT, NULL },
565N/A { "ldap_service_proto", "ipServiceProtocol", SYSDB_SVC_PROTO, NULL },
565N/A { "ldap_service_entry_usn", NULL, SYSDB_USN, NULL },
565N/A SDAP_ATTR_MAP_TERMINATOR
565N/A};
565N/A
565N/Astruct sdap_attr_map ad_autofs_mobject_map[] = {
565N/A { "ldap_autofs_map_object_class", "nisMap", SYSDB_AUTOFS_MAP_OC, NULL },
565N/A { "ldap_autofs_map_name", "nisMapName", SYSDB_AUTOFS_MAP_NAME, NULL },
941N/A SDAP_ATTR_MAP_TERMINATOR
941N/A};
1027N/A
941N/Astruct sdap_attr_map ad_autofs_entry_map[] = {
941N/A { "ldap_autofs_entry_object_class", "nisObject", SYSDB_AUTOFS_ENTRY_OC, NULL },
1027N/A { "ldap_autofs_entry_key", "cn", SYSDB_AUTOFS_ENTRY_KEY, NULL },
941N/A { "ldap_autofs_entry_value", "nisMapEntry", SYSDB_AUTOFS_ENTRY_VALUE, NULL },
941N/A SDAP_ATTR_MAP_TERMINATOR
941N/A};
1027N/A
1027N/Astruct dp_option ad_dyndns_opts[] = {
565N/A { "dyndns_update", DP_OPT_BOOL, BOOL_TRUE, BOOL_FALSE },
565N/A { "dyndns_refresh_interval", DP_OPT_NUMBER, { .number = 86400 }, NULL_NUMBER },
565N/A { "dyndns_iface", DP_OPT_STRING, NULL_STRING, NULL_STRING },
1027N/A { "dyndns_ttl", DP_OPT_NUMBER, { .number = 3600 }, NULL_NUMBER },
565N/A { "dyndns_update_ptr", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
565N/A { "dyndns_force_tcp", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
565N/A { "dyndns_auth", DP_OPT_STRING, { "gss-tsig" }, NULL_STRING },
565N/A DP_OPTION_TERMINATOR
565N/A};
565N/A
565N/A#endif /* AD_OPTS_H_ */
565N/A