/*
SSSD
LDAP Identity Backend Module
Authors:
Simo Sorce <ssorce@redhat.com>
Copyright (C) 2008 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <errno.h>
#include <time.h>
#include "util/strtonum.h"
#include "providers/ldap/ldap_common.h"
#include "providers/ldap/sdap_async.h"
#include "providers/ldap/sdap_idmap.h"
#include "providers/ldap/sdap_users.h"
#include "providers/ad/ad_common.h"
/* =Users-Related-Functions-(by-name,by-uid)============================== */
struct users_get_state {
char *shortname;
const char *filter_value;
int filter_type;
bool name_is_upn;
char *filter;
const char **attrs;
bool use_id_mapping;
int dp_error;
int sdap_ret;
bool noexist_delete;
};
struct tevent_context *ev,
struct sdap_id_ctx *ctx,
struct sdap_domain *sdom,
struct sdap_id_conn_ctx *conn,
const char *filter_value,
int filter_type,
const char *extra_value,
int attrs_type,
bool noexist_delete)
{
char *endptr;
int ret;
char *sid;
char *ep_filter;
goto done;
}
switch (filter_type) {
case BE_FILTER_WILDCARD:
goto done;
}
break;
case BE_FILTER_NAME:
goto done;
}
/* TODO: Do we have to check the attribute names more carefully? */
if (user_filter == NULL) {
goto done;
}
} else {
goto done;
}
goto done;
}
}
break;
case BE_FILTER_IDNUM:
if (state->use_id_mapping) {
/* If we're ID-mapping, we need to use the objectSID
* in the search filter.
*/
goto done;
}
/* Convert the UID to its objectSID */
if (err == IDMAP_NO_DOMAIN) {
"[%s] did not match any configured ID mapping domain\n",
/* Ignore errors to remove users that were not cached previously */
}
goto done;
} else if (err != IDMAP_SUCCESS) {
"Mapping ID [%s] to SID failed: [%s]\n",
goto done;
}
goto done;
}
} else {
goto done;
}
}
break;
case BE_FILTER_SECID:
goto done;
}
break;
case BE_FILTER_UUID:
"UUID search not configured for this backend.\n");
goto done;
}
goto done;
}
break;
case BE_FILTER_CERT:
"Certificate search not configured for this backend.\n");
goto done;
}
&user_filter);
"sss_cert_derb64_to_ldap_filter failed.\n");
goto done;
}
break;
default:
goto done;
}
goto done;
}
if (user_filter == NULL) {
if (user_filter == NULL) {
goto done;
}
}
/* When mapping IDs or looking for SIDs, we don't want to limit
* ourselves to users with a UID value. But there must be a SID to map
* from.
*/
"(&%s(objectclass=%s)(%s=*)(%s=*))",
} else {
/* When not ID-mapping, make sure there is a non-NULL UID */
"(&%s(objectclass=%s)(%s=*)(&(%s=*)(!(%s=0))))",
}
goto done;
}
/* TODO: handle attrs_type */
goto done;
}
return req;
done:
} else {
}
}
{
struct users_get_state);
if (!subreq) {
return ret;
}
return EOK;
}
{
struct tevent_req);
struct users_get_state);
int ret;
return;
}
/* If POSIX attributes have been requested with an AD server and we
* have no idea about POSIX attributes support, run a one-time check
*/
if (state->use_id_mapping == false &&
return;
}
return;
}
}
{
bool has_posix;
int dp_error;
struct tevent_req);
struct users_get_state);
/* We can only finish the id_op on error as the connection
* is re-used by the user search
*/
/* retry */
}
return;
}
}
/* If the check ran to completion, we know for certain about the attributes
*/
return;
}
}
{
struct users_get_state);
} else {
}
if (!subreq) {
return;
}
}
{
struct tevent_req);
struct users_get_state);
char *endptr;
int ret;
const char *del_name;
/* retry */
return;
}
return;
}
SDAP_RFC2307_FALLBACK_TO_LOCAL_USERS) == true)) {
bool fallback;
switch (state->filter_type) {
case BE_FILTER_NAME:
uid = -1;
fallback = true;
break;
case BE_FILTER_IDNUM:
return;
}
fallback = true;
break;
default:
fallback = false;
break;
}
if (fallback) {
}
}
}
return;
}
switch (state->filter_type) {
case BE_FILTER_ENUM:
return;
case BE_FILTER_NAME:
if (state->name_is_upn == true) {
break;
}
} else {
}
break;
}
return;
}
break;
case BE_FILTER_IDNUM:
return;
}
return;
}
break;
case BE_FILTER_SECID:
case BE_FILTER_UUID:
* group we have nothing to do here. */
break;
case BE_FILTER_WILDCARD:
/* We can't know if all users are up-to-date, especially in a large
* environment. Do not delete any records, let the responder fetch
* the entries they are requested in
*/
break;
case BE_FILTER_CERT:
return;
}
break;
default:
return;
}
}
/* FIXME - return sdap error so that we know the user was not found */
}
{
struct users_get_state);
if (dp_error_out) {
}
if (sdap_ret) {
}
return EOK;
}
/* =Groups-Related-Functions-(by-name,by-uid)============================= */
struct groups_get_state {
const char *filter_value;
int filter_type;
char *filter;
const char **attrs;
bool use_id_mapping;
int dp_error;
int sdap_ret;
bool noexist_delete;
bool no_members;
};
struct tevent_context *ev,
struct sdap_id_ctx *ctx,
struct sdap_domain *sdom,
struct sdap_id_conn_ctx *conn,
const char *filter_value,
int filter_type,
int attrs_type,
bool noexist_delete,
bool no_members)
{
char *clean_value;
char *endptr;
int ret;
char *sid;
char *oc_list;
goto done;
}
switch(filter_type) {
case BE_FILTER_WILDCARD:
goto done;
}
break;
case BE_FILTER_NAME:
goto done;
}
goto done;
}
break;
case BE_FILTER_IDNUM:
if (state->use_id_mapping) {
/* If we're ID-mapping, we need to use the objectSID
* in the search filter.
*/
goto done;
}
/* Convert the GID to its objectSID */
if (err == IDMAP_NO_DOMAIN) {
"[%s] did not match any configured ID mapping domain\n",
/* Ignore errors to remove users that were not cached previously */
}
goto done;
} else if (err != IDMAP_SUCCESS) {
"Mapping ID [%s] to SID failed: [%s]\n",
goto done;
}
goto done;
}
} else {
goto done;
}
}
break;
case BE_FILTER_SECID:
goto done;
}
break;
case BE_FILTER_UUID:
"UUID search not configured for this backend.\n");
goto done;
}
goto done;
}
break;
default:
goto done;
}
goto done;
}
goto done;
}
/* When mapping IDs or looking for SIDs, we don't want to limit
* ourselves to groups with a GID value
*/
"(&(%s=%s)(%s)(%s=*))",
} else {
"(&(%s=%s)(%s)(%s=*)(&(%s=*)(!(%s=0))))",
}
goto done;
}
/* TODO: handle attrs_type */
|| state->no_members) ?
(const char **)member_filter : NULL,
goto done;
}
return req;
done:
} else {
}
}
{
struct groups_get_state);
if (!subreq) {
return ret;
}
return EOK;
}
{
struct tevent_req);
struct groups_get_state);
int ret;
return;
}
/* If POSIX attributes have been requested with an AD server and we
* have no idea about POSIX attributes support, run a one-time check
*/
if (state->use_id_mapping == false &&
return;
}
return;
}
}
{
bool has_posix;
int dp_error;
struct tevent_req);
struct groups_get_state);
/* We can only finish the id_op on error as the connection
* is re-used by the group search
*/
/* retry */
}
return;
}
}
/* If the check ran to completion, we know for certain about the attributes
*/
if (has_posix == false) {
return;
}
}
{
struct groups_get_state);
} else {
}
state->no_members);
if (!subreq) {
return;
}
}
{
struct tevent_req);
struct groups_get_state);
char *endptr;
int ret;
/* retry */
return;
}
return;
}
return;
}
switch (state->filter_type) {
case BE_FILTER_ENUM:
return;
case BE_FILTER_NAME:
return;
}
break;
case BE_FILTER_IDNUM:
return;
}
return;
}
break;
case BE_FILTER_SECID:
case BE_FILTER_UUID:
* group we have nothing to do here. */
break;
case BE_FILTER_WILDCARD:
/* We can't know if all groups are up-to-date, especially in
* a large environment. Do not delete any records, let the
* responder fetch the entries they are requested in.
*/
break;
default:
return;
}
}
}
{
struct groups_get_state);
if (dp_error_out) {
}
if (sdap_ret) {
}
return EOK;
}
/* =Get-Groups-for-User================================================== */
struct groups_by_user_state {
const char *filter_value;
int filter_type;
const char *extra_value;
const char **attrs;
int dp_error;
int sdap_ret;
bool noexist_delete;
};
const char *name)
{
return ENOMEM;
}
: 0;
goto done;
}
"Failed to set initgroups expire attribute\n");
goto done;
}
done:
return ret;
}
struct tevent_context *ev,
struct sdap_id_ctx *ctx,
struct sdap_domain *sdom,
struct sdap_id_conn_ctx *conn,
const char *filter_value,
int filter_type,
const char *extra_value,
bool noexist_delete)
{
int ret;
goto fail;
}
goto fail;
}
return req;
fail:
return req;
}
{
struct groups_by_user_state);
if (!subreq) {
return ret;
}
return EOK;
}
{
struct tevent_req);
struct groups_by_user_state);
int ret;
return;
}
if (!subreq) {
return;
}
}
{
struct tevent_req);
struct groups_by_user_state);
int ret;
const char *cname;
/* retry */
return;
}
return;
}
/* state->filter_value is still the name used for the original req. The cached
* object might have a different name, e.g. a fully-qualified name. */
&cname);
"Failed to canonicalize name, using [%s] [%d]: %s.\n",
}
}
case ENOENT:
if (state->noexist_delete == true) {
return;
}
}
break;
case EOK:
return;
}
break;
default:
return;
}
}
{
struct groups_by_user_state);
if (dp_error_out) {
}
if (sdap_ret) {
}
return EOK;
}
/* =Get-Account-Info-Call================================================= */
/* FIXME: embed this function in sssd_be and only call out
* specific functions from modules ? */
struct tevent_context *ev,
struct sdap_id_ctx *ctx,
struct sdap_domain *sdom,
struct sdap_id_conn_ctx *conn,
const char *filter_value,
int filter_type,
int attrs_type,
bool noexist_delete);
int *dp_error_out, int *sdap_ret);
{
case BE_REQ_USER:
case BE_REQ_GROUP:
case BE_REQ_SERVICES:
return true;
}
}
return false;
}
/* A generic LDAP account info handler */
struct sdap_handle_acct_req_state {
const char *err;
int dp_error;
int sdap_ret;
};
struct tevent_req *
struct dp_id_data *ar,
struct sdap_id_ctx *id_ctx,
struct sdap_domain *sdom,
struct sdap_id_conn_ctx *conn,
bool noexist_delete)
{
struct sdap_handle_acct_req_state);
if (!req) {
return NULL;
}
goto done;
}
case BE_REQ_USER: /* user */
break;
case BE_REQ_GROUP: /* group */
noexist_delete, false);
break;
case BE_REQ_INITGROUPS: /* init groups for user */
goto done;
}
goto done;
}
break;
case BE_REQ_NETGROUP:
goto done;
}
break;
case BE_REQ_SERVICES:
goto done;
}
break;
case BE_REQ_BY_SECID:
goto done;
}
break;
case BE_REQ_BY_UUID:
goto done;
}
break;
case BE_REQ_USER_AND_GROUP:
goto done;
}
break;
case BE_REQ_BY_CERT:
break;
default: /*fail*/
goto done;
}
if (!subreq) {
goto done;
}
return req;
done:
} else {
}
return req;
}
static void
{
case BE_REQ_USER: /* user */
err = "User lookup failed";
break;
case BE_REQ_GROUP: /* group */
err = "Group lookup failed";
break;
case BE_REQ_INITGROUPS: /* init groups for user */
err = "Init group lookup failed";
break;
case BE_REQ_NETGROUP:
err = "Netgroup lookup failed";
break;
case BE_REQ_SERVICES:
err = "Service lookup failed";
break;
case BE_REQ_BY_SECID:
/* Fallthrough */
case BE_REQ_BY_UUID:
/* Fallthrough */
case BE_REQ_USER_AND_GROUP:
err = "Lookup by SID failed";
break;
case BE_REQ_BY_CERT:
err = "User lookup by certificate failed";
break;
default: /*fail*/
break;
}
return;
}
}
int *sdap_ret)
{
if (_dp_error) {
}
if (_err) {
}
if (sdap_ret) {
}
return EOK;
}
struct get_user_and_group_state {
const char *filter_val;
int filter_type;
int attrs_type;
char *filter;
const char **attrs;
int dp_error;
int sdap_ret;
bool noexist_delete;
};
struct tevent_context *ev,
struct sdap_id_ctx *id_ctx,
struct sdap_domain *sdom,
struct sdap_id_conn_ctx *conn,
const char *filter_val,
int filter_type,
int attrs_type,
bool noexist_delete)
{
int ret;
return NULL;
}
goto fail;
}
goto fail;
}
return req;
fail:
return req;
}
{
struct tevent_req);
struct get_user_and_group_state);
int ret;
return;
}
return;
return;
}
/* Now the search finished fine but did not find an entry.
* Retry with users. */
/* Prefer LDAP over GC for users */
"Switching to LDAP connection for user lookup.\n");
}
}
return;
}
}
{
struct tevent_req);
struct get_user_and_group_state);
int ret;
return;
}
if (state->noexist_delete == true) {
/* The search ran to completion, but nothing was found.
* Delete the existing entry, if any. */
state->filter_val);
return;
}
}
return;
}
/* Both ret and sdap->ret are EOK. Matching user found */
return;
}
int *dp_error_out, int *sdap_ret)
{
struct get_user_and_group_state);
if (dp_error_out) {
}
if (sdap_ret) {
}
return EOK;
}
struct sdap_account_info_handler_state {
};
struct tevent_req *
struct sdap_id_ctx *id_ctx,
struct dp_id_data *data,
struct dp_req_params *params)
{
struct sdap_account_info_handler_state);
return NULL;
}
if (sdap_is_enum_request(data)) {
goto immediately;
}
goto immediately;
}
return req;
/* TODO For backward compatibility we always return EOK to DP now. */
return req;
}
{
const char *error_msg;
int dp_error;
/* TODO For backward compatibility we always return EOK to DP now. */
}
struct tevent_req *req,
struct dp_reply_std *data)
{
return EOK;
}