ldap_common.c revision 42165bd9ada160e68ab0dbdeb21ed397486aa830
02c335c23bf5fa225a467c19f2c063fb0dc7b8c3Timo Sirainen/*
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen SSSD
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen LDAP Provider Common Functions
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen Authors:
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen Simo Sorce <ssorce@redhat.com>
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen Copyright (C) 2008-2010 Red Hat
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen This program is free software; you can redistribute it and/or modify
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen it under the terms of the GNU General Public License as published by
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen the Free Software Foundation; either version 3 of the License, or
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen (at your option) any later version.
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen This program is distributed in the hope that it will be useful,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen but WITHOUT ANY WARRANTY; without even the implied warranty of
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen GNU General Public License for more details.
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen You should have received a copy of the GNU General Public License
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen along with this program. If not, see <http://www.gnu.org/licenses/>.
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen*/
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen#include "providers/ldap/ldap_common.h"
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen#include "providers/fail_over.h"
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen#include "providers/ldap/sdap_async_private.h"
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen#include "providers/krb5/krb5_common.h"
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen#include "util/sss_krb5.h"
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
f6a21dbf70e816c33bfb1ce91728d06bd7d5758fTimo Sirainen/* a fd the child process would log into */
f6a21dbf70e816c33bfb1ce91728d06bd7d5758fTimo Sirainenint ldap_child_debug_fd = -1;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainenstruct dp_option default_basic_opts[] = {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_default_bind_dn", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_default_authtok_type", DP_OPT_STRING, NULL_STRING, NULL_STRING},
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_default_authtok", DP_OPT_BLOB, NULL_BLOB, NULL_BLOB },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_search_timeout", DP_OPT_NUMBER, { .number = 60 }, NULL_NUMBER },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_network_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_opt_timeout", DP_OPT_NUMBER, { .number = 6 }, NULL_NUMBER },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_tls_reqcert", DP_OPT_STRING, { "hard" }, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_search_scope", DP_OPT_STRING, { "sub" }, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_search_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_schema", DP_OPT_STRING, { "rfc2307" }, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_offline_timeout", DP_OPT_NUMBER, { .number = 60 }, NULL_NUMBER },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_force_upper_case_realm", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_enumeration_refresh_timeout", DP_OPT_NUMBER, { .number = 300 }, NULL_NUMBER },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_purge_cache_timeout", DP_OPT_NUMBER, { .number = 10800 }, NULL_NUMBER },
573424407a2d3c1453638a643583a7cf10c129e1Phil Carmody { "entry_cache_timeout", DP_OPT_NUMBER, { .number = 5400 }, NULL_NUMBER },
573424407a2d3c1453638a643583a7cf10c129e1Phil Carmody { "ldap_tls_cacert", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_tls_cacertdir", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_id_use_start_tls", DP_OPT_BOOL, BOOL_FALSE, BOOL_FALSE },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_sasl_mech", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_sasl_authid", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_krb5_keytab", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_krb5_init_creds", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen /* use the same parm name as the krb5 module so we set it only once */
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "krb5_server", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "krb5_realm", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_pwd_policy", DP_OPT_STRING, { "none" }, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_referrals", DP_OPT_BOOL, BOOL_TRUE, BOOL_TRUE },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "account_cache_expiration", DP_OPT_NUMBER, { .number = 0 }, NULL_NUMBER },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_dns_service_name", DP_OPT_STRING, { SSS_LDAP_SRV_NAME }, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_krb5_ticket_lifetime", DP_OPT_NUMBER, { .number = (24 * 60 * 60) }, NULL_NUMBER },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_access_filter", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_netgroup_search_base", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_nesting_level", DP_OPT_NUMBER, { .number = 2 }, NULL_NUMBER },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_deref", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_account_expire_policy", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_access_order", DP_OPT_STRING, { "filter" }, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_chpass_uri", DP_OPT_STRING, NULL_STRING, NULL_STRING },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_chpass_dns_service_name", DP_OPT_STRING, NULL_STRING, NULL_STRING }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen};
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainenstruct sdap_attr_map generic_attr_map[] = {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_entry_usn", NULL, SYSDB_USN, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_rootdse_last_usn", NULL, SYSDB_HIGH_USN, NULL }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen};
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainenstruct sdap_attr_map gen_ipa_attr_map[] = {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_entry_usn", SDAP_IPA_USN, SYSDB_USN, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_rootdse_last_usn", SDAP_IPA_LAST_USN, SYSDB_HIGH_USN, NULL }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen};
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainenstruct sdap_attr_map gen_ad_attr_map[] = {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_entry_usn", SDAP_AD_USN, SYSDB_USN, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_rootdse_last_usn", SDAP_AD_LAST_USN, SYSDB_HIGH_USN, NULL }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen};
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainenstruct sdap_attr_map rfc2307_user_map[] = {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_object_class", "posixAccount", SYSDB_USER_CLASS, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_name", "uid", SYSDB_NAME, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_pwd", "userPassword", SYSDB_PWD, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_uid_number", "uidNumber", SYSDB_UIDNUM, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
d868a04630bd7bfe9c1543a7c3f68703b3e276e4Timo Sirainen { "ldap_user_gecos", "gecos", SYSDB_GECOS, NULL },
d868a04630bd7bfe9c1543a7c3f68703b3e276e4Timo Sirainen { "ldap_user_home_directory", "homeDirectory", SYSDB_HOMEDIR, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shell", "loginShell", SYSDB_SHELL, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_principal", "krbPrincipalName", SYSDB_UPN, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
131b0d222ad89b2c5d2b03b865b45cae9e290d68Timo Sirainen { "ldap_user_member_of", NULL, SYSDB_MEMBEROF, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_uuid", NULL, SYSDB_UUID, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_entry_usn", NULL, SYSDB_USN, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_last_change", "shadowLastChange", SYSDB_SHADOWPW_LASTCHANGE, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_min", "shadowMin", SYSDB_SHADOWPW_MIN, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_max", "shadowMax", SYSDB_SHADOWPW_MAX, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_warning", "shadowWarning", SYSDB_SHADOWPW_WARNING, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_inactive", "shadowInactive", SYSDB_SHADOWPW_INACTIVE, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_expire", "shadowExpire", SYSDB_SHADOWPW_EXPIRE, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_flag", "shadowFlag", SYSDB_SHADOWPW_FLAG, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_krb_last_pwd_change", "krbLastPwdChange", SYSDB_KRBPW_LASTCHANGE, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_krb_password_expiration", "krbPasswordExpiration", SYSDB_KRBPW_EXPIRATION, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_pwd_attribute", "pwdAttribute", SYSDB_PWD_ATTRIBUTE, NULL }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen};
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainenstruct sdap_attr_map rfc2307_group_map[] = {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_object_class", "posixGroup", SYSDB_GROUP_CLASS, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_name", "cn", SYSDB_NAME, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_pwd", "userPassword", SYSDB_PWD, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_member", "memberuid", SYSDB_MEMBER, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_uuid", NULL, SYSDB_UUID, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL }
9184983183ae28fb543695c54c85bc5396c07e42Phil Carmody};
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainenstruct sdap_attr_map rfc2307bis_user_map[] = {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_object_class", "posixAccount", SYSDB_USER_CLASS, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_name", "uid", SYSDB_NAME, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_pwd", "userPassword", SYSDB_PWD, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_uid_number", "uidNumber", SYSDB_UIDNUM, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_gecos", "gecos", SYSDB_GECOS, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_home_directory", "homeDirectory", SYSDB_HOMEDIR, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shell", "loginShell", SYSDB_SHELL, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_principal", "krbPrincipalName", SYSDB_UPN, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_member_of", "memberOf", SYSDB_MEMBEROF, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen /* FIXME: this is 389ds specific */
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_uuid", "nsUniqueId", SYSDB_UUID, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_entry_usn", NULL, SYSDB_USN, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_last_change", "shadowLastChange", SYSDB_SHADOWPW_LASTCHANGE, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_min", "shadowMin", SYSDB_SHADOWPW_MIN, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_max", "shadowMax", SYSDB_SHADOWPW_MAX, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_warning", "shadowWarning", SYSDB_SHADOWPW_WARNING, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_inactive", "shadowInactive", SYSDB_SHADOWPW_INACTIVE, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_expire", "shadowExpire", SYSDB_SHADOWPW_EXPIRE, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_shadow_flag", "shadowFlag", SYSDB_SHADOWPW_FLAG, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_krb_last_pwd_change", "krbLastPwdChange", SYSDB_KRBPW_LASTCHANGE, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_user_krb_password_expiration", "krbPasswordExpiration", SYSDB_KRBPW_EXPIRATION, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_pwd_attribute", "pwdAttribute", SYSDB_PWD_ATTRIBUTE, NULL }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen};
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainenstruct sdap_attr_map rfc2307bis_group_map[] = {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_object_class", "posixGroup", SYSDB_GROUP_CLASS, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_name", "cn", SYSDB_NAME, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_pwd", "userPassword", SYSDB_PWD, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen /* FIXME: this is 389ds specific */
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_uuid", "nsUniqueId", SYSDB_UUID, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen};
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainenstruct sdap_attr_map netgroup_map[] = {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_netgroup_object_class", "nisNetgroup", SYSDB_NETGROUP_CLASS, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_netgroup_name", "cn", SYSDB_NAME, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_netgroup_member", "memberNisNetgroup", SYSDB_ORIG_NETGROUP_MEMBER, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_netgroup_triple", "nisNetgroupTriple", SYSDB_NETGROUP_TRIPLE, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen /* FIXME: this is 389ds specific */
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_netgroup_uuid", "nsUniqueId", SYSDB_UUID, NULL },
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen { "ldap_netgroup_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen};
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainenint ldap_get_options(TALLOC_CTX *memctx,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen struct confdb_ctx *cdb,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen const char *conf_path,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen struct sdap_options **_opts)
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen{
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen struct sdap_attr_map *default_attr_map;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen struct sdap_attr_map *default_user_map;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen struct sdap_attr_map *default_group_map;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen struct sdap_attr_map *default_netgroup_map;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen struct sdap_options *opts;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen char *schema;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen const char *search_base;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen const char *pwd_policy;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen int ret;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen int account_cache_expiration;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen int offline_credentials_expiration;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen const char *ldap_deref;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen int ldap_deref_val;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen int o;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen const int search_base_options[] = { SDAP_USER_SEARCH_BASE,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen SDAP_GROUP_SEARCH_BASE,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen SDAP_NETGROUP_SEARCH_BASE,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen -1 };
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen opts = talloc_zero(memctx, struct sdap_options);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (!opts) return ENOMEM;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen ret = dp_get_options(opts, cdb, conf_path,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen default_basic_opts,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen SDAP_OPTS_BASIC,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen &opts->basic);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (ret != EOK) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen goto done;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen search_base = dp_opt_get_string(opts->basic, SDAP_SEARCH_BASE);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (search_base != NULL) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen /* set user/group/netgroup search bases if they are not */
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen for (o = 0; search_base_options[o] != -1; o++) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (NULL == dp_opt_get_string(opts->basic, search_base_options[o])) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen ret = dp_opt_set_string(opts->basic, search_base_options[o],
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen search_base);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (ret != EOK) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen goto done;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen DEBUG(6, ("Option %s set to %s\n",
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen opts->basic[search_base_options[o]].opt_name,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen dp_opt_get_string(opts->basic,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen search_base_options[o])));
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen } else {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen DEBUG(5, ("Search base not set, trying to discover it later when "
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen "connecting to the LDAP server.\n"));
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen pwd_policy = dp_opt_get_string(opts->basic, SDAP_PWD_POLICY);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (pwd_policy == NULL) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen DEBUG(1, ("Missing password policy, this may not happen.\n"));
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen ret = EINVAL;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen goto done;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (strcasecmp(pwd_policy, PWD_POL_OPT_NONE) != 0 &&
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen strcasecmp(pwd_policy, PWD_POL_OPT_SHADOW) != 0 &&
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen strcasecmp(pwd_policy, PWD_POL_OPT_MIT) != 0) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen DEBUG(1, ("Unsupported password policy [%s].\n", pwd_policy));
2c0f1cb7a0564d48ec43c7315ea46ea38d2abd19Timo Sirainen ret = EINVAL;
2c0f1cb7a0564d48ec43c7315ea46ea38d2abd19Timo Sirainen goto done;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
2c0f1cb7a0564d48ec43c7315ea46ea38d2abd19Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen /* account_cache_expiration must be >= than offline_credentials_expiration */
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen ret = confdb_get_int(cdb, memctx, CONFDB_PAM_CONF_ENTRY,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen CONFDB_PAM_CRED_TIMEOUT, 0,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen &offline_credentials_expiration);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (ret != EOK) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen DEBUG(1, ("Cannot get value of %s from confdb \n",
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen CONFDB_PAM_CRED_TIMEOUT));
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen goto done;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen account_cache_expiration = dp_opt_get_int(opts->basic,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen SDAP_ACCOUNT_CACHE_EXPIRATION);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen /* account cache_expiration must not be smaller than
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen * offline_credentials_expiration to prevent deleting entries that
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen * still contain credentials valid for offline login.
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen *
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen * offline_credentials_expiration == 0 is a special case that says
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen * that the cached credentials are valid forever. Therefore, the cached
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen * entries must not be purged from cache.
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen */
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (!offline_credentials_expiration && account_cache_expiration) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen DEBUG(1, ("Conflicting values for options %s (unlimited) "
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen "and %s (%d)\n",
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen opts->basic[SDAP_ACCOUNT_CACHE_EXPIRATION].opt_name,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen CONFDB_PAM_CRED_TIMEOUT,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen offline_credentials_expiration));
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen ret = EINVAL;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen goto done;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (offline_credentials_expiration && account_cache_expiration &&
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen offline_credentials_expiration > account_cache_expiration) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen DEBUG(1, ("Value of %s (now %d) must be larger "
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen "than value of %s (now %d)\n",
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen opts->basic[SDAP_ACCOUNT_CACHE_EXPIRATION].opt_name,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen account_cache_expiration,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen CONFDB_PAM_CRED_TIMEOUT,
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen offline_credentials_expiration));
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen ret = EINVAL;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen goto done;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen ldap_deref = dp_opt_get_string(opts->basic, SDAP_DEREF);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (ldap_deref != NULL) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen ret = deref_string_to_val(ldap_deref, &ldap_deref_val);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (ret != EOK) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen DEBUG(1, ("Failed to verify ldap_deref option.\n"));
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen goto done;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen#ifndef HAVE_LDAP_CONNCB
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen bool ldap_referrals;
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen ldap_referrals = dp_opt_get_bool(opts->basic, SDAP_REFERRALS);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (ldap_referrals) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen DEBUG(1, ("LDAP referrals are not supported, because the LDAP library "
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen "is too old, see sssd-ldap(5) for details.\n"));
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen ret = dp_opt_set_bool(opts->basic, SDAP_REFERRALS, false);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen }
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen#endif
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen /* schema type */
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen schema = dp_opt_get_string(opts->basic, SDAP_SCHEMA);
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen if (strcasecmp(schema, "rfc2307") == 0) {
a49d1c2ca3c134c0c62b37a94936c78e9849e044Timo Sirainen opts->schema_type = SDAP_SCHEMA_RFC2307;
default_attr_map = generic_attr_map;
default_user_map = rfc2307_user_map;
default_group_map = rfc2307_group_map;
default_netgroup_map = netgroup_map;
} else
if (strcasecmp(schema, "rfc2307bis") == 0) {
opts->schema_type = SDAP_SCHEMA_RFC2307BIS;
default_attr_map = generic_attr_map;
default_user_map = rfc2307bis_user_map;
default_group_map = rfc2307bis_group_map;
default_netgroup_map = netgroup_map;
} else
if (strcasecmp(schema, "IPA") == 0) {
opts->schema_type = SDAP_SCHEMA_IPA_V1;
default_attr_map = gen_ipa_attr_map;
default_user_map = rfc2307bis_user_map;
default_group_map = rfc2307bis_group_map;
default_netgroup_map = netgroup_map;
} else
if (strcasecmp(schema, "AD") == 0) {
opts->schema_type = SDAP_SCHEMA_AD;
default_attr_map = gen_ad_attr_map;
default_user_map = rfc2307bis_user_map;
default_group_map = rfc2307bis_group_map;
default_netgroup_map = netgroup_map;
} else {
DEBUG(0, ("Unrecognized schema type: %s\n", schema));
ret = EINVAL;
goto done;
}
ret = sdap_get_map(opts, cdb, conf_path,
default_attr_map,
SDAP_AT_GENERAL,
&opts->gen_map);
if (ret != EOK) {
goto done;
}
ret = sdap_get_map(opts, cdb, conf_path,
default_user_map,
SDAP_OPTS_USER,
&opts->user_map);
if (ret != EOK) {
goto done;
}
ret = sdap_get_map(opts, cdb, conf_path,
default_group_map,
SDAP_OPTS_GROUP,
&opts->group_map);
if (ret != EOK) {
goto done;
}
ret = sdap_get_map(opts, cdb, conf_path,
default_netgroup_map,
SDAP_OPTS_NETGROUP,
&opts->netgroup_map);
if (ret != EOK) {
goto done;
}
/* If there is no KDC, try the deprecated krb5_kdcip option, too */
/* FIXME - this can be removed in a future version */
ret = krb5_try_kdcip(memctx, cdb, conf_path, opts->basic, SDAP_KRB5_KDC);
if (ret != EOK) {
DEBUG(1, ("sss_krb5_try_kdcip failed.\n"));
goto done;
}
ret = EOK;
*_opts = opts;
done:
if (ret != EOK) {
talloc_zfree(opts);
}
return ret;
}
void sdap_handler_done(struct be_req *req, int dp_err,
int error, const char *errstr)
{
return req->fn(req, dp_err, error, errstr);
}
void sdap_mark_offline(struct sdap_id_ctx *ctx)
{
be_mark_offline(ctx->be);
}
int sdap_id_setup_tasks(struct sdap_id_ctx *ctx)
{
struct timeval tv;
int ret = EOK;
int delay;
/* set up enumeration task */
if (ctx->be->domain->enumerate) {
/* run the first one in a couple of seconds so that we have time to
* finish initializations first*/
tv = tevent_timeval_current_ofs(10, 0);
ret = ldap_id_enumerate_set_timer(ctx, tv);
} else {
/* the enumeration task, runs the cleanup process by itself,
* but if enumeration is not running we need to schedule it */
delay = dp_opt_get_int(ctx->opts->basic, SDAP_CACHE_PURGE_TIMEOUT);
if (delay == 0) {
/* Cleanup has been explicitly disabled, so we won't
* schedule any cleanup tasks.
*/
return EOK;
}
/* run the first one in a couple of seconds so that we have time to
* finish initializations first*/
tv = tevent_timeval_current_ofs(10, 0);
ret = ldap_id_cleanup_set_timer(ctx, tv);
}
return ret;
}
static void sdap_uri_callback(void *private_data, struct fo_server *server)
{
struct sdap_service *service;
const char *tmp;
char *new_uri;
service = talloc_get_type(private_data, struct sdap_service);
if (!service) return;
tmp = (const char *)fo_get_server_user_data(server);
if (fo_is_srv_lookup(server)) {
if (!tmp) {
DEBUG(1, ("Unknown service, using ldap\n"));
tmp = SSS_LDAP_SRV_NAME;
}
new_uri = talloc_asprintf(service, "%s://%s:%d",
tmp,
fo_get_server_name(server),
fo_get_server_port(server));
} else {
if (tmp && ldap_is_ldap_url(tmp)) {
new_uri = talloc_strdup(service, tmp);
} else {
new_uri = talloc_asprintf(service, "ldap://%s",
fo_get_server_name(server));
}
}
if (!new_uri) {
DEBUG(2, ("Failed to copy URI ...\n"));
return;
}
DEBUG(6, ("Constructed uri '%s'\n", new_uri));
/* free old one and replace with new one */
talloc_zfree(service->uri);
service->uri = new_uri;
}
static void sdap_finalize(struct tevent_context *ev,
struct tevent_signal *se,
int signum,
int count,
void *siginfo,
void *private_data)
{
char *realm = (char *) private_data;
int ret;
ret = remove_krb5_info_files(se, realm);
if (ret != EOK) {
DEBUG(1, ("remove_krb5_info_files failed.\n"));
}
sig_term(signum);
}
errno_t sdap_install_sigterm_handler(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
const char *realm)
{
char *sig_realm;
struct tevent_signal *sige;
BlockSignals(false, SIGTERM);
sig_realm = talloc_strdup(mem_ctx, realm);
if (sig_realm == NULL) {
DEBUG(1, ("talloc_strdup failed!\n"));
return ENOMEM;
}
sige = tevent_add_signal(ev, mem_ctx, SIGTERM, SA_SIGINFO, sdap_finalize,
sig_realm);
if (sige == NULL) {
DEBUG(1, ("tevent_add_signal failed.\n"));
talloc_free(sig_realm);
return ENOMEM;
}
talloc_steal(sige, sig_realm);
return EOK;
}
void sdap_remove_kdcinfo_files_callback(void *pvt)
{
int ret;
TALLOC_CTX *tmp_ctx = NULL;
struct remove_info_files_ctx *ctx = talloc_get_type(pvt,
struct remove_info_files_ctx);
ret = be_fo_run_callbacks_at_next_request(ctx->be_ctx,
ctx->kdc_service_name);
if (ret != EOK) {
DEBUG(1, ("be_fo_run_callbacks_at_next_request failed, "
"krb5 info files will not be removed, because "
"it is unclear if they will be recreated properly.\n"));
return;
}
tmp_ctx = talloc_new(NULL);
if (tmp_ctx == NULL) {
DEBUG(1, ("talloc_new failed, cannot remove krb5 info files.\n"));
return;
}
ret = remove_krb5_info_files(tmp_ctx, ctx->realm);
if (ret != EOK) {
DEBUG(1, ("remove_krb5_info_files failed.\n"));
}
talloc_zfree(tmp_ctx);
}
errno_t sdap_install_offline_callback(TALLOC_CTX *mem_ctx,
struct be_ctx *be_ctx,
const char *realm,
const char *service_name)
{
int ret;
struct remove_info_files_ctx *ctx;
ctx = talloc_zero(mem_ctx, struct remove_info_files_ctx);
if (ctx == NULL) {
DEBUG(1, ("talloc_zfree failed.\n"));
return ENOMEM;
}
ctx->be_ctx = be_ctx;
ctx->realm = talloc_strdup(ctx, realm);
ctx->kdc_service_name = talloc_strdup(ctx, service_name);
if (ctx->realm == NULL || ctx->kdc_service_name == NULL) {
DEBUG(1, ("talloc_strdup failed!\n"));
ret = ENOMEM;
goto done;
}
ret = be_add_offline_cb(ctx, be_ctx,
sdap_remove_kdcinfo_files_callback,
ctx, NULL);
if (ret != EOK) {
DEBUG(1, ("be_add_offline_cb failed.\n"));
goto done;
}
ret = EOK;
done:
if (ret != EOK) {
talloc_zfree(ctx);
}
return ret;
}
int sdap_gssapi_init(TALLOC_CTX *mem_ctx,
struct dp_option *opts,
struct be_ctx *bectx,
struct sdap_service *sdap_service,
struct krb5_service **krb5_service)
{
int ret;
const char *krb5_servers;
const char *krb5_realm;
struct krb5_service *service = NULL;
krb5_servers = dp_opt_get_string(opts, SDAP_KRB5_KDC);
if (krb5_servers == NULL) {
DEBUG(1, ("Missing krb5_server option, using service discovery!\n"));
}
krb5_realm = dp_opt_get_string(opts, SDAP_KRB5_REALM);
if (krb5_realm == NULL) {
DEBUG(0, ("Missing krb5_realm option, will use libkrb default\n"));
}
ret = krb5_service_init(mem_ctx, bectx, SSS_KRB5KDC_FO_SRV, krb5_servers,
krb5_realm, &service);
if (ret != EOK) {
DEBUG(0, ("Failed to init KRB5 failover service!\n"));
goto done;
}
ret = sdap_install_sigterm_handler(mem_ctx, bectx->ev, krb5_realm);
if (ret != EOK) {
DEBUG(0, ("Failed to install sigterm handler\n"));
goto done;
}
ret = sdap_install_offline_callback(mem_ctx, bectx,
krb5_realm, SSS_KRB5KDC_FO_SRV);
if (ret != EOK) {
DEBUG(0, ("Failed to install sigterm handler\n"));
goto done;
}
sdap_service->kinit_service_name = talloc_strdup(sdap_service,
service->name);
if (sdap_service->kinit_service_name == NULL) {
ret = ENOMEM;
goto done;
}
ret = EOK;
*krb5_service = service;
done:
if (ret != EOK) talloc_free(service);
return ret;
}
int sdap_service_init(TALLOC_CTX *memctx, struct be_ctx *ctx,
const char *service_name, const char *dns_service_name,
const char *urls, struct sdap_service **_service)
{
TALLOC_CTX *tmp_ctx;
struct sdap_service *service;
LDAPURLDesc *lud;
char **list = NULL;
char *srv_user_data;
int ret;
int i;
tmp_ctx = talloc_new(memctx);
if (!tmp_ctx) {
return ENOMEM;
}
service = talloc_zero(tmp_ctx, struct sdap_service);
if (!service) {
ret = ENOMEM;
goto done;
}
ret = be_fo_add_service(ctx, service_name);
if (ret != EOK) {
DEBUG(1, ("Failed to create failover service!\n"));
goto done;
}
service->name = talloc_strdup(service, service_name);
if (!service->name) {
ret = ENOMEM;
goto done;
}
if (!urls) {
urls = BE_SRV_IDENTIFIER;
}
/* split server parm into a list */
ret = split_on_separator(tmp_ctx, urls, ',', true, &list, NULL);
if (ret != EOK) {
DEBUG(1, ("Failed to parse server list!\n"));
goto done;
}
/* now for each URI add a new server to the failover service */
for (i = 0; list[i]; i++) {
if (be_fo_is_srv_identifier(list[i])) {
if (!dns_service_name) {
DEBUG(0, ("Missing DNS service name for service [%s].\n",
service_name));
ret = EINVAL;
goto done;
}
srv_user_data = talloc_strdup(service, dns_service_name);
if (!srv_user_data) {
ret = ENOMEM;
goto done;
}
ret = be_fo_add_srv_server(ctx, service_name, dns_service_name,
BE_FO_PROTO_TCP, false, srv_user_data);
if (ret) {
DEBUG(0, ("Failed to add server\n"));
goto done;
}
DEBUG(6, ("Added service lookup\n"));
continue;
}
ret = ldap_url_parse(list[i], &lud);
if (ret != LDAP_SUCCESS) {
DEBUG(0, ("Failed to parse ldap URI (%s)!\n", list[i]));
ret = EINVAL;
goto done;
}
DEBUG(6, ("Added URI %s\n", list[i]));
talloc_steal(service, list[i]);
ret = be_fo_add_server(ctx, service->name,
lud->lud_host, lud->lud_port, list[i]);
if (ret) {
goto done;
}
ldap_free_urldesc(lud);
}
ret = be_fo_service_add_callback(memctx, ctx, service->name,
sdap_uri_callback, service);
if (ret != EOK) {
DEBUG(1, ("Failed to add failover callback!\n"));
goto done;
}
ret = EOK;
done:
if (ret == EOK) {
*_service = talloc_steal(memctx, service);
}
talloc_zfree(tmp_ctx);
return ret;
}
errno_t string_to_shadowpw_days(const char *s, long *d)
{
long l;
char *endptr;
if (s == NULL || *s == '\0') {
*d = -1;
return EOK;
}
errno = 0;
l = strtol(s, &endptr, 10);
if (errno != 0) {
DEBUG(1, ("strtol failed [%d][%s].\n", errno, strerror(errno)));
return errno;
}
if (*endptr != '\0') {
DEBUG(1, ("Input string [%s] is invalid.\n", s));
return EINVAL;
}
if (l < 0) {
DEBUG(1, ("Input string contains not allowed negative value [%d].\n",
l));
return EINVAL;
}
*d = l;
return EOK;
}