ad_common.c revision 0051296f67bd7d8e2e3094638ddff4e641324d04
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina/*
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina SSSD
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina Authors:
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina Stephen Gallagher <sgallagh@redhat.com>
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina Copyright (C) 2012 Red Hat
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina This program is free software; you can redistribute it and/or modify
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina it under the terms of the GNU General Public License as published by
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina the Free Software Foundation; either version 3 of the License, or
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina (at your option) any later version.
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina This program is distributed in the hope that it will be useful,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina but WITHOUT ANY WARRANTY; without even the implied warranty of
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina GNU General Public License for more details.
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina You should have received a copy of the GNU General Public License
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina along with this program. If not, see <http://www.gnu.org/licenses/>.
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina*/
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina#include <ctype.h>
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina#include "providers/ad/ad_common.h"
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina#include "providers/ad/ad_opts.h"
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinaerrno_t
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinaad_get_common_options(TALLOC_CTX *mem_ctx,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina struct confdb_ctx *cdb,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina const char *conf_path,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina struct sss_domain_info *dom,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina struct ad_options **_opts)
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina{
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina errno_t ret;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina int gret;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina struct ad_options *opts = NULL;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina char *domain;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina char *server;
5e2ffb69dcdd157ea422c6aec256111653e4206bPavel Březina char *realm;
5e2ffb69dcdd157ea422c6aec256111653e4206bPavel Březina char *ad_hostname;
5e2ffb69dcdd157ea422c6aec256111653e4206bPavel Březina char hostname[HOST_NAME_MAX + 1];
5e2ffb69dcdd157ea422c6aec256111653e4206bPavel Březina
a6cd927f298ff5c9a603db5acb6c1b0ebea178c0Pavel Březina opts = talloc_zero(mem_ctx, struct ad_options);
b963ed8079a4a284611d50d1b79695116c40295dPavel Březina if (!opts) return ENOMEM;
b963ed8079a4a284611d50d1b79695116c40295dPavel Březina
b963ed8079a4a284611d50d1b79695116c40295dPavel Březina ret = dp_get_options(opts, cdb, conf_path,
b963ed8079a4a284611d50d1b79695116c40295dPavel Březina ad_basic_opts,
b963ed8079a4a284611d50d1b79695116c40295dPavel Březina AD_OPTS_BASIC,
b963ed8079a4a284611d50d1b79695116c40295dPavel Březina &opts->basic);
5e2ffb69dcdd157ea422c6aec256111653e4206bPavel Březina if (ret != EOK) {
5e2ffb69dcdd157ea422c6aec256111653e4206bPavel Březina goto done;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina }
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina /* If the AD domain name wasn't explicitly set, assume that it
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina * matches the SSSD domain name
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina */
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina domain = dp_opt_get_string(opts->basic, AD_DOMAIN);
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina if (!domain) {
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina ret = dp_opt_set_string(opts->basic, AD_DOMAIN, dom->name);
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina if (ret != EOK) {
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina goto done;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina }
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina domain = dom->name;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Did we get an explicit server name, or are we discovering it? */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina server = dp_opt_get_string(opts->basic, AD_SERVER);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!server) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CONF_SETTINGS,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("No AD server set, will use service discovery!\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Set the machine's hostname to the local host name if it
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina * wasn't explicitly specified.
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ad_hostname = dp_opt_get_string(opts->basic, AD_HOSTNAME);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ad_hostname == NULL) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina gret = gethostname(hostname, HOST_NAME_MAX);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (gret != 0) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = errno;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_FATAL_FAILURE,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("gethostname failed [%s].\n",
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina strerror(ret)));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina hostname[HOST_NAME_MAX] = '\0';
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CONF_SETTINGS,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("Setting ad_hostname to [%s].\n", hostname));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = dp_opt_set_string(opts->basic, AD_HOSTNAME, hostname);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_FATAL_FAILURE,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("Setting ad_hostname failed [%s].\n",
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina strerror(ret)));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Always use the upper-case AD domain for the kerberos realm */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina realm = get_uppercase_realm(opts, domain);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!realm) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ENOMEM;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = dp_opt_set_string(opts->basic, AD_KRB5_REALM, realm);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Active Directory is always case-insensitive */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina dom->case_sensitive = false;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Set this in the confdb so that the responders pick it
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina * up when they start up.
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = confdb_set_bool(cdb, conf_path, "case_sensitive",
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina dom->case_sensitive);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CRIT_FAILURE,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("Could not set domain case-sensitive: [%s]\n",
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina strerror(ret)));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CONF_SETTINGS,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("Setting domain case-insensitive\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = EOK;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina *_opts = opts;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinadone:
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina talloc_zfree(opts);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina return ret;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina}
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinastatic void
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinaad_resolve_callback(void *private_data, struct fo_server *server);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinastatic errno_t
877b92e80bde510d5cd9f03dbf01e2bcf73ab072Michal Židekad_servers_init(TALLOC_CTX *mem_ctx,
877b92e80bde510d5cd9f03dbf01e2bcf73ab072Michal Židek struct be_ctx *bectx,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina const char *servers,
3a8b5ccf7c27b72054e1d8b3ab355cb1e28efda9Sumit Bose struct ad_options *options,
3a8b5ccf7c27b72054e1d8b3ab355cb1e28efda9Sumit Bose bool primary)
3a8b5ccf7c27b72054e1d8b3ab355cb1e28efda9Sumit Bose{
3a8b5ccf7c27b72054e1d8b3ab355cb1e28efda9Sumit Bose size_t i;
3a8b5ccf7c27b72054e1d8b3ab355cb1e28efda9Sumit Bose errno_t ret = 0;
3a8b5ccf7c27b72054e1d8b3ab355cb1e28efda9Sumit Bose char **list;
3a8b5ccf7c27b72054e1d8b3ab355cb1e28efda9Sumit Bose char *ad_domain;
3a8b5ccf7c27b72054e1d8b3ab355cb1e28efda9Sumit Bose TALLOC_CTX *tmp_ctx;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina tmp_ctx = talloc_new(NULL);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!tmp_ctx) return ENOMEM;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Split the server list */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = split_on_separator(tmp_ctx, servers, ',', true, &list, NULL);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to parse server list!\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
877b92e80bde510d5cd9f03dbf01e2bcf73ab072Michal Židek
877b92e80bde510d5cd9f03dbf01e2bcf73ab072Michal Židek ad_domain = dp_opt_get_string(options->basic, AD_DOMAIN);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Add each of these servers to the failover service */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina for (i = 0; list[i]; i++) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (be_fo_is_srv_identifier(list[i])) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!primary) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_MINOR_FAILURE,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("Failed to add server [%s] to failover service: "
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina "SRV resolution only allowed for primary servers!\n",
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina list[i]));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina continue;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = be_fo_add_srv_server(bectx, AD_SERVICE_NAME, "ldap",
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ad_domain, BE_FO_PROTO_TCP,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina false, NULL);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_FATAL_FAILURE,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("Failed to add service discovery to failover: [%s]",
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina strerror(ret)));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CONF_SETTINGS, ("Added service discovery for AD\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina continue;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = be_fo_add_server(bectx, AD_SERVICE_NAME, list[i], 0, NULL, primary);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret && ret != EEXIST) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_FATAL_FAILURE, ("Failed to add server\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CONF_SETTINGS, ("Added failover server %s\n", list[i]));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinadone:
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina talloc_free(tmp_ctx);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina return ret;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina}
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinastatic int ad_user_data_cmp(void *ud1, void *ud2)
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina{
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina return strcasecmp((char*) ud1, (char*) ud2);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina}
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinaerrno_t
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinaad_failover_init(TALLOC_CTX *mem_ctx, struct be_ctx *bectx,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina const char *primary_servers,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina const char *backup_servers,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina struct ad_options *options,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina struct ad_service **_service)
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina{
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina errno_t ret;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina TALLOC_CTX *tmp_ctx;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina struct ad_service *service;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina char *realm;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina tmp_ctx = talloc_new(mem_ctx);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!tmp_ctx) return ENOMEM;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina service = talloc_zero(tmp_ctx, struct ad_service);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!service) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ENOMEM;
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina goto done;
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina }
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina service->sdap = talloc_zero(service, struct sdap_service);
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina if (!service->sdap) {
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina ret = ENOMEM;
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina goto done;
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina }
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina service->krb5_service = talloc_zero(service, struct krb5_service);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!service->krb5_service) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ENOMEM;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = be_fo_add_service(bectx, AD_SERVICE_NAME, ad_user_data_cmp);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to create failover service!\n"));
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina goto done;
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina }
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina service->sdap->name = talloc_strdup(service, AD_SERVICE_NAME);
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina if (!service->sdap->name) {
cf3ba77997dfbd076a1f30fdbb33c7973766ac03Pavel Březina ret = ENOMEM;
cf3ba77997dfbd076a1f30fdbb33c7973766ac03Pavel Březina goto done;
cf3ba77997dfbd076a1f30fdbb33c7973766ac03Pavel Březina }
cf3ba77997dfbd076a1f30fdbb33c7973766ac03Pavel Březina
cf3ba77997dfbd076a1f30fdbb33c7973766ac03Pavel Březina service->krb5_service->name = talloc_strdup(service, AD_SERVICE_NAME);
cf3ba77997dfbd076a1f30fdbb33c7973766ac03Pavel Březina if (!service->krb5_service->name) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ENOMEM;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
5e2ffb69dcdd157ea422c6aec256111653e4206bPavel Březina }
5e2ffb69dcdd157ea422c6aec256111653e4206bPavel Březina service->sdap->kinit_service_name = service->krb5_service->name;
5e2ffb69dcdd157ea422c6aec256111653e4206bPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina realm = dp_opt_get_string(options->basic, AD_KRB5_REALM);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!realm) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CRIT_FAILURE, ("No Kerberos realm set\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = EINVAL;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina service->krb5_service->realm =
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina talloc_strdup(service->krb5_service, realm);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!service->krb5_service->realm) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ENOMEM;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!primary_servers) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (backup_servers) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_TRACE_FUNC,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("No primary servers defined but backup are present, "
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina "setting backup servers as primary\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina primary_servers = backup_servers;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina backup_servers = NULL;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina } else {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_TRACE_FUNC,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("No primary or backup servers defined but backup are present, "
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina "setting backup servers as primary\n"));
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina primary_servers = BE_SRV_IDENTIFIER;
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina }
b03ccb2764a4ccdadb77599cb624b6a17b633438Pavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ad_servers_init(mem_ctx, bectx, primary_servers, options, true);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (backup_servers) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ad_servers_init(mem_ctx, bectx, backup_servers, options, false);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina ret = be_fo_service_add_callback(mem_ctx, bectx, AD_SERVICE_NAME,
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina ad_resolve_callback, service);
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina if (ret != EOK) {
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina DEBUG(SSSDBG_FATAL_FAILURE,
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina ("Failed to add failover callback! [%s]\n", strerror(ret)));
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina goto done;
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina }
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina *_service = talloc_steal(mem_ctx, service);
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina ret = EOK;
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březinadone:
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina talloc_free(tmp_ctx);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina return ret;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina}
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinastatic void
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinaad_resolve_callback(void *private_data, struct fo_server *server)
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina{
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina errno_t ret;
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina TALLOC_CTX *tmp_ctx;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina struct ad_service *service;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina struct resolv_hostent *srvaddr;
16065cc731687eb8779d31b79436bbf79c5e3ed3Pavel Březina struct sockaddr_storage *sockaddr;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina char *address;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina const char *safe_address;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina char *new_uri;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina const char *srv_name;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina tmp_ctx = talloc_new(NULL);
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina if (!tmp_ctx) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CRIT_FAILURE, ("Out of memory\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina return;
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina service = talloc_get_type(private_data, struct ad_service);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!service) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = EINVAL;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina }
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina srvaddr = fo_get_server_hostent(server);
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina if (!srvaddr) {
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina DEBUG(SSSDBG_CRIT_FAILURE,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("No hostent available for server (%s)\n",
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina fo_get_server_str_name(server)));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = EINVAL;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina sockaddr = resolv_get_sockaddr_address(tmp_ctx, srvaddr, LDAP_PORT);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (sockaddr == NULL) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CRIT_FAILURE, ("resolv_get_sockaddr_address failed.\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = EIO;
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina address = resolv_get_string_address(tmp_ctx, srvaddr);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (address == NULL) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CRIT_FAILURE, ("resolv_get_string_address failed.\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = EIO;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina srv_name = fo_get_server_name(server);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (srv_name == NULL) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CRIT_FAILURE, ("Could not get server host name\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = EINVAL;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina new_uri = talloc_asprintf(service, "ldap://%s", srv_name);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!new_uri) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CRIT_FAILURE, ("Failed to copy URI\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ENOMEM;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina DEBUG(SSSDBG_CONF_SETTINGS, ("Constructed uri '%s'\n", new_uri));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina /* free old one and replace with new one */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina talloc_zfree(service->sdap->uri);
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina service->sdap->uri = new_uri;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina talloc_zfree(service->sdap->sockaddr);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina service->sdap->sockaddr = talloc_steal(service, sockaddr);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina safe_address = sss_escape_ip_address(tmp_ctx,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina srvaddr->family,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina address);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (safe_address == NULL) {
bda8039465a0084fb380e878c8f9ea3e900505eaPavel Březina DEBUG(SSSDBG_CRIT_FAILURE, ("sss_escape_ip_address failed.\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ENOMEM;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina ret = write_krb5info_file(service->krb5_service->realm, safe_address,
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina SSS_KRB5KDC_FO_SRV);
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina if (ret != EOK) {
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina DEBUG(SSSDBG_MINOR_FAILURE,
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina ("write_krb5info_file failed, authentication might fail.\n"));
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina }
4940ba14100ad11b0ed1f2a8a4fea5daa34d56eePavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = EOK;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březinadone:
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina if (ret != EOK) {
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina DEBUG(SSSDBG_CRIT_FAILURE,
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina ("Error: [%s]\n", strerror(ret)));
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina }
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina talloc_free(tmp_ctx);
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina return;
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina}
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březinaerrno_t
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březinaad_set_search_bases(struct sdap_options *id_opts);
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březinaerrno_t
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březinaad_get_id_options(struct ad_options *ad_opts,
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina struct confdb_ctx *cdb,
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina const char *conf_path,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina struct sdap_options **_opts)
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina{
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina errno_t ret;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina TALLOC_CTX *tmp_ctx;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina struct sdap_options *id_opts;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina char *krb5_realm;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina char *sasl_primary;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina char *desired_primary;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina char *sasl_realm;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina char *desired_realm;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina char *keytab_path;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina bool primary_requested = true;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina bool realm_requested = true;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina tmp_ctx = talloc_new(NULL);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!tmp_ctx) return ENOMEM;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
3bc651a611a3e5be508875f3ae58bfb5ece2525cPavel Březina id_opts = talloc_zero(tmp_ctx, struct sdap_options);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!id_opts) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ENOMEM;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = dp_get_options(id_opts, cdb, conf_path,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ad_def_ldap_opts,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina SDAP_OPTS_BASIC,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina &id_opts->basic);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Set up search bases if they were assigned explicitly */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = ad_set_search_bases(id_opts);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* We only support Kerberos password policy with AD, so
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina * force that on.
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = dp_opt_set_string(id_opts->basic,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina SDAP_PWD_POLICY,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina PWD_POL_OPT_MIT);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_FATAL_FAILURE, ("Could not set password policy\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Set the Kerberos Realm for GSSAPI */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina krb5_realm = dp_opt_get_string(ad_opts->basic, AD_KRB5_REALM);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!krb5_realm) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Should be impossible, this is set in ad_get_common_options() */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_FATAL_FAILURE, ("No Kerberos realm\n"));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = EINVAL;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = dp_opt_set_string(id_opts->basic, SDAP_KRB5_REALM, krb5_realm);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CONF_SETTINGS,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("Option %s set to %s\n",
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina id_opts->basic[SDAP_KRB5_REALM].opt_name,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina krb5_realm));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina /* Configuration of SASL auth ID and realm */
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina desired_primary = dp_opt_get_string(id_opts->basic, SDAP_SASL_AUTHID);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!desired_primary) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina primary_requested = false;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina desired_primary = dp_opt_get_string(ad_opts->basic, AD_HOSTNAME);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina desired_realm = dp_opt_get_string(id_opts->basic, SDAP_SASL_REALM);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (!desired_realm) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina realm_requested = false;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina desired_realm = dp_opt_get_string(ad_opts->basic, AD_KRB5_REALM);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina keytab_path = dp_opt_get_string(ad_opts->basic, AD_KEYTAB);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (keytab_path) {
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ret = dp_opt_set_string(id_opts->basic, SDAP_KRB5_KEYTAB,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina keytab_path);
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina if (ret != EOK) goto done;
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina DEBUG(SSSDBG_CONF_SETTINGS,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina ("Option %s set to %s\n",
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina id_opts->basic[SDAP_KRB5_KEYTAB].opt_name,
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina keytab_path));
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina }
284937e6b5b0c9d7a1d3382d0d2820d1168842fbPavel Březina
ret = select_principal_from_keytab(tmp_ctx,
desired_primary, desired_realm,
keytab_path, NULL,
&sasl_primary, &sasl_realm);
if (ret != EOK) goto done;
if ((primary_requested && strcmp(desired_primary, sasl_primary) != 0) ||
(realm_requested && strcmp(desired_realm, sasl_realm) != 0)) {
DEBUG(SSSDBG_FATAL_FAILURE,
("Configured SASL auth ID/realm not found in keytab.\n"));
ret = ENOENT;
goto done;
}
ret = dp_opt_set_string(id_opts->basic, SDAP_SASL_AUTHID, sasl_primary);
if (ret != EOK) goto done;
DEBUG(SSSDBG_CONF_SETTINGS,
("Option %s set to %s\n",
id_opts->basic[SDAP_SASL_AUTHID].opt_name,
sasl_primary));
ret = dp_opt_set_string(id_opts->basic, SDAP_SASL_REALM, sasl_realm);
if (ret != EOK) goto done;
DEBUG(SSSDBG_CONF_SETTINGS,
("Option %s set to %s\n",
id_opts->basic[SDAP_SASL_REALM].opt_name,
sasl_realm));
/* fix schema to AD */
id_opts->schema_type = SDAP_SCHEMA_AD;
/* Get sdap option maps */
/* General Attribute Map */
ret = sdap_get_map(id_opts,
cdb, conf_path,
ad_2008r2_attr_map,
SDAP_AT_GENERAL,
&id_opts->gen_map);
if (ret != EOK) {
goto done;
}
/* User map */
ret = sdap_get_map(id_opts,
cdb, conf_path,
ad_2008r2_user_map,
SDAP_OPTS_USER,
&id_opts->user_map);
if (ret != EOK) {
goto done;
}
/* Group map */
ret = sdap_get_map(id_opts,
cdb, conf_path,
ad_2008r2_group_map,
SDAP_OPTS_GROUP,
&id_opts->group_map);
if (ret != EOK) {
goto done;
}
/* Netgroup map */
ret = sdap_get_map(id_opts,
cdb, conf_path,
ad_netgroup_map,
SDAP_OPTS_NETGROUP,
&id_opts->netgroup_map);
if (ret != EOK) {
goto done;
}
/* Services map */
ret = sdap_get_map(id_opts,
cdb, conf_path,
ad_service_map,
SDAP_OPTS_SERVICES,
&id_opts->service_map);
if (ret != EOK) {
goto done;
}
ad_opts->id = talloc_steal(ad_opts, id_opts);
*_opts = id_opts;
ret = EOK;
done:
talloc_free(tmp_ctx);
return ret;
}
errno_t
ad_set_search_bases(struct sdap_options *id_opts)
{
errno_t ret;
char *default_search_base;
size_t o;
const int search_base_options[] = { SDAP_USER_SEARCH_BASE,
SDAP_GROUP_SEARCH_BASE,
SDAP_NETGROUP_SEARCH_BASE,
SDAP_SERVICE_SEARCH_BASE,
-1 };
/* AD servers provide defaultNamingContext, so we will
* rely on that to specify the search base unless it has
* been specifically overridden.
*/
default_search_base =
dp_opt_get_string(id_opts->basic, SDAP_SEARCH_BASE);
if (default_search_base) {
/* set search bases if they are not */
for (o = 0; search_base_options[o] != -1; o++) {
if (NULL == dp_opt_get_string(id_opts->basic,
search_base_options[o])) {
ret = dp_opt_set_string(id_opts->basic,
search_base_options[o],
default_search_base);
if (ret != EOK) {
goto done;
}
DEBUG(SSSDBG_CONF_SETTINGS,
("Option %s set to %s\n",
id_opts->basic[search_base_options[o]].opt_name,
dp_opt_get_string(id_opts->basic,
search_base_options[o])));
}
}
} else {
DEBUG(SSSDBG_CONF_SETTINGS,
("Search base not set. SSSD will attempt to discover it later, "
"when connecting to the LDAP server.\n"));
}
/* Default search */
ret = sdap_parse_search_base(id_opts, id_opts->basic,
SDAP_SEARCH_BASE,
&id_opts->search_bases);
if (ret != EOK && ret != ENOENT) goto done;
/* User search */
ret = sdap_parse_search_base(id_opts, id_opts->basic,
SDAP_USER_SEARCH_BASE,
&id_opts->user_search_bases);
if (ret != EOK && ret != ENOENT) goto done;
/* Group search base */
ret = sdap_parse_search_base(id_opts, id_opts->basic,
SDAP_GROUP_SEARCH_BASE,
&id_opts->group_search_bases);
if (ret != EOK && ret != ENOENT) goto done;
/* Netgroup search */
ret = sdap_parse_search_base(id_opts, id_opts->basic,
SDAP_NETGROUP_SEARCH_BASE,
&id_opts->netgroup_search_bases);
if (ret != EOK && ret != ENOENT) goto done;
/* Service search */
ret = sdap_parse_search_base(id_opts, id_opts->basic,
SDAP_SERVICE_SEARCH_BASE,
&id_opts->service_search_bases);
if (ret != EOK && ret != ENOENT) goto done;
ret = EOK;
done:
return ret;
}
errno_t
ad_get_auth_options(TALLOC_CTX *mem_ctx,
struct ad_options *ad_opts,
struct be_ctx *bectx,
struct dp_option **_opts)
{
errno_t ret;
struct dp_option *krb5_options;
const char *ad_servers;
const char *krb5_realm;
TALLOC_CTX *tmp_ctx = talloc_new(NULL);
if (!tmp_ctx) return ENOMEM;
/* Get krb5 options */
ret = dp_get_options(tmp_ctx, bectx->cdb, bectx->conf_path,
ad_def_krb5_opts, KRB5_OPTS,
&krb5_options);
if (ret != EOK) {
DEBUG(SSSDBG_CRIT_FAILURE,
("Could not read Kerberos options from the configuration\n"));
goto done;
}
ad_servers = dp_opt_get_string(ad_opts->basic, AD_SERVER);
/* Force the krb5_servers to match the ad_servers */
ret = dp_opt_set_string(krb5_options, KRB5_KDC, ad_servers);
if (ret != EOK) goto done;
DEBUG(SSSDBG_CONF_SETTINGS,
("Option %s set to %s\n",
krb5_options[KRB5_KDC].opt_name,
ad_servers));
/* Set krb5 realm */
/* Set the Kerberos Realm for GSSAPI */
krb5_realm = dp_opt_get_string(ad_opts->basic, AD_KRB5_REALM);
if (!krb5_realm) {
/* Should be impossible, this is set in ad_get_common_options() */
DEBUG(SSSDBG_FATAL_FAILURE, ("No Kerberos realm\n"));
ret = EINVAL;
goto done;
}
/* Force the kerberos realm to match the AD_KRB5_REALM (which may have
* been upper-cased in ad_common_options()
*/
ret = dp_opt_set_string(krb5_options, KRB5_REALM, krb5_realm);
if (ret != EOK) goto done;
DEBUG(SSSDBG_CONF_SETTINGS,
("Option %s set to %s\n",
krb5_options[KRB5_REALM].opt_name,
krb5_realm));
*_opts = talloc_steal(mem_ctx, krb5_options);
ret = EOK;
done:
talloc_free(tmp_ctx);
return ret;
}