ldap_common.c revision 83bf46f4066e3d5e838a32357c201de9bd6ecdfd
/*
SSSD
LDAP Provider Common Functions
Authors:
Simo Sorce <ssorce@redhat.com>
Copyright (C) 2008-2010 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "providers/ldap/ldap_common.h"
#include "providers/fail_over.h"
#include "providers/ldap/sdap_async_private.h"
#include "providers/krb5/krb5_common.h"
#include "db/sysdb_sudo.h"
#include "db/sysdb_services.h"
#include "db/sysdb_autofs.h"
#include "util/sss_krb5.h"
#include "util/crypto/sss_crypto.h"
#include "providers/ldap/ldap_opts.h"
#include "providers/ldap/sdap_idmap.h"
/* a fd the child process would log into */
int ldap_child_debug_fd = -1;
int
sdap_domain_destructor(void *mem)
{
struct sdap_domain *dom =
return 0;
}
struct sdap_domain *
struct sss_domain_info *dom)
{
break;
}
}
return sditer;
}
struct sdap_domain *
const char *dn)
{
int match_len;
int best_match_len = 0;
return NULL;
}
if (best_match_len < match_len) {
/*this is a longer match*/
}
}
}
return sdmatch;
}
struct sss_domain_info *dom,
struct sdap_domain **_sdom)
{
struct sdap_domain *sdom;
return ENOMEM;
}
/* Convert the domain name into search base */
"Cannot convert domain name [%s] to base DN [%d]: %s\n",
goto done;
}
done:
}
return ret;
}
struct sdap_domain *sdom_list,
struct sss_domain_info *parent)
{
struct sss_domain_info *dom;
break;
}
}
/* New sdap domain */
"Cannot add new sdap domain for domain %s [%d]: %s\n",
return ret;
}
} else {
}
/* Update search bases */
return ENOMEM;
}
if (ret) {
return ret;
}
}
return EOK;
}
void
struct sss_domain_info *dom)
{
struct sdap_domain *sdom;
}
struct sss_domain_info *dom,
struct confdb_ctx *cdb,
const char *conf_path,
struct sdap_options **_opts)
{
struct sdap_attr_map *default_attr_map;
struct sdap_attr_map *default_user_map;
struct sdap_attr_map *default_group_map;
struct sdap_attr_map *default_netgroup_map;
struct sdap_attr_map *default_service_map;
struct sdap_options *opts;
char *schema;
const char *search_base;
const char *pwd_policy;
int ret;
const char *ldap_deref;
int ldap_deref_val;
int o;
const char *authtok_type;
struct dp_opt_blob authtok_blob;
char *cleartext;
const int search_base_options[] = { SDAP_USER_SEARCH_BASE,
-1 };
goto done;
}
goto done;
}
/* Handle search bases */
if (search_base != NULL) {
for (o = 0; search_base_options[o] != -1; o++) {
goto done;
}
search_base_options[o]));
}
}
} else {
"Search base not set, trying to discover it later when "
"connecting to the LDAP server.\n");
}
/* Default search */
/* User search */
/* Group search base */
/* Netgroup search */
/* Service search */
if (pwd_policy == NULL) {
"Missing password policy, this may not happen.\n");
goto done;
}
"Unsupported password policy [%s].\n", pwd_policy);
goto done;
}
/* account_cache_expiration must be >= than offline_credentials_expiration */
goto done;
}
/* account cache_expiration must not be smaller than
* offline_credentials_expiration to prevent deleting entries that
* still contain credentials valid for offline login.
*
* offline_credentials_expiration == 0 is a special case that says
* that the cached credentials are valid forever. Therefore, the cached
* entries must not be purged from cache.
*/
"Conflicting values for options %s (unlimited) "
"and %s (%d)\n",
goto done;
}
"than value of %s (now %d)\n",
goto done;
}
if (ldap_deref != NULL) {
goto done;
}
}
#ifndef HAVE_LDAP_CONNCB
bool ldap_referrals;
if (ldap_referrals) {
"LDAP referrals are not supported, because the LDAP library "
"is too old, see sssd-ldap(5) for details.\n");
}
#endif
/* schema type */
} else
} else
} else
} else {
goto done;
}
goto done;
}
goto done;
}
goto done;
}
&opts->netgroup_map);
goto done;
}
&opts->service_map);
goto done;
}
/* If there is no KDC, try the deprecated krb5_kdcip option, too */
/* FIXME - this can be removed in a future version */
goto done;
}
if (authtok_type != NULL &&
"trying to convert to cleartext.\n");
return EINVAL;
}
&cleartext);
"password back to cleartext\n");
return ret;
}
return ret;
}
"password");
return ret;
}
}
done:
}
return ret;
}
struct confdb_ctx *cdb,
const char *conf_path,
struct sdap_options *opts,
bool *use_host_filter,
bool *include_regexp,
bool *include_netgroups)
{
const char *search_base;
int ret;
/* search base */
if (search_base != NULL) {
/* set sudo search bases if they are not */
"to default value\n");
return ret;
}
}
} else {
"connecting to the LDAP server.\n");
}
return ret;
}
/* attrs map */
&opts->sudorule_map);
return ret;
}
/* host filter */
return EOK;
}
struct confdb_ctx *cdb,
const char *conf_path,
struct sdap_options *opts)
{
const char *search_base;
struct sdap_attr_map *default_entry_map;
struct sdap_attr_map *default_mobject_map;
int ret;
/* search base */
if (search_base != NULL) {
/* set autofs search bases if they are not */
"to default value\n");
return ret;
}
}
} else {
"connecting to the LDAP server.\n");
}
return ret;
}
/* attribute maps */
switch (opts->schema_type) {
case SDAP_SCHEMA_RFC2307:
break;
case SDAP_SCHEMA_RFC2307BIS:
case SDAP_SCHEMA_IPA_V1:
case SDAP_SCHEMA_AD:
break;
default:
return EINVAL;
}
"Could not get autofs map object attribute map\n");
return ret;
}
&opts->autofs_entry_map);
"Could not get autofs entry object attribute map\n");
return ret;
}
return EOK;
}
struct sdap_search_base ***_search_bases)
{
const char *class_name;
char *unparsed_base;
const char *old_filter = NULL;
*_search_bases = NULL;
switch (class) {
case SDAP_SEARCH_BASE:
class_name = "DEFAULT";
break;
case SDAP_USER_SEARCH_BASE:
class_name = "USER";
break;
case SDAP_GROUP_SEARCH_BASE:
class_name = "GROUP";
break;
class_name = "NETGROUP";
break;
case SDAP_SUDO_SEARCH_BASE:
class_name = "SUDO";
break;
case SDAP_SERVICE_SEARCH_BASE:
class_name = "SERVICE";
break;
case SDAP_AUTOFS_SEARCH_BASE:
class_name = "AUTOFS";
break;
default:
"Unknown search base type: [%d]\n", class);
class_name = "UNKNOWN";
/* Non-fatal */
break;
}
}
const char *unparsed_base,
int scope,
const char *filter,
struct sdap_search_base **_base)
{
struct sdap_search_base *base;
struct ldb_context *ldb;
if (!tmp_ctx) {
goto done;
}
/* Create a throwaway LDB context for validating the DN */
if (!ldb) {
goto done;
}
goto done;
}
goto done;
}
/* Validate the basedn */
if (!ldn) {
goto done;
}
if (!ldb_dn_validate(ldn)) {
"Invalid base DN [%s]\n",
goto done;
}
done:
return ret;
}
const char *unparsed_base,
const char *class_name,
const char *old_filter,
struct sdap_search_base ***_search_bases)
{
struct sdap_search_base **search_bases;
struct ldb_context *ldb;
struct ldb_parse_tree *tree;
char **split_bases;
char *filter;
int count;
int i, c;
if (!tmp_ctx) {
goto done;
}
/* Create a throwaway LDB context for validating the DN */
if (!ldb) {
goto done;
}
&split_bases, &count);
/* The split must be either exactly one value or a multiple of
* three in order to be valid.
* One value: just a base, backwards-compatible with pre-1.7.0 versions
* Multiple: search_base?scope?filter[?search_base?scope?filter]*
*/
goto done;
}
if (count == 1) {
if (!search_bases) {
goto done;
}
if (old_filter != NULL) {
/* Using a deprecated ldap_{user,group}_search_filter */
"option for %s. Please see the documentation on LDAP search "
"bases to see how the obsolete option can be migrated\n",
"for %s. Please see the documentation on LDAP search bases "
"to see how the obsolete option can be migrated\n",
}
&search_bases[0]);
goto done;
}
"Search base added: [%s][%s][%s][%s]\n",
search_bases[0]->basedn,
"SUBTREE",
} else {
if (!search_bases) {
goto done;
}
i = 0;
for (c = 0; c < count; c += 3) {
struct sdap_search_base);
if (!search_bases[i]) {
goto done;
}
if (split_bases[c][0] == '\0') {
"Zero-length search base: [%s]\n", unparsed_base);
goto done;
}
/* Validate the basedn */
if (!ldn) {
goto done;
}
if (!ldb_dn_validate(ldn)) {
"Invalid base DN [%s]\n",
split_bases[c]);
goto done;
}
/* Set the search base DN */
split_bases[c]);
if (!search_bases[i]->basedn) {
goto done;
}
/* Set the search scope for this base DN */
/* If unspecified, default to subtree */
} else {
goto done;
}
/* Get a specialized filter if provided */
} else {
/* Filters need to be enclosed in parentheses
* to be validated properly by ldb_parse_tree()
*/
split_bases[c+2]);
} else {
}
if (!filter) {
goto done;
}
if(!tree) {
"Invalid search filter: [%s]\n", filter);
goto done;
}
filter);
}
"Search base added: [%s][%s][%s][%s]\n",
search_bases[i]->basedn,
i++;
}
search_bases[i] = NULL;
}
done:
return ret;
}
{
}
{
}
{
ctx);
}
struct sdap_id_ctx *ctx,
struct sdap_domain *sdom,
void *pvt)
{
int ret;
/* set up enumeration task */
} else {
/* the enumeration task, runs the cleanup process by itself,
* but if enumeration is not running we need to schedule it */
}
return ret;
}
{
struct sdap_service *service;
struct resolv_hostent *srvaddr;
struct sockaddr_storage *sockaddr;
const char *tmp;
const char *srv_name;
char *new_uri;
return;
}
if (!service) {
return;
}
if (!srvaddr) {
"FATAL: No hostent available for server (%s)\n",
return;
}
return;
}
if (fo_is_srv_lookup(server)) {
if (!tmp) {
}
return;
}
} else {
}
if (!new_uri) {
return;
}
/* free old one and replace with new one */
}
struct tevent_signal *se,
int signum,
int count,
void *siginfo,
void *private_data)
{
char *realm = (char *) private_data;
int ret;
}
orderly_shutdown(0);
}
struct tevent_context *ev,
const char *realm)
{
char *sig_realm;
struct tevent_signal *sige;
BlockSignals(false, SIGTERM);
return ENOMEM;
}
return ENOMEM;
}
return EOK;
}
void sdap_remove_kdcinfo_files_callback(void *pvt)
{
int ret;
struct remove_info_files_ctx);
"be_fo_run_callbacks_at_next_request failed, "
"krb5 info files will not be removed, because "
"it is unclear if they will be recreated properly.\n");
return;
}
"talloc_new failed, cannot remove krb5 info files.\n");
return;
}
}
}
const char *realm,
const char *service_name)
{
int ret;
struct remove_info_files_ctx *ctx;
return ENOMEM;
}
goto done;
}
goto done;
}
done:
}
return ret;
}
char *default_primary,
char *default_realm,
const char *keytab_path)
{
char *sasl_primary;
char *desired_primary;
char *primary_realm;
char *sasl_realm;
char *desired_realm;
bool primary_requested = true;
bool realm_requested = true;
/* Configuration of SASL auth ID and realm */
if (!desired_primary) {
primary_requested = false;
}
*primary_realm = '\0';
"authid contains realm [%s]\n", desired_realm);
} else {
if (!desired_realm) {
realm_requested = false;
}
}
goto done;
}
"Configured SASL auth ID not found in keytab. "
}
"Configured SASL realm not found in keytab. "
}
goto done;
}
goto done;
}
done:
return ret;
}
static const char *
{
char *krb5_realm = NULL;
if (krberr) {
goto done;
}
if (krberr) {
goto done;
}
if (!realm) {
goto done;
}
done:
return realm;
}
struct sdap_service *sdap_service,
struct krb5_service **krb5_service)
{
int ret;
const char *krb5_servers;
const char *krb5_backup_servers;
const char *krb5_realm;
const char *krb5_opt_realm;
if (krb5_opt_realm == NULL) {
"Missing krb5_realm option, will use libkrb default\n");
if (krb5_realm == NULL) {
"Cannot determine the Kerberos realm, aborting\n");
goto done;
}
} else {
if (krb5_realm == NULL) {
goto done;
}
}
&service);
goto done;
}
goto done;
}
goto done;
}
goto done;
}
*krb5_service = service;
done:
return ret;
}
struct sdap_service *service,
const char *service_name,
const char *dns_service_name,
const char *urls,
bool primary)
{
char *srv_user_data;
int i;
if (!tmp_ctx) {
return ENOMEM;
}
/* split server parm into a list */
goto done;
}
/* now for each URI add a new server to the failover service */
for (i = 0; list[i]; i++) {
if (be_fo_is_srv_identifier(list[i])) {
if (!primary) {
"Failed to add server [%s] to failover service: "
"SRV resolution only allowed for primary servers!\n",
list[i]);
continue;
}
if (!dns_service_name) {
"Missing DNS service name for service [%s].\n",
goto done;
}
if (!srv_user_data) {
goto done;
}
BE_FO_PROTO_TCP, false, srv_user_data);
if (ret) {
goto done;
}
continue;
}
if (ret != LDAP_SUCCESS) {
"Failed to parse ldap URI (%s)!\n", list[i]);
goto done;
}
"The LDAP URI (%s) did not contain a host name\n",
list[i]);
continue;
}
/* It could be ipv6 address in square brackets. Remove
* the brackets if needed. */
goto done;
}
if (ret) {
goto done;
}
}
done:
return ret;
}
static inline errno_t
const char *service_name, const char *dns_service_name,
const char *urls)
{
dns_service_name, urls, true);
}
static inline errno_t
const char *service_name, const char *dns_service_name,
const char *urls)
{
dns_service_name, urls, false);
}
{
}
const char *service_name, const char *dns_service_name,
const char *urls, const char *backup_urls,
struct sdap_service **_service)
{
struct sdap_service *service;
int ret;
if (!tmp_ctx) {
return ENOMEM;
}
if (!service) {
goto done;
}
goto done;
}
goto done;
}
if (!urls) {
"No primary servers defined, using service discovery\n");
}
urls);
goto done;
}
if (backup_urls) {
goto done;
}
}
goto done;
}
done:
}
return ret;
}
errno_t string_to_shadowpw_days(const char *s, long *d)
{
long l;
char *endptr;
if (s == NULL || *s == '\0') {
*d = -1;
return EOK;
}
errno = 0;
if (errno != 0) {
return errno;
}
if (*endptr != '\0') {
return EINVAL;
}
if (l < -1) {
"Input string contains not allowed negative value [%ld].\n",
l);
return EINVAL;
}
*d = l;
return EOK;
}
struct sdap_attr_map *map,
const char *ldap_name,
char **sysdb_name)
{
size_t i;
for (i = 0; i < map_size; i++) {
/* Skip map entries with no name (may depend on
* schema selected)
*/
/* Check if it is a mapped attribute */
}
if (i < map_size) {
/* We found a mapped name, return that */
} else {
/* Not mapped, use the same name */
}
if (!*sysdb_name) {
return ENOMEM;
}
return EOK;
}
struct sdap_attr_map *map,
struct sysdb_attrs *recvd_attrs,
char ***missing_attrs)
{
size_t attr_count = 0;
size_t i, j, k;
const char **expected_attrs;
char *sysdb_name;
if (!recvd_attrs || !missing_attrs) {
return EINVAL;
}
if (!tmp_ctx) {
return ENOMEM;
}
&expected_attrs, &attr_count);
goto done;
}
/* Allocate the maximum possible values for missing_attrs, to
* be on the safe side
*/
if (!missing) {
goto done;
}
k = 0;
/* Check for each expected attribute */
for (i = 0; i < attr_count; i++) {
expected_attrs[i],
&sysdb_name);
goto done;
}
/* objectClass is a special-case and we need to
* check for it explicitly.
*/
continue;
}
/* GECOS is another special case. Its value can come
* either from the 'gecos' attribute or the 'cn'
* attribute. It's best if we just never remove it.
*/
continue;
}
for (j = 0; j < recvd_attrs->num; j++) {
/* Check whether this expected attribute appeared in the
* received attributes and had a non-zero number of
* values.
*/
(recvd_attrs->a[j].num_values > 0)) {
break;
}
}
if (j < recvd_attrs->num) {
/* Attribute was found, therefore not missing */
} else {
/* Attribute could not be found. Add to the missing list */
k++;
}
}
if (k == 0) {
*missing_attrs = NULL;
} else {
/* Terminate the list */
}
done:
return ret;
}
bool sdap_is_secure_uri(const char *uri)
{
/* LDAPS URI's are secure channels */
return true;
}
return false;
}
const char *base_filter,
const char *extra_filter)
{
if (!extra_filter) {
}
if (extra_filter[0] == '(') {
} else {
}
return filter; /* NULL or not */
}
const char *base_filter)
{
if (base_filter[0] == '(') {
/* This filter is wrapped in parentheses.
* Pass it as-is to the openldap libraries.
*/
} else {
}
return filter;
}
struct sdap_idmap_ctx *idmap_ctx,
struct sysdb_attrs *sysdb_attrs,
const char *sid_attr,
char **_sid_str)
{
enum idmap_error_code err;
struct ldb_message_element *el;
char *sid_str;
"No [%s] attribute while id-mapping. [%d][%s]\n",
return ENOENT;
}
return ENOMEM;
}
} else {
&sid_str);
if (err != IDMAP_SUCCESS) {
"Could not convert SID: [%s]\n",
return EIO;
}
}
return EOK;
}
struct sdap_id_conn_ctx *
struct sdap_service *sdap_service)
{
struct sdap_id_conn_ctx *conn;
return NULL;
}
/* Create a connection cache */
return NULL;
}
return conn;
}
struct sdap_id_ctx *
struct sdap_service *sdap_service)
{
struct sdap_id_ctx *sdap_ctx;
return NULL;
}
/* There should be at least one connection context */
return NULL;
}
return sdap_ctx;
}