cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#include "providers/ldap/sdap_async.h"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#include "providers/ldap/sdap_idmap.h"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#include "providers/ipa/ipa_subdomains.h"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#include "providers/ipa/ipa_common.h"

f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung#include <ctype.h>

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define SUBDOMAINS_FILTER "objectclass=ipaNTTrustedDomain"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define MASTER_DOMAIN_FILTER "objectclass=ipaNTDomainAttrs"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define RANGE_FILTER "objectclass=ipaIDRange"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define IPA_CN "cn"

48c64aeceef385e19025b384bd719b2a9789592dnd#define IPA_FLATNAME "ipaNTFlatName"

48c64aeceef385e19025b384bd719b2a9789592dnd#define IPA_SID "ipaNTSecurityIdentifier"

48c64aeceef385e19025b384bd719b2a9789592dnd#define IPA_TRUSTED_DOMAIN_SID "ipaNTTrustedDomainSID"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define IPA_RANGE_TYPE "ipaRangeType"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define IPA_BASE_ID "ipaBaseID"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define IPA_ID_RANGE_SIZE "ipaIDRangeSize"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define IPA_BASE_RID "ipaBaseRID"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define IPA_SECONDARY_BASE_RID "ipaSecondaryBaseRID"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define OBJECTCLASS "objectClass"

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define IPA_SUBDOMAIN_REFRESH_LIMIT 5

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor#define IPA_SUBDOMAIN_DISABLED_PERIOD 3600

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzorenum ipa_subdomains_req_type {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor IPA_SUBDOMAINS_MASTER,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor IPA_SUBDOMAINS_SLAVE,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor IPA_SUBDOMAINS_RANGES,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor IPA_SUBDOMAINS_MAX /* Counter */

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor};

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzorstruct ipa_subdomains_req_params {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor const char *filter;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor tevent_req_fn cb;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor const char *attrs[9];

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor};

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzorstruct ipa_subdomains_ctx {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct be_ctx *be_ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ipa_id_ctx *id_ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sdap_id_ctx *sdap_id_ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sdap_search_base **search_bases;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sdap_search_base **master_search_bases;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sdap_search_base **ranges_search_bases;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor time_t last_refreshed;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct tevent_timer *timer_event;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor bool configured_explicit;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor time_t disabled_until;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor};

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf

cae0359c9286c8e34cbccd15eee2da90562c1ee2sfstruct be_ctx *ipa_get_subdomains_be_ctx(struct be_ctx *be_ctx)

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf{

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf struct ipa_subdomains_ctx *subdom_ctx;

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf subdom_ctx = talloc_get_type(be_ctx->bet_info[BET_SUBDOMAINS].pvt_bet_data,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ipa_subdomains_ctx);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (subdom_ctx == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_TRACE_ALL, ("Subdomains are not configured.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return NULL;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return subdom_ctx->be_ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor}

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzorstatic errno_t

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzoripa_ad_ctx_new(struct be_ctx *be_ctx,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ipa_id_ctx *id_ctx,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sss_domain_info *subdom,

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh struct ad_id_ctx **_ad_id_ctx)

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor{

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ad_options *ad_options;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ad_id_ctx *ad_id_ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor const char *gc_service_name;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ad_srv_plugin_ctx *srv_ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor char *ad_domain;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sdap_domain *sdom;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor errno_t ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ad_options = ad_create_default_options(id_ctx, id_ctx->server_mode->realm,

fed47023e9be04c612b5f6d4a5ee2b8e7c587181rbowen id_ctx->server_mode->hostname);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ad_options == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("Cannot initialize AD options\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor talloc_free(ad_options);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ENOMEM;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ad_domain = subdom->name;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = dp_opt_set_string(ad_options->basic, AD_DOMAIN, ad_domain);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("Cannot set AD domain\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor talloc_free(ad_options);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = dp_opt_set_string(ad_options->basic, AD_KRB5_REALM,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor id_ctx->server_mode->realm);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("Cannot set AD realm\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor talloc_free(ad_options);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh gc_service_name = talloc_asprintf(ad_options, "%s%s", "gc_", subdom->name);

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh if (gc_service_name == NULL) {

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh talloc_free(ad_options);

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh return ENOMEM;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor /* Set KRB5 realm to same as the one of IPA when IPA

f039cf01b271a31e317d5b84f24cb135f1c1b6d7nd ret = ad_failover_init(ad_options, be_ctx, NULL, NULL,

48c64aeceef385e19025b384bd719b2a9789592dnd id_ctx->server_mode->realm,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor subdom->name, gc_service_name,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor subdom->name, &ad_options->service);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("Cannot initialize AD failover\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor talloc_free(ad_options);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ad_id_ctx = ad_id_ctx_init(ad_options, be_ctx);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ad_id_ctx == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor talloc_free(ad_options);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ENOMEM;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh }

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh ad_id_ctx->sdap_id_ctx->opts = ad_options->id;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh ad_options->id_ctx = ad_id_ctx;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh /* use AD plugin */

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor srv_ctx = ad_srv_plugin_ctx_init(be_ctx, be_ctx->be_res,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor default_host_dbs,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ad_id_ctx->ad_options->id,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor id_ctx->server_mode->hostname,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ad_domain);

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh if (srv_ctx == NULL) {

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh DEBUG(SSSDBG_FATAL_FAILURE, ("Out of memory?\n"));

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh return ENOMEM;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh }

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh be_fo_set_srv_lookup_plugin(be_ctx, ad_srv_plugin_send,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ad_srv_plugin_recv, srv_ctx, "AD");

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = sdap_domain_subdom_add(ad_id_ctx->sdap_id_ctx,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ad_id_ctx->sdap_id_ctx->opts->sdom,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor subdom->parent);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK) {

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh DEBUG(SSSDBG_OP_FAILURE, ("Cannot initialize sdap domain\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor talloc_free(ad_options);

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh return ret;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor sdom = sdap_domain_get(ad_id_ctx->sdap_id_ctx->opts, subdom);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (sdom == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return EFAULT;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = sdap_id_setup_tasks(ad_id_ctx->sdap_id_ctx,

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh ad_id_ctx->ldap_ctx, sdom,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ldap_enumeration_send,

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh ldap_enumeration_recv);

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh if (ret != EOK) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor talloc_free(ad_options);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor /* Set up the ID mapping object */

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ad_id_ctx->sdap_id_ctx->opts->idmap_ctx =

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor id_ctx->sdap_id_ctx->opts->idmap_ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor *_ad_id_ctx = ad_id_ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return EOK;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh}

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh

ba543b319188dc1887607f6d59feddc00e38eee2humbedoohstatic errno_t

ba543b319188dc1887607f6d59feddc00e38eee2humbedoohipa_server_trust_add(struct be_ctx *be_ctx,

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh struct ipa_id_ctx *id_ctx,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sss_domain_info *subdom)

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor{

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ipa_ad_server_ctx *trust_ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ad_id_ctx *ad_id_ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor errno_t ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = ipa_ad_ctx_new(be_ctx, id_ctx, subdom, &ad_id_ctx);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ("Cannot create ad_id_ctx for subdomain %s\n", subdom->name));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor trust_ctx = talloc(id_ctx->server_mode, struct ipa_ad_server_ctx);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (trust_ctx == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ENOMEM;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor trust_ctx->dom = subdom;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh trust_ctx->ad_id_ctx = ad_id_ctx;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh DLIST_ADD(id_ctx->server_mode->trusts, trust_ctx);

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh return EOK;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh}

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh

ba543b319188dc1887607f6d59feddc00e38eee2humbedoohstatic errno_t

ba543b319188dc1887607f6d59feddc00e38eee2humbedoohipa_ad_subdom_refresh(struct be_ctx *be_ctx,

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh struct ipa_id_ctx *id_ctx,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sss_domain_info *parent)

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor{

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sss_domain_info *dom;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ipa_ad_server_ctx *trust_iter;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor errno_t ret;

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf if (dp_opt_get_bool(id_ctx->ipa_options->basic,

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf IPA_SERVER_MODE) == false) {

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf return EOK;

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf }

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor for (dom = get_next_domain(parent, true);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor dom && IS_SUBDOMAIN(dom); /* if we get back to a parent, stop */

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor dom = get_next_domain(dom, false)) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor /* Check if we already have an ID context for this subdomain */

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DLIST_FOR_EACH(trust_iter, id_ctx->server_mode->trusts) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (trust_iter->dom == dom) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor break;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

fed47023e9be04c612b5f6d4a5ee2b8e7c587181rbowen

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor /* Newly detected trust */

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (trust_iter == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = ipa_server_trust_add(be_ctx, id_ctx, dom);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ("Cannot create ad_id_ctx for subdomain %s\n",

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor dom->name));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor continue;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return EOK;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor}

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzorstatic void

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzoripa_ad_subdom_remove(struct ipa_subdomains_ctx *ctx,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sss_domain_info *subdom)

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor{

fed47023e9be04c612b5f6d4a5ee2b8e7c587181rbowen struct ipa_ad_server_ctx *iter;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sdap_domain *sdom;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (dp_opt_get_bool(ctx->id_ctx->ipa_options->basic,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor IPA_SERVER_MODE) == false) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DLIST_FOR_EACH(iter, ctx->id_ctx->server_mode->trusts) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (iter->dom == subdom) break;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (iter == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_CRIT_FAILURE, ("No IPA-AD context for subdomain %s\n",

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor subdom->name));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor sdom = sdap_domain_get(iter->ad_id_ctx->sdap_id_ctx->opts, subdom);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (sdom == NULL) return;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor be_ptask_destroy(&sdom->enum_task);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor be_ptask_destroy(&sdom->cleanup_task);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor sdap_domain_remove(iter->ad_id_ctx->sdap_id_ctx->opts, subdom);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DLIST_REMOVE(ctx->id_ctx->server_mode->trusts, iter);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor /* terminate all requests for this subdomain so we can free it */

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor be_terminate_domain_requests(ctx->be_ctx, subdom->name);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor talloc_zfree(sdom);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor}

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzorconst char *get_flat_name_from_subdomain_name(struct be_ctx *be_ctx,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor const char *name)

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor{

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ipa_subdomains_ctx *ctx;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sss_domain_info *dom;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ctx = talloc_get_type(be_ctx->bet_info[BET_SUBDOMAINS].pvt_bet_data,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ipa_subdomains_ctx);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ctx == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_TRACE_ALL, ("Subdomains are not configured.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return NULL;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor dom = find_subdomain_by_name(ctx->be_ctx->domain, name, true);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (dom) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return dom->flat_name;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return NULL;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor}

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzorstatic errno_t ipa_ranges_parse_results(TALLOC_CTX *mem_ctx,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor size_t count,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sysdb_attrs **reply,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct range_info ***_range_list)

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor{

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct range_info **range_list = NULL;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor const char *value;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor size_t c;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor int ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor range_list = talloc_array(mem_ctx, struct range_info *, count + 1);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (range_list == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("talloc_array failed.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ENOMEM;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor for (c = 0; c < count; c++) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor range_list[c] = talloc_zero(range_list, struct range_info);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (range_list[c] == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("talloc_zero failed.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = ENOMEM;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = sysdb_attrs_get_string(reply[c], IPA_CN, &value);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor range_list[c]->name = talloc_strdup(range_list[c], value);

f039cf01b271a31e317d5b84f24cb135f1c1b6d7nd if (range_list[c]->name == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = ENOMEM;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh }

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh ret = sysdb_attrs_get_string(reply[c], IPA_TRUSTED_DOMAIN_SID, &value);

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh if (ret == EOK) {

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh range_list[c]->trusted_dom_sid = talloc_strdup(range_list[c],

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh value);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (range_list[c]->trusted_dom_sid == NULL) {

f039cf01b271a31e317d5b84f24cb135f1c1b6d7nd DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));

f039cf01b271a31e317d5b84f24cb135f1c1b6d7nd ret = ENOMEM;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

f039cf01b271a31e317d5b84f24cb135f1c1b6d7nd }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor } else if (ret != ENOENT) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh }

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh ret = sysdb_attrs_get_uint32_t(reply[c], IPA_BASE_ID,

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh &range_list[c]->base_id);

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh if (ret != EOK && ret != ENOENT) {

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = sysdb_attrs_get_uint32_t(reply[c], IPA_ID_RANGE_SIZE,

f039cf01b271a31e317d5b84f24cb135f1c1b6d7nd &range_list[c]->id_range_size);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK && ret != ENOENT) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

f039cf01b271a31e317d5b84f24cb135f1c1b6d7nd goto done;

f039cf01b271a31e317d5b84f24cb135f1c1b6d7nd }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = sysdb_attrs_get_uint32_t(reply[c], IPA_BASE_RID,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor &range_list[c]->base_rid);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK && ret != ENOENT) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = sysdb_attrs_get_uint32_t(reply[c], IPA_SECONDARY_BASE_RID,

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh &range_list[c]->secondary_base_rid);

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh if (ret != EOK && ret != ENOENT) {

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh goto done;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh }

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = sysdb_attrs_get_string(reply[c], IPA_RANGE_TYPE, &value);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret == EOK) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor range_list[c]->range_type = talloc_strdup(range_list[c], value);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (range_list[c]->range_type == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = ENOMEM;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor } else if (ret == ENOENT) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor /* Older IPA servers might not have the range_type attribute, but

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (range_list[c]->trusted_dom_sid == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor range_list[c]->range_type = talloc_strdup(range_list[c],

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor IPA_RANGE_LOCAL);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor } else {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor range_list[c]->range_type = talloc_strdup(range_list[c],

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor IPA_RANGE_AD_TRUST);

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf }

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf } else {

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf goto done;

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf }

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf if (range_list[c]->range_type == NULL) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("talloc_strdup failed.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = ENOMEM;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor range_list[c] = NULL;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor *_range_list = range_list;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = EOK;

fed47023e9be04c612b5f6d4a5ee2b8e7c587181rbowen

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzordone:

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor talloc_free(range_list);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor}

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzorstatic errno_t ipa_subdom_enumerates(struct sss_domain_info *parent,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct sysdb_attrs *attrs,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor bool *_enumerates)

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor{

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor errno_t ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor const char *name;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = sysdb_attrs_get_string(attrs, IPA_CN, &name);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret != EOK) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor *_enumerates = subdomain_enumerates(parent, name);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor return EOK;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor}

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

ba543b319188dc1887607f6d59feddc00e38eee2humbedoohstatic errno_t ipa_subdom_get_forest(TALLOC_CTX *mem_ctx,

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh struct ldb_context *ldb_ctx,

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh struct sysdb_attrs *attrs,

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh char **_forest)

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh{

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh int ret;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor const char *orig_dn;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor struct ldb_dn *dn = NULL;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor const struct ldb_val *val;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor char *forest = NULL;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = sysdb_attrs_get_string(attrs, SYSDB_ORIG_DN, &orig_dn);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ret) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh goto done;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh }

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh DEBUG(SSSDBG_TRACE_ALL, ("Checking if we need the forest name for [%s].\n",

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh orig_dn));

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh dn = ldb_dn_new(mem_ctx, ldb_ctx, orig_dn);

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh if (dn == NULL) {

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh DEBUG(SSSDBG_OP_FAILURE, ("ldb_dn_new failed.\n"));

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh goto done;

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh }

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (!ldb_dn_validate(dn)) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_OP_FAILURE, ("Original DN [%s] is not a valid DN.\n",

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor orig_dn));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = EINVAL;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (ldb_dn_get_comp_num(dn) < 5) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor /* We are only interested in the member domain objects. In IPA the

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf ret = EOK;

cae0359c9286c8e34cbccd15eee2da90562c1ee2sf goto done;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor val = ldb_dn_get_component_val(dn, 3);

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor if (strncasecmp("trusts", (const char *) val->data, val->length) != 0) {

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor DEBUG(SSSDBG_TRACE_FUNC,

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ("4th component is not 'trust', nothing to do.\n"));

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor ret = EOK;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor goto done;

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor }

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung val = ldb_dn_get_component_val(dn, 2);

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh if (strncasecmp("ad", (const char *) val->data, val->length) != 0) {

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh DEBUG(SSSDBG_TRACE_FUNC,

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh ("3rd component is not 'ad', nothing to do.\n"));

ba543b319188dc1887607f6d59feddc00e38eee2humbedooh ret = EOK;

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh goto done;

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh }

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh val = ldb_dn_get_component_val(dn, 1);

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh forest = talloc_strndup(mem_ctx, (const char *) val->data, val->length);

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh if (forest == NULL) {

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh DEBUG(SSSDBG_OP_FAILURE, ("talloc_strndup failed.\n"));

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh ret = ENOMEM;

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh goto done;

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh }

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedoohdone:

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh talloc_free(dn);

30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh

5effc8b39fae5cd169d17f342bfc265705840014rbowen if (ret == EOK) {

d229f940abfb2490dee17979e9a5ff31b7012eb5rbowen *_forest = forest;

7fec19672a491661b2fe4b29f685bc7f4efa64d4nd }

7fec19672a491661b2fe4b29f685bc7f4efa64d4nd

7fec19672a491661b2fe4b29f685bc7f4efa64d4nd return ret;

7fec19672a491661b2fe4b29f685bc7f4efa64d4nd}

cc8190433d13f5e9de618c5d7f10c824c0c1919cgryzor

static errno_t ipa_subdom_store(struct sss_domain_info *parent,

struct sdap_idmap_ctx *sdap_idmap_ctx,

struct sysdb_attrs *attrs,

bool enumerate)

{

TALLOC_CTX *tmp_ctx;

const char *name;

char *realm;

const char *flat;

const char *id;

char *forest = NULL;

int ret;

bool mpg;

tmp_ctx = talloc_new(parent);

if (tmp_ctx == NULL) {

return ENOMEM;

}

ret = sysdb_attrs_get_string(attrs, IPA_CN, &name);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

goto done;

}

realm = get_uppercase_realm(tmp_ctx, name);

if (!realm) {

ret = ENOMEM;

goto done;

}

ret = sysdb_attrs_get_string(attrs, IPA_FLATNAME, &flat);

if (ret) {

DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

goto done;

}

ret = sysdb_attrs_get_string(attrs, IPA_TRUSTED_DOMAIN_SID, &id);

if (ret) {

DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

goto done;

}

mpg = sdap_idmap_domain_has_algorithmic_mapping(sdap_idmap_ctx, name, id);

ret = ipa_subdom_get_forest(tmp_ctx, sysdb_ctx_get_ldb(parent->sysdb),

attrs, &forest);

if (ret != EOK) {

goto done;

}

ret = sysdb_subdomain_store(parent->sysdb, name, realm, flat,

id, mpg, enumerate, forest);

if (ret) {

DEBUG(SSSDBG_OP_FAILURE, ("sysdb_subdomain_store failed.\n"));

goto done;

}

ret = EOK;

done:

talloc_free(tmp_ctx);

return ret;

}

static errno_t ipa_subdomains_refresh(struct ipa_subdomains_ctx *ctx,

int count, struct sysdb_attrs **reply,

bool *changes)

{

struct sss_domain_info *parent, *dom;

bool handled[count];

const char *value;

int c, h;

int ret;

bool enumerate;

parent = ctx->be_ctx->domain;

memset(handled, 0, sizeof(bool) * count);

h = 0;

/* check existing subdomains */

for (dom = get_next_domain(parent, true);

dom && IS_SUBDOMAIN(dom); /* if we get back to a parent, stop */

dom = get_next_domain(dom, false)) {

for (c = 0; c < count; c++) {

if (handled[c]) {

continue;

}

ret = sysdb_attrs_get_string(reply[c], IPA_CN, &value);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("sysdb_attrs_get_string failed.\n"));

goto done;

}

if (strcmp(value, dom->name) == 0) {

break;

}

}

if (c >= count) {

/* ok this subdomain does not exist anymore, let's clean up */

dom->disabled = true;

ret = sysdb_subdomain_delete(dom->sysdb, dom->name);

if (ret != EOK) {

goto done;

}

/* Remove the AD ID ctx from the list of LDAP domains */

ipa_ad_subdom_remove(ctx, dom);

} else {

/* ok let's try to update it */

ret = ipa_subdom_enumerates(parent, reply[c], &enumerate);

if (ret != EOK) {

goto done;

}

ret = ipa_subdom_store(parent, ctx->sdap_id_ctx->opts->idmap_ctx,

reply[c], enumerate);

if (ret) {

/* Nothing we can do about the errorr. Let's at least try

DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to parse subdom data, "

"will try to use cached subdomain\n"));

}

handled[c] = true;

h++;

}

}

if (count == h) {

/* all domains were already accounted for and have been updated */

ret = EOK;

goto done;

}

/* if we get here it means we have changes to the subdomains list */

*changes = true;

for (c = 0; c < count; c++) {

if (handled[c]) {

continue;

}

/* Nothing we can do about the errorr. Let's at least try

ret = ipa_subdom_enumerates(parent, reply[c], &enumerate);

if (ret != EOK) {

goto done;

}

ret = ipa_subdom_store(parent, ctx->sdap_id_ctx->opts->idmap_ctx,

reply[c], enumerate);

if (ret) {

DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to parse subdom data, "

"will try to use cached subdomain\n"));

}

}

ret = EOK;

done:

if (ret != EOK) {

ctx->last_refreshed = 0;

} else {

ctx->last_refreshed = time(NULL);

}

return ret;

}

struct ipa_subdomains_req_ctx {

struct be_req *be_req;

struct ipa_subdomains_ctx *sd_ctx;

struct sdap_id_op *sdap_op;

char *current_filter;

struct sdap_search_base **search_bases;

int search_base_iter;

size_t reply_count;

struct sysdb_attrs **reply;

};

static void ipa_subdomains_get_conn_done(struct tevent_req *req);

static errno_t

ipa_subdomains_handler_get(struct ipa_subdomains_req_ctx *ctx,

enum ipa_subdomains_req_type type);

static void ipa_subdomains_handler_done(struct tevent_req *req);

static void ipa_subdomains_handler_master_done(struct tevent_req *req);

static void ipa_subdomains_handler_ranges_done(struct tevent_req *req);

static struct ipa_subdomains_req_params subdomain_requests[] = {

{ MASTER_DOMAIN_FILTER,

ipa_subdomains_handler_master_done,

{ IPA_CN, IPA_FLATNAME, IPA_SID, NULL }

},

{ SUBDOMAINS_FILTER,

ipa_subdomains_handler_done,

{ IPA_CN, IPA_FLATNAME, IPA_TRUSTED_DOMAIN_SID, NULL }

},

{ RANGE_FILTER,

ipa_subdomains_handler_ranges_done,

{ OBJECTCLASS, IPA_CN,

IPA_BASE_ID, IPA_BASE_RID, IPA_SECONDARY_BASE_RID,

IPA_ID_RANGE_SIZE, IPA_TRUSTED_DOMAIN_SID, IPA_RANGE_TYPE, NULL

}

}

};

static void ipa_subdomains_retrieve(struct ipa_subdomains_ctx *ctx, struct be_req *be_req)

{

struct ipa_subdomains_req_ctx *req_ctx = NULL;

struct tevent_req *req;

int dp_error = DP_ERR_FATAL;

int ret;

req_ctx = talloc(be_req, struct ipa_subdomains_req_ctx);

if (req_ctx == NULL) {

ret = ENOMEM;

goto done;

}

req_ctx->be_req = be_req;

req_ctx->sd_ctx = ctx;

req_ctx->search_base_iter = 0;

req_ctx->search_bases = ctx->ranges_search_bases;

req_ctx->current_filter = NULL;

req_ctx->reply_count = 0;

req_ctx->reply = NULL;

req_ctx->sdap_op = sdap_id_op_create(req_ctx,

ctx->sdap_id_ctx->conn->conn_cache);

if (req_ctx->sdap_op == NULL) {

DEBUG(SSSDBG_OP_FAILURE, ("sdap_id_op_create failed.\n"));

ret = ENOMEM;

goto done;

}

req = sdap_id_op_connect_send(req_ctx->sdap_op, req_ctx, &ret);

if (req == NULL) {

DEBUG(SSSDBG_OP_FAILURE, ("sdap_id_op_connect_send failed: %d(%s).\n",

ret, strerror(ret)));

goto done;

}

tevent_req_set_callback(req, ipa_subdomains_get_conn_done, req_ctx);

return;

done:

talloc_free(req_ctx);

if (ret == EOK) {

dp_error = DP_ERR_OK;

}

be_req_terminate(be_req, dp_error, ret, NULL);

}

static void ipa_subdomains_get_conn_done(struct tevent_req *req)

{

int ret;

int dp_error = DP_ERR_FATAL;

struct ipa_subdomains_req_ctx *ctx;

ctx = tevent_req_callback_data(req, struct ipa_subdomains_req_ctx);

ret = sdap_id_op_connect_recv(req, &dp_error);

talloc_zfree(req);

if (ret) {

if (dp_error == DP_ERR_OFFLINE) {

DEBUG(SSSDBG_MINOR_FAILURE,

("No IPA server is available, cannot get the "

"subdomain list while offline\n"));

} else {

DEBUG(SSSDBG_OP_FAILURE,

("Failed to connect to IPA server: [%d](%s)\n",

ret, strerror(ret)));

}

goto fail;

}

ret = ipa_subdomains_handler_get(ctx, IPA_SUBDOMAINS_RANGES);

if (ret != EOK && ret != EAGAIN) {

goto fail;

}

return;

fail:

be_req_terminate(ctx->be_req, dp_error, ret, NULL);

}

static errno_t

ipa_subdomains_handler_get(struct ipa_subdomains_req_ctx *ctx,

enum ipa_subdomains_req_type type)

{

struct tevent_req *req;

struct sdap_search_base *base;

struct ipa_subdomains_req_params *params;

if (type >= IPA_SUBDOMAINS_MAX) {

return EINVAL;

}

params = &subdomain_requests[type];

base = ctx->search_bases[ctx->search_base_iter];

if (base == NULL) {

return EOK;

}

talloc_free(ctx->current_filter);

ctx->current_filter = sdap_get_id_specific_filter(ctx, params->filter,

base->filter);

if (ctx->current_filter == NULL) {

return ENOMEM;

}

req = sdap_get_generic_send(ctx, ctx->sd_ctx->be_ctx->ev,

ctx->sd_ctx->sdap_id_ctx->opts,

sdap_id_op_handle(ctx->sdap_op),

base->basedn, base->scope,

ctx->current_filter, params->attrs, NULL, 0,

dp_opt_get_int(ctx->sd_ctx->sdap_id_ctx->opts->basic,

SDAP_SEARCH_TIMEOUT), false);

if (req == NULL) {

DEBUG(SSSDBG_OP_FAILURE, ("sdap_get_generic_send failed.\n"));

return ENOMEM;

}

tevent_req_set_callback(req, params->cb, ctx);

return EAGAIN;

}

static void ipa_subdomains_handler_done(struct tevent_req *req)

{

int ret;

size_t reply_count;

struct sysdb_attrs **reply = NULL;

struct ipa_subdomains_req_ctx *ctx;

struct sss_domain_info *domain;

bool refresh_has_changes = false;

int dp_error = DP_ERR_FATAL;

ctx = tevent_req_callback_data(req, struct ipa_subdomains_req_ctx);

domain = ctx->sd_ctx->be_ctx->domain;

ret = sdap_get_generic_recv(req, ctx, &reply_count, &reply);

talloc_zfree(req);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("sdap_get_generic_send request failed.\n"));

goto done;

}

if (reply_count) {

ctx->reply = talloc_realloc(ctx, ctx->reply, struct sysdb_attrs *,

ctx->reply_count + reply_count);

if (ctx->reply == NULL) {

ret = ENOMEM;

goto done;

}

memcpy(ctx->reply+ctx->reply_count, reply,

reply_count * sizeof(struct sysdb_attrs *));

ctx->reply_count += reply_count;

}

ctx->search_base_iter++;

ret = ipa_subdomains_handler_get(ctx, IPA_SUBDOMAINS_SLAVE);

if (ret == EAGAIN) {

return;

} else if (ret != EOK) {

goto done;

}

ret = ipa_subdomains_refresh(ctx->sd_ctx, ctx->reply_count, ctx->reply,

&refresh_has_changes);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("Failed to refresh subdomains.\n"));

goto done;

}

if (refresh_has_changes) {

ret = sysdb_update_subdomains(domain);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("sysdb_update_subdomains failed.\n"));

goto done;

}

ret = ipa_ad_subdom_refresh(ctx->sd_ctx->be_ctx, ctx->sd_ctx->id_ctx,

domain);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("ipa_ad_subdom_refresh failed.\n"));

goto done;

}

ret = sss_write_domain_mappings(domain,

dp_opt_get_bool(ctx->sd_ctx->id_ctx->ipa_options->basic,

IPA_SERVER_MODE));

if (ret != EOK) {

DEBUG(SSSDBG_MINOR_FAILURE,

("sss_krb5_write_mappings failed.\n"));

/* Just continue */

}

}

ret = sysdb_master_domain_update(domain);

if (ret != EOK) {

goto done;

}

if (domain->flat_name == NULL ||

domain->domain_id == NULL ||

domain->realm == NULL) {

ctx->search_base_iter = 0;

ctx->search_bases = ctx->sd_ctx->master_search_bases;

ret = ipa_subdomains_handler_get(ctx, IPA_SUBDOMAINS_MASTER);

if (ret == EAGAIN) {

return;

} else if (ret != EOK) {

goto done;

}

} else {

ret = EOK;

}

done:

if (ret == EOK) {

dp_error = DP_ERR_OK;

}

be_req_terminate(ctx->be_req, dp_error, ret, NULL);

}

static void ipa_subdomains_handler_ranges_done(struct tevent_req *req)

{

errno_t ret;

int dp_error = DP_ERR_FATAL;

size_t reply_count;

struct sysdb_attrs **reply = NULL;

struct ipa_subdomains_req_ctx *ctx;

struct range_info **range_list = NULL;

struct sysdb_ctx *sysdb;

struct sss_domain_info *domain;

ctx = tevent_req_callback_data(req, struct ipa_subdomains_req_ctx);

domain = ctx->sd_ctx->be_ctx->domain;

sysdb = domain->sysdb;

ret = sdap_get_generic_recv(req, ctx, &reply_count, &reply);

talloc_zfree(req);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("sdap_get_generic_send request failed.\n"));

goto done;

}

ret = ipa_ranges_parse_results(ctx, reply_count, reply, &range_list);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE,

("ipa_ranges_parse_results request failed.\n"));

goto done;

}

ret = sysdb_update_ranges(sysdb, range_list);

talloc_free(range_list);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("sysdb_update_ranges failed.\n"));

goto done;

}

ctx->search_base_iter = 0;

ctx->search_bases = ctx->sd_ctx->search_bases;

ret = ipa_subdomains_handler_get(ctx, IPA_SUBDOMAINS_SLAVE);

if (ret == EAGAIN) {

return;

} else if (ret != EOK) {

goto done;

}

DEBUG(SSSDBG_OP_FAILURE, ("No search base for ranges available.\n"));

ret = EINVAL;

done:

if (ret == EOK) {

dp_error = DP_ERR_OK;

}

be_req_terminate(ctx->be_req, dp_error, ret, NULL);

}

static void ipa_subdomains_handler_master_done(struct tevent_req *req)

{

errno_t ret;

int dp_error = DP_ERR_FATAL;

size_t reply_count;

struct sysdb_attrs **reply = NULL;

struct ipa_subdomains_req_ctx *ctx;

ctx = tevent_req_callback_data(req, struct ipa_subdomains_req_ctx);

ret = sdap_get_generic_recv(req, ctx, &reply_count, &reply);

talloc_zfree(req);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("sdap_get_generic_send request failed.\n"));

goto done;

}

if (reply_count) {

const char *flat = NULL;

const char *id = NULL;

ret = sysdb_attrs_get_string(reply[0], IPA_FLATNAME, &flat);

if (ret != EOK) {

goto done;

}

ret = sysdb_attrs_get_string(reply[0], IPA_SID, &id);

if (ret != EOK) {

goto done;

}

ret = sysdb_master_domain_add_info(ctx->sd_ctx->be_ctx->domain,

flat, id);

} else {

ctx->search_base_iter++;

ret = ipa_subdomains_handler_get(ctx, IPA_SUBDOMAINS_MASTER);

if (ret == EAGAIN) {

return;

} else if (ret != EOK) {

goto done;

}

/* Right now we know there has been an error

DEBUG(SSSDBG_CRIT_FAILURE, ("Master domain record not found!\n"));

if (!ctx->sd_ctx->configured_explicit) {

ctx->sd_ctx->disabled_until = time(NULL) +

IPA_SUBDOMAIN_DISABLED_PERIOD;

}

ret = EIO;

}

done:

if (ret == EOK) {

dp_error = DP_ERR_OK;

}

be_req_terminate(ctx->be_req, dp_error, ret, NULL);

}

static void ipa_subdom_online_cb(void *pvt);

static void ipa_subdom_timer_refresh(struct tevent_context *ev,

struct tevent_timer *te,

struct timeval current_time,

void *pvt)

{

ipa_subdom_online_cb(pvt);

}

static void ipa_subdom_be_req_callback(struct be_req *be_req,

int dp_err, int dp_ret,

const char *errstr)

{

talloc_free(be_req);

}

static void ipa_subdom_reset_timeouts_cb(void *pvt)

{

struct ipa_subdomains_ctx *ctx;

ctx = talloc_get_type(pvt, struct ipa_subdomains_ctx);

if (ctx == NULL) {

DEBUG(SSSDBG_CRIT_FAILURE, ("Bad private pointer\n"));

return;

}

DEBUG(SSSDBG_TRACE_ALL, ("Resetting last_refreshed and disabled_until.\n"));

ctx->last_refreshed = 0;

ctx->disabled_until = 0;

}

static void ipa_subdom_online_cb(void *pvt)

{

struct ipa_subdomains_ctx *ctx;

struct be_req *be_req;

struct timeval tv;

uint32_t refresh_interval;

ctx = talloc_get_type(pvt, struct ipa_subdomains_ctx);

if (!ctx) {

DEBUG(SSSDBG_CRIT_FAILURE, ("Bad private pointer\n"));

return;

}

ctx->disabled_until = 0;

refresh_interval = ctx->be_ctx->domain->subdomain_refresh_interval;

be_req = be_req_create(ctx, NULL, ctx->be_ctx,

ipa_subdom_be_req_callback, NULL);

if (be_req == NULL) {

DEBUG(SSSDBG_CRIT_FAILURE, ("be_req_create() failed.\n"));

return;

}

ipa_subdomains_retrieve(ctx, be_req);

tv = tevent_timeval_current_ofs(refresh_interval, 0);

ctx->timer_event = tevent_add_timer(ctx->be_ctx->ev, ctx, tv,

ipa_subdom_timer_refresh, ctx);

if (!ctx->timer_event) {

DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to add subdom timer event\n"));

}

}

static void ipa_subdom_offline_cb(void *pvt)

{

struct ipa_subdomains_ctx *ctx;

ctx = talloc_get_type(pvt, struct ipa_subdomains_ctx);

if (ctx) {

talloc_zfree(ctx->timer_event);

}

}

static errno_t get_config_status(struct be_ctx *be_ctx,

bool *configured_explicit)

{

int ret;

TALLOC_CTX *tmp_ctx = NULL;

char *tmp_str;

tmp_ctx = talloc_new(NULL);

if (tmp_ctx == NULL) {

DEBUG(SSSDBG_OP_FAILURE, ("talloc_new failed.\n"));

return ENOMEM;

}

ret = confdb_get_string(be_ctx->cdb, tmp_ctx, be_ctx->conf_path,

CONFDB_DOMAIN_SUBDOMAINS_PROVIDER, NULL,

&tmp_str);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("confdb_get_string failed.\n"));

goto done;

}

if (tmp_str == NULL) {

*configured_explicit = false;

} else {

*configured_explicit = true;

}

DEBUG(SSSDBG_TRACE_ALL, ("IPA subdomain provider is configured %s.\n",

*configured_explicit ? "explicit" : "implicit"));

ret = EOK;

done:

talloc_free(tmp_ctx);

return ret;

}

void ipa_subdomains_handler(struct be_req *be_req)

{

struct be_ctx *be_ctx = be_req_get_be_ctx(be_req);

struct ipa_subdomains_ctx *ctx;

time_t now;

ctx = talloc_get_type(be_ctx->bet_info[BET_SUBDOMAINS].pvt_bet_data,

struct ipa_subdomains_ctx);

if (!ctx) {

be_req_terminate(be_req, DP_ERR_FATAL, EINVAL, NULL);

return;

}

now = time(NULL);

if (ctx->disabled_until > now) {

DEBUG(SSSDBG_TRACE_ALL, ("Subdomain provider disabled.\n"));

be_req_terminate(be_req, DP_ERR_OK, EOK, NULL);

return;

}

if (ctx->last_refreshed > now - IPA_SUBDOMAIN_REFRESH_LIMIT) {

be_req_terminate(be_req, DP_ERR_OK, EOK, NULL);

return;

}

ipa_subdomains_retrieve(ctx, be_req);

}

struct bet_ops ipa_subdomains_ops = {

.handler = ipa_subdomains_handler,

.finalize = NULL

};

int ipa_subdom_init(struct be_ctx *be_ctx,

struct ipa_id_ctx *id_ctx,

struct bet_ops **ops,

void **pvt_data)

{

struct ipa_subdomains_ctx *ctx;

int ret;

bool configured_explicit = false;

ret = get_config_status(be_ctx, &configured_explicit);

if (ret != EOK) {

DEBUG(SSSDBG_OP_FAILURE, ("get_config_status failed.\n"));

return ret;

}

ctx = talloc_zero(id_ctx, struct ipa_subdomains_ctx);

if (ctx == NULL) {

DEBUG(SSSDBG_CRIT_FAILURE, ("talloc_zero failed.\n"));

return ENOMEM;

}

ctx->be_ctx = be_ctx;

ctx->id_ctx = id_ctx;

ctx->sdap_id_ctx = id_ctx->sdap_id_ctx;

ctx->search_bases = id_ctx->ipa_options->subdomains_search_bases;

ctx->master_search_bases = id_ctx->ipa_options->master_domain_search_bases;

ctx->ranges_search_bases = id_ctx->ipa_options->ranges_search_bases;

ctx->configured_explicit = configured_explicit;

ctx->disabled_until = 0;

*ops = &ipa_subdomains_ops;

*pvt_data = ctx;

ret = be_add_unconditional_online_cb(ctx, be_ctx,

ipa_subdom_reset_timeouts_cb, ctx,

NULL);

if (ret != EOK) {

DEBUG(SSSDBG_MINOR_FAILURE,

("Failed to add subdom reset timeouts callback"));

}

ret = be_add_online_cb(ctx, be_ctx, ipa_subdom_online_cb, ctx, NULL);

if (ret != EOK) {

DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to add subdom online callback"));

}

ret = be_add_offline_cb(ctx, be_ctx, ipa_subdom_offline_cb, ctx, NULL);

if (ret != EOK) {

DEBUG(SSSDBG_MINOR_FAILURE, ("Failed to add subdom offline callback"));

}

return EOK;

}

int ipa_ad_subdom_init(struct be_ctx *be_ctx,

struct ipa_id_ctx *id_ctx)

{

char *realm;

char *hostname;

if (dp_opt_get_bool(id_ctx->ipa_options->basic,

IPA_SERVER_MODE) == false) {

return EOK;

}

/* The IPA code relies on the default FQDN format to unparse user

if ((strcmp(be_ctx->domain->names->fq_fmt,

CONFDB_DEFAULT_FULL_NAME_FORMAT) != 0)

&& (strcmp(be_ctx->domain->names->fq_fmt,