Context Navigation

source: branches/samba-3.0/source/passdb/pdb_ldap.c

Visit:

Last change on this file was 134, checked in by Paul Smedley, 17 years ago
Update source to 3.0.29
File size: 168.1 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	LDAP protocol helper functions for SAMBA
4	Copyright (C) Jean François Micouleau 1998
5	Copyright (C) Gerald Carter 2001-2003
6	Copyright (C) Shahms King 2001
7	Copyright (C) Andrew Bartlett 2002-2003
8	Copyright (C) Stefan (metze) Metzmacher 2002-2003
9	Copyright (C) Simo Sorce 2006
10
11	This program is free software; you can redistribute it and/or modify
12	it under the terms of the GNU General Public License as published by
13	the Free Software Foundation; either version 2 of the License, or
14	(at your option) any later version.
15
16	This program is distributed in the hope that it will be useful,
17	but WITHOUT ANY WARRANTY; without even the implied warranty of
18	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19	GNU General Public License for more details.
20
21	You should have received a copy of the GNU General Public License
22	along with this program; if not, write to the Free Software
23	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24
25	*/
26
27	/* TODO:
28	* persistent connections: if using NSS LDAP, many connections are made
29	* however, using only one within Samba would be nice
30	*
31	* Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
32	*
33	* Other LDAP based login attributes: accountExpires, etc.
34	* (should be the domain of Samba proper, but the sam_password/struct samu
35	* structures don't have fields for some of these attributes)
36	*
37	* SSL is done, but can't get the certificate based authentication to work
38	* against on my test platform (Linux 2.4, OpenLDAP 2.x)
39	*/
40
41	/* NOTE: this will NOT work against an Active Directory server
42	* due to the fact that the two password fields cannot be retrieved
43	* from a server; recommend using security = domain in this situation
44	* and/or winbind
45	*/
46
47	#include "includes.h"
48
49	#undef DBGC_CLASS
50	#define DBGC_CLASS DBGC_PASSDB
51
52	#include <lber.h>
53	#include <ldap.h>
54
55	/*
56	* Work around versions of the LDAP client libs that don't have the OIDs
57	* defined, or have them defined under the old name.
58	* This functionality is really a factor of the server, not the client
59	*
60	*/
61
62	#if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD)
63	#define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD
64	#elif !defined(LDAP_EXOP_MODIFY_PASSWD)
65	#define LDAP_EXOP_MODIFY_PASSWD "1.3.6.1.4.1.4203.1.11.1"
66	#endif
67
68	#if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
69	#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID
70	#elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
71	#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID ((ber_tag_t) 0x80U)
72	#endif
73
74	#if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
75	#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW
76	#elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
77	#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ((ber_tag_t) 0x82U)
78	#endif
79
80
81	#include "smbldap.h"
82
83	/**********************************************************************
84	Simple helper function to make stuff better readable
85	**********************************************************************/
86
87	static LDAP priv2ld(struct ldapsam_privates priv)
88	{
89	return priv->smbldap_state->ldap_struct;
90	}
91
92	/**********************************************************************
93	Get the attribute name given a user schame version.
94	**********************************************************************/
95
96	static const char* get_userattr_key2string( int schema_ver, int key )
97	{
98	switch ( schema_ver ) {
99	case SCHEMAVER_SAMBAACCOUNT:
100	return get_attr_key2string( attrib_map_v22, key );
101
102	case SCHEMAVER_SAMBASAMACCOUNT:
103	return get_attr_key2string( attrib_map_v30, key );
104
105	default:
106	DEBUG(0,("get_userattr_key2string: unknown schema version specified\n"));
107	break;
108	}
109	return NULL;
110	}
111
112	/**********************************************************************
113	Return the list of attribute names given a user schema version.
114	**********************************************************************/
115
116	const char** get_userattr_list( TALLOC_CTX *mem_ctx, int schema_ver )
117	{
118	switch ( schema_ver ) {
119	case SCHEMAVER_SAMBAACCOUNT:
120	return get_attr_list( mem_ctx, attrib_map_v22 );
121
122	case SCHEMAVER_SAMBASAMACCOUNT:
123	return get_attr_list( mem_ctx, attrib_map_v30 );
124	default:
125	DEBUG(0,("get_userattr_list: unknown schema version specified!\n"));
126	break;
127	}
128
129	return NULL;
130	}
131
132	/**************************************************************************
133	Return the list of attribute names to delete given a user schema version.
134	**************************************************************************/
135
136	static const char** get_userattr_delete_list( TALLOC_CTX *mem_ctx,
137	int schema_ver )
138	{
139	switch ( schema_ver ) {
140	case SCHEMAVER_SAMBAACCOUNT:
141	return get_attr_list( mem_ctx,
142	attrib_map_to_delete_v22 );
143
144	case SCHEMAVER_SAMBASAMACCOUNT:
145	return get_attr_list( mem_ctx,
146	attrib_map_to_delete_v30 );
147	default:
148	DEBUG(0,("get_userattr_delete_list: unknown schema version specified!\n"));
149	break;
150	}
151
152	return NULL;
153	}
154
155
156	/*******************************************************************
157	Generate the LDAP search filter for the objectclass based on the
158	version of the schema we are using.
159	******************************************************************/
160
161	static const char* get_objclass_filter( int schema_ver )
162	{
163	static fstring objclass_filter;
164
165	switch( schema_ver ) {
166	case SCHEMAVER_SAMBAACCOUNT:
167	fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT );
168	break;
169	case SCHEMAVER_SAMBASAMACCOUNT:
170	fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT );
171	break;
172	default:
173	DEBUG(0,("get_objclass_filter: Invalid schema version specified!\n"));
174	break;
175	}
176
177	return objclass_filter;
178	}
179
180	/*****************************************************************
181	Scan a sequence number off OpenLDAP's syncrepl contextCSN
182	******************************************************************/
183
184	static NTSTATUS ldapsam_get_seq_num(struct pdb_methods my_methods, time_t seq_num)
185	{
186	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
187	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
188	LDAPMessage *msg = NULL;
189	LDAPMessage *entry = NULL;
190	TALLOC_CTX *mem_ctx;
191	char **values = NULL;
192	int rc, num_result, num_values, rid;
193	pstring suffix;
194	fstring tok;
195	const char *p;
196	const char **attrs;
197
198	/* Unfortunatly there is no proper way to detect syncrepl-support in
199	* smbldap_connect_system(). The syncrepl OIDs are submitted for publication
200	* but do not show up in the root-DSE yet. Neither we can query the
201	* subschema-context for the syncProviderSubentry or syncConsumerSubentry
202	* objectclass. Currently we require lp_ldap_suffix() to show up as
203	* namingContext. - Guenther
204	*/
205
206	if (!lp_parm_bool(-1, "ldapsam", "syncrepl_seqnum", False)) {
207	return ntstatus;
208	}
209
210	if (!seq_num) {
211	DEBUG(3,("ldapsam_get_seq_num: no sequence_number\n"));
212	return ntstatus;
213	}
214
215	if (!smbldap_has_naming_context(ldap_state->smbldap_state->ldap_struct, lp_ldap_suffix())) {
216	DEBUG(3,("ldapsam_get_seq_num: DIT not configured to hold %s "
217	"as top-level namingContext\n", lp_ldap_suffix()));
218	return ntstatus;
219	}
220
221	mem_ctx = talloc_init("ldapsam_get_seq_num");
222
223	if (mem_ctx == NULL)
224	return NT_STATUS_NO_MEMORY;
225
226	if ((attrs = TALLOC_ARRAY(mem_ctx, const char *, 2)) == NULL) {
227	ntstatus = NT_STATUS_NO_MEMORY;
228	goto done;
229	}
230
231	/* if we got a syncrepl-rid (up to three digits long) we speak with a consumer */
232	rid = lp_parm_int(-1, "ldapsam", "syncrepl_rid", -1);
233	if (rid > 0) {
234
235	/* consumer syncreplCookie: */
236	/* csn=20050126161620Z#0000001#00#00000 */
237	attrs[0] = talloc_strdup(mem_ctx, "syncreplCookie");
238	attrs[1] = NULL;
239	pstr_sprintf( suffix, "cn=syncrepl%d,%s", rid, lp_ldap_suffix());
240
241	} else {
242
243	/* provider contextCSN */
244	/* 20050126161620Z#000009#00#000000 */
245	attrs[0] = talloc_strdup(mem_ctx, "contextCSN");
246	attrs[1] = NULL;
247	pstr_sprintf( suffix, "cn=ldapsync,%s", lp_ldap_suffix());
248
249	}
250
251	rc = smbldap_search(ldap_state->smbldap_state, suffix,
252	LDAP_SCOPE_BASE, "(objectclass=*)", attrs, 0, &msg);
253
254	if (rc != LDAP_SUCCESS) {
255	goto done;
256	}
257
258	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg);
259	if (num_result != 1) {
260	DEBUG(3,("ldapsam_get_seq_num: Expected one entry, got %d\n", num_result));
261	goto done;
262	}
263
264	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg);
265	if (entry == NULL) {
266	DEBUG(3,("ldapsam_get_seq_num: Could not retrieve entry\n"));
267	goto done;
268	}
269
270	values = ldap_get_values(ldap_state->smbldap_state->ldap_struct, entry, attrs[0]);
271	if (values == NULL) {
272	DEBUG(3,("ldapsam_get_seq_num: no values\n"));
273	goto done;
274	}
275
276	num_values = ldap_count_values(values);
277	if (num_values == 0) {
278	DEBUG(3,("ldapsam_get_seq_num: not a single value\n"));
279	goto done;
280	}
281
282	p = values[0];
283	if (!next_token(&p, tok, "#", sizeof(tok))) {
284	DEBUG(0,("ldapsam_get_seq_num: failed to parse sequence number\n"));
285	goto done;
286	}
287
288	p = tok;
289	if (!strncmp(p, "csn=", strlen("csn=")))
290	p += strlen("csn=");
291
292	DEBUG(10,("ldapsam_get_seq_num: got %s: %s\n", attrs[0], p));
293
294	*seq_num = generalized_to_unix_time(p);
295
296	/* very basic sanity check */
297	if (*seq_num <= 0) {
298	DEBUG(3,("ldapsam_get_seq_num: invalid sequence number: %d\n",
299	(int)*seq_num));
300	goto done;
301	}
302
303	ntstatus = NT_STATUS_OK;
304
305	done:
306	if (values != NULL)
307	ldap_value_free(values);
308	if (msg != NULL)
309	ldap_msgfree(msg);
310	if (mem_ctx)
311	talloc_destroy(mem_ctx);
312
313	return ntstatus;
314	}
315
316	/*******************************************************************
317	Run the search by name.
318	******************************************************************/
319
320	int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
321	const char *user,
322	LDAPMessage ** result,
323	const char **attr)
324	{
325	pstring filter;
326	char *escape_user = escape_ldap_string_alloc(user);
327
328	if (!escape_user) {
329	return LDAP_NO_MEMORY;
330	}
331
332	/*
333	* in the filter expression, replace %u with the real name
334	* so in ldap filter, %u MUST exist :-)
335	*/
336	pstr_sprintf(filter, "(&%s%s)", "(uid=%u)",
337	get_objclass_filter(ldap_state->schema_ver));
338
339	/*
340	* have to use this here because $ is filtered out
341	* in pstring_sub
342	*/
343
344
345	all_string_sub(filter, "%u", escape_user, sizeof(pstring));
346	SAFE_FREE(escape_user);
347
348	return smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
349	}
350
351	/*******************************************************************
352	Run the search by rid.
353	******************************************************************/
354
355	static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
356	uint32 rid, LDAPMessage ** result,
357	const char **attr)
358	{
359	pstring filter;
360	int rc;
361
362	pstr_sprintf(filter, "(&(rid=%i)%s)", rid,
363	get_objclass_filter(ldap_state->schema_ver));
364
365	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
366
367	return rc;
368	}
369
370	/*******************************************************************
371	Run the search by SID.
372	******************************************************************/
373
374	static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
375	const DOM_SID sid, LDAPMessage * result,
376	const char **attr)
377	{
378	pstring filter;
379	int rc;
380	fstring sid_string;
381
382	pstr_sprintf(filter, "(&(%s=%s)%s)",
383	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
384	sid_to_string(sid_string, sid),
385	get_objclass_filter(ldap_state->schema_ver));
386
387	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
388
389	return rc;
390	}
391
392	/*******************************************************************
393	Delete complete object or objectclass and attrs from
394	object found in search_result depending on lp_ldap_delete_dn
395	******************************************************************/
396
397	static int ldapsam_delete_entry(struct ldapsam_privates *priv,
398	TALLOC_CTX *mem_ctx,
399	LDAPMessage *entry,
400	const char *objectclass,
401	const char **attrs)
402	{
403	LDAPMod **mods = NULL;
404	char *name;
405	const char *dn;
406	BerElement *ptr = NULL;
407
408	dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry);
409	if (dn == NULL) {
410	return LDAP_NO_MEMORY;
411	}
412
413	if (lp_ldap_delete_dn()) {
414	return smbldap_delete(priv->smbldap_state, dn);
415	}
416
417	/* Ok, delete only the SAM attributes */
418
419	for (name = ldap_first_attribute(priv2ld(priv), entry, &ptr);
420	name != NULL;
421	name = ldap_next_attribute(priv2ld(priv), entry, ptr)) {
422	const char **attrib;
423
424	/* We are only allowed to delete the attributes that
425	really exist. */
426
427	for (attrib = attrs; *attrib != NULL; attrib++) {
428	if (strequal(*attrib, name)) {
429	DEBUG(10, ("ldapsam_delete_entry: deleting "
430	"attribute %s\n", name));
431	smbldap_set_mod(&mods, LDAP_MOD_DELETE, name,
432	NULL);
433	}
434	}
435	ldap_memfree(name);
436	}
437
438	if (ptr != NULL) {
439	ber_free(ptr, 0);
440	}
441
442	smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
443	talloc_autofree_ldapmod(mem_ctx, mods);
444
445	return smbldap_modify(priv->smbldap_state, dn, mods);
446	}
447
448	static time_t ldapsam_get_entry_timestamp( struct ldapsam_privates ldap_state, LDAPMessage entry)
449	{
450	pstring temp;
451	struct tm tm;
452
453	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
454	get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
455	temp))
456	return (time_t) 0;
457
458	if ( !strptime(temp, "%Y%m%d%H%M%SZ", &tm)) {
459	DEBUG(2,("ldapsam_get_entry_timestamp: strptime failed on: %s\n",
460	(char*)temp));
461	return (time_t) 0;
462	}
463	tzset();
464	return timegm(&tm);
465	}
466
467	/**********************************************************************
468	Initialize struct samu from an LDAP query.
469	(Based on init_sam_from_buffer in pdb_tdb.c)
470	*********************************************************************/
471
472	static BOOL init_sam_from_ldap(struct ldapsam_privates *ldap_state,
473	struct samu * sampass,
474	LDAPMessage * entry)
475	{
476	time_t logon_time,
477	logoff_time,
478	kickoff_time,
479	pass_last_set_time,
480	pass_can_change_time,
481	pass_must_change_time,
482	ldap_entry_time,
483	bad_password_time;
484	pstring username,
485	domain,
486	nt_username,
487	fullname,
488	homedir,
489	dir_drive,
490	logon_script,
491	profile_path,
492	acct_desc,
493	workstations;
494	char munged_dial[2048];
495	uint32 user_rid;
496	uint8 smblmpwd[LM_HASH_LEN],
497	smbntpwd[NT_HASH_LEN];
498	BOOL use_samba_attrs = True;
499	uint32 acct_ctrl = 0;
500	uint16 logon_divs;
501	uint16 bad_password_count = 0,
502	logon_count = 0;
503	uint32 hours_len;
504	uint8 hours[MAX_HOURS_LEN];
505	pstring temp;
506	LOGIN_CACHE *cache_entry = NULL;
507	uint32 pwHistLen;
508	pstring tmpstring;
509	BOOL expand_explicit = lp_passdb_expand_explicit();
510
511	/*
512	* do a little initialization
513	*/
514	username[0] = '\0';
515	domain[0] = '\0';
516	nt_username[0] = '\0';
517	fullname[0] = '\0';
518	homedir[0] = '\0';
519	dir_drive[0] = '\0';
520	logon_script[0] = '\0';
521	profile_path[0] = '\0';
522	acct_desc[0] = '\0';
523	munged_dial[0] = '\0';
524	workstations[0] = '\0';
525
526
527	if (sampass == NULL \|\| ldap_state == NULL \|\| entry == NULL) {
528	DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
529	return False;
530	}
531
532	if (priv2ld(ldap_state) == NULL) {
533	DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->"
534	"ldap_struct is NULL!\n"));
535	return False;
536	}
537
538	if (!smbldap_get_single_pstring(priv2ld(ldap_state), entry, "uid",
539	username)) {
540	DEBUG(1, ("init_sam_from_ldap: No uid attribute found for "
541	"this user!\n"));
542	return False;
543	}
544
545	DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
546
547	pstrcpy(nt_username, username);
548
549	pstrcpy(domain, ldap_state->domain_name);
550
551	pdb_set_username(sampass, username, PDB_SET);
552
553	pdb_set_domain(sampass, domain, PDB_DEFAULT);
554	pdb_set_nt_username(sampass, nt_username, PDB_SET);
555
556	/* deal with different attributes between the schema first */
557
558	if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
559	if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
560	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp)) {
561	pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
562	}
563	} else {
564	if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
565	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp)) {
566	user_rid = (uint32)atol(temp);
567	pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
568	}
569	}
570
571	if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
572	DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
573	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
574	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
575	username));
576	return False;
577	}
578
579	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
580	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) {
581	/* leave as default */
582	} else {
583	pass_last_set_time = (time_t) atol(temp);
584	pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
585	}
586
587	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
588	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp)) {
589	/* leave as default */
590	} else {
591	logon_time = (time_t) atol(temp);
592	pdb_set_logon_time(sampass, logon_time, PDB_SET);
593	}
594
595	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
596	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp)) {
597	/* leave as default */
598	} else {
599	logoff_time = (time_t) atol(temp);
600	pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
601	}
602
603	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
604	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp)) {
605	/* leave as default */
606	} else {
607	kickoff_time = (time_t) atol(temp);
608	pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
609	}
610
611	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
612	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp)) {
613	/* leave as default */
614	} else {
615	pass_can_change_time = (time_t) atol(temp);
616	pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
617	}
618
619	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
620	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp)) {
621	/* leave as default */
622	} else {
623	pass_must_change_time = (time_t) atol(temp);
624	pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
625	}
626
627	/* recommend that 'gecos' and 'displayName' should refer to the same
628	* attribute OID. userFullName depreciated, only used by Samba
629	* primary rules of LDAP: don't make a new attribute when one is already defined
630	* that fits your needs; using cn then displayName rather than 'userFullName'
631	*/
632
633	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
634	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname)) {
635	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
636	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname)) {
637	/* leave as default */
638	} else {
639	pdb_set_fullname(sampass, fullname, PDB_SET);
640	}
641	} else {
642	pdb_set_fullname(sampass, fullname, PDB_SET);
643	}
644
645	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
646	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive))
647	{
648	pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
649	} else {
650	pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
651	}
652
653	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
654	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir))
655	{
656	pdb_set_homedir( sampass,
657	talloc_sub_basic(sampass, username, domain,
658	lp_logon_home()),
659	PDB_DEFAULT );
660	} else {
661	pstrcpy( tmpstring, homedir );
662	if (expand_explicit) {
663	standard_sub_basic( username, domain, tmpstring,
664	sizeof(tmpstring) );
665	}
666	pdb_set_homedir(sampass, tmpstring, PDB_SET);
667	}
668
669	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
670	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script))
671	{
672	pdb_set_logon_script( sampass,
673	talloc_sub_basic(sampass, username, domain,
674	lp_logon_script()),
675	PDB_DEFAULT );
676	} else {
677	pstrcpy( tmpstring, logon_script );
678	if (expand_explicit) {
679	standard_sub_basic( username, domain, tmpstring,
680	sizeof(tmpstring) );
681	}
682	pdb_set_logon_script(sampass, tmpstring, PDB_SET);
683	}
684
685	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
686	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path))
687	{
688	pdb_set_profile_path( sampass,
689	talloc_sub_basic( sampass, username, domain,
690	lp_logon_path()),
691	PDB_DEFAULT );
692	} else {
693	pstrcpy( tmpstring, profile_path );
694	if (expand_explicit) {
695	standard_sub_basic( username, domain, tmpstring,
696	sizeof(tmpstring) );
697	}
698	pdb_set_profile_path(sampass, tmpstring, PDB_SET);
699	}
700
701	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
702	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC), acct_desc))
703	{
704	/* leave as default */
705	} else {
706	pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
707	}
708
709	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
710	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations)) {
711	/* leave as default */;
712	} else {
713	pdb_set_workstations(sampass, workstations, PDB_SET);
714	}
715
716	if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
717	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL), munged_dial, sizeof(munged_dial))) {
718	/* leave as default */;
719	} else {
720	pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
721	}
722
723	/* FIXME: hours stuff should be cleaner */
724
725	logon_divs = 168;
726	hours_len = 21;
727	memset(hours, 0xff, hours_len);
728
729	if (ldap_state->is_nds_ldap) {
730	char *user_dn;
731	size_t pwd_len;
732	char clear_text_pw[512];
733
734	/* Make call to Novell eDirectory ldap extension to get clear text password.
735	NOTE: This will only work if we have an SSL connection to eDirectory. */
736	user_dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
737	if (user_dn != NULL) {
738	DEBUG(3, ("init_sam_from_ldap: smbldap_get_dn(%s) returned '%s'\n", username, user_dn));
739
740	pwd_len = sizeof(clear_text_pw);
741	if (pdb_nds_get_password(ldap_state->smbldap_state, user_dn, &pwd_len, clear_text_pw) == LDAP_SUCCESS) {
742	nt_lm_owf_gen(clear_text_pw, smbntpwd, smblmpwd);
743	if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET)) {
744	SAFE_FREE(user_dn);
745	return False;
746	}
747	ZERO_STRUCT(smblmpwd);
748	if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET)) {
749	SAFE_FREE(user_dn);
750	return False;
751	}
752	ZERO_STRUCT(smbntpwd);
753	use_samba_attrs = False;
754	}
755
756	SAFE_FREE(user_dn);
757
758	} else {
759	DEBUG(0, ("init_sam_from_ldap: failed to get user_dn for '%s'\n", username));
760	}
761	}
762
763	if (use_samba_attrs) {
764	if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
765	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp)) {
766	/* leave as default */
767	} else {
768	pdb_gethexpwd(temp, smblmpwd);
769	memset((char *)temp, '\0', strlen(temp)+1);
770	if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
771	return False;
772	ZERO_STRUCT(smblmpwd);
773	}
774
775	if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
776	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp)) {
777	/* leave as default */
778	} else {
779	pdb_gethexpwd(temp, smbntpwd);
780	memset((char *)temp, '\0', strlen(temp)+1);
781	if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
782	return False;
783	ZERO_STRUCT(smbntpwd);
784	}
785	}
786
787	pwHistLen = 0;
788
789	pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
790	if (pwHistLen > 0){
791	uint8 *pwhist = NULL;
792	int i;
793	char history_string[MAX_PW_HISTORY_LEN*64];
794
795	pwHistLen = MIN(pwHistLen, MAX_PW_HISTORY_LEN);
796
797	if ((pwhist = SMB_MALLOC_ARRAY(uint8, pwHistLen * PW_HISTORY_ENTRY_LEN)) == NULL){
798	DEBUG(0, ("init_sam_from_ldap: malloc failed!\n"));
799	return False;
800	}
801	memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
802
803	if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
804	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
805	history_string, sizeof(history_string))) {
806	/* leave as default - zeros */
807	} else {
808	BOOL hex_failed = False;
809	for (i = 0; i < pwHistLen; i++){
810	/* Get the 16 byte salt. */
811	if (!pdb_gethexpwd(&history_string[i64], &pwhist[iPW_HISTORY_ENTRY_LEN])) {
812	hex_failed = True;
813	break;
814	}
815	/* Get the 16 byte MD5 hash of salt+passwd. */
816	if (!pdb_gethexpwd(&history_string[(i*64)+32],
817	&pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN])) {
818	hex_failed = True;
819	break;
820	}
821	}
822	if (hex_failed) {
823	DEBUG(0,("init_sam_from_ldap: Failed to get password history for user %s\n",
824	username));
825	memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
826	}
827	}
828	if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
829	SAFE_FREE(pwhist);
830	return False;
831	}
832	SAFE_FREE(pwhist);
833	}
834
835	if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
836	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp)) {
837	acct_ctrl \|= ACB_NORMAL;
838	} else {
839	acct_ctrl = pdb_decode_acct_ctrl(temp);
840
841	if (acct_ctrl == 0)
842	acct_ctrl \|= ACB_NORMAL;
843
844	pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
845	}
846
847	pdb_set_hours_len(sampass, hours_len, PDB_SET);
848	pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
849
850	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
851	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_COUNT), temp)) {
852	/* leave as default */
853	} else {
854	bad_password_count = (uint32) atol(temp);
855	pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET);
856	}
857
858	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
859	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_TIME), temp)) {
860	/* leave as default */
861	} else {
862	bad_password_time = (time_t) atol(temp);
863	pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
864	}
865
866
867	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
868	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_COUNT), temp)) {
869	/* leave as default */
870	} else {
871	logon_count = (uint32) atol(temp);
872	pdb_set_logon_count(sampass, logon_count, PDB_SET);
873	}
874
875	/* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
876
877	if(!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
878	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_HOURS), temp)) {
879	/* leave as default */
880	} else {
881	pdb_gethexhours(temp, hours);
882	memset((char *)temp, '\0', strlen(temp) +1);
883	pdb_set_hours(sampass, hours, PDB_SET);
884	ZERO_STRUCT(hours);
885	}
886
887	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
888	if (smbldap_get_single_pstring(priv2ld(ldap_state), entry,
889	"uidNumber", temp)) {
890	/* We've got a uid, feed the cache */
891	uid_t uid = strtoul(temp, NULL, 10);
892	store_uid_sid_cache(pdb_get_user_sid(sampass), uid);
893	}
894	}
895
896	/* check the timestamp of the cache vs ldap entry */
897	if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
898	entry)))
899	return True;
900
901	/* see if we have newer updates */
902	if (!(cache_entry = login_cache_read(sampass))) {
903	DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
904	(unsigned int)pdb_get_bad_password_count(sampass),
905	(unsigned int)pdb_get_bad_password_time(sampass)));
906	return True;
907	}
908
909	DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
910	(unsigned int)ldap_entry_time, (unsigned int)cache_entry->entry_timestamp,
911	(unsigned int)cache_entry->bad_password_time));
912
913	if (ldap_entry_time > cache_entry->entry_timestamp) {
914	/* cache is older than directory , so
915	we need to delete the entry but allow the
916	fields to be written out */
917	login_cache_delentry(sampass);
918	} else {
919	/* read cache in */
920	pdb_set_acct_ctrl(sampass,
921	pdb_get_acct_ctrl(sampass) \|
922	(cache_entry->acct_ctrl & ACB_AUTOLOCK),
923	PDB_SET);
924	pdb_set_bad_password_count(sampass,
925	cache_entry->bad_password_count,
926	PDB_SET);
927	pdb_set_bad_password_time(sampass,
928	cache_entry->bad_password_time,
929	PDB_SET);
930	}
931
932	SAFE_FREE(cache_entry);
933	return True;
934	}
935
936	/**********************************************************************
937	Initialize the ldap db from a struct samu. Called on update.
938	(Based on init_buffer_from_sam in pdb_tdb.c)
939	*********************************************************************/
940
941	static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state,
942	LDAPMessage *existing,
943	LDAPMod *** mods, struct samu * sampass,
944	BOOL (need_update)(const struct samu ,
945	enum pdb_elements))
946	{
947	pstring temp;
948	uint32 rid;
949
950	if (mods == NULL \|\| sampass == NULL) {
951	DEBUG(0, ("init_ldap_from_sam: NULL parameters found!\n"));
952	return False;
953	}
954
955	*mods = NULL;
956
957	/*
958	* took out adding "objectclass: sambaAccount"
959	* do this on a per-mod basis
960	*/
961	if (need_update(sampass, PDB_USERNAME)) {
962	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
963	"uid", pdb_get_username(sampass));
964	if (ldap_state->is_nds_ldap) {
965	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
966	"cn", pdb_get_username(sampass));
967	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
968	"sn", pdb_get_username(sampass));
969	}
970	}
971
972	DEBUG(2, ("init_ldap_from_sam: Setting entry for user: %s\n", pdb_get_username(sampass)));
973
974	/* only update the RID if we actually need to */
975	if (need_update(sampass, PDB_USERSID)) {
976	fstring sid_string;
977	const DOM_SID *user_sid = pdb_get_user_sid(sampass);
978
979	switch ( ldap_state->schema_ver ) {
980	case SCHEMAVER_SAMBAACCOUNT:
981	if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
982	DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
983	sid_string_static(user_sid),
984	sid_string_static(&ldap_state->domain_sid)));
985	return False;
986	}
987	slprintf(temp, sizeof(temp) - 1, "%i", rid);
988	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
989	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
990	temp);
991	break;
992
993	case SCHEMAVER_SAMBASAMACCOUNT:
994	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
995	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
996	sid_to_string(sid_string, user_sid));
997	break;
998
999	default:
1000	DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
1001	break;
1002	}
1003	}
1004
1005	/* we don't need to store the primary group RID - so leaving it
1006	'free' to hang off the unix primary group makes life easier */
1007
1008	if (need_update(sampass, PDB_GROUPSID)) {
1009	fstring sid_string;
1010	const DOM_SID *group_sid = pdb_get_group_sid(sampass);
1011
1012	switch ( ldap_state->schema_ver ) {
1013	case SCHEMAVER_SAMBAACCOUNT:
1014	if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
1015	DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
1016	sid_string_static(group_sid),
1017	sid_string_static(&ldap_state->domain_sid)));
1018	return False;
1019	}
1020
1021	slprintf(temp, sizeof(temp) - 1, "%i", rid);
1022	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1023	get_userattr_key2string(ldap_state->schema_ver,
1024	LDAP_ATTR_PRIMARY_GROUP_RID), temp);
1025	break;
1026
1027	case SCHEMAVER_SAMBASAMACCOUNT:
1028	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1029	get_userattr_key2string(ldap_state->schema_ver,
1030	LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_string(sid_string, group_sid));
1031	break;
1032
1033	default:
1034	DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
1035	break;
1036	}
1037
1038	}
1039
1040	/* displayName, cn, and gecos should all be the same
1041	* most easily accomplished by giving them the same OID
1042	* gecos isn't set here b/c it should be handled by the
1043	* add-user script
1044	* We change displayName only and fall back to cn if
1045	* it does not exist.
1046	*/
1047
1048	if (need_update(sampass, PDB_FULLNAME))
1049	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1050	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME),
1051	pdb_get_fullname(sampass));
1052
1053	if (need_update(sampass, PDB_ACCTDESC))
1054	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1055	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC),
1056	pdb_get_acct_desc(sampass));
1057
1058	if (need_update(sampass, PDB_WORKSTATIONS))
1059	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1060	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
1061	pdb_get_workstations(sampass));
1062
1063	if (need_update(sampass, PDB_MUNGEDDIAL))
1064	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1065	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL),
1066	pdb_get_munged_dial(sampass));
1067
1068	if (need_update(sampass, PDB_SMBHOME))
1069	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1070	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
1071	pdb_get_homedir(sampass));
1072
1073	if (need_update(sampass, PDB_DRIVE))
1074	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1075	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
1076	pdb_get_dir_drive(sampass));
1077
1078	if (need_update(sampass, PDB_LOGONSCRIPT))
1079	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1080	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT),
1081	pdb_get_logon_script(sampass));
1082
1083	if (need_update(sampass, PDB_PROFILE))
1084	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1085	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
1086	pdb_get_profile_path(sampass));
1087
1088	slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logon_time(sampass));
1089	if (need_update(sampass, PDB_LOGONTIME))
1090	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1091	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
1092
1093	slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logoff_time(sampass));
1094	if (need_update(sampass, PDB_LOGOFFTIME))
1095	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1096	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
1097
1098	slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_kickoff_time(sampass));
1099	if (need_update(sampass, PDB_KICKOFFTIME))
1100	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1101	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
1102
1103	slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_can_change_time_noncalc(sampass));
1104	if (need_update(sampass, PDB_CANCHANGETIME))
1105	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1106	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
1107
1108	slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_must_change_time(sampass));
1109	if (need_update(sampass, PDB_MUSTCHANGETIME))
1110	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1111	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
1112
1113
1114	if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST))
1115	\|\| (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
1116
1117	if (need_update(sampass, PDB_LMPASSWD)) {
1118	const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
1119	if (lm_pw) {
1120	pdb_sethexpwd(temp, lm_pw,
1121	pdb_get_acct_ctrl(sampass));
1122	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1123	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1124	temp);
1125	} else {
1126	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1127	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1128	NULL);
1129	}
1130	}
1131	if (need_update(sampass, PDB_NTPASSWD)) {
1132	const uchar *nt_pw = pdb_get_nt_passwd(sampass);
1133	if (nt_pw) {
1134	pdb_sethexpwd(temp, nt_pw,
1135	pdb_get_acct_ctrl(sampass));
1136	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1137	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1138	temp);
1139	} else {
1140	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1141	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1142	NULL);
1143	}
1144	}
1145
1146	if (need_update(sampass, PDB_PWHISTORY)) {
1147	uint32 pwHistLen = 0;
1148	pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
1149	if (pwHistLen == 0) {
1150	/* Remove any password history from the LDAP store. */
1151	memset(temp, '0', 64); /* NOTE !!!! '0' NOT '\0' /
1152	temp[64] = '\0';
1153	} else {
1154	int i;
1155	uint32 currHistLen = 0;
1156	const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
1157	if (pwhist != NULL) {
1158	/* We can only store (sizeof(pstring)-1)/64 password history entries. */
1159	pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));
1160	for (i=0; i< pwHistLen && i < currHistLen; i++) {
1161	/* Store the salt. */
1162	pdb_sethexpwd(&temp[i64], &pwhist[iPW_HISTORY_ENTRY_LEN], 0);
1163	/* Followed by the md5 hash of salt + md4 hash */
1164	pdb_sethexpwd(&temp[(i*64)+32],
1165	&pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
1166	DEBUG(100, ("temp=%s\n", temp));
1167	}
1168	}
1169	}
1170	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1171	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
1172	temp);
1173	}
1174
1175	if (need_update(sampass, PDB_PASSLASTSET)) {
1176	slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_last_set_time(sampass));
1177	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1178	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
1179	temp);
1180	}
1181	}
1182
1183	if (need_update(sampass, PDB_HOURS)) {
1184	const uint8 *hours = pdb_get_hours(sampass);
1185	if (hours) {
1186	pdb_sethexhours(temp, hours);
1187	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
1188	existing,
1189	mods,
1190	get_userattr_key2string(ldap_state->schema_ver,
1191	LDAP_ATTR_LOGON_HOURS),
1192	temp);
1193	}
1194	}
1195
1196	if (need_update(sampass, PDB_ACCTCTRL))
1197	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1198	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
1199	pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
1200
1201	/* password lockout cache:
1202	- If we are now autolocking or clearing, we write to ldap
1203	- If we are clearing, we delete the cache entry
1204	- If the count is > 0, we update the cache
1205
1206	This even means when autolocking, we cache, just in case the
1207	update doesn't work, and we have to cache the autolock flag */
1208
1209	if (need_update(sampass, PDB_BAD_PASSWORD_COUNT)) /* &&
1210	need_update(sampass, PDB_BAD_PASSWORD_TIME)) */ {
1211	uint16 badcount = pdb_get_bad_password_count(sampass);
1212	time_t badtime = pdb_get_bad_password_time(sampass);
1213	uint32 pol;
1214	pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT, &pol);
1215
1216	DEBUG(3, ("updating bad password fields, policy=%u, count=%u, time=%u\n",
1217	(unsigned int)pol, (unsigned int)badcount, (unsigned int)badtime));
1218
1219	if ((badcount >= pol) \|\| (badcount == 0)) {
1220	DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
1221	(unsigned int)badcount, (unsigned int)badtime));
1222	slprintf (temp, sizeof (temp) - 1, "%li", (long)badcount);
1223	smbldap_make_mod(
1224	ldap_state->smbldap_state->ldap_struct,
1225	existing, mods,
1226	get_userattr_key2string(
1227	ldap_state->schema_ver,
1228	LDAP_ATTR_BAD_PASSWORD_COUNT),
1229	temp);
1230
1231	slprintf (temp, sizeof (temp) - 1, "%li", badtime);
1232	smbldap_make_mod(
1233	ldap_state->smbldap_state->ldap_struct,
1234	existing, mods,
1235	get_userattr_key2string(
1236	ldap_state->schema_ver,
1237	LDAP_ATTR_BAD_PASSWORD_TIME),
1238	temp);
1239	}
1240	if (badcount == 0) {
1241	DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
1242	login_cache_delentry(sampass);
1243	} else {
1244	LOGIN_CACHE cache_entry;
1245
1246	cache_entry.entry_timestamp = time(NULL);
1247	cache_entry.acct_ctrl = pdb_get_acct_ctrl(sampass);
1248	cache_entry.bad_password_count = badcount;
1249	cache_entry.bad_password_time = badtime;
1250
1251	DEBUG(7, ("Updating bad password count and time in login cache\n"));
1252	login_cache_write(sampass, cache_entry);
1253	}
1254	}
1255
1256	return True;
1257	}
1258
1259	/**********************************************************************
1260	Connect to LDAP server for password enumeration.
1261	*********************************************************************/
1262
1263	static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update, uint32 acb_mask)
1264	{
1265	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1266	int rc;
1267	pstring filter, suffix;
1268	const char **attr_list;
1269	BOOL machine_mask = False, user_mask = False;
1270
1271	pstr_sprintf( filter, "(&%s%s)", "(uid=%u)",
1272	get_objclass_filter(ldap_state->schema_ver));
1273	all_string_sub(filter, "%u", "*", sizeof(pstring));
1274
1275	machine_mask = ((acb_mask != 0) && (acb_mask & (ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST)));
1276	user_mask = ((acb_mask != 0) && (acb_mask & ACB_NORMAL));
1277
1278	if (machine_mask) {
1279	pstrcpy(suffix, lp_ldap_machine_suffix());
1280	} else if (user_mask) {
1281	pstrcpy(suffix, lp_ldap_user_suffix());
1282	} else {
1283	pstrcpy(suffix, lp_ldap_suffix());
1284	}
1285
1286	DEBUG(10,("ldapsam_setsampwent: LDAP Query for acb_mask 0x%x will use suffix %s\n",
1287	acb_mask, suffix));
1288
1289	attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
1290	rc = smbldap_search(ldap_state->smbldap_state, suffix, LDAP_SCOPE_SUBTREE, filter,
1291	attr_list, 0, &ldap_state->result);
1292	TALLOC_FREE( attr_list );
1293
1294	if (rc != LDAP_SUCCESS) {
1295	DEBUG(0, ("ldapsam_setsampwent: LDAP search failed: %s\n", ldap_err2string(rc)));
1296	DEBUG(3, ("ldapsam_setsampwent: Query was: %s, %s\n", suffix, filter));
1297	ldap_msgfree(ldap_state->result);
1298	ldap_state->result = NULL;
1299	return NT_STATUS_UNSUCCESSFUL;
1300	}
1301
1302	DEBUG(2, ("ldapsam_setsampwent: %d entries in the base %s\n",
1303	ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
1304	ldap_state->result), suffix));
1305
1306	ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
1307	ldap_state->result);
1308	ldap_state->index = 0;
1309
1310	return NT_STATUS_OK;
1311	}
1312
1313	/**********************************************************************
1314	End enumeration of the LDAP password list.
1315	*********************************************************************/
1316
1317	static void ldapsam_endsampwent(struct pdb_methods *my_methods)
1318	{
1319	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1320	if (ldap_state->result) {
1321	ldap_msgfree(ldap_state->result);
1322	ldap_state->result = NULL;
1323	}
1324	}
1325
1326	/**********************************************************************
1327	Get the next entry in the LDAP password database.
1328	*********************************************************************/
1329
1330	static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods,
1331	struct samu *user)
1332	{
1333	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1334	struct ldapsam_privates *ldap_state =
1335	(struct ldapsam_privates *)my_methods->private_data;
1336	BOOL bret = False;
1337
1338	while (!bret) {
1339	if (!ldap_state->entry)
1340	return ret;
1341
1342	ldap_state->index++;
1343	bret = init_sam_from_ldap(ldap_state, user, ldap_state->entry);
1344
1345	ldap_state->entry = ldap_next_entry(priv2ld(ldap_state),
1346	ldap_state->entry);
1347	}
1348
1349	return NT_STATUS_OK;
1350	}
1351
1352	static void append_attr(TALLOC_CTX mem_ctx, const char **attr_list,
1353	const char *new_attr)
1354	{
1355	int i;
1356
1357	if (new_attr == NULL) {
1358	return;
1359	}
1360
1361	for (i=0; (*attr_list)[i] != NULL; i++) {
1362	;
1363	}
1364
1365	(attr_list) = TALLOC_REALLOC_ARRAY(mem_ctx, (attr_list),
1366	const char *, i+2);
1367	SMB_ASSERT((*attr_list) != NULL);
1368	(attr_list)[i] = talloc_strdup((attr_list), new_attr);
1369	(*attr_list)[i+1] = NULL;
1370	}
1371
1372	/**********************************************************************
1373	Get struct samu entry from LDAP by username.
1374	*********************************************************************/
1375
1376	static NTSTATUS ldapsam_getsampwnam(struct pdb_methods my_methods, struct samu user, const char *sname)
1377	{
1378	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1379	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1380	LDAPMessage *result = NULL;
1381	LDAPMessage *entry = NULL;
1382	int count;
1383	const char ** attr_list;
1384	int rc;
1385
1386	attr_list = get_userattr_list( user, ldap_state->schema_ver );
1387	append_attr(user, &attr_list,
1388	get_userattr_key2string(ldap_state->schema_ver,
1389	LDAP_ATTR_MOD_TIMESTAMP));
1390	append_attr(user, &attr_list, "uidNumber");
1391	rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result,
1392	attr_list);
1393	TALLOC_FREE( attr_list );
1394
1395	if ( rc != LDAP_SUCCESS )
1396	return NT_STATUS_NO_SUCH_USER;
1397
1398	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1399
1400	if (count < 1) {
1401	DEBUG(4, ("ldapsam_getsampwnam: Unable to locate user [%s] count=%d\n", sname, count));
1402	ldap_msgfree(result);
1403	return NT_STATUS_NO_SUCH_USER;
1404	} else if (count > 1) {
1405	DEBUG(1, ("ldapsam_getsampwnam: Duplicate entries for this user [%s] Failing. count=%d\n", sname, count));
1406	ldap_msgfree(result);
1407	return NT_STATUS_NO_SUCH_USER;
1408	}
1409
1410	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1411	if (entry) {
1412	if (!init_sam_from_ldap(ldap_state, user, entry)) {
1413	DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname));
1414	ldap_msgfree(result);
1415	return NT_STATUS_NO_SUCH_USER;
1416	}
1417	pdb_set_backend_private_data(user, result, NULL,
1418	my_methods, PDB_CHANGED);
1419	talloc_autofree_ldapmsg(user, result);
1420	ret = NT_STATUS_OK;
1421	} else {
1422	ldap_msgfree(result);
1423	}
1424	return ret;
1425	}
1426
1427	static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state,
1428	const DOM_SID sid, LDAPMessage *result)
1429	{
1430	int rc = -1;
1431	const char ** attr_list;
1432	uint32 rid;
1433
1434	switch ( ldap_state->schema_ver ) {
1435	case SCHEMAVER_SAMBASAMACCOUNT: {
1436	TALLOC_CTX *tmp_ctx = talloc_new(NULL);
1437	if (tmp_ctx == NULL) {
1438	return LDAP_NO_MEMORY;
1439	}
1440
1441	attr_list = get_userattr_list(tmp_ctx,
1442	ldap_state->schema_ver);
1443	append_attr(tmp_ctx, &attr_list,
1444	get_userattr_key2string(
1445	ldap_state->schema_ver,
1446	LDAP_ATTR_MOD_TIMESTAMP));
1447	append_attr(tmp_ctx, &attr_list, "uidNumber");
1448	rc = ldapsam_search_suffix_by_sid(ldap_state, sid,
1449	result, attr_list);
1450	TALLOC_FREE(tmp_ctx);
1451
1452	if ( rc != LDAP_SUCCESS )
1453	return rc;
1454	break;
1455	}
1456
1457	case SCHEMAVER_SAMBAACCOUNT:
1458	if (!sid_peek_check_rid(&ldap_state->domain_sid, sid, &rid)) {
1459	return rc;
1460	}
1461
1462	attr_list = get_userattr_list(NULL,
1463	ldap_state->schema_ver);
1464	rc = ldapsam_search_suffix_by_rid(ldap_state, rid, result, attr_list );
1465	TALLOC_FREE( attr_list );
1466
1467	if ( rc != LDAP_SUCCESS )
1468	return rc;
1469	break;
1470	}
1471	return rc;
1472	}
1473
1474	/**********************************************************************
1475	Get struct samu entry from LDAP by SID.
1476	*********************************************************************/
1477
1478	static NTSTATUS ldapsam_getsampwsid(struct pdb_methods my_methods, struct samu user, const DOM_SID *sid)
1479	{
1480	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1481	LDAPMessage *result = NULL;
1482	LDAPMessage *entry = NULL;
1483	int count;
1484	int rc;
1485	fstring sid_string;
1486
1487	rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1488	sid, &result);
1489	if (rc != LDAP_SUCCESS)
1490	return NT_STATUS_NO_SUCH_USER;
1491
1492	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1493
1494	if (count < 1) {
1495	DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string, sid),
1496	count));
1497	ldap_msgfree(result);
1498	return NT_STATUS_NO_SUCH_USER;
1499	} else if (count > 1) {
1500	DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string, sid),
1501	count));
1502	ldap_msgfree(result);
1503	return NT_STATUS_NO_SUCH_USER;
1504	}
1505
1506	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1507	if (!entry) {
1508	ldap_msgfree(result);
1509	return NT_STATUS_NO_SUCH_USER;
1510	}
1511
1512	if (!init_sam_from_ldap(ldap_state, user, entry)) {
1513	DEBUG(1,("ldapsam_getsampwsid: init_sam_from_ldap failed!\n"));
1514	ldap_msgfree(result);
1515	return NT_STATUS_NO_SUCH_USER;
1516	}
1517
1518	pdb_set_backend_private_data(user, result, NULL,
1519	my_methods, PDB_CHANGED);
1520	talloc_autofree_ldapmsg(user, result);
1521	return NT_STATUS_OK;
1522	}
1523
1524	/********************************************************************
1525	Do the actual modification - also change a plaintext passord if
1526	it it set.
1527	**********************************************************************/
1528
1529	static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods,
1530	struct samu newpwd, char dn,
1531	LDAPMod **mods, int ldap_op,
1532	BOOL (need_update)(const struct samu , enum pdb_elements))
1533	{
1534	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1535	int rc;
1536
1537	if (!newpwd \|\| !dn) {
1538	return NT_STATUS_INVALID_PARAMETER;
1539	}
1540
1541	if (!mods) {
1542	DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
1543	/* may be password change below however */
1544	} else {
1545	switch(ldap_op) {
1546	case LDAP_MOD_ADD:
1547	if (ldap_state->is_nds_ldap) {
1548	smbldap_set_mod(&mods, LDAP_MOD_ADD,
1549	"objectclass",
1550	"inetOrgPerson");
1551	} else {
1552	smbldap_set_mod(&mods, LDAP_MOD_ADD,
1553	"objectclass",
1554	LDAP_OBJ_ACCOUNT);
1555	}
1556	rc = smbldap_add(ldap_state->smbldap_state,
1557	dn, mods);
1558	break;
1559	case LDAP_MOD_REPLACE:
1560	rc = smbldap_modify(ldap_state->smbldap_state,
1561	dn ,mods);
1562	break;
1563	default:
1564	DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n",
1565	ldap_op));
1566	return NT_STATUS_INVALID_PARAMETER;
1567	}
1568
1569	if (rc!=LDAP_SUCCESS) {
1570	return NT_STATUS_UNSUCCESSFUL;
1571	}
1572	}
1573
1574	if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST)) &&
1575	(lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) &&
1576	need_update(newpwd, PDB_PLAINTEXT_PW) &&
1577	(pdb_get_plaintext_passwd(newpwd)!=NULL)) {
1578	BerElement *ber;
1579	struct berval *bv;
1580	char *retoid = NULL;
1581	struct berval *retdata = NULL;
1582	char *utf8_password;
1583	char *utf8_dn;
1584
1585	if (!ldap_state->is_nds_ldap) {
1586
1587	if (!smbldap_has_extension(ldap_state->smbldap_state->ldap_struct,
1588	LDAP_EXOP_MODIFY_PASSWD)) {
1589	DEBUG(2, ("ldap password change requested, but LDAP "
1590	"server does not support it -- ignoring\n"));
1591	return NT_STATUS_OK;
1592	}
1593	}
1594
1595	if (push_utf8_allocate(&utf8_password, pdb_get_plaintext_passwd(newpwd)) == (size_t)-1) {
1596	return NT_STATUS_NO_MEMORY;
1597	}
1598
1599	if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) {
1600	SAFE_FREE(utf8_password);
1601	return NT_STATUS_NO_MEMORY;
1602	}
1603
1604	if ((ber = ber_alloc_t(LBER_USE_DER))==NULL) {
1605	DEBUG(0,("ber_alloc_t returns NULL\n"));
1606	SAFE_FREE(utf8_password);
1607	SAFE_FREE(utf8_dn);
1608	return NT_STATUS_UNSUCCESSFUL;
1609	}
1610
1611	ber_printf (ber, "{");
1612	ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, utf8_dn);
1613	ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, utf8_password);
1614	ber_printf (ber, "n}");
1615
1616	if ((rc = ber_flatten (ber, &bv))<0) {
1617	DEBUG(0,("ldapsam_modify_entry: ber_flatten returns a value <0\n"));
1618	ber_free(ber,1);
1619	SAFE_FREE(utf8_dn);
1620	SAFE_FREE(utf8_password);
1621	return NT_STATUS_UNSUCCESSFUL;
1622	}
1623
1624	SAFE_FREE(utf8_dn);
1625	SAFE_FREE(utf8_password);
1626	ber_free(ber, 1);
1627
1628	if (!ldap_state->is_nds_ldap) {
1629	rc = smbldap_extended_operation(ldap_state->smbldap_state,
1630	LDAP_EXOP_MODIFY_PASSWD,
1631	bv, NULL, NULL, &retoid,
1632	&retdata);
1633	} else {
1634	rc = pdb_nds_set_password(ldap_state->smbldap_state, dn,
1635	pdb_get_plaintext_passwd(newpwd));
1636	}
1637	if (rc != LDAP_SUCCESS) {
1638	char *ld_error = NULL;
1639
1640	if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
1641	DEBUG(3, ("Could not set userPassword "
1642	"attribute due to an objectClass "
1643	"violation -- ignoring\n"));
1644	ber_bvfree(bv);
1645	return NT_STATUS_OK;
1646	}
1647
1648	ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1649	&ld_error);
1650	DEBUG(0,("ldapsam_modify_entry: LDAP Password could not be changed for user %s: %s\n\t%s\n",
1651	pdb_get_username(newpwd), ldap_err2string(rc), ld_error?ld_error:"unknown"));
1652	SAFE_FREE(ld_error);
1653	ber_bvfree(bv);
1654	#if defined(LDAP_CONSTRAINT_VIOLATION)
1655	if (rc == LDAP_CONSTRAINT_VIOLATION)
1656	return NT_STATUS_PASSWORD_RESTRICTION;
1657	#endif
1658	return NT_STATUS_UNSUCCESSFUL;
1659	} else {
1660	DEBUG(3,("ldapsam_modify_entry: LDAP Password changed for user %s\n",pdb_get_username(newpwd)));
1661	#ifdef DEBUG_PASSWORD
1662	DEBUG(100,("ldapsam_modify_entry: LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd)));
1663	#endif
1664	if (retdata)
1665	ber_bvfree(retdata);
1666	if (retoid)
1667	ldap_memfree(retoid);
1668	}
1669	ber_bvfree(bv);
1670	}
1671	return NT_STATUS_OK;
1672	}
1673
1674	/**********************************************************************
1675	Delete entry from LDAP for username.
1676	*********************************************************************/
1677
1678	static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods,
1679	struct samu * sam_acct)
1680	{
1681	struct ldapsam_privates *priv =
1682	(struct ldapsam_privates *)my_methods->private_data;
1683	const char *sname;
1684	int rc;
1685	LDAPMessage msg, entry;
1686	NTSTATUS result = NT_STATUS_NO_MEMORY;
1687	const char **attr_list;
1688	TALLOC_CTX *mem_ctx;
1689
1690	if (!sam_acct) {
1691	DEBUG(0, ("ldapsam_delete_sam_account: sam_acct was NULL!\n"));
1692	return NT_STATUS_INVALID_PARAMETER;
1693	}
1694
1695	sname = pdb_get_username(sam_acct);
1696
1697	DEBUG(3, ("ldapsam_delete_sam_account: Deleting user %s from "
1698	"LDAP.\n", sname));
1699
1700	mem_ctx = talloc_new(NULL);
1701	if (mem_ctx == NULL) {
1702	DEBUG(0, ("talloc_new failed\n"));
1703	goto done;
1704	}
1705
1706	attr_list = get_userattr_delete_list(mem_ctx, priv->schema_ver );
1707	if (attr_list == NULL) {
1708	goto done;
1709	}
1710
1711	rc = ldapsam_search_suffix_by_name(priv, sname, &msg, attr_list);
1712
1713	if ((rc != LDAP_SUCCESS) \|\|
1714	(ldap_count_entries(priv2ld(priv), msg) != 1) \|\|
1715	((entry = ldap_first_entry(priv2ld(priv), msg)) == NULL)) {
1716	DEBUG(5, ("Could not find user %s\n", sname));
1717	result = NT_STATUS_NO_SUCH_USER;
1718	goto done;
1719	}
1720
1721	rc = ldapsam_delete_entry(
1722	priv, mem_ctx, entry,
1723	priv->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ?
1724	LDAP_OBJ_SAMBASAMACCOUNT : LDAP_OBJ_SAMBAACCOUNT,
1725	attr_list);
1726
1727	result = (rc == LDAP_SUCCESS) ?
1728	NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
1729
1730	done:
1731	TALLOC_FREE(mem_ctx);
1732	return result;
1733	}
1734
1735	/**********************************************************************
1736	Helper function to determine for update_sam_account whether
1737	we need LDAP modification.
1738	*********************************************************************/
1739
1740	static BOOL element_is_changed(const struct samu *sampass,
1741	enum pdb_elements element)
1742	{
1743	return IS_SAM_CHANGED(sampass, element);
1744	}
1745
1746	/**********************************************************************
1747	Update struct samu.
1748	*********************************************************************/
1749
1750	static NTSTATUS ldapsam_update_sam_account(struct pdb_methods my_methods, struct samu newpwd)
1751	{
1752	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1753	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1754	int rc = 0;
1755	char *dn;
1756	LDAPMessage *result = NULL;
1757	LDAPMessage *entry = NULL;
1758	LDAPMod **mods = NULL;
1759	const char **attr_list;
1760
1761	result = (LDAPMessage *)pdb_get_backend_private_data(newpwd, my_methods);
1762	if (!result) {
1763	attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
1764	if (pdb_get_username(newpwd) == NULL) {
1765	return NT_STATUS_INVALID_PARAMETER;
1766	}
1767	rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list );
1768	TALLOC_FREE( attr_list );
1769	if (rc != LDAP_SUCCESS) {
1770	return NT_STATUS_UNSUCCESSFUL;
1771	}
1772	pdb_set_backend_private_data(newpwd, result, NULL,
1773	my_methods, PDB_CHANGED);
1774	talloc_autofree_ldapmsg(newpwd, result);
1775	}
1776
1777	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
1778	DEBUG(0, ("ldapsam_update_sam_account: No user to modify!\n"));
1779	return NT_STATUS_UNSUCCESSFUL;
1780	}
1781
1782	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1783	dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
1784	if (!dn) {
1785	return NT_STATUS_UNSUCCESSFUL;
1786	}
1787
1788	DEBUG(4, ("ldapsam_update_sam_account: user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn));
1789
1790	if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
1791	element_is_changed)) {
1792	DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
1793	SAFE_FREE(dn);
1794	if (mods != NULL)
1795	ldap_mods_free(mods,True);
1796	return NT_STATUS_UNSUCCESSFUL;
1797	}
1798
1799	if ((lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_ONLY)
1800	&& (mods == NULL)) {
1801	DEBUG(4,("ldapsam_update_sam_account: mods is empty: nothing to update for user: %s\n",
1802	pdb_get_username(newpwd)));
1803	SAFE_FREE(dn);
1804	return NT_STATUS_OK;
1805	}
1806
1807	ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed);
1808
1809	if (mods != NULL) {
1810	ldap_mods_free(mods,True);
1811	}
1812
1813	SAFE_FREE(dn);
1814
1815	/*
1816	* We need to set the backend private data to NULL here. For example
1817	* setuserinfo level 25 does a pdb_update_sam_account twice on the
1818	* same one, and with the explicit delete / add logic for attribute
1819	* values the second time we would use the wrong "old" value which
1820	* does not exist in LDAP anymore. Thus the LDAP server would refuse
1821	* the update.
1822	* The existing LDAPMessage is still being auto-freed by the
1823	* destructor.
1824	*/
1825	pdb_set_backend_private_data(newpwd, NULL, NULL, my_methods,
1826	PDB_CHANGED);
1827
1828	if (!NT_STATUS_IS_OK(ret)) {
1829	return ret;
1830	}
1831
1832	DEBUG(2, ("ldapsam_update_sam_account: successfully modified uid = %s in the LDAP database\n",
1833	pdb_get_username(newpwd)));
1834	return NT_STATUS_OK;
1835	}
1836
1837	/***************************************************************************
1838	Renames a struct samu
1839	- The "rename user script" has full responsibility for changing everything
1840	***************************************************************************/
1841
1842	static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
1843	struct samu *old_acct,
1844	const char *newname)
1845	{
1846	const char *oldname;
1847	int rc;
1848	pstring rename_script;
1849	fstring oldname_lower, newname_lower;
1850
1851	if (!old_acct) {
1852	DEBUG(0, ("ldapsam_rename_sam_account: old_acct was NULL!\n"));
1853	return NT_STATUS_INVALID_PARAMETER;
1854	}
1855	if (!newname) {
1856	DEBUG(0, ("ldapsam_rename_sam_account: newname was NULL!\n"));
1857	return NT_STATUS_INVALID_PARAMETER;
1858	}
1859
1860	oldname = pdb_get_username(old_acct);
1861
1862	/* rename the posix user */
1863	pstrcpy(rename_script, lp_renameuser_script());
1864
1865	if (!(*rename_script))
1866	return NT_STATUS_ACCESS_DENIED;
1867
1868	DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n",
1869	oldname, newname));
1870
1871	/* We have to allow the account name to end with a '$'.
1872	Also, follow the semantics in _samr_create_user() and lower case the
1873	posix name but preserve the case in passdb */
1874
1875	fstrcpy( oldname_lower, oldname );
1876	strlower_m( oldname_lower );
1877	fstrcpy( newname_lower, newname );
1878	strlower_m( newname_lower );
1879	string_sub2(rename_script, "%unew", newname_lower, sizeof(pstring),
1880	True, False, True);
1881	string_sub2(rename_script, "%uold", oldname_lower, sizeof(pstring),
1882	True, False, True);
1883	rc = smbrun(rename_script, NULL);
1884
1885	DEBUG(rc ? 0 : 3,("Running the command `%s' gave %d\n",
1886	rename_script, rc));
1887
1888	if (rc == 0) {
1889	smb_nscd_flush_user_cache();
1890	}
1891
1892	if (rc)
1893	return NT_STATUS_UNSUCCESSFUL;
1894
1895	return NT_STATUS_OK;
1896	}
1897
1898	/**********************************************************************
1899	Helper function to determine for update_sam_account whether
1900	we need LDAP modification.
1901	*********************************************************************/
1902
1903	static BOOL element_is_set_or_changed(const struct samu *sampass,
1904	enum pdb_elements element)
1905	{
1906	return (IS_SAM_SET(sampass, element) \|\|
1907	IS_SAM_CHANGED(sampass, element));
1908	}
1909
1910	/**********************************************************************
1911	Add struct samu to LDAP.
1912	*********************************************************************/
1913
1914	static NTSTATUS ldapsam_add_sam_account(struct pdb_methods my_methods, struct samu newpwd)
1915	{
1916	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1917	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1918	int rc;
1919	LDAPMessage *result = NULL;
1920	LDAPMessage *entry = NULL;
1921	pstring dn;
1922	LDAPMod **mods = NULL;
1923	int ldap_op = LDAP_MOD_REPLACE;
1924	uint32 num_result;
1925	const char **attr_list;
1926	char *escape_user;
1927	const char *username = pdb_get_username(newpwd);
1928	const DOM_SID *sid = pdb_get_user_sid(newpwd);
1929	pstring filter;
1930	fstring sid_string;
1931
1932	if (!username \|\| !*username) {
1933	DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
1934	return NT_STATUS_INVALID_PARAMETER;
1935	}
1936
1937	/* free this list after the second search or in case we exit on failure */
1938	attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
1939
1940	rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
1941
1942	if (rc != LDAP_SUCCESS) {
1943	TALLOC_FREE( attr_list );
1944	return NT_STATUS_UNSUCCESSFUL;
1945	}
1946
1947	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
1948	DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
1949	username));
1950	ldap_msgfree(result);
1951	TALLOC_FREE( attr_list );
1952	return NT_STATUS_UNSUCCESSFUL;
1953	}
1954	ldap_msgfree(result);
1955	result = NULL;
1956
1957	if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
1958	rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1959	sid, &result);
1960	if (rc == LDAP_SUCCESS) {
1961	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
1962	DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n",
1963	sid_to_string(sid_string, sid)));
1964	TALLOC_FREE( attr_list );
1965	ldap_msgfree(result);
1966	return NT_STATUS_UNSUCCESSFUL;
1967	}
1968	ldap_msgfree(result);
1969	}
1970	}
1971
1972	/* does the entry already exist but without a samba attributes?
1973	we need to return the samba attributes here */
1974
1975	escape_user = escape_ldap_string_alloc( username );
1976	pstrcpy( filter, "(uid=%u)" );
1977	all_string_sub( filter, "%u", escape_user, sizeof(filter) );
1978	SAFE_FREE( escape_user );
1979
1980	rc = smbldap_search_suffix(ldap_state->smbldap_state,
1981	filter, attr_list, &result);
1982	if ( rc != LDAP_SUCCESS ) {
1983	TALLOC_FREE( attr_list );
1984	return NT_STATUS_UNSUCCESSFUL;
1985	}
1986
1987	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1988
1989	if (num_result > 1) {
1990	DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
1991	TALLOC_FREE( attr_list );
1992	ldap_msgfree(result);
1993	return NT_STATUS_UNSUCCESSFUL;
1994	}
1995
1996	/* Check if we need to update an existing entry */
1997	if (num_result == 1) {
1998	char *tmp;
1999
2000	DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
2001	ldap_op = LDAP_MOD_REPLACE;
2002	entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
2003	tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
2004	if (!tmp) {
2005	TALLOC_FREE( attr_list );
2006	ldap_msgfree(result);
2007	return NT_STATUS_UNSUCCESSFUL;
2008	}
2009	slprintf (dn, sizeof (dn) - 1, "%s", tmp);
2010	SAFE_FREE(tmp);
2011
2012	} else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
2013
2014	/* There might be a SID for this account already - say an idmap entry */
2015
2016	pstr_sprintf(filter, "(&(%s=%s)(\|(objectClass=%s)(objectClass=%s)))",
2017	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
2018	sid_to_string(sid_string, sid),
2019	LDAP_OBJ_IDMAP_ENTRY,
2020	LDAP_OBJ_SID_ENTRY);
2021
2022	/* free old result before doing a new search */
2023	if (result != NULL) {
2024	ldap_msgfree(result);
2025	result = NULL;
2026	}
2027	rc = smbldap_search_suffix(ldap_state->smbldap_state,
2028	filter, attr_list, &result);
2029
2030	if ( rc != LDAP_SUCCESS ) {
2031	TALLOC_FREE( attr_list );
2032	return NT_STATUS_UNSUCCESSFUL;
2033	}
2034
2035	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2036
2037	if (num_result > 1) {
2038	DEBUG (0, ("ldapsam_add_sam_account: More than one user with specified Sid exists: bailing out!\n"));
2039	TALLOC_FREE( attr_list );
2040	ldap_msgfree(result);
2041	return NT_STATUS_UNSUCCESSFUL;
2042	}
2043
2044	/* Check if we need to update an existing entry */
2045	if (num_result == 1) {
2046	char *tmp;
2047
2048	DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
2049	ldap_op = LDAP_MOD_REPLACE;
2050	entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
2051	tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
2052	if (!tmp) {
2053	TALLOC_FREE( attr_list );
2054	ldap_msgfree(result);
2055	return NT_STATUS_UNSUCCESSFUL;
2056	}
2057	slprintf (dn, sizeof (dn) - 1, "%s", tmp);
2058	SAFE_FREE(tmp);
2059	}
2060	}
2061
2062	TALLOC_FREE( attr_list );
2063
2064	if (num_result == 0) {
2065	char *escape_username;
2066	/* Check if we need to add an entry */
2067	DEBUG(3,("ldapsam_add_sam_account: Adding new user\n"));
2068	ldap_op = LDAP_MOD_ADD;
2069
2070	escape_username = escape_rdn_val_string_alloc(username);
2071	if (!escape_username) {
2072	DEBUG(0, ("Out of memory!\n"));
2073	ldap_msgfree(result);
2074	return NT_STATUS_NO_MEMORY;
2075	}
2076
2077	if (username[strlen(username)-1] == '$') {
2078	slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", escape_username, lp_ldap_machine_suffix ());
2079	} else {
2080	slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", escape_username, lp_ldap_user_suffix ());
2081	}
2082
2083	SAFE_FREE(escape_username);
2084	}
2085
2086	if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
2087	element_is_set_or_changed)) {
2088	DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
2089	ldap_msgfree(result);
2090	if (mods != NULL)
2091	ldap_mods_free(mods,True);
2092	return NT_STATUS_UNSUCCESSFUL;
2093	}
2094
2095	ldap_msgfree(result);
2096
2097	if (mods == NULL) {
2098	DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
2099	return NT_STATUS_UNSUCCESSFUL;
2100	}
2101	switch ( ldap_state->schema_ver ) {
2102	case SCHEMAVER_SAMBAACCOUNT:
2103	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT);
2104	break;
2105	case SCHEMAVER_SAMBASAMACCOUNT:
2106	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT);
2107	break;
2108	default:
2109	DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n"));
2110	break;
2111	}
2112
2113	ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed);
2114	if (!NT_STATUS_IS_OK(ret)) {
2115	DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
2116	pdb_get_username(newpwd),dn));
2117	ldap_mods_free(mods, True);
2118	return ret;
2119	}
2120
2121	DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
2122	ldap_mods_free(mods, True);
2123
2124	return NT_STATUS_OK;
2125	}
2126
2127	/**********************************************************************
2128	*********************************************************************/
2129
2130	static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
2131	const char *filter,
2132	LDAPMessage ** result)
2133	{
2134	int scope = LDAP_SCOPE_SUBTREE;
2135	int rc;
2136	const char **attr_list;
2137
2138	attr_list = get_attr_list(NULL, groupmap_attr_list);
2139	rc = smbldap_search(ldap_state->smbldap_state,
2140	lp_ldap_group_suffix (), scope,
2141	filter, attr_list, 0, result);
2142	TALLOC_FREE(attr_list);
2143
2144	return rc;
2145	}
2146
2147	/**********************************************************************
2148	*********************************************************************/
2149
2150	static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state,
2151	GROUP_MAP map, LDAPMessage entry)
2152	{
2153	pstring temp;
2154
2155	if (ldap_state == NULL \|\| map == NULL \|\| entry == NULL \|\|
2156	ldap_state->smbldap_state->ldap_struct == NULL) {
2157	DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
2158	return False;
2159	}
2160
2161	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2162	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp)) {
2163	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2164	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
2165	return False;
2166	}
2167	DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
2168
2169	map->gid = (gid_t)atol(temp);
2170
2171	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2172	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp)) {
2173	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2174	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
2175	return False;
2176	}
2177
2178	if (!string_to_sid(&map->sid, temp)) {
2179	DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
2180	return False;
2181	}
2182
2183	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2184	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) {
2185	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2186	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
2187	return False;
2188	}
2189	map->sid_name_use = (enum lsa_SidType)atol(temp);
2190
2191	if ((map->sid_name_use < SID_NAME_USER) \|\|
2192	(map->sid_name_use > SID_NAME_UNKNOWN)) {
2193	DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
2194	return False;
2195	}
2196
2197	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2198	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp)) {
2199	temp[0] = '\0';
2200	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2201	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp))
2202	{
2203	DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
2204	for gidNumber(%lu)\n",(unsigned long)map->gid));
2205	return False;
2206	}
2207	}
2208	fstrcpy(map->nt_name, temp);
2209
2210	if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2211	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp)) {
2212	temp[0] = '\0';
2213	}
2214	fstrcpy(map->comment, temp);
2215
2216	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
2217	store_gid_sid_cache(&map->sid, map->gid);
2218	}
2219
2220	return True;
2221	}
2222
2223	/**********************************************************************
2224	*********************************************************************/
2225
2226	static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods,
2227	const char *filter,
2228	GROUP_MAP *map)
2229	{
2230	struct ldapsam_privates *ldap_state =
2231	(struct ldapsam_privates *)methods->private_data;
2232	LDAPMessage *result = NULL;
2233	LDAPMessage *entry = NULL;
2234	int count;
2235
2236	if (ldapsam_search_one_group(ldap_state, filter, &result)
2237	!= LDAP_SUCCESS) {
2238	return NT_STATUS_NO_SUCH_GROUP;
2239	}
2240
2241	count = ldap_count_entries(priv2ld(ldap_state), result);
2242
2243	if (count < 1) {
2244	DEBUG(4, ("ldapsam_getgroup: Did not find group\n"));
2245	ldap_msgfree(result);
2246	return NT_STATUS_NO_SUCH_GROUP;
2247	}
2248
2249	if (count > 1) {
2250	DEBUG(1, ("ldapsam_getgroup: Duplicate entries for filter %s: "
2251	"count=%d\n", filter, count));
2252	ldap_msgfree(result);
2253	return NT_STATUS_NO_SUCH_GROUP;
2254	}
2255
2256	entry = ldap_first_entry(priv2ld(ldap_state), result);
2257
2258	if (!entry) {
2259	ldap_msgfree(result);
2260	return NT_STATUS_UNSUCCESSFUL;
2261	}
2262
2263	if (!init_group_from_ldap(ldap_state, map, entry)) {
2264	DEBUG(1, ("ldapsam_getgroup: init_group_from_ldap failed for "
2265	"group filter %s\n", filter));
2266	ldap_msgfree(result);
2267	return NT_STATUS_NO_SUCH_GROUP;
2268	}
2269
2270	ldap_msgfree(result);
2271	return NT_STATUS_OK;
2272	}
2273
2274	/**********************************************************************
2275	*********************************************************************/
2276
2277	static NTSTATUS ldapsam_getgrsid(struct pdb_methods methods, GROUP_MAP map,
2278	DOM_SID sid)
2279	{
2280	pstring filter;
2281
2282	pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
2283	LDAP_OBJ_GROUPMAP,
2284	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
2285	sid_string_static(&sid));
2286
2287	return ldapsam_getgroup(methods, filter, map);
2288	}
2289
2290	/**********************************************************************
2291	*********************************************************************/
2292
2293	static NTSTATUS ldapsam_getgrgid(struct pdb_methods methods, GROUP_MAP map,
2294	gid_t gid)
2295	{
2296	pstring filter;
2297
2298	pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))",
2299	LDAP_OBJ_GROUPMAP,
2300	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2301	(unsigned long)gid);
2302
2303	return ldapsam_getgroup(methods, filter, map);
2304	}
2305
2306	/**********************************************************************
2307	*********************************************************************/
2308
2309	static NTSTATUS ldapsam_getgrnam(struct pdb_methods methods, GROUP_MAP map,
2310	const char *name)
2311	{
2312	pstring filter;
2313	char *escape_name = escape_ldap_string_alloc(name);
2314
2315	if (!escape_name) {
2316	return NT_STATUS_NO_MEMORY;
2317	}
2318
2319	pstr_sprintf(filter, "(&(objectClass=%s)(\|(%s=%s)(%s=%s)))",
2320	LDAP_OBJ_GROUPMAP,
2321	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
2322	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), escape_name);
2323
2324	SAFE_FREE(escape_name);
2325
2326	return ldapsam_getgroup(methods, filter, map);
2327	}
2328
2329	static BOOL ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
2330	LDAPMessage *entry,
2331	const DOM_SID *domain_sid,
2332	uint32 *rid)
2333	{
2334	fstring str;
2335	DOM_SID sid;
2336
2337	if (!smbldap_get_single_attribute(ldap_struct, entry, "sambaSID",
2338	str, sizeof(str)-1)) {
2339	DEBUG(10, ("Could not find sambaSID attribute\n"));
2340	return False;
2341	}
2342
2343	if (!string_to_sid(&sid, str)) {
2344	DEBUG(10, ("Could not convert string %s to sid\n", str));
2345	return False;
2346	}
2347
2348	if (sid_compare_domain(&sid, domain_sid) != 0) {
2349	DEBUG(10, ("SID %s is not in expected domain %s\n",
2350	str, sid_string_static(domain_sid)));
2351	return False;
2352	}
2353
2354	if (!sid_peek_rid(&sid, rid)) {
2355	DEBUG(10, ("Could not peek into RID\n"));
2356	return False;
2357	}
2358
2359	return True;
2360	}
2361
2362	static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
2363	TALLOC_CTX *mem_ctx,
2364	const DOM_SID *group,
2365	uint32 **pp_member_rids,
2366	size_t *p_num_members)
2367	{
2368	struct ldapsam_privates *ldap_state =
2369	(struct ldapsam_privates *)methods->private_data;
2370	struct smbldap_state *conn = ldap_state->smbldap_state;
2371	const char *id_attrs[] = { "memberUid", "gidNumber", NULL };
2372	const char *sid_attrs[] = { "sambaSID", NULL };
2373	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2374	LDAPMessage *result = NULL;
2375	LDAPMessage *entry;
2376	char *filter;
2377	char **values = NULL;
2378	char **memberuid;
2379	char *gidstr;
2380	int rc, count;
2381
2382	*pp_member_rids = NULL;
2383	*p_num_members = 0;
2384
2385	filter = talloc_asprintf(mem_ctx,
2386	"(&(objectClass=%s)"
2387	"(objectClass=%s)"
2388	"(sambaSID=%s))",
2389	LDAP_OBJ_POSIXGROUP,
2390	LDAP_OBJ_GROUPMAP,
2391	sid_string_static(group));
2392	if (filter == NULL) {
2393	ret = NT_STATUS_NO_MEMORY;
2394	goto done;
2395	}
2396
2397	rc = smbldap_search(conn, lp_ldap_group_suffix(),
2398	LDAP_SCOPE_SUBTREE, filter, id_attrs, 0,
2399	&result);
2400
2401	if (rc != LDAP_SUCCESS)
2402	goto done;
2403
2404	talloc_autofree_ldapmsg(mem_ctx, result);
2405
2406	count = ldap_count_entries(conn->ldap_struct, result);
2407
2408	if (count > 1) {
2409	DEBUG(1, ("Found more than one groupmap entry for %s\n",
2410	sid_string_static(group)));
2411	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2412	goto done;
2413	}
2414
2415	if (count == 0) {
2416	ret = NT_STATUS_NO_SUCH_GROUP;
2417	goto done;
2418	}
2419
2420	entry = ldap_first_entry(conn->ldap_struct, result);
2421	if (entry == NULL)
2422	goto done;
2423
2424	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", mem_ctx);
2425	if (!gidstr) {
2426	DEBUG (0, ("ldapsam_enum_group_members: Unable to find the group's gid!\n"));
2427	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2428	goto done;
2429	}
2430
2431	values = ldap_get_values(conn->ldap_struct, entry, "memberUid");
2432
2433	if (values) {
2434
2435	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(\|", LDAP_OBJ_SAMBASAMACCOUNT);
2436	if (filter == NULL) {
2437	ret = NT_STATUS_NO_MEMORY;
2438	goto done;
2439	}
2440
2441	for (memberuid = values; *memberuid != NULL; memberuid += 1) {
2442	char *escape_memberuid;
2443
2444	escape_memberuid = escape_ldap_string_alloc(*memberuid);
2445	if (escape_memberuid == NULL) {
2446	ret = NT_STATUS_NO_MEMORY;
2447	goto done;
2448	}
2449
2450	filter = talloc_asprintf_append(filter, "(uid=%s)", escape_memberuid);
2451	if (filter == NULL) {
2452	SAFE_FREE(escape_memberuid);
2453	ret = NT_STATUS_NO_MEMORY;
2454	goto done;
2455	}
2456
2457	SAFE_FREE(escape_memberuid);
2458	}
2459
2460	filter = talloc_asprintf_append(filter, "))");
2461	if (filter == NULL) {
2462	ret = NT_STATUS_NO_MEMORY;
2463	goto done;
2464	}
2465
2466	rc = smbldap_search(conn, lp_ldap_suffix(),
2467	LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
2468	&result);
2469
2470	if (rc != LDAP_SUCCESS)
2471	goto done;
2472
2473	count = ldap_count_entries(conn->ldap_struct, result);
2474	DEBUG(10,("ldapsam_enum_group_members: found %d accounts\n", count));
2475
2476	talloc_autofree_ldapmsg(mem_ctx, result);
2477
2478	for (entry = ldap_first_entry(conn->ldap_struct, result);
2479	entry != NULL;
2480	entry = ldap_next_entry(conn->ldap_struct, entry))
2481	{
2482	char *sidstr;
2483	DOM_SID sid;
2484	uint32 rid;
2485
2486	sidstr = smbldap_talloc_single_attribute(conn->ldap_struct,
2487	entry, "sambaSID",
2488	mem_ctx);
2489	if (!sidstr) {
2490	DEBUG(0, ("Severe DB error, sambaSamAccount can't miss "
2491	"the sambaSID attribute\n"));
2492	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2493	goto done;
2494	}
2495
2496	if (!string_to_sid(&sid, sidstr))
2497	goto done;
2498
2499	if (!sid_check_is_in_our_domain(&sid)) {
2500	DEBUG(0, ("Inconsistent SAM -- group member uid not "
2501	"in our domain\n"));
2502	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2503	goto done;
2504	}
2505
2506	sid_peek_rid(&sid, &rid);
2507
2508	if (!add_rid_to_array_unique(mem_ctx, rid, pp_member_rids,
2509	p_num_members)) {
2510	ret = NT_STATUS_NO_MEMORY;
2511	goto done;
2512	}
2513	}
2514	}
2515
2516	filter = talloc_asprintf(mem_ctx,
2517	"(&(objectClass=%s)"
2518	"(gidNumber=%s))",
2519	LDAP_OBJ_SAMBASAMACCOUNT,
2520	gidstr);
2521
2522	rc = smbldap_search(conn, lp_ldap_suffix(),
2523	LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
2524	&result);
2525
2526	if (rc != LDAP_SUCCESS)
2527	goto done;
2528
2529	talloc_autofree_ldapmsg(mem_ctx, result);
2530
2531	for (entry = ldap_first_entry(conn->ldap_struct, result);
2532	entry != NULL;
2533	entry = ldap_next_entry(conn->ldap_struct, entry))
2534	{
2535	uint32 rid;
2536
2537	if (!ldapsam_extract_rid_from_entry(conn->ldap_struct,
2538	entry,
2539	get_global_sam_sid(),
2540	&rid)) {
2541	DEBUG(0, ("Severe DB error, sambaSamAccount can't miss "
2542	"the sambaSID attribute\n"));
2543	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2544	goto done;
2545	}
2546
2547	if (!add_rid_to_array_unique(mem_ctx, rid, pp_member_rids,
2548	p_num_members)) {
2549	ret = NT_STATUS_NO_MEMORY;
2550	goto done;
2551	}
2552	}
2553
2554	ret = NT_STATUS_OK;
2555
2556	done:
2557
2558	if (values)
2559	ldap_value_free(values);
2560
2561	return ret;
2562	}
2563
2564	static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
2565	TALLOC_CTX *mem_ctx,
2566	struct samu *user,
2567	DOM_SID **pp_sids,
2568	gid_t **pp_gids,
2569	size_t *p_num_groups)
2570	{
2571	struct ldapsam_privates *ldap_state =
2572	(struct ldapsam_privates *)methods->private_data;
2573	struct smbldap_state *conn = ldap_state->smbldap_state;
2574	char *filter;
2575	const char *attrs[] = { "gidNumber", "sambaSID", NULL };
2576	char *escape_name;
2577	int rc, count;
2578	LDAPMessage *result = NULL;
2579	LDAPMessage *entry;
2580	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2581	size_t num_sids, num_gids;
2582	char *gidstr;
2583	gid_t primary_gid = -1;
2584
2585	*pp_sids = NULL;
2586	num_sids = 0;
2587
2588	if (pdb_get_username(user) == NULL) {
2589	return NT_STATUS_INVALID_PARAMETER;
2590	}
2591
2592	escape_name = escape_ldap_string_alloc(pdb_get_username(user));
2593	if (escape_name == NULL)
2594	return NT_STATUS_NO_MEMORY;
2595
2596	/* retrieve the users primary gid */
2597	filter = talloc_asprintf(mem_ctx,
2598	"(&(objectClass=%s)(uid=%s))",
2599	LDAP_OBJ_SAMBASAMACCOUNT,
2600	escape_name);
2601	if (filter == NULL) {
2602	ret = NT_STATUS_NO_MEMORY;
2603	goto done;
2604	}
2605
2606	rc = smbldap_search(conn, lp_ldap_suffix(),
2607	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
2608
2609	if (rc != LDAP_SUCCESS)
2610	goto done;
2611
2612	talloc_autofree_ldapmsg(mem_ctx, result);
2613
2614	count = ldap_count_entries(priv2ld(ldap_state), result);
2615
2616	switch (count) {
2617	case 0:
2618	DEBUG(1, ("User account [%s] not found!\n", pdb_get_username(user)));
2619	ret = NT_STATUS_NO_SUCH_USER;
2620	goto done;
2621	case 1:
2622	entry = ldap_first_entry(priv2ld(ldap_state), result);
2623
2624	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", mem_ctx);
2625	if (!gidstr) {
2626	DEBUG (1, ("Unable to find the member's gid!\n"));
2627	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2628	goto done;
2629	}
2630	primary_gid = strtoul(gidstr, NULL, 10);
2631	break;
2632	default:
2633	DEBUG(1, ("found more than one account with the same user name ?!\n"));
2634	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2635	goto done;
2636	}
2637
2638	filter = talloc_asprintf(mem_ctx,
2639	"(&(objectClass=%s)(\|(memberUid=%s)(gidNumber=%d)))",
2640	LDAP_OBJ_POSIXGROUP, escape_name, primary_gid);
2641	if (filter == NULL) {
2642	ret = NT_STATUS_NO_MEMORY;
2643	goto done;
2644	}
2645
2646	rc = smbldap_search(conn, lp_ldap_group_suffix(),
2647	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
2648
2649	if (rc != LDAP_SUCCESS)
2650	goto done;
2651
2652	talloc_autofree_ldapmsg(mem_ctx, result);
2653
2654	num_gids = 0;
2655	*pp_gids = NULL;
2656
2657	num_sids = 0;
2658	*pp_sids = NULL;
2659
2660	/* We need to add the primary group as the first gid/sid */
2661
2662	if (!add_gid_to_array_unique(mem_ctx, primary_gid, pp_gids, &num_gids)) {
2663	ret = NT_STATUS_NO_MEMORY;
2664	goto done;
2665	}
2666
2667	/* This sid will be replaced later */
2668
2669	if (!add_sid_to_array_unique(mem_ctx, &global_sid_NULL, pp_sids, &num_sids)) {
2670	ret = NT_STATUS_NO_MEMORY;
2671	goto done;
2672	}
2673
2674	for (entry = ldap_first_entry(conn->ldap_struct, result);
2675	entry != NULL;
2676	entry = ldap_next_entry(conn->ldap_struct, entry))
2677	{
2678	fstring str;
2679	DOM_SID sid;
2680	gid_t gid;
2681	char *end;
2682
2683	if (!smbldap_get_single_attribute(conn->ldap_struct,
2684	entry, "sambaSID",
2685	str, sizeof(str)-1))
2686	continue;
2687
2688	if (!string_to_sid(&sid, str))
2689	goto done;
2690
2691	if (!smbldap_get_single_attribute(conn->ldap_struct,
2692	entry, "gidNumber",
2693	str, sizeof(str)-1))
2694	continue;
2695
2696	gid = strtoul(str, &end, 10);
2697
2698	if (PTR_DIFF(end, str) != strlen(str))
2699	goto done;
2700
2701	if (gid == primary_gid) {
2702	sid_copy(&(*pp_sids)[0], &sid);
2703	} else {
2704	if (!add_gid_to_array_unique(mem_ctx, gid, pp_gids,
2705	&num_gids)) {
2706	ret = NT_STATUS_NO_MEMORY;
2707	goto done;
2708	}
2709	if (!add_sid_to_array_unique(mem_ctx, &sid, pp_sids,
2710	&num_sids)) {
2711	ret = NT_STATUS_NO_MEMORY;
2712	goto done;
2713	}
2714	}
2715	}
2716
2717	if (sid_compare(&global_sid_NULL, &(*pp_sids)[0]) == 0) {
2718	DEBUG(3, ("primary group of [%s] not found\n",
2719	pdb_get_username(user)));
2720	goto done;
2721	}
2722
2723	*p_num_groups = num_sids;
2724
2725	ret = NT_STATUS_OK;
2726
2727	done:
2728
2729	SAFE_FREE(escape_name);
2730	return ret;
2731	}
2732
2733	/**********************************************************************
2734	* Augment a posixGroup object with a sambaGroupMapping domgroup
2735	*********************************************************************/
2736
2737	static NTSTATUS ldapsam_map_posixgroup(TALLOC_CTX *mem_ctx,
2738	struct ldapsam_privates *ldap_state,
2739	GROUP_MAP *map)
2740	{
2741	const char filter, dn;
2742	LDAPMessage msg, entry;
2743	LDAPMod **mods;
2744	int rc;
2745
2746	filter = talloc_asprintf(mem_ctx,
2747	"(&(objectClass=posixGroup)(gidNumber=%u))",
2748	map->gid);
2749	if (filter == NULL) {
2750	return NT_STATUS_NO_MEMORY;
2751	}
2752
2753	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter,
2754	get_attr_list(mem_ctx, groupmap_attr_list),
2755	&msg);
2756	talloc_autofree_ldapmsg(mem_ctx, msg);
2757
2758	if ((rc != LDAP_SUCCESS) \|\|
2759	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) != 1) \|\|
2760	((entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg)) == NULL)) {
2761	return NT_STATUS_NO_SUCH_GROUP;
2762	}
2763
2764	dn = smbldap_talloc_dn(mem_ctx, ldap_state->smbldap_state->ldap_struct, entry);
2765	if (dn == NULL) {
2766	return NT_STATUS_NO_MEMORY;
2767	}
2768
2769	mods = NULL;
2770	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass",
2771	"sambaGroupMapping");
2772	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "sambaSid",
2773	sid_string_static(&map->sid));
2774	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "sambaGroupType",
2775	talloc_asprintf(mem_ctx, "%d", map->sid_name_use));
2776	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "displayName",
2777	map->nt_name);
2778	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
2779	map->comment);
2780	talloc_autofree_ldapmod(mem_ctx, mods);
2781
2782	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2783	if (rc != LDAP_SUCCESS) {
2784	return NT_STATUS_ACCESS_DENIED;
2785	}
2786
2787	return NT_STATUS_OK;
2788	}
2789
2790	static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
2791	GROUP_MAP *map)
2792	{
2793	struct ldapsam_privates *ldap_state =
2794	(struct ldapsam_privates *)methods->private_data;
2795	LDAPMessage *msg = NULL;
2796	LDAPMod **mods = NULL;
2797	const char *attrs[] = { NULL };
2798	char *filter;
2799
2800	char *dn;
2801	TALLOC_CTX *mem_ctx;
2802	NTSTATUS result;
2803
2804	DOM_SID sid;
2805
2806	int rc;
2807
2808	mem_ctx = talloc_new(NULL);
2809	if (mem_ctx == NULL) {
2810	DEBUG(0, ("talloc_new failed\n"));
2811	return NT_STATUS_NO_MEMORY;
2812	}
2813
2814	filter = talloc_asprintf(mem_ctx, "(sambaSid=%s)",
2815	sid_string_static(&map->sid));
2816	if (filter == NULL) {
2817	result = NT_STATUS_NO_MEMORY;
2818	goto done;
2819	}
2820
2821	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
2822	LDAP_SCOPE_SUBTREE, filter, attrs, True, &msg);
2823	talloc_autofree_ldapmsg(mem_ctx, msg);
2824
2825	if ((rc == LDAP_SUCCESS) &&
2826	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) > 0)) {
2827
2828	DEBUG(3, ("SID %s already present in LDAP, refusing to add "
2829	"group mapping entry\n",
2830	sid_string_static(&map->sid)));
2831	result = NT_STATUS_GROUP_EXISTS;
2832	goto done;
2833	}
2834
2835	switch (map->sid_name_use) {
2836
2837	case SID_NAME_DOM_GRP:
2838	/* To map a domain group we need to have a posix group
2839	to attach to. */
2840	result = ldapsam_map_posixgroup(mem_ctx, ldap_state, map);
2841	goto done;
2842	break;
2843
2844	case SID_NAME_ALIAS:
2845	if (!sid_check_is_in_our_domain(&map->sid)
2846	&& !sid_check_is_in_builtin(&map->sid) )
2847	{
2848	DEBUG(3, ("Refusing to map sid %s as an alias, not in our domain\n",
2849	sid_string_static(&map->sid)));
2850	result = NT_STATUS_INVALID_PARAMETER;
2851	goto done;
2852	}
2853	break;
2854
2855	default:
2856	DEBUG(3, ("Got invalid use '%s' for mapping\n",
2857	sid_type_lookup(map->sid_name_use)));
2858	result = NT_STATUS_INVALID_PARAMETER;
2859	goto done;
2860	}
2861
2862	/* Domain groups have been mapped in a separate routine, we have to
2863	* create an alias now */
2864
2865	if (map->gid == -1) {
2866	DEBUG(10, ("Refusing to map gid==-1\n"));
2867	result = NT_STATUS_INVALID_PARAMETER;
2868	goto done;
2869	}
2870
2871	if (pdb_gid_to_sid(map->gid, &sid)) {
2872	DEBUG(3, ("Gid %d is already mapped to SID %s, refusing to "
2873	"add\n", map->gid, sid_string_static(&sid)));
2874	result = NT_STATUS_GROUP_EXISTS;
2875	goto done;
2876	}
2877
2878	/* Ok, enough checks done. It's still racy to go ahead now, but that's
2879	* the best we can get out of LDAP. */
2880
2881	dn = talloc_asprintf(mem_ctx, "sambaSid=%s,%s",
2882	sid_string_static(&map->sid),
2883	lp_ldap_group_suffix());
2884	if (dn == NULL) {
2885	result = NT_STATUS_NO_MEMORY;
2886	goto done;
2887	}
2888
2889	mods = NULL;
2890
2891	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "objectClass",
2892	"sambaSidEntry");
2893	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "objectClass",
2894	"sambaGroupMapping");
2895
2896	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "sambaSid",
2897	sid_string_static(&map->sid));
2898	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "sambaGroupType",
2899	talloc_asprintf(mem_ctx, "%d", map->sid_name_use));
2900	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "displayName",
2901	map->nt_name);
2902	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "description",
2903	map->comment);
2904	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "gidNumber",
2905	talloc_asprintf(mem_ctx, "%u", map->gid));
2906	talloc_autofree_ldapmod(mem_ctx, mods);
2907
2908	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
2909
2910	result = (rc == LDAP_SUCCESS) ?
2911	NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
2912
2913	done:
2914	TALLOC_FREE(mem_ctx);
2915	return result;
2916	}
2917
2918	/**********************************************************************
2919	* Update a group mapping entry. We're quite strict about what can be changed:
2920	* Only the description and displayname may be changed. It simply does not
2921	* make any sense to change the SID, gid or the type in a mapping.
2922	*********************************************************************/
2923
2924	static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods,
2925	GROUP_MAP *map)
2926	{
2927	struct ldapsam_privates *ldap_state =
2928	(struct ldapsam_privates *)methods->private_data;
2929	int rc;
2930	const char filter, dn;
2931	LDAPMessage *msg = NULL;
2932	LDAPMessage *entry = NULL;
2933	LDAPMod **mods = NULL;
2934	TALLOC_CTX *mem_ctx;
2935	NTSTATUS result;
2936
2937	mem_ctx = talloc_new(NULL);
2938	if (mem_ctx == NULL) {
2939	DEBUG(0, ("talloc_new failed\n"));
2940	return NT_STATUS_NO_MEMORY;
2941	}
2942
2943	/* Make 100% sure that sid, gid and type are not changed by looking up
2944	* exactly the values we're given in LDAP. */
2945
2946	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)"
2947	"(sambaSid=%s)(gidNumber=%u)"
2948	"(sambaGroupType=%d))",
2949	LDAP_OBJ_GROUPMAP,
2950	sid_string_static(&map->sid), map->gid,
2951	map->sid_name_use);
2952	if (filter == NULL) {
2953	result = NT_STATUS_NO_MEMORY;
2954	goto done;
2955	}
2956
2957	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter,
2958	get_attr_list(mem_ctx, groupmap_attr_list),
2959	&msg);
2960	talloc_autofree_ldapmsg(mem_ctx, msg);
2961
2962	if ((rc != LDAP_SUCCESS) \|\|
2963	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) != 1) \|\|
2964	((entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg)) == NULL)) {
2965	result = NT_STATUS_NO_SUCH_GROUP;
2966	goto done;
2967	}
2968
2969	dn = smbldap_talloc_dn(mem_ctx, ldap_state->smbldap_state->ldap_struct, entry);
2970
2971	if (dn == NULL) {
2972	result = NT_STATUS_NO_MEMORY;
2973	goto done;
2974	}
2975
2976	mods = NULL;
2977	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "displayName",
2978	map->nt_name);
2979	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
2980	map->comment);
2981	talloc_autofree_ldapmod(mem_ctx, mods);
2982
2983	if (mods == NULL) {
2984	DEBUG(4, ("ldapsam_update_group_mapping_entry: mods is empty: "
2985	"nothing to do\n"));
2986	result = NT_STATUS_OK;
2987	goto done;
2988	}
2989
2990	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2991
2992	if (rc != LDAP_SUCCESS) {
2993	result = NT_STATUS_ACCESS_DENIED;
2994	goto done;
2995	}
2996
2997	DEBUG(2, ("ldapsam_update_group_mapping_entry: successfully modified "
2998	"group %lu in LDAP\n", (unsigned long)map->gid));
2999
3000	result = NT_STATUS_OK;
3001
3002	done:
3003	TALLOC_FREE(mem_ctx);
3004	return result;
3005	}
3006
3007	/**********************************************************************
3008	*********************************************************************/
3009
3010	static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods,
3011	DOM_SID sid)
3012	{
3013	struct ldapsam_privates *priv =
3014	(struct ldapsam_privates *)methods->private_data;
3015	LDAPMessage msg, entry;
3016	int rc;
3017	NTSTATUS result;
3018	TALLOC_CTX *mem_ctx;
3019	char *filter;
3020
3021	mem_ctx = talloc_new(NULL);
3022	if (mem_ctx == NULL) {
3023	DEBUG(0, ("talloc_new failed\n"));
3024	return NT_STATUS_NO_MEMORY;
3025	}
3026
3027	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(%s=%s))",
3028	LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID,
3029	sid_string_static(&sid));
3030	if (filter == NULL) {
3031	result = NT_STATUS_NO_MEMORY;
3032	goto done;
3033	}
3034	rc = smbldap_search_suffix(priv->smbldap_state, filter,
3035	get_attr_list(mem_ctx, groupmap_attr_list),
3036	&msg);
3037	talloc_autofree_ldapmsg(mem_ctx, msg);
3038
3039	if ((rc != LDAP_SUCCESS) \|\|
3040	(ldap_count_entries(priv2ld(priv), msg) != 1) \|\|
3041	((entry = ldap_first_entry(priv2ld(priv), msg)) == NULL)) {
3042	result = NT_STATUS_NO_SUCH_GROUP;
3043	goto done;
3044	}
3045
3046	rc = ldapsam_delete_entry(priv, mem_ctx, entry, LDAP_OBJ_GROUPMAP,
3047	get_attr_list(mem_ctx,
3048	groupmap_attr_list_to_delete));
3049
3050	if ((rc == LDAP_NAMING_VIOLATION) \|\|
3051	(rc == LDAP_OBJECT_CLASS_VIOLATION)) {
3052	const char *attrs[] = { "sambaGroupType", "description",
3053	"displayName", "sambaSIDList",
3054	NULL };
3055
3056	/* Second try. Don't delete the sambaSID attribute, this is
3057	for "old" entries that are tacked on a winbind
3058	sambaIdmapEntry. */
3059
3060	rc = ldapsam_delete_entry(priv, mem_ctx, entry,
3061	LDAP_OBJ_GROUPMAP, attrs);
3062	}
3063
3064	if ((rc == LDAP_NAMING_VIOLATION) \|\|
3065	(rc == LDAP_OBJECT_CLASS_VIOLATION)) {
3066	const char *attrs[] = { "sambaGroupType", "description",
3067	"displayName", "sambaSIDList",
3068	"gidNumber", NULL };
3069
3070	/* Third try. This is a post-3.0.21 alias (containing only
3071	* sambaSidEntry and sambaGroupMapping classes), we also have
3072	* to delete the gidNumber attribute, only the sambaSidEntry
3073	* remains */
3074
3075	rc = ldapsam_delete_entry(priv, mem_ctx, entry,
3076	LDAP_OBJ_GROUPMAP, attrs);
3077	}
3078
3079	result = (rc == LDAP_SUCCESS) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
3080
3081	done:
3082	TALLOC_FREE(mem_ctx);
3083	return result;
3084	}
3085
3086	/**********************************************************************
3087	*********************************************************************/
3088
3089	static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods,
3090	BOOL update)
3091	{
3092	struct ldapsam_privates *ldap_state =
3093	(struct ldapsam_privates *)my_methods->private_data;
3094	fstring filter;
3095	int rc;
3096	const char **attr_list;
3097
3098	pstr_sprintf( filter, "(objectclass=%s)", LDAP_OBJ_GROUPMAP);
3099	attr_list = get_attr_list( NULL, groupmap_attr_list );
3100	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
3101	LDAP_SCOPE_SUBTREE, filter,
3102	attr_list, 0, &ldap_state->result);
3103	TALLOC_FREE(attr_list);
3104
3105	if (rc != LDAP_SUCCESS) {
3106	DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n",
3107	ldap_err2string(rc)));
3108	DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n",
3109	lp_ldap_group_suffix(), filter));
3110	ldap_msgfree(ldap_state->result);
3111	ldap_state->result = NULL;
3112	return NT_STATUS_UNSUCCESSFUL;
3113	}
3114
3115	DEBUG(2, ("ldapsam_setsamgrent: %d entries in the base!\n",
3116	ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3117	ldap_state->result)));
3118
3119	ldap_state->entry =
3120	ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3121	ldap_state->result);
3122	ldap_state->index = 0;
3123
3124	return NT_STATUS_OK;
3125	}
3126
3127	/**********************************************************************
3128	*********************************************************************/
3129
3130	static void ldapsam_endsamgrent(struct pdb_methods *my_methods)
3131	{
3132	ldapsam_endsampwent(my_methods);
3133	}
3134
3135	/**********************************************************************
3136	*********************************************************************/
3137
3138	static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods,
3139	GROUP_MAP *map)
3140	{
3141	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
3142	struct ldapsam_privates *ldap_state =
3143	(struct ldapsam_privates *)my_methods->private_data;
3144	BOOL bret = False;
3145
3146	while (!bret) {
3147	if (!ldap_state->entry)
3148	return ret;
3149
3150	ldap_state->index++;
3151	bret = init_group_from_ldap(ldap_state, map,
3152	ldap_state->entry);
3153
3154	ldap_state->entry =
3155	ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
3156	ldap_state->entry);
3157	}
3158
3159	return NT_STATUS_OK;
3160	}
3161
3162	/**********************************************************************
3163	*********************************************************************/
3164
3165	static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
3166	const DOM_SID *domsid, enum lsa_SidType sid_name_use,
3167	GROUP_MAP **pp_rmap,
3168	size_t *p_num_entries,
3169	BOOL unix_only)
3170	{
3171	GROUP_MAP map;
3172	size_t entries = 0;
3173
3174	*p_num_entries = 0;
3175	*pp_rmap = NULL;
3176
3177	if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods, False))) {
3178	DEBUG(0, ("ldapsam_enum_group_mapping: Unable to open "
3179	"passdb\n"));
3180	return NT_STATUS_ACCESS_DENIED;
3181	}
3182
3183	while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) {
3184	if (sid_name_use != SID_NAME_UNKNOWN &&
3185	sid_name_use != map.sid_name_use) {
3186	DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
3187	"not of the requested type\n", map.nt_name));
3188	continue;
3189	}
3190	if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
3191	DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
3192	"non mapped\n", map.nt_name));
3193	continue;
3194	}
3195
3196	(pp_rmap)=SMB_REALLOC_ARRAY((pp_rmap), GROUP_MAP, entries+1);
3197	if (!(*pp_rmap)) {
3198	DEBUG(0,("ldapsam_enum_group_mapping: Unable to "
3199	"enlarge group map!\n"));
3200	return NT_STATUS_UNSUCCESSFUL;
3201	}
3202
3203	(*pp_rmap)[entries] = map;
3204
3205	entries += 1;
3206
3207	}
3208	ldapsam_endsamgrent(methods);
3209
3210	*p_num_entries = entries;
3211
3212	return NT_STATUS_OK;
3213	}
3214
3215	static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
3216	const DOM_SID *alias,
3217	const DOM_SID *member,
3218	int modop)
3219	{
3220	struct ldapsam_privates *ldap_state =
3221	(struct ldapsam_privates *)methods->private_data;
3222	char *dn;
3223	LDAPMessage *result = NULL;
3224	LDAPMessage *entry = NULL;
3225	int count;
3226	LDAPMod **mods = NULL;
3227	int rc;
3228	enum lsa_SidType type = SID_NAME_USE_NONE;
3229
3230	pstring filter;
3231
3232	if (sid_check_is_in_builtin(alias)) {
3233	type = SID_NAME_ALIAS;
3234	}
3235
3236	if (sid_check_is_in_our_domain(alias)) {
3237	type = SID_NAME_ALIAS;
3238	}
3239
3240	if (type == SID_NAME_USE_NONE) {
3241	DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
3242	sid_string_static(alias)));
3243	return NT_STATUS_NO_SUCH_ALIAS;
3244	}
3245
3246	pstr_sprintf(filter,
3247	"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
3248	LDAP_OBJ_GROUPMAP, sid_string_static(alias),
3249	type);
3250
3251	if (ldapsam_search_one_group(ldap_state, filter,
3252	&result) != LDAP_SUCCESS)
3253	return NT_STATUS_NO_SUCH_ALIAS;
3254
3255	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3256	result);
3257
3258	if (count < 1) {
3259	DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
3260	ldap_msgfree(result);
3261	return NT_STATUS_NO_SUCH_ALIAS;
3262	}
3263
3264	if (count > 1) {
3265	DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for "
3266	"filter %s: count=%d\n", filter, count));
3267	ldap_msgfree(result);
3268	return NT_STATUS_NO_SUCH_ALIAS;
3269	}
3270
3271	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3272	result);
3273
3274	if (!entry) {
3275	ldap_msgfree(result);
3276	return NT_STATUS_UNSUCCESSFUL;
3277	}
3278
3279	dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
3280	if (!dn) {
3281	ldap_msgfree(result);
3282	return NT_STATUS_UNSUCCESSFUL;
3283	}
3284
3285	smbldap_set_mod(&mods, modop,
3286	get_attr_key2string(groupmap_attr_list,
3287	LDAP_ATTR_SID_LIST),
3288	sid_string_static(member));
3289
3290	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3291
3292	ldap_mods_free(mods, True);
3293	ldap_msgfree(result);
3294	SAFE_FREE(dn);
3295
3296	if (rc == LDAP_TYPE_OR_VALUE_EXISTS) {
3297	return NT_STATUS_MEMBER_IN_ALIAS;
3298	}
3299
3300	if (rc == LDAP_NO_SUCH_ATTRIBUTE) {
3301	return NT_STATUS_MEMBER_NOT_IN_ALIAS;
3302	}
3303
3304	if (rc != LDAP_SUCCESS) {
3305	return NT_STATUS_UNSUCCESSFUL;
3306	}
3307
3308	return NT_STATUS_OK;
3309	}
3310
3311	static NTSTATUS ldapsam_add_aliasmem(struct pdb_methods *methods,
3312	const DOM_SID *alias,
3313	const DOM_SID *member)
3314	{
3315	return ldapsam_modify_aliasmem(methods, alias, member, LDAP_MOD_ADD);
3316	}
3317
3318	static NTSTATUS ldapsam_del_aliasmem(struct pdb_methods *methods,
3319	const DOM_SID *alias,
3320	const DOM_SID *member)
3321	{
3322	return ldapsam_modify_aliasmem(methods, alias, member,
3323	LDAP_MOD_DELETE);
3324	}
3325
3326	static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
3327	const DOM_SID *alias,
3328	DOM_SID **pp_members,
3329	size_t *p_num_members)
3330	{
3331	struct ldapsam_privates *ldap_state =
3332	(struct ldapsam_privates *)methods->private_data;
3333	LDAPMessage *result = NULL;
3334	LDAPMessage *entry = NULL;
3335	int count;
3336	char **values;
3337	int i;
3338	pstring filter;
3339	size_t num_members = 0;
3340	enum lsa_SidType type = SID_NAME_USE_NONE;
3341
3342	*pp_members = NULL;
3343	*p_num_members = 0;
3344
3345	if (sid_check_is_in_builtin(alias)) {
3346	type = SID_NAME_ALIAS;
3347	}
3348
3349	if (sid_check_is_in_our_domain(alias)) {
3350	type = SID_NAME_ALIAS;
3351	}
3352
3353	if (type == SID_NAME_USE_NONE) {
3354	DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
3355	sid_string_static(alias)));
3356	return NT_STATUS_NO_SUCH_ALIAS;
3357	}
3358
3359	pstr_sprintf(filter,
3360	"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
3361	LDAP_OBJ_GROUPMAP, sid_string_static(alias),
3362	type);
3363
3364	if (ldapsam_search_one_group(ldap_state, filter,
3365	&result) != LDAP_SUCCESS)
3366	return NT_STATUS_NO_SUCH_ALIAS;
3367
3368	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3369	result);
3370
3371	if (count < 1) {
3372	DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
3373	ldap_msgfree(result);
3374	return NT_STATUS_NO_SUCH_ALIAS;
3375	}
3376
3377	if (count > 1) {
3378	DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for "
3379	"filter %s: count=%d\n", filter, count));
3380	ldap_msgfree(result);
3381	return NT_STATUS_NO_SUCH_ALIAS;
3382	}
3383
3384	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3385	result);
3386
3387	if (!entry) {
3388	ldap_msgfree(result);
3389	return NT_STATUS_UNSUCCESSFUL;
3390	}
3391
3392	values = ldap_get_values(ldap_state->smbldap_state->ldap_struct,
3393	entry,
3394	get_attr_key2string(groupmap_attr_list,
3395	LDAP_ATTR_SID_LIST));
3396
3397	if (values == NULL) {
3398	ldap_msgfree(result);
3399	return NT_STATUS_OK;
3400	}
3401
3402	count = ldap_count_values(values);
3403
3404	for (i=0; i<count; i++) {
3405	DOM_SID member;
3406
3407	if (!string_to_sid(&member, values[i]))
3408	continue;
3409
3410	if (!add_sid_to_array(NULL, &member, pp_members, &num_members)) {
3411	ldap_value_free(values);
3412	ldap_msgfree(result);
3413	return NT_STATUS_NO_MEMORY;
3414	}
3415	}
3416
3417	*p_num_members = num_members;
3418	ldap_value_free(values);
3419	ldap_msgfree(result);
3420
3421	return NT_STATUS_OK;
3422	}
3423
3424	static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
3425	TALLOC_CTX *mem_ctx,
3426	const DOM_SID *domain_sid,
3427	const DOM_SID *members,
3428	size_t num_members,
3429	uint32 **pp_alias_rids,
3430	size_t *p_num_alias_rids)
3431	{
3432	struct ldapsam_privates *ldap_state =
3433	(struct ldapsam_privates *)methods->private_data;
3434	LDAP *ldap_struct;
3435
3436	const char *attrs[] = { LDAP_ATTRIBUTE_SID, NULL };
3437
3438	LDAPMessage *result = NULL;
3439	LDAPMessage *entry = NULL;
3440	int i;
3441	int rc;
3442	char *filter;
3443	enum lsa_SidType type = SID_NAME_USE_NONE;
3444
3445	if (sid_check_is_builtin(domain_sid)) {
3446	type = SID_NAME_ALIAS;
3447	}
3448
3449	if (sid_check_is_domain(domain_sid)) {
3450	type = SID_NAME_ALIAS;
3451	}
3452
3453	if (type == SID_NAME_USE_NONE) {
3454	DEBUG(5, ("SID %s is neither builtin nor domain!\n",
3455	sid_string_static(domain_sid)));
3456	return NT_STATUS_UNSUCCESSFUL;
3457	}
3458
3459	filter = talloc_asprintf(mem_ctx,
3460	"(&(\|(objectclass=%s)(sambaGroupType=%d))(\|",
3461	LDAP_OBJ_GROUPMAP, type);
3462
3463	for (i=0; i<num_members; i++)
3464	filter = talloc_asprintf(mem_ctx, "%s(sambaSIDList=%s)",
3465	filter,
3466	sid_string_static(&members[i]));
3467
3468	filter = talloc_asprintf(mem_ctx, "%s))", filter);
3469
3470	if (filter == NULL) {
3471	return NT_STATUS_NO_MEMORY;
3472	}
3473
3474	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
3475	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
3476
3477	if (rc != LDAP_SUCCESS)
3478	return NT_STATUS_UNSUCCESSFUL;
3479
3480	ldap_struct = ldap_state->smbldap_state->ldap_struct;
3481
3482	for (entry = ldap_first_entry(ldap_struct, result);
3483	entry != NULL;
3484	entry = ldap_next_entry(ldap_struct, entry))
3485	{
3486	fstring sid_str;
3487	DOM_SID sid;
3488	uint32 rid;
3489
3490	if (!smbldap_get_single_attribute(ldap_struct, entry,
3491	LDAP_ATTRIBUTE_SID,
3492	sid_str,
3493	sizeof(sid_str)-1))
3494	continue;
3495
3496	if (!string_to_sid(&sid, sid_str))
3497	continue;
3498
3499	if (!sid_peek_check_rid(domain_sid, &sid, &rid))
3500	continue;
3501
3502	if (!add_rid_to_array_unique(mem_ctx, rid, pp_alias_rids,
3503	p_num_alias_rids)) {
3504	ldap_msgfree(result);
3505	return NT_STATUS_NO_MEMORY;
3506	}
3507	}
3508
3509	ldap_msgfree(result);
3510	return NT_STATUS_OK;
3511	}
3512
3513	static NTSTATUS ldapsam_set_account_policy_in_ldap(struct pdb_methods *methods,
3514	int policy_index,
3515	uint32 value)
3516	{
3517	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3518	int rc;
3519	LDAPMod **mods = NULL;
3520	fstring value_string;
3521	const char *policy_attr = NULL;
3522
3523	struct ldapsam_privates *ldap_state =
3524	(struct ldapsam_privates *)methods->private_data;
3525
3526	DEBUG(10,("ldapsam_set_account_policy_in_ldap\n"));
3527
3528	if (!ldap_state->domain_dn) {
3529	return NT_STATUS_INVALID_PARAMETER;
3530	}
3531
3532	policy_attr = get_account_policy_attr(policy_index);
3533	if (policy_attr == NULL) {
3534	DEBUG(0,("ldapsam_set_account_policy_in_ldap: invalid "
3535	"policy\n"));
3536	return ntstatus;
3537	}
3538
3539	slprintf(value_string, sizeof(value_string) - 1, "%i", value);
3540
3541	smbldap_set_mod(&mods, LDAP_MOD_REPLACE, policy_attr, value_string);
3542
3543	rc = smbldap_modify(ldap_state->smbldap_state, ldap_state->domain_dn,
3544	mods);
3545
3546	ldap_mods_free(mods, True);
3547
3548	if (rc != LDAP_SUCCESS) {
3549	return ntstatus;
3550	}
3551
3552	if (!cache_account_policy_set(policy_index, value)) {
3553	DEBUG(0,("ldapsam_set_account_policy_in_ldap: failed to "
3554	"update local tdb cache\n"));
3555	return ntstatus;
3556	}
3557
3558	return NT_STATUS_OK;
3559	}
3560
3561	static NTSTATUS ldapsam_set_account_policy(struct pdb_methods *methods,
3562	int policy_index, uint32 value)
3563	{
3564	return ldapsam_set_account_policy_in_ldap(methods, policy_index,
3565	value);
3566	}
3567
3568	static NTSTATUS ldapsam_get_account_policy_from_ldap(struct pdb_methods *methods,
3569	int policy_index,
3570	uint32 *value)
3571	{
3572	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3573	LDAPMessage *result = NULL;
3574	LDAPMessage *entry = NULL;
3575	int count;
3576	int rc;
3577	char **vals = NULL;
3578	const char *policy_attr = NULL;
3579
3580	struct ldapsam_privates *ldap_state =
3581	(struct ldapsam_privates *)methods->private_data;
3582
3583	const char *attrs[2];
3584
3585	DEBUG(10,("ldapsam_get_account_policy_from_ldap\n"));
3586
3587	if (!ldap_state->domain_dn) {
3588	return NT_STATUS_INVALID_PARAMETER;
3589	}
3590
3591	policy_attr = get_account_policy_attr(policy_index);
3592	if (!policy_attr) {
3593	DEBUG(0,("ldapsam_get_account_policy_from_ldap: invalid "
3594	"policy index: %d\n", policy_index));
3595	return ntstatus;
3596	}
3597
3598	attrs[0] = policy_attr;
3599	attrs[1] = NULL;
3600
3601	rc = smbldap_search(ldap_state->smbldap_state, ldap_state->domain_dn,
3602	LDAP_SCOPE_BASE, "(objectclass=*)", attrs, 0,
3603	&result);
3604
3605	if (rc != LDAP_SUCCESS) {
3606	return ntstatus;
3607	}
3608
3609	count = ldap_count_entries(priv2ld(ldap_state), result);
3610	if (count < 1) {
3611	goto out;
3612	}
3613
3614	entry = ldap_first_entry(priv2ld(ldap_state), result);
3615	if (entry == NULL) {
3616	goto out;
3617	}
3618
3619	vals = ldap_get_values(priv2ld(ldap_state), entry, policy_attr);
3620	if (vals == NULL) {
3621	goto out;
3622	}
3623
3624	*value = (uint32)atol(vals[0]);
3625
3626	ntstatus = NT_STATUS_OK;
3627
3628	out:
3629	if (vals)
3630	ldap_value_free(vals);
3631	ldap_msgfree(result);
3632
3633	return ntstatus;
3634	}
3635
3636	/* wrapper around ldapsam_get_account_policy_from_ldap(), handles tdb as cache
3637
3638	- if user hasn't decided to use account policies inside LDAP just reuse the
3639	old tdb values
3640
3641	- if there is a valid cache entry, return that
3642	- if there is an LDAP entry, update cache and return
3643	- otherwise set to default, update cache and return
3644
3645	Guenther
3646	*/
3647	static NTSTATUS ldapsam_get_account_policy(struct pdb_methods *methods,
3648	int policy_index, uint32 *value)
3649	{
3650	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3651
3652	if (cache_account_policy_get(policy_index, value)) {
3653	DEBUG(11,("ldapsam_get_account_policy: got valid value from "
3654	"cache\n"));
3655	return NT_STATUS_OK;
3656	}
3657
3658	ntstatus = ldapsam_get_account_policy_from_ldap(methods, policy_index,
3659	value);
3660	if (NT_STATUS_IS_OK(ntstatus)) {
3661	goto update_cache;
3662	}
3663
3664	DEBUG(10,("ldapsam_get_account_policy: failed to retrieve from "
3665	"ldap\n"));
3666
3667	#if 0
3668	/* should we automagically migrate old tdb value here ? */
3669	if (account_policy_get(policy_index, value))
3670	goto update_ldap;
3671
3672	DEBUG(10,("ldapsam_get_account_policy: no tdb for %d, trying "
3673	"default\n", policy_index));
3674	#endif
3675
3676	if (!account_policy_get_default(policy_index, value)) {
3677	return ntstatus;
3678	}
3679
3680	/* update_ldap: */
3681
3682	ntstatus = ldapsam_set_account_policy(methods, policy_index, *value);
3683	if (!NT_STATUS_IS_OK(ntstatus)) {
3684	return ntstatus;
3685	}
3686
3687	update_cache:
3688
3689	if (!cache_account_policy_set(policy_index, *value)) {
3690	DEBUG(0,("ldapsam_get_account_policy: failed to update local "
3691	"tdb as a cache\n"));
3692	return NT_STATUS_UNSUCCESSFUL;
3693	}
3694
3695	return NT_STATUS_OK;
3696	}
3697
3698	static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
3699	const DOM_SID *domain_sid,
3700	int num_rids,
3701	uint32 *rids,
3702	const char **names,
3703	enum lsa_SidType *attrs)
3704	{
3705	struct ldapsam_privates *ldap_state =
3706	(struct ldapsam_privates *)methods->private_data;
3707	LDAPMessage *msg = NULL;
3708	LDAPMessage *entry;
3709	char *allsids = NULL;
3710	int i, rc, num_mapped;
3711	NTSTATUS result = NT_STATUS_NO_MEMORY;
3712	TALLOC_CTX *mem_ctx;
3713	LDAP *ld;
3714	BOOL is_builtin;
3715
3716	mem_ctx = talloc_new(NULL);
3717	if (mem_ctx == NULL) {
3718	DEBUG(0, ("talloc_new failed\n"));
3719	goto done;
3720	}
3721
3722	if (!sid_check_is_builtin(domain_sid) &&
3723	!sid_check_is_domain(domain_sid)) {
3724	result = NT_STATUS_INVALID_PARAMETER;
3725	goto done;
3726	}
3727
3728	for (i=0; i<num_rids; i++)
3729	attrs[i] = SID_NAME_UNKNOWN;
3730
3731	allsids = talloc_strdup(mem_ctx, "");
3732	if (allsids == NULL) {
3733	goto done;
3734	}
3735
3736	for (i=0; i<num_rids; i++) {
3737	DOM_SID sid;
3738	sid_compose(&sid, domain_sid, rids[i]);
3739	allsids = talloc_asprintf_append(allsids, "(sambaSid=%s)",
3740	sid_string_static(&sid));
3741	if (allsids == NULL) {
3742	goto done;
3743	}
3744	}
3745
3746	/* First look for users */
3747
3748	{
3749	char *filter;
3750	const char *ldap_attrs[] = { "uid", "sambaSid", NULL };
3751
3752	filter = talloc_asprintf(
3753	mem_ctx, ("(&(objectClass=%s)(\|%s))"),
3754	LDAP_OBJ_SAMBASAMACCOUNT, allsids);
3755
3756	if (filter == NULL) {
3757	goto done;
3758	}
3759
3760	rc = smbldap_search(ldap_state->smbldap_state,
3761	lp_ldap_user_suffix(),
3762	LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
3763	&msg);
3764	talloc_autofree_ldapmsg(mem_ctx, msg);
3765	}
3766
3767	if (rc != LDAP_SUCCESS)
3768	goto done;
3769
3770	ld = ldap_state->smbldap_state->ldap_struct;
3771	num_mapped = 0;
3772
3773	for (entry = ldap_first_entry(ld, msg);
3774	entry != NULL;
3775	entry = ldap_next_entry(ld, entry)) {
3776	uint32 rid;
3777	int rid_index;
3778	const char *name;
3779
3780	if (!ldapsam_extract_rid_from_entry(ld, entry, domain_sid,
3781	&rid)) {
3782	DEBUG(2, ("Could not find sid from ldap entry\n"));
3783	continue;
3784	}
3785
3786	name = smbldap_talloc_single_attribute(ld, entry, "uid",
3787	names);
3788	if (name == NULL) {
3789	DEBUG(2, ("Could not retrieve uid attribute\n"));
3790	continue;
3791	}
3792
3793	for (rid_index = 0; rid_index < num_rids; rid_index++) {
3794	if (rid == rids[rid_index])
3795	break;
3796	}
3797
3798	if (rid_index == num_rids) {
3799	DEBUG(2, ("Got a RID not asked for: %d\n", rid));
3800	continue;
3801	}
3802
3803	attrs[rid_index] = SID_NAME_USER;
3804	names[rid_index] = name;
3805	num_mapped += 1;
3806	}
3807
3808	if (num_mapped == num_rids) {
3809	/* No need to look for groups anymore -- we're done */
3810	result = NT_STATUS_OK;
3811	goto done;
3812	}
3813
3814	/* Same game for groups */
3815
3816	{
3817	char *filter;
3818	const char *ldap_attrs[] = { "cn", "displayName", "sambaSid",
3819	"sambaGroupType", NULL };
3820
3821	filter = talloc_asprintf(
3822	mem_ctx, "(&(objectClass=%s)(\|%s))",
3823	LDAP_OBJ_GROUPMAP, allsids);
3824	if (filter == NULL) {
3825	goto done;
3826	}
3827
3828	rc = smbldap_search(ldap_state->smbldap_state,
3829	lp_ldap_group_suffix(),
3830	LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
3831	&msg);
3832	talloc_autofree_ldapmsg(mem_ctx, msg);
3833	}
3834
3835	if (rc != LDAP_SUCCESS)
3836	goto done;
3837
3838	/* ldap_struct might have changed due to a reconnect */
3839
3840	ld = ldap_state->smbldap_state->ldap_struct;
3841
3842	/* For consistency checks, we already checked we're only domain or builtin */
3843
3844	is_builtin = sid_check_is_builtin(domain_sid);
3845
3846	for (entry = ldap_first_entry(ld, msg);
3847	entry != NULL;
3848	entry = ldap_next_entry(ld, entry))
3849	{
3850	uint32 rid;
3851	int rid_index;
3852	const char *attr;
3853	enum lsa_SidType type;
3854	const char *dn = smbldap_talloc_dn(mem_ctx, ld, entry);
3855
3856	attr = smbldap_talloc_single_attribute(ld, entry, "sambaGroupType",
3857	mem_ctx);
3858	if (attr == NULL) {
3859	DEBUG(2, ("Could not extract type from ldap entry %s\n",
3860	dn));
3861	continue;
3862	}
3863
3864	type = (enum lsa_SidType)atol(attr);
3865
3866	/* Consistency checks */
3867	if ((is_builtin && (type != SID_NAME_ALIAS)) \|\|
3868	(!is_builtin && ((type != SID_NAME_ALIAS) &&
3869	(type != SID_NAME_DOM_GRP)))) {
3870	DEBUG(2, ("Rejecting invalid group mapping entry %s\n", dn));
3871	}
3872
3873	if (!ldapsam_extract_rid_from_entry(ld, entry, domain_sid,
3874	&rid)) {
3875	DEBUG(2, ("Could not find sid from ldap entry %s\n", dn));
3876	continue;
3877	}
3878
3879	attr = smbldap_talloc_single_attribute(ld, entry, "displayName", names);
3880
3881	if (attr == NULL) {
3882	DEBUG(10, ("Could not retrieve 'displayName' attribute from %s\n",
3883	dn));
3884	attr = smbldap_talloc_single_attribute(ld, entry, "cn", names);
3885	}
3886
3887	if (attr == NULL) {
3888	DEBUG(2, ("Could not retrieve naming attribute from %s\n",
3889	dn));
3890	continue;
3891	}
3892
3893	for (rid_index = 0; rid_index < num_rids; rid_index++) {
3894	if (rid == rids[rid_index])
3895	break;
3896	}
3897
3898	if (rid_index == num_rids) {
3899	DEBUG(2, ("Got a RID not asked for: %d\n", rid));
3900	continue;
3901	}
3902
3903	attrs[rid_index] = type;
3904	names[rid_index] = attr;
3905	num_mapped += 1;
3906	}
3907
3908	result = NT_STATUS_NONE_MAPPED;
3909
3910	if (num_mapped > 0)
3911	result = (num_mapped == num_rids) ?
3912	NT_STATUS_OK : STATUS_SOME_UNMAPPED;
3913	done:
3914	TALLOC_FREE(mem_ctx);
3915	return result;
3916	}
3917
3918	static char get_ldap_filter(TALLOC_CTX mem_ctx, const char *username)
3919	{
3920	char *filter = NULL;
3921	char *escaped = NULL;
3922	char *result = NULL;
3923
3924	asprintf(&filter, "(&%s(objectclass=sambaSamAccount))",
3925	"(uid=%u)");
3926	if (filter == NULL) goto done;
3927
3928	escaped = escape_ldap_string_alloc(username);
3929	if (escaped == NULL) goto done;
3930
3931	result = talloc_string_sub(mem_ctx, filter, "%u", username);
3932
3933	done:
3934	SAFE_FREE(filter);
3935	SAFE_FREE(escaped);
3936
3937	return result;
3938	}
3939
3940	const char *talloc_attrs(TALLOC_CTX mem_ctx, ...)
3941	{
3942	int i, num = 0;
3943	va_list ap;
3944	const char **result;
3945
3946	va_start(ap, mem_ctx);
3947	while (va_arg(ap, const char *) != NULL)
3948	num += 1;
3949	va_end(ap);
3950
3951	if ((result = TALLOC_ARRAY(mem_ctx, const char *, num+1)) == NULL) {
3952	return NULL;
3953	}
3954
3955	va_start(ap, mem_ctx);
3956	for (i=0; i<num; i++) {
3957	result[i] = talloc_strdup(result, va_arg(ap, const char*));
3958	if (result[i] == NULL) {
3959	talloc_free(result);
3960	return NULL;
3961	}
3962	}
3963	va_end(ap);
3964
3965	result[num] = NULL;
3966	return result;
3967	}
3968
3969	struct ldap_search_state {
3970	struct smbldap_state *connection;
3971
3972	uint32 acct_flags;
3973	uint16 group_type;
3974
3975	const char *base;
3976	int scope;
3977	const char *filter;
3978	const char **attrs;
3979	int attrsonly;
3980	void *pagedresults_cookie;
3981
3982	LDAPMessage entries, current_entry;
3983	BOOL (ldap2displayentry)(struct ldap_search_state state,
3984	TALLOC_CTX *mem_ctx,
3985	LDAP ld, LDAPMessage entry,
3986	struct samr_displayentry *result);
3987	};
3988
3989	static BOOL ldapsam_search_firstpage(struct pdb_search *search)
3990	{
3991	struct ldap_search_state *state =
3992	(struct ldap_search_state *)search->private_data;
3993	LDAP *ld;
3994	int rc = LDAP_OPERATIONS_ERROR;
3995
3996	state->entries = NULL;
3997
3998	if (state->connection->paged_results) {
3999	rc = smbldap_search_paged(state->connection, state->base,
4000	state->scope, state->filter,
4001	state->attrs, state->attrsonly,
4002	lp_ldap_page_size(), &state->entries,
4003	&state->pagedresults_cookie);
4004	}
4005
4006	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL)) {
4007
4008	if (state->entries != NULL) {
4009	/* Left over from unsuccessful paged attempt */
4010	ldap_msgfree(state->entries);
4011	state->entries = NULL;
4012	}
4013
4014	rc = smbldap_search(state->connection, state->base,
4015	state->scope, state->filter, state->attrs,
4016	state->attrsonly, &state->entries);
4017
4018	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL))
4019	return False;
4020
4021	/* Ok, the server was lying. It told us it could do paged
4022	* searches when it could not. */
4023	state->connection->paged_results = False;
4024	}
4025
4026	ld = state->connection->ldap_struct;
4027	if ( ld == NULL) {
4028	DEBUG(5, ("Don't have an LDAP connection right after a "
4029	"search\n"));
4030	return False;
4031	}
4032	state->current_entry = ldap_first_entry(ld, state->entries);
4033
4034	if (state->current_entry == NULL) {
4035	ldap_msgfree(state->entries);
4036	state->entries = NULL;
4037	}
4038
4039	return True;
4040	}
4041
4042	static BOOL ldapsam_search_nextpage(struct pdb_search *search)
4043	{
4044	struct ldap_search_state *state =
4045	(struct ldap_search_state *)search->private_data;
4046	int rc;
4047
4048	if (!state->connection->paged_results) {
4049	/* There is no next page when there are no paged results */
4050	return False;
4051	}
4052
4053	rc = smbldap_search_paged(state->connection, state->base,
4054	state->scope, state->filter, state->attrs,
4055	state->attrsonly, lp_ldap_page_size(),
4056	&state->entries,
4057	&state->pagedresults_cookie);
4058
4059	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL))
4060	return False;
4061
4062	state->current_entry = ldap_first_entry(state->connection->ldap_struct, state->entries);
4063
4064	if (state->current_entry == NULL) {
4065	ldap_msgfree(state->entries);
4066	state->entries = NULL;
4067	}
4068
4069	return True;
4070	}
4071
4072	static BOOL ldapsam_search_next_entry(struct pdb_search *search,
4073	struct samr_displayentry *entry)
4074	{
4075	struct ldap_search_state *state =
4076	(struct ldap_search_state *)search->private_data;
4077	BOOL result;
4078
4079	retry:
4080	if ((state->entries == NULL) && (state->pagedresults_cookie == NULL))
4081	return False;
4082
4083	if ((state->entries == NULL) &&
4084	!ldapsam_search_nextpage(search))
4085	return False;
4086
4087	result = state->ldap2displayentry(state, search->mem_ctx, state->connection->ldap_struct,
4088	state->current_entry, entry);
4089
4090	if (!result) {
4091	char *dn;
4092	dn = ldap_get_dn(state->connection->ldap_struct, state->current_entry);
4093	DEBUG(5, ("Skipping entry %s\n", dn != NULL ? dn : "<NULL>"));
4094	if (dn != NULL) ldap_memfree(dn);
4095	}
4096
4097	state->current_entry = ldap_next_entry(state->connection->ldap_struct, state->current_entry);
4098
4099	if (state->current_entry == NULL) {
4100	ldap_msgfree(state->entries);
4101	state->entries = NULL;
4102	}
4103
4104	if (!result) goto retry;
4105
4106	return True;
4107	}
4108
4109	static void ldapsam_search_end(struct pdb_search *search)
4110	{
4111	struct ldap_search_state *state =
4112	(struct ldap_search_state *)search->private_data;
4113	int rc;
4114
4115	if (state->pagedresults_cookie == NULL)
4116	return;
4117
4118	if (state->entries != NULL)
4119	ldap_msgfree(state->entries);
4120
4121	state->entries = NULL;
4122	state->current_entry = NULL;
4123
4124	if (!state->connection->paged_results)
4125	return;
4126
4127	/* Tell the LDAP server we're not interested in the rest anymore. */
4128
4129	rc = smbldap_search_paged(state->connection, state->base, state->scope,
4130	state->filter, state->attrs,
4131	state->attrsonly, 0, &state->entries,
4132	&state->pagedresults_cookie);
4133
4134	if (rc != LDAP_SUCCESS)
4135	DEBUG(5, ("Could not end search properly\n"));
4136
4137	return;
4138	}
4139
4140	static BOOL ldapuser2displayentry(struct ldap_search_state *state,
4141	TALLOC_CTX *mem_ctx,
4142	LDAP ld, LDAPMessage entry,
4143	struct samr_displayentry *result)
4144	{
4145	char **vals;
4146	DOM_SID sid;
4147	uint32 acct_flags;
4148
4149	vals = ldap_get_values(ld, entry, "sambaAcctFlags");
4150	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4151	DEBUG(5, ("\"sambaAcctFlags\" not found\n"));
4152	return False;
4153	}
4154	acct_flags = pdb_decode_acct_ctrl(vals[0]);
4155	ldap_value_free(vals);
4156
4157	if ((state->acct_flags != 0) &&
4158	((state->acct_flags & acct_flags) == 0))
4159	return False;
4160
4161	result->acct_flags = acct_flags;
4162	result->account_name = "";
4163	result->fullname = "";
4164	result->description = "";
4165
4166	vals = ldap_get_values(ld, entry, "uid");
4167	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4168	DEBUG(5, ("\"uid\" not found\n"));
4169	return False;
4170	}
4171	pull_utf8_talloc(mem_ctx,
4172	CONST_DISCARD(char **, &result->account_name),
4173	vals[0]);
4174	ldap_value_free(vals);
4175
4176	vals = ldap_get_values(ld, entry, "displayName");
4177	if ((vals == NULL) \|\| (vals[0] == NULL))
4178	DEBUG(8, ("\"displayName\" not found\n"));
4179	else
4180	pull_utf8_talloc(mem_ctx,
4181	CONST_DISCARD(char **, &result->fullname),
4182	vals[0]);
4183	ldap_value_free(vals);
4184
4185	vals = ldap_get_values(ld, entry, "description");
4186	if ((vals == NULL) \|\| (vals[0] == NULL))
4187	DEBUG(8, ("\"description\" not found\n"));
4188	else
4189	pull_utf8_talloc(mem_ctx,
4190	CONST_DISCARD(char **, &result->description),
4191	vals[0]);
4192	ldap_value_free(vals);
4193
4194	if ((result->account_name == NULL) \|\|
4195	(result->fullname == NULL) \|\|
4196	(result->description == NULL)) {
4197	DEBUG(0, ("talloc failed\n"));
4198	return False;
4199	}
4200
4201	vals = ldap_get_values(ld, entry, "sambaSid");
4202	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4203	DEBUG(0, ("\"objectSid\" not found\n"));
4204	return False;
4205	}
4206
4207	if (!string_to_sid(&sid, vals[0])) {
4208	DEBUG(0, ("Could not convert %s to SID\n", vals[0]));
4209	ldap_value_free(vals);
4210	return False;
4211	}
4212	ldap_value_free(vals);
4213
4214	if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)) {
4215	DEBUG(0, ("sid %s does not belong to our domain\n",
4216	sid_string_static(&sid)));
4217	return False;
4218	}
4219
4220	return True;
4221	}
4222
4223
4224	static BOOL ldapsam_search_users(struct pdb_methods *methods,
4225	struct pdb_search *search,
4226	uint32 acct_flags)
4227	{
4228	struct ldapsam_privates *ldap_state =
4229	(struct ldapsam_privates *)methods->private_data;
4230	struct ldap_search_state *state;
4231
4232	state = TALLOC_P(search->mem_ctx, struct ldap_search_state);
4233	if (state == NULL) {
4234	DEBUG(0, ("talloc failed\n"));
4235	return False;
4236	}
4237
4238	state->connection = ldap_state->smbldap_state;
4239
4240	if ((acct_flags != 0) && ((acct_flags & ACB_NORMAL) != 0))
4241	state->base = lp_ldap_user_suffix();
4242	else if ((acct_flags != 0) &&
4243	((acct_flags & (ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST)) != 0))
4244	state->base = lp_ldap_machine_suffix();
4245	else
4246	state->base = lp_ldap_suffix();
4247
4248	state->acct_flags = acct_flags;
4249	state->base = talloc_strdup(search->mem_ctx, state->base);
4250	state->scope = LDAP_SCOPE_SUBTREE;
4251	state->filter = get_ldap_filter(search->mem_ctx, "*");
4252	state->attrs = talloc_attrs(search->mem_ctx, "uid", "sambaSid",
4253	"displayName", "description",
4254	"sambaAcctFlags", NULL);
4255	state->attrsonly = 0;
4256	state->pagedresults_cookie = NULL;
4257	state->entries = NULL;
4258	state->ldap2displayentry = ldapuser2displayentry;
4259
4260	if ((state->filter == NULL) \|\| (state->attrs == NULL)) {
4261	DEBUG(0, ("talloc failed\n"));
4262	return False;
4263	}
4264
4265	search->private_data = state;
4266	search->next_entry = ldapsam_search_next_entry;
4267	search->search_end = ldapsam_search_end;
4268
4269	return ldapsam_search_firstpage(search);
4270	}
4271
4272	static BOOL ldapgroup2displayentry(struct ldap_search_state *state,
4273	TALLOC_CTX *mem_ctx,
4274	LDAP ld, LDAPMessage entry,
4275	struct samr_displayentry *result)
4276	{
4277	char **vals;
4278	DOM_SID sid;
4279	uint16 group_type;
4280
4281	result->account_name = "";
4282	result->fullname = "";
4283	result->description = "";
4284
4285
4286	vals = ldap_get_values(ld, entry, "sambaGroupType");
4287	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4288	DEBUG(5, ("\"sambaGroupType\" not found\n"));
4289	if (vals != NULL) {
4290	ldap_value_free(vals);
4291	}
4292	return False;
4293	}
4294
4295	group_type = atoi(vals[0]);
4296
4297	if ((state->group_type != 0) &&
4298	((state->group_type != group_type))) {
4299	ldap_value_free(vals);
4300	return False;
4301	}
4302
4303	ldap_value_free(vals);
4304
4305	/* display name is the NT group name */
4306
4307	vals = ldap_get_values(ld, entry, "displayName");
4308	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4309	DEBUG(8, ("\"displayName\" not found\n"));
4310
4311	/* fallback to the 'cn' attribute */
4312	vals = ldap_get_values(ld, entry, "cn");
4313	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4314	DEBUG(5, ("\"cn\" not found\n"));
4315	return False;
4316	}
4317	pull_utf8_talloc(mem_ctx,
4318	CONST_DISCARD(char **, &result->account_name),
4319	vals[0]);
4320	}
4321	else {
4322	pull_utf8_talloc(mem_ctx,
4323	CONST_DISCARD(char **, &result->account_name),
4324	vals[0]);
4325	}
4326
4327	ldap_value_free(vals);
4328
4329	vals = ldap_get_values(ld, entry, "description");
4330	if ((vals == NULL) \|\| (vals[0] == NULL))
4331	DEBUG(8, ("\"description\" not found\n"));
4332	else
4333	pull_utf8_talloc(mem_ctx,
4334	CONST_DISCARD(char **, &result->description),
4335	vals[0]);
4336	ldap_value_free(vals);
4337
4338	if ((result->account_name == NULL) \|\|
4339	(result->fullname == NULL) \|\|
4340	(result->description == NULL)) {
4341	DEBUG(0, ("talloc failed\n"));
4342	return False;
4343	}
4344
4345	vals = ldap_get_values(ld, entry, "sambaSid");
4346	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4347	DEBUG(0, ("\"objectSid\" not found\n"));
4348	if (vals != NULL) {
4349	ldap_value_free(vals);
4350	}
4351	return False;
4352	}
4353
4354	if (!string_to_sid(&sid, vals[0])) {
4355	DEBUG(0, ("Could not convert %s to SID\n", vals[0]));
4356	return False;
4357	}
4358
4359	ldap_value_free(vals);
4360
4361	switch (group_type) {
4362	case SID_NAME_DOM_GRP:
4363	case SID_NAME_ALIAS:
4364
4365	if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)
4366	&& !sid_peek_check_rid(&global_sid_Builtin, &sid, &result->rid))
4367	{
4368	DEBUG(0, ("%s is not in our domain\n",
4369	sid_string_static(&sid)));
4370	return False;
4371	}
4372	break;
4373
4374	default:
4375	DEBUG(0,("unkown group type: %d\n", group_type));
4376	return False;
4377	}
4378
4379	return True;
4380	}
4381
4382	static BOOL ldapsam_search_grouptype(struct pdb_methods *methods,
4383	struct pdb_search *search,
4384	const DOM_SID *sid,
4385	enum lsa_SidType type)
4386	{
4387	struct ldapsam_privates *ldap_state =
4388	(struct ldapsam_privates *)methods->private_data;
4389	struct ldap_search_state *state;
4390
4391	state = TALLOC_P(search->mem_ctx, struct ldap_search_state);
4392	if (state == NULL) {
4393	DEBUG(0, ("talloc failed\n"));
4394	return False;
4395	}
4396
4397	state->connection = ldap_state->smbldap_state;
4398
4399	state->base = talloc_strdup(search->mem_ctx, lp_ldap_group_suffix());
4400	state->connection = ldap_state->smbldap_state;
4401	state->scope = LDAP_SCOPE_SUBTREE;
4402	state->filter = talloc_asprintf(search->mem_ctx,
4403	"(&(objectclass=sambaGroupMapping)"
4404	"(sambaGroupType=%d)(sambaSID=%s*))",
4405	type, sid_string_static(sid));
4406	state->attrs = talloc_attrs(search->mem_ctx, "cn", "sambaSid",
4407	"displayName", "description",
4408	"sambaGroupType", NULL);
4409	state->attrsonly = 0;
4410	state->pagedresults_cookie = NULL;
4411	state->entries = NULL;
4412	state->group_type = type;
4413	state->ldap2displayentry = ldapgroup2displayentry;
4414
4415	if ((state->filter == NULL) \|\| (state->attrs == NULL)) {
4416	DEBUG(0, ("talloc failed\n"));
4417	return False;
4418	}
4419
4420	search->private_data = state;
4421	search->next_entry = ldapsam_search_next_entry;
4422	search->search_end = ldapsam_search_end;
4423
4424	return ldapsam_search_firstpage(search);
4425	}
4426
4427	static BOOL ldapsam_search_groups(struct pdb_methods *methods,
4428	struct pdb_search *search)
4429	{
4430	return ldapsam_search_grouptype(methods, search, get_global_sam_sid(), SID_NAME_DOM_GRP);
4431	}
4432
4433	static BOOL ldapsam_search_aliases(struct pdb_methods *methods,
4434	struct pdb_search *search,
4435	const DOM_SID *sid)
4436	{
4437	return ldapsam_search_grouptype(methods, search, sid, SID_NAME_ALIAS);
4438	}
4439
4440	static BOOL ldapsam_rid_algorithm(struct pdb_methods *methods)
4441	{
4442	return False;
4443	}
4444
4445	static NTSTATUS ldapsam_get_new_rid(struct ldapsam_privates *priv,
4446	uint32 *rid)
4447	{
4448	struct smbldap_state *smbldap_state = priv->smbldap_state;
4449
4450	LDAPMessage *result = NULL;
4451	LDAPMessage *entry = NULL;
4452	LDAPMod **mods = NULL;
4453	NTSTATUS status;
4454	char *value;
4455	int rc;
4456	uint32 nextRid = 0;
4457	const char *dn;
4458
4459	TALLOC_CTX *mem_ctx;
4460
4461	mem_ctx = talloc_new(NULL);
4462	if (mem_ctx == NULL) {
4463	DEBUG(0, ("talloc_new failed\n"));
4464	return NT_STATUS_NO_MEMORY;
4465	}
4466
4467	status = smbldap_search_domain_info(smbldap_state, &result,
4468	get_global_sam_name(), False);
4469	if (!NT_STATUS_IS_OK(status)) {
4470	DEBUG(3, ("Could not get domain info: %s\n",
4471	nt_errstr(status)));
4472	goto done;
4473	}
4474
4475	talloc_autofree_ldapmsg(mem_ctx, result);
4476
4477	entry = ldap_first_entry(priv2ld(priv), result);
4478	if (entry == NULL) {
4479	DEBUG(0, ("Could not get domain info entry\n"));
4480	status = NT_STATUS_INTERNAL_DB_CORRUPTION;
4481	goto done;
4482	}
4483
4484	/* Find the largest of the three attributes "sambaNextRid",
4485	"sambaNextGroupRid" and "sambaNextUserRid". I gave up on the
4486	concept of differentiating between user and group rids, and will
4487	use only "sambaNextRid" in the future. But for compatibility
4488	reasons I look if others have chosen different strategies -- VL */
4489
4490	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4491	"sambaNextRid", mem_ctx);
4492	if (value != NULL) {
4493	uint32 tmp = (uint32)strtoul(value, NULL, 10);
4494	nextRid = MAX(nextRid, tmp);
4495	}
4496
4497	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4498	"sambaNextUserRid", mem_ctx);
4499	if (value != NULL) {
4500	uint32 tmp = (uint32)strtoul(value, NULL, 10);
4501	nextRid = MAX(nextRid, tmp);
4502	}
4503
4504	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4505	"sambaNextGroupRid", mem_ctx);
4506	if (value != NULL) {
4507	uint32 tmp = (uint32)strtoul(value, NULL, 10);
4508	nextRid = MAX(nextRid, tmp);
4509	}
4510
4511	if (nextRid == 0) {
4512	nextRid = BASE_RID-1;
4513	}
4514
4515	nextRid += 1;
4516
4517	smbldap_make_mod(priv2ld(priv), entry, &mods, "sambaNextRid",
4518	talloc_asprintf(mem_ctx, "%d", nextRid));
4519	talloc_autofree_ldapmod(mem_ctx, mods);
4520
4521	if ((dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)) == NULL) {
4522	status = NT_STATUS_NO_MEMORY;
4523	goto done;
4524	}
4525
4526	rc = smbldap_modify(smbldap_state, dn, mods);
4527
4528	/* ACCESS_DENIED is used as a placeholder for "the modify failed,
4529	* please retry" */
4530
4531	status = (rc == LDAP_SUCCESS) ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
4532
4533	done:
4534	if (NT_STATUS_IS_OK(status)) {
4535	*rid = nextRid;
4536	}
4537
4538	TALLOC_FREE(mem_ctx);
4539	return status;
4540	}
4541
4542	static NTSTATUS ldapsam_new_rid_internal(struct pdb_methods methods, uint32 rid)
4543	{
4544	int i;
4545
4546	for (i=0; i<10; i++) {
4547	NTSTATUS result = ldapsam_get_new_rid(
4548	(struct ldapsam_privates *)methods->private_data, rid);
4549	if (NT_STATUS_IS_OK(result)) {
4550	return result;
4551	}
4552
4553	if (!NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
4554	return result;
4555	}
4556
4557	/* The ldap update failed (maybe a race condition), retry */
4558	}
4559
4560	/* Tried 10 times, fail. */
4561	return NT_STATUS_ACCESS_DENIED;
4562	}
4563
4564	static BOOL ldapsam_new_rid(struct pdb_methods methods, uint32 rid)
4565	{
4566	NTSTATUS result = ldapsam_new_rid_internal(methods, rid);
4567	return NT_STATUS_IS_OK(result) ? True : False;
4568	}
4569
4570	static BOOL ldapsam_sid_to_id(struct pdb_methods *methods,
4571	const DOM_SID *sid,
4572	union unid_t id, enum lsa_SidType type)
4573	{
4574	struct ldapsam_privates *priv =
4575	(struct ldapsam_privates *)methods->private_data;
4576	char *filter;
4577	const char *attrs[] = { "sambaGroupType", "gidNumber", "uidNumber",
4578	NULL };
4579	LDAPMessage *result = NULL;
4580	LDAPMessage *entry = NULL;
4581	BOOL ret = False;
4582	char *value;
4583	int rc;
4584
4585	TALLOC_CTX *mem_ctx;
4586
4587	mem_ctx = talloc_new(NULL);
4588	if (mem_ctx == NULL) {
4589	DEBUG(0, ("talloc_new failed\n"));
4590	return False;
4591	}
4592
4593	filter = talloc_asprintf(mem_ctx,
4594	"(&(sambaSid=%s)"
4595	"(\|(objectClass=%s)(objectClass=%s)))",
4596	sid_string_static(sid),
4597	LDAP_OBJ_GROUPMAP, LDAP_OBJ_SAMBASAMACCOUNT);
4598	if (filter == NULL) {
4599	DEBUG(5, ("talloc_asprintf failed\n"));
4600	goto done;
4601	}
4602
4603	rc = smbldap_search_suffix(priv->smbldap_state, filter,
4604	attrs, &result);
4605	if (rc != LDAP_SUCCESS) {
4606	goto done;
4607	}
4608	talloc_autofree_ldapmsg(mem_ctx, result);
4609
4610	if (ldap_count_entries(priv2ld(priv), result) != 1) {
4611	DEBUG(10, ("Got %d entries, expected one\n",
4612	ldap_count_entries(priv2ld(priv), result)));
4613	goto done;
4614	}
4615
4616	entry = ldap_first_entry(priv2ld(priv), result);
4617
4618	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4619	"sambaGroupType", mem_ctx);
4620
4621	if (value != NULL) {
4622	const char *gid_str;
4623	/* It's a group */
4624
4625	gid_str = smbldap_talloc_single_attribute(
4626	priv2ld(priv), entry, "gidNumber", mem_ctx);
4627	if (gid_str == NULL) {
4628	DEBUG(1, ("%s has sambaGroupType but no gidNumber\n",
4629	smbldap_talloc_dn(mem_ctx, priv2ld(priv),
4630	entry)));
4631	goto done;
4632	}
4633
4634	id->gid = strtoul(gid_str, NULL, 10);
4635	*type = (enum lsa_SidType)strtoul(value, NULL, 10);
4636	ret = True;
4637	goto done;
4638	}
4639
4640	/* It must be a user */
4641
4642	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4643	"uidNumber", mem_ctx);
4644	if (value == NULL) {
4645	DEBUG(1, ("Could not find uidNumber in %s\n",
4646	smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)));
4647	goto done;
4648	}
4649
4650	id->uid = strtoul(value, NULL, 10);
4651	*type = SID_NAME_USER;
4652
4653	ret = True;
4654	done:
4655	TALLOC_FREE(mem_ctx);
4656	return ret;
4657	}
4658
4659	/*
4660	* The following functions is called only if
4661	* ldapsam:trusted and ldapsam:editposix are
4662	* set to true
4663	*/
4664
4665	/*
4666	* ldapsam_create_user creates a new
4667	* posixAccount and sambaSamAccount object
4668	* in the ldap users subtree
4669	*
4670	* The uid is allocated by winbindd.
4671	*/
4672
4673	static NTSTATUS ldapsam_create_user(struct pdb_methods *my_methods,
4674	TALLOC_CTX tmp_ctx, const char name,
4675	uint32 acb_info, uint32 *rid)
4676	{
4677	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
4678	LDAPMessage *entry = NULL;
4679	LDAPMessage *result = NULL;
4680	uint32 num_result;
4681	BOOL is_machine = False;
4682	BOOL add_posix = False;
4683	LDAPMod **mods = NULL;
4684	struct samu *user;
4685	char *filter;
4686	char *username;
4687	char *homedir;
4688	char *gidstr;
4689	char *uidstr;
4690	char *shell;
4691	const char *dn = NULL;
4692	DOM_SID group_sid;
4693	DOM_SID user_sid;
4694	gid_t gid = -1;
4695	uid_t uid = -1;
4696	NTSTATUS ret;
4697	int rc;
4698
4699	if (((acb_info & ACB_NORMAL) && name[strlen(name)-1] == '$') \|\|
4700	acb_info & ACB_WSTRUST \|\|
4701	acb_info & ACB_SVRTRUST \|\|
4702	acb_info & ACB_DOMTRUST) {
4703	is_machine = True;
4704	}
4705
4706	username = escape_ldap_string_alloc(name);
4707	filter = talloc_asprintf(tmp_ctx, "(&(uid=%s)(objectClass=%s))",
4708	username, LDAP_OBJ_POSIXACCOUNT);
4709	SAFE_FREE(username);
4710
4711	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
4712	if (rc != LDAP_SUCCESS) {
4713	DEBUG(0,("ldapsam_create_user: ldap search failed!\n"));
4714	return NT_STATUS_UNSUCCESSFUL;
4715	}
4716	talloc_autofree_ldapmsg(tmp_ctx, result);
4717
4718	num_result = ldap_count_entries(priv2ld(ldap_state), result);
4719
4720	if (num_result > 1) {
4721	DEBUG (0, ("ldapsam_create_user: More than one user with name [%s] ?!\n", name));
4722	return NT_STATUS_INTERNAL_DB_CORRUPTION;
4723	}
4724
4725	if (num_result == 1) {
4726	char *tmp;
4727	/* check if it is just a posix account.
4728	* or if there is a sid attached to this entry
4729	*/
4730
4731	entry = ldap_first_entry(priv2ld(ldap_state), result);
4732	if (!entry) {
4733	return NT_STATUS_UNSUCCESSFUL;
4734	}
4735
4736	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "sambaSID", tmp_ctx);
4737	if (tmp) {
4738	DEBUG (1, ("ldapsam_create_user: The user [%s] already exist!\n", name));
4739	return NT_STATUS_USER_EXISTS;
4740	}
4741
4742	/* it is just a posix account, retrieve the dn for later use */
4743	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
4744	if (!dn) {
4745	DEBUG(0,("ldapsam_create_user: Out of memory!\n"));
4746	return NT_STATUS_NO_MEMORY;
4747	}
4748	}
4749
4750	if (num_result == 0) {
4751	add_posix = True;
4752	}
4753
4754	/* Create the basic samu structure and generate the mods for the ldap commit */
4755	if (!NT_STATUS_IS_OK((ret = ldapsam_new_rid_internal(my_methods, rid)))) {
4756	DEBUG(1, ("ldapsam_create_user: Could not allocate a new RID\n"));
4757	return ret;
4758	}
4759
4760	sid_compose(&user_sid, get_global_sam_sid(), *rid);
4761
4762	user = samu_new(tmp_ctx);
4763	if (!user) {
4764	DEBUG(1,("ldapsam_create_user: Unable to allocate user struct\n"));
4765	return NT_STATUS_NO_MEMORY;
4766	}
4767
4768	if (!pdb_set_username(user, name, PDB_SET)) {
4769	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4770	return NT_STATUS_UNSUCCESSFUL;
4771	}
4772	if (!pdb_set_domain(user, get_global_sam_name(), PDB_SET)) {
4773	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4774	return NT_STATUS_UNSUCCESSFUL;
4775	}
4776	if (is_machine) {
4777	if (acb_info & ACB_NORMAL) {
4778	if (!pdb_set_acct_ctrl(user, ACB_WSTRUST, PDB_SET)) {
4779	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4780	return NT_STATUS_UNSUCCESSFUL;
4781	}
4782	} else {
4783	if (!pdb_set_acct_ctrl(user, acb_info, PDB_SET)) {
4784	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4785	return NT_STATUS_UNSUCCESSFUL;
4786	}
4787	}
4788	} else {
4789	if (!pdb_set_acct_ctrl(user, ACB_NORMAL \| ACB_DISABLED, PDB_SET)) {
4790	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4791	return NT_STATUS_UNSUCCESSFUL;
4792	}
4793	}
4794
4795	if (!pdb_set_user_sid(user, &user_sid, PDB_SET)) {
4796	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4797	return NT_STATUS_UNSUCCESSFUL;
4798	}
4799
4800	if (!init_ldap_from_sam(ldap_state, NULL, &mods, user, element_is_set_or_changed)) {
4801	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
4802	return NT_STATUS_UNSUCCESSFUL;
4803	}
4804
4805	if (ldap_state->schema_ver != SCHEMAVER_SAMBASAMACCOUNT) {
4806	DEBUG(1,("ldapsam_create_user: Unsupported schema version\n"));
4807	}
4808	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
4809
4810	if (add_posix) {
4811	char *escape_name;
4812
4813	DEBUG(3,("ldapsam_create_user: Creating new posix user\n"));
4814
4815	/* retrieve the Domain Users group gid */
4816	if (!sid_compose(&group_sid, get_global_sam_sid(), DOMAIN_GROUP_RID_USERS) \|\|
4817	!sid_to_gid(&group_sid, &gid)) {
4818	DEBUG (0, ("ldapsam_create_user: Unable to get the Domain Users gid: bailing out!\n"));
4819	return NT_STATUS_INVALID_PRIMARY_GROUP;
4820	}
4821
4822	/* lets allocate a new userid for this user */
4823	if (!winbind_allocate_uid(&uid)) {
4824	DEBUG (0, ("ldapsam_create_user: Unable to allocate a new user id: bailing out!\n"));
4825	return NT_STATUS_UNSUCCESSFUL;
4826	}
4827
4828
4829	if (is_machine) {
4830	/* TODO: choose a more appropriate default for machines */
4831	homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), "SMB_workstations_home", ldap_state->domain_name, uid, gid);
4832	shell = talloc_strdup(tmp_ctx, "/bin/false");
4833	} else {
4834	homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), name, ldap_state->domain_name, uid, gid);
4835	shell = talloc_sub_specified(tmp_ctx, lp_template_shell(), name, ldap_state->domain_name, uid, gid);
4836	}
4837	uidstr = talloc_asprintf(tmp_ctx, "%d", uid);
4838	gidstr = talloc_asprintf(tmp_ctx, "%d", gid);
4839
4840	escape_name = escape_rdn_val_string_alloc(name);
4841	if (!escape_name) {
4842	DEBUG (0, ("ldapsam_create_user: Out of memory!\n"));
4843	return NT_STATUS_NO_MEMORY;
4844	}
4845
4846	if (is_machine) {
4847	dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_machine_suffix ());
4848	} else {
4849	dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_user_suffix ());
4850	}
4851
4852	SAFE_FREE(escape_name);
4853
4854	if (!homedir \|\| !shell \|\| !uidstr \|\| !gidstr \|\| !dn) {
4855	DEBUG (0, ("ldapsam_create_user: Out of memory!\n"));
4856	return NT_STATUS_NO_MEMORY;
4857	}
4858
4859	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
4860	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
4861	smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
4862	smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
4863	smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
4864	smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", homedir);
4865	smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", shell);
4866	}
4867
4868	talloc_autofree_ldapmod(tmp_ctx, mods);
4869
4870	if (add_posix) {
4871	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
4872	} else {
4873	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
4874	}
4875
4876	if (rc != LDAP_SUCCESS) {
4877	DEBUG(0,("ldapsam_create_user: failed to create a new user [%s] (dn = %s)\n", name ,dn));
4878	return NT_STATUS_UNSUCCESSFUL;
4879	}
4880
4881	DEBUG(2,("ldapsam_create_user: added account [%s] in the LDAP database\n", name));
4882
4883	flush_pwnam_cache();
4884
4885	return NT_STATUS_OK;
4886	}
4887
4888	static NTSTATUS ldapsam_delete_user(struct pdb_methods my_methods, TALLOC_CTX tmp_ctx, struct samu *sam_acct)
4889	{
4890	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
4891	LDAPMessage *result = NULL;
4892	LDAPMessage *entry = NULL;
4893	int num_result;
4894	const char *dn;
4895	char *filter;
4896	int rc;
4897
4898	DEBUG(0,("ldapsam_delete_user: Attempt to delete user [%s]\n", pdb_get_username(sam_acct)));
4899
4900	filter = talloc_asprintf(tmp_ctx,
4901	"(&(uid=%s)"
4902	"(objectClass=%s)"
4903	"(objectClass=%s))",
4904	pdb_get_username(sam_acct),
4905	LDAP_OBJ_POSIXACCOUNT,
4906	LDAP_OBJ_SAMBASAMACCOUNT);
4907	if (filter == NULL) {
4908	return NT_STATUS_NO_MEMORY;
4909	}
4910
4911	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
4912	if (rc != LDAP_SUCCESS) {
4913	DEBUG(0,("ldapsam_delete_user: user search failed!\n"));
4914	return NT_STATUS_UNSUCCESSFUL;
4915	}
4916	talloc_autofree_ldapmsg(tmp_ctx, result);
4917
4918	num_result = ldap_count_entries(priv2ld(ldap_state), result);
4919
4920	if (num_result == 0) {
4921	DEBUG(0,("ldapsam_delete_user: user not found!\n"));
4922	return NT_STATUS_NO_SUCH_USER;
4923	}
4924
4925	if (num_result > 1) {
4926	DEBUG (0, ("ldapsam_delete_user: More than one user with name [%s] ?!\n", pdb_get_username(sam_acct)));
4927	return NT_STATUS_INTERNAL_DB_CORRUPTION;
4928	}
4929
4930	entry = ldap_first_entry(priv2ld(ldap_state), result);
4931	if (!entry) {
4932	return NT_STATUS_UNSUCCESSFUL;
4933	}
4934
4935	/* it is just a posix account, retrieve the dn for later use */
4936	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
4937	if (!dn) {
4938	DEBUG(0,("ldapsam_delete_user: Out of memory!\n"));
4939	return NT_STATUS_NO_MEMORY;
4940	}
4941
4942	rc = smbldap_delete(ldap_state->smbldap_state, dn);
4943	if (rc != LDAP_SUCCESS) {
4944	return NT_STATUS_UNSUCCESSFUL;
4945	}
4946
4947	flush_pwnam_cache();
4948
4949	return NT_STATUS_OK;
4950	}
4951
4952	/*
4953	* ldapsam_create_group creates a new
4954	* posixGroup and sambaGroupMapping object
4955	* in the ldap groups subtree
4956	*
4957	* The gid is allocated by winbindd.
4958	*/
4959
4960	static NTSTATUS ldapsam_create_dom_group(struct pdb_methods *my_methods,
4961	TALLOC_CTX *tmp_ctx,
4962	const char *name,
4963	uint32 *rid)
4964	{
4965	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
4966	NTSTATUS ret;
4967	LDAPMessage *entry = NULL;
4968	LDAPMessage *result = NULL;
4969	uint32 num_result;
4970	BOOL is_new_entry = False;
4971	LDAPMod **mods = NULL;
4972	char *filter;
4973	char *groupsidstr;
4974	char *groupname;
4975	char *grouptype;
4976	char *gidstr;
4977	const char *dn = NULL;
4978	DOM_SID group_sid;
4979	gid_t gid = -1;
4980	int rc;
4981
4982	groupname = escape_ldap_string_alloc(name);
4983	filter = talloc_asprintf(tmp_ctx, "(&(cn=%s)(objectClass=%s))",
4984	groupname, LDAP_OBJ_POSIXGROUP);
4985	SAFE_FREE(groupname);
4986
4987	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
4988	if (rc != LDAP_SUCCESS) {
4989	DEBUG(0,("ldapsam_create_group: ldap search failed!\n"));
4990	return NT_STATUS_UNSUCCESSFUL;
4991	}
4992	talloc_autofree_ldapmsg(tmp_ctx, result);
4993
4994	num_result = ldap_count_entries(priv2ld(ldap_state), result);
4995
4996	if (num_result > 1) {
4997	DEBUG (0, ("ldapsam_create_group: There exists more than one group with name [%s]: bailing out!\n", name));
4998	return NT_STATUS_INTERNAL_DB_CORRUPTION;
4999	}
5000
5001	if (num_result == 1) {
5002	char *tmp;
5003	/* check if it is just a posix group.
5004	* or if there is a sid attached to this entry
5005	*/
5006
5007	entry = ldap_first_entry(priv2ld(ldap_state), result);
5008	if (!entry) {
5009	return NT_STATUS_UNSUCCESSFUL;
5010	}
5011
5012	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "sambaSID", tmp_ctx);
5013	if (tmp) {
5014	DEBUG (1, ("ldapsam_create_group: The group [%s] already exist!\n", name));
5015	return NT_STATUS_GROUP_EXISTS;
5016	}
5017
5018	/* it is just a posix group, retrieve the gid and the dn for later use */
5019	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5020	if (!tmp) {
5021	DEBUG (1, ("ldapsam_create_group: Couldn't retrieve the gidNumber for [%s]?!?!\n", name));
5022	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5023	}
5024
5025	gid = strtoul(tmp, NULL, 10);
5026
5027	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5028	if (!dn) {
5029	DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
5030	return NT_STATUS_NO_MEMORY;
5031	}
5032	}
5033
5034	if (num_result == 0) {
5035	char *escape_name;
5036
5037	DEBUG(3,("ldapsam_create_user: Creating new posix group\n"));
5038
5039	is_new_entry = True;
5040
5041	/* lets allocate a new groupid for this group */
5042	if (!winbind_allocate_gid(&gid)) {
5043	DEBUG (0, ("ldapsam_create_group: Unable to allocate a new group id: bailing out!\n"));
5044	return NT_STATUS_UNSUCCESSFUL;
5045	}
5046
5047	gidstr = talloc_asprintf(tmp_ctx, "%d", gid);
5048
5049	escape_name = escape_rdn_val_string_alloc(name);
5050	if (!escape_name) {
5051	DEBUG (0, ("ldapsam_create_group: Out of memory!\n"));
5052	return NT_STATUS_NO_MEMORY;
5053	}
5054
5055	dn = talloc_asprintf(tmp_ctx, "cn=%s,%s", escape_name, lp_ldap_group_suffix());
5056
5057	SAFE_FREE(escape_name);
5058
5059	if (!gidstr \|\| !dn) {
5060	DEBUG (0, ("ldapsam_create_group: Out of memory!\n"));
5061	return NT_STATUS_NO_MEMORY;
5062	}
5063
5064	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_POSIXGROUP);
5065	smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
5066	smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
5067	}
5068
5069	if (!NT_STATUS_IS_OK((ret = ldapsam_new_rid_internal(my_methods, rid)))) {
5070	DEBUG(1, ("ldapsam_create_group: Could not allocate a new RID\n"));
5071	return ret;
5072	}
5073
5074	sid_compose(&group_sid, get_global_sam_sid(), *rid);
5075
5076	groupsidstr = talloc_strdup(tmp_ctx, sid_string_static(&group_sid));
5077	grouptype = talloc_asprintf(tmp_ctx, "%d", SID_NAME_DOM_GRP);
5078
5079	if (!groupsidstr \|\| !grouptype) {
5080	DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
5081	return NT_STATUS_NO_MEMORY;
5082	}
5083
5084	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
5085	smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid", groupsidstr);
5086	smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", grouptype);
5087	smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
5088	talloc_autofree_ldapmod(tmp_ctx, mods);
5089
5090	if (is_new_entry) {
5091	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5092	#if 0
5093	if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
5094	/* This call may fail with rfc2307bis schema */
5095	/* Retry adding a structural class */
5096	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "????");
5097	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5098	}
5099	#endif
5100	} else {
5101	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5102	}
5103
5104	if (rc != LDAP_SUCCESS) {
5105	DEBUG(0,("ldapsam_create_group: failed to create a new group [%s] (dn = %s)\n", name ,dn));
5106	return NT_STATUS_UNSUCCESSFUL;
5107	}
5108
5109	DEBUG(2,("ldapsam_create_group: added group [%s] in the LDAP database\n", name));
5110
5111	return NT_STATUS_OK;
5112	}
5113
5114	static NTSTATUS ldapsam_delete_dom_group(struct pdb_methods my_methods, TALLOC_CTX tmp_ctx, uint32 rid)
5115	{
5116	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5117	LDAPMessage *result = NULL;
5118	LDAPMessage *entry = NULL;
5119	int num_result;
5120	const char *dn;
5121	char *gidstr;
5122	char *filter;
5123	DOM_SID group_sid;
5124	int rc;
5125
5126	/* get the group sid */
5127	sid_compose(&group_sid, get_global_sam_sid(), rid);
5128
5129	filter = talloc_asprintf(tmp_ctx,
5130	"(&(sambaSID=%s)"
5131	"(objectClass=%s)"
5132	"(objectClass=%s))",
5133	sid_string_static(&group_sid),
5134	LDAP_OBJ_POSIXGROUP,
5135	LDAP_OBJ_GROUPMAP);
5136	if (filter == NULL) {
5137	return NT_STATUS_NO_MEMORY;
5138	}
5139
5140	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5141	if (rc != LDAP_SUCCESS) {
5142	DEBUG(1,("ldapsam_delete_dom_group: group search failed!\n"));
5143	return NT_STATUS_UNSUCCESSFUL;
5144	}
5145	talloc_autofree_ldapmsg(tmp_ctx, result);
5146
5147	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5148
5149	if (num_result == 0) {
5150	DEBUG(1,("ldapsam_delete_dom_group: group not found!\n"));
5151	return NT_STATUS_NO_SUCH_GROUP;
5152	}
5153
5154	if (num_result > 1) {
5155	DEBUG (0, ("ldapsam_delete_dom_group: More than one group with the same SID ?!\n"));
5156	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5157	}
5158
5159	entry = ldap_first_entry(priv2ld(ldap_state), result);
5160	if (!entry) {
5161	return NT_STATUS_UNSUCCESSFUL;
5162	}
5163
5164	/* here it is, retrieve the dn for later use */
5165	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5166	if (!dn) {
5167	DEBUG(0,("ldapsam_delete_dom_group: Out of memory!\n"));
5168	return NT_STATUS_NO_MEMORY;
5169	}
5170
5171	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5172	if (!gidstr) {
5173	DEBUG (0, ("ldapsam_delete_dom_group: Unable to find the group's gid!\n"));
5174	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5175	}
5176
5177	/* check no user have this group marked as primary group */
5178	filter = talloc_asprintf(tmp_ctx,
5179	"(&(gidNumber=%s)"
5180	"(objectClass=%s)"
5181	"(objectClass=%s))",
5182	gidstr,
5183	LDAP_OBJ_POSIXACCOUNT,
5184	LDAP_OBJ_SAMBASAMACCOUNT);
5185
5186	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5187	if (rc != LDAP_SUCCESS) {
5188	DEBUG(1,("ldapsam_delete_dom_group: accounts search failed!\n"));
5189	return NT_STATUS_UNSUCCESSFUL;
5190	}
5191	talloc_autofree_ldapmsg(tmp_ctx, result);
5192
5193	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5194
5195	if (num_result != 0) {
5196	DEBUG(3,("ldapsam_delete_dom_group: Can't delete group, it is a primary group for %d users\n", num_result));
5197	return NT_STATUS_MEMBERS_PRIMARY_GROUP;
5198	}
5199
5200	rc = smbldap_delete(ldap_state->smbldap_state, dn);
5201	if (rc != LDAP_SUCCESS) {
5202	return NT_STATUS_UNSUCCESSFUL;
5203	}
5204
5205	return NT_STATUS_OK;
5206	}
5207
5208	static NTSTATUS ldapsam_change_groupmem(struct pdb_methods *my_methods,
5209	TALLOC_CTX *tmp_ctx,
5210	uint32 group_rid,
5211	uint32 member_rid,
5212	int modop)
5213	{
5214	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5215	LDAPMessage *entry = NULL;
5216	LDAPMessage *result = NULL;
5217	uint32 num_result;
5218	LDAPMod **mods = NULL;
5219	char *filter;
5220	char *uidstr;
5221	const char *dn = NULL;
5222	DOM_SID group_sid;
5223	DOM_SID member_sid;
5224	int rc;
5225
5226	switch (modop) {
5227	case LDAP_MOD_ADD:
5228	DEBUG(1,("ldapsam_change_groupmem: add new member(rid=%d) to a domain group(rid=%d)", member_rid, group_rid));
5229	break;
5230	case LDAP_MOD_DELETE:
5231	DEBUG(1,("ldapsam_change_groupmem: delete member(rid=%d) from a domain group(rid=%d)", member_rid, group_rid));
5232	break;
5233	default:
5234	return NT_STATUS_UNSUCCESSFUL;
5235	}
5236
5237	/* get member sid */
5238	sid_compose(&member_sid, get_global_sam_sid(), member_rid);
5239
5240	/* get the group sid */
5241	sid_compose(&group_sid, get_global_sam_sid(), group_rid);
5242
5243	filter = talloc_asprintf(tmp_ctx,
5244	"(&(sambaSID=%s)"
5245	"(objectClass=%s)"
5246	"(objectClass=%s))",
5247	sid_string_static(&member_sid),
5248	LDAP_OBJ_POSIXACCOUNT,
5249	LDAP_OBJ_SAMBASAMACCOUNT);
5250	if (filter == NULL) {
5251	return NT_STATUS_NO_MEMORY;
5252	}
5253
5254	/* get the member uid */
5255	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5256	if (rc != LDAP_SUCCESS) {
5257	DEBUG(1,("ldapsam_change_groupmem: member search failed!\n"));
5258	return NT_STATUS_UNSUCCESSFUL;
5259	}
5260	talloc_autofree_ldapmsg(tmp_ctx, result);
5261
5262	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5263
5264	if (num_result == 0) {
5265	DEBUG(1,("ldapsam_change_groupmem: member not found!\n"));
5266	return NT_STATUS_NO_SUCH_MEMBER;
5267	}
5268
5269	if (num_result > 1) {
5270	DEBUG (0, ("ldapsam_change_groupmem: More than one account with the same SID ?!\n"));
5271	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5272	}
5273
5274	entry = ldap_first_entry(priv2ld(ldap_state), result);
5275	if (!entry) {
5276	return NT_STATUS_UNSUCCESSFUL;
5277	}
5278
5279	if (modop == LDAP_MOD_DELETE) {
5280	/* check if we are trying to remove the member from his primary group */
5281	char *gidstr;
5282	gid_t user_gid, group_gid;
5283
5284	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5285	if (!gidstr) {
5286	DEBUG (0, ("ldapsam_change_groupmem: Unable to find the member's gid!\n"));
5287	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5288	}
5289
5290	user_gid = strtoul(gidstr, NULL, 10);
5291
5292	if (!sid_to_gid(&group_sid, &group_gid)) {
5293	DEBUG (0, ("ldapsam_change_groupmem: Unable to get group gid from SID!\n"));
5294	return NT_STATUS_UNSUCCESSFUL;
5295	}
5296
5297	if (user_gid == group_gid) {
5298	DEBUG (3, ("ldapsam_change_groupmem: can't remove user from it's own primary group!\n"));
5299	return NT_STATUS_MEMBERS_PRIMARY_GROUP;
5300	}
5301	}
5302
5303	/* here it is, retrieve the uid for later use */
5304	uidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "uid", tmp_ctx);
5305	if (!uidstr) {
5306	DEBUG (0, ("ldapsam_change_groupmem: Unable to find the member's name!\n"));
5307	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5308	}
5309
5310	filter = talloc_asprintf(tmp_ctx,
5311	"(&(sambaSID=%s)"
5312	"(objectClass=%s)"
5313	"(objectClass=%s))",
5314	sid_string_static(&group_sid),
5315	LDAP_OBJ_POSIXGROUP,
5316	LDAP_OBJ_GROUPMAP);
5317
5318	/* get the group */
5319	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5320	if (rc != LDAP_SUCCESS) {
5321	DEBUG(1,("ldapsam_change_groupmem: group search failed!\n"));
5322	return NT_STATUS_UNSUCCESSFUL;
5323	}
5324	talloc_autofree_ldapmsg(tmp_ctx, result);
5325
5326	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5327
5328	if (num_result == 0) {
5329	DEBUG(1,("ldapsam_change_groupmem: group not found!\n"));
5330	return NT_STATUS_NO_SUCH_GROUP;
5331	}
5332
5333	if (num_result > 1) {
5334	DEBUG (0, ("ldapsam_change_groupmem: More than one group with the same SID ?!\n"));
5335	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5336	}
5337
5338	entry = ldap_first_entry(priv2ld(ldap_state), result);
5339	if (!entry) {
5340	return NT_STATUS_UNSUCCESSFUL;
5341	}
5342
5343	/* here it is, retrieve the dn for later use */
5344	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5345	if (!dn) {
5346	DEBUG(0,("ldapsam_change_groupmem: Out of memory!\n"));
5347	return NT_STATUS_NO_MEMORY;
5348	}
5349
5350	smbldap_set_mod(&mods, modop, "memberUid", uidstr);
5351
5352	talloc_autofree_ldapmod(tmp_ctx, mods);
5353
5354	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5355	if (rc != LDAP_SUCCESS) {
5356	if (rc == LDAP_TYPE_OR_VALUE_EXISTS && modop == LDAP_MOD_ADD) {
5357	DEBUG(1,("ldapsam_change_groupmem: member is already in group, add failed!\n"));
5358	return NT_STATUS_MEMBER_IN_GROUP;
5359	}
5360	if (rc == LDAP_NO_SUCH_ATTRIBUTE && modop == LDAP_MOD_DELETE) {
5361	DEBUG(1,("ldapsam_change_groupmem: member is not in group, delete failed!\n"));
5362	return NT_STATUS_MEMBER_NOT_IN_GROUP;
5363	}
5364	return NT_STATUS_UNSUCCESSFUL;
5365	}
5366
5367	return NT_STATUS_OK;
5368	}
5369
5370	static NTSTATUS ldapsam_add_groupmem(struct pdb_methods *my_methods,
5371	TALLOC_CTX *tmp_ctx,
5372	uint32 group_rid,
5373	uint32 member_rid)
5374	{
5375	return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_ADD);
5376	}
5377	static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
5378	TALLOC_CTX *tmp_ctx,
5379	uint32 group_rid,
5380	uint32 member_rid)
5381	{
5382	return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_DELETE);
5383	}
5384
5385	static NTSTATUS ldapsam_set_primary_group(struct pdb_methods *my_methods,
5386	TALLOC_CTX *mem_ctx,
5387	struct samu *sampass)
5388	{
5389	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5390	LDAPMessage *entry = NULL;
5391	LDAPMessage *result = NULL;
5392	uint32 num_result;
5393	LDAPMod **mods = NULL;
5394	char *filter;
5395	char *escape_username;
5396	char *gidstr;
5397	const char *dn = NULL;
5398	gid_t gid;
5399	int rc;
5400
5401	DEBUG(0,("ldapsam_set_primary_group: Attempt to set primary group for user [%s]\n", pdb_get_username(sampass)));
5402
5403	if (!sid_to_gid(pdb_get_group_sid(sampass), &gid)) {
5404	DEBUG(0,("ldapsam_set_primary_group: failed to retieve gid from user's group SID!\n"));
5405	return NT_STATUS_UNSUCCESSFUL;
5406	}
5407	gidstr = talloc_asprintf(mem_ctx, "%d", gid);
5408	if (!gidstr) {
5409	DEBUG(0,("ldapsam_set_primary_group: Out of Memory!\n"));
5410	return NT_STATUS_NO_MEMORY;
5411	}
5412
5413	escape_username = escape_ldap_string_alloc(pdb_get_username(sampass));
5414	if (escape_username== NULL) {
5415	return NT_STATUS_NO_MEMORY;
5416	}
5417
5418	filter = talloc_asprintf(mem_ctx,
5419	"(&(uid=%s)"
5420	"(objectClass=%s)"
5421	"(objectClass=%s))",
5422	escape_username,
5423	LDAP_OBJ_POSIXACCOUNT,
5424	LDAP_OBJ_SAMBASAMACCOUNT);
5425
5426	SAFE_FREE(escape_username);
5427
5428	if (filter == NULL) {
5429	return NT_STATUS_NO_MEMORY;
5430	}
5431
5432	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5433	if (rc != LDAP_SUCCESS) {
5434	DEBUG(0,("ldapsam_set_primary_group: user search failed!\n"));
5435	return NT_STATUS_UNSUCCESSFUL;
5436	}
5437	talloc_autofree_ldapmsg(mem_ctx, result);
5438
5439	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5440
5441	if (num_result == 0) {
5442	DEBUG(0,("ldapsam_set_primary_group: user not found!\n"));
5443	return NT_STATUS_NO_SUCH_USER;
5444	}
5445
5446	if (num_result > 1) {
5447	DEBUG (0, ("ldapsam_set_primary_group: More than one user with name [%s] ?!\n", pdb_get_username(sampass)));
5448	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5449	}
5450
5451	entry = ldap_first_entry(priv2ld(ldap_state), result);
5452	if (!entry) {
5453	return NT_STATUS_UNSUCCESSFUL;
5454	}
5455
5456	/* retrieve the dn for later use */
5457	dn = smbldap_talloc_dn(mem_ctx, priv2ld(ldap_state), entry);
5458	if (!dn) {
5459	DEBUG(0,("ldapsam_set_primary_group: Out of memory!\n"));
5460	return NT_STATUS_NO_MEMORY;
5461	}
5462
5463	/* remove the old one, and add the new one, this way we do not risk races */
5464	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "gidNumber", gidstr);
5465
5466	if (mods == NULL) {
5467	return NT_STATUS_OK;
5468	}
5469
5470	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5471
5472	if (rc != LDAP_SUCCESS) {
5473	DEBUG(0,("ldapsam_set_primary_group: failed to modify [%s] primary group to [%s]\n",
5474	pdb_get_username(sampass), gidstr));
5475	return NT_STATUS_UNSUCCESSFUL;
5476	}
5477
5478	flush_pwnam_cache();
5479
5480	return NT_STATUS_OK;
5481	}
5482
5483	/**********************************************************************
5484	Housekeeping
5485	*********************************************************************/
5486
5487	static void free_private_data(void **vp)
5488	{
5489	struct ldapsam_privates ldap_state = (struct ldapsam_privates )vp;
5490
5491	smbldap_free_struct(&(*ldap_state)->smbldap_state);
5492
5493	if ((*ldap_state)->result != NULL) {
5494	ldap_msgfree((*ldap_state)->result);
5495	(*ldap_state)->result = NULL;
5496	}
5497	if ((*ldap_state)->domain_dn != NULL) {
5498	SAFE_FREE((*ldap_state)->domain_dn);
5499	}
5500
5501	*ldap_state = NULL;
5502
5503	/* No need to free any further, as it is talloc()ed */
5504	}
5505
5506	/*********************************************************************
5507	Intitalise the parts of the pdb_methods structure that are common to
5508	all pdb_ldap modes
5509	*********************************************************************/
5510
5511	static NTSTATUS pdb_init_ldapsam_common(struct pdb_methods *pdb_method, const char location)
5512	{
5513	NTSTATUS nt_status;
5514	struct ldapsam_privates *ldap_state;
5515
5516	if (!NT_STATUS_IS_OK(nt_status = make_pdb_method( pdb_method ))) {
5517	return nt_status;
5518	}
5519
5520	(*pdb_method)->name = "ldapsam";
5521
5522	(*pdb_method)->setsampwent = ldapsam_setsampwent;
5523	(*pdb_method)->endsampwent = ldapsam_endsampwent;
5524	(*pdb_method)->getsampwent = ldapsam_getsampwent;
5525	(*pdb_method)->getsampwnam = ldapsam_getsampwnam;
5526	(*pdb_method)->getsampwsid = ldapsam_getsampwsid;
5527	(*pdb_method)->add_sam_account = ldapsam_add_sam_account;
5528	(*pdb_method)->update_sam_account = ldapsam_update_sam_account;
5529	(*pdb_method)->delete_sam_account = ldapsam_delete_sam_account;
5530	(*pdb_method)->rename_sam_account = ldapsam_rename_sam_account;
5531
5532	(*pdb_method)->getgrsid = ldapsam_getgrsid;
5533	(*pdb_method)->getgrgid = ldapsam_getgrgid;
5534	(*pdb_method)->getgrnam = ldapsam_getgrnam;
5535	(*pdb_method)->add_group_mapping_entry = ldapsam_add_group_mapping_entry;
5536	(*pdb_method)->update_group_mapping_entry = ldapsam_update_group_mapping_entry;
5537	(*pdb_method)->delete_group_mapping_entry = ldapsam_delete_group_mapping_entry;
5538	(*pdb_method)->enum_group_mapping = ldapsam_enum_group_mapping;
5539
5540	(*pdb_method)->get_account_policy = ldapsam_get_account_policy;
5541	(*pdb_method)->set_account_policy = ldapsam_set_account_policy;
5542
5543	(*pdb_method)->get_seq_num = ldapsam_get_seq_num;
5544
5545	(*pdb_method)->rid_algorithm = ldapsam_rid_algorithm;
5546	(*pdb_method)->new_rid = ldapsam_new_rid;
5547
5548	/* TODO: Setup private data and free */
5549
5550	if ( !(ldap_state = TALLOC_ZERO_P(*pdb_method, struct ldapsam_privates)) ) {
5551	DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
5552	return NT_STATUS_NO_MEMORY;
5553	}
5554
5555	nt_status = smbldap_init(*pdb_method, location, &ldap_state->smbldap_state);
5556
5557	if ( !NT_STATUS_IS_OK(nt_status) ) {
5558	return nt_status;
5559	}
5560
5561	if ( !(ldap_state->domain_name = talloc_strdup(*pdb_method, get_global_sam_name()) ) ) {
5562	return NT_STATUS_NO_MEMORY;
5563	}
5564
5565	(*pdb_method)->private_data = ldap_state;
5566
5567	(*pdb_method)->free_private_data = free_private_data;
5568
5569	return NT_STATUS_OK;
5570	}
5571
5572	/**********************************************************************
5573	Initialise the 'compat' mode for pdb_ldap
5574	*********************************************************************/
5575
5576	NTSTATUS pdb_init_ldapsam_compat(struct pdb_methods *pdb_method, const char location)
5577	{
5578	NTSTATUS nt_status;
5579	struct ldapsam_privates *ldap_state;
5580	char *uri = talloc_strdup( NULL, location );
5581
5582	trim_char( uri, '\"', '\"' );
5583	nt_status = pdb_init_ldapsam_common( pdb_method, uri );
5584	if ( uri )
5585	TALLOC_FREE( uri );
5586
5587	if ( !NT_STATUS_IS_OK(nt_status) ) {
5588	return nt_status;
5589	}
5590
5591	(*pdb_method)->name = "ldapsam_compat";
5592
5593	ldap_state = (struct ldapsam_privates )((pdb_method)->private_data);
5594	ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT;
5595
5596	sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
5597
5598	return NT_STATUS_OK;
5599	}
5600
5601	/**********************************************************************
5602	Initialise the normal mode for pdb_ldap
5603	*********************************************************************/
5604
5605	NTSTATUS pdb_init_ldapsam(struct pdb_methods *pdb_method, const char location)
5606	{
5607	NTSTATUS nt_status;
5608	struct ldapsam_privates *ldap_state;
5609	uint32 alg_rid_base;
5610	pstring alg_rid_base_string;
5611	LDAPMessage *result = NULL;
5612	LDAPMessage *entry = NULL;
5613	DOM_SID ldap_domain_sid;
5614	DOM_SID secrets_domain_sid;
5615	pstring domain_sid_string;
5616	char *dn;
5617	char *uri = talloc_strdup( NULL, location );
5618
5619	trim_char( uri, '\"', '\"' );
5620	nt_status = pdb_init_ldapsam_common(pdb_method, uri);
5621	if ( uri )
5622	TALLOC_FREE( uri );
5623
5624	if (!NT_STATUS_IS_OK(nt_status)) {
5625	return nt_status;
5626	}
5627
5628	(*pdb_method)->name = "ldapsam";
5629
5630	(*pdb_method)->add_aliasmem = ldapsam_add_aliasmem;
5631	(*pdb_method)->del_aliasmem = ldapsam_del_aliasmem;
5632	(*pdb_method)->enum_aliasmem = ldapsam_enum_aliasmem;
5633	(*pdb_method)->enum_alias_memberships = ldapsam_alias_memberships;
5634	(*pdb_method)->search_users = ldapsam_search_users;
5635	(*pdb_method)->search_groups = ldapsam_search_groups;
5636	(*pdb_method)->search_aliases = ldapsam_search_aliases;
5637
5638	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
5639	(*pdb_method)->enum_group_members = ldapsam_enum_group_members;
5640	(*pdb_method)->enum_group_memberships =
5641	ldapsam_enum_group_memberships;
5642	(*pdb_method)->lookup_rids = ldapsam_lookup_rids;
5643	(*pdb_method)->sid_to_id = ldapsam_sid_to_id;
5644
5645	if (lp_parm_bool(-1, "ldapsam", "editposix", False)) {
5646	(*pdb_method)->create_user = ldapsam_create_user;
5647	(*pdb_method)->delete_user = ldapsam_delete_user;
5648	(*pdb_method)->create_dom_group = ldapsam_create_dom_group;
5649	(*pdb_method)->delete_dom_group = ldapsam_delete_dom_group;
5650	(*pdb_method)->add_groupmem = ldapsam_add_groupmem;
5651	(*pdb_method)->del_groupmem = ldapsam_del_groupmem;
5652	(*pdb_method)->set_unix_primary_group = ldapsam_set_primary_group;
5653	}
5654	}
5655
5656	ldap_state = (struct ldapsam_privates )((pdb_method)->private_data);
5657	ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
5658
5659	/* Try to setup the Domain Name, Domain SID, algorithmic rid base */
5660
5661	nt_status = smbldap_search_domain_info(ldap_state->smbldap_state,
5662	&result,
5663	ldap_state->domain_name, True);
5664
5665	if ( !NT_STATUS_IS_OK(nt_status) ) {
5666	DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain "
5667	"info, nor add one to the domain\n"));
5668	DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, "
5669	"will be unable to allocate new users/groups, "
5670	"and will risk BDCs having inconsistant SIDs\n"));
5671	sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
5672	return NT_STATUS_OK;
5673	}
5674
5675	/* Given that the above might fail, everything below this must be
5676	* optional */
5677
5678	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
5679	result);
5680	if (!entry) {
5681	DEBUG(0, ("pdb_init_ldapsam: Could not get domain info "
5682	"entry\n"));
5683	ldap_msgfree(result);
5684	return NT_STATUS_UNSUCCESSFUL;
5685	}
5686
5687	dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
5688	if (!dn) {
5689	ldap_msgfree(result);
5690	return NT_STATUS_UNSUCCESSFUL;
5691	}
5692
5693	ldap_state->domain_dn = smb_xstrdup(dn);
5694	ldap_memfree(dn);
5695
5696	if (smbldap_get_single_pstring(
5697	ldap_state->smbldap_state->ldap_struct,
5698	entry,
5699	get_userattr_key2string(ldap_state->schema_ver,
5700	LDAP_ATTR_USER_SID),
5701	domain_sid_string)) {
5702	BOOL found_sid;
5703	if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
5704	DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be "
5705	"read as a valid SID\n", domain_sid_string));
5706	ldap_msgfree(result);
5707	return NT_STATUS_INVALID_PARAMETER;
5708	}
5709	found_sid = secrets_fetch_domain_sid(ldap_state->domain_name,
5710	&secrets_domain_sid);
5711	if (!found_sid \|\| !sid_equal(&secrets_domain_sid,
5712	&ldap_domain_sid)) {
5713	fstring new_sid_str, old_sid_str;
5714	DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain "
5715	"%s based on pdb_ldap results %s -> %s\n",
5716	ldap_state->domain_name,
5717	sid_to_string(old_sid_str,
5718	&secrets_domain_sid),
5719	sid_to_string(new_sid_str,
5720	&ldap_domain_sid)));
5721
5722	/* reset secrets.tdb sid */
5723	secrets_store_domain_sid(ldap_state->domain_name,
5724	&ldap_domain_sid);
5725	DEBUG(1, ("New global sam SID: %s\n",
5726	sid_to_string(new_sid_str,
5727	get_global_sam_sid())));
5728	}
5729	sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
5730	}
5731
5732	if (smbldap_get_single_pstring(
5733	ldap_state->smbldap_state->ldap_struct,
5734	entry,
5735	get_attr_key2string( dominfo_attr_list,
5736	LDAP_ATTR_ALGORITHMIC_RID_BASE ),
5737	alg_rid_base_string)) {
5738	alg_rid_base = (uint32)atol(alg_rid_base_string);
5739	if (alg_rid_base != algorithmic_rid_base()) {
5740	DEBUG(0, ("The value of 'algorithmic RID base' has "
5741	"changed since the LDAP\n"
5742	"database was initialised. Aborting. \n"));
5743	ldap_msgfree(result);
5744	return NT_STATUS_UNSUCCESSFUL;
5745	}
5746	}
5747	ldap_msgfree(result);
5748
5749	return NT_STATUS_OK;
5750	}
5751
5752	NTSTATUS pdb_ldap_init(void)
5753	{
5754	NTSTATUS nt_status;
5755	if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam)))
5756	return nt_status;
5757
5758	if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_compat", pdb_init_ldapsam_compat)))
5759	return nt_status;
5760
5761	/* Let pdb_nds register backends */
5762	pdb_nds_init();
5763
5764	return NT_STATUS_OK;
5765	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: