providers/ipa/ipa_hbac_users.c

	ipa_hbac_users.c revision 1243e093fd31c5660adf1bb3dd477d6935a755be
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher/*
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    SSSD
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    Authors:
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        Stephen Gallagher <sgallagh@redhat.com>
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    Copyright (C) 2011 Red Hat
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    This program is free software; you can redistribute it and/or modify
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    it under the terms of the GNU General Public License as published by
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    the Free Software Foundation; either version 3 of the License, or
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    (at your option) any later version.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    This program is distributed in the hope that it will be useful,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    but WITHOUT ANY WARRANTY; without even the implied warranty of
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    GNU General Public License for more details.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    You should have received a copy of the GNU General Public License
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    along with this program.  If not, see <http://www.gnu.org/licenses/>.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher*/
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher#include "util/util.h"
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher#include "providers/ipa/ipa_hbac_private.h"
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher#include "providers/ldap/sdap_async.h"
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher/* Returns EOK and populates groupname if
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher * the group_dn is actually a group.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher * Returns ENOENT if group_dn does not point
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher * at a a group.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher * Returns EINVAL if there is a parsing error.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher * Returns ENOMEM as appropriate
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallaghererrno_t
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherget_ipa_groupname(TALLOC_CTX *mem_ctx,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                  struct sysdb_ctx *sysdb,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                  const char *group_dn,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                  const char **groupname)
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher{
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    errno_t ret;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    struct ldb_dn *dn;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    const char *rdn_name;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    const char *group_comp_name;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    const char *account_comp_name;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    const struct ldb_val *rdn_val;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    const struct ldb_val *group_comp_val;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    const struct ldb_val *account_comp_val;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    /* This is an IPA-specific hack. It may not
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher     * work for non-IPA servers and will need to
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher     * be changed if SSSD ever supports HBAC on
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher     * a non-IPA server.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher     */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    *groupname = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    dn = ldb_dn_new(mem_ctx, sysdb_ctx_get_ldb(sysdb), group_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (dn == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (!ldb_dn_validate(dn)) {
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek        ret = ERR_MALFORMED_ENTRY;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (ldb_dn_get_comp_num(dn) < 4) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        /* RDN, groups, accounts, and at least one DC= */
1dd195b9a3df01a0ef51e9f963201f1f79d1f90bStephen Gallagher        /* If it's fewer, it's not a group DN */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek        ret = ERR_UNEXPECTED_ENTRY_TYPE;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    /* If the RDN name is 'cn' */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    rdn_name = ldb_dn_get_rdn_name(dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (rdn_name == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        /* Shouldn't happen if ldb_dn_validate()
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher         * passed, but we'll be careful.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher         */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek        ret = ERR_MALFORMED_ENTRY;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (strcasecmp("cn", rdn_name) != 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        /* RDN has the wrong attribute name.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher         * It's not a group.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher         */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek        ret = ERR_UNEXPECTED_ENTRY_TYPE;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    /* and the second component is "cn=groups" */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    group_comp_name = ldb_dn_get_component_name(dn, 1);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (strcasecmp("cn", group_comp_name) != 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        /* The second component name is not "cn" */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek        ret = ERR_UNEXPECTED_ENTRY_TYPE;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    group_comp_val = ldb_dn_get_component_val(dn, 1);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (strncasecmp("groups",
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    (const char *) group_comp_val->data,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    group_comp_val->length) != 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        /* The second component value is not "groups" */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek        ret = ERR_UNEXPECTED_ENTRY_TYPE;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    /* and the third component is "accounts" */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    account_comp_name = ldb_dn_get_component_name(dn, 2);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (strcasecmp("cn", account_comp_name) != 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        /* The third component name is not "cn" */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek        ret = ERR_UNEXPECTED_ENTRY_TYPE;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    account_comp_val = ldb_dn_get_component_val(dn, 2);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (strncasecmp("accounts",
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    (const char *) account_comp_val->data,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    account_comp_val->length) != 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        /* The third component value is not "accounts" */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek        ret = ERR_UNEXPECTED_ENTRY_TYPE;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    /* Then the value of the RDN is the group name */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    rdn_val = ldb_dn_get_rdn_val(dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    *groupname = talloc_strndup(mem_ctx,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                (const char *)rdn_val->data,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                rdn_val->length);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (*groupname == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    ret = EOK;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherdone:
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    talloc_free(dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    return ret;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher}
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallaghererrno_t
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherhbac_user_attrs_to_rule(TALLOC_CTX *mem_ctx,
044868b388b4e47499f12a9105310b247bbe1ce2Simo Sorce                        struct sss_domain_info *domain,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                        const char *rule_name,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                        struct sysdb_attrs *rule_attrs,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                        struct hbac_rule_element **users)
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher{
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    errno_t ret;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    TALLOC_CTX *tmp_ctx = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    struct hbac_rule_element *new_users = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    struct ldb_message_element *el = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    struct ldb_message **msgs = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    char *filter;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    char *member_dn;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    const char *member_user;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    const char *attrs[] = { SYSDB_NAME, NULL };
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    size_t num_users = 0;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    size_t num_groups = 0;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    const char *name;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    size_t count;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    size_t i;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    tmp_ctx = talloc_new(mem_ctx);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (tmp_ctx == NULL) return ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    new_users = talloc_zero(tmp_ctx, struct hbac_rule_element);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (new_users == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov    DEBUG(SSSDBG_TRACE_LIBS, "Processing users for rule [%s]\n", rule_name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    ret = hbac_get_category(rule_attrs, IPA_USER_CATEGORY,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                            &new_users->category);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "Could not identify user categories\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (new_users->category & HBAC_CATEGORY_ALL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        /* Short-cut to the exit */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        ret = EOK;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    ret = sysdb_attrs_get_el(rule_attrs, IPA_MEMBER_USER, &el);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (ret != EOK && ret != ENOENT) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CRIT_FAILURE, "sysdb_attrs_get_el failed.\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (ret == ENOENT || el->num_values == 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        el->num_values = 0;
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov        DEBUG(SSSDBG_CONF_SETTINGS,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov              "No user specified, rule will never apply.\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    new_users->names = talloc_array(new_users,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                    const char *,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                    el->num_values + 1);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (new_users->names == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    new_users->groups = talloc_array(new_users,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                     const char *,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                     el->num_values + 1);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (new_users->groups == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    for (i = 0; i < el->num_values; i++) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        member_user = (const char *)el->values[i].data;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        ret = sss_filter_sanitize(tmp_ctx, member_user, &member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        if (ret != EOK) goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        filter = talloc_asprintf(member_dn, "(%s=%s)",
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                 SYSDB_ORIG_DN, member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        if (filter == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        /* First check if this is a user */
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek        ret = sysdb_search_users(tmp_ctx, domain,
044868b388b4e47499f12a9105310b247bbe1ce2Simo Sorce                                 filter, attrs, &count, &msgs);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        if (ret != EOK && ret != ENOENT) goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        if (ret == EOK && count == 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            ret = ENOENT;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        if (ret == EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            if (count > 1) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                      "Original DN matched multiple users. Skipping \n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                talloc_zfree(member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                continue;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            /* Original DN matched a single user. Get the username */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            name = ldb_msg_find_attr_as_string(msgs[0], SYSDB_NAME, NULL);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            if (name == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                DEBUG(SSSDBG_CRIT_FAILURE, "Attribute is missing!\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                ret = EFAULT;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            new_users->names[num_users] = talloc_strdup(new_users->names,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                                        name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            if (new_users->names[num_users] == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            }
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov            DEBUG(SSSDBG_TRACE_INTERNAL, "Added user [%s] to rule [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                      name, rule_name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            num_users++;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        } else {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            /* Check if it is a group instead */
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek            ret = sysdb_search_groups(tmp_ctx, domain, filter, attrs,
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek                                      &count, &msgs);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            if (ret != EOK && ret != ENOENT) goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            if (ret == EOK && count == 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                ret = ENOENT;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            if (ret == EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                if (count > 1) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                    DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                          "Original DN matched multiple groups. "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                              "Skipping\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    talloc_zfree(member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    continue;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                /* Original DN matched a single group. Get the groupname */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                name = ldb_msg_find_attr_as_string(msgs[0], SYSDB_NAME, NULL);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                if (name == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                    DEBUG(SSSDBG_CRIT_FAILURE, "Attribute is missing!\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    ret = EFAULT;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                new_users->groups[num_groups] =
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                        talloc_strdup(new_users->groups, name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                if (new_users->groups[num_groups] == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                }
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                DEBUG(SSSDBG_TRACE_INTERNAL,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                      "Added POSIX group [%s] to rule [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                          name, rule_name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                num_groups++;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            } else {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                /* If the group still matches the group pattern,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                 * we can assume it is a non-POSIX group.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                 */
8a81628d58dd2991d53398a213916671e14592d8Simo Sorce                ret = get_ipa_groupname(new_users->groups, domain->sysdb,
8a81628d58dd2991d53398a213916671e14592d8Simo Sorce                                        member_user,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                        &new_users->groups[num_groups]);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                if (ret == EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                    DEBUG(SSSDBG_TRACE_INTERNAL,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                          "Added non-POSIX group [%s] to rule [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                              new_users->groups[num_groups], rule_name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    num_groups++;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                } else {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                    /* Not a group, so we don't care about it */
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                    DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov                          "[%s] does not map to either a user or group. "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov                              "Skipping\n", member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher            }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        talloc_zfree(member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    new_users->names[num_users] = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    new_users->groups[num_groups] = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    /* Shrink the arrays down to their real sizes */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    new_users->names = talloc_realloc(new_users, new_users->names,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                      const char *, num_users + 1);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (new_users->names == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    new_users->groups = talloc_realloc(new_users, new_users->groups,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher                                      const char *, num_groups + 1);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (new_users->groups == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    ret = EOK;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherdone:
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    if (ret == EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher        *users = talloc_steal(mem_ctx, new_users);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    talloc_free(tmp_ctx);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher    return ret;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher}