ad_common.c revision 72ae534f5aef6d2e5d3f2f51299aede5abf9687e
/*
SSSD
Authors:
Stephen Gallagher <sgallagh@redhat.com>
Copyright (C) 2012 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <ctype.h>
#include "providers/ad/ad_common.h"
#include "providers/dp_dyndns.h"
struct ad_server_data {
bool gc;
};
struct sdap_options *id_opts);
static struct sdap_options *
{
struct sdap_options *id_opts;
if (!id_opts) {
return NULL;
}
goto fail;
}
/* Get sdap option maps */
/* General Attribute Map */
goto fail;
}
/* User map */
goto fail;
}
/* Group map */
goto fail;
}
/* Netgroup map */
&id_opts->netgroup_map);
goto fail;
}
/* Services map */
&id_opts->service_map);
goto fail;
}
return id_opts;
fail:
return NULL;
}
struct ad_options *
const char *realm,
const char *hostname)
{
struct ad_options *ad_options;
&ad_options->basic);
return NULL;
}
return NULL;
}
return NULL;
}
return NULL;
}
return NULL;
}
return ad_options;
}
static errno_t
struct confdb_ctx *cdb,
const char *conf_path,
struct sdap_options **_id_opts)
{
struct sdap_options *id_opts;
if (!id_opts) {
goto done;
}
goto done;
}
/* Get sdap option maps */
/* General Attribute Map */
goto done;
}
/* User map */
goto done;
}
/* Group map */
goto done;
}
/* Netgroup map */
&id_opts->netgroup_map);
goto done;
}
/* Services map */
&id_opts->service_map);
goto done;
}
done:
return ret;
}
struct confdb_ctx *cdb,
const char *conf_path,
struct sss_domain_info *dom,
struct ad_options **_opts)
{
int gret;
char *domain;
char *server;
char *realm;
char *ad_hostname;
goto done;
}
/* If the AD domain name wasn't explicitly set, assume that it
* matches the SSSD domain name
*/
if (!domain) {
goto done;
}
}
/* Did we get an explicit server name, or are we discovering it? */
if (!server) {
("No AD server set, will use service discovery!\n"));
}
/* Set the machine's hostname to the local host name if it
* wasn't explicitly specified.
*/
if (ad_hostname == NULL) {
if (gret != 0) {
("gethostname failed [%s].\n",
goto done;
}
("Setting ad_hostname to [%s].\n", hostname));
("Setting ad_hostname failed [%s].\n",
goto done;
}
}
/* Always use the upper-case AD domain for the kerberos realm */
if (!realm) {
goto done;
}
goto done;
}
/* Active Directory is always case-insensitive */
dom->case_sensitive = false;
/* Set this in the confdb so that the responders pick it
* up when they start up.
*/
("Could not set domain case-sensitive: [%s]\n",
goto done;
}
("Setting domain case-insensitive\n"));
done:
}
return ret;
}
static void
static errno_t
struct ad_service *service,
const char *fo_service,
const char *fo_gc_service,
const char *servers,
const char *ad_domain,
bool primary)
{
size_t i;
char **list;
struct ad_server_data *sdata;
/* Split the server list */
goto done;
}
/* Add each of these servers to the failover service */
for (i = 0; list[i]; i++) {
if (be_fo_is_srv_identifier(list[i])) {
if (!primary) {
("Failed to add server [%s] to failover service: "
"SRV resolution only allowed for primary servers!\n",
list[i]));
continue;
}
goto done;
}
false, sdata);
("Failed to add service discovery to failover: [%s]",
goto done;
}
goto done;
}
false, sdata);
("Failed to add service discovery to failover: [%s]",
goto done;
}
continue;
}
/* It could be ipv6 address in square brackets. Remove
* the brackets if needed. */
goto done;
}
goto done;
}
goto done;
}
goto done;
}
goto done;
}
}
done:
return ret;
}
static inline errno_t
const char *fo_service, const char *fo_gc_service,
const char *ad_domain)
{
}
static inline errno_t
const char *fo_service, const char *fo_gc_service,
const char *ad_domain)
{
}
{
}
return 0;
}
return 1;
}
static void ad_online_cb(void *pvt)
{
return;
}
}
const char *primary_servers,
const char *backup_servers,
const char *krb5_realm,
const char *ad_service,
const char *ad_gc_service,
const char *ad_domain,
struct ad_service **_service)
{
struct ad_service *service;
if (!service) {
goto done;
}
goto done;
}
goto done;
}
if (!service->krb5_service) {
goto done;
}
goto done;
}
goto done;
}
goto done;
}
if (!krb5_realm) {
goto done;
}
goto done;
}
if (!primary_servers) {
("No primary servers defined, using service discovery\n"));
}
goto done;
}
if (backup_servers) {
goto done;
}
}
return ret;
}
goto done;
}
goto done;
}
done:
return ret;
}
static void
{
struct ad_service *service;
struct resolv_hostent *srvaddr;
struct sockaddr_storage *sockaddr;
char *address;
const char *safe_address;
char *new_uri;
int new_port;
const char *srv_name;
if (!tmp_ctx) {
return;
}
return;
}
if (!service) {
goto done;
}
if (!srvaddr) {
("No hostent available for server (%s)\n",
goto done;
}
goto done;
}
goto done;
}
if (!new_uri) {
goto done;
}
goto done;
}
/* free old one and replace with new one */
new_port);
} else {
/* Make sure there always is an URI even if we know that this
* server doesn't support GC. That way the lookup would go through
* just not return anything
*/
sizeof(struct sockaddr_storage));
}
goto done;
}
("resolv_get_sockaddr_address failed.\n"));
goto done;
}
/* Only write kdcinfo files for local servers */
/* Write krb5 info files */
address);
if (safe_address == NULL) {
goto done;
}
("write_krb5info_file failed, authentication might fail.\n"));
}
}
done:
}
return;
}
static errno_t
struct sdap_options *id_opts)
{
char *krb5_realm;
char *keytab_path;
/* We only support Kerberos password policy with AD, so
* force that on.
*/
goto done;
}
/* Set the Kerberos Realm for GSSAPI */
if (!krb5_realm) {
/* Should be impossible, this is set in ad_get_common_options() */
goto done;
}
("Option %s set to %s\n",
krb5_realm));
if (keytab_path) {
("Option %s set to %s\n",
keytab_path));
}
goto done;
}
/* fix schema to AD */
done:
return ret;
}
struct confdb_ctx *cdb,
const char *conf_path,
struct sdap_options **_opts)
{
struct sdap_options *id_opts;
return ENOMEM;
}
return ret;
}
NULL);
return ret;
}
/* Set up search bases if they were assigned explicitly */
return ret;
}
return EOK;
}
{
char *default_search_base;
size_t o;
const int search_base_options[] = { SDAP_USER_SEARCH_BASE,
-1 };
/* AD servers provide defaultNamingContext, so we will
* rely on that to specify the search base unless it has
* been specifically overridden.
*/
if (default_search_base) {
/* set search bases if they are not */
for (o = 0; search_base_options[o] != -1; o++) {
search_base_options[o])) {
goto done;
}
("Option %s set to %s\n",
search_base_options[o])));
}
}
} else {
("Search base not set. SSSD will attempt to discover it later, "
"when connecting to the LDAP server.\n"));
}
/* Default search */
/* User search */
/* Group search base */
/* Netgroup search */
/* Service search */
done:
return ret;
}
struct ad_options *ad_opts,
{
struct dp_option *krb5_options;
const char *ad_servers;
const char *krb5_realm;
/* Get krb5 options */
&krb5_options);
("Could not read Kerberos options from the configuration\n"));
goto done;
}
/* Force the krb5_servers to match the ad_servers */
("Option %s set to %s\n",
ad_servers));
/* Set krb5 realm */
/* Set the Kerberos Realm for GSSAPI */
if (!krb5_realm) {
/* Should be impossible, this is set in ad_get_common_options() */
goto done;
}
/* Force the kerberos realm to match the AD_KRB5_REALM (which may have
* been upper-cased in ad_common_options()
*/
("Option %s set to %s\n",
krb5_realm));
/* Set flag that controls whether we want to write the
* kdcinfo files at all
*/
done:
return ret;
}
struct ad_options *ad_opts)
{
&ad_opts->dyndns_ctx);
("Cannot initialize AD dyndns opts [%d]: %s\n",
return ret;
}
return EOK;
}
struct ad_id_ctx *
{
struct sdap_id_ctx *sdap_ctx;
return NULL;
}
return NULL;
}
return NULL;
}
return ad_ctx;
}
struct sdap_id_conn_ctx *
{
struct sdap_id_conn_ctx *conn;
struct sdap_domain *sdom;
struct ad_id_ctx *subdom_id_ctx;
if (IS_SUBDOMAIN(dom)) {
return NULL;
}
} else {
}
return conn;
}
struct sdap_id_conn_ctx **
struct sss_domain_info *dom)
{
struct sdap_id_conn_ctx **clist;
/* Always try GC first */
if (IS_SUBDOMAIN(dom) == true) {
clist[0]->ignore_mark_offline = false;
/* Subdomain users are only present in GC. */
return clist;
}
/* fall back to ldap if gc is not available */
clist[0]->ignore_mark_offline = true;
/* With root domain users we have the option to
* fall back to LDAP in case ie POSIX attributes
* are used but not replicated to GC
*/
return clist;
}