89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek/*
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek SSSD
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek IPA Subdomains Module - utilities
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek Authors:
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek Sumit Bose <sbose@redhat.com>
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek Copyright (C) 2015 Red Hat
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek This program is free software; you can redistribute it and/or modify
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek it under the terms of the GNU General Public License as published by
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek the Free Software Foundation; either version 3 of the License, or
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek (at your option) any later version.
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek This program is distributed in the hope that it will be useful,
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek but WITHOUT ANY WARRANTY; without even the implied warranty of
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek GNU General Public License for more details.
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek You should have received a copy of the GNU General Public License
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek along with this program. If not, see <http://www.gnu.org/licenses/>.
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek*/
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek#include "providers/ipa/ipa_subdomains.h"
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek#include "providers/ipa/ipa_common.h"
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek#include "providers/ipa/ipa_id.h"
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozekstruct ldb_dn *ipa_subdom_ldb_dn(TALLOC_CTX *mem_ctx,
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek struct ldb_context *ldb_ctx,
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek struct sysdb_attrs *attrs)
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek{
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek int ret;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek const char *orig_dn;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek struct ldb_dn *dn = NULL;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek if (attrs == NULL || ldb_ctx == NULL) {
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek return NULL;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek }
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek ret = sysdb_attrs_get_string(attrs, SYSDB_ORIG_DN, &orig_dn);
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek if (ret) {
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_string failed: %d\n", ret);
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek return NULL;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek }
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek dn = ldb_dn_new(mem_ctx, ldb_ctx, orig_dn);
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek if (dn == NULL) {
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "ldb_dn_new failed.\n");
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek return NULL;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek }
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek if (!ldb_dn_validate(dn)) {
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek DEBUG(SSSDBG_OP_FAILURE, "Original DN [%s] is not a valid DN.\n",
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek orig_dn);
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek talloc_free(dn);
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek return NULL;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek }
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek return dn;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek}
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozekbool ipa_subdom_is_member_dom(struct ldb_dn *dn)
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek{
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek const struct ldb_val *val;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek if (dn == NULL) {
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek DEBUG(SSSDBG_CRIT_FAILURE, "Wrong input!\n");
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek return false;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek }
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek if (ldb_dn_get_comp_num(dn) < 5) {
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek /* We are only interested in the member domain objects. In IPA the
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek * forest root object is stored as e.g.
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek * cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com. Member domains in the
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek * forest are children of the forest root object e.g.
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek * cn=SUB.AD.DOM,cn=AD.DOM,cn=ad,cn=trusts,dc=example,dc=com. Since
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek * the forest name is not stored in the member objects we derive it
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek * from the RDN of the forest root object. */
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC,
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek "DN too short, not a member domain\n");
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek return false;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek }
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek val = ldb_dn_get_component_val(dn, 3);
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek if (strncasecmp("trusts", (const char *) val->data, val->length) != 0) {
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC,
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek "4th component is not 'trust', not a member domain\n");
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek return false;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek }
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek val = ldb_dn_get_component_val(dn, 2);
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek if (strncasecmp("ad", (const char *) val->data, val->length) != 0) {
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek DEBUG(SSSDBG_TRACE_FUNC,
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek "3rd component is not 'ad', not a member domain\n");
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek return false;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek }
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek return true;
89ddc9ed474e9ac2b1e7bccb0a58610babf26cf8Jakub Hrozek}