sdap_access.h revision 2a91d3dd0ce4387332db27bd1a0c0005c74f870e
e07d9cb85217949d497b02d7211de8a197d2f2ebzf/*
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang SSSD
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf sdap_access.h
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Authors:
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Stephen Gallagher <sgallagh@redhat.com>
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf Copyright (C) 2010 Red Hat
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This program is free software; you can redistribute it and/or modify
e07d9cb85217949d497b02d7211de8a197d2f2ebzf it under the terms of the GNU General Public License as published by
e07d9cb85217949d497b02d7211de8a197d2f2ebzf the Free Software Foundation; either version 3 of the License, or
e07d9cb85217949d497b02d7211de8a197d2f2ebzf (at your option) any later version.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf This program is distributed in the hope that it will be useful,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf but WITHOUT ANY WARRANTY; without even the implied warranty of
e07d9cb85217949d497b02d7211de8a197d2f2ebzf MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
e07d9cb85217949d497b02d7211de8a197d2f2ebzf GNU General Public License for more details.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf You should have received a copy of the GNU General Public License
e07d9cb85217949d497b02d7211de8a197d2f2ebzf along with this program. If not, see <http://www.gnu.org/licenses/>.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf*/
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#ifndef SDAP_ACCESS_H_
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define SDAP_ACCESS_H_
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#include "providers/dp_backend.h"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#include "providers/ldap/ldap_common.h"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf/* Attributes in sysdb, used for caching last values of lockout or filter
1a932f2eab9b00d713acc4205d96ca2485bf2712Quaker Fang * access control checks.
e07d9cb85217949d497b02d7211de8a197d2f2ebzf */
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define SYSDB_LDAP_ACCESS_FILTER "ldap_access_filter_allow"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define SYSDB_LDAP_ACCESS_CACHED_LOCKOUT "ldap_access_lockout_allow"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf/* names of ppolicy attributes */
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define SYSDB_LDAP_ACCESS_LOCKED_TIME "pwdAccountLockedTime"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define SYSDB_LDAP_ACCESS_LOCKOUT "pwdLockout"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define LDAP_ACCESS_FILTER_NAME "filter"
da14cebe459d3275048785f25bd869cb09b5307fEric Cheng#define LDAP_ACCESS_EXPIRE_NAME "expire"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define LDAP_ACCESS_SERVICE_NAME "authorized_service"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define LDAP_ACCESS_HOST_NAME "host"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define LDAP_ACCESS_LOCK_NAME "lockout"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define LDAP_ACCOUNT_EXPIRE_SHADOW "shadow"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define LDAP_ACCOUNT_EXPIRE_AD "ad"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define LDAP_ACCOUNT_EXPIRE_RHDS "rhds"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define LDAP_ACCOUNT_EXPIRE_IPA "ipa"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define LDAP_ACCOUNT_EXPIRE_389DS "389ds"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#define LDAP_ACCOUNT_EXPIRE_NDS "nds"
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzfenum ldap_access_rule {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf LDAP_ACCESS_EMPTY = -1,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf LDAP_ACCESS_FILTER = 0,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf LDAP_ACCESS_EXPIRE,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf LDAP_ACCESS_SERVICE,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf LDAP_ACCESS_HOST,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf LDAP_ACCESS_LOCKOUT,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf LDAP_ACCESS_LAST
e07d9cb85217949d497b02d7211de8a197d2f2ebzf};
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzfstruct sdap_access_ctx {
e07d9cb85217949d497b02d7211de8a197d2f2ebzf struct sdap_id_ctx *id_ctx;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf const char *filter;
e07d9cb85217949d497b02d7211de8a197d2f2ebzf int access_rule[LDAP_ACCESS_LAST + 1];
e07d9cb85217949d497b02d7211de8a197d2f2ebzf};
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzfstruct tevent_req *
e07d9cb85217949d497b02d7211de8a197d2f2ebzfsdap_access_send(TALLOC_CTX *mem_ctx,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf struct tevent_context *ev,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf struct be_ctx *be_ctx,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf struct sss_domain_info *domain,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf struct sdap_access_ctx *access_ctx,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf struct sdap_id_conn_ctx *conn,
e07d9cb85217949d497b02d7211de8a197d2f2ebzf struct pam_data *pd);
e07d9cb85217949d497b02d7211de8a197d2f2ebzferrno_t sdap_access_recv(struct tevent_req *req);
e07d9cb85217949d497b02d7211de8a197d2f2ebzf
e07d9cb85217949d497b02d7211de8a197d2f2ebzf#endif /* SDAP_ACCESS_H_ */
e07d9cb85217949d497b02d7211de8a197d2f2ebzf