providers/ldap/ldap_options.c

ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina/*
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    Authors:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        Simo Sorce <ssorce@redhat.com>
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    Copyright (C) 2008-2010 Red Hat
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    This program is free software; you can redistribute it and/or modify
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    it under the terms of the GNU General Public License as published by
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    the Free Software Foundation; either version 3 of the License, or
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    (at your option) any later version.
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    This program is distributed in the hope that it will be useful,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    but WITHOUT ANY WARRANTY; without even the implied warranty of
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    GNU General Public License for more details.
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    You should have received a copy of the GNU General Public License
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    along with this program.  If not, see <http://www.gnu.org/licenses/>.
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina*/
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina#include "providers/ldap/ldap_common.h"
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina#include "providers/ldap/ldap_opts.h"
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina#include "providers/ldap/sdap_async_private.h"
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina#include "util/crypto/sss_crypto.h"
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březinaint ldap_get_options(TALLOC_CTX *memctx,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                     struct sss_domain_info *dom,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                     struct confdb_ctx *cdb,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                     const char *conf_path,
d2633d922eeed68f92be4248b9172b928c189920Jakub Hrozek                     struct data_provider *dp,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                     struct sdap_options **_opts)
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina{
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct sdap_attr_map *default_attr_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct sdap_attr_map *default_user_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct sdap_attr_map *default_group_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct sdap_attr_map *default_netgroup_map;
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev    struct sdap_attr_map *default_host_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct sdap_attr_map *default_service_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct sdap_options *opts;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    char *schema;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    const char *search_base;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    const char *pwd_policy;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    int ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    int account_cache_expiration;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    int offline_credentials_expiration;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    const char *ldap_deref;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    int ldap_deref_val;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    int o;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    const char *authtok_type;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct dp_opt_blob authtok_blob;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    char *cleartext;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    const int search_base_options[] = { SDAP_USER_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                        SDAP_GROUP_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                        SDAP_NETGROUP_SEARCH_BASE,
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev                                        SDAP_HOST_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                        SDAP_SERVICE_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                        -1 };
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    opts = talloc_zero(memctx, struct sdap_options);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (!opts) return ENOMEM;
d2633d922eeed68f92be4248b9172b928c189920Jakub Hrozek    opts->dp = dp;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_domain_add(opts, dom, NULL);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = dp_get_options(opts, cdb, conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                         default_basic_opts,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                         SDAP_OPTS_BASIC,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                         &opts->basic);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* Handle search bases */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    search_base = dp_opt_get_string(opts->basic, SDAP_SEARCH_BASE);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (search_base != NULL) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        /* set user/group/netgroup search bases if they are not */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        for (o = 0; search_base_options[o] != -1; o++) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            if (NULL == dp_opt_get_string(opts->basic, search_base_options[o])) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                ret = dp_opt_set_string(opts->basic, search_base_options[o],
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                        search_base);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                DEBUG(SSSDBG_TRACE_FUNC, "Option %s set to %s\n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                          opts->basic[search_base_options[o]].opt_name,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                          dp_opt_get_string(opts->basic,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                            search_base_options[o]));
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    } else {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_FUNC_DATA,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "Search base not set, trying to discover it later when "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  "connecting to the LDAP server.\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* Default search */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_parse_search_base(opts, opts->basic,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 SDAP_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 &opts->sdom->search_bases);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK && ret != ENOENT) goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* User search */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_parse_search_base(opts, opts->basic,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 SDAP_USER_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 &opts->sdom->user_search_bases);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK && ret != ENOENT) goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* Group search base */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_parse_search_base(opts, opts->basic,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 SDAP_GROUP_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 &opts->sdom->group_search_bases);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK && ret != ENOENT) goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* Netgroup search */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_parse_search_base(opts, opts->basic,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 SDAP_NETGROUP_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 &opts->sdom->netgroup_search_bases);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK && ret != ENOENT) goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev    /* Netgroup search */
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev    ret = sdap_parse_search_base(opts, opts->basic,
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev                                 SDAP_HOST_SEARCH_BASE,
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev                                 &opts->sdom->host_search_bases);
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev    if (ret != EOK && ret != ENOENT) goto done;
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* Service search */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_parse_search_base(opts, opts->basic,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 SDAP_SERVICE_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 &opts->sdom->service_search_bases);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK && ret != ENOENT) goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    pwd_policy = dp_opt_get_string(opts->basic, SDAP_PWD_POLICY);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (pwd_policy == NULL) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "Missing password policy, this may not happen.\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (strcasecmp(pwd_policy, PWD_POL_OPT_NONE) != 0 &&
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        strcasecmp(pwd_policy, PWD_POL_OPT_SHADOW) != 0 &&
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        strcasecmp(pwd_policy, PWD_POL_OPT_MIT) != 0) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "Unsupported password policy [%s].\n", pwd_policy);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* account_cache_expiration must be >= than offline_credentials_expiration */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = confdb_get_int(cdb, CONFDB_PAM_CONF_ENTRY,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                         CONFDB_PAM_CRED_TIMEOUT, 0,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                         &offline_credentials_expiration);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot get value of %s from confdb \n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  CONFDB_PAM_CRED_TIMEOUT);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    account_cache_expiration = dp_opt_get_int(opts->basic,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                              SDAP_ACCOUNT_CACHE_EXPIRATION);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* account cache_expiration must not be smaller than
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     * offline_credentials_expiration to prevent deleting entries that
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     * still contain credentials valid for offline login.
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     *
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     * offline_credentials_expiration == 0 is a special case that says
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     * that the cached credentials are valid forever. Therefore, the cached
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     * entries must not be purged from cache.
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (!offline_credentials_expiration && account_cache_expiration) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "Conflicting values for options %s (unlimited) "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  "and %s (%d)\n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  opts->basic[SDAP_ACCOUNT_CACHE_EXPIRATION].opt_name,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  CONFDB_PAM_CRED_TIMEOUT,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  offline_credentials_expiration);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (offline_credentials_expiration && account_cache_expiration &&
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        offline_credentials_expiration > account_cache_expiration) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, "Value of %s (now %d) must be larger "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  "than value of %s (now %d)\n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  opts->basic[SDAP_ACCOUNT_CACHE_EXPIRATION].opt_name,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  account_cache_expiration,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  CONFDB_PAM_CRED_TIMEOUT,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  offline_credentials_expiration);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ldap_deref = dp_opt_get_string(opts->basic, SDAP_DEREF);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ldap_deref != NULL) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = deref_string_to_val(ldap_deref, &ldap_deref_val);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE, "Failed to verify ldap_deref option.\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina#ifndef HAVE_LDAP_CONNCB
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    bool ldap_referrals;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ldap_referrals = dp_opt_get_bool(opts->basic, SDAP_REFERRALS);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ldap_referrals) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "LDAP referrals are not supported, because the LDAP library "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  "is too old, see sssd-ldap(5) for details.\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = dp_opt_set_bool(opts->basic, SDAP_REFERRALS, false);
383840c0c9c440710352076f844a64745121d251Pavel Březina        if (ret != EOK) {
383840c0c9c440710352076f844a64745121d251Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE, "dp_opt_set_string failed.\n");
383840c0c9c440710352076f844a64745121d251Pavel Březina            goto done;
383840c0c9c440710352076f844a64745121d251Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina#endif
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* schema type */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    schema = dp_opt_get_string(opts->basic, SDAP_SCHEMA);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (strcasecmp(schema, "rfc2307") == 0) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        opts->schema_type = SDAP_SCHEMA_RFC2307;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_attr_map = generic_attr_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_user_map = rfc2307_user_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_group_map = rfc2307_group_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_netgroup_map = netgroup_map;
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev        default_host_map = host_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_service_map = service_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    } else
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (strcasecmp(schema, "rfc2307bis") == 0) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        opts->schema_type = SDAP_SCHEMA_RFC2307BIS;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_attr_map = generic_attr_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_user_map = rfc2307bis_user_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_group_map = rfc2307bis_group_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_netgroup_map = netgroup_map;
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev        default_host_map = host_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_service_map = service_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    } else
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (strcasecmp(schema, "IPA") == 0) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        opts->schema_type = SDAP_SCHEMA_IPA_V1;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_attr_map = gen_ipa_attr_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_user_map = rfc2307bis_user_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_group_map = rfc2307bis_group_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_netgroup_map = netgroup_map;
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev        default_host_map = host_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_service_map = service_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    } else
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (strcasecmp(schema, "AD") == 0) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        opts->schema_type = SDAP_SCHEMA_AD;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_attr_map = gen_ad_attr_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_user_map = gen_ad2008r2_user_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_group_map = gen_ad2008r2_group_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_netgroup_map = netgroup_map;
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev        default_host_map = host_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default_service_map = service_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    } else {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_FATAL_FAILURE, "Unrecognized schema type: %s\n", schema);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_get_map(opts, cdb, conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       default_attr_map,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       SDAP_AT_GENERAL,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       &opts->gen_map);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_get_map(opts, cdb, conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       default_user_map,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       SDAP_OPTS_USER,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       &opts->user_map);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
4dd38025efda88f123eac672f87d3cda12f050c8Jakub Hrozek    ret = sdap_extend_map_with_list(opts, opts, SDAP_USER_EXTRA_ATTRS,
4dd38025efda88f123eac672f87d3cda12f050c8Jakub Hrozek                                    opts->user_map, SDAP_OPTS_USER,
4dd38025efda88f123eac672f87d3cda12f050c8Jakub Hrozek                                    &opts->user_map, &opts->user_map_cnt);
4dd38025efda88f123eac672f87d3cda12f050c8Jakub Hrozek    if (ret != EOK) {
4dd38025efda88f123eac672f87d3cda12f050c8Jakub Hrozek        goto done;
4dd38025efda88f123eac672f87d3cda12f050c8Jakub Hrozek    }
4dd38025efda88f123eac672f87d3cda12f050c8Jakub Hrozek
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_get_map(opts, cdb, conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       default_group_map,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       SDAP_OPTS_GROUP,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       &opts->group_map);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_get_map(opts, cdb, conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       default_netgroup_map,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       SDAP_OPTS_NETGROUP,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       &opts->netgroup_map);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev    ret = sdap_get_map(opts, cdb, conf_path,
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev                       default_host_map,
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev                       SDAP_OPTS_HOST,
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev                       &opts->host_map);
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev    if (ret != EOK) {
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev        goto done;
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev    }
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_get_map(opts, cdb, conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       default_service_map,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       SDAP_OPTS_SERVICES,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       &opts->service_map);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* If there is no KDC, try the deprecated krb5_kdcip option, too */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* FIXME - this can be removed in a future version */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = krb5_try_kdcip(cdb, conf_path, opts->basic, SDAP_KRB5_KDC);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE, "sss_krb5_try_kdcip failed.\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    authtok_type = dp_opt_get_string(opts->basic, SDAP_DEFAULT_AUTHTOK_TYPE);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (authtok_type != NULL &&
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        strcasecmp(authtok_type,"obfuscated_password") == 0) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_TRACE_ALL, "Found obfuscated password, "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  "trying to convert to cleartext.\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        authtok_blob = dp_opt_get_blob(opts->basic, SDAP_DEFAULT_AUTHTOK);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (authtok_blob.data == NULL || authtok_blob.length == 0) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE, "Missing obfuscated password string.\n");
383840c0c9c440710352076f844a64745121d251Pavel Březina            ret = EINVAL;
383840c0c9c440710352076f844a64745121d251Pavel Březina            goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = sss_password_decrypt(memctx, (char *) authtok_blob.data,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                   &cleartext);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE, "Cannot convert the obfuscated "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                      "password back to cleartext\n");
383840c0c9c440710352076f844a64745121d251Pavel Březina            goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        authtok_blob.data = (uint8_t *) cleartext;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        authtok_blob.length = strlen(cleartext);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = dp_opt_set_blob(opts->basic, SDAP_DEFAULT_AUTHTOK, authtok_blob);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        talloc_free(cleartext);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE, "dp_opt_set_string failed.\n");
383840c0c9c440710352076f844a64745121d251Pavel Březina            goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = dp_opt_set_string(opts->basic, SDAP_DEFAULT_AUTHTOK_TYPE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                "password");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE, "dp_opt_set_string failed.\n");
383840c0c9c440710352076f844a64745121d251Pavel Březina            goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = EOK;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    *_opts = opts;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březinadone:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        talloc_zfree(opts);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    return ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina}
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
8835ecb2ff5126629993a6b6d3fb0bb7baa3b765Pavel Reichlint ldap_get_sudo_options(struct confdb_ctx *cdb,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                          const char *conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                          struct sdap_options *opts,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                          bool *use_host_filter,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                          bool *include_regexp,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                          bool *include_netgroups)
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina{
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    const char *search_base;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    int ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* search base */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    search_base = dp_opt_get_string(opts->basic, SDAP_SEARCH_BASE);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (search_base != NULL) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        /* set sudo search bases if they are not */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (dp_opt_get_string(opts->basic, SDAP_SUDO_SEARCH_BASE) == NULL) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            ret = dp_opt_set_string(opts->basic, SDAP_SUDO_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                    search_base);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                DEBUG(SSSDBG_OP_FAILURE, "Could not set SUDO search base"
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                      "to default value\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                return ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_FUNC_DATA, "Option %s set to %s\n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  opts->basic[SDAP_SUDO_SEARCH_BASE].opt_name,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  dp_opt_get_string(opts->basic, SDAP_SUDO_SEARCH_BASE));
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    } else {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_TRACE_FUNC, "Search base not set, trying to discover it later "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "connecting to the LDAP server.\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_parse_search_base(opts, opts->basic,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 SDAP_SUDO_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 &opts->sdom->sudo_search_bases);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK && ret != ENOENT) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_OP_FAILURE, "Could not parse SUDO search base\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        return ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* attrs map */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_get_map(opts, cdb, conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       native_sudorule_map,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       SDAP_OPTS_SUDO,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       &opts->sudorule_map);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_OP_FAILURE, "Could not get SUDO attribute map\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        return ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* host filter */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    *use_host_filter = dp_opt_get_bool(opts->basic, SDAP_SUDO_USE_HOST_FILTER);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    *include_netgroups = dp_opt_get_bool(opts->basic, SDAP_SUDO_INCLUDE_NETGROUPS);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    *include_regexp = dp_opt_get_bool(opts->basic, SDAP_SUDO_INCLUDE_REGEXP);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    return EOK;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina}
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozekstatic bool has_defaults(struct confdb_ctx *cdb,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek                         const char *conf_path,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek                         const char *attrs[])
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek{
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    errno_t ret;
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    TALLOC_CTX *tmp_ctx;
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    char *val;
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    bool found_default = false;
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    tmp_ctx = talloc_new(NULL);
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    if (tmp_ctx == NULL) {
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        return false;
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    }
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    for (size_t i = 0; attrs[i] != NULL; i++) {
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        ret = confdb_get_string(cdb, tmp_ctx, conf_path,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek                               attrs[i], NULL, &val);
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        if (ret != EOK) {
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek            continue;
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        }
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        if (val == NULL) {
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek            found_default = true;
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek            break;
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        }
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    }
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    talloc_free(tmp_ctx);
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    return found_default;
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek}
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek/* Return true if rfc2307 schema is used and all autofs options use
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek * defaults. Should be removed in future, see
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek * https://fedorahosted.org/sssd/ticket/2858
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek */
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozekstatic bool ldap_rfc2307_autofs_defaults(struct confdb_ctx *cdb,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek                                         const char *conf_path)
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek{
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    char **services = NULL;
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    errno_t ret;
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    bool has_autofs_defaults = false;
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    const char *attrs[] = {
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        rfc2307_autofs_entry_map[SDAP_OC_AUTOFS_ENTRY].opt_name,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        /* SDAP_AT_AUTOFS_ENTRY_KEY missing on purpose, its value was
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek         * the same between the wrong and correct schema
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek         */
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        rfc2307_autofs_entry_map[SDAP_AT_AUTOFS_ENTRY_VALUE].opt_name,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        rfc2307_autofs_mobject_map[SDAP_OC_AUTOFS_MAP].opt_name,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        rfc2307_autofs_mobject_map[SDAP_AT_AUTOFS_MAP_NAME].opt_name,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        NULL,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    };
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    ret = confdb_get_string_as_list(cdb, cdb,
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik                                    CONFDB_MONITOR_CONF_ENTRY,
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik                                    CONFDB_MONITOR_ACTIVE_SERVICES, &services);
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    if (ret != EOK) {
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik        DEBUG(SSSDBG_FATAL_FAILURE, "Unable to read from confdb [%d]: %s\n",
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik              ret, sss_strerror(ret));
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik        goto done;
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    }
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    if (string_in_list("autofs", services, true) == false) {
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik        goto done;
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    }
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    has_autofs_defaults = has_defaults(cdb, conf_path, attrs);
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnikdone:
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    talloc_free(services);
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik
d9065da2a103fe88b548904bb215c9bb1f21afa2Lukas Slebodnik    return has_autofs_defaults;
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek}
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březinaint ldap_get_autofs_options(TALLOC_CTX *memctx,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                            struct confdb_ctx *cdb,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                            const char *conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                            struct sdap_options *opts)
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina{
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    const char *search_base;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct sdap_attr_map *default_entry_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct sdap_attr_map *default_mobject_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    int ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* search base */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    search_base = dp_opt_get_string(opts->basic, SDAP_SEARCH_BASE);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (search_base != NULL) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        /* set autofs search bases if they are not */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (dp_opt_get_string(opts->basic, SDAP_AUTOFS_SEARCH_BASE) == NULL) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            ret = dp_opt_set_string(opts->basic, SDAP_AUTOFS_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                    search_base);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                DEBUG(SSSDBG_OP_FAILURE, "Could not set autofs search base"
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                      "to default value\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                return ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_FUNC_DATA, "Option %s set to %s\n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  opts->basic[SDAP_AUTOFS_SEARCH_BASE].opt_name,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  dp_opt_get_string(opts->basic, SDAP_AUTOFS_SEARCH_BASE));
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    } else {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_TRACE_FUNC, "Search base not set, trying to discover it later "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "connecting to the LDAP server.\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    if (opts->schema_type == SDAP_SCHEMA_RFC2307 &&
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek            ldap_rfc2307_autofs_defaults(cdb, conf_path) == true) {
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        DEBUG(SSSDBG_IMPORTANT_INFO,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek              "Your configuration uses the autofs provider "
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek              "with schema set to rfc2307 and default attribute mappings. "
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek              "The default map has changed in this release, please make "
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek              "sure the configuration matches the server attributes.\n");
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek        sss_log(SSS_LOG_NOTICE,
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek                _("Your configuration uses the autofs provider "
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek                  "with schema set to rfc2307 and default attribute mappings. "
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek                  "The default map has changed in this release, please make "
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek                  "sure the configuration matches the server attributes.\n"));
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek    }
999d6066c7a96f102b692d31435d76114478e874Jakub Hrozek
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_parse_search_base(opts, opts->basic,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 SDAP_AUTOFS_SEARCH_BASE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 &opts->sdom->autofs_search_bases);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK && ret != ENOENT) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_OP_FAILURE, "Could not parse autofs search base\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        return ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* attribute maps */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    switch (opts->schema_type) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        case SDAP_SCHEMA_RFC2307:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            default_mobject_map = rfc2307_autofs_mobject_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            default_entry_map = rfc2307_autofs_entry_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            break;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        case SDAP_SCHEMA_RFC2307BIS:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        case SDAP_SCHEMA_IPA_V1:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        case SDAP_SCHEMA_AD:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            default_mobject_map = rfc2307bis_autofs_mobject_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            default_entry_map = rfc2307bis_autofs_entry_map;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            break;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        default:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_CRIT_FAILURE, "Unknown LDAP schema!\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            return EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_get_map(opts, cdb, conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       default_mobject_map,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       SDAP_OPTS_AUTOFS_MAP,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       &opts->autofs_mobject_map);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_OP_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "Could not get autofs map object attribute map\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        return ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = sdap_get_map(opts, cdb, conf_path,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       default_entry_map,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       SDAP_OPTS_AUTOFS_ENTRY,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       &opts->autofs_entry_map);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_OP_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "Could not get autofs entry object attribute map\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        return ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    return EOK;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina}
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březinaerrno_t sdap_parse_search_base(TALLOC_CTX *mem_ctx,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                               struct dp_option *opts, int class,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                               struct sdap_search_base ***_search_bases)
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina{
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    const char *class_name;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    char *unparsed_base;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    const char *old_filter = NULL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    switch (class) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    case SDAP_SEARCH_BASE:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        class_name = "DEFAULT";
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        break;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    case SDAP_USER_SEARCH_BASE:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        class_name = "USER";
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        old_filter = dp_opt_get_string(opts, SDAP_USER_SEARCH_FILTER);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        break;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    case SDAP_GROUP_SEARCH_BASE:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        class_name = "GROUP";
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        old_filter = dp_opt_get_string(opts, SDAP_GROUP_SEARCH_FILTER);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        break;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    case SDAP_NETGROUP_SEARCH_BASE:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        class_name = "NETGROUP";
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        break;
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev    case SDAP_HOST_SEARCH_BASE:
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev        class_name = "HOST";
60a715a0dd79873d2d2607eab8fdfaf0ffd2e7d3Hristo Venev        break;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    case SDAP_SUDO_SEARCH_BASE:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        class_name = "SUDO";
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        break;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    case SDAP_SERVICE_SEARCH_BASE:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        class_name = "SERVICE";
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        break;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    case SDAP_AUTOFS_SEARCH_BASE:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        class_name = "AUTOFS";
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        break;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    default:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_CONF_SETTINGS,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "Unknown search base type: [%d]\n", class);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        class_name = "UNKNOWN";
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        /* Non-fatal */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        break;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    unparsed_base = dp_opt_get_string(opts, class);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (!unparsed_base || unparsed_base[0] == '\0') return ENOENT;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    return common_parse_search_base(mem_ctx, unparsed_base,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                    class_name, old_filter,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                    _search_bases);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina}
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březinaerrno_t common_parse_search_base(TALLOC_CTX *mem_ctx,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 const char *unparsed_base,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 const char *class_name,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 const char *old_filter,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                 struct sdap_search_base ***_search_bases)
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina{
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    errno_t ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct sdap_search_base **search_bases;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    TALLOC_CTX *tmp_ctx;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct ldb_context *ldb;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct ldb_dn *ldn;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    struct ldb_parse_tree *tree;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    char **split_bases;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    char *filter;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    int count;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    int i, c;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    tmp_ctx = talloc_new(NULL);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (!tmp_ctx) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = ENOMEM;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* Create a throwaway LDB context for validating the DN */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ldb = ldb_init(tmp_ctx, NULL);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (!ldb) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = ENOMEM;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = split_on_separator(tmp_ctx, unparsed_base, '?', false, false,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                             &split_bases, &count);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (ret != EOK) goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    /* The split must be either exactly one value or a multiple of
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     * three in order to be valid.
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     * One value: just a base, backwards-compatible with pre-1.7.0 versions
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     * Multiple: search_base?scope?filter[?search_base?scope?filter]*
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina     */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (count > 1 && (count % 3)) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_CRIT_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "Unparseable search base: [%s][%d]\n", unparsed_base, count);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    if (count == 1) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        search_bases = talloc_array(tmp_ctx, struct sdap_search_base *, 2);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (!search_bases) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            ret = ENOMEM;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (old_filter != NULL) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            /* Using a deprecated ldap_{user,group}_search_filter */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_IMPORTANT_INFO, "WARNING: Using a deprecated filter "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  "option for %s. Please see the documentation on LDAP search "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  "bases to see how the obsolete option can be migrated\n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  class_name);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            sss_log(SSS_LOG_NOTICE, "WARNING: Using a deprecated filter option"
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    "for %s. Please see the documentation on LDAP search bases "
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    "to see how the obsolete option can be migrated\n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    class_name);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        ret = sdap_create_search_base(search_bases, unparsed_base,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                      LDAP_SCOPE_SUBTREE, old_filter,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                      &search_bases[0]);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (ret != EOK) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_OP_FAILURE, "Cannot create new sdap search base\n");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        DEBUG(SSSDBG_CONF_SETTINGS,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina              "Search base added: [%s][%s][%s][%s]\n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina               class_name,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina               search_bases[0]->basedn,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina               "SUBTREE",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina               search_bases[0]->filter ? search_bases[0]->filter : "");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        search_bases[1] = NULL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    } else {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        search_bases = talloc_array(tmp_ctx, struct sdap_search_base *,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                    (count / 3) + 1);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        if (!search_bases) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            ret = ENOMEM;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        i = 0;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        for (c = 0; c < count; c += 3) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            search_bases[i] = talloc_zero(search_bases,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                          struct sdap_search_base);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            if (!search_bases[i]) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                ret = ENOMEM;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            if (split_bases[c][0] == '\0') {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                DEBUG(SSSDBG_CRIT_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                      "Zero-length search base: [%s]\n", unparsed_base);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                ret = EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            /* Validate the basedn */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            ldn = ldb_dn_new(tmp_ctx, ldb, split_bases[c]);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            if (!ldn) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                ret = ENOMEM;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            if (!ldb_dn_validate(ldn)) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                DEBUG(SSSDBG_CRIT_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                      "Invalid base DN [%s]\n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                       split_bases[c]);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                ret = EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            talloc_zfree(ldn);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            /* Set the search base DN */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            search_bases[i]->basedn = talloc_strdup(search_bases[i],
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                                    split_bases[c]);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            if (!search_bases[i]->basedn) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                ret = ENOMEM;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            /* Set the search scope for this base DN */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            if ((split_bases[c+1][0] == '\0')
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    || strcasecmp(split_bases[c+1], "sub") == 0
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    || strcasecmp(split_bases[c+1], "subtree") == 0) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                /* If unspecified, default to subtree */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                search_bases[i]->scope = LDAP_SCOPE_SUBTREE;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            } else if (strcasecmp(split_bases[c+1], "one") == 0
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    || strcasecmp(split_bases[c+1], "onelevel") == 0) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                search_bases[i]->scope = LDAP_SCOPE_ONELEVEL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            } else if (strcasecmp(split_bases[c+1], "base") == 0) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                search_bases[i]->scope = LDAP_SCOPE_BASE;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            } else {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                DEBUG(SSSDBG_CRIT_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                      "Unknown search scope: [%s]\n", split_bases[c+1]);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                ret = EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            /* Get a specialized filter if provided */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            if (split_bases[c+2][0] == '\0') {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                search_bases[i]->filter = NULL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            } else {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                if (split_bases[c+2][0] != '(') {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    /* Filters need to be enclosed in parentheses
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                     * to be validated properly by ldb_parse_tree()
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                     */
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    filter = talloc_asprintf(tmp_ctx, "(%s)",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                             split_bases[c+2]);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                } else {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    filter = talloc_strdup(tmp_ctx, split_bases[c+2]);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                if (!filter) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    ret = ENOMEM;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                tree = ldb_parse_tree(tmp_ctx, filter);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                if(!tree) {
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    DEBUG(SSSDBG_CRIT_FAILURE,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                          "Invalid search filter: [%s]\n", filter);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    ret = EINVAL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                    goto done;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                talloc_zfree(tree);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                search_bases[i]->filter = talloc_steal(search_bases[i],
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                                                       filter);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            DEBUG(SSSDBG_CONF_SETTINGS,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                  "Search base added: [%s][%s][%s][%s]\n",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                   class_name,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                   search_bases[i]->basedn,
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                   split_bases[c+1][0] ? split_bases[c+1] : "SUBTREE",
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina                   search_bases[i]->filter ? search_bases[i]->filter : "");
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina            i++;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina        search_bases[i] = NULL;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    }
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    *_search_bases = talloc_steal(mem_ctx, search_bases);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    ret = EOK;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březinadone:
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    talloc_free(tmp_ctx);
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina    return ret;
ce35bb272d25926b8fa0f9450c8b74064f25c816Pavel Březina}