providers/ipa/ipa_common.c

	ipa_common.c revision 6bcdb688a3d1319ded1073f08e0350de9e5ba94e
a11689fe3fbb3bca11b9cb4ae5faf27db96401ccTimo Sirainen/*
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    SSSD
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    IPA Provider Common Functions
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    Authors:
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        Simo Sorce <ssorce@redhat.com>
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    Copyright (C) 2009 Red Hat
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    This program is free software; you can redistribute it and/or modify
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    it under the terms of the GNU General Public License as published by
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    the Free Software Foundation; either version 3 of the License, or
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    (at your option) any later version.
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    This program is distributed in the hope that it will be useful,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    but WITHOUT ANY WARRANTY; without even the implied warranty of
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    GNU General Public License for more details.
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    You should have received a copy of the GNU General Public License
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    along with this program.  If not, see <http://www.gnu.org/licenses/>.
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen*/
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen#include <netdb.h>
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen#include <ctype.h>
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen#include <arpa/inet.h>
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen#include "providers/ipa/ipa_common.h"
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen
d595049948579def2d82718dbce0a6b49a281402Timo Sirainenstruct dp_option ipa_basic_opts[] = {
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen    { "ipa_domain", DP_OPT_STRING, NULL_STRING, NULL_STRING },
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen    { "ipa_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen    { "ipa_hostname", DP_OPT_STRING, NULL_STRING, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen};
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainenstruct dp_option ipa_def_ldap_opts[] = {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_default_bind_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_default_authtok_type", DP_OPT_STRING, NULL_STRING, NULL_STRING},
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_default_authtok", DP_OPT_BLOB, NULL_BLOB, NULL_BLOB },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_search_timeout", DP_OPT_NUMBER, { .number = 60 }, NULL_NUMBER },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_network_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_opt_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_tls_reqcert", DP_OPT_STRING, { "hard" }, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_user_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_user_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_user_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_group_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_group_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_group_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_schema", DP_OPT_STRING, { "ipa_v1" }, NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_offline_timeout", DP_OPT_NUMBER, { .number = 60 }, NULL_NUMBER },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_force_upper_case_realm", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_enumeration_refresh_timeout", DP_OPT_NUMBER, { .number = 300 }, NULL_NUMBER },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_purge_cache_timeout", DP_OPT_NUMBER, { .number = 3600 }, NULL_NUMBER },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "entry_cache_timeout", DP_OPT_NUMBER, { .number = 1800 }, NULL_NUMBER },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_tls_cacert", DP_OPT_STRING, NULL_STRING, NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_tls_cacertdir", DP_OPT_STRING, NULL_STRING, NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_id_use_start_tls", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_sasl_mech", DP_OPT_STRING, { "GSSAPI" } , NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_sasl_authid", DP_OPT_STRING, NULL_STRING, NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_krb5_init_creds", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    /* use the same parm name as the krb5 module so we set it only once */
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_pwd_policy", DP_OPT_STRING, { "none" } , NULL_STRING },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_referrals", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "account_cache_expiration", DP_OPT_NUMBER, { .number = 0 }, NULL_NUMBER }
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen};
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainenstruct sdap_attr_map ipa_attr_map[] = {
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_entry_usn", "entryUSN", SYSDB_USN, NULL },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_rootdse_last_usn", "lastUSN", SYSDB_HIGH_USN, NULL }
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen};
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainenstruct sdap_attr_map ipa_user_map[] = {
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_user_object_class", "posixAccount", SYSDB_USER_CLASS, NULL },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_user_name", "uid", SYSDB_NAME, NULL },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_user_pwd", "userPassword", SYSDB_PWD, NULL },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_user_uid_number", "uidNumber", SYSDB_UIDNUM, NULL },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_user_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_user_gecos", "gecos", SYSDB_GECOS, NULL },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_user_home_directory", "homeDirectory", SYSDB_HOMEDIR, NULL },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_user_shell", "loginShell", SYSDB_SHELL, NULL },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_user_principal", "krbPrincipalName", SYSDB_UPN, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_user_member_of", "memberOf", SYSDB_MEMBEROF, NULL },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_user_uuid", "nsUniqueId", SYSDB_UUID, NULL },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_user_shadow_last_change", "shadowLastChange", SYSDB_SHADOWPW_LASTCHANGE, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_user_shadow_min", "shadowMin", SYSDB_SHADOWPW_MIN, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_user_shadow_max", "shadowMax", SYSDB_SHADOWPW_MAX, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_user_shadow_warning", "shadowWarning", SYSDB_SHADOWPW_WARNING, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_user_shadow_inactive", "shadowInactive", SYSDB_SHADOWPW_INACTIVE, NULL },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_user_shadow_expire", "shadowExpire", SYSDB_SHADOWPW_EXPIRE, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_user_shadow_flag", "shadowFlag", SYSDB_SHADOWPW_FLAG, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_user_krb_last_pwd_change", "krbLastPwdChange", SYSDB_KRBPW_LASTCHANGE, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_user_krb_password_expiration", "krbPasswordExpiration", SYSDB_KRBPW_EXPIRATION, NULL },
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen    { "ldap_pwd_attribute", "pwdAttribute", SYSDB_PWD_ATTRIBUTE, NULL }
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen};
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainenstruct sdap_attr_map ipa_group_map[] = {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_group_object_class", "posixGroup", SYSDB_GROUP_CLASS, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_group_name", "cn", SYSDB_NAME, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_group_pwd", "userPassword", SYSDB_PWD, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_group_uuid", "nsUniqueId", SYSDB_UUID, NULL },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen};
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainenstruct dp_option ipa_def_krb5_opts[] = {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "krb5_kdcip", DP_OPT_STRING, NULL_STRING, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "krb5_ccachedir", DP_OPT_STRING, { "/tmp" }, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "krb5_ccname_template", DP_OPT_STRING, { "FILE:%d/krb5cc_%U_XXXXXX" }, NULL_STRING},
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "krb5_changepw_principal", DP_OPT_STRING, { "kadmin/changepw" }, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "krb5_auth_timeout", DP_OPT_NUMBER, { .number = 15 }, NULL_NUMBER },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "krb5_keytab", DP_OPT_STRING, { "/etc/krb5.keytab" }, NULL_STRING },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "krb5_validate", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    { "krb5_kpasswd", DP_OPT_STRING, NULL_STRING, NULL_STRING }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen};
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainenint domain_to_basedn(TALLOC_CTX *memctx, const char *domain, char **basedn)
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen{
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen    const char *s;
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen    char *dn;
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen    char *p;
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen    int l;
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen    s = domain;
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen    dn = talloc_strdup(memctx, "dc=");
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen    while ((p = strchr(s, '.'))) {
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen        l = p - s;
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen        dn = talloc_asprintf_append_buffer(dn, "%.*s,dc=", l, s);
bbc30fd4fa86723f6a72309ad3a2a96f34eabd6cTimo Sirainen        if (!dn) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen            return ENOMEM;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        s = p + 1;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    dn = talloc_strdup_append_buffer(dn, s);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (!dn) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        return ENOMEM;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    *basedn = dn;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    return EOK;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen}
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainenint ipa_get_options(TALLOC_CTX *memctx,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                    struct confdb_ctx *cdb,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                    const char *conf_path,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                    struct sss_domain_info *dom,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                    struct ipa_options **_opts)
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen{
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    struct ipa_options *opts;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    char *domain;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    char *server;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    char *ipa_hostname;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    int ret;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    char hostname[HOST_NAME_MAX + 1];
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    opts = talloc_zero(memctx, struct ipa_options);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (!opts) return ENOMEM;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    ret = dp_get_options(opts, cdb, conf_path,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                         ipa_basic_opts,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                         IPA_OPTS_BASIC,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                         &opts->basic);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (ret != EOK) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    domain = dp_opt_get_string(opts->basic, IPA_DOMAIN);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (!domain) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        ret = dp_opt_set_string(opts->basic, IPA_DOMAIN, dom->name);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        if (ret != EOK) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen            goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    /* FIXME: Make non-fatal once we have discovery */
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    server = dp_opt_get_string(opts->basic, IPA_SERVER);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (!server) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        DEBUG(0, ("Can't find ipa server, missing option!\n"));
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        ret = EINVAL;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    ipa_hostname = dp_opt_get_string(opts->basic, IPA_HOSTNAME);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (ipa_hostname == NULL) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        ret = gethostname(hostname, HOST_NAME_MAX);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        if (ret != EOK) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen            DEBUG(1, ("gethostname failed [%d][%s].\n", errno,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                      strerror(errno)));
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen            ret = errno;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen            goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        hostname[HOST_NAME_MAX] = '\0';
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        DEBUG(9, ("Setting ipa_hostname to [%s].\n", hostname));
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        ret = dp_opt_set_string(opts->basic, IPA_HOSTNAME, hostname);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        if (ret != EOK) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen            goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    ret = EOK;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    *_opts = opts;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainendone:
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (ret != EOK) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        talloc_zfree(opts);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    return ret;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen}
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainenint ipa_get_id_options(struct ipa_options *ipa_opts,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                       struct confdb_ctx *cdb,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                       const char *conf_path,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                       struct sdap_options **_opts)
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen{
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    TALLOC_CTX *tmpctx;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    char *hostname;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    char *basedn;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    char *realm;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    char *value;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    int ret;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    int i;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    /* self check test, this should never fail, unless someone forgot
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen     * to properly update the code after new ldap options have been added */
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (SDAP_OPTS_BASIC != IPA_OPTS_BASIC_TEST) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        DEBUG(0, ("Option numbers do not match (%d != %d)\n",
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                   SDAP_OPTS_BASIC, IPA_OPTS_BASIC_TEST));
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        abort();
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    tmpctx = talloc_new(ipa_opts);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (!tmpctx) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        return ENOMEM;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    ipa_opts->id = talloc_zero(ipa_opts, struct sdap_options);
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    if (!ipa_opts->id) {
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen        ret = ENOMEM;
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen        goto done;
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    }
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    /* get sdap options */
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    ret = dp_get_options(ipa_opts->id, cdb, conf_path,
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen                         ipa_def_ldap_opts,
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen                         SDAP_OPTS_BASIC,
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen                         &ipa_opts->id->basic);
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    if (ret != EOK) {
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen        goto done;
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    }
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    if (NULL == dp_opt_get_string(ipa_opts->id->basic, SDAP_SEARCH_BASE)) {
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen        ret = domain_to_basedn(tmpctx,
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen                               dp_opt_get_string(ipa_opts->basic, IPA_DOMAIN),
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen                               &basedn);
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen        if (ret != EOK) {
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen            goto done;
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen        }
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen        /* FIXME: get values by querying IPA */
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        /* set search base */
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        value = talloc_asprintf(tmpctx, "cn=accounts,%s", basedn);
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        if (!value) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            ret = ENOMEM;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            goto done;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        ret = dp_opt_set_string(ipa_opts->id->basic,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                                SDAP_SEARCH_BASE, value);
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        if (ret != EOK) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            goto done;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        DEBUG(6, ("Option %s set to %s\n",
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                  ipa_opts->id->basic[SDAP_SEARCH_BASE].opt_name,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                  dp_opt_get_string(ipa_opts->id->basic, SDAP_SEARCH_BASE)));
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    /* set the ldap_sasl_authid if the ipa_hostname override was specified */
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    if (NULL == dp_opt_get_string(ipa_opts->id->basic, SDAP_SASL_AUTHID)) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        hostname = dp_opt_get_string(ipa_opts->basic, IPA_HOSTNAME);
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        if (hostname) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            value = talloc_asprintf(tmpctx, "host/%s", hostname);
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            if (!value) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                ret = ENOMEM;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                goto done;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            ret = dp_opt_set_string(ipa_opts->id->basic,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                                    SDAP_SASL_AUTHID, value);
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            if (ret != EOK) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                goto done;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        DEBUG(6, ("Option %s set to %s\n",
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                  ipa_opts->id->basic[SDAP_SASL_AUTHID].opt_name,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                  dp_opt_get_string(ipa_opts->id->basic, SDAP_SASL_AUTHID)));
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    /* set krb realm */
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    if (NULL == dp_opt_get_string(ipa_opts->id->basic, SDAP_KRB5_REALM)) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        realm = dp_opt_get_string(ipa_opts->basic, IPA_DOMAIN);
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        for (i = 0; realm[i]; i++) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            realm[i] = toupper(realm[i]);
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        ret = dp_opt_set_string(ipa_opts->id->basic,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                                SDAP_KRB5_REALM, realm);
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        if (ret != EOK) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            goto done;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        DEBUG(6, ("Option %s set to %s\n",
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                  ipa_opts->id->basic[SDAP_KRB5_REALM].opt_name,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                  dp_opt_get_string(ipa_opts->id->basic, SDAP_KRB5_REALM)));
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    /* fix schema to IPAv1 for now */
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    ipa_opts->id->schema_type = SDAP_SCHEMA_IPA_V1;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    /* set user/group search bases if they are not specified */
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    if (NULL == dp_opt_get_string(ipa_opts->id->basic,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                                  SDAP_USER_SEARCH_BASE)) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        ret = dp_opt_set_string(ipa_opts->id->basic, SDAP_USER_SEARCH_BASE,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                                dp_opt_get_string(ipa_opts->id->basic,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                                                  SDAP_SEARCH_BASE));
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        if (ret != EOK) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen            goto done;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        DEBUG(6, ("Option %s set to %s\n",
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                  ipa_opts->id->basic[SDAP_USER_SEARCH_BASE].opt_name,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                  dp_opt_get_string(ipa_opts->id->basic,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                                    SDAP_USER_SEARCH_BASE)));
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    }
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    if (NULL == dp_opt_get_string(ipa_opts->id->basic,
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen                                  SDAP_GROUP_SEARCH_BASE)) {
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        ret = dp_opt_set_string(ipa_opts->id->basic, SDAP_GROUP_SEARCH_BASE,
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen                                dp_opt_get_string(ipa_opts->id->basic,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                                                  SDAP_SEARCH_BASE));
e9e5e84ffb2ce2e606a24ce6d930580367562ff0Timo Sirainen        if (ret != EOK) {
e9e5e84ffb2ce2e606a24ce6d930580367562ff0Timo Sirainen            goto done;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen        }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(6, ("Option %s set to %s\n",
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                  ipa_opts->id->basic[SDAP_GROUP_SEARCH_BASE].opt_name,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                  dp_opt_get_string(ipa_opts->id->basic,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                                    SDAP_GROUP_SEARCH_BASE)));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
28cb56e6957f06717e876cecb7aabc820fdf632eTimo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    ret = sdap_get_map(ipa_opts->id, cdb, conf_path,
9e1211fd8b7a12b1a4e4c2b7714164e504f127d0Timo Sirainen                       ipa_attr_map,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                       SDAP_AT_GENERAL,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                       &ipa_opts->id->gen_map);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (ret != EOK) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        goto done;
ebded144e74a668973ec9ba6e7e169d4e6dc766cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    ret = sdap_get_map(ipa_opts->id,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                       cdb, conf_path,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                       ipa_user_map,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                       SDAP_OPTS_USER,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                       &ipa_opts->id->user_map);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (ret != EOK) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        goto done;
e9e5e84ffb2ce2e606a24ce6d930580367562ff0Timo Sirainen    }
e9e5e84ffb2ce2e606a24ce6d930580367562ff0Timo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    ret = sdap_get_map(ipa_opts->id,
e9e5e84ffb2ce2e606a24ce6d930580367562ff0Timo Sirainen                       cdb, conf_path,
e9e5e84ffb2ce2e606a24ce6d930580367562ff0Timo Sirainen                       ipa_group_map,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                       SDAP_OPTS_GROUP,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                       &ipa_opts->id->group_map);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (ret != EOK) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    ret = EOK;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    *_opts = ipa_opts->id;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainendone:
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    talloc_zfree(tmpctx);
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen    if (ret != EOK) {
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen        talloc_zfree(ipa_opts->id);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen    return ret;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen}
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
9e1211fd8b7a12b1a4e4c2b7714164e504f127d0Timo Sirainenint ipa_get_auth_options(struct ipa_options *ipa_opts,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                         struct confdb_ctx *cdb,
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen                         const char *conf_path,
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen                         struct dp_option **_opts)
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen{
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    char *value;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    int ret;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    int i;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    /* self check test, this should never fail, unless someone forgot
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen     * to properly update the code after new ldap options have been added */
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (KRB5_OPTS != IPA_KRB5_OPTS_TEST) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(0, ("Option numbers do not match (%d != %d)\n",
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                   KRB5_OPTS, IPA_KRB5_OPTS_TEST));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        abort();
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    ipa_opts->auth = talloc_zero(ipa_opts, struct dp_option);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (ipa_opts->auth == NULL) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        ret = ENOMEM;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        goto done;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    /* get krb5 options */
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    ret = dp_get_options(ipa_opts, cdb, conf_path,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                         ipa_def_krb5_opts,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                         KRB5_OPTS, &ipa_opts->auth);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (ret != EOK) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        goto done;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    /* set krb realm */
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (NULL == dp_opt_get_string(ipa_opts->auth, KRB5_REALM)) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        value = dp_opt_get_string(ipa_opts->basic, IPA_DOMAIN);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        if (!value) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen            ret = ENOMEM;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen            goto done;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        for (i = 0; value[i]; i++) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen            value[i] = toupper(value[i]);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        ret = dp_opt_set_string(ipa_opts->auth, KRB5_REALM, value);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        if (ret != EOK) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen            goto done;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(6, ("Option %s set to %s\n",
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                  ipa_opts->auth[KRB5_REALM].opt_name,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                  dp_opt_get_string(ipa_opts->auth, KRB5_REALM)));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    *_opts = ipa_opts->auth;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    ret = EOK;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainendone:
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (ret != EOK) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        talloc_zfree(ipa_opts->auth);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    return ret;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen}
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainenstatic void ipa_resolve_callback(void *private_data, struct fo_server *server)
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen{
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen    struct ipa_service *service;
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen    struct hostent *srvaddr;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    char *address;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    char *new_uri;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen    int ret;
a78d5bd9772681a232de56b3dd6acefee66cc71bTimo Sirainen
d595049948579def2d82718dbce0a6b49a281402Timo Sirainen    service = talloc_get_type(private_data, struct ipa_service);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (!service) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(1, ("FATAL: Bad private_data\n"));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        return;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    srvaddr = fo_get_server_hostent(server);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (!srvaddr) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(1, ("FATAL: No hostent available for server (%s)\n",
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                  fo_get_server_name(server)));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        return;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    address = talloc_zero_size(service, 128);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (address == NULL) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(1, ("talloc_zero failed.\n"));
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen        return;
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    }
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    if (inet_ntop(srvaddr->h_addrtype, srvaddr->h_addr_list[0],
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen                  address, 128) == NULL) {
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen        DEBUG(1, ("inet_ntop failed [%d][%s].\n", errno, strerror(errno)));
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen        return;
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    }
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    new_uri = talloc_asprintf(service, "ldap://%s", address);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (!new_uri) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(2, ("Failed to copy URI ...\n"));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        talloc_free(address);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        return;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    /* free old one and replace with new one */
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    talloc_zfree(service->sdap->uri);
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    service->sdap->uri = new_uri;
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    talloc_zfree(service->krb5_service->address);
1b33e848e84e6f74aa0e3339c32fa96bc15102a2Timo Sirainen    service->krb5_service->address = address;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    ret = write_krb5info_file(service->krb5_service->realm, address,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                              SSS_KRB5KDC_FO_SRV);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (ret != EOK) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(2, ("write_krb5info_file failed, authentication might fail.\n"));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen}
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainenint ipa_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                     const char *servers, const char *domain,
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                     struct ipa_service **_service)
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen{
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    TALLOC_CTX *tmp_ctx;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    struct ipa_service *service;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    char **list = NULL;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    char *realm;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    int ret;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    int i;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    tmp_ctx = talloc_new(memctx);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (!tmp_ctx) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        return ENOMEM;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    service = talloc_zero(tmp_ctx, struct ipa_service);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (!service) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        ret = ENOMEM;
9e1211fd8b7a12b1a4e4c2b7714164e504f127d0Timo Sirainen        goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    service->sdap = talloc_zero(service, struct sdap_service);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (!service->sdap) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        ret = ENOMEM;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    service->krb5_service = talloc_zero(service, struct krb5_service);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (!service->krb5_service) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        ret = ENOMEM;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    ret = be_fo_add_service(ctx, "IPA");
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (ret != EOK) {
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        DEBUG(1, ("Failed to create failover service!\n"));
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        goto done;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    service->sdap->name = talloc_strdup(service, "IPA");
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (!service->sdap->name) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        ret = ENOMEM;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        goto done;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    service->krb5_service->name = talloc_strdup(service, "IPA");
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (!service->krb5_service->name) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        ret = ENOMEM;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        goto done;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    realm = talloc_strdup(service, domain);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (!realm) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        ret = ENOMEM;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        goto done;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    for (i = 0; realm[i]; i++) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        realm[i] = toupper(realm[i]);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    service->krb5_service->realm = realm;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    /* split server parm into a list */
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    ret = split_on_separator(tmp_ctx, servers, ',', true, &list, NULL);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (ret != EOK) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(1, ("Failed to parse server list!\n"));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        goto done;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    /* now for each one add a new server to the failover service */
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    for (i = 0; list[i]; i++) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        talloc_steal(service, list[i]);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        ret = be_fo_add_server(ctx, "IPA", list[i], 0, NULL);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        if (ret && ret != EEXIST) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen            DEBUG(0, ("Failed to add server\n"));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen            goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen        }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(6, ("Added Server %s\n", list[i]));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    ret = be_fo_service_add_callback(memctx, ctx, "IPA",
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen                                     ipa_resolve_callback, service);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    if (ret != EOK) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        DEBUG(1, ("Failed to add failover callback!\n"));
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        goto done;
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    ret = EOK;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainendone:
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    if (ret == EOK) {
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen        *_service = talloc_steal(memctx, service);
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen    }
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    talloc_zfree(tmp_ctx);
1358e2c58ce29231485a5cfa454756d429ad3d2cTimo Sirainen    return ret;
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen}
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen
a64adf62fa33f2463a86f990217b0c9078531a40Timo Sirainen