ad_id.c revision db18dda869bc6c52a41797b2066cf121cf10f49c
/*
SSSD
Authors:
Stephen Gallagher <sgallagh@redhat.com>
Copyright (C) 2012 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "util/strtonum.h"
#include "providers/ad/ad_common.h"
#include "providers/ad/ad_domain_info.h"
#include "providers/ldap/sdap_async_enum.h"
#include "providers/ldap/sdap_idmap.h"
static void
{
return;
}
"but are not present on the server side. Global Catalog "
"lookups will be disabled\n");
AD_ENABLE_GC, false);
"Could not turn off GC support\n");
/* Not fatal */
}
}
struct ad_handle_acct_info_state {
struct be_acct_req *ar;
struct sdap_id_ctx *ctx;
struct sdap_id_conn_ctx **conn;
struct sdap_domain *sdom;
struct ad_options *ad_options;
int dp_error;
const char *err;
};
struct tevent_req *
struct be_acct_req *ar,
struct sdap_id_ctx *ctx,
struct ad_options *ad_options,
struct sdap_domain *sdom,
struct sdap_id_conn_ctx **conn)
{
struct tevent_req *req;
struct ad_handle_acct_info_state *state;
return NULL;
}
}
/* Lookup in progress */
return req;
}
static errno_t
{
struct tevent_req *subreq;
struct ad_handle_acct_info_state);
bool noexist_delete = false;
return EOK;
}
noexist_delete = true;
}
return ENOMEM;
}
return EAGAIN;
}
static void
{
int dp_error;
int sdap_err;
const char *err;
struct tevent_req);
struct ad_handle_acct_info_state);
if (dp_error == DP_ERR_OFFLINE
/* This is a special case: GC does not work.
* We need to Fall back to ldap
*/
}
return;
}
return;
} else if (sdap_err == ERR_NO_POSIX) {
return;
}
/* Ret is only ENOENT or ERR_NO_POSIX now. Try the next connection */
/* No additional search in progress. Save the last
* error status, we'll be returning it.
*/
/* No more connections */
} else {
}
return;
}
/* Another lookup in progress */
}
{
struct ad_handle_acct_info_state);
if (_dp_error) {
}
if (_err) {
}
return EOK;
}
struct sdap_id_conn_ctx **
{
struct sdap_id_conn_ctx **clist;
int cindex = 0;
case BE_REQ_USER: /* user */
/* Try GC first for users from trusted domains */
&& IS_SUBDOMAIN(dom)) {
cindex++;
}
/* Users from primary domain can be just downloaded from LDAP.
* The domain's LDAP connection also works as a fallback
*/
break;
case BE_REQ_BY_SECID: /* by SID */
case BE_REQ_USER_AND_GROUP: /* get SID */
case BE_REQ_GROUP: /* group */
case BE_REQ_INITGROUPS: /* init groups for user */
break;
default:
/* Requests for other object should only contact LDAP by default */
break;
}
return clist;
}
struct sdap_idmap_ctx *idmap_ctx,
int filter_type,
const char *filter_value,
const char *filter_domain)
{
enum idmap_error_code err;
bool shortcut = false;
goto done;
}
switch (filter_type) {
case BE_FILTER_IDNUM:
/* convert value to ID */
errno = 0;
if (errno != 0) {
goto done;
}
/* convert the ID to its SID equivalent */
if (err != IDMAP_SUCCESS) {
goto done;
}
/* fall through */
case BE_FILTER_SECID:
goto done;
}
shortcut = true;
}
break;
default:
break;
}
done:
}
return shortcut;
}
void
{
struct be_acct_req *ar;
struct sdap_id_ctx *sdap_id_ctx;
struct tevent_req *req;
struct sss_domain_info *dom;
struct sdap_domain *sdom;
struct sdap_id_conn_ctx **clist;
bool shortcut;
struct ad_id_ctx);
if (be_is_offline(be_ctx)) {
}
/* Try to shortcut if this is ID or SID search and it belongs to
* other domain range than is in ar->domain. */
if (shortcut) {
return;
}
/* Subdomain request, verify subdomain */
}
goto fail;
}
/* Determine whether to connect to GC, LDAP or try both */
goto fail;
}
goto fail;
}
goto fail;
}
return;
fail:
}
static void
{
int dp_error;
const char *error_text = "Internal error";
const char *req_error_text;
error_text = NULL;
} else {
"Bug: dp_error is OK on failed request\n");
}
} else if (dp_error == DP_ERR_OFFLINE) {
error_text = "Offline";
error_text = "Out of memory";
} else {
}
}
void
{
struct ad_id_ctx);
}
struct ad_enumeration_state {
struct ldap_enum_ctx *ectx;
struct sdap_id_op *sdap_op;
struct tevent_context *ev;
struct sdap_domain *sdom;
struct sdap_domain *sditer;
};
struct tevent_req *
struct tevent_context *ev,
void *pvt)
{
struct tevent_req *req;
struct tevent_req *subreq;
struct ad_enumeration_state *state;
struct ldap_enum_ctx *ectx;
goto fail;
}
goto fail;
}
goto fail;
}
return req;
fail:
return req;
}
static void
{
struct tevent_req);
struct ad_enumeration_state);
if (dp_error == DP_ERR_OFFLINE) {
"Backend is marked offline, retry later!\n");
} else {
"Domain enumeration failed to connect to " \
}
return;
}
return;
}
}
static void
{
struct tevent_req);
struct ad_enumeration_state);
char *flat_name;
char *master_sid;
char *forest;
return;
}
return;
}
return;
}
/* Execution will resume in ad_enumeration_done */
}
static errno_t
struct sdap_domain *sd,
{
struct sdap_id_conn_ctx *user_conn;
struct tevent_req *subreq;
struct ad_enumeration_state);
} else {
}
/* Groups are searched for in LDAP, users in GC. Services (if present,
* which is unlikely in AD) from LDAP as well
*/
sd,
user_conn, /* Users */
/* The ptask API will reschedule the enumeration on its own on
* failure */
"Failed to schedule enumeration, retrying later!\n");
return ENOMEM;
}
return EOK;
}
struct sss_domain_info *dom);
static void
{
struct tevent_req);
struct ad_enumeration_state);
if (ret == ERR_NO_POSIX) {
/* Retry enumerating the same domain again, this time w/o
* connecting to GC
*/
return;
}
/* Execution will resume in ad_enumeration_done */
return;
return;
}
do {
return;
}
/* Execution will resume in ad_enumeration_done */
return;
}
/* No more subdomains to enumerate. Check if we need to fixup
* cross-domain membership
*/
/* We did enumerate at least one subdomain. Walk the subdomains
* and fixup members for each of them
*/
"memberships for %s, group memberships might be "
continue;
}
}
}
}
const struct ldb_message *group,
struct sss_domain_info *dom,
char ***_group_only);
struct sss_domain_info *group_domain,
const char *member);
static errno_t
struct sss_domain_info *dom)
{
char *filter;
const char *attrs[] = {
};
struct ldb_message **msgs;
bool in_transaction = false;
char **group_only;
goto done;
}
in_transaction = true;
goto done;
}
goto done;
}
for (i = 0; i < count; i++) {
continue;
} else if (group_only == NULL) {
continue;
}
/* Group has extra members */
continue;
}
}
}
goto done;
}
in_transaction = false;
done:
if (in_transaction) {
}
}
return ret;
}
static errno_t
static errno_t
{
struct ldb_message_element *m, *om;
const char *name;
char **sysdb_odn_list;
const char **group_odn_list;
char **group_only = NULL;
*_group_only = NULL;
goto done;
}
goto done;
}
"Group %s has %d members but %d original members\n",
/* Get the list of originalDN attributes that are already
* linked to the group
*/
"Could not retrieve list of original members for %s\n",
name);
goto done;
}
/* Get the list of original DN attributes the group had in AD */
if (group_odn_list == NULL) {
goto done;
}
/* Compare the two lists */
"Could not compare lists of members for %s\n", name);
goto done;
}
}
done:
return ret;
}
static errno_t
{
struct ldb_message **members;
const char *attrs[] = {
};
char **odn_list;
const char *odn;
/* Get all entries member element points to */
goto done;
}
goto done;
}
/* Get a list of their original DNs */
oi = 0;
for (i = 0; i < m_count; i++) {
continue;
}
goto done;
}
oi++;
}
done:
return ret;
}
static errno_t
struct sss_domain_info *group_domain,
const char *member)
{
struct sdap_domain *sd;
const char *mem_filter;
struct ldb_message **msgs;
/* This member would be from a different domain */
return ENOENT;
}
if (mem_filter == NULL) {
goto done;
}
goto done;
}
&msgs_count, &msgs);
goto done;
goto done;
}
if (msgs_count != 1) {
"Search by orig DN returned %zd results!\n", msgs_count);
goto done;
}
goto done;
}
done:
return ret;
}
{
return EOK;
}