ad_common.c revision cc4caf88344210ea9777d618f0f71935ca5e7f8b
/*
SSSD
Authors:
Stephen Gallagher <sgallagh@redhat.com>
Copyright (C) 2012 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <ctype.h>
#include "providers/ad/ad_common.h"
#include "providers/dp_dyndns.h"
struct ad_server_data {
bool gc;
};
struct sdap_options *id_opts);
static struct sdap_options *
{
struct sdap_options *id_opts;
if (!id_opts) {
return NULL;
}
goto fail;
}
/* Get sdap option maps */
/* General Attribute Map */
goto fail;
}
/* User map */
goto fail;
}
/* Group map */
goto fail;
}
/* Netgroup map */
&id_opts->netgroup_map);
goto fail;
}
/* Services map */
&id_opts->service_map);
goto fail;
}
return id_opts;
fail:
return NULL;
}
struct ad_options *
{
struct ad_options *ad_options;
&ad_options->basic);
return NULL;
}
return NULL;
}
return ad_options;
}
static errno_t
const char *realm,
const char *ad_domain,
const char *hostname,
const char *keytab)
{
return ret;
}
return ret;
}
return ret;
}
return ret;
}
}
return EOK;
}
struct ad_options *
const char *realm,
const char *ad_domain,
const char *hostname,
const char *keytab)
{
struct ad_options *ad_options;
keytab);
return NULL;
}
return NULL;
}
return ad_options;
}
struct ad_options *
const char *ad_domain,
const char *hostname,
const char *keytab,
const char *sasl_authid)
{
struct ad_options *ad_options;
const char *realm;
if (!realm) {
return NULL;
}
return NULL;
}
/* Set SDAP_SASL_AUTHID to the trust principal */
return NULL;
}
return NULL;
}
return ad_options;
}
static errno_t
struct confdb_ctx *cdb,
const char *conf_path,
struct sdap_options **_id_opts)
{
struct sdap_options *id_opts;
if (!id_opts) {
goto done;
}
goto done;
}
/* Get sdap option maps */
/* General Attribute Map */
goto done;
}
/* User map */
goto done;
}
&id_opts->user_map_cnt);
goto done;
}
/* Group map */
goto done;
}
/* Netgroup map */
&id_opts->netgroup_map);
goto done;
}
/* Services map */
&id_opts->service_map);
goto done;
}
done:
return ret;
}
struct confdb_ctx *cdb,
const char *conf_path,
struct sss_domain_info *dom,
struct ad_options **_opts)
{
int gret;
char *domain;
char *server;
char *realm;
char *ad_hostname;
char *case_sensitive_opt;
const char *opt_override;
goto done;
}
/* If the AD domain name wasn't explicitly set, assume that it
* matches the SSSD domain name
*/
if (!domain) {
goto done;
}
}
/* Did we get an explicit server name, or are we discovering it? */
if (!server) {
"No AD server set, will use service discovery!\n");
}
/* Set the machine's hostname to the local host name if it
* wasn't explicitly specified.
*/
if (ad_hostname == NULL) {
if (gret != 0) {
"gethostname failed [%s].\n",
goto done;
}
"Setting ad_hostname to [%s].\n", hostname);
"Setting ad_hostname failed [%s].\n",
goto done;
}
}
/* Always use the upper-case AD domain for the kerberos realm */
if (!realm) {
goto done;
}
goto done;
}
/* Active Directory is always case-insensitive */
CONFDB_DOMAIN_CASE_SENSITIVE, "false",
goto done;
}
"Warning: AD domain can not be set as case-sensitive.\n");
dom->case_sensitive = false;
dom->case_preserve = false;
dom->case_sensitive = false;
dom->case_preserve = false;
dom->case_sensitive = false;
dom->case_preserve = true;
} else {
"Invalid value for %s\n", CONFDB_DOMAIN_CASE_SENSITIVE);
goto done;
}
/* Set this in the confdb so that the responders pick it
* up when they start up.
*/
"Could not set domain option case_sensitive: [%s]\n",
goto done;
}
"Setting domain option case_sensitive to [%s]\n", opt_override);
done:
}
return ret;
}
static void
static errno_t
const char *fo_service,
const char *fo_gc_service,
const char *servers,
const char *ad_domain,
bool primary)
{
size_t i;
char **list;
struct ad_server_data *sdata;
/* Split the server list */
goto done;
}
/* Add each of these servers to the failover service */
for (i = 0; list[i]; i++) {
if (be_fo_is_srv_identifier(list[i])) {
if (!primary) {
"Failed to add server [%s] to failover service: "
"SRV resolution only allowed for primary servers!\n",
list[i]);
continue;
}
goto done;
}
false, sdata);
"Failed to add service discovery to failover: [%s]\n",
goto done;
}
goto done;
}
false, sdata);
"Failed to add service discovery to failover: [%s]\n",
goto done;
}
continue;
}
/* It could be ipv6 address in square brackets. Remove
* the brackets if needed. */
goto done;
}
goto done;
}
goto done;
}
goto done;
}
goto done;
}
}
done:
return ret;
}
static inline errno_t
const char *fo_service, const char *fo_gc_service,
const char *ad_domain)
{
}
static inline errno_t
const char *fo_service, const char *fo_gc_service,
const char *ad_domain)
{
}
{
}
return 0;
}
return 1;
}
static void ad_online_cb(void *pvt)
{
return;
}
}
const char *primary_servers,
const char *backup_servers,
const char *krb5_realm,
const char *ad_service,
const char *ad_gc_service,
const char *ad_domain,
struct ad_service **_service)
{
struct ad_service *service;
if (!service) {
goto done;
}
goto done;
}
goto done;
}
if (!service->krb5_service) {
goto done;
}
goto done;
}
goto done;
}
goto done;
}
if (!krb5_realm) {
goto done;
}
goto done;
}
if (!primary_servers) {
"No primary servers defined, using service discovery\n");
}
goto done;
}
if (backup_servers) {
goto done;
}
}
goto done;
}
goto done;
}
goto done;
}
done:
return ret;
}
static void
{
struct ad_service *service;
struct resolv_hostent *srvaddr;
struct sockaddr_storage *sockaddr;
char *address;
const char *safe_address;
char *new_uri;
int new_port;
const char *srv_name;
if (!tmp_ctx) {
return;
}
goto done;
}
if (!service) {
goto done;
}
if (!srvaddr) {
"No hostent available for server (%s)\n",
goto done;
}
goto done;
}
goto done;
}
if (!new_uri) {
goto done;
}
goto done;
}
/* free old one and replace with new one */
new_port);
} else {
/* Make sure there always is an URI even if we know that this
* server doesn't support GC. That way the lookup would go through
* just not return anything
*/
sizeof(struct sockaddr_storage));
}
goto done;
}
"resolv_get_sockaddr_address failed.\n");
goto done;
}
/* Only write kdcinfo files for local servers */
/* Write krb5 info files */
address);
if (safe_address == NULL) {
goto done;
}
"write_krb5info_file failed, authentication might fail.\n");
}
}
done:
}
return;
}
static errno_t
struct sdap_options *id_opts)
{
char *krb5_realm;
char *keytab_path;
/* We only support Kerberos password policy with AD, so
* force that on.
*/
goto done;
}
/* Set the Kerberos Realm for GSSAPI */
if (!krb5_realm) {
/* Should be impossible, this is set in ad_get_common_options() */
goto done;
}
"Option %s set to %s\n",
if (keytab_path) {
"Option %s set to %s\n",
}
goto done;
}
/* fix schema to AD */
done:
return ret;
}
struct confdb_ctx *cdb,
const char *conf_path,
struct sdap_options **_opts)
{
struct sdap_options *id_opts;
return ENOMEM;
}
return ret;
}
NULL);
return ret;
}
/* Set up search bases if they were assigned explicitly */
return ret;
}
return EOK;
}
struct confdb_ctx *cdb,
const char *conf_path)
{
/* autofs maps */
cdb,
return ret;
}
cdb,
return ret;
}
return EOK;
}
{
char *default_search_base;
size_t o;
const int search_base_options[] = { SDAP_USER_SEARCH_BASE,
-1 };
/* AD servers provide defaultNamingContext, so we will
* rely on that to specify the search base unless it has
* been specifically overridden.
*/
if (default_search_base) {
/* set search bases if they are not */
for (o = 0; search_base_options[o] != -1; o++) {
search_base_options[o])) {
goto done;
}
"Option %s set to %s\n",
search_base_options[o]));
}
}
} else {
"Search base not set. SSSD will attempt to discover it later, "
"when connecting to the LDAP server.\n");
}
/* Default search */
/* User search */
/* Group search base */
/* Netgroup search */
/* Service search */
done:
return ret;
}
struct ad_options *ad_opts,
{
struct dp_option *krb5_options;
const char *ad_servers;
const char *krb5_realm;
/* Get krb5 options */
&krb5_options);
"Could not read Kerberos options from the configuration\n");
goto done;
}
/* Force the krb5_servers to match the ad_servers */
"Option %s set to %s\n",
/* Set krb5 realm */
/* Set the Kerberos Realm for GSSAPI */
if (!krb5_realm) {
/* Should be impossible, this is set in ad_get_common_options() */
goto done;
}
/* Force the kerberos realm to match the AD_KRB5_REALM (which may have
* been upper-cased in ad_common_options()
*/
"Option %s set to %s\n",
/* Set flag that controls whether we want to write the
* kdcinfo files at all
*/
done:
return ret;
}
struct ad_options *ad_opts)
{
&ad_opts->dyndns_ctx);
"Cannot initialize AD dyndns opts [%d]: %s\n",
return ret;
}
return EOK;
}
struct ad_id_ctx *
{
struct sdap_id_ctx *sdap_ctx;
return NULL;
}
return NULL;
}
return NULL;
}
return ad_ctx;
}
struct sdap_id_conn_ctx *
{
struct sdap_id_conn_ctx *conn;
struct sdap_domain *sdom;
struct ad_id_ctx *subdom_id_ctx;
return NULL;
}
/* Regardless of connection types, a subdomain error must not be
* allowed to set the whole back end offline, rather report an error
* and let the caller deal with it (normally disable the subdomain
*/
conn->ignore_mark_offline = true;
}
return conn;
}
struct sdap_id_conn_ctx **
struct sss_domain_info *dom)
{
struct sdap_id_conn_ctx **clist;
int cindex = 0;
/* Always try GC first */
cindex++;
}
return clist;
}
struct sdap_id_conn_ctx **
struct sss_domain_info *dom)
{
struct sdap_id_conn_ctx **clist;
return NULL;
}
return clist;
}
struct sdap_id_conn_ctx **
struct sss_domain_info *dom)
{
struct sdap_id_conn_ctx **clist;
int cindex = 0;
return NULL;
}
/* Try GC first for users from trusted domains, but go to LDAP
* for users from non-trusted domains to get all POSIX attrs
*/
&& IS_SUBDOMAIN(dom)) {
cindex++;
}
/* Users from primary domain can be just downloaded from LDAP.
* The domain's LDAP connection also works as a fallback
*/
return clist;
}