f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder/*
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder SSSD
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder sdap_access.h
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder Authors:
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder Stephen Gallagher <sgallagh@redhat.com>
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder Copyright (C) 2010 Red Hat
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder This program is free software; you can redistribute it and/or modify
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder it under the terms of the GNU General Public License as published by
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder the Free Software Foundation; either version 3 of the License, or
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder (at your option) any later version.
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder This program is distributed in the hope that it will be useful,
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder but WITHOUT ANY WARRANTY; without even the implied warranty of
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder GNU General Public License for more details.
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder You should have received a copy of the GNU General Public License
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder along with this program. If not, see <http://www.gnu.org/licenses/>.
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder*/
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#ifndef SDAP_ACCESS_H_
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define SDAP_ACCESS_H_
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#include "providers/backend.h"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#include "providers/ldap/ldap_common.h"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder/* Attributes in sysdb, used for caching last values of lockout or filter
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder * access control checks.
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder */
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define SYSDB_LDAP_ACCESS_FILTER "ldap_access_filter_allow"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define SYSDB_LDAP_ACCESS_CACHED_LOCKOUT "ldap_access_lockout_allow"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder/* names of ppolicy attributes */
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define SYSDB_LDAP_ACCESS_LOCKED_TIME "pwdAccountLockedTime"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define SYSDB_LDAP_ACESS_LOCKOUT_DURATION "pwdLockoutDuration"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define SYSDB_LDAP_ACCESS_LOCKOUT "pwdLockout"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define LDAP_ACCESS_FILTER_NAME "filter"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define LDAP_ACCESS_EXPIRE_NAME "expire"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define LDAP_ACCESS_EXPIRE_POLICY_REJECT_NAME "pwd_expire_policy_reject"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define LDAP_ACCESS_EXPIRE_POLICY_WARN_NAME "pwd_expire_policy_warn"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define LDAP_ACCESS_EXPIRE_POLICY_RENEW_NAME "pwd_expire_policy_renew"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define LDAP_ACCESS_SERVICE_NAME "authorized_service"
41582f75931338095dc749c455593c859376d593Christian Maeder#define LDAP_ACCESS_HOST_NAME "host"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define LDAP_ACCESS_LOCK_NAME "lockout"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define LDAP_ACCESS_PPOLICY_NAME "ppolicy"
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder
f0cb315452faea6fee8144489629e63e9bd7b303Christian Maeder#define LDAP_ACCOUNT_EXPIRE_SHADOW "shadow"
#define LDAP_ACCOUNT_EXPIRE_AD "ad"
#define LDAP_ACCOUNT_EXPIRE_RHDS "rhds"
#define LDAP_ACCOUNT_EXPIRE_IPA "ipa"
#define LDAP_ACCOUNT_EXPIRE_389DS "389ds"
#define LDAP_ACCOUNT_EXPIRE_NDS "nds"
enum ldap_access_rule {
LDAP_ACCESS_EMPTY = -1,
LDAP_ACCESS_FILTER = 0,
LDAP_ACCESS_EXPIRE,
LDAP_ACCESS_SERVICE,
LDAP_ACCESS_HOST,
LDAP_ACCESS_LOCKOUT,
LDAP_ACCESS_EXPIRE_POLICY_REJECT,
LDAP_ACCESS_EXPIRE_POLICY_WARN,
LDAP_ACCESS_EXPIRE_POLICY_RENEW,
LDAP_ACCESS_PPOLICY,
LDAP_ACCESS_LAST
};
struct sdap_access_ctx {
struct sdap_id_ctx *id_ctx;
const char *filter;
int access_rule[LDAP_ACCESS_LAST + 1];
};
struct tevent_req *
sdap_pam_access_handler_send(TALLOC_CTX *mem_ctx,
struct sdap_access_ctx *access_ctx,
struct pam_data *pd,
struct dp_req_params *params);
errno_t
sdap_pam_access_handler_recv(TALLOC_CTX *mem_ctx,
struct tevent_req *req,
struct pam_data **_data);
struct tevent_req *
sdap_access_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct be_ctx *be_ctx,
struct sss_domain_info *domain,
struct sdap_access_ctx *access_ctx,
struct sdap_id_conn_ctx *conn,
struct pam_data *pd);
errno_t sdap_access_recv(struct tevent_req *req);
#endif /* SDAP_ACCESS_H_ */