ipa_s2n_exop.c revision 28c70f003c7b330ab1d998a4eff1248d272a6ba9
/*
SSSD
IPA Helper routines - external users and groups with s2n plugin
Copyright (C) Sumit Bose <sbose@redhat.com> - 2011
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "providers/ldap/sdap_async_private.h"
#include "providers/ldap/ldap_common.h"
#include "providers/ipa/ipa_subdomains.h"
enum input_types {
INP_SID = 1,
};
enum request_types {
REQ_SIMPLE = 1,
};
enum response_types {
RESP_SID = 1,
};
/* ==Sid2Name Extended Operation============================================= */
#define EXOP_SID2NAME_OID "2.16.840.1.113730.3.8.10.4"
#define EXOP_SID2NAME_V1_OID "2.16.840.1.113730.3.8.10.4.1"
struct ipa_s2n_exop_state {
struct sdap_handle *sh;
char *retoid;
};
struct tevent_context *ev,
struct sdap_handle *sh,
bool is_v1,
int timeout,
{
struct ipa_s2n_exop_state *state;
int ret;
int msgid;
goto fail;
}
msgid);
if (ret) {
ret = ERR_INTERNAL;
goto fail;
}
return req;
fail:
return req;
}
{
struct ipa_s2n_exop_state);
int ret;
int result;
if (error) {
return;
}
NULL, 0);
if (ret != LDAP_SUCCESS) {
goto done;
}
if (result != LDAP_SUCCESS) {
goto done;
}
if (ret != LDAP_SUCCESS) {
ret);
goto done;
}
goto done;
}
goto done;
}
goto done;
}
done:
} else {
}
}
{
struct ipa_s2n_exop_state);
return EOK;
}
{
int ret;
if (ret == -1) {
goto done;
}
goto done;
}
goto done;
}
done:
ber_bvfree(bv);
} else {
}
return ret;
}
/* The extended operation expect the following ASN.1 encoded request data:
*
* ExtdomRequestValue ::= SEQUENCE {
* inputType ENUMERATED {
* sid (1),
* name (2),
* posix uid (3),
* posix gid (3)
* },
* requestType ENUMERATED {
* simple (1),
* full (2)
* full_with_members (3)
* },
* data InputData
* }
*
* InputData ::= CHOICE {
* sid OCTET STRING,
* name NameDomainData
* uid PosixUid,
* gid PosixGid
* }
*
* NameDomainData ::= SEQUENCE {
* domain_name OCTET STRING,
* object_name OCTET STRING
* }
*
* PosixUid ::= SEQUENCE {
* domain_name OCTET STRING,
* uid INTEGER
* }
*
* PosixGid ::= SEQUENCE {
* domain_name OCTET STRING,
* gid INTEGER
* }
*
*/
const char *domain_name,
int entry_type,
enum request_types request_type,
{
int ret;
return ENOMEM;
}
switch (entry_type) {
case BE_REQ_USER:
case BE_REQ_USER_AND_GROUP: /* the extdom exop does not care if the
ID belongs to a user or a group */
} else {
goto done;
}
break;
case BE_REQ_GROUP:
} else {
goto done;
}
break;
case BE_REQ_BY_SECID:
} else {
goto done;
}
break;
default:
goto done;
}
if (ret == -1) {
goto done;
}
if (ret == -1) {
goto done;
}
done:
return ret;
}
/* If the extendend operation is successful it returns the following ASN.1
* encoded response:
*
* ExtdomResponseValue ::= SEQUENCE {
* responseType ENUMERATED {
* sid (1),
* name (2),
* posix_user (3),
* posix_group (4),
* posix_user_grouplist (5),
* posix_group_members (6)
* },
* data OutputData
* }
*
* OutputData ::= CHOICE {
* sid OCTET STRING,
* name NameDomainData,
* user PosixUser,
* group PosixGroup,
* usergrouplist PosixUserGrouplist,
* groupmembers PosixGroupMembers
*
* }
*
* NameDomainData ::= SEQUENCE {
* domain_name OCTET STRING,
* object_name OCTET STRING
* }
*
* PosixUser ::= SEQUENCE {
* domain_name OCTET STRING,
* user_name OCTET STRING,
* uid INTEGER
* gid INTEGER
* }
*
* PosixGroup ::= SEQUENCE {
* domain_name OCTET STRING,
* group_name OCTET STRING,
* gid INTEGER
* }
*
* PosixUserGrouplist ::= SEQUENCE {
* domain_name OCTET STRING,
* user_name OCTET STRING,
* uid INTEGER,
* gid INTEGER,
* gecos OCTET STRING,
* home_directory OCTET STRING,
* shell OCTET STRING,
* grouplist GroupNameList
* }
*
* GroupNameList ::= SEQUENCE OF OCTET STRING
*
* PosixGroupMembers ::= SEQUENCE {
* domain_name OCTET STRING,
* group_name OCTET STRING,
* gid INTEGER,
* members GroupMemberList
* }
*
* GroupMemberList ::= SEQUENCE OF OCTET STRING
*/
struct resp_attrs {
enum response_types response_type;
char *domain_name;
union {
char *sid_str;
char *name;
} a;
char **groups;
struct sysdb_attrs *sysdb_attrs;
};
{
char *ber_cookie;
char *name;
struct ldb_val v;
int ret;
size_t c;
return ENOMEM;
}
}
tag != LBER_DEFAULT;
if (tag == LBER_ERROR) {
return EINVAL;
}
return ret;
}
}
}
return EOK;
}
{
int ret;
size_t c;
if (tag == LBER_ERROR) {
goto done;
}
} else {
goto done;
}
}
} else {
goto done;
}
}
} else {
goto done;
}
}
if (tag == LBER_ERROR) {
goto done;
}
goto done;
}
list[c]);
goto done;
}
}
}
if (tag == LBER_SEQUENCE) {
goto done;
}
}
done:
ber_memvfree((void **) list);
return ret;
}
{
int ret;
size_t c;
if (tag == LBER_ERROR) {
goto done;
}
goto done;
}
list[c]);
goto done;
}
}
}
if (tag == LBER_SEQUENCE) {
goto done;
}
}
done:
ber_memvfree((void **) list);
return ret;
}
struct resp_attrs *attrs,
struct resp_attrs *simple_attrs);
char *retoid,
struct resp_attrs **resp_attrs)
{
int ret;
enum response_types type;
char *domain_name = NULL;
char *sid_str;
bool is_v1 = false;
return EINVAL;
}
is_v1 = true;
is_v1 = false;
} else {
"Result has wrong OID, expected [%s] or [%s], got [%s].\n",
return EINVAL;
}
return EINVAL;
}
if (tag == LBER_ERROR) {
goto done;
}
goto done;
}
switch (type) {
case RESP_USER:
case RESP_USER_GROUPLIST:
if (tag == LBER_ERROR) {
goto done;
}
/* Winbind is not consistent with the case of the returned user
* name. In general all names should be lower case but there are
* bug in some version of winbind which might lead to upper case
* letters in the name. To be on the safe side we explicitly
* lowercase the name. */
goto done;
}
if (is_v1) {
goto done;
}
}
if (tag == LBER_ERROR) {
goto done;
}
break;
case RESP_GROUP:
case RESP_GROUP_MEMBERS:
if (tag == LBER_ERROR) {
goto done;
}
/* Winbind is not consistent with the case of the returned user
* name. In general all names should be lower case but there are
* bug in some version of winbind which might lead to upper case
* letters in the name. To be on the safe side we explicitly
* lowercase the name. */
goto done;
}
if (is_v1) {
goto done;
}
}
if (tag == LBER_ERROR) {
goto done;
}
break;
case RESP_SID:
if (tag == LBER_ERROR) {
goto done;
}
goto done;
}
break;
case RESP_NAME:
if (tag == LBER_ERROR) {
goto done;
}
goto done;
}
break;
default:
type);
goto done;
}
goto done;
}
}
done:
*resp_attrs = attrs;
} else {
}
return ret;
}
struct ipa_s2n_get_groups_state {
struct tevent_context *ev;
struct sss_domain_info *dom;
struct sdap_handle *sh;
char **group_list;
int exop_timeout;
};
struct tevent_context *ev,
struct sss_domain_info *dom,
struct sdap_handle *sh,
int exop_timeout,
char **group_list)
{
int ret;
struct ipa_s2n_get_groups_state *state;
struct tevent_req *req;
return NULL;
}
goto done;
}
done:
}
return req;
}
{
int ret;
struct ipa_s2n_get_groups_state);
struct tevent_req *subreq;
struct sss_domain_info *obj_domain;
struct sss_domain_info *parent_domain;
char *group_name = NULL;
char *domain_name = NULL;
&domain_name, &group_name);
return ret;
}
if (obj_domain == NULL) {
return ENOMEM;
}
return ret;
}
return ENOMEM;
}
return EOK;
}
{
int ret;
struct tevent_req);
struct ipa_s2n_get_groups_state);
struct resp_attrs *attrs;
goto fail;
}
goto fail;
}
goto fail;
}
return;
}
goto fail;
}
return;
fail:
return;
}
{
return EOK;
}
struct ipa_s2n_get_user_state {
struct tevent_context *ev;
struct sdap_options *opts;
struct sss_domain_info *dom;
struct sdap_handle *sh;
int entry_type;
enum request_types request_type;
struct resp_attrs *attrs;
struct resp_attrs *simple_attrs;
int exop_timeout;
};
struct tevent_context *ev,
struct sdap_options *opts,
struct sss_domain_info *dom,
struct sdap_handle *sh,
int entry_type,
{
struct ipa_s2n_get_user_state *state;
struct tevent_req *req;
struct tevent_req *subreq;
bool is_v1 = false;
return NULL;
}
is_v1 = true;
is_v1 = false;
} else {
"cannot resolve objects from trusted domains.\n");
goto fail;
}
goto fail;
}
goto fail;
}
return req;
fail:
return req;
}
struct sysdb_attrs *group_attrs,
char **members)
{
int ret;
size_t c;
struct ldb_message *msg;
const char *dn_str;
struct sss_domain_info *obj_domain;
struct sss_domain_info *parent_domain;
return ENOMEM;
}
if (obj_domain == NULL) {
goto done;
}
&msg);
goto done;
}
goto done;
}
goto done;
}
} else {
goto done;
}
}
done:
return ret;
}
struct sss_domain_info *dom,
char ***_missing_groups)
{
int ret;
size_t c;
char **missing_groups = NULL;
struct sss_domain_info *obj_domain;
struct sss_domain_info *parent_domain;
return ENOMEM;
}
goto done;
}
for (c = 0; c < ngroups; c++) {
if (obj_domain == NULL) {
goto done;
}
&msg);
goto done;
}
n_dns++;
groups[c]);
goto done;
}
n_missing++;
} else {
goto done;
}
}
if (n_missing != 0) {
} else {
*_missing_groups = NULL;
}
if (n_dns != 0) {
} else {
}
done:
return ret;
}
{
struct tevent_req);
struct ipa_s2n_get_user_state);
int ret;
char **missing_groups = NULL;
goto done;
}
switch (state->request_type) {
case REQ_FULL_WITH_MEMBERS:
case REQ_FULL:
goto done;
}
"expected [%s] or [%s], got [%s].\n",
attrs->domain_name);
goto done;
}
goto done;
}
if (missing_groups != NULL) {
"ipa_s2n_get_groups_send failed.\n");
goto done;
}
req);
return;
}
}
/* We already know the SID, we do not have to read it. */
break;
}
&bv_req);
goto done;
}
goto done;
}
return;
case REQ_SIMPLE:
&state->simple_attrs);
goto done;
}
break;
default:
goto done;
}
goto done;
}
goto done;
}
done:
} else {
}
return;
}
struct resp_attrs *attrs,
struct resp_attrs *simple_attrs)
{
int ret;
struct sss_nss_homedir_ctx homedir_ctx;
char *name;
char *realm;
char *upn;
return ENOMEM;
}
goto done;
}
}
switch (attrs->response_type) {
case RESP_USER:
case RESP_USER_GROUPLIST:
if (dom->subdomain_homedir
&homedir_ctx);
goto done;
}
}
/* we always use the fully qualified name for subdomain users */
if (!name) {
goto done;
}
"sysdb_attrs_add_lc_name_alias failed.\n");
goto done;
}
/* We also have to store a fake UPN here, because otherwise the
* krb5 child later won't be able to properly construct one as
* the username is fully qualified but the child doesn't have
* access to the regex to deconstruct it */
/* FIXME: The real UPN is available from the PAC, we should get
* it from there. */
if (!realm) {
goto done;
}
if (!upn) {
goto done;
}
goto done;
}
"sysdb_attrs_add_string failed.\n");
goto done;
}
}
if (simple_attrs != NULL
simple_attrs->a.sid_str);
"sysdb_attrs_add_string failed.\n");
goto done;
}
}
gid = 0;
}
break;
case RESP_GROUP:
case RESP_GROUP_MEMBERS:
/* we always use the fully qualified name for subdomain users */
if (!name) {
goto done;
}
"sysdb_attrs_add_lc_name_alias failed.\n");
goto done;
}
"sysdb_attrs_add_string failed.\n");
goto done;
}
}
if (simple_attrs != NULL
simple_attrs->a.sid_str);
"sysdb_attrs_add_string failed.\n");
goto done;
}
}
goto done;
}
break;
default:
goto done;
}
done:
return ret;
}
{
int ret;
struct tevent_req);
struct ipa_s2n_get_user_state);
return;
}
return;
}
return;
}
{
return EOK;
}