Context Navigation

source: branches/samba-3.3.x/source/passdb/pdb_ldap.c

Visit:

Last change on this file was 370, checked in by Herwig Bauernfeind, 16 years ago
Update Samba 3.3 to 3.3.10 (source)
File size: 179.3 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	LDAP protocol helper functions for SAMBA
4	Copyright (C) Jean François Micouleau 1998
5	Copyright (C) Gerald Carter 2001-2003
6	Copyright (C) Shahms King 2001
7	Copyright (C) Andrew Bartlett 2002-2003
8	Copyright (C) Stefan (metze) Metzmacher 2002-2003
9	Copyright (C) Simo Sorce 2006
10
11	This program is free software; you can redistribute it and/or modify
12	it under the terms of the GNU General Public License as published by
13	the Free Software Foundation; either version 3 of the License, or
14	(at your option) any later version.
15
16	This program is distributed in the hope that it will be useful,
17	but WITHOUT ANY WARRANTY; without even the implied warranty of
18	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19	GNU General Public License for more details.
20
21	You should have received a copy of the GNU General Public License
22	along with this program. If not, see <http://www.gnu.org/licenses/>.
23
24	*/
25
26	/* TODO:
27	* persistent connections: if using NSS LDAP, many connections are made
28	* however, using only one within Samba would be nice
29	*
30	* Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
31	*
32	* Other LDAP based login attributes: accountExpires, etc.
33	* (should be the domain of Samba proper, but the sam_password/struct samu
34	* structures don't have fields for some of these attributes)
35	*
36	* SSL is done, but can't get the certificate based authentication to work
37	* against on my test platform (Linux 2.4, OpenLDAP 2.x)
38	*/
39
40	/* NOTE: this will NOT work against an Active Directory server
41	* due to the fact that the two password fields cannot be retrieved
42	* from a server; recommend using security = domain in this situation
43	* and/or winbind
44	*/
45
46	#include "includes.h"
47
48	#undef DBGC_CLASS
49	#define DBGC_CLASS DBGC_PASSDB
50
51	#include <lber.h>
52	#include <ldap.h>
53
54	/*
55	* Work around versions of the LDAP client libs that don't have the OIDs
56	* defined, or have them defined under the old name.
57	* This functionality is really a factor of the server, not the client
58	*
59	*/
60
61	#if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD)
62	#define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD
63	#elif !defined(LDAP_EXOP_MODIFY_PASSWD)
64	#define LDAP_EXOP_MODIFY_PASSWD "1.3.6.1.4.1.4203.1.11.1"
65	#endif
66
67	#if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
68	#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID
69	#elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
70	#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID ((ber_tag_t) 0x80U)
71	#endif
72
73	#if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
74	#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW
75	#elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
76	#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ((ber_tag_t) 0x82U)
77	#endif
78
79
80	#include "smbldap.h"
81
82	/**********************************************************************
83	Simple helper function to make stuff better readable
84	**********************************************************************/
85
86	static LDAP priv2ld(struct ldapsam_privates priv)
87	{
88	return priv->smbldap_state->ldap_struct;
89	}
90
91	/**********************************************************************
92	Get the attribute name given a user schame version.
93	**********************************************************************/
94
95	static const char* get_userattr_key2string( int schema_ver, int key )
96	{
97	switch ( schema_ver ) {
98	case SCHEMAVER_SAMBAACCOUNT:
99	return get_attr_key2string( attrib_map_v22, key );
100
101	case SCHEMAVER_SAMBASAMACCOUNT:
102	return get_attr_key2string( attrib_map_v30, key );
103
104	default:
105	DEBUG(0,("get_userattr_key2string: unknown schema version specified\n"));
106	break;
107	}
108	return NULL;
109	}
110
111	/**********************************************************************
112	Return the list of attribute names given a user schema version.
113	**********************************************************************/
114
115	const char** get_userattr_list( TALLOC_CTX *mem_ctx, int schema_ver )
116	{
117	switch ( schema_ver ) {
118	case SCHEMAVER_SAMBAACCOUNT:
119	return get_attr_list( mem_ctx, attrib_map_v22 );
120
121	case SCHEMAVER_SAMBASAMACCOUNT:
122	return get_attr_list( mem_ctx, attrib_map_v30 );
123	default:
124	DEBUG(0,("get_userattr_list: unknown schema version specified!\n"));
125	break;
126	}
127
128	return NULL;
129	}
130
131	/**************************************************************************
132	Return the list of attribute names to delete given a user schema version.
133	**************************************************************************/
134
135	static const char** get_userattr_delete_list( TALLOC_CTX *mem_ctx,
136	int schema_ver )
137	{
138	switch ( schema_ver ) {
139	case SCHEMAVER_SAMBAACCOUNT:
140	return get_attr_list( mem_ctx,
141	attrib_map_to_delete_v22 );
142
143	case SCHEMAVER_SAMBASAMACCOUNT:
144	return get_attr_list( mem_ctx,
145	attrib_map_to_delete_v30 );
146	default:
147	DEBUG(0,("get_userattr_delete_list: unknown schema version specified!\n"));
148	break;
149	}
150
151	return NULL;
152	}
153
154
155	/*******************************************************************
156	Generate the LDAP search filter for the objectclass based on the
157	version of the schema we are using.
158	******************************************************************/
159
160	static const char* get_objclass_filter( int schema_ver )
161	{
162	fstring objclass_filter;
163	char *result;
164
165	switch( schema_ver ) {
166	case SCHEMAVER_SAMBAACCOUNT:
167	fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT );
168	break;
169	case SCHEMAVER_SAMBASAMACCOUNT:
170	fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT );
171	break;
172	default:
173	DEBUG(0,("get_objclass_filter: Invalid schema version specified!\n"));
174	objclass_filter[0] = '\0';
175	break;
176	}
177
178	result = talloc_strdup(talloc_tos(), objclass_filter);
179	SMB_ASSERT(result != NULL);
180	return result;
181	}
182
183	/*****************************************************************
184	Scan a sequence number off OpenLDAP's syncrepl contextCSN
185	******************************************************************/
186
187	static NTSTATUS ldapsam_get_seq_num(struct pdb_methods my_methods, time_t seq_num)
188	{
189	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
190	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
191	LDAPMessage *msg = NULL;
192	LDAPMessage *entry = NULL;
193	TALLOC_CTX *mem_ctx;
194	char **values = NULL;
195	int rc, num_result, num_values, rid;
196	char *suffix = NULL;
197	char *tok;
198	const char *p;
199	const char **attrs;
200
201	/* Unfortunatly there is no proper way to detect syncrepl-support in
202	* smbldap_connect_system(). The syncrepl OIDs are submitted for publication
203	* but do not show up in the root-DSE yet. Neither we can query the
204	* subschema-context for the syncProviderSubentry or syncConsumerSubentry
205	* objectclass. Currently we require lp_ldap_suffix() to show up as
206	* namingContext. - Guenther
207	*/
208
209	if (!lp_parm_bool(-1, "ldapsam", "syncrepl_seqnum", False)) {
210	return ntstatus;
211	}
212
213	if (!seq_num) {
214	DEBUG(3,("ldapsam_get_seq_num: no sequence_number\n"));
215	return ntstatus;
216	}
217
218	if (!smbldap_has_naming_context(ldap_state->smbldap_state->ldap_struct, lp_ldap_suffix())) {
219	DEBUG(3,("ldapsam_get_seq_num: DIT not configured to hold %s "
220	"as top-level namingContext\n", lp_ldap_suffix()));
221	return ntstatus;
222	}
223
224	mem_ctx = talloc_init("ldapsam_get_seq_num");
225
226	if (mem_ctx == NULL)
227	return NT_STATUS_NO_MEMORY;
228
229	if ((attrs = TALLOC_ARRAY(mem_ctx, const char *, 2)) == NULL) {
230	ntstatus = NT_STATUS_NO_MEMORY;
231	goto done;
232	}
233
234	/* if we got a syncrepl-rid (up to three digits long) we speak with a consumer */
235	rid = lp_parm_int(-1, "ldapsam", "syncrepl_rid", -1);
236	if (rid > 0) {
237
238	/* consumer syncreplCookie: */
239	/* csn=20050126161620Z#0000001#00#00000 */
240	attrs[0] = talloc_strdup(mem_ctx, "syncreplCookie");
241	attrs[1] = NULL;
242	suffix = talloc_asprintf(mem_ctx,
243	"cn=syncrepl%d,%s", rid, lp_ldap_suffix());
244	if (!suffix) {
245	ntstatus = NT_STATUS_NO_MEMORY;
246	goto done;
247	}
248	} else {
249
250	/* provider contextCSN */
251	/* 20050126161620Z#000009#00#000000 */
252	attrs[0] = talloc_strdup(mem_ctx, "contextCSN");
253	attrs[1] = NULL;
254	suffix = talloc_asprintf(mem_ctx,
255	"cn=ldapsync,%s", lp_ldap_suffix());
256
257	if (!suffix) {
258	ntstatus = NT_STATUS_NO_MEMORY;
259	goto done;
260	}
261	}
262
263	rc = smbldap_search(ldap_state->smbldap_state, suffix,
264	LDAP_SCOPE_BASE, "(objectclass=*)", attrs, 0, &msg);
265
266	if (rc != LDAP_SUCCESS) {
267	goto done;
268	}
269
270	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg);
271	if (num_result != 1) {
272	DEBUG(3,("ldapsam_get_seq_num: Expected one entry, got %d\n", num_result));
273	goto done;
274	}
275
276	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg);
277	if (entry == NULL) {
278	DEBUG(3,("ldapsam_get_seq_num: Could not retrieve entry\n"));
279	goto done;
280	}
281
282	values = ldap_get_values(ldap_state->smbldap_state->ldap_struct, entry, attrs[0]);
283	if (values == NULL) {
284	DEBUG(3,("ldapsam_get_seq_num: no values\n"));
285	goto done;
286	}
287
288	num_values = ldap_count_values(values);
289	if (num_values == 0) {
290	DEBUG(3,("ldapsam_get_seq_num: not a single value\n"));
291	goto done;
292	}
293
294	p = values[0];
295	if (!next_token_talloc(mem_ctx, &p, &tok, "#")) {
296	DEBUG(0,("ldapsam_get_seq_num: failed to parse sequence number\n"));
297	goto done;
298	}
299
300	p = tok;
301	if (!strncmp(p, "csn=", strlen("csn=")))
302	p += strlen("csn=");
303
304	DEBUG(10,("ldapsam_get_seq_num: got %s: %s\n", attrs[0], p));
305
306	*seq_num = generalized_to_unix_time(p);
307
308	/* very basic sanity check */
309	if (*seq_num <= 0) {
310	DEBUG(3,("ldapsam_get_seq_num: invalid sequence number: %d\n",
311	(int)*seq_num));
312	goto done;
313	}
314
315	ntstatus = NT_STATUS_OK;
316
317	done:
318	if (values != NULL)
319	ldap_value_free(values);
320	if (msg != NULL)
321	ldap_msgfree(msg);
322	if (mem_ctx)
323	talloc_destroy(mem_ctx);
324
325	return ntstatus;
326	}
327
328	/*******************************************************************
329	Run the search by name.
330	******************************************************************/
331
332	int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
333	const char *user,
334	LDAPMessage ** result,
335	const char **attr)
336	{
337	char *filter = NULL;
338	char *escape_user = escape_ldap_string_alloc(user);
339	int ret = -1;
340
341	if (!escape_user) {
342	return LDAP_NO_MEMORY;
343	}
344
345	/*
346	* in the filter expression, replace %u with the real name
347	* so in ldap filter, %u MUST exist :-)
348	*/
349	filter = talloc_asprintf(talloc_tos(), "(&%s%s)", "(uid=%u)",
350	get_objclass_filter(ldap_state->schema_ver));
351	if (!filter) {
352	SAFE_FREE(escape_user);
353	return LDAP_NO_MEMORY;
354	}
355	/*
356	* have to use this here because $ is filtered out
357	* in string_sub
358	*/
359
360	filter = talloc_all_string_sub(talloc_tos(),
361	filter, "%u", escape_user);
362	SAFE_FREE(escape_user);
363	if (!filter) {
364	return LDAP_NO_MEMORY;
365	}
366
367	ret = smbldap_search_suffix(ldap_state->smbldap_state,
368	filter, attr, result);
369	TALLOC_FREE(filter);
370	return ret;
371	}
372
373	/*******************************************************************
374	Run the search by rid.
375	******************************************************************/
376
377	static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
378	uint32 rid, LDAPMessage ** result,
379	const char **attr)
380	{
381	char *filter = NULL;
382	int rc;
383
384	filter = talloc_asprintf(talloc_tos(), "(&(rid=%i)%s)", rid,
385	get_objclass_filter(ldap_state->schema_ver));
386	if (!filter) {
387	return LDAP_NO_MEMORY;
388	}
389
390	rc = smbldap_search_suffix(ldap_state->smbldap_state,
391	filter, attr, result);
392	TALLOC_FREE(filter);
393	return rc;
394	}
395
396	/*******************************************************************
397	Run the search by SID.
398	******************************************************************/
399
400	static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
401	const DOM_SID sid, LDAPMessage * result,
402	const char **attr)
403	{
404	char *filter = NULL;
405	int rc;
406	fstring sid_string;
407
408	filter = talloc_asprintf(talloc_tos(), "(&(%s=%s)%s)",
409	get_userattr_key2string(ldap_state->schema_ver,
410	LDAP_ATTR_USER_SID),
411	sid_to_fstring(sid_string, sid),
412	get_objclass_filter(ldap_state->schema_ver));
413	if (!filter) {
414	return LDAP_NO_MEMORY;
415	}
416
417	rc = smbldap_search_suffix(ldap_state->smbldap_state,
418	filter, attr, result);
419
420	TALLOC_FREE(filter);
421	return rc;
422	}
423
424	/*******************************************************************
425	Delete complete object or objectclass and attrs from
426	object found in search_result depending on lp_ldap_delete_dn
427	******************************************************************/
428
429	static int ldapsam_delete_entry(struct ldapsam_privates *priv,
430	TALLOC_CTX *mem_ctx,
431	LDAPMessage *entry,
432	const char *objectclass,
433	const char **attrs)
434	{
435	LDAPMod **mods = NULL;
436	char *name;
437	const char *dn;
438	BerElement *ptr = NULL;
439
440	dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry);
441	if (dn == NULL) {
442	return LDAP_NO_MEMORY;
443	}
444
445	if (lp_ldap_delete_dn()) {
446	return smbldap_delete(priv->smbldap_state, dn);
447	}
448
449	/* Ok, delete only the SAM attributes */
450
451	for (name = ldap_first_attribute(priv2ld(priv), entry, &ptr);
452	name != NULL;
453	name = ldap_next_attribute(priv2ld(priv), entry, ptr)) {
454	const char **attrib;
455
456	/* We are only allowed to delete the attributes that
457	really exist. */
458
459	for (attrib = attrs; *attrib != NULL; attrib++) {
460	if (strequal(*attrib, name)) {
461	DEBUG(10, ("ldapsam_delete_entry: deleting "
462	"attribute %s\n", name));
463	smbldap_set_mod(&mods, LDAP_MOD_DELETE, name,
464	NULL);
465	}
466	}
467	ldap_memfree(name);
468	}
469
470	if (ptr != NULL) {
471	ber_free(ptr, 0);
472	}
473
474	smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
475	talloc_autofree_ldapmod(mem_ctx, mods);
476
477	return smbldap_modify(priv->smbldap_state, dn, mods);
478	}
479
480	static time_t ldapsam_get_entry_timestamp( struct ldapsam_privates ldap_state, LDAPMessage entry)
481	{
482	char *temp;
483	struct tm tm;
484
485	temp = smbldap_talloc_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
486	get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
487	talloc_tos());
488	if (!temp) {
489	return (time_t) 0;
490	}
491
492	if ( !strptime(temp, "%Y%m%d%H%M%SZ", &tm)) {
493	DEBUG(2,("ldapsam_get_entry_timestamp: strptime failed on: %s\n",
494	(char*)temp));
495	TALLOC_FREE(temp);
496	return (time_t) 0;
497	}
498	TALLOC_FREE(temp);
499	tzset();
500	return timegm(&tm);
501	}
502
503	/**********************************************************************
504	Initialize struct samu from an LDAP query.
505	(Based on init_sam_from_buffer in pdb_tdb.c)
506	*********************************************************************/
507
508	static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
509	struct samu * sampass,
510	LDAPMessage * entry)
511	{
512	time_t logon_time,
513	logoff_time,
514	kickoff_time,
515	pass_last_set_time,
516	pass_can_change_time,
517	pass_must_change_time,
518	ldap_entry_time,
519	bad_password_time;
520	char *username = NULL,
521	*domain = NULL,
522	*nt_username = NULL,
523	*fullname = NULL,
524	*homedir = NULL,
525	*dir_drive = NULL,
526	*logon_script = NULL,
527	*profile_path = NULL,
528	*acct_desc = NULL,
529	*workstations = NULL,
530	*munged_dial = NULL;
531	uint32 user_rid;
532	uint8 smblmpwd[LM_HASH_LEN],
533	smbntpwd[NT_HASH_LEN];
534	bool use_samba_attrs = True;
535	uint32 acct_ctrl = 0;
536	uint16 logon_divs;
537	uint16 bad_password_count = 0,
538	logon_count = 0;
539	uint32 hours_len;
540	uint8 hours[MAX_HOURS_LEN];
541	char *temp = NULL;
542	LOGIN_CACHE *cache_entry = NULL;
543	uint32 pwHistLen;
544	bool expand_explicit = lp_passdb_expand_explicit();
545	bool ret = false;
546	TALLOC_CTX *ctx = talloc_init("init_sam_from_ldap");
547
548	if (!ctx) {
549	return false;
550	}
551	if (sampass == NULL \|\| ldap_state == NULL \|\| entry == NULL) {
552	DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
553	goto fn_exit;
554	}
555
556	if (priv2ld(ldap_state) == NULL) {
557	DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->"
558	"ldap_struct is NULL!\n"));
559	goto fn_exit;
560	}
561
562	if (!(username = smbldap_talloc_first_attribute(priv2ld(ldap_state),
563	entry,
564	"uid",
565	ctx))) {
566	DEBUG(1, ("init_sam_from_ldap: No uid attribute found for "
567	"this user!\n"));
568	goto fn_exit;
569	}
570
571	DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
572
573	nt_username = talloc_strdup(ctx, username);
574	if (!nt_username) {
575	goto fn_exit;
576	}
577
578	domain = talloc_strdup(ctx, ldap_state->domain_name);
579	if (!domain) {
580	goto fn_exit;
581	}
582
583	pdb_set_username(sampass, username, PDB_SET);
584
585	pdb_set_domain(sampass, domain, PDB_DEFAULT);
586	pdb_set_nt_username(sampass, nt_username, PDB_SET);
587
588	/* deal with different attributes between the schema first */
589
590	if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
591	if ((temp = smbldap_talloc_single_attribute(
592	ldap_state->smbldap_state->ldap_struct,
593	entry,
594	get_userattr_key2string(ldap_state->schema_ver,
595	LDAP_ATTR_USER_SID),
596	ctx))!=NULL) {
597	pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
598	}
599	} else {
600	if ((temp = smbldap_talloc_single_attribute(
601	ldap_state->smbldap_state->ldap_struct,
602	entry,
603	get_userattr_key2string(ldap_state->schema_ver,
604	LDAP_ATTR_USER_RID),
605	ctx))!=NULL) {
606	user_rid = (uint32)atol(temp);
607	pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
608	}
609	}
610
611	if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
612	DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
613	get_userattr_key2string(ldap_state->schema_ver,
614	LDAP_ATTR_USER_SID),
615	get_userattr_key2string(ldap_state->schema_ver,
616	LDAP_ATTR_USER_RID),
617	username));
618	return False;
619	}
620
621	temp = smbldap_talloc_single_attribute(
622	ldap_state->smbldap_state->ldap_struct,
623	entry,
624	get_userattr_key2string(ldap_state->schema_ver,
625	LDAP_ATTR_PWD_LAST_SET),
626	ctx);
627	if (temp) {
628	pass_last_set_time = (time_t) atol(temp);
629	pdb_set_pass_last_set_time(sampass,
630	pass_last_set_time, PDB_SET);
631	}
632
633	temp = smbldap_talloc_single_attribute(
634	ldap_state->smbldap_state->ldap_struct,
635	entry,
636	get_userattr_key2string(ldap_state->schema_ver,
637	LDAP_ATTR_LOGON_TIME),
638	ctx);
639	if (temp) {
640	logon_time = (time_t) atol(temp);
641	pdb_set_logon_time(sampass, logon_time, PDB_SET);
642	}
643
644	temp = smbldap_talloc_single_attribute(
645	ldap_state->smbldap_state->ldap_struct,
646	entry,
647	get_userattr_key2string(ldap_state->schema_ver,
648	LDAP_ATTR_LOGOFF_TIME),
649	ctx);
650	if (temp) {
651	logoff_time = (time_t) atol(temp);
652	pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
653	}
654
655	temp = smbldap_talloc_single_attribute(
656	ldap_state->smbldap_state->ldap_struct,
657	entry,
658	get_userattr_key2string(ldap_state->schema_ver,
659	LDAP_ATTR_KICKOFF_TIME),
660	ctx);
661	if (temp) {
662	kickoff_time = (time_t) atol(temp);
663	pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
664	}
665
666	temp = smbldap_talloc_single_attribute(
667	ldap_state->smbldap_state->ldap_struct,
668	entry,
669	get_userattr_key2string(ldap_state->schema_ver,
670	LDAP_ATTR_PWD_CAN_CHANGE),
671	ctx);
672	if (temp) {
673	pass_can_change_time = (time_t) atol(temp);
674	pdb_set_pass_can_change_time(sampass,
675	pass_can_change_time, PDB_SET);
676	}
677
678	temp = smbldap_talloc_single_attribute(
679	ldap_state->smbldap_state->ldap_struct,
680	entry,
681	get_userattr_key2string(ldap_state->schema_ver,
682	LDAP_ATTR_PWD_MUST_CHANGE),
683	ctx);
684	if (temp) {
685	pass_must_change_time = (time_t) atol(temp);
686	pdb_set_pass_must_change_time(sampass,
687	pass_must_change_time, PDB_SET);
688	}
689
690	/* recommend that 'gecos' and 'displayName' should refer to the same
691	* attribute OID. userFullName depreciated, only used by Samba
692	* primary rules of LDAP: don't make a new attribute when one is already defined
693	* that fits your needs; using cn then displayName rather than 'userFullName'
694	*/
695
696	fullname = smbldap_talloc_single_attribute(
697	ldap_state->smbldap_state->ldap_struct,
698	entry,
699	get_userattr_key2string(ldap_state->schema_ver,
700	LDAP_ATTR_DISPLAY_NAME),
701	ctx);
702	if (fullname) {
703	pdb_set_fullname(sampass, fullname, PDB_SET);
704	} else {
705	fullname = smbldap_talloc_single_attribute(
706	ldap_state->smbldap_state->ldap_struct,
707	entry,
708	get_userattr_key2string(ldap_state->schema_ver,
709	LDAP_ATTR_CN),
710	ctx);
711	if (fullname) {
712	pdb_set_fullname(sampass, fullname, PDB_SET);
713	}
714	}
715
716	dir_drive = smbldap_talloc_single_attribute(
717	ldap_state->smbldap_state->ldap_struct,
718	entry,
719	get_userattr_key2string(ldap_state->schema_ver,
720	LDAP_ATTR_HOME_DRIVE),
721	ctx);
722	if (dir_drive) {
723	pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
724	} else {
725	pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
726	}
727
728	homedir = smbldap_talloc_single_attribute(
729	ldap_state->smbldap_state->ldap_struct,
730	entry,
731	get_userattr_key2string(ldap_state->schema_ver,
732	LDAP_ATTR_HOME_PATH),
733	ctx);
734	if (homedir) {
735	if (expand_explicit) {
736	homedir = talloc_sub_basic(ctx,
737	username,
738	domain,
739	homedir);
740	if (!homedir) {
741	goto fn_exit;
742	}
743	}
744	pdb_set_homedir(sampass, homedir, PDB_SET);
745	} else {
746	pdb_set_homedir(sampass,
747	talloc_sub_basic(ctx, username, domain,
748	lp_logon_home()),
749	PDB_DEFAULT);
750	}
751
752	logon_script = smbldap_talloc_single_attribute(
753	ldap_state->smbldap_state->ldap_struct,
754	entry,
755	get_userattr_key2string(ldap_state->schema_ver,
756	LDAP_ATTR_LOGON_SCRIPT),
757	ctx);
758	if (logon_script) {
759	if (expand_explicit) {
760	logon_script = talloc_sub_basic(ctx,
761	username,
762	domain,
763	logon_script);
764	if (!logon_script) {
765	goto fn_exit;
766	}
767	}
768	pdb_set_logon_script(sampass, logon_script, PDB_SET);
769	} else {
770	pdb_set_logon_script(sampass,
771	talloc_sub_basic(ctx, username, domain,
772	lp_logon_script()),
773	PDB_DEFAULT );
774	}
775
776	profile_path = smbldap_talloc_single_attribute(
777	ldap_state->smbldap_state->ldap_struct,
778	entry,
779	get_userattr_key2string(ldap_state->schema_ver,
780	LDAP_ATTR_PROFILE_PATH),
781	ctx);
782	if (profile_path) {
783	if (expand_explicit) {
784	profile_path = talloc_sub_basic(ctx,
785	username,
786	domain,
787	profile_path);
788	if (!profile_path) {
789	goto fn_exit;
790	}
791	}
792	pdb_set_profile_path(sampass, profile_path, PDB_SET);
793	} else {
794	pdb_set_profile_path(sampass,
795	talloc_sub_basic(ctx, username, domain,
796	lp_logon_path()),
797	PDB_DEFAULT );
798	}
799
800	acct_desc = smbldap_talloc_single_attribute(
801	ldap_state->smbldap_state->ldap_struct,
802	entry,
803	get_userattr_key2string(ldap_state->schema_ver,
804	LDAP_ATTR_DESC),
805	ctx);
806	if (acct_desc) {
807	pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
808	}
809
810	workstations = smbldap_talloc_single_attribute(
811	ldap_state->smbldap_state->ldap_struct,
812	entry,
813	get_userattr_key2string(ldap_state->schema_ver,
814	LDAP_ATTR_USER_WKS),
815	ctx);
816	if (workstations) {
817	pdb_set_workstations(sampass, workstations, PDB_SET);
818	}
819
820	munged_dial = smbldap_talloc_single_attribute(
821	ldap_state->smbldap_state->ldap_struct,
822	entry,
823	get_userattr_key2string(ldap_state->schema_ver,
824	LDAP_ATTR_MUNGED_DIAL),
825	ctx);
826	if (munged_dial) {
827	pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
828	}
829
830	/* FIXME: hours stuff should be cleaner */
831
832	logon_divs = 168;
833	hours_len = 21;
834	memset(hours, 0xff, hours_len);
835
836	if (ldap_state->is_nds_ldap) {
837	char *user_dn;
838	size_t pwd_len;
839	char clear_text_pw[512];
840
841	/* Make call to Novell eDirectory ldap extension to get clear text password.
842	NOTE: This will only work if we have an SSL connection to eDirectory. */
843	user_dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
844	if (user_dn != NULL) {
845	DEBUG(3, ("init_sam_from_ldap: smbldap_get_dn(%s) returned '%s'\n", username, user_dn));
846
847	pwd_len = sizeof(clear_text_pw);
848	if (pdb_nds_get_password(ldap_state->smbldap_state, user_dn, &pwd_len, clear_text_pw) == LDAP_SUCCESS) {
849	nt_lm_owf_gen(clear_text_pw, smbntpwd, smblmpwd);
850	if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET)) {
851	SAFE_FREE(user_dn);
852	return False;
853	}
854	ZERO_STRUCT(smblmpwd);
855	if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET)) {
856	SAFE_FREE(user_dn);
857	return False;
858	}
859	ZERO_STRUCT(smbntpwd);
860	use_samba_attrs = False;
861	}
862
863	SAFE_FREE(user_dn);
864
865	} else {
866	DEBUG(0, ("init_sam_from_ldap: failed to get user_dn for '%s'\n", username));
867	}
868	}
869
870	if (use_samba_attrs) {
871	temp = smbldap_talloc_single_attribute(
872	ldap_state->smbldap_state->ldap_struct,
873	entry,
874	get_userattr_key2string(ldap_state->schema_ver,
875	LDAP_ATTR_LMPW),
876	ctx);
877	if (temp) {
878	pdb_gethexpwd(temp, smblmpwd);
879	memset((char *)temp, '\0', strlen(temp)+1);
880	if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET)) {
881	goto fn_exit;
882	}
883	ZERO_STRUCT(smblmpwd);
884	}
885
886	temp = smbldap_talloc_single_attribute(
887	ldap_state->smbldap_state->ldap_struct,
888	entry,
889	get_userattr_key2string(ldap_state->schema_ver,
890	LDAP_ATTR_NTPW),
891	ctx);
892	if (temp) {
893	pdb_gethexpwd(temp, smbntpwd);
894	memset((char *)temp, '\0', strlen(temp)+1);
895	if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET)) {
896	goto fn_exit;
897	}
898	ZERO_STRUCT(smbntpwd);
899	}
900	}
901
902	pwHistLen = 0;
903
904	pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
905	if (pwHistLen > 0){
906	uint8 *pwhist = NULL;
907	int i;
908	char *history_string = TALLOC_ARRAY(ctx, char,
909	MAX_PW_HISTORY_LEN*64);
910
911	if (!history_string) {
912	goto fn_exit;
913	}
914
915	pwHistLen = MIN(pwHistLen, MAX_PW_HISTORY_LEN);
916
917	if ((pwhist = TALLOC_ARRAY(ctx, uint8,
918	pwHistLen * PW_HISTORY_ENTRY_LEN)) ==
919	NULL){
920	DEBUG(0, ("init_sam_from_ldap: talloc failed!\n"));
921	goto fn_exit;
922	}
923	memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
924
925	if (smbldap_get_single_attribute(
926	ldap_state->smbldap_state->ldap_struct,
927	entry,
928	get_userattr_key2string(ldap_state->schema_ver,
929	LDAP_ATTR_PWD_HISTORY),
930	history_string,
931	MAX_PW_HISTORY_LEN*64)) {
932	bool hex_failed = false;
933	for (i = 0; i < pwHistLen; i++){
934	/* Get the 16 byte salt. */
935	if (!pdb_gethexpwd(&history_string[i*64],
936	&pwhist[i*PW_HISTORY_ENTRY_LEN])) {
937	hex_failed = true;
938	break;
939	}
940	/* Get the 16 byte MD5 hash of salt+passwd. */
941	if (!pdb_gethexpwd(&history_string[(i*64)+32],
942	&pwhist[(i*PW_HISTORY_ENTRY_LEN)+
943	PW_HISTORY_SALT_LEN])) {
944	hex_failed = True;
945	break;
946	}
947	}
948	if (hex_failed) {
949	DEBUG(2,("init_sam_from_ldap: Failed to get password history for user %s\n",
950	username));
951	memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
952	}
953	}
954	if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
955	goto fn_exit;
956	}
957	}
958
959	temp = smbldap_talloc_single_attribute(
960	ldap_state->smbldap_state->ldap_struct,
961	entry,
962	get_userattr_key2string(ldap_state->schema_ver,
963	LDAP_ATTR_ACB_INFO),
964	ctx);
965	if (temp) {
966	acct_ctrl = pdb_decode_acct_ctrl(temp);
967
968	if (acct_ctrl == 0) {
969	acct_ctrl \|= ACB_NORMAL;
970	}
971
972	pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
973	} else {
974	acct_ctrl \|= ACB_NORMAL;
975	}
976
977	pdb_set_hours_len(sampass, hours_len, PDB_SET);
978	pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
979
980	temp = smbldap_talloc_single_attribute(
981	ldap_state->smbldap_state->ldap_struct,
982	entry,
983	get_userattr_key2string(ldap_state->schema_ver,
984	LDAP_ATTR_BAD_PASSWORD_COUNT),
985	ctx);
986	if (temp) {
987	bad_password_count = (uint32) atol(temp);
988	pdb_set_bad_password_count(sampass,
989	bad_password_count, PDB_SET);
990	}
991
992	temp = smbldap_talloc_single_attribute(
993	ldap_state->smbldap_state->ldap_struct,
994	entry,
995	get_userattr_key2string(ldap_state->schema_ver,
996	LDAP_ATTR_BAD_PASSWORD_TIME),
997	ctx);
998	if (temp) {
999	bad_password_time = (time_t) atol(temp);
1000	pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
1001	}
1002
1003
1004	temp = smbldap_talloc_single_attribute(
1005	ldap_state->smbldap_state->ldap_struct,
1006	entry,
1007	get_userattr_key2string(ldap_state->schema_ver,
1008	LDAP_ATTR_LOGON_COUNT),
1009	ctx);
1010	if (temp) {
1011	logon_count = (uint32) atol(temp);
1012	pdb_set_logon_count(sampass, logon_count, PDB_SET);
1013	}
1014
1015	/* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
1016
1017	temp = smbldap_talloc_single_attribute(
1018	ldap_state->smbldap_state->ldap_struct,
1019	entry,
1020	get_userattr_key2string(ldap_state->schema_ver,
1021	LDAP_ATTR_LOGON_HOURS),
1022	ctx);
1023	if (temp) {
1024	pdb_gethexhours(temp, hours);
1025	memset((char *)temp, '\0', strlen(temp) +1);
1026	pdb_set_hours(sampass, hours, PDB_SET);
1027	ZERO_STRUCT(hours);
1028	}
1029
1030	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
1031	temp = smbldap_talloc_single_attribute(
1032	priv2ld(ldap_state),
1033	entry,
1034	"uidNumber",
1035	ctx);
1036	if (temp) {
1037	/* We've got a uid, feed the cache */
1038	uid_t uid = strtoul(temp, NULL, 10);
1039	store_uid_sid_cache(pdb_get_user_sid(sampass), uid);
1040	}
1041	}
1042
1043	/* check the timestamp of the cache vs ldap entry */
1044	if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
1045	entry))) {
1046	ret = true;
1047	goto fn_exit;
1048	}
1049
1050	/* see if we have newer updates */
1051	if (!(cache_entry = login_cache_read(sampass))) {
1052	DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
1053	(unsigned int)pdb_get_bad_password_count(sampass),
1054	(unsigned int)pdb_get_bad_password_time(sampass)));
1055	ret = true;
1056	goto fn_exit;
1057	}
1058
1059	DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
1060	(unsigned int)ldap_entry_time,
1061	(unsigned int)cache_entry->entry_timestamp,
1062	(unsigned int)cache_entry->bad_password_time));
1063
1064	if (ldap_entry_time > cache_entry->entry_timestamp) {
1065	/* cache is older than directory , so
1066	we need to delete the entry but allow the
1067	fields to be written out */
1068	login_cache_delentry(sampass);
1069	} else {
1070	/* read cache in */
1071	pdb_set_acct_ctrl(sampass,
1072	pdb_get_acct_ctrl(sampass) \|
1073	(cache_entry->acct_ctrl & ACB_AUTOLOCK),
1074	PDB_SET);
1075	pdb_set_bad_password_count(sampass,
1076	cache_entry->bad_password_count,
1077	PDB_SET);
1078	pdb_set_bad_password_time(sampass,
1079	cache_entry->bad_password_time,
1080	PDB_SET);
1081	}
1082
1083	ret = true;
1084
1085	fn_exit:
1086
1087	TALLOC_FREE(ctx);
1088	SAFE_FREE(cache_entry);
1089	return ret;
1090	}
1091
1092	/**********************************************************************
1093	Initialize the ldap db from a struct samu. Called on update.
1094	(Based on init_buffer_from_sam in pdb_tdb.c)
1095	*********************************************************************/
1096
1097	static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
1098	LDAPMessage *existing,
1099	LDAPMod *** mods, struct samu * sampass,
1100	bool (need_update)(const struct samu ,
1101	enum pdb_elements))
1102	{
1103	char *temp = NULL;
1104	uint32 rid;
1105
1106	if (mods == NULL \|\| sampass == NULL) {
1107	DEBUG(0, ("init_ldap_from_sam: NULL parameters found!\n"));
1108	return False;
1109	}
1110
1111	*mods = NULL;
1112
1113	/*
1114	* took out adding "objectclass: sambaAccount"
1115	* do this on a per-mod basis
1116	*/
1117	if (need_update(sampass, PDB_USERNAME)) {
1118	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1119	"uid", pdb_get_username(sampass));
1120	if (ldap_state->is_nds_ldap) {
1121	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1122	"cn", pdb_get_username(sampass));
1123	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1124	"sn", pdb_get_username(sampass));
1125	}
1126	}
1127
1128	DEBUG(2, ("init_ldap_from_sam: Setting entry for user: %s\n", pdb_get_username(sampass)));
1129
1130	/* only update the RID if we actually need to */
1131	if (need_update(sampass, PDB_USERSID)) {
1132	fstring sid_string;
1133	const DOM_SID *user_sid = pdb_get_user_sid(sampass);
1134
1135	switch ( ldap_state->schema_ver ) {
1136	case SCHEMAVER_SAMBAACCOUNT:
1137	if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
1138	DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
1139	sid_string_dbg(user_sid),
1140	sid_string_dbg(
1141	&ldap_state->domain_sid)));
1142	return False;
1143	}
1144	if (asprintf(&temp, "%i", rid) < 0) {
1145	return false;
1146	}
1147	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1148	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
1149	temp);
1150	SAFE_FREE(temp);
1151	break;
1152
1153	case SCHEMAVER_SAMBASAMACCOUNT:
1154	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1155	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
1156	sid_to_fstring(sid_string, user_sid));
1157	break;
1158
1159	default:
1160	DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
1161	break;
1162	}
1163	}
1164
1165	/* we don't need to store the primary group RID - so leaving it
1166	'free' to hang off the unix primary group makes life easier */
1167
1168	if (need_update(sampass, PDB_GROUPSID)) {
1169	fstring sid_string;
1170	const DOM_SID *group_sid = pdb_get_group_sid(sampass);
1171
1172	switch ( ldap_state->schema_ver ) {
1173	case SCHEMAVER_SAMBAACCOUNT:
1174	if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
1175	DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
1176	sid_string_dbg(group_sid),
1177	sid_string_dbg(
1178	&ldap_state->domain_sid)));
1179	return False;
1180	}
1181
1182	if (asprintf(&temp, "%i", rid) < 0) {
1183	return false;
1184	}
1185	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1186	get_userattr_key2string(ldap_state->schema_ver,
1187	LDAP_ATTR_PRIMARY_GROUP_RID), temp);
1188	SAFE_FREE(temp);
1189	break;
1190
1191	case SCHEMAVER_SAMBASAMACCOUNT:
1192	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1193	get_userattr_key2string(ldap_state->schema_ver,
1194	LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_fstring(sid_string, group_sid));
1195	break;
1196
1197	default:
1198	DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
1199	break;
1200	}
1201
1202	}
1203
1204	/* displayName, cn, and gecos should all be the same
1205	* most easily accomplished by giving them the same OID
1206	* gecos isn't set here b/c it should be handled by the
1207	* add-user script
1208	* We change displayName only and fall back to cn if
1209	* it does not exist.
1210	*/
1211
1212	if (need_update(sampass, PDB_FULLNAME))
1213	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1214	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME),
1215	pdb_get_fullname(sampass));
1216
1217	if (need_update(sampass, PDB_ACCTDESC))
1218	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1219	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC),
1220	pdb_get_acct_desc(sampass));
1221
1222	if (need_update(sampass, PDB_WORKSTATIONS))
1223	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1224	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
1225	pdb_get_workstations(sampass));
1226
1227	if (need_update(sampass, PDB_MUNGEDDIAL))
1228	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1229	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL),
1230	pdb_get_munged_dial(sampass));
1231
1232	if (need_update(sampass, PDB_SMBHOME))
1233	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1234	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
1235	pdb_get_homedir(sampass));
1236
1237	if (need_update(sampass, PDB_DRIVE))
1238	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1239	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
1240	pdb_get_dir_drive(sampass));
1241
1242	if (need_update(sampass, PDB_LOGONSCRIPT))
1243	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1244	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT),
1245	pdb_get_logon_script(sampass));
1246
1247	if (need_update(sampass, PDB_PROFILE))
1248	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1249	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
1250	pdb_get_profile_path(sampass));
1251
1252	if (asprintf(&temp, "%li", (long int)pdb_get_logon_time(sampass)) < 0) {
1253	return false;
1254	}
1255	if (need_update(sampass, PDB_LOGONTIME))
1256	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1257	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
1258	SAFE_FREE(temp);
1259
1260	if (asprintf(&temp, "%li", (long int)pdb_get_logoff_time(sampass)) < 0) {
1261	return false;
1262	}
1263	if (need_update(sampass, PDB_LOGOFFTIME))
1264	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1265	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
1266	SAFE_FREE(temp);
1267
1268	if (asprintf(&temp, "%li", (long int)pdb_get_kickoff_time(sampass)) < 0) {
1269	return false;
1270	}
1271	if (need_update(sampass, PDB_KICKOFFTIME))
1272	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1273	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
1274	SAFE_FREE(temp);
1275
1276	if (asprintf(&temp, "%li", (long int)pdb_get_pass_can_change_time_noncalc(sampass)) < 0) {
1277	return false;
1278	}
1279	if (need_update(sampass, PDB_CANCHANGETIME))
1280	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1281	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
1282	SAFE_FREE(temp);
1283
1284	if (asprintf(&temp, "%li", (long int)pdb_get_pass_must_change_time(sampass)) < 0) {
1285	return false;
1286	}
1287	if (need_update(sampass, PDB_MUSTCHANGETIME))
1288	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1289	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
1290	SAFE_FREE(temp);
1291
1292	if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST))
1293	\|\| (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
1294
1295	if (need_update(sampass, PDB_LMPASSWD)) {
1296	const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
1297	if (lm_pw) {
1298	char pwstr[34];
1299	pdb_sethexpwd(pwstr, lm_pw,
1300	pdb_get_acct_ctrl(sampass));
1301	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1302	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1303	pwstr);
1304	} else {
1305	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1306	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1307	NULL);
1308	}
1309	}
1310	if (need_update(sampass, PDB_NTPASSWD)) {
1311	const uchar *nt_pw = pdb_get_nt_passwd(sampass);
1312	if (nt_pw) {
1313	char pwstr[34];
1314	pdb_sethexpwd(pwstr, nt_pw,
1315	pdb_get_acct_ctrl(sampass));
1316	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1317	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1318	pwstr);
1319	} else {
1320	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1321	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1322	NULL);
1323	}
1324	}
1325
1326	if (need_update(sampass, PDB_PWHISTORY)) {
1327	char *pwstr = NULL;
1328	uint32 pwHistLen = 0;
1329	pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
1330
1331	pwstr = SMB_MALLOC_ARRAY(char, 1024);
1332	if (!pwstr) {
1333	return false;
1334	}
1335	if (pwHistLen == 0) {
1336	/* Remove any password history from the LDAP store. */
1337	memset(pwstr, '0', 64); /* NOTE !!!! '0' NOT '\0' /
1338	pwstr[64] = '\0';
1339	} else {
1340	int i;
1341	uint32 currHistLen = 0;
1342	const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
1343	if (pwhist != NULL) {
1344	/* We can only store (1024-1/64 password history entries. */
1345	pwHistLen = MIN(pwHistLen, ((1024-1)/64));
1346	for (i=0; i< pwHistLen && i < currHistLen; i++) {
1347	/* Store the salt. */
1348	pdb_sethexpwd(&pwstr[i64], &pwhist[iPW_HISTORY_ENTRY_LEN], 0);
1349	/* Followed by the md5 hash of salt + md4 hash */
1350	pdb_sethexpwd(&pwstr[(i*64)+32],
1351	&pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
1352	DEBUG(100, ("pwstr=%s\n", pwstr));
1353	}
1354	}
1355	}
1356	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1357	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
1358	pwstr);
1359	SAFE_FREE(pwstr);
1360	}
1361
1362	if (need_update(sampass, PDB_PASSLASTSET)) {
1363	if (asprintf(&temp, "%li",
1364	(long int)pdb_get_pass_last_set_time(sampass)) < 0) {
1365	return false;
1366	}
1367	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1368	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
1369	temp);
1370	SAFE_FREE(temp);
1371	}
1372	}
1373
1374	if (need_update(sampass, PDB_HOURS)) {
1375	const uint8 *hours = pdb_get_hours(sampass);
1376	if (hours) {
1377	char hourstr[44];
1378	pdb_sethexhours(hourstr, hours);
1379	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
1380	existing,
1381	mods,
1382	get_userattr_key2string(ldap_state->schema_ver,
1383	LDAP_ATTR_LOGON_HOURS),
1384	hourstr);
1385	}
1386	}
1387
1388	if (need_update(sampass, PDB_ACCTCTRL))
1389	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1390	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
1391	pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
1392
1393	/* password lockout cache:
1394	- If we are now autolocking or clearing, we write to ldap
1395	- If we are clearing, we delete the cache entry
1396	- If the count is > 0, we update the cache
1397
1398	This even means when autolocking, we cache, just in case the
1399	update doesn't work, and we have to cache the autolock flag */
1400
1401	if (need_update(sampass, PDB_BAD_PASSWORD_COUNT)) /* &&
1402	need_update(sampass, PDB_BAD_PASSWORD_TIME)) */ {
1403	uint16 badcount = pdb_get_bad_password_count(sampass);
1404	time_t badtime = pdb_get_bad_password_time(sampass);
1405	uint32 pol;
1406	pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT, &pol);
1407
1408	DEBUG(3, ("updating bad password fields, policy=%u, count=%u, time=%u\n",
1409	(unsigned int)pol, (unsigned int)badcount, (unsigned int)badtime));
1410
1411	if ((badcount >= pol) \|\| (badcount == 0)) {
1412	DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
1413	(unsigned int)badcount, (unsigned int)badtime));
1414	if (asprintf(&temp, "%li", (long)badcount) < 0) {
1415	return false;
1416	}
1417	smbldap_make_mod(
1418	ldap_state->smbldap_state->ldap_struct,
1419	existing, mods,
1420	get_userattr_key2string(
1421	ldap_state->schema_ver,
1422	LDAP_ATTR_BAD_PASSWORD_COUNT),
1423	temp);
1424	SAFE_FREE(temp);
1425
1426	if (asprintf(&temp, "%li", (long int)badtime) < 0) {
1427	return false;
1428	}
1429	smbldap_make_mod(
1430	ldap_state->smbldap_state->ldap_struct,
1431	existing, mods,
1432	get_userattr_key2string(
1433	ldap_state->schema_ver,
1434	LDAP_ATTR_BAD_PASSWORD_TIME),
1435	temp);
1436	SAFE_FREE(temp);
1437	}
1438	if (badcount == 0) {
1439	DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
1440	login_cache_delentry(sampass);
1441	} else {
1442	LOGIN_CACHE cache_entry;
1443
1444	cache_entry.entry_timestamp = time(NULL);
1445	cache_entry.acct_ctrl = pdb_get_acct_ctrl(sampass);
1446	cache_entry.bad_password_count = badcount;
1447	cache_entry.bad_password_time = badtime;
1448
1449	DEBUG(7, ("Updating bad password count and time in login cache\n"));
1450	login_cache_write(sampass, cache_entry);
1451	}
1452	}
1453
1454	return True;
1455	}
1456
1457	/**********************************************************************
1458	End enumeration of the LDAP password list.
1459	*********************************************************************/
1460
1461	static void ldapsam_endsampwent(struct pdb_methods *my_methods)
1462	{
1463	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1464	if (ldap_state->result) {
1465	ldap_msgfree(ldap_state->result);
1466	ldap_state->result = NULL;
1467	}
1468	}
1469
1470	static void append_attr(TALLOC_CTX mem_ctx, const char **attr_list,
1471	const char *new_attr)
1472	{
1473	int i;
1474
1475	if (new_attr == NULL) {
1476	return;
1477	}
1478
1479	for (i=0; (*attr_list)[i] != NULL; i++) {
1480	;
1481	}
1482
1483	(attr_list) = TALLOC_REALLOC_ARRAY(mem_ctx, (attr_list),
1484	const char *, i+2);
1485	SMB_ASSERT((*attr_list) != NULL);
1486	(attr_list)[i] = talloc_strdup((attr_list), new_attr);
1487	(*attr_list)[i+1] = NULL;
1488	}
1489
1490	/**********************************************************************
1491	Get struct samu entry from LDAP by username.
1492	*********************************************************************/
1493
1494	static NTSTATUS ldapsam_getsampwnam(struct pdb_methods my_methods, struct samu user, const char *sname)
1495	{
1496	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1497	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1498	LDAPMessage *result = NULL;
1499	LDAPMessage *entry = NULL;
1500	int count;
1501	const char ** attr_list;
1502	int rc;
1503
1504	attr_list = get_userattr_list( user, ldap_state->schema_ver );
1505	append_attr(user, &attr_list,
1506	get_userattr_key2string(ldap_state->schema_ver,
1507	LDAP_ATTR_MOD_TIMESTAMP));
1508	append_attr(user, &attr_list, "uidNumber");
1509	rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result,
1510	attr_list);
1511	TALLOC_FREE( attr_list );
1512
1513	if ( rc != LDAP_SUCCESS )
1514	return NT_STATUS_NO_SUCH_USER;
1515
1516	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1517
1518	if (count < 1) {
1519	DEBUG(4, ("ldapsam_getsampwnam: Unable to locate user [%s] count=%d\n", sname, count));
1520	ldap_msgfree(result);
1521	return NT_STATUS_NO_SUCH_USER;
1522	} else if (count > 1) {
1523	DEBUG(1, ("ldapsam_getsampwnam: Duplicate entries for this user [%s] Failing. count=%d\n", sname, count));
1524	ldap_msgfree(result);
1525	return NT_STATUS_NO_SUCH_USER;
1526	}
1527
1528	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1529	if (entry) {
1530	if (!init_sam_from_ldap(ldap_state, user, entry)) {
1531	DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname));
1532	ldap_msgfree(result);
1533	return NT_STATUS_NO_SUCH_USER;
1534	}
1535	pdb_set_backend_private_data(user, result, NULL,
1536	my_methods, PDB_CHANGED);
1537	talloc_autofree_ldapmsg(user, result);
1538	ret = NT_STATUS_OK;
1539	} else {
1540	ldap_msgfree(result);
1541	}
1542	return ret;
1543	}
1544
1545	static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state,
1546	const DOM_SID sid, LDAPMessage *result)
1547	{
1548	int rc = -1;
1549	const char ** attr_list;
1550	uint32 rid;
1551
1552	switch ( ldap_state->schema_ver ) {
1553	case SCHEMAVER_SAMBASAMACCOUNT: {
1554	TALLOC_CTX *tmp_ctx = talloc_new(NULL);
1555	if (tmp_ctx == NULL) {
1556	return LDAP_NO_MEMORY;
1557	}
1558
1559	attr_list = get_userattr_list(tmp_ctx,
1560	ldap_state->schema_ver);
1561	append_attr(tmp_ctx, &attr_list,
1562	get_userattr_key2string(
1563	ldap_state->schema_ver,
1564	LDAP_ATTR_MOD_TIMESTAMP));
1565	append_attr(tmp_ctx, &attr_list, "uidNumber");
1566	rc = ldapsam_search_suffix_by_sid(ldap_state, sid,
1567	result, attr_list);
1568	TALLOC_FREE(tmp_ctx);
1569
1570	if ( rc != LDAP_SUCCESS )
1571	return rc;
1572	break;
1573	}
1574
1575	case SCHEMAVER_SAMBAACCOUNT:
1576	if (!sid_peek_check_rid(&ldap_state->domain_sid, sid, &rid)) {
1577	return rc;
1578	}
1579
1580	attr_list = get_userattr_list(NULL,
1581	ldap_state->schema_ver);
1582	rc = ldapsam_search_suffix_by_rid(ldap_state, rid, result, attr_list );
1583	TALLOC_FREE( attr_list );
1584
1585	if ( rc != LDAP_SUCCESS )
1586	return rc;
1587	break;
1588	}
1589	return rc;
1590	}
1591
1592	/**********************************************************************
1593	Get struct samu entry from LDAP by SID.
1594	*********************************************************************/
1595
1596	static NTSTATUS ldapsam_getsampwsid(struct pdb_methods my_methods, struct samu user, const DOM_SID *sid)
1597	{
1598	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1599	LDAPMessage *result = NULL;
1600	LDAPMessage *entry = NULL;
1601	int count;
1602	int rc;
1603
1604	rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1605	sid, &result);
1606	if (rc != LDAP_SUCCESS)
1607	return NT_STATUS_NO_SUCH_USER;
1608
1609	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1610
1611	if (count < 1) {
1612	DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] "
1613	"count=%d\n", sid_string_dbg(sid), count));
1614	ldap_msgfree(result);
1615	return NT_STATUS_NO_SUCH_USER;
1616	} else if (count > 1) {
1617	DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID "
1618	"[%s]. Failing. count=%d\n", sid_string_dbg(sid),
1619	count));
1620	ldap_msgfree(result);
1621	return NT_STATUS_NO_SUCH_USER;
1622	}
1623
1624	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1625	if (!entry) {
1626	ldap_msgfree(result);
1627	return NT_STATUS_NO_SUCH_USER;
1628	}
1629
1630	if (!init_sam_from_ldap(ldap_state, user, entry)) {
1631	DEBUG(1,("ldapsam_getsampwsid: init_sam_from_ldap failed!\n"));
1632	ldap_msgfree(result);
1633	return NT_STATUS_NO_SUCH_USER;
1634	}
1635
1636	pdb_set_backend_private_data(user, result, NULL,
1637	my_methods, PDB_CHANGED);
1638	talloc_autofree_ldapmsg(user, result);
1639	return NT_STATUS_OK;
1640	}
1641
1642	/********************************************************************
1643	Do the actual modification - also change a plaintext passord if
1644	it it set.
1645	**********************************************************************/
1646
1647	static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods,
1648	struct samu newpwd, char dn,
1649	LDAPMod **mods, int ldap_op,
1650	bool (need_update)(const struct samu , enum pdb_elements))
1651	{
1652	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1653	int rc;
1654
1655	if (!newpwd \|\| !dn) {
1656	return NT_STATUS_INVALID_PARAMETER;
1657	}
1658
1659	if (!mods) {
1660	DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
1661	/* may be password change below however */
1662	} else {
1663	switch(ldap_op) {
1664	case LDAP_MOD_ADD:
1665	if (ldap_state->is_nds_ldap) {
1666	smbldap_set_mod(&mods, LDAP_MOD_ADD,
1667	"objectclass",
1668	"inetOrgPerson");
1669	} else {
1670	smbldap_set_mod(&mods, LDAP_MOD_ADD,
1671	"objectclass",
1672	LDAP_OBJ_ACCOUNT);
1673	}
1674	rc = smbldap_add(ldap_state->smbldap_state,
1675	dn, mods);
1676	break;
1677	case LDAP_MOD_REPLACE:
1678	rc = smbldap_modify(ldap_state->smbldap_state,
1679	dn ,mods);
1680	break;
1681	default:
1682	DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n",
1683	ldap_op));
1684	return NT_STATUS_INVALID_PARAMETER;
1685	}
1686
1687	if (rc!=LDAP_SUCCESS) {
1688	return NT_STATUS_UNSUCCESSFUL;
1689	}
1690	}
1691
1692	if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST)) &&
1693	(lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) &&
1694	need_update(newpwd, PDB_PLAINTEXT_PW) &&
1695	(pdb_get_plaintext_passwd(newpwd)!=NULL)) {
1696	BerElement *ber;
1697	struct berval *bv;
1698	char *retoid = NULL;
1699	struct berval *retdata = NULL;
1700	char *utf8_password;
1701	char *utf8_dn;
1702	size_t converted_size;
1703	int ret;
1704
1705	if (!ldap_state->is_nds_ldap) {
1706
1707	if (!smbldap_has_extension(ldap_state->smbldap_state->ldap_struct,
1708	LDAP_EXOP_MODIFY_PASSWD)) {
1709	DEBUG(2, ("ldap password change requested, but LDAP "
1710	"server does not support it -- ignoring\n"));
1711	return NT_STATUS_OK;
1712	}
1713	}
1714
1715	if (!push_utf8_allocate(&utf8_password,
1716	pdb_get_plaintext_passwd(newpwd),
1717	&converted_size))
1718	{
1719	return NT_STATUS_NO_MEMORY;
1720	}
1721
1722	if (!push_utf8_allocate(&utf8_dn, dn, &converted_size)) {
1723	SAFE_FREE(utf8_password);
1724	return NT_STATUS_NO_MEMORY;
1725	}
1726
1727	if ((ber = ber_alloc_t(LBER_USE_DER))==NULL) {
1728	DEBUG(0,("ber_alloc_t returns NULL\n"));
1729	SAFE_FREE(utf8_password);
1730	SAFE_FREE(utf8_dn);
1731	return NT_STATUS_UNSUCCESSFUL;
1732	}
1733
1734	if ((ber_printf (ber, "{") < 0) \|\|
1735	(ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID,
1736	utf8_dn) < 0)) {
1737	DEBUG(0,("ldapsam_modify_entry: ber_printf returns a "
1738	"value <0\n"));
1739	ber_free(ber,1);
1740	SAFE_FREE(utf8_dn);
1741	SAFE_FREE(utf8_password);
1742	return NT_STATUS_UNSUCCESSFUL;
1743	}
1744
1745	if ((utf8_password != NULL) && (*utf8_password != '\0')) {
1746	ret = ber_printf(ber, "ts}",
1747	LDAP_TAG_EXOP_MODIFY_PASSWD_NEW,
1748	utf8_password);
1749	} else {
1750	ret = ber_printf(ber, "}");
1751	}
1752
1753	if (ret < 0) {
1754	DEBUG(0,("ldapsam_modify_entry: ber_printf returns a "
1755	"value <0\n"));
1756	ber_free(ber,1);
1757	SAFE_FREE(utf8_dn);
1758	SAFE_FREE(utf8_password);
1759	return NT_STATUS_UNSUCCESSFUL;
1760	}
1761
1762	if ((rc = ber_flatten (ber, &bv))<0) {
1763	DEBUG(0,("ldapsam_modify_entry: ber_flatten returns a value <0\n"));
1764	ber_free(ber,1);
1765	SAFE_FREE(utf8_dn);
1766	SAFE_FREE(utf8_password);
1767	return NT_STATUS_UNSUCCESSFUL;
1768	}
1769
1770	SAFE_FREE(utf8_dn);
1771	SAFE_FREE(utf8_password);
1772	ber_free(ber, 1);
1773
1774	if (!ldap_state->is_nds_ldap) {
1775	rc = smbldap_extended_operation(ldap_state->smbldap_state,
1776	LDAP_EXOP_MODIFY_PASSWD,
1777	bv, NULL, NULL, &retoid,
1778	&retdata);
1779	} else {
1780	rc = pdb_nds_set_password(ldap_state->smbldap_state, dn,
1781	pdb_get_plaintext_passwd(newpwd));
1782	}
1783	if (rc != LDAP_SUCCESS) {
1784	char *ld_error = NULL;
1785
1786	if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
1787	DEBUG(3, ("Could not set userPassword "
1788	"attribute due to an objectClass "
1789	"violation -- ignoring\n"));
1790	ber_bvfree(bv);
1791	return NT_STATUS_OK;
1792	}
1793
1794	ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1795	&ld_error);
1796	DEBUG(0,("ldapsam_modify_entry: LDAP Password could not be changed for user %s: %s\n\t%s\n",
1797	pdb_get_username(newpwd), ldap_err2string(rc), ld_error?ld_error:"unknown"));
1798	SAFE_FREE(ld_error);
1799	ber_bvfree(bv);
1800	#if defined(LDAP_CONSTRAINT_VIOLATION)
1801	if (rc == LDAP_CONSTRAINT_VIOLATION)
1802	return NT_STATUS_PASSWORD_RESTRICTION;
1803	#endif
1804	return NT_STATUS_UNSUCCESSFUL;
1805	} else {
1806	DEBUG(3,("ldapsam_modify_entry: LDAP Password changed for user %s\n",pdb_get_username(newpwd)));
1807	#ifdef DEBUG_PASSWORD
1808	DEBUG(100,("ldapsam_modify_entry: LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd)));
1809	#endif
1810	if (retdata)
1811	ber_bvfree(retdata);
1812	if (retoid)
1813	ldap_memfree(retoid);
1814	}
1815	ber_bvfree(bv);
1816	}
1817	return NT_STATUS_OK;
1818	}
1819
1820	/**********************************************************************
1821	Delete entry from LDAP for username.
1822	*********************************************************************/
1823
1824	static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods,
1825	struct samu * sam_acct)
1826	{
1827	struct ldapsam_privates *priv =
1828	(struct ldapsam_privates *)my_methods->private_data;
1829	const char *sname;
1830	int rc;
1831	LDAPMessage msg, entry;
1832	NTSTATUS result = NT_STATUS_NO_MEMORY;
1833	const char **attr_list;
1834	TALLOC_CTX *mem_ctx;
1835
1836	if (!sam_acct) {
1837	DEBUG(0, ("ldapsam_delete_sam_account: sam_acct was NULL!\n"));
1838	return NT_STATUS_INVALID_PARAMETER;
1839	}
1840
1841	sname = pdb_get_username(sam_acct);
1842
1843	DEBUG(3, ("ldapsam_delete_sam_account: Deleting user %s from "
1844	"LDAP.\n", sname));
1845
1846	mem_ctx = talloc_new(NULL);
1847	if (mem_ctx == NULL) {
1848	DEBUG(0, ("talloc_new failed\n"));
1849	goto done;
1850	}
1851
1852	attr_list = get_userattr_delete_list(mem_ctx, priv->schema_ver );
1853	if (attr_list == NULL) {
1854	goto done;
1855	}
1856
1857	rc = ldapsam_search_suffix_by_name(priv, sname, &msg, attr_list);
1858
1859	if ((rc != LDAP_SUCCESS) \|\|
1860	(ldap_count_entries(priv2ld(priv), msg) != 1) \|\|
1861	((entry = ldap_first_entry(priv2ld(priv), msg)) == NULL)) {
1862	DEBUG(5, ("Could not find user %s\n", sname));
1863	result = NT_STATUS_NO_SUCH_USER;
1864	goto done;
1865	}
1866
1867	rc = ldapsam_delete_entry(
1868	priv, mem_ctx, entry,
1869	priv->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ?
1870	LDAP_OBJ_SAMBASAMACCOUNT : LDAP_OBJ_SAMBAACCOUNT,
1871	attr_list);
1872
1873	result = (rc == LDAP_SUCCESS) ?
1874	NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
1875
1876	done:
1877	TALLOC_FREE(mem_ctx);
1878	return result;
1879	}
1880
1881	/**********************************************************************
1882	Helper function to determine for update_sam_account whether
1883	we need LDAP modification.
1884	*********************************************************************/
1885
1886	static bool element_is_changed(const struct samu *sampass,
1887	enum pdb_elements element)
1888	{
1889	return IS_SAM_CHANGED(sampass, element);
1890	}
1891
1892	/**********************************************************************
1893	Update struct samu.
1894	*********************************************************************/
1895
1896	static NTSTATUS ldapsam_update_sam_account(struct pdb_methods my_methods, struct samu newpwd)
1897	{
1898	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1899	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1900	int rc = 0;
1901	char *dn;
1902	LDAPMessage *result = NULL;
1903	LDAPMessage *entry = NULL;
1904	LDAPMod **mods = NULL;
1905	const char **attr_list;
1906
1907	result = (LDAPMessage *)pdb_get_backend_private_data(newpwd, my_methods);
1908	if (!result) {
1909	attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
1910	if (pdb_get_username(newpwd) == NULL) {
1911	return NT_STATUS_INVALID_PARAMETER;
1912	}
1913	rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list );
1914	TALLOC_FREE( attr_list );
1915	if (rc != LDAP_SUCCESS) {
1916	return NT_STATUS_UNSUCCESSFUL;
1917	}
1918	pdb_set_backend_private_data(newpwd, result, NULL,
1919	my_methods, PDB_CHANGED);
1920	talloc_autofree_ldapmsg(newpwd, result);
1921	}
1922
1923	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
1924	DEBUG(0, ("ldapsam_update_sam_account: No user to modify!\n"));
1925	return NT_STATUS_UNSUCCESSFUL;
1926	}
1927
1928	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1929	dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
1930	if (!dn) {
1931	return NT_STATUS_UNSUCCESSFUL;
1932	}
1933
1934	DEBUG(4, ("ldapsam_update_sam_account: user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn));
1935
1936	if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
1937	element_is_changed)) {
1938	DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
1939	SAFE_FREE(dn);
1940	if (mods != NULL)
1941	ldap_mods_free(mods,True);
1942	return NT_STATUS_UNSUCCESSFUL;
1943	}
1944
1945	if ((lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_ONLY)
1946	&& (mods == NULL)) {
1947	DEBUG(4,("ldapsam_update_sam_account: mods is empty: nothing to update for user: %s\n",
1948	pdb_get_username(newpwd)));
1949	SAFE_FREE(dn);
1950	return NT_STATUS_OK;
1951	}
1952
1953	ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed);
1954
1955	if (mods != NULL) {
1956	ldap_mods_free(mods,True);
1957	}
1958
1959	SAFE_FREE(dn);
1960
1961	/*
1962	* We need to set the backend private data to NULL here. For example
1963	* setuserinfo level 25 does a pdb_update_sam_account twice on the
1964	* same one, and with the explicit delete / add logic for attribute
1965	* values the second time we would use the wrong "old" value which
1966	* does not exist in LDAP anymore. Thus the LDAP server would refuse
1967	* the update.
1968	* The existing LDAPMessage is still being auto-freed by the
1969	* destructor.
1970	*/
1971	pdb_set_backend_private_data(newpwd, NULL, NULL, my_methods,
1972	PDB_CHANGED);
1973
1974	if (!NT_STATUS_IS_OK(ret)) {
1975	return ret;
1976	}
1977
1978	DEBUG(2, ("ldapsam_update_sam_account: successfully modified uid = %s in the LDAP database\n",
1979	pdb_get_username(newpwd)));
1980	return NT_STATUS_OK;
1981	}
1982
1983	/***************************************************************************
1984	Renames a struct samu
1985	- The "rename user script" has full responsibility for changing everything
1986	***************************************************************************/
1987
1988	static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
1989	struct samu *old_acct,
1990	const char *newname)
1991	{
1992	const char *oldname;
1993	int rc;
1994	char *rename_script = NULL;
1995	fstring oldname_lower, newname_lower;
1996
1997	if (!old_acct) {
1998	DEBUG(0, ("ldapsam_rename_sam_account: old_acct was NULL!\n"));
1999	return NT_STATUS_INVALID_PARAMETER;
2000	}
2001	if (!newname) {
2002	DEBUG(0, ("ldapsam_rename_sam_account: newname was NULL!\n"));
2003	return NT_STATUS_INVALID_PARAMETER;
2004	}
2005
2006	oldname = pdb_get_username(old_acct);
2007
2008	/* rename the posix user */
2009	rename_script = SMB_STRDUP(lp_renameuser_script());
2010	if (rename_script == NULL) {
2011	return NT_STATUS_NO_MEMORY;
2012	}
2013
2014	if (!(*rename_script)) {
2015	SAFE_FREE(rename_script);
2016	return NT_STATUS_ACCESS_DENIED;
2017	}
2018
2019	DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n",
2020	oldname, newname));
2021
2022	/* We have to allow the account name to end with a '$'.
2023	Also, follow the semantics in _samr_create_user() and lower case the
2024	posix name but preserve the case in passdb */
2025
2026	fstrcpy( oldname_lower, oldname );
2027	strlower_m( oldname_lower );
2028	fstrcpy( newname_lower, newname );
2029	strlower_m( newname_lower );
2030	rename_script = realloc_string_sub2(rename_script,
2031	"%unew",
2032	newname_lower,
2033	true,
2034	true);
2035	if (!rename_script) {
2036	return NT_STATUS_NO_MEMORY;
2037	}
2038	rename_script = realloc_string_sub2(rename_script,
2039	"%uold",
2040	oldname_lower,
2041	true,
2042	true);
2043	rc = smbrun(rename_script, NULL);
2044
2045	DEBUG(rc ? 0 : 3,("Running the command `%s' gave %d\n",
2046	rename_script, rc));
2047
2048	SAFE_FREE(rename_script);
2049
2050	if (rc == 0) {
2051	smb_nscd_flush_user_cache();
2052	}
2053
2054	if (rc)
2055	return NT_STATUS_UNSUCCESSFUL;
2056
2057	return NT_STATUS_OK;
2058	}
2059
2060	/**********************************************************************
2061	Helper function to determine for update_sam_account whether
2062	we need LDAP modification.
2063	*********************************************************************/
2064
2065	static bool element_is_set_or_changed(const struct samu *sampass,
2066	enum pdb_elements element)
2067	{
2068	return (IS_SAM_SET(sampass, element) \|\|
2069	IS_SAM_CHANGED(sampass, element));
2070	}
2071
2072	/**********************************************************************
2073	Add struct samu to LDAP.
2074	*********************************************************************/
2075
2076	static NTSTATUS ldapsam_add_sam_account(struct pdb_methods my_methods, struct samu newpwd)
2077	{
2078	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2079	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
2080	int rc;
2081	LDAPMessage *result = NULL;
2082	LDAPMessage *entry = NULL;
2083	LDAPMod **mods = NULL;
2084	int ldap_op = LDAP_MOD_REPLACE;
2085	uint32 num_result;
2086	const char **attr_list;
2087	char *escape_user = NULL;
2088	const char *username = pdb_get_username(newpwd);
2089	const DOM_SID *sid = pdb_get_user_sid(newpwd);
2090	char *filter = NULL;
2091	char *dn = NULL;
2092	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
2093	TALLOC_CTX *ctx = talloc_init("ldapsam_add_sam_account");
2094
2095	if (!ctx) {
2096	return NT_STATUS_NO_MEMORY;
2097	}
2098
2099	if (!username \|\| !*username) {
2100	DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
2101	status = NT_STATUS_INVALID_PARAMETER;
2102	goto fn_exit;
2103	}
2104
2105	/* free this list after the second search or in case we exit on failure */
2106	attr_list = get_userattr_list(ctx, ldap_state->schema_ver);
2107
2108	rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
2109
2110	if (rc != LDAP_SUCCESS) {
2111	goto fn_exit;
2112	}
2113
2114	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
2115	DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
2116	username));
2117	goto fn_exit;
2118	}
2119	ldap_msgfree(result);
2120	result = NULL;
2121
2122	if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
2123	rc = ldapsam_get_ldap_user_by_sid(ldap_state,
2124	sid, &result);
2125	if (rc == LDAP_SUCCESS) {
2126	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
2127	DEBUG(0,("ldapsam_add_sam_account: SID '%s' "
2128	"already in the base, with samba "
2129	"attributes\n", sid_string_dbg(sid)));
2130	goto fn_exit;
2131	}
2132	ldap_msgfree(result);
2133	result = NULL;
2134	}
2135	}
2136
2137	/* does the entry already exist but without a samba attributes?
2138	we need to return the samba attributes here */
2139
2140	escape_user = escape_ldap_string_alloc( username );
2141	filter = talloc_strdup(attr_list, "(uid=%u)");
2142	if (!filter) {
2143	status = NT_STATUS_NO_MEMORY;
2144	goto fn_exit;
2145	}
2146	filter = talloc_all_string_sub(attr_list, filter, "%u", escape_user);
2147	if (!filter) {
2148	status = NT_STATUS_NO_MEMORY;
2149	goto fn_exit;
2150	}
2151	SAFE_FREE(escape_user);
2152
2153	rc = smbldap_search_suffix(ldap_state->smbldap_state,
2154	filter, attr_list, &result);
2155	if ( rc != LDAP_SUCCESS ) {
2156	goto fn_exit;
2157	}
2158
2159	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2160
2161	if (num_result > 1) {
2162	DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
2163	goto fn_exit;
2164	}
2165
2166	/* Check if we need to update an existing entry */
2167	if (num_result == 1) {
2168	char *tmp;
2169
2170	DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
2171	ldap_op = LDAP_MOD_REPLACE;
2172	entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
2173	tmp = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
2174	if (!tmp) {
2175	goto fn_exit;
2176	}
2177	dn = talloc_asprintf(ctx, "%s", tmp);
2178	SAFE_FREE(tmp);
2179	if (!dn) {
2180	status = NT_STATUS_NO_MEMORY;
2181	goto fn_exit;
2182	}
2183
2184	} else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
2185
2186	/* There might be a SID for this account already - say an idmap entry */
2187
2188	filter = talloc_asprintf(ctx,
2189	"(&(%s=%s)(\|(objectClass=%s)(objectClass=%s)))",
2190	get_userattr_key2string(ldap_state->schema_ver,
2191	LDAP_ATTR_USER_SID),
2192	sid_string_talloc(ctx, sid),
2193	LDAP_OBJ_IDMAP_ENTRY,
2194	LDAP_OBJ_SID_ENTRY);
2195	if (!filter) {
2196	status = NT_STATUS_NO_MEMORY;
2197	goto fn_exit;
2198	}
2199
2200	/* free old result before doing a new search */
2201	if (result != NULL) {
2202	ldap_msgfree(result);
2203	result = NULL;
2204	}
2205	rc = smbldap_search_suffix(ldap_state->smbldap_state,
2206	filter, attr_list, &result);
2207
2208	if ( rc != LDAP_SUCCESS ) {
2209	goto fn_exit;
2210	}
2211
2212	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2213
2214	if (num_result > 1) {
2215	DEBUG (0, ("ldapsam_add_sam_account: More than one user with specified Sid exists: bailing out!\n"));
2216	goto fn_exit;
2217	}
2218
2219	/* Check if we need to update an existing entry */
2220	if (num_result == 1) {
2221	char *tmp;
2222
2223	DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
2224	ldap_op = LDAP_MOD_REPLACE;
2225	entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
2226	tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
2227	if (!tmp) {
2228	goto fn_exit;
2229	}
2230	dn = talloc_asprintf(ctx, "%s", tmp);
2231	SAFE_FREE(tmp);
2232	if (!dn) {
2233	status = NT_STATUS_NO_MEMORY;
2234	goto fn_exit;
2235	}
2236	}
2237	}
2238
2239	if (num_result == 0) {
2240	char *escape_username;
2241	/* Check if we need to add an entry */
2242	DEBUG(3,("ldapsam_add_sam_account: Adding new user\n"));
2243	ldap_op = LDAP_MOD_ADD;
2244
2245	escape_username = escape_rdn_val_string_alloc(username);
2246	if (!escape_username) {
2247	status = NT_STATUS_NO_MEMORY;
2248	goto fn_exit;
2249	}
2250
2251	if (username[strlen(username)-1] == '$') {
2252	dn = talloc_asprintf(ctx,
2253	"uid=%s,%s",
2254	escape_username,
2255	lp_ldap_machine_suffix());
2256	} else {
2257	dn = talloc_asprintf(ctx,
2258	"uid=%s,%s",
2259	escape_username,
2260	lp_ldap_user_suffix());
2261	}
2262
2263	SAFE_FREE(escape_username);
2264	if (!dn) {
2265	status = NT_STATUS_NO_MEMORY;
2266	goto fn_exit;
2267	}
2268	}
2269
2270	if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
2271	element_is_set_or_changed)) {
2272	DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
2273	if (mods != NULL) {
2274	ldap_mods_free(mods, true);
2275	}
2276	goto fn_exit;
2277	}
2278
2279	if (mods == NULL) {
2280	DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
2281	goto fn_exit;
2282	}
2283	switch ( ldap_state->schema_ver ) {
2284	case SCHEMAVER_SAMBAACCOUNT:
2285	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT);
2286	break;
2287	case SCHEMAVER_SAMBASAMACCOUNT:
2288	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT);
2289	break;
2290	default:
2291	DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n"));
2292	break;
2293	}
2294
2295	ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed);
2296	if (!NT_STATUS_IS_OK(ret)) {
2297	DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
2298	pdb_get_username(newpwd),dn));
2299	ldap_mods_free(mods, true);
2300	goto fn_exit;
2301	}
2302
2303	DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
2304	ldap_mods_free(mods, true);
2305
2306	status = NT_STATUS_OK;
2307
2308	fn_exit:
2309
2310	TALLOC_FREE(ctx);
2311	SAFE_FREE(escape_user);
2312	if (result) {
2313	ldap_msgfree(result);
2314	}
2315	return status;
2316	}
2317
2318	/**********************************************************************
2319	*********************************************************************/
2320
2321	static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
2322	const char *filter,
2323	LDAPMessage ** result)
2324	{
2325	int scope = LDAP_SCOPE_SUBTREE;
2326	int rc;
2327	const char **attr_list;
2328
2329	attr_list = get_attr_list(NULL, groupmap_attr_list);
2330	rc = smbldap_search(ldap_state->smbldap_state,
2331	lp_ldap_group_suffix (), scope,
2332	filter, attr_list, 0, result);
2333	TALLOC_FREE(attr_list);
2334
2335	return rc;
2336	}
2337
2338	/**********************************************************************
2339	*********************************************************************/
2340
2341	static bool init_group_from_ldap(struct ldapsam_privates *ldap_state,
2342	GROUP_MAP map, LDAPMessage entry)
2343	{
2344	char *temp = NULL;
2345	TALLOC_CTX *ctx = talloc_init("init_group_from_ldap");
2346
2347	if (ldap_state == NULL \|\| map == NULL \|\| entry == NULL \|\|
2348	ldap_state->smbldap_state->ldap_struct == NULL) {
2349	DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
2350	TALLOC_FREE(ctx);
2351	return false;
2352	}
2353
2354	temp = smbldap_talloc_single_attribute(
2355	ldap_state->smbldap_state->ldap_struct,
2356	entry,
2357	get_attr_key2string(groupmap_attr_list,
2358	LDAP_ATTR_GIDNUMBER),
2359	ctx);
2360	if (!temp) {
2361	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2362	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
2363	TALLOC_FREE(ctx);
2364	return false;
2365	}
2366	DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
2367
2368	map->gid = (gid_t)atol(temp);
2369
2370	TALLOC_FREE(temp);
2371	temp = smbldap_talloc_single_attribute(
2372	ldap_state->smbldap_state->ldap_struct,
2373	entry,
2374	get_attr_key2string(groupmap_attr_list,
2375	LDAP_ATTR_GROUP_SID),
2376	ctx);
2377	if (!temp) {
2378	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2379	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
2380	TALLOC_FREE(ctx);
2381	return false;
2382	}
2383
2384	if (!string_to_sid(&map->sid, temp)) {
2385	DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
2386	TALLOC_FREE(ctx);
2387	return false;
2388	}
2389
2390	TALLOC_FREE(temp);
2391	temp = smbldap_talloc_single_attribute(
2392	ldap_state->smbldap_state->ldap_struct,
2393	entry,
2394	get_attr_key2string(groupmap_attr_list,
2395	LDAP_ATTR_GROUP_TYPE),
2396	ctx);
2397	if (!temp) {
2398	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2399	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
2400	TALLOC_FREE(ctx);
2401	return false;
2402	}
2403	map->sid_name_use = (enum lsa_SidType)atol(temp);
2404
2405	if ((map->sid_name_use < SID_NAME_USER) \|\|
2406	(map->sid_name_use > SID_NAME_UNKNOWN)) {
2407	DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
2408	TALLOC_FREE(ctx);
2409	return false;
2410	}
2411
2412	TALLOC_FREE(temp);
2413	temp = smbldap_talloc_single_attribute(
2414	ldap_state->smbldap_state->ldap_struct,
2415	entry,
2416	get_attr_key2string(groupmap_attr_list,
2417	LDAP_ATTR_DISPLAY_NAME),
2418	ctx);
2419	if (!temp) {
2420	temp = smbldap_talloc_single_attribute(
2421	ldap_state->smbldap_state->ldap_struct,
2422	entry,
2423	get_attr_key2string(groupmap_attr_list,
2424	LDAP_ATTR_CN),
2425	ctx);
2426	if (!temp) {
2427	DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
2428	for gidNumber(%lu)\n",(unsigned long)map->gid));
2429	TALLOC_FREE(ctx);
2430	return false;
2431	}
2432	}
2433	fstrcpy(map->nt_name, temp);
2434
2435	TALLOC_FREE(temp);
2436	temp = smbldap_talloc_single_attribute(
2437	ldap_state->smbldap_state->ldap_struct,
2438	entry,
2439	get_attr_key2string(groupmap_attr_list,
2440	LDAP_ATTR_DESC),
2441	ctx);
2442	if (!temp) {
2443	temp = talloc_strdup(ctx, "");
2444	if (!temp) {
2445	TALLOC_FREE(ctx);
2446	return false;
2447	}
2448	}
2449	fstrcpy(map->comment, temp);
2450
2451	if (lp_parm_bool(-1, "ldapsam", "trusted", false)) {
2452	store_gid_sid_cache(&map->sid, map->gid);
2453	}
2454
2455	TALLOC_FREE(ctx);
2456	return true;
2457	}
2458
2459	/**********************************************************************
2460	*********************************************************************/
2461
2462	static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods,
2463	const char *filter,
2464	GROUP_MAP *map)
2465	{
2466	struct ldapsam_privates *ldap_state =
2467	(struct ldapsam_privates *)methods->private_data;
2468	LDAPMessage *result = NULL;
2469	LDAPMessage *entry = NULL;
2470	int count;
2471
2472	if (ldapsam_search_one_group(ldap_state, filter, &result)
2473	!= LDAP_SUCCESS) {
2474	return NT_STATUS_NO_SUCH_GROUP;
2475	}
2476
2477	count = ldap_count_entries(priv2ld(ldap_state), result);
2478
2479	if (count < 1) {
2480	DEBUG(4, ("ldapsam_getgroup: Did not find group, filter was "
2481	"%s\n", filter));
2482	ldap_msgfree(result);
2483	return NT_STATUS_NO_SUCH_GROUP;
2484	}
2485
2486	if (count > 1) {
2487	DEBUG(1, ("ldapsam_getgroup: Duplicate entries for filter %s: "
2488	"count=%d\n", filter, count));
2489	ldap_msgfree(result);
2490	return NT_STATUS_NO_SUCH_GROUP;
2491	}
2492
2493	entry = ldap_first_entry(priv2ld(ldap_state), result);
2494
2495	if (!entry) {
2496	ldap_msgfree(result);
2497	return NT_STATUS_UNSUCCESSFUL;
2498	}
2499
2500	if (!init_group_from_ldap(ldap_state, map, entry)) {
2501	DEBUG(1, ("ldapsam_getgroup: init_group_from_ldap failed for "
2502	"group filter %s\n", filter));
2503	ldap_msgfree(result);
2504	return NT_STATUS_NO_SUCH_GROUP;
2505	}
2506
2507	ldap_msgfree(result);
2508	return NT_STATUS_OK;
2509	}
2510
2511	/**********************************************************************
2512	*********************************************************************/
2513
2514	static NTSTATUS ldapsam_getgrsid(struct pdb_methods methods, GROUP_MAP map,
2515	DOM_SID sid)
2516	{
2517	char *filter = NULL;
2518	NTSTATUS status;
2519	fstring tmp;
2520
2521	if (asprintf(&filter, "(&(objectClass=%s)(%s=%s))",
2522	LDAP_OBJ_GROUPMAP,
2523	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
2524	sid_to_fstring(tmp, &sid)) < 0) {
2525	return NT_STATUS_NO_MEMORY;
2526	}
2527
2528	status = ldapsam_getgroup(methods, filter, map);
2529	SAFE_FREE(filter);
2530	return status;
2531	}
2532
2533	/**********************************************************************
2534	*********************************************************************/
2535
2536	static NTSTATUS ldapsam_getgrgid(struct pdb_methods methods, GROUP_MAP map,
2537	gid_t gid)
2538	{
2539	char *filter = NULL;
2540	NTSTATUS status;
2541
2542	if (asprintf(&filter, "(&(objectClass=%s)(%s=%lu))",
2543	LDAP_OBJ_GROUPMAP,
2544	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2545	(unsigned long)gid) < 0) {
2546	return NT_STATUS_NO_MEMORY;
2547	}
2548
2549	status = ldapsam_getgroup(methods, filter, map);
2550	SAFE_FREE(filter);
2551	return status;
2552	}
2553
2554	/**********************************************************************
2555	*********************************************************************/
2556
2557	static NTSTATUS ldapsam_getgrnam(struct pdb_methods methods, GROUP_MAP map,
2558	const char *name)
2559	{
2560	char *filter = NULL;
2561	char *escape_name = escape_ldap_string_alloc(name);
2562	NTSTATUS status;
2563
2564	if (!escape_name) {
2565	return NT_STATUS_NO_MEMORY;
2566	}
2567
2568	if (asprintf(&filter, "(&(objectClass=%s)(\|(%s=%s)(%s=%s)))",
2569	LDAP_OBJ_GROUPMAP,
2570	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
2571	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN),
2572	escape_name) < 0) {
2573	SAFE_FREE(escape_name);
2574	return NT_STATUS_NO_MEMORY;
2575	}
2576
2577	SAFE_FREE(escape_name);
2578	status = ldapsam_getgroup(methods, filter, map);
2579	SAFE_FREE(filter);
2580	return status;
2581	}
2582
2583	static bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
2584	LDAPMessage *entry,
2585	const DOM_SID *domain_sid,
2586	uint32 *rid)
2587	{
2588	fstring str;
2589	DOM_SID sid;
2590
2591	if (!smbldap_get_single_attribute(ldap_struct, entry, "sambaSID",
2592	str, sizeof(str)-1)) {
2593	DEBUG(10, ("Could not find sambaSID attribute\n"));
2594	return False;
2595	}
2596
2597	if (!string_to_sid(&sid, str)) {
2598	DEBUG(10, ("Could not convert string %s to sid\n", str));
2599	return False;
2600	}
2601
2602	if (sid_compare_domain(&sid, domain_sid) != 0) {
2603	DEBUG(10, ("SID %s is not in expected domain %s\n",
2604	str, sid_string_dbg(domain_sid)));
2605	return False;
2606	}
2607
2608	if (!sid_peek_rid(&sid, rid)) {
2609	DEBUG(10, ("Could not peek into RID\n"));
2610	return False;
2611	}
2612
2613	return True;
2614	}
2615
2616	static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
2617	TALLOC_CTX *mem_ctx,
2618	const DOM_SID *group,
2619	uint32 **pp_member_rids,
2620	size_t *p_num_members)
2621	{
2622	struct ldapsam_privates *ldap_state =
2623	(struct ldapsam_privates *)methods->private_data;
2624	struct smbldap_state *conn = ldap_state->smbldap_state;
2625	const char *id_attrs[] = { "memberUid", "gidNumber", NULL };
2626	const char *sid_attrs[] = { "sambaSID", NULL };
2627	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2628	LDAPMessage *result = NULL;
2629	LDAPMessage *entry;
2630	char *filter;
2631	char **values = NULL;
2632	char **memberuid;
2633	char *gidstr;
2634	int rc, count;
2635
2636	*pp_member_rids = NULL;
2637	*p_num_members = 0;
2638
2639	filter = talloc_asprintf(mem_ctx,
2640	"(&(objectClass=%s)"
2641	"(objectClass=%s)"
2642	"(sambaSID=%s))",
2643	LDAP_OBJ_POSIXGROUP,
2644	LDAP_OBJ_GROUPMAP,
2645	sid_string_talloc(mem_ctx, group));
2646	if (filter == NULL) {
2647	ret = NT_STATUS_NO_MEMORY;
2648	goto done;
2649	}
2650
2651	rc = smbldap_search(conn, lp_ldap_group_suffix(),
2652	LDAP_SCOPE_SUBTREE, filter, id_attrs, 0,
2653	&result);
2654
2655	if (rc != LDAP_SUCCESS)
2656	goto done;
2657
2658	talloc_autofree_ldapmsg(mem_ctx, result);
2659
2660	count = ldap_count_entries(conn->ldap_struct, result);
2661
2662	if (count > 1) {
2663	DEBUG(1, ("Found more than one groupmap entry for %s\n",
2664	sid_string_dbg(group)));
2665	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2666	goto done;
2667	}
2668
2669	if (count == 0) {
2670	ret = NT_STATUS_NO_SUCH_GROUP;
2671	goto done;
2672	}
2673
2674	entry = ldap_first_entry(conn->ldap_struct, result);
2675	if (entry == NULL)
2676	goto done;
2677
2678	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", mem_ctx);
2679	if (!gidstr) {
2680	DEBUG (0, ("ldapsam_enum_group_members: Unable to find the group's gid!\n"));
2681	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2682	goto done;
2683	}
2684
2685	values = ldap_get_values(conn->ldap_struct, entry, "memberUid");
2686
2687	if (values) {
2688
2689	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(\|", LDAP_OBJ_SAMBASAMACCOUNT);
2690	if (filter == NULL) {
2691	ret = NT_STATUS_NO_MEMORY;
2692	goto done;
2693	}
2694
2695	for (memberuid = values; *memberuid != NULL; memberuid += 1) {
2696	char *escape_memberuid;
2697
2698	escape_memberuid = escape_ldap_string_alloc(*memberuid);
2699	if (escape_memberuid == NULL) {
2700	ret = NT_STATUS_NO_MEMORY;
2701	goto done;
2702	}
2703
2704	filter = talloc_asprintf_append_buffer(filter, "(uid=%s)", escape_memberuid);
2705	if (filter == NULL) {
2706	SAFE_FREE(escape_memberuid);
2707	ret = NT_STATUS_NO_MEMORY;
2708	goto done;
2709	}
2710
2711	SAFE_FREE(escape_memberuid);
2712	}
2713
2714	filter = talloc_asprintf_append_buffer(filter, "))");
2715	if (filter == NULL) {
2716	ret = NT_STATUS_NO_MEMORY;
2717	goto done;
2718	}
2719
2720	rc = smbldap_search(conn, lp_ldap_suffix(),
2721	LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
2722	&result);
2723
2724	if (rc != LDAP_SUCCESS)
2725	goto done;
2726
2727	count = ldap_count_entries(conn->ldap_struct, result);
2728	DEBUG(10,("ldapsam_enum_group_members: found %d accounts\n", count));
2729
2730	talloc_autofree_ldapmsg(mem_ctx, result);
2731
2732	for (entry = ldap_first_entry(conn->ldap_struct, result);
2733	entry != NULL;
2734	entry = ldap_next_entry(conn->ldap_struct, entry))
2735	{
2736	char *sidstr;
2737	DOM_SID sid;
2738	uint32 rid;
2739
2740	sidstr = smbldap_talloc_single_attribute(conn->ldap_struct,
2741	entry, "sambaSID",
2742	mem_ctx);
2743	if (!sidstr) {
2744	DEBUG(0, ("Severe DB error, %s can't miss the sambaSID"
2745	"attribute\n", LDAP_OBJ_SAMBASAMACCOUNT));
2746	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2747	goto done;
2748	}
2749
2750	if (!string_to_sid(&sid, sidstr))
2751	goto done;
2752
2753	if (!sid_check_is_in_our_domain(&sid)) {
2754	DEBUG(0, ("Inconsistent SAM -- group member uid not "
2755	"in our domain\n"));
2756	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2757	goto done;
2758	}
2759
2760	sid_peek_rid(&sid, &rid);
2761
2762	if (!add_rid_to_array_unique(mem_ctx, rid, pp_member_rids,
2763	p_num_members)) {
2764	ret = NT_STATUS_NO_MEMORY;
2765	goto done;
2766	}
2767	}
2768	}
2769
2770	filter = talloc_asprintf(mem_ctx,
2771	"(&(objectClass=%s)"
2772	"(gidNumber=%s))",
2773	LDAP_OBJ_SAMBASAMACCOUNT,
2774	gidstr);
2775
2776	rc = smbldap_search(conn, lp_ldap_suffix(),
2777	LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
2778	&result);
2779
2780	if (rc != LDAP_SUCCESS)
2781	goto done;
2782
2783	talloc_autofree_ldapmsg(mem_ctx, result);
2784
2785	for (entry = ldap_first_entry(conn->ldap_struct, result);
2786	entry != NULL;
2787	entry = ldap_next_entry(conn->ldap_struct, entry))
2788	{
2789	uint32 rid;
2790
2791	if (!ldapsam_extract_rid_from_entry(conn->ldap_struct,
2792	entry,
2793	get_global_sam_sid(),
2794	&rid)) {
2795	DEBUG(0, ("Severe DB error, %s can't miss the samba SID" "attribute\n", LDAP_OBJ_SAMBASAMACCOUNT));
2796	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2797	goto done;
2798	}
2799
2800	if (!add_rid_to_array_unique(mem_ctx, rid, pp_member_rids,
2801	p_num_members)) {
2802	ret = NT_STATUS_NO_MEMORY;
2803	goto done;
2804	}
2805	}
2806
2807	ret = NT_STATUS_OK;
2808
2809	done:
2810
2811	if (values)
2812	ldap_value_free(values);
2813
2814	return ret;
2815	}
2816
2817	static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
2818	TALLOC_CTX *mem_ctx,
2819	struct samu *user,
2820	DOM_SID **pp_sids,
2821	gid_t **pp_gids,
2822	size_t *p_num_groups)
2823	{
2824	struct ldapsam_privates *ldap_state =
2825	(struct ldapsam_privates *)methods->private_data;
2826	struct smbldap_state *conn = ldap_state->smbldap_state;
2827	char *filter;
2828	const char *attrs[] = { "gidNumber", "sambaSID", NULL };
2829	char *escape_name;
2830	int rc, count;
2831	LDAPMessage *result = NULL;
2832	LDAPMessage *entry;
2833	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2834	size_t num_sids, num_gids;
2835	char *gidstr;
2836	gid_t primary_gid = -1;
2837
2838	*pp_sids = NULL;
2839	num_sids = 0;
2840
2841	if (pdb_get_username(user) == NULL) {
2842	return NT_STATUS_INVALID_PARAMETER;
2843	}
2844
2845	escape_name = escape_ldap_string_alloc(pdb_get_username(user));
2846	if (escape_name == NULL)
2847	return NT_STATUS_NO_MEMORY;
2848
2849	/* retrieve the users primary gid */
2850	filter = talloc_asprintf(mem_ctx,
2851	"(&(objectClass=%s)(uid=%s))",
2852	LDAP_OBJ_SAMBASAMACCOUNT,
2853	escape_name);
2854	if (filter == NULL) {
2855	ret = NT_STATUS_NO_MEMORY;
2856	goto done;
2857	}
2858
2859	rc = smbldap_search(conn, lp_ldap_suffix(),
2860	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
2861
2862	if (rc != LDAP_SUCCESS)
2863	goto done;
2864
2865	talloc_autofree_ldapmsg(mem_ctx, result);
2866
2867	count = ldap_count_entries(priv2ld(ldap_state), result);
2868
2869	switch (count) {
2870	case 0:
2871	DEBUG(1, ("User account [%s] not found!\n", pdb_get_username(user)));
2872	ret = NT_STATUS_NO_SUCH_USER;
2873	goto done;
2874	case 1:
2875	entry = ldap_first_entry(priv2ld(ldap_state), result);
2876
2877	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", mem_ctx);
2878	if (!gidstr) {
2879	DEBUG (1, ("Unable to find the member's gid!\n"));
2880	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2881	goto done;
2882	}
2883	primary_gid = strtoul(gidstr, NULL, 10);
2884	break;
2885	default:
2886	DEBUG(1, ("found more than one account with the same user name ?!\n"));
2887	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2888	goto done;
2889	}
2890
2891	filter = talloc_asprintf(mem_ctx,
2892	"(&(objectClass=%s)(\|(memberUid=%s)(gidNumber=%d)))",
2893	LDAP_OBJ_POSIXGROUP, escape_name, primary_gid);
2894	if (filter == NULL) {
2895	ret = NT_STATUS_NO_MEMORY;
2896	goto done;
2897	}
2898
2899	rc = smbldap_search(conn, lp_ldap_group_suffix(),
2900	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
2901
2902	if (rc != LDAP_SUCCESS)
2903	goto done;
2904
2905	talloc_autofree_ldapmsg(mem_ctx, result);
2906
2907	num_gids = 0;
2908	*pp_gids = NULL;
2909
2910	num_sids = 0;
2911	*pp_sids = NULL;
2912
2913	/* We need to add the primary group as the first gid/sid */
2914
2915	if (!add_gid_to_array_unique(mem_ctx, primary_gid, pp_gids, &num_gids)) {
2916	ret = NT_STATUS_NO_MEMORY;
2917	goto done;
2918	}
2919
2920	/* This sid will be replaced later */
2921
2922	ret = add_sid_to_array_unique(mem_ctx, &global_sid_NULL, pp_sids,
2923	&num_sids);
2924	if (!NT_STATUS_IS_OK(ret)) {
2925	goto done;
2926	}
2927
2928	for (entry = ldap_first_entry(conn->ldap_struct, result);
2929	entry != NULL;
2930	entry = ldap_next_entry(conn->ldap_struct, entry))
2931	{
2932	fstring str;
2933	DOM_SID sid;
2934	gid_t gid;
2935	char *end;
2936
2937	if (!smbldap_get_single_attribute(conn->ldap_struct,
2938	entry, "sambaSID",
2939	str, sizeof(str)-1))
2940	continue;
2941
2942	if (!string_to_sid(&sid, str))
2943	goto done;
2944
2945	if (!smbldap_get_single_attribute(conn->ldap_struct,
2946	entry, "gidNumber",
2947	str, sizeof(str)-1))
2948	continue;
2949
2950	gid = strtoul(str, &end, 10);
2951
2952	if (PTR_DIFF(end, str) != strlen(str))
2953	goto done;
2954
2955	if (gid == primary_gid) {
2956	sid_copy(&(*pp_sids)[0], &sid);
2957	} else {
2958	if (!add_gid_to_array_unique(mem_ctx, gid, pp_gids,
2959	&num_gids)) {
2960	ret = NT_STATUS_NO_MEMORY;
2961	goto done;
2962	}
2963	ret = add_sid_to_array_unique(mem_ctx, &sid, pp_sids,
2964	&num_sids);
2965	if (!NT_STATUS_IS_OK(ret)) {
2966	goto done;
2967	}
2968	}
2969	}
2970
2971	if (sid_compare(&global_sid_NULL, &(*pp_sids)[0]) == 0) {
2972	DEBUG(3, ("primary group of [%s] not found\n",
2973	pdb_get_username(user)));
2974	goto done;
2975	}
2976
2977	*p_num_groups = num_sids;
2978
2979	ret = NT_STATUS_OK;
2980
2981	done:
2982
2983	SAFE_FREE(escape_name);
2984	return ret;
2985	}
2986
2987	/**********************************************************************
2988	* Augment a posixGroup object with a sambaGroupMapping domgroup
2989	*********************************************************************/
2990
2991	static NTSTATUS ldapsam_map_posixgroup(TALLOC_CTX *mem_ctx,
2992	struct ldapsam_privates *ldap_state,
2993	GROUP_MAP *map)
2994	{
2995	const char filter, dn;
2996	LDAPMessage msg, entry;
2997	LDAPMod **mods;
2998	int rc;
2999
3000	filter = talloc_asprintf(mem_ctx,
3001	"(&(objectClass=%s)(gidNumber=%u))",
3002	LDAP_OBJ_POSIXGROUP, map->gid);
3003	if (filter == NULL) {
3004	return NT_STATUS_NO_MEMORY;
3005	}
3006
3007	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter,
3008	get_attr_list(mem_ctx, groupmap_attr_list),
3009	&msg);
3010	talloc_autofree_ldapmsg(mem_ctx, msg);
3011
3012	if ((rc != LDAP_SUCCESS) \|\|
3013	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) != 1) \|\|
3014	((entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg)) == NULL)) {
3015	return NT_STATUS_NO_SUCH_GROUP;
3016	}
3017
3018	dn = smbldap_talloc_dn(mem_ctx, ldap_state->smbldap_state->ldap_struct, entry);
3019	if (dn == NULL) {
3020	return NT_STATUS_NO_MEMORY;
3021	}
3022
3023	mods = NULL;
3024	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass",
3025	LDAP_OBJ_GROUPMAP);
3026	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "sambaSid",
3027	sid_string_talloc(mem_ctx, &map->sid));
3028	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "sambaGroupType",
3029	talloc_asprintf(mem_ctx, "%d", map->sid_name_use));
3030	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "displayName",
3031	map->nt_name);
3032	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
3033	map->comment);
3034	talloc_autofree_ldapmod(mem_ctx, mods);
3035
3036	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3037	if (rc != LDAP_SUCCESS) {
3038	return NT_STATUS_ACCESS_DENIED;
3039	}
3040
3041	return NT_STATUS_OK;
3042	}
3043
3044	static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
3045	GROUP_MAP *map)
3046	{
3047	struct ldapsam_privates *ldap_state =
3048	(struct ldapsam_privates *)methods->private_data;
3049	LDAPMessage *msg = NULL;
3050	LDAPMod **mods = NULL;
3051	const char *attrs[] = { NULL };
3052	char *filter;
3053
3054	char *dn;
3055	TALLOC_CTX *mem_ctx;
3056	NTSTATUS result;
3057
3058	DOM_SID sid;
3059
3060	int rc;
3061
3062	mem_ctx = talloc_new(NULL);
3063	if (mem_ctx == NULL) {
3064	DEBUG(0, ("talloc_new failed\n"));
3065	return NT_STATUS_NO_MEMORY;
3066	}
3067
3068	filter = talloc_asprintf(mem_ctx, "(sambaSid=%s)",
3069	sid_string_talloc(mem_ctx, &map->sid));
3070	if (filter == NULL) {
3071	result = NT_STATUS_NO_MEMORY;
3072	goto done;
3073	}
3074
3075	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
3076	LDAP_SCOPE_SUBTREE, filter, attrs, True, &msg);
3077	talloc_autofree_ldapmsg(mem_ctx, msg);
3078
3079	if ((rc == LDAP_SUCCESS) &&
3080	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) > 0)) {
3081
3082	DEBUG(3, ("SID %s already present in LDAP, refusing to add "
3083	"group mapping entry\n", sid_string_dbg(&map->sid)));
3084	result = NT_STATUS_GROUP_EXISTS;
3085	goto done;
3086	}
3087
3088	switch (map->sid_name_use) {
3089
3090	case SID_NAME_DOM_GRP:
3091	/* To map a domain group we need to have a posix group
3092	to attach to. */
3093	result = ldapsam_map_posixgroup(mem_ctx, ldap_state, map);
3094	goto done;
3095	break;
3096
3097	case SID_NAME_ALIAS:
3098	if (!sid_check_is_in_our_domain(&map->sid)
3099	&& !sid_check_is_in_builtin(&map->sid) )
3100	{
3101	DEBUG(3, ("Refusing to map sid %s as an alias, not in our domain\n",
3102	sid_string_dbg(&map->sid)));
3103	result = NT_STATUS_INVALID_PARAMETER;
3104	goto done;
3105	}
3106	break;
3107
3108	default:
3109	DEBUG(3, ("Got invalid use '%s' for mapping\n",
3110	sid_type_lookup(map->sid_name_use)));
3111	result = NT_STATUS_INVALID_PARAMETER;
3112	goto done;
3113	}
3114
3115	/* Domain groups have been mapped in a separate routine, we have to
3116	* create an alias now */
3117
3118	if (map->gid == -1) {
3119	DEBUG(10, ("Refusing to map gid==-1\n"));
3120	result = NT_STATUS_INVALID_PARAMETER;
3121	goto done;
3122	}
3123
3124	if (pdb_gid_to_sid(map->gid, &sid)) {
3125	DEBUG(3, ("Gid %d is already mapped to SID %s, refusing to "
3126	"add\n", map->gid, sid_string_dbg(&sid)));
3127	result = NT_STATUS_GROUP_EXISTS;
3128	goto done;
3129	}
3130
3131	/* Ok, enough checks done. It's still racy to go ahead now, but that's
3132	* the best we can get out of LDAP. */
3133
3134	dn = talloc_asprintf(mem_ctx, "sambaSid=%s,%s",
3135	sid_string_talloc(mem_ctx, &map->sid),
3136	lp_ldap_group_suffix());
3137	if (dn == NULL) {
3138	result = NT_STATUS_NO_MEMORY;
3139	goto done;
3140	}
3141
3142	mods = NULL;
3143
3144	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "objectClass",
3145	LDAP_OBJ_SID_ENTRY);
3146	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "objectClass",
3147	LDAP_OBJ_GROUPMAP);
3148	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "sambaSid",
3149	sid_string_talloc(mem_ctx, &map->sid));
3150	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "sambaGroupType",
3151	talloc_asprintf(mem_ctx, "%d", map->sid_name_use));
3152	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "displayName",
3153	map->nt_name);
3154	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "description",
3155	map->comment);
3156	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "gidNumber",
3157	talloc_asprintf(mem_ctx, "%u", map->gid));
3158	talloc_autofree_ldapmod(mem_ctx, mods);
3159
3160	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
3161
3162	result = (rc == LDAP_SUCCESS) ?
3163	NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
3164
3165	done:
3166	TALLOC_FREE(mem_ctx);
3167	return result;
3168	}
3169
3170	/**********************************************************************
3171	* Update a group mapping entry. We're quite strict about what can be changed:
3172	* Only the description and displayname may be changed. It simply does not
3173	* make any sense to change the SID, gid or the type in a mapping.
3174	*********************************************************************/
3175
3176	static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods,
3177	GROUP_MAP *map)
3178	{
3179	struct ldapsam_privates *ldap_state =
3180	(struct ldapsam_privates *)methods->private_data;
3181	int rc;
3182	const char filter, dn;
3183	LDAPMessage *msg = NULL;
3184	LDAPMessage *entry = NULL;
3185	LDAPMod **mods = NULL;
3186	TALLOC_CTX *mem_ctx;
3187	NTSTATUS result;
3188
3189	mem_ctx = talloc_new(NULL);
3190	if (mem_ctx == NULL) {
3191	DEBUG(0, ("talloc_new failed\n"));
3192	return NT_STATUS_NO_MEMORY;
3193	}
3194
3195	/* Make 100% sure that sid, gid and type are not changed by looking up
3196	* exactly the values we're given in LDAP. */
3197
3198	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)"
3199	"(sambaSid=%s)(gidNumber=%u)"
3200	"(sambaGroupType=%d))",
3201	LDAP_OBJ_GROUPMAP,
3202	sid_string_talloc(mem_ctx, &map->sid),
3203	map->gid, map->sid_name_use);
3204	if (filter == NULL) {
3205	result = NT_STATUS_NO_MEMORY;
3206	goto done;
3207	}
3208
3209	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter,
3210	get_attr_list(mem_ctx, groupmap_attr_list),
3211	&msg);
3212	talloc_autofree_ldapmsg(mem_ctx, msg);
3213
3214	if ((rc != LDAP_SUCCESS) \|\|
3215	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) != 1) \|\|
3216	((entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg)) == NULL)) {
3217	result = NT_STATUS_NO_SUCH_GROUP;
3218	goto done;
3219	}
3220
3221	dn = smbldap_talloc_dn(mem_ctx, ldap_state->smbldap_state->ldap_struct, entry);
3222
3223	if (dn == NULL) {
3224	result = NT_STATUS_NO_MEMORY;
3225	goto done;
3226	}
3227
3228	mods = NULL;
3229	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "displayName",
3230	map->nt_name);
3231	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
3232	map->comment);
3233	talloc_autofree_ldapmod(mem_ctx, mods);
3234
3235	if (mods == NULL) {
3236	DEBUG(4, ("ldapsam_update_group_mapping_entry: mods is empty: "
3237	"nothing to do\n"));
3238	result = NT_STATUS_OK;
3239	goto done;
3240	}
3241
3242	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3243
3244	if (rc != LDAP_SUCCESS) {
3245	result = NT_STATUS_ACCESS_DENIED;
3246	goto done;
3247	}
3248
3249	DEBUG(2, ("ldapsam_update_group_mapping_entry: successfully modified "
3250	"group %lu in LDAP\n", (unsigned long)map->gid));
3251
3252	result = NT_STATUS_OK;
3253
3254	done:
3255	TALLOC_FREE(mem_ctx);
3256	return result;
3257	}
3258
3259	/**********************************************************************
3260	*********************************************************************/
3261
3262	static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods,
3263	DOM_SID sid)
3264	{
3265	struct ldapsam_privates *priv =
3266	(struct ldapsam_privates *)methods->private_data;
3267	LDAPMessage msg, entry;
3268	int rc;
3269	NTSTATUS result;
3270	TALLOC_CTX *mem_ctx;
3271	char *filter;
3272
3273	mem_ctx = talloc_new(NULL);
3274	if (mem_ctx == NULL) {
3275	DEBUG(0, ("talloc_new failed\n"));
3276	return NT_STATUS_NO_MEMORY;
3277	}
3278
3279	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(%s=%s))",
3280	LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID,
3281	sid_string_talloc(mem_ctx, &sid));
3282	if (filter == NULL) {
3283	result = NT_STATUS_NO_MEMORY;
3284	goto done;
3285	}
3286	rc = smbldap_search_suffix(priv->smbldap_state, filter,
3287	get_attr_list(mem_ctx, groupmap_attr_list),
3288	&msg);
3289	talloc_autofree_ldapmsg(mem_ctx, msg);
3290
3291	if ((rc != LDAP_SUCCESS) \|\|
3292	(ldap_count_entries(priv2ld(priv), msg) != 1) \|\|
3293	((entry = ldap_first_entry(priv2ld(priv), msg)) == NULL)) {
3294	result = NT_STATUS_NO_SUCH_GROUP;
3295	goto done;
3296	}
3297
3298	rc = ldapsam_delete_entry(priv, mem_ctx, entry, LDAP_OBJ_GROUPMAP,
3299	get_attr_list(mem_ctx,
3300	groupmap_attr_list_to_delete));
3301
3302	if ((rc == LDAP_NAMING_VIOLATION) \|\|
3303	(rc == LDAP_NOT_ALLOWED_ON_RDN) \|\|
3304	(rc == LDAP_OBJECT_CLASS_VIOLATION)) {
3305	const char *attrs[] = { "sambaGroupType", "description",
3306	"displayName", "sambaSIDList",
3307	NULL };
3308
3309	/* Second try. Don't delete the sambaSID attribute, this is
3310	for "old" entries that are tacked on a winbind
3311	sambaIdmapEntry. */
3312
3313	rc = ldapsam_delete_entry(priv, mem_ctx, entry,
3314	LDAP_OBJ_GROUPMAP, attrs);
3315	}
3316
3317	if ((rc == LDAP_NAMING_VIOLATION) \|\|
3318	(rc == LDAP_NOT_ALLOWED_ON_RDN) \|\|
3319	(rc == LDAP_OBJECT_CLASS_VIOLATION)) {
3320	const char *attrs[] = { "sambaGroupType", "description",
3321	"displayName", "sambaSIDList",
3322	"gidNumber", NULL };
3323
3324	/* Third try. This is a post-3.0.21 alias (containing only
3325	* sambaSidEntry and sambaGroupMapping classes), we also have
3326	* to delete the gidNumber attribute, only the sambaSidEntry
3327	* remains */
3328
3329	rc = ldapsam_delete_entry(priv, mem_ctx, entry,
3330	LDAP_OBJ_GROUPMAP, attrs);
3331	}
3332
3333	result = (rc == LDAP_SUCCESS) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
3334
3335	done:
3336	TALLOC_FREE(mem_ctx);
3337	return result;
3338	}
3339
3340	/**********************************************************************
3341	*********************************************************************/
3342
3343	static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods,
3344	bool update)
3345	{
3346	struct ldapsam_privates *ldap_state =
3347	(struct ldapsam_privates *)my_methods->private_data;
3348	char *filter = NULL;
3349	int rc;
3350	const char **attr_list;
3351
3352	filter = talloc_asprintf(NULL, "(objectclass=%s)", LDAP_OBJ_GROUPMAP);
3353	if (!filter) {
3354	return NT_STATUS_NO_MEMORY;
3355	}
3356	attr_list = get_attr_list( NULL, groupmap_attr_list );
3357	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
3358	LDAP_SCOPE_SUBTREE, filter,
3359	attr_list, 0, &ldap_state->result);
3360	TALLOC_FREE(attr_list);
3361
3362	if (rc != LDAP_SUCCESS) {
3363	DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n",
3364	ldap_err2string(rc)));
3365	DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n",
3366	lp_ldap_group_suffix(), filter));
3367	ldap_msgfree(ldap_state->result);
3368	ldap_state->result = NULL;
3369	TALLOC_FREE(filter);
3370	return NT_STATUS_UNSUCCESSFUL;
3371	}
3372
3373	TALLOC_FREE(filter);
3374
3375	DEBUG(2, ("ldapsam_setsamgrent: %d entries in the base!\n",
3376	ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3377	ldap_state->result)));
3378
3379	ldap_state->entry =
3380	ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3381	ldap_state->result);
3382	ldap_state->index = 0;
3383
3384	return NT_STATUS_OK;
3385	}
3386
3387	/**********************************************************************
3388	*********************************************************************/
3389
3390	static void ldapsam_endsamgrent(struct pdb_methods *my_methods)
3391	{
3392	ldapsam_endsampwent(my_methods);
3393	}
3394
3395	/**********************************************************************
3396	*********************************************************************/
3397
3398	static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods,
3399	GROUP_MAP *map)
3400	{
3401	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
3402	struct ldapsam_privates *ldap_state =
3403	(struct ldapsam_privates *)my_methods->private_data;
3404	bool bret = False;
3405
3406	while (!bret) {
3407	if (!ldap_state->entry)
3408	return ret;
3409
3410	ldap_state->index++;
3411	bret = init_group_from_ldap(ldap_state, map,
3412	ldap_state->entry);
3413
3414	ldap_state->entry =
3415	ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
3416	ldap_state->entry);
3417	}
3418
3419	return NT_STATUS_OK;
3420	}
3421
3422	/**********************************************************************
3423	*********************************************************************/
3424
3425	static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
3426	const DOM_SID *domsid, enum lsa_SidType sid_name_use,
3427	GROUP_MAP **pp_rmap,
3428	size_t *p_num_entries,
3429	bool unix_only)
3430	{
3431	GROUP_MAP map;
3432	size_t entries = 0;
3433
3434	*p_num_entries = 0;
3435	*pp_rmap = NULL;
3436
3437	if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods, False))) {
3438	DEBUG(0, ("ldapsam_enum_group_mapping: Unable to open "
3439	"passdb\n"));
3440	return NT_STATUS_ACCESS_DENIED;
3441	}
3442
3443	while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) {
3444	if (sid_name_use != SID_NAME_UNKNOWN &&
3445	sid_name_use != map.sid_name_use) {
3446	DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
3447	"not of the requested type\n", map.nt_name));
3448	continue;
3449	}
3450	if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
3451	DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
3452	"non mapped\n", map.nt_name));
3453	continue;
3454	}
3455
3456	(pp_rmap)=SMB_REALLOC_ARRAY((pp_rmap), GROUP_MAP, entries+1);
3457	if (!(*pp_rmap)) {
3458	DEBUG(0,("ldapsam_enum_group_mapping: Unable to "
3459	"enlarge group map!\n"));
3460	return NT_STATUS_UNSUCCESSFUL;
3461	}
3462
3463	(*pp_rmap)[entries] = map;
3464
3465	entries += 1;
3466
3467	}
3468	ldapsam_endsamgrent(methods);
3469
3470	*p_num_entries = entries;
3471
3472	return NT_STATUS_OK;
3473	}
3474
3475	static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
3476	const DOM_SID *alias,
3477	const DOM_SID *member,
3478	int modop)
3479	{
3480	struct ldapsam_privates *ldap_state =
3481	(struct ldapsam_privates *)methods->private_data;
3482	char *dn = NULL;
3483	LDAPMessage *result = NULL;
3484	LDAPMessage *entry = NULL;
3485	int count;
3486	LDAPMod **mods = NULL;
3487	int rc;
3488	enum lsa_SidType type = SID_NAME_USE_NONE;
3489	fstring tmp;
3490
3491	char *filter = NULL;
3492
3493	if (sid_check_is_in_builtin(alias)) {
3494	type = SID_NAME_ALIAS;
3495	}
3496
3497	if (sid_check_is_in_our_domain(alias)) {
3498	type = SID_NAME_ALIAS;
3499	}
3500
3501	if (type == SID_NAME_USE_NONE) {
3502	DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
3503	sid_string_dbg(alias)));
3504	return NT_STATUS_NO_SUCH_ALIAS;
3505	}
3506
3507	if (asprintf(&filter,
3508	"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
3509	LDAP_OBJ_GROUPMAP, sid_to_fstring(tmp, alias),
3510	type) < 0) {
3511	return NT_STATUS_NO_MEMORY;
3512	}
3513
3514	if (ldapsam_search_one_group(ldap_state, filter,
3515	&result) != LDAP_SUCCESS) {
3516	SAFE_FREE(filter);
3517	return NT_STATUS_NO_SUCH_ALIAS;
3518	}
3519
3520	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3521	result);
3522
3523	if (count < 1) {
3524	DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
3525	ldap_msgfree(result);
3526	SAFE_FREE(filter);
3527	return NT_STATUS_NO_SUCH_ALIAS;
3528	}
3529
3530	if (count > 1) {
3531	DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for "
3532	"filter %s: count=%d\n", filter, count));
3533	ldap_msgfree(result);
3534	SAFE_FREE(filter);
3535	return NT_STATUS_NO_SUCH_ALIAS;
3536	}
3537
3538	SAFE_FREE(filter);
3539
3540	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3541	result);
3542
3543	if (!entry) {
3544	ldap_msgfree(result);
3545	return NT_STATUS_UNSUCCESSFUL;
3546	}
3547
3548	dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
3549	if (!dn) {
3550	ldap_msgfree(result);
3551	return NT_STATUS_UNSUCCESSFUL;
3552	}
3553
3554	smbldap_set_mod(&mods, modop,
3555	get_attr_key2string(groupmap_attr_list,
3556	LDAP_ATTR_SID_LIST),
3557	sid_to_fstring(tmp, member));
3558
3559	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3560
3561	ldap_mods_free(mods, True);
3562	ldap_msgfree(result);
3563	SAFE_FREE(dn);
3564
3565	if (rc == LDAP_TYPE_OR_VALUE_EXISTS) {
3566	return NT_STATUS_MEMBER_IN_ALIAS;
3567	}
3568
3569	if (rc == LDAP_NO_SUCH_ATTRIBUTE) {
3570	return NT_STATUS_MEMBER_NOT_IN_ALIAS;
3571	}
3572
3573	if (rc != LDAP_SUCCESS) {
3574	return NT_STATUS_UNSUCCESSFUL;
3575	}
3576
3577	return NT_STATUS_OK;
3578	}
3579
3580	static NTSTATUS ldapsam_add_aliasmem(struct pdb_methods *methods,
3581	const DOM_SID *alias,
3582	const DOM_SID *member)
3583	{
3584	return ldapsam_modify_aliasmem(methods, alias, member, LDAP_MOD_ADD);
3585	}
3586
3587	static NTSTATUS ldapsam_del_aliasmem(struct pdb_methods *methods,
3588	const DOM_SID *alias,
3589	const DOM_SID *member)
3590	{
3591	return ldapsam_modify_aliasmem(methods, alias, member,
3592	LDAP_MOD_DELETE);
3593	}
3594
3595	static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
3596	const DOM_SID *alias,
3597	DOM_SID **pp_members,
3598	size_t *p_num_members)
3599	{
3600	struct ldapsam_privates *ldap_state =
3601	(struct ldapsam_privates *)methods->private_data;
3602	LDAPMessage *result = NULL;
3603	LDAPMessage *entry = NULL;
3604	int count;
3605	char **values = NULL;
3606	int i;
3607	char *filter = NULL;
3608	size_t num_members = 0;
3609	enum lsa_SidType type = SID_NAME_USE_NONE;
3610	fstring tmp;
3611
3612	*pp_members = NULL;
3613	*p_num_members = 0;
3614
3615	if (sid_check_is_in_builtin(alias)) {
3616	type = SID_NAME_ALIAS;
3617	}
3618
3619	if (sid_check_is_in_our_domain(alias)) {
3620	type = SID_NAME_ALIAS;
3621	}
3622
3623	if (type == SID_NAME_USE_NONE) {
3624	DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
3625	sid_string_dbg(alias)));
3626	return NT_STATUS_NO_SUCH_ALIAS;
3627	}
3628
3629	if (asprintf(&filter,
3630	"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
3631	LDAP_OBJ_GROUPMAP, sid_to_fstring(tmp, alias),
3632	type) < 0) {
3633	return NT_STATUS_NO_MEMORY;
3634	}
3635
3636	if (ldapsam_search_one_group(ldap_state, filter,
3637	&result) != LDAP_SUCCESS) {
3638	SAFE_FREE(filter);
3639	return NT_STATUS_NO_SUCH_ALIAS;
3640	}
3641
3642	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3643	result);
3644
3645	if (count < 1) {
3646	DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
3647	ldap_msgfree(result);
3648	SAFE_FREE(filter);
3649	return NT_STATUS_NO_SUCH_ALIAS;
3650	}
3651
3652	if (count > 1) {
3653	DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for "
3654	"filter %s: count=%d\n", filter, count));
3655	ldap_msgfree(result);
3656	SAFE_FREE(filter);
3657	return NT_STATUS_NO_SUCH_ALIAS;
3658	}
3659
3660	SAFE_FREE(filter);
3661
3662	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3663	result);
3664
3665	if (!entry) {
3666	ldap_msgfree(result);
3667	return NT_STATUS_UNSUCCESSFUL;
3668	}
3669
3670	values = ldap_get_values(ldap_state->smbldap_state->ldap_struct,
3671	entry,
3672	get_attr_key2string(groupmap_attr_list,
3673	LDAP_ATTR_SID_LIST));
3674
3675	if (values == NULL) {
3676	ldap_msgfree(result);
3677	return NT_STATUS_OK;
3678	}
3679
3680	count = ldap_count_values(values);
3681
3682	for (i=0; i<count; i++) {
3683	DOM_SID member;
3684	NTSTATUS status;
3685
3686	if (!string_to_sid(&member, values[i]))
3687	continue;
3688
3689	status = add_sid_to_array(NULL, &member, pp_members,
3690	&num_members);
3691	if (!NT_STATUS_IS_OK(status)) {
3692	ldap_value_free(values);
3693	ldap_msgfree(result);
3694	return status;
3695	}
3696	}
3697
3698	*p_num_members = num_members;
3699	ldap_value_free(values);
3700	ldap_msgfree(result);
3701
3702	return NT_STATUS_OK;
3703	}
3704
3705	static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
3706	TALLOC_CTX *mem_ctx,
3707	const DOM_SID *domain_sid,
3708	const DOM_SID *members,
3709	size_t num_members,
3710	uint32 **pp_alias_rids,
3711	size_t *p_num_alias_rids)
3712	{
3713	struct ldapsam_privates *ldap_state =
3714	(struct ldapsam_privates *)methods->private_data;
3715	LDAP *ldap_struct;
3716
3717	const char *attrs[] = { LDAP_ATTRIBUTE_SID, NULL };
3718
3719	LDAPMessage *result = NULL;
3720	LDAPMessage *entry = NULL;
3721	int i;
3722	int rc;
3723	char *filter;
3724	enum lsa_SidType type = SID_NAME_USE_NONE;
3725
3726	if (sid_check_is_builtin(domain_sid)) {
3727	type = SID_NAME_ALIAS;
3728	}
3729
3730	if (sid_check_is_domain(domain_sid)) {
3731	type = SID_NAME_ALIAS;
3732	}
3733
3734	if (type == SID_NAME_USE_NONE) {
3735	DEBUG(5, ("SID %s is neither builtin nor domain!\n",
3736	sid_string_dbg(domain_sid)));
3737	return NT_STATUS_UNSUCCESSFUL;
3738	}
3739
3740	filter = talloc_asprintf(mem_ctx,
3741	"(&(\|(objectclass=%s)(sambaGroupType=%d))(\|",
3742	LDAP_OBJ_GROUPMAP, type);
3743
3744	for (i=0; i<num_members; i++)
3745	filter = talloc_asprintf(mem_ctx, "%s(sambaSIDList=%s)",
3746	filter,
3747	sid_string_talloc(mem_ctx,
3748	&members[i]));
3749
3750	filter = talloc_asprintf(mem_ctx, "%s))", filter);
3751
3752	if (filter == NULL) {
3753	return NT_STATUS_NO_MEMORY;
3754	}
3755
3756	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
3757	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
3758
3759	if (rc != LDAP_SUCCESS)
3760	return NT_STATUS_UNSUCCESSFUL;
3761
3762	ldap_struct = ldap_state->smbldap_state->ldap_struct;
3763
3764	for (entry = ldap_first_entry(ldap_struct, result);
3765	entry != NULL;
3766	entry = ldap_next_entry(ldap_struct, entry))
3767	{
3768	fstring sid_str;
3769	DOM_SID sid;
3770	uint32 rid;
3771
3772	if (!smbldap_get_single_attribute(ldap_struct, entry,
3773	LDAP_ATTRIBUTE_SID,
3774	sid_str,
3775	sizeof(sid_str)-1))
3776	continue;
3777
3778	if (!string_to_sid(&sid, sid_str))
3779	continue;
3780
3781	if (!sid_peek_check_rid(domain_sid, &sid, &rid))
3782	continue;
3783
3784	if (!add_rid_to_array_unique(mem_ctx, rid, pp_alias_rids,
3785	p_num_alias_rids)) {
3786	ldap_msgfree(result);
3787	return NT_STATUS_NO_MEMORY;
3788	}
3789	}
3790
3791	ldap_msgfree(result);
3792	return NT_STATUS_OK;
3793	}
3794
3795	static NTSTATUS ldapsam_set_account_policy_in_ldap(struct pdb_methods *methods,
3796	int policy_index,
3797	uint32 value)
3798	{
3799	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3800	int rc;
3801	LDAPMod **mods = NULL;
3802	fstring value_string;
3803	const char *policy_attr = NULL;
3804
3805	struct ldapsam_privates *ldap_state =
3806	(struct ldapsam_privates *)methods->private_data;
3807
3808	DEBUG(10,("ldapsam_set_account_policy_in_ldap\n"));
3809
3810	if (!ldap_state->domain_dn) {
3811	return NT_STATUS_INVALID_PARAMETER;
3812	}
3813
3814	policy_attr = get_account_policy_attr(policy_index);
3815	if (policy_attr == NULL) {
3816	DEBUG(0,("ldapsam_set_account_policy_in_ldap: invalid "
3817	"policy\n"));
3818	return ntstatus;
3819	}
3820
3821	slprintf(value_string, sizeof(value_string) - 1, "%i", value);
3822
3823	smbldap_set_mod(&mods, LDAP_MOD_REPLACE, policy_attr, value_string);
3824
3825	rc = smbldap_modify(ldap_state->smbldap_state, ldap_state->domain_dn,
3826	mods);
3827
3828	ldap_mods_free(mods, True);
3829
3830	if (rc != LDAP_SUCCESS) {
3831	return ntstatus;
3832	}
3833
3834	if (!cache_account_policy_set(policy_index, value)) {
3835	DEBUG(0,("ldapsam_set_account_policy_in_ldap: failed to "
3836	"update local tdb cache\n"));
3837	return ntstatus;
3838	}
3839
3840	return NT_STATUS_OK;
3841	}
3842
3843	static NTSTATUS ldapsam_set_account_policy(struct pdb_methods *methods,
3844	int policy_index, uint32 value)
3845	{
3846	return ldapsam_set_account_policy_in_ldap(methods, policy_index,
3847	value);
3848	}
3849
3850	static NTSTATUS ldapsam_get_account_policy_from_ldap(struct pdb_methods *methods,
3851	int policy_index,
3852	uint32 *value)
3853	{
3854	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3855	LDAPMessage *result = NULL;
3856	LDAPMessage *entry = NULL;
3857	int count;
3858	int rc;
3859	char **vals = NULL;
3860	const char *policy_attr = NULL;
3861
3862	struct ldapsam_privates *ldap_state =
3863	(struct ldapsam_privates *)methods->private_data;
3864
3865	const char *attrs[2];
3866
3867	DEBUG(10,("ldapsam_get_account_policy_from_ldap\n"));
3868
3869	if (!ldap_state->domain_dn) {
3870	return NT_STATUS_INVALID_PARAMETER;
3871	}
3872
3873	policy_attr = get_account_policy_attr(policy_index);
3874	if (!policy_attr) {
3875	DEBUG(0,("ldapsam_get_account_policy_from_ldap: invalid "
3876	"policy index: %d\n", policy_index));
3877	return ntstatus;
3878	}
3879
3880	attrs[0] = policy_attr;
3881	attrs[1] = NULL;
3882
3883	rc = smbldap_search(ldap_state->smbldap_state, ldap_state->domain_dn,
3884	LDAP_SCOPE_BASE, "(objectclass=*)", attrs, 0,
3885	&result);
3886
3887	if (rc != LDAP_SUCCESS) {
3888	return ntstatus;
3889	}
3890
3891	count = ldap_count_entries(priv2ld(ldap_state), result);
3892	if (count < 1) {
3893	goto out;
3894	}
3895
3896	entry = ldap_first_entry(priv2ld(ldap_state), result);
3897	if (entry == NULL) {
3898	goto out;
3899	}
3900
3901	vals = ldap_get_values(priv2ld(ldap_state), entry, policy_attr);
3902	if (vals == NULL) {
3903	goto out;
3904	}
3905
3906	*value = (uint32)atol(vals[0]);
3907
3908	ntstatus = NT_STATUS_OK;
3909
3910	out:
3911	if (vals)
3912	ldap_value_free(vals);
3913	ldap_msgfree(result);
3914
3915	return ntstatus;
3916	}
3917
3918	/* wrapper around ldapsam_get_account_policy_from_ldap(), handles tdb as cache
3919
3920	- if user hasn't decided to use account policies inside LDAP just reuse the
3921	old tdb values
3922
3923	- if there is a valid cache entry, return that
3924	- if there is an LDAP entry, update cache and return
3925	- otherwise set to default, update cache and return
3926
3927	Guenther
3928	*/
3929	static NTSTATUS ldapsam_get_account_policy(struct pdb_methods *methods,
3930	int policy_index, uint32 *value)
3931	{
3932	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3933
3934	if (cache_account_policy_get(policy_index, value)) {
3935	DEBUG(11,("ldapsam_get_account_policy: got valid value from "
3936	"cache\n"));
3937	return NT_STATUS_OK;
3938	}
3939
3940	ntstatus = ldapsam_get_account_policy_from_ldap(methods, policy_index,
3941	value);
3942	if (NT_STATUS_IS_OK(ntstatus)) {
3943	goto update_cache;
3944	}
3945
3946	DEBUG(10,("ldapsam_get_account_policy: failed to retrieve from "
3947	"ldap\n"));
3948
3949	#if 0
3950	/* should we automagically migrate old tdb value here ? */
3951	if (account_policy_get(policy_index, value))
3952	goto update_ldap;
3953
3954	DEBUG(10,("ldapsam_get_account_policy: no tdb for %d, trying "
3955	"default\n", policy_index));
3956	#endif
3957
3958	if (!account_policy_get_default(policy_index, value)) {
3959	return ntstatus;
3960	}
3961
3962	/* update_ldap: */
3963
3964	ntstatus = ldapsam_set_account_policy(methods, policy_index, *value);
3965	if (!NT_STATUS_IS_OK(ntstatus)) {
3966	return ntstatus;
3967	}
3968
3969	update_cache:
3970
3971	if (!cache_account_policy_set(policy_index, *value)) {
3972	DEBUG(0,("ldapsam_get_account_policy: failed to update local "
3973	"tdb as a cache\n"));
3974	return NT_STATUS_UNSUCCESSFUL;
3975	}
3976
3977	return NT_STATUS_OK;
3978	}
3979
3980	static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
3981	const DOM_SID *domain_sid,
3982	int num_rids,
3983	uint32 *rids,
3984	const char **names,
3985	enum lsa_SidType *attrs)
3986	{
3987	struct ldapsam_privates *ldap_state =
3988	(struct ldapsam_privates *)methods->private_data;
3989	LDAPMessage *msg = NULL;
3990	LDAPMessage *entry;
3991	char *allsids = NULL;
3992	int i, rc, num_mapped;
3993	NTSTATUS result = NT_STATUS_NO_MEMORY;
3994	TALLOC_CTX *mem_ctx;
3995	LDAP *ld;
3996	bool is_builtin;
3997
3998	mem_ctx = talloc_new(NULL);
3999	if (mem_ctx == NULL) {
4000	DEBUG(0, ("talloc_new failed\n"));
4001	goto done;
4002	}
4003
4004	if (!sid_check_is_builtin(domain_sid) &&
4005	!sid_check_is_domain(domain_sid)) {
4006	result = NT_STATUS_INVALID_PARAMETER;
4007	goto done;
4008	}
4009
4010	for (i=0; i<num_rids; i++)
4011	attrs[i] = SID_NAME_UNKNOWN;
4012
4013	allsids = talloc_strdup(mem_ctx, "");
4014	if (allsids == NULL) {
4015	goto done;
4016	}
4017
4018	for (i=0; i<num_rids; i++) {
4019	DOM_SID sid;
4020	sid_compose(&sid, domain_sid, rids[i]);
4021	allsids = talloc_asprintf_append_buffer(
4022	allsids, "(sambaSid=%s)",
4023	sid_string_talloc(mem_ctx, &sid));
4024	if (allsids == NULL) {
4025	goto done;
4026	}
4027	}
4028
4029	/* First look for users */
4030
4031	{
4032	char *filter;
4033	const char *ldap_attrs[] = { "uid", "sambaSid", NULL };
4034
4035	filter = talloc_asprintf(
4036	mem_ctx, ("(&(objectClass=%s)(\|%s))"),
4037	LDAP_OBJ_SAMBASAMACCOUNT, allsids);
4038
4039	if (filter == NULL) {
4040	goto done;
4041	}
4042
4043	rc = smbldap_search(ldap_state->smbldap_state,
4044	lp_ldap_user_suffix(),
4045	LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
4046	&msg);
4047	talloc_autofree_ldapmsg(mem_ctx, msg);
4048	}
4049
4050	if (rc != LDAP_SUCCESS)
4051	goto done;
4052
4053	ld = ldap_state->smbldap_state->ldap_struct;
4054	num_mapped = 0;
4055
4056	for (entry = ldap_first_entry(ld, msg);
4057	entry != NULL;
4058	entry = ldap_next_entry(ld, entry)) {
4059	uint32 rid;
4060	int rid_index;
4061	const char *name;
4062
4063	if (!ldapsam_extract_rid_from_entry(ld, entry, domain_sid,
4064	&rid)) {
4065	DEBUG(2, ("Could not find sid from ldap entry\n"));
4066	continue;
4067	}
4068
4069	name = smbldap_talloc_single_attribute(ld, entry, "uid",
4070	names);
4071	if (name == NULL) {
4072	DEBUG(2, ("Could not retrieve uid attribute\n"));
4073	continue;
4074	}
4075
4076	for (rid_index = 0; rid_index < num_rids; rid_index++) {
4077	if (rid == rids[rid_index])
4078	break;
4079	}
4080
4081	if (rid_index == num_rids) {
4082	DEBUG(2, ("Got a RID not asked for: %d\n", rid));
4083	continue;
4084	}
4085
4086	attrs[rid_index] = SID_NAME_USER;
4087	names[rid_index] = name;
4088	num_mapped += 1;
4089	}
4090
4091	if (num_mapped == num_rids) {
4092	/* No need to look for groups anymore -- we're done */
4093	result = NT_STATUS_OK;
4094	goto done;
4095	}
4096
4097	/* Same game for groups */
4098
4099	{
4100	char *filter;
4101	const char *ldap_attrs[] = { "cn", "displayName", "sambaSid",
4102	"sambaGroupType", NULL };
4103
4104	filter = talloc_asprintf(
4105	mem_ctx, "(&(objectClass=%s)(\|%s))",
4106	LDAP_OBJ_GROUPMAP, allsids);
4107	if (filter == NULL) {
4108	goto done;
4109	}
4110
4111	rc = smbldap_search(ldap_state->smbldap_state,
4112	lp_ldap_group_suffix(),
4113	LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
4114	&msg);
4115	talloc_autofree_ldapmsg(mem_ctx, msg);
4116	}
4117
4118	if (rc != LDAP_SUCCESS)
4119	goto done;
4120
4121	/* ldap_struct might have changed due to a reconnect */
4122
4123	ld = ldap_state->smbldap_state->ldap_struct;
4124
4125	/* For consistency checks, we already checked we're only domain or builtin */
4126
4127	is_builtin = sid_check_is_builtin(domain_sid);
4128
4129	for (entry = ldap_first_entry(ld, msg);
4130	entry != NULL;
4131	entry = ldap_next_entry(ld, entry))
4132	{
4133	uint32 rid;
4134	int rid_index;
4135	const char *attr;
4136	enum lsa_SidType type;
4137	const char *dn = smbldap_talloc_dn(mem_ctx, ld, entry);
4138
4139	attr = smbldap_talloc_single_attribute(ld, entry, "sambaGroupType",
4140	mem_ctx);
4141	if (attr == NULL) {
4142	DEBUG(2, ("Could not extract type from ldap entry %s\n",
4143	dn));
4144	continue;
4145	}
4146
4147	type = (enum lsa_SidType)atol(attr);
4148
4149	/* Consistency checks */
4150	if ((is_builtin && (type != SID_NAME_ALIAS)) \|\|
4151	(!is_builtin && ((type != SID_NAME_ALIAS) &&
4152	(type != SID_NAME_DOM_GRP)))) {
4153	DEBUG(2, ("Rejecting invalid group mapping entry %s\n", dn));
4154	}
4155
4156	if (!ldapsam_extract_rid_from_entry(ld, entry, domain_sid,
4157	&rid)) {
4158	DEBUG(2, ("Could not find sid from ldap entry %s\n", dn));
4159	continue;
4160	}
4161
4162	attr = smbldap_talloc_single_attribute(ld, entry, "displayName", names);
4163
4164	if (attr == NULL) {
4165	DEBUG(10, ("Could not retrieve 'displayName' attribute from %s\n",
4166	dn));
4167	attr = smbldap_talloc_single_attribute(ld, entry, "cn", names);
4168	}
4169
4170	if (attr == NULL) {
4171	DEBUG(2, ("Could not retrieve naming attribute from %s\n",
4172	dn));
4173	continue;
4174	}
4175
4176	for (rid_index = 0; rid_index < num_rids; rid_index++) {
4177	if (rid == rids[rid_index])
4178	break;
4179	}
4180
4181	if (rid_index == num_rids) {
4182	DEBUG(2, ("Got a RID not asked for: %d\n", rid));
4183	continue;
4184	}
4185
4186	attrs[rid_index] = type;
4187	names[rid_index] = attr;
4188	num_mapped += 1;
4189	}
4190
4191	result = NT_STATUS_NONE_MAPPED;
4192
4193	if (num_mapped > 0)
4194	result = (num_mapped == num_rids) ?
4195	NT_STATUS_OK : STATUS_SOME_UNMAPPED;
4196	done:
4197	TALLOC_FREE(mem_ctx);
4198	return result;
4199	}
4200
4201	static char get_ldap_filter(TALLOC_CTX mem_ctx, const char *username)
4202	{
4203	char *filter = NULL;
4204	char *escaped = NULL;
4205	char *result = NULL;
4206
4207	if (asprintf(&filter, "(&%s(objectclass=%s))",
4208	"(uid=%u)", LDAP_OBJ_SAMBASAMACCOUNT) < 0) {
4209	goto done;
4210	}
4211
4212	escaped = escape_ldap_string_alloc(username);
4213	if (escaped == NULL) goto done;
4214
4215	result = talloc_string_sub(mem_ctx, filter, "%u", username);
4216
4217	done:
4218	SAFE_FREE(filter);
4219	SAFE_FREE(escaped);
4220
4221	return result;
4222	}
4223
4224	const char *talloc_attrs(TALLOC_CTX mem_ctx, ...)
4225	{
4226	int i, num = 0;
4227	va_list ap;
4228	const char **result;
4229
4230	va_start(ap, mem_ctx);
4231	while (va_arg(ap, const char *) != NULL)
4232	num += 1;
4233	va_end(ap);
4234
4235	if ((result = TALLOC_ARRAY(mem_ctx, const char *, num+1)) == NULL) {
4236	return NULL;
4237	}
4238
4239	va_start(ap, mem_ctx);
4240	for (i=0; i<num; i++) {
4241	result[i] = talloc_strdup(result, va_arg(ap, const char*));
4242	if (result[i] == NULL) {
4243	talloc_free(result);
4244	va_end(ap);
4245	return NULL;
4246	}
4247	}
4248	va_end(ap);
4249
4250	result[num] = NULL;
4251	return result;
4252	}
4253
4254	struct ldap_search_state {
4255	struct smbldap_state *connection;
4256
4257	uint32 acct_flags;
4258	uint16 group_type;
4259
4260	const char *base;
4261	int scope;
4262	const char *filter;
4263	const char **attrs;
4264	int attrsonly;
4265	void *pagedresults_cookie;
4266
4267	LDAPMessage entries, current_entry;
4268	bool (ldap2displayentry)(struct ldap_search_state state,
4269	TALLOC_CTX *mem_ctx,
4270	LDAP ld, LDAPMessage entry,
4271	struct samr_displayentry *result);
4272	};
4273
4274	static bool ldapsam_search_firstpage(struct pdb_search *search)
4275	{
4276	struct ldap_search_state *state =
4277	(struct ldap_search_state *)search->private_data;
4278	LDAP *ld;
4279	int rc = LDAP_OPERATIONS_ERROR;
4280
4281	state->entries = NULL;
4282
4283	if (state->connection->paged_results) {
4284	rc = smbldap_search_paged(state->connection, state->base,
4285	state->scope, state->filter,
4286	state->attrs, state->attrsonly,
4287	lp_ldap_page_size(), &state->entries,
4288	&state->pagedresults_cookie);
4289	}
4290
4291	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL)) {
4292
4293	if (state->entries != NULL) {
4294	/* Left over from unsuccessful paged attempt */
4295	ldap_msgfree(state->entries);
4296	state->entries = NULL;
4297	}
4298
4299	rc = smbldap_search(state->connection, state->base,
4300	state->scope, state->filter, state->attrs,
4301	state->attrsonly, &state->entries);
4302
4303	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL))
4304	return False;
4305
4306	/* Ok, the server was lying. It told us it could do paged
4307	* searches when it could not. */
4308	state->connection->paged_results = False;
4309	}
4310
4311	ld = state->connection->ldap_struct;
4312	if ( ld == NULL) {
4313	DEBUG(5, ("Don't have an LDAP connection right after a "
4314	"search\n"));
4315	return False;
4316	}
4317	state->current_entry = ldap_first_entry(ld, state->entries);
4318
4319	if (state->current_entry == NULL) {
4320	ldap_msgfree(state->entries);
4321	state->entries = NULL;
4322	}
4323
4324	return True;
4325	}
4326
4327	static bool ldapsam_search_nextpage(struct pdb_search *search)
4328	{
4329	struct ldap_search_state *state =
4330	(struct ldap_search_state *)search->private_data;
4331	int rc;
4332
4333	if (!state->connection->paged_results) {
4334	/* There is no next page when there are no paged results */
4335	return False;
4336	}
4337
4338	rc = smbldap_search_paged(state->connection, state->base,
4339	state->scope, state->filter, state->attrs,
4340	state->attrsonly, lp_ldap_page_size(),
4341	&state->entries,
4342	&state->pagedresults_cookie);
4343
4344	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL))
4345	return False;
4346
4347	state->current_entry = ldap_first_entry(state->connection->ldap_struct, state->entries);
4348
4349	if (state->current_entry == NULL) {
4350	ldap_msgfree(state->entries);
4351	state->entries = NULL;
4352	}
4353
4354	return True;
4355	}
4356
4357	static bool ldapsam_search_next_entry(struct pdb_search *search,
4358	struct samr_displayentry *entry)
4359	{
4360	struct ldap_search_state *state =
4361	(struct ldap_search_state *)search->private_data;
4362	bool result;
4363
4364	retry:
4365	if ((state->entries == NULL) && (state->pagedresults_cookie == NULL))
4366	return False;
4367
4368	if ((state->entries == NULL) &&
4369	!ldapsam_search_nextpage(search))
4370	return False;
4371
4372	result = state->ldap2displayentry(state, search->mem_ctx, state->connection->ldap_struct,
4373	state->current_entry, entry);
4374
4375	if (!result) {
4376	char *dn;
4377	dn = ldap_get_dn(state->connection->ldap_struct, state->current_entry);
4378	DEBUG(5, ("Skipping entry %s\n", dn != NULL ? dn : "<NULL>"));
4379	if (dn != NULL) ldap_memfree(dn);
4380	}
4381
4382	state->current_entry = ldap_next_entry(state->connection->ldap_struct, state->current_entry);
4383
4384	if (state->current_entry == NULL) {
4385	ldap_msgfree(state->entries);
4386	state->entries = NULL;
4387	}
4388
4389	if (!result) goto retry;
4390
4391	return True;
4392	}
4393
4394	static void ldapsam_search_end(struct pdb_search *search)
4395	{
4396	struct ldap_search_state *state =
4397	(struct ldap_search_state *)search->private_data;
4398	int rc;
4399
4400	if (state->pagedresults_cookie == NULL)
4401	return;
4402
4403	if (state->entries != NULL)
4404	ldap_msgfree(state->entries);
4405
4406	state->entries = NULL;
4407	state->current_entry = NULL;
4408
4409	if (!state->connection->paged_results)
4410	return;
4411
4412	/* Tell the LDAP server we're not interested in the rest anymore. */
4413
4414	rc = smbldap_search_paged(state->connection, state->base, state->scope,
4415	state->filter, state->attrs,
4416	state->attrsonly, 0, &state->entries,
4417	&state->pagedresults_cookie);
4418
4419	if (rc != LDAP_SUCCESS)
4420	DEBUG(5, ("Could not end search properly\n"));
4421
4422	return;
4423	}
4424
4425	static bool ldapuser2displayentry(struct ldap_search_state *state,
4426	TALLOC_CTX *mem_ctx,
4427	LDAP ld, LDAPMessage entry,
4428	struct samr_displayentry *result)
4429	{
4430	char **vals;
4431	size_t converted_size;
4432	DOM_SID sid;
4433	uint32 acct_flags;
4434
4435	vals = ldap_get_values(ld, entry, "sambaAcctFlags");
4436	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4437	DEBUG(5, ("\"sambaAcctFlags\" not found\n"));
4438	return False;
4439	}
4440	acct_flags = pdb_decode_acct_ctrl(vals[0]);
4441	ldap_value_free(vals);
4442
4443	if ((state->acct_flags != 0) &&
4444	((state->acct_flags & acct_flags) == 0))
4445	return False;
4446
4447	result->acct_flags = acct_flags;
4448	result->account_name = "";
4449	result->fullname = "";
4450	result->description = "";
4451
4452	vals = ldap_get_values(ld, entry, "uid");
4453	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4454	DEBUG(5, ("\"uid\" not found\n"));
4455	return False;
4456	}
4457	if (!pull_utf8_talloc(mem_ctx,
4458	CONST_DISCARD(char **, &result->account_name),
4459	vals[0], &converted_size))
4460	{
4461	DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",
4462	strerror(errno)));
4463	}
4464
4465	ldap_value_free(vals);
4466
4467	vals = ldap_get_values(ld, entry, "displayName");
4468	if ((vals == NULL) \|\| (vals[0] == NULL))
4469	DEBUG(8, ("\"displayName\" not found\n"));
4470	else if (!pull_utf8_talloc(mem_ctx,
4471	CONST_DISCARD(char **, &result->fullname),
4472	vals[0], &converted_size))
4473	{
4474	DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",
4475	strerror(errno)));
4476	}
4477
4478	ldap_value_free(vals);
4479
4480	vals = ldap_get_values(ld, entry, "description");
4481	if ((vals == NULL) \|\| (vals[0] == NULL))
4482	DEBUG(8, ("\"description\" not found\n"));
4483	else if (!pull_utf8_talloc(mem_ctx,
4484	CONST_DISCARD(char **, &result->description),
4485	vals[0], &converted_size))
4486	{
4487	DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",
4488	strerror(errno)));
4489	}
4490
4491	ldap_value_free(vals);
4492
4493	if ((result->account_name == NULL) \|\|
4494	(result->fullname == NULL) \|\|
4495	(result->description == NULL)) {
4496	DEBUG(0, ("talloc failed\n"));
4497	return False;
4498	}
4499
4500	vals = ldap_get_values(ld, entry, "sambaSid");
4501	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4502	DEBUG(0, ("\"objectSid\" not found\n"));
4503	return False;
4504	}
4505
4506	if (!string_to_sid(&sid, vals[0])) {
4507	DEBUG(0, ("Could not convert %s to SID\n", vals[0]));
4508	ldap_value_free(vals);
4509	return False;
4510	}
4511	ldap_value_free(vals);
4512
4513	if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)) {
4514	DEBUG(0, ("sid %s does not belong to our domain\n",
4515	sid_string_dbg(&sid)));
4516	return False;
4517	}
4518
4519	return True;
4520	}
4521
4522
4523	static bool ldapsam_search_users(struct pdb_methods *methods,
4524	struct pdb_search *search,
4525	uint32 acct_flags)
4526	{
4527	struct ldapsam_privates *ldap_state =
4528	(struct ldapsam_privates *)methods->private_data;
4529	struct ldap_search_state *state;
4530
4531	state = TALLOC_P(search->mem_ctx, struct ldap_search_state);
4532	if (state == NULL) {
4533	DEBUG(0, ("talloc failed\n"));
4534	return False;
4535	}
4536
4537	state->connection = ldap_state->smbldap_state;
4538
4539	if ((acct_flags != 0) && ((acct_flags & ACB_NORMAL) != 0))
4540	state->base = lp_ldap_user_suffix();
4541	else if ((acct_flags != 0) &&
4542	((acct_flags & (ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST)) != 0))
4543	state->base = lp_ldap_machine_suffix();
4544	else
4545	state->base = lp_ldap_suffix();
4546
4547	state->acct_flags = acct_flags;
4548	state->base = talloc_strdup(search->mem_ctx, state->base);
4549	state->scope = LDAP_SCOPE_SUBTREE;
4550	state->filter = get_ldap_filter(search->mem_ctx, "*");
4551	state->attrs = talloc_attrs(search->mem_ctx, "uid", "sambaSid",
4552	"displayName", "description",
4553	"sambaAcctFlags", NULL);
4554	state->attrsonly = 0;
4555	state->pagedresults_cookie = NULL;
4556	state->entries = NULL;
4557	state->ldap2displayentry = ldapuser2displayentry;
4558
4559	if ((state->filter == NULL) \|\| (state->attrs == NULL)) {
4560	DEBUG(0, ("talloc failed\n"));
4561	return False;
4562	}
4563
4564	search->private_data = state;
4565	search->next_entry = ldapsam_search_next_entry;
4566	search->search_end = ldapsam_search_end;
4567
4568	return ldapsam_search_firstpage(search);
4569	}
4570
4571	static bool ldapgroup2displayentry(struct ldap_search_state *state,
4572	TALLOC_CTX *mem_ctx,
4573	LDAP ld, LDAPMessage entry,
4574	struct samr_displayentry *result)
4575	{
4576	char **vals;
4577	size_t converted_size;
4578	DOM_SID sid;
4579	uint16 group_type;
4580
4581	result->account_name = "";
4582	result->fullname = "";
4583	result->description = "";
4584
4585
4586	vals = ldap_get_values(ld, entry, "sambaGroupType");
4587	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4588	DEBUG(5, ("\"sambaGroupType\" not found\n"));
4589	if (vals != NULL) {
4590	ldap_value_free(vals);
4591	}
4592	return False;
4593	}
4594
4595	group_type = atoi(vals[0]);
4596
4597	if ((state->group_type != 0) &&
4598	((state->group_type != group_type))) {
4599	ldap_value_free(vals);
4600	return False;
4601	}
4602
4603	ldap_value_free(vals);
4604
4605	/* display name is the NT group name */
4606
4607	vals = ldap_get_values(ld, entry, "displayName");
4608	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4609	DEBUG(8, ("\"displayName\" not found\n"));
4610
4611	/* fallback to the 'cn' attribute */
4612	vals = ldap_get_values(ld, entry, "cn");
4613	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4614	DEBUG(5, ("\"cn\" not found\n"));
4615	return False;
4616	}
4617	if (!pull_utf8_talloc(mem_ctx,
4618	CONST_DISCARD(char **,
4619	&result->account_name),
4620	vals[0], &converted_size))
4621	{
4622	DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc "
4623	"failed: %s", strerror(errno)));
4624	}
4625	}
4626	else if (!pull_utf8_talloc(mem_ctx,
4627	CONST_DISCARD(char **,
4628	&result->account_name),
4629	vals[0], &converted_size))
4630	{
4631	DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc failed: %s",
4632	strerror(errno)));
4633	}
4634
4635	ldap_value_free(vals);
4636
4637	vals = ldap_get_values(ld, entry, "description");
4638	if ((vals == NULL) \|\| (vals[0] == NULL))
4639	DEBUG(8, ("\"description\" not found\n"));
4640	else if (!pull_utf8_talloc(mem_ctx,
4641	CONST_DISCARD(char **, &result->description),
4642	vals[0], &converted_size))
4643	{
4644	DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc failed: %s",
4645	strerror(errno)));
4646	}
4647	ldap_value_free(vals);
4648
4649	if ((result->account_name == NULL) \|\|
4650	(result->fullname == NULL) \|\|
4651	(result->description == NULL)) {
4652	DEBUG(0, ("talloc failed\n"));
4653	return False;
4654	}
4655
4656	vals = ldap_get_values(ld, entry, "sambaSid");
4657	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4658	DEBUG(0, ("\"objectSid\" not found\n"));
4659	if (vals != NULL) {
4660	ldap_value_free(vals);
4661	}
4662	return False;
4663	}
4664
4665	if (!string_to_sid(&sid, vals[0])) {
4666	DEBUG(0, ("Could not convert %s to SID\n", vals[0]));
4667	return False;
4668	}
4669
4670	ldap_value_free(vals);
4671
4672	switch (group_type) {
4673	case SID_NAME_DOM_GRP:
4674	case SID_NAME_ALIAS:
4675
4676	if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)
4677	&& !sid_peek_check_rid(&global_sid_Builtin, &sid, &result->rid))
4678	{
4679	DEBUG(0, ("%s is not in our domain\n",
4680	sid_string_dbg(&sid)));
4681	return False;
4682	}
4683	break;
4684
4685	default:
4686	DEBUG(0,("unkown group type: %d\n", group_type));
4687	return False;
4688	}
4689
4690	result->acct_flags = 0;
4691
4692	return True;
4693	}
4694
4695	static bool ldapsam_search_grouptype(struct pdb_methods *methods,
4696	struct pdb_search *search,
4697	const DOM_SID *sid,
4698	enum lsa_SidType type)
4699	{
4700	struct ldapsam_privates *ldap_state =
4701	(struct ldapsam_privates *)methods->private_data;
4702	struct ldap_search_state *state;
4703	fstring tmp;
4704
4705	state = TALLOC_P(search->mem_ctx, struct ldap_search_state);
4706	if (state == NULL) {
4707	DEBUG(0, ("talloc failed\n"));
4708	return False;
4709	}
4710
4711	state->connection = ldap_state->smbldap_state;
4712
4713	state->base = talloc_strdup(search->mem_ctx, lp_ldap_group_suffix());
4714	state->connection = ldap_state->smbldap_state;
4715	state->scope = LDAP_SCOPE_SUBTREE;
4716	state->filter = talloc_asprintf(search->mem_ctx,
4717	"(&(objectclass=%s)"
4718	"(sambaGroupType=%d)(sambaSID=%s*))",
4719	LDAP_OBJ_GROUPMAP,
4720	type, sid_to_fstring(tmp, sid));
4721	state->attrs = talloc_attrs(search->mem_ctx, "cn", "sambaSid",
4722	"displayName", "description",
4723	"sambaGroupType", NULL);
4724	state->attrsonly = 0;
4725	state->pagedresults_cookie = NULL;
4726	state->entries = NULL;
4727	state->group_type = type;
4728	state->ldap2displayentry = ldapgroup2displayentry;
4729
4730	if ((state->filter == NULL) \|\| (state->attrs == NULL)) {
4731	DEBUG(0, ("talloc failed\n"));
4732	return False;
4733	}
4734
4735	search->private_data = state;
4736	search->next_entry = ldapsam_search_next_entry;
4737	search->search_end = ldapsam_search_end;
4738
4739	return ldapsam_search_firstpage(search);
4740	}
4741
4742	static bool ldapsam_search_groups(struct pdb_methods *methods,
4743	struct pdb_search *search)
4744	{
4745	return ldapsam_search_grouptype(methods, search, get_global_sam_sid(), SID_NAME_DOM_GRP);
4746	}
4747
4748	static bool ldapsam_search_aliases(struct pdb_methods *methods,
4749	struct pdb_search *search,
4750	const DOM_SID *sid)
4751	{
4752	return ldapsam_search_grouptype(methods, search, sid, SID_NAME_ALIAS);
4753	}
4754
4755	static bool ldapsam_rid_algorithm(struct pdb_methods *methods)
4756	{
4757	return False;
4758	}
4759
4760	static NTSTATUS ldapsam_get_new_rid(struct ldapsam_privates *priv,
4761	uint32 *rid)
4762	{
4763	struct smbldap_state *smbldap_state = priv->smbldap_state;
4764
4765	LDAPMessage *result = NULL;
4766	LDAPMessage *entry = NULL;
4767	LDAPMod **mods = NULL;
4768	NTSTATUS status;
4769	char *value;
4770	int rc;
4771	uint32 nextRid = 0;
4772	const char *dn;
4773
4774	TALLOC_CTX *mem_ctx;
4775
4776	mem_ctx = talloc_new(NULL);
4777	if (mem_ctx == NULL) {
4778	DEBUG(0, ("talloc_new failed\n"));
4779	return NT_STATUS_NO_MEMORY;
4780	}
4781
4782	status = smbldap_search_domain_info(smbldap_state, &result,
4783	get_global_sam_name(), False);
4784	if (!NT_STATUS_IS_OK(status)) {
4785	DEBUG(3, ("Could not get domain info: %s\n",
4786	nt_errstr(status)));
4787	goto done;
4788	}
4789
4790	talloc_autofree_ldapmsg(mem_ctx, result);
4791
4792	entry = ldap_first_entry(priv2ld(priv), result);
4793	if (entry == NULL) {
4794	DEBUG(0, ("Could not get domain info entry\n"));
4795	status = NT_STATUS_INTERNAL_DB_CORRUPTION;
4796	goto done;
4797	}
4798
4799	/* Find the largest of the three attributes "sambaNextRid",
4800	"sambaNextGroupRid" and "sambaNextUserRid". I gave up on the
4801	concept of differentiating between user and group rids, and will
4802	use only "sambaNextRid" in the future. But for compatibility
4803	reasons I look if others have chosen different strategies -- VL */
4804
4805	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4806	"sambaNextRid", mem_ctx);
4807	if (value != NULL) {
4808	uint32 tmp = (uint32)strtoul(value, NULL, 10);
4809	nextRid = MAX(nextRid, tmp);
4810	}
4811
4812	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4813	"sambaNextUserRid", mem_ctx);
4814	if (value != NULL) {
4815	uint32 tmp = (uint32)strtoul(value, NULL, 10);
4816	nextRid = MAX(nextRid, tmp);
4817	}
4818
4819	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4820	"sambaNextGroupRid", mem_ctx);
4821	if (value != NULL) {
4822	uint32 tmp = (uint32)strtoul(value, NULL, 10);
4823	nextRid = MAX(nextRid, tmp);
4824	}
4825
4826	if (nextRid == 0) {
4827	nextRid = BASE_RID-1;
4828	}
4829
4830	nextRid += 1;
4831
4832	smbldap_make_mod(priv2ld(priv), entry, &mods, "sambaNextRid",
4833	talloc_asprintf(mem_ctx, "%d", nextRid));
4834	talloc_autofree_ldapmod(mem_ctx, mods);
4835
4836	if ((dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)) == NULL) {
4837	status = NT_STATUS_NO_MEMORY;
4838	goto done;
4839	}
4840
4841	rc = smbldap_modify(smbldap_state, dn, mods);
4842
4843	/* ACCESS_DENIED is used as a placeholder for "the modify failed,
4844	* please retry" */
4845
4846	status = (rc == LDAP_SUCCESS) ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
4847
4848	done:
4849	if (NT_STATUS_IS_OK(status)) {
4850	*rid = nextRid;
4851	}
4852
4853	TALLOC_FREE(mem_ctx);
4854	return status;
4855	}
4856
4857	static NTSTATUS ldapsam_new_rid_internal(struct pdb_methods methods, uint32 rid)
4858	{
4859	int i;
4860
4861	for (i=0; i<10; i++) {
4862	NTSTATUS result = ldapsam_get_new_rid(
4863	(struct ldapsam_privates *)methods->private_data, rid);
4864	if (NT_STATUS_IS_OK(result)) {
4865	return result;
4866	}
4867
4868	if (!NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
4869	return result;
4870	}
4871
4872	/* The ldap update failed (maybe a race condition), retry */
4873	}
4874
4875	/* Tried 10 times, fail. */
4876	return NT_STATUS_ACCESS_DENIED;
4877	}
4878
4879	static bool ldapsam_new_rid(struct pdb_methods methods, uint32 rid)
4880	{
4881	NTSTATUS result = ldapsam_new_rid_internal(methods, rid);
4882	return NT_STATUS_IS_OK(result) ? True : False;
4883	}
4884
4885	static bool ldapsam_sid_to_id(struct pdb_methods *methods,
4886	const DOM_SID *sid,
4887	union unid_t id, enum lsa_SidType type)
4888	{
4889	struct ldapsam_privates *priv =
4890	(struct ldapsam_privates *)methods->private_data;
4891	char *filter;
4892	const char *attrs[] = { "sambaGroupType", "gidNumber", "uidNumber",
4893	NULL };
4894	LDAPMessage *result = NULL;
4895	LDAPMessage *entry = NULL;
4896	bool ret = False;
4897	char *value;
4898	int rc;
4899
4900	TALLOC_CTX *mem_ctx;
4901
4902	mem_ctx = talloc_new(NULL);
4903	if (mem_ctx == NULL) {
4904	DEBUG(0, ("talloc_new failed\n"));
4905	return False;
4906	}
4907
4908	filter = talloc_asprintf(mem_ctx,
4909	"(&(sambaSid=%s)"
4910	"(\|(objectClass=%s)(objectClass=%s)))",
4911	sid_string_talloc(mem_ctx, sid),
4912	LDAP_OBJ_GROUPMAP, LDAP_OBJ_SAMBASAMACCOUNT);
4913	if (filter == NULL) {
4914	DEBUG(5, ("talloc_asprintf failed\n"));
4915	goto done;
4916	}
4917
4918	rc = smbldap_search_suffix(priv->smbldap_state, filter,
4919	attrs, &result);
4920	if (rc != LDAP_SUCCESS) {
4921	goto done;
4922	}
4923	talloc_autofree_ldapmsg(mem_ctx, result);
4924
4925	if (ldap_count_entries(priv2ld(priv), result) != 1) {
4926	DEBUG(10, ("Got %d entries, expected one\n",
4927	ldap_count_entries(priv2ld(priv), result)));
4928	goto done;
4929	}
4930
4931	entry = ldap_first_entry(priv2ld(priv), result);
4932
4933	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4934	"sambaGroupType", mem_ctx);
4935
4936	if (value != NULL) {
4937	const char *gid_str;
4938	/* It's a group */
4939
4940	gid_str = smbldap_talloc_single_attribute(
4941	priv2ld(priv), entry, "gidNumber", mem_ctx);
4942	if (gid_str == NULL) {
4943	DEBUG(1, ("%s has sambaGroupType but no gidNumber\n",
4944	smbldap_talloc_dn(mem_ctx, priv2ld(priv),
4945	entry)));
4946	goto done;
4947	}
4948
4949	id->gid = strtoul(gid_str, NULL, 10);
4950	*type = (enum lsa_SidType)strtoul(value, NULL, 10);
4951	ret = True;
4952	goto done;
4953	}
4954
4955	/* It must be a user */
4956
4957	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4958	"uidNumber", mem_ctx);
4959	if (value == NULL) {
4960	DEBUG(1, ("Could not find uidNumber in %s\n",
4961	smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)));
4962	goto done;
4963	}
4964
4965	id->uid = strtoul(value, NULL, 10);
4966	*type = SID_NAME_USER;
4967
4968	ret = True;
4969	done:
4970	TALLOC_FREE(mem_ctx);
4971	return ret;
4972	}
4973
4974	/*
4975	* The following functions is called only if
4976	* ldapsam:trusted and ldapsam:editposix are
4977	* set to true
4978	*/
4979
4980	/*
4981	* ldapsam_create_user creates a new
4982	* posixAccount and sambaSamAccount object
4983	* in the ldap users subtree
4984	*
4985	* The uid is allocated by winbindd.
4986	*/
4987
4988	static NTSTATUS ldapsam_create_user(struct pdb_methods *my_methods,
4989	TALLOC_CTX tmp_ctx, const char name,
4990	uint32 acb_info, uint32 *rid)
4991	{
4992	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
4993	LDAPMessage *entry = NULL;
4994	LDAPMessage *result = NULL;
4995	uint32 num_result;
4996	bool is_machine = False;
4997	bool add_posix = False;
4998	LDAPMod **mods = NULL;
4999	struct samu *user;
5000	char *filter;
5001	char *username;
5002	char *homedir;
5003	char *gidstr;
5004	char *uidstr;
5005	char *shell;
5006	const char *dn = NULL;
5007	DOM_SID group_sid;
5008	DOM_SID user_sid;
5009	gid_t gid = -1;
5010	uid_t uid = -1;
5011	NTSTATUS ret;
5012	int rc;
5013
5014	if (((acb_info & ACB_NORMAL) && name[strlen(name)-1] == '$') \|\|
5015	acb_info & ACB_WSTRUST \|\|
5016	acb_info & ACB_SVRTRUST \|\|
5017	acb_info & ACB_DOMTRUST) {
5018	is_machine = True;
5019	}
5020
5021	username = escape_ldap_string_alloc(name);
5022	filter = talloc_asprintf(tmp_ctx, "(&(uid=%s)(objectClass=%s))",
5023	username, LDAP_OBJ_POSIXACCOUNT);
5024	SAFE_FREE(username);
5025
5026	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5027	if (rc != LDAP_SUCCESS) {
5028	DEBUG(0,("ldapsam_create_user: ldap search failed!\n"));
5029	return NT_STATUS_ACCESS_DENIED;
5030	}
5031	talloc_autofree_ldapmsg(tmp_ctx, result);
5032
5033	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5034
5035	if (num_result > 1) {
5036	DEBUG (0, ("ldapsam_create_user: More than one user with name [%s] ?!\n", name));
5037	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5038	}
5039
5040	if (num_result == 1) {
5041	char *tmp;
5042	/* check if it is just a posix account.
5043	* or if there is a sid attached to this entry
5044	*/
5045
5046	entry = ldap_first_entry(priv2ld(ldap_state), result);
5047	if (!entry) {
5048	return NT_STATUS_UNSUCCESSFUL;
5049	}
5050
5051	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "sambaSID", tmp_ctx);
5052	if (tmp) {
5053	DEBUG (1, ("ldapsam_create_user: The user [%s] already exist!\n", name));
5054	return NT_STATUS_USER_EXISTS;
5055	}
5056
5057	/* it is just a posix account, retrieve the dn for later use */
5058	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5059	if (!dn) {
5060	DEBUG(0,("ldapsam_create_user: Out of memory!\n"));
5061	return NT_STATUS_NO_MEMORY;
5062	}
5063	}
5064
5065	if (num_result == 0) {
5066	add_posix = True;
5067	}
5068
5069	/* Create the basic samu structure and generate the mods for the ldap commit */
5070	if (!NT_STATUS_IS_OK((ret = ldapsam_new_rid_internal(my_methods, rid)))) {
5071	DEBUG(1, ("ldapsam_create_user: Could not allocate a new RID\n"));
5072	return ret;
5073	}
5074
5075	sid_compose(&user_sid, get_global_sam_sid(), *rid);
5076
5077	user = samu_new(tmp_ctx);
5078	if (!user) {
5079	DEBUG(1,("ldapsam_create_user: Unable to allocate user struct\n"));
5080	return NT_STATUS_NO_MEMORY;
5081	}
5082
5083	if (!pdb_set_username(user, name, PDB_SET)) {
5084	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5085	return NT_STATUS_UNSUCCESSFUL;
5086	}
5087	if (!pdb_set_domain(user, get_global_sam_name(), PDB_SET)) {
5088	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5089	return NT_STATUS_UNSUCCESSFUL;
5090	}
5091	if (is_machine) {
5092	if (acb_info & ACB_NORMAL) {
5093	if (!pdb_set_acct_ctrl(user, ACB_WSTRUST, PDB_SET)) {
5094	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5095	return NT_STATUS_UNSUCCESSFUL;
5096	}
5097	} else {
5098	if (!pdb_set_acct_ctrl(user, acb_info, PDB_SET)) {
5099	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5100	return NT_STATUS_UNSUCCESSFUL;
5101	}
5102	}
5103	} else {
5104	if (!pdb_set_acct_ctrl(user, ACB_NORMAL \| ACB_DISABLED, PDB_SET)) {
5105	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5106	return NT_STATUS_UNSUCCESSFUL;
5107	}
5108	}
5109
5110	if (!pdb_set_user_sid(user, &user_sid, PDB_SET)) {
5111	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5112	return NT_STATUS_UNSUCCESSFUL;
5113	}
5114
5115	if (!init_ldap_from_sam(ldap_state, NULL, &mods, user, element_is_set_or_changed)) {
5116	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5117	return NT_STATUS_UNSUCCESSFUL;
5118	}
5119
5120	if (ldap_state->schema_ver != SCHEMAVER_SAMBASAMACCOUNT) {
5121	DEBUG(1,("ldapsam_create_user: Unsupported schema version\n"));
5122	}
5123	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
5124
5125	if (add_posix) {
5126	char *escape_name;
5127
5128	DEBUG(3,("ldapsam_create_user: Creating new posix user\n"));
5129
5130	/* retrieve the Domain Users group gid */
5131	if (!sid_compose(&group_sid, get_global_sam_sid(), DOMAIN_GROUP_RID_USERS) \|\|
5132	!sid_to_gid(&group_sid, &gid)) {
5133	DEBUG (0, ("ldapsam_create_user: Unable to get the Domain Users gid: bailing out!\n"));
5134	return NT_STATUS_INVALID_PRIMARY_GROUP;
5135	}
5136
5137	/* lets allocate a new userid for this user */
5138	if (!winbind_allocate_uid(&uid)) {
5139	DEBUG (0, ("ldapsam_create_user: Unable to allocate a new user id: bailing out!\n"));
5140	return NT_STATUS_UNSUCCESSFUL;
5141	}
5142
5143
5144	if (is_machine) {
5145	/* TODO: choose a more appropriate default for machines */
5146	homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), "SMB_workstations_home", ldap_state->domain_name, uid, gid);
5147	shell = talloc_strdup(tmp_ctx, "/bin/false");
5148	} else {
5149	homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), name, ldap_state->domain_name, uid, gid);
5150	shell = talloc_sub_specified(tmp_ctx, lp_template_shell(), name, ldap_state->domain_name, uid, gid);
5151	}
5152	uidstr = talloc_asprintf(tmp_ctx, "%d", uid);
5153	gidstr = talloc_asprintf(tmp_ctx, "%d", gid);
5154
5155	escape_name = escape_rdn_val_string_alloc(name);
5156	if (!escape_name) {
5157	DEBUG (0, ("ldapsam_create_user: Out of memory!\n"));
5158	return NT_STATUS_NO_MEMORY;
5159	}
5160
5161	if (is_machine) {
5162	dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_machine_suffix ());
5163	} else {
5164	dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_user_suffix ());
5165	}
5166
5167	SAFE_FREE(escape_name);
5168
5169	if (!homedir \|\| !shell \|\| !uidstr \|\| !gidstr \|\| !dn) {
5170	DEBUG (0, ("ldapsam_create_user: Out of memory!\n"));
5171	return NT_STATUS_NO_MEMORY;
5172	}
5173
5174	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
5175	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
5176	smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
5177	smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
5178	smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
5179	smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", homedir);
5180	smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", shell);
5181	}
5182
5183	talloc_autofree_ldapmod(tmp_ctx, mods);
5184
5185	if (add_posix) {
5186	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5187	} else {
5188	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5189	}
5190
5191	if (rc != LDAP_SUCCESS) {
5192	DEBUG(0,("ldapsam_create_user: failed to create a new user [%s] (dn = %s)\n", name ,dn));
5193	return NT_STATUS_UNSUCCESSFUL;
5194	}
5195
5196	DEBUG(2,("ldapsam_create_user: added account [%s] in the LDAP database\n", name));
5197
5198	flush_pwnam_cache();
5199
5200	return NT_STATUS_OK;
5201	}
5202
5203	static NTSTATUS ldapsam_delete_user(struct pdb_methods my_methods, TALLOC_CTX tmp_ctx, struct samu *sam_acct)
5204	{
5205	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5206	LDAPMessage *result = NULL;
5207	LDAPMessage *entry = NULL;
5208	int num_result;
5209	const char *dn;
5210	char *filter;
5211	int rc;
5212
5213	DEBUG(0,("ldapsam_delete_user: Attempt to delete user [%s]\n", pdb_get_username(sam_acct)));
5214
5215	filter = talloc_asprintf(tmp_ctx,
5216	"(&(uid=%s)"
5217	"(objectClass=%s)"
5218	"(objectClass=%s))",
5219	pdb_get_username(sam_acct),
5220	LDAP_OBJ_POSIXACCOUNT,
5221	LDAP_OBJ_SAMBASAMACCOUNT);
5222	if (filter == NULL) {
5223	return NT_STATUS_NO_MEMORY;
5224	}
5225
5226	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5227	if (rc != LDAP_SUCCESS) {
5228	DEBUG(0,("ldapsam_delete_user: user search failed!\n"));
5229	return NT_STATUS_UNSUCCESSFUL;
5230	}
5231	talloc_autofree_ldapmsg(tmp_ctx, result);
5232
5233	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5234
5235	if (num_result == 0) {
5236	DEBUG(0,("ldapsam_delete_user: user not found!\n"));
5237	return NT_STATUS_NO_SUCH_USER;
5238	}
5239
5240	if (num_result > 1) {
5241	DEBUG (0, ("ldapsam_delete_user: More than one user with name [%s] ?!\n", pdb_get_username(sam_acct)));
5242	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5243	}
5244
5245	entry = ldap_first_entry(priv2ld(ldap_state), result);
5246	if (!entry) {
5247	return NT_STATUS_UNSUCCESSFUL;
5248	}
5249
5250	/* it is just a posix account, retrieve the dn for later use */
5251	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5252	if (!dn) {
5253	DEBUG(0,("ldapsam_delete_user: Out of memory!\n"));
5254	return NT_STATUS_NO_MEMORY;
5255	}
5256
5257	rc = smbldap_delete(ldap_state->smbldap_state, dn);
5258	if (rc != LDAP_SUCCESS) {
5259	return NT_STATUS_UNSUCCESSFUL;
5260	}
5261
5262	flush_pwnam_cache();
5263
5264	return NT_STATUS_OK;
5265	}
5266
5267	/*
5268	* ldapsam_create_group creates a new
5269	* posixGroup and sambaGroupMapping object
5270	* in the ldap groups subtree
5271	*
5272	* The gid is allocated by winbindd.
5273	*/
5274
5275	static NTSTATUS ldapsam_create_dom_group(struct pdb_methods *my_methods,
5276	TALLOC_CTX *tmp_ctx,
5277	const char *name,
5278	uint32 *rid)
5279	{
5280	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5281	NTSTATUS ret;
5282	LDAPMessage *entry = NULL;
5283	LDAPMessage *result = NULL;
5284	uint32 num_result;
5285	bool is_new_entry = False;
5286	LDAPMod **mods = NULL;
5287	char *filter;
5288	char *groupsidstr;
5289	char *groupname;
5290	char *grouptype;
5291	char *gidstr;
5292	const char *dn = NULL;
5293	DOM_SID group_sid;
5294	gid_t gid = -1;
5295	int rc;
5296
5297	groupname = escape_ldap_string_alloc(name);
5298	filter = talloc_asprintf(tmp_ctx, "(&(cn=%s)(objectClass=%s))",
5299	groupname, LDAP_OBJ_POSIXGROUP);
5300	SAFE_FREE(groupname);
5301
5302	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5303	if (rc != LDAP_SUCCESS) {
5304	DEBUG(0,("ldapsam_create_group: ldap search failed!\n"));
5305	return NT_STATUS_UNSUCCESSFUL;
5306	}
5307	talloc_autofree_ldapmsg(tmp_ctx, result);
5308
5309	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5310
5311	if (num_result > 1) {
5312	DEBUG (0, ("ldapsam_create_group: There exists more than one group with name [%s]: bailing out!\n", name));
5313	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5314	}
5315
5316	if (num_result == 1) {
5317	char *tmp;
5318	/* check if it is just a posix group.
5319	* or if there is a sid attached to this entry
5320	*/
5321
5322	entry = ldap_first_entry(priv2ld(ldap_state), result);
5323	if (!entry) {
5324	return NT_STATUS_UNSUCCESSFUL;
5325	}
5326
5327	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "sambaSID", tmp_ctx);
5328	if (tmp) {
5329	DEBUG (1, ("ldapsam_create_group: The group [%s] already exist!\n", name));
5330	return NT_STATUS_GROUP_EXISTS;
5331	}
5332
5333	/* it is just a posix group, retrieve the gid and the dn for later use */
5334	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5335	if (!tmp) {
5336	DEBUG (1, ("ldapsam_create_group: Couldn't retrieve the gidNumber for [%s]?!?!\n", name));
5337	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5338	}
5339
5340	gid = strtoul(tmp, NULL, 10);
5341
5342	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5343	if (!dn) {
5344	DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
5345	return NT_STATUS_NO_MEMORY;
5346	}
5347	}
5348
5349	if (num_result == 0) {
5350	char *escape_name;
5351
5352	DEBUG(3,("ldapsam_create_user: Creating new posix group\n"));
5353
5354	is_new_entry = True;
5355
5356	/* lets allocate a new groupid for this group */
5357	if (!winbind_allocate_gid(&gid)) {
5358	DEBUG (0, ("ldapsam_create_group: Unable to allocate a new group id: bailing out!\n"));
5359	return NT_STATUS_UNSUCCESSFUL;
5360	}
5361
5362	gidstr = talloc_asprintf(tmp_ctx, "%d", gid);
5363
5364	escape_name = escape_rdn_val_string_alloc(name);
5365	if (!escape_name) {
5366	DEBUG (0, ("ldapsam_create_group: Out of memory!\n"));
5367	return NT_STATUS_NO_MEMORY;
5368	}
5369
5370	dn = talloc_asprintf(tmp_ctx, "cn=%s,%s", escape_name, lp_ldap_group_suffix());
5371
5372	SAFE_FREE(escape_name);
5373
5374	if (!gidstr \|\| !dn) {
5375	DEBUG (0, ("ldapsam_create_group: Out of memory!\n"));
5376	return NT_STATUS_NO_MEMORY;
5377	}
5378
5379	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_POSIXGROUP);
5380	smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
5381	smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
5382	}
5383
5384	if (!NT_STATUS_IS_OK((ret = ldapsam_new_rid_internal(my_methods, rid)))) {
5385	DEBUG(1, ("ldapsam_create_group: Could not allocate a new RID\n"));
5386	return ret;
5387	}
5388
5389	sid_compose(&group_sid, get_global_sam_sid(), *rid);
5390
5391	groupsidstr = talloc_strdup(tmp_ctx, sid_string_talloc(tmp_ctx,
5392	&group_sid));
5393	grouptype = talloc_asprintf(tmp_ctx, "%d", SID_NAME_DOM_GRP);
5394
5395	if (!groupsidstr \|\| !grouptype) {
5396	DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
5397	return NT_STATUS_NO_MEMORY;
5398	}
5399
5400	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
5401	smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid", groupsidstr);
5402	smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", grouptype);
5403	smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
5404	talloc_autofree_ldapmod(tmp_ctx, mods);
5405
5406	if (is_new_entry) {
5407	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5408	#if 0
5409	if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
5410	/* This call may fail with rfc2307bis schema */
5411	/* Retry adding a structural class */
5412	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "????");
5413	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5414	}
5415	#endif
5416	} else {
5417	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5418	}
5419
5420	if (rc != LDAP_SUCCESS) {
5421	DEBUG(0,("ldapsam_create_group: failed to create a new group [%s] (dn = %s)\n", name ,dn));
5422	return NT_STATUS_UNSUCCESSFUL;
5423	}
5424
5425	DEBUG(2,("ldapsam_create_group: added group [%s] in the LDAP database\n", name));
5426
5427	return NT_STATUS_OK;
5428	}
5429
5430	static NTSTATUS ldapsam_delete_dom_group(struct pdb_methods my_methods, TALLOC_CTX tmp_ctx, uint32 rid)
5431	{
5432	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5433	LDAPMessage *result = NULL;
5434	LDAPMessage *entry = NULL;
5435	int num_result;
5436	const char *dn;
5437	char *gidstr;
5438	char *filter;
5439	DOM_SID group_sid;
5440	int rc;
5441
5442	/* get the group sid */
5443	sid_compose(&group_sid, get_global_sam_sid(), rid);
5444
5445	filter = talloc_asprintf(tmp_ctx,
5446	"(&(sambaSID=%s)"
5447	"(objectClass=%s)"
5448	"(objectClass=%s))",
5449	sid_string_talloc(tmp_ctx, &group_sid),
5450	LDAP_OBJ_POSIXGROUP,
5451	LDAP_OBJ_GROUPMAP);
5452	if (filter == NULL) {
5453	return NT_STATUS_NO_MEMORY;
5454	}
5455
5456	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5457	if (rc != LDAP_SUCCESS) {
5458	DEBUG(1,("ldapsam_delete_dom_group: group search failed!\n"));
5459	return NT_STATUS_UNSUCCESSFUL;
5460	}
5461	talloc_autofree_ldapmsg(tmp_ctx, result);
5462
5463	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5464
5465	if (num_result == 0) {
5466	DEBUG(1,("ldapsam_delete_dom_group: group not found!\n"));
5467	return NT_STATUS_NO_SUCH_GROUP;
5468	}
5469
5470	if (num_result > 1) {
5471	DEBUG (0, ("ldapsam_delete_dom_group: More than one group with the same SID ?!\n"));
5472	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5473	}
5474
5475	entry = ldap_first_entry(priv2ld(ldap_state), result);
5476	if (!entry) {
5477	return NT_STATUS_UNSUCCESSFUL;
5478	}
5479
5480	/* here it is, retrieve the dn for later use */
5481	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5482	if (!dn) {
5483	DEBUG(0,("ldapsam_delete_dom_group: Out of memory!\n"));
5484	return NT_STATUS_NO_MEMORY;
5485	}
5486
5487	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5488	if (!gidstr) {
5489	DEBUG (0, ("ldapsam_delete_dom_group: Unable to find the group's gid!\n"));
5490	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5491	}
5492
5493	/* check no user have this group marked as primary group */
5494	filter = talloc_asprintf(tmp_ctx,
5495	"(&(gidNumber=%s)"
5496	"(objectClass=%s)"
5497	"(objectClass=%s))",
5498	gidstr,
5499	LDAP_OBJ_POSIXACCOUNT,
5500	LDAP_OBJ_SAMBASAMACCOUNT);
5501
5502	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5503	if (rc != LDAP_SUCCESS) {
5504	DEBUG(1,("ldapsam_delete_dom_group: accounts search failed!\n"));
5505	return NT_STATUS_UNSUCCESSFUL;
5506	}
5507	talloc_autofree_ldapmsg(tmp_ctx, result);
5508
5509	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5510
5511	if (num_result != 0) {
5512	DEBUG(3,("ldapsam_delete_dom_group: Can't delete group, it is a primary group for %d users\n", num_result));
5513	return NT_STATUS_MEMBERS_PRIMARY_GROUP;
5514	}
5515
5516	rc = smbldap_delete(ldap_state->smbldap_state, dn);
5517	if (rc != LDAP_SUCCESS) {
5518	return NT_STATUS_UNSUCCESSFUL;
5519	}
5520
5521	return NT_STATUS_OK;
5522	}
5523
5524	static NTSTATUS ldapsam_change_groupmem(struct pdb_methods *my_methods,
5525	TALLOC_CTX *tmp_ctx,
5526	uint32 group_rid,
5527	uint32 member_rid,
5528	int modop)
5529	{
5530	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5531	LDAPMessage *entry = NULL;
5532	LDAPMessage *result = NULL;
5533	uint32 num_result;
5534	LDAPMod **mods = NULL;
5535	char *filter;
5536	char *uidstr;
5537	const char *dn = NULL;
5538	DOM_SID group_sid;
5539	DOM_SID member_sid;
5540	int rc;
5541
5542	switch (modop) {
5543	case LDAP_MOD_ADD:
5544	DEBUG(1,("ldapsam_change_groupmem: add new member(rid=%d) to a domain group(rid=%d)", member_rid, group_rid));
5545	break;
5546	case LDAP_MOD_DELETE:
5547	DEBUG(1,("ldapsam_change_groupmem: delete member(rid=%d) from a domain group(rid=%d)", member_rid, group_rid));
5548	break;
5549	default:
5550	return NT_STATUS_UNSUCCESSFUL;
5551	}
5552
5553	/* get member sid */
5554	sid_compose(&member_sid, get_global_sam_sid(), member_rid);
5555
5556	/* get the group sid */
5557	sid_compose(&group_sid, get_global_sam_sid(), group_rid);
5558
5559	filter = talloc_asprintf(tmp_ctx,
5560	"(&(sambaSID=%s)"
5561	"(objectClass=%s)"
5562	"(objectClass=%s))",
5563	sid_string_talloc(tmp_ctx, &member_sid),
5564	LDAP_OBJ_POSIXACCOUNT,
5565	LDAP_OBJ_SAMBASAMACCOUNT);
5566	if (filter == NULL) {
5567	return NT_STATUS_NO_MEMORY;
5568	}
5569
5570	/* get the member uid */
5571	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5572	if (rc != LDAP_SUCCESS) {
5573	DEBUG(1,("ldapsam_change_groupmem: member search failed!\n"));
5574	return NT_STATUS_UNSUCCESSFUL;
5575	}
5576	talloc_autofree_ldapmsg(tmp_ctx, result);
5577
5578	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5579
5580	if (num_result == 0) {
5581	DEBUG(1,("ldapsam_change_groupmem: member not found!\n"));
5582	return NT_STATUS_NO_SUCH_MEMBER;
5583	}
5584
5585	if (num_result > 1) {
5586	DEBUG (0, ("ldapsam_change_groupmem: More than one account with the same SID ?!\n"));
5587	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5588	}
5589
5590	entry = ldap_first_entry(priv2ld(ldap_state), result);
5591	if (!entry) {
5592	return NT_STATUS_UNSUCCESSFUL;
5593	}
5594
5595	if (modop == LDAP_MOD_DELETE) {
5596	/* check if we are trying to remove the member from his primary group */
5597	char *gidstr;
5598	gid_t user_gid, group_gid;
5599
5600	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5601	if (!gidstr) {
5602	DEBUG (0, ("ldapsam_change_groupmem: Unable to find the member's gid!\n"));
5603	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5604	}
5605
5606	user_gid = strtoul(gidstr, NULL, 10);
5607
5608	if (!sid_to_gid(&group_sid, &group_gid)) {
5609	DEBUG (0, ("ldapsam_change_groupmem: Unable to get group gid from SID!\n"));
5610	return NT_STATUS_UNSUCCESSFUL;
5611	}
5612
5613	if (user_gid == group_gid) {
5614	DEBUG (3, ("ldapsam_change_groupmem: can't remove user from its own primary group!\n"));
5615	return NT_STATUS_MEMBERS_PRIMARY_GROUP;
5616	}
5617	}
5618
5619	/* here it is, retrieve the uid for later use */
5620	uidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "uid", tmp_ctx);
5621	if (!uidstr) {
5622	DEBUG (0, ("ldapsam_change_groupmem: Unable to find the member's name!\n"));
5623	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5624	}
5625
5626	filter = talloc_asprintf(tmp_ctx,
5627	"(&(sambaSID=%s)"
5628	"(objectClass=%s)"
5629	"(objectClass=%s))",
5630	sid_string_talloc(tmp_ctx, &group_sid),
5631	LDAP_OBJ_POSIXGROUP,
5632	LDAP_OBJ_GROUPMAP);
5633
5634	/* get the group */
5635	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5636	if (rc != LDAP_SUCCESS) {
5637	DEBUG(1,("ldapsam_change_groupmem: group search failed!\n"));
5638	return NT_STATUS_UNSUCCESSFUL;
5639	}
5640	talloc_autofree_ldapmsg(tmp_ctx, result);
5641
5642	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5643
5644	if (num_result == 0) {
5645	DEBUG(1,("ldapsam_change_groupmem: group not found!\n"));
5646	return NT_STATUS_NO_SUCH_GROUP;
5647	}
5648
5649	if (num_result > 1) {
5650	DEBUG (0, ("ldapsam_change_groupmem: More than one group with the same SID ?!\n"));
5651	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5652	}
5653
5654	entry = ldap_first_entry(priv2ld(ldap_state), result);
5655	if (!entry) {
5656	return NT_STATUS_UNSUCCESSFUL;
5657	}
5658
5659	/* here it is, retrieve the dn for later use */
5660	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5661	if (!dn) {
5662	DEBUG(0,("ldapsam_change_groupmem: Out of memory!\n"));
5663	return NT_STATUS_NO_MEMORY;
5664	}
5665
5666	smbldap_set_mod(&mods, modop, "memberUid", uidstr);
5667
5668	talloc_autofree_ldapmod(tmp_ctx, mods);
5669
5670	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5671	if (rc != LDAP_SUCCESS) {
5672	if (rc == LDAP_TYPE_OR_VALUE_EXISTS && modop == LDAP_MOD_ADD) {
5673	DEBUG(1,("ldapsam_change_groupmem: member is already in group, add failed!\n"));
5674	return NT_STATUS_MEMBER_IN_GROUP;
5675	}
5676	if (rc == LDAP_NO_SUCH_ATTRIBUTE && modop == LDAP_MOD_DELETE) {
5677	DEBUG(1,("ldapsam_change_groupmem: member is not in group, delete failed!\n"));
5678	return NT_STATUS_MEMBER_NOT_IN_GROUP;
5679	}
5680	return NT_STATUS_UNSUCCESSFUL;
5681	}
5682
5683	return NT_STATUS_OK;
5684	}
5685
5686	static NTSTATUS ldapsam_add_groupmem(struct pdb_methods *my_methods,
5687	TALLOC_CTX *tmp_ctx,
5688	uint32 group_rid,
5689	uint32 member_rid)
5690	{
5691	return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_ADD);
5692	}
5693	static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
5694	TALLOC_CTX *tmp_ctx,
5695	uint32 group_rid,
5696	uint32 member_rid)
5697	{
5698	return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_DELETE);
5699	}
5700
5701	static NTSTATUS ldapsam_set_primary_group(struct pdb_methods *my_methods,
5702	TALLOC_CTX *mem_ctx,
5703	struct samu *sampass)
5704	{
5705	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5706	LDAPMessage *entry = NULL;
5707	LDAPMessage *result = NULL;
5708	uint32 num_result;
5709	LDAPMod **mods = NULL;
5710	char *filter;
5711	char *escape_username;
5712	char *gidstr;
5713	const char *dn = NULL;
5714	gid_t gid;
5715	int rc;
5716
5717	DEBUG(0,("ldapsam_set_primary_group: Attempt to set primary group for user [%s]\n", pdb_get_username(sampass)));
5718
5719	if (!sid_to_gid(pdb_get_group_sid(sampass), &gid)) {
5720	DEBUG(0,("ldapsam_set_primary_group: failed to retrieve gid from user's group SID!\n"));
5721	return NT_STATUS_UNSUCCESSFUL;
5722	}
5723	gidstr = talloc_asprintf(mem_ctx, "%d", gid);
5724	if (!gidstr) {
5725	DEBUG(0,("ldapsam_set_primary_group: Out of Memory!\n"));
5726	return NT_STATUS_NO_MEMORY;
5727	}
5728
5729	escape_username = escape_ldap_string_alloc(pdb_get_username(sampass));
5730	if (escape_username== NULL) {
5731	return NT_STATUS_NO_MEMORY;
5732	}
5733
5734	filter = talloc_asprintf(mem_ctx,
5735	"(&(uid=%s)"
5736	"(objectClass=%s)"
5737	"(objectClass=%s))",
5738	escape_username,
5739	LDAP_OBJ_POSIXACCOUNT,
5740	LDAP_OBJ_SAMBASAMACCOUNT);
5741
5742	SAFE_FREE(escape_username);
5743
5744	if (filter == NULL) {
5745	return NT_STATUS_NO_MEMORY;
5746	}
5747
5748	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5749	if (rc != LDAP_SUCCESS) {
5750	DEBUG(0,("ldapsam_set_primary_group: user search failed!\n"));
5751	return NT_STATUS_UNSUCCESSFUL;
5752	}
5753	talloc_autofree_ldapmsg(mem_ctx, result);
5754
5755	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5756
5757	if (num_result == 0) {
5758	DEBUG(0,("ldapsam_set_primary_group: user not found!\n"));
5759	return NT_STATUS_NO_SUCH_USER;
5760	}
5761
5762	if (num_result > 1) {
5763	DEBUG (0, ("ldapsam_set_primary_group: More than one user with name [%s] ?!\n", pdb_get_username(sampass)));
5764	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5765	}
5766
5767	entry = ldap_first_entry(priv2ld(ldap_state), result);
5768	if (!entry) {
5769	return NT_STATUS_UNSUCCESSFUL;
5770	}
5771
5772	/* retrieve the dn for later use */
5773	dn = smbldap_talloc_dn(mem_ctx, priv2ld(ldap_state), entry);
5774	if (!dn) {
5775	DEBUG(0,("ldapsam_set_primary_group: Out of memory!\n"));
5776	return NT_STATUS_NO_MEMORY;
5777	}
5778
5779	/* remove the old one, and add the new one, this way we do not risk races */
5780	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "gidNumber", gidstr);
5781
5782	if (mods == NULL) {
5783	return NT_STATUS_OK;
5784	}
5785
5786	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5787
5788	if (rc != LDAP_SUCCESS) {
5789	DEBUG(0,("ldapsam_set_primary_group: failed to modify [%s] primary group to [%s]\n",
5790	pdb_get_username(sampass), gidstr));
5791	return NT_STATUS_UNSUCCESSFUL;
5792	}
5793
5794	flush_pwnam_cache();
5795
5796	return NT_STATUS_OK;
5797	}
5798
5799
5800	/**********************************************************************
5801	trusted domains functions
5802	*********************************************************************/
5803
5804	static char trusteddom_dn(struct ldapsam_privates ldap_state,
5805	const char *domain)
5806	{
5807	return talloc_asprintf(talloc_tos(), "sambaDomainName=%s,%s", domain,
5808	ldap_state->domain_dn);
5809	}
5810
5811	static bool get_trusteddom_pw_int(struct ldapsam_privates *ldap_state,
5812	TALLOC_CTX *mem_ctx,
5813	const char domain, LDAPMessage *entry)
5814	{
5815	int rc;
5816	char *filter;
5817	int scope = LDAP_SCOPE_SUBTREE;
5818	const char *attrs = NULL; / NULL: get all attrs */
5819	int attrsonly = 0; /* 0: return values too */
5820	LDAPMessage *result = NULL;
5821	char *trusted_dn;
5822	uint32 num_result;
5823
5824	filter = talloc_asprintf(talloc_tos(),
5825	"(&(objectClass=%s)(sambaDomainName=%s))",
5826	LDAP_OBJ_TRUSTDOM_PASSWORD, domain);
5827
5828	trusted_dn = trusteddom_dn(ldap_state, domain);
5829	if (trusted_dn == NULL) {
5830	return False;
5831	}
5832	rc = smbldap_search(ldap_state->smbldap_state, trusted_dn, scope,
5833	filter, attrs, attrsonly, &result);
5834
5835	if (result != NULL) {
5836	talloc_autofree_ldapmsg(mem_ctx, result);
5837	}
5838
5839	if (rc == LDAP_NO_SUCH_OBJECT) {
5840	*entry = NULL;
5841	return True;
5842	}
5843
5844	if (rc != LDAP_SUCCESS) {
5845	return False;
5846	}
5847
5848	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5849
5850	if (num_result > 1) {
5851	DEBUG(1, ("ldapsam_get_trusteddom_pw: more than one "
5852	"%s object for domain '%s'?!\n",
5853	LDAP_OBJ_TRUSTDOM_PASSWORD, domain));
5854	return False;
5855	}
5856
5857	if (num_result == 0) {
5858	DEBUG(1, ("ldapsam_get_trusteddom_pw: no "
5859	"%s object for domain %s.\n",
5860	LDAP_OBJ_TRUSTDOM_PASSWORD, domain));
5861	*entry = NULL;
5862	} else {
5863	*entry = ldap_first_entry(priv2ld(ldap_state), result);
5864	}
5865
5866	return True;
5867	}
5868
5869	static bool ldapsam_get_trusteddom_pw(struct pdb_methods *methods,
5870	const char *domain,
5871	char** pwd,
5872	DOM_SID *sid,
5873	time_t *pass_last_set_time)
5874	{
5875	struct ldapsam_privates *ldap_state =
5876	(struct ldapsam_privates *)methods->private_data;
5877	LDAPMessage *entry = NULL;
5878
5879	DEBUG(10, ("ldapsam_get_trusteddom_pw called for domain %s\n", domain));
5880
5881	if (!get_trusteddom_pw_int(ldap_state, talloc_tos(), domain, &entry) \|\|
5882	(entry == NULL))
5883	{
5884	return False;
5885	}
5886
5887	/* password */
5888	if (pwd != NULL) {
5889	char *pwd_str;
5890	pwd_str = smbldap_talloc_single_attribute(priv2ld(ldap_state),
5891	entry, "sambaClearTextPassword", talloc_tos());
5892	if (pwd_str == NULL) {
5893	return False;
5894	}
5895	/* trusteddom_pw routines do not use talloc yet... */
5896	*pwd = SMB_STRDUP(pwd_str);
5897	if (*pwd == NULL) {
5898	return False;
5899	}
5900	}
5901
5902	/* last change time */
5903	if (pass_last_set_time != NULL) {
5904	char *time_str;
5905	time_str = smbldap_talloc_single_attribute(priv2ld(ldap_state),
5906	entry, "sambaPwdLastSet", talloc_tos());
5907	if (time_str == NULL) {
5908	return False;
5909	}
5910	*pass_last_set_time = (time_t)atol(time_str);
5911	}
5912
5913	/* domain sid */
5914	if (sid != NULL) {
5915	char *sid_str;
5916	DOM_SID *dom_sid;
5917	sid_str = smbldap_talloc_single_attribute(priv2ld(ldap_state),
5918	entry, "sambaSID",
5919	talloc_tos());
5920	if (sid_str == NULL) {
5921	return False;
5922	}
5923	dom_sid = string_sid_talloc(talloc_tos(), sid_str);
5924	if (dom_sid == NULL) {
5925	return False;
5926	}
5927	sid_copy(sid, dom_sid);
5928	}
5929
5930	return True;
5931	}
5932
5933	static bool ldapsam_set_trusteddom_pw(struct pdb_methods *methods,
5934	const char* domain,
5935	const char* pwd,
5936	const DOM_SID *sid)
5937	{
5938	struct ldapsam_privates *ldap_state =
5939	(struct ldapsam_privates *)methods->private_data;
5940	LDAPMessage *entry = NULL;
5941	LDAPMod **mods = NULL;
5942	char *prev_pwd = NULL;
5943	char *trusted_dn = NULL;
5944	int rc;
5945
5946	DEBUG(10, ("ldapsam_set_trusteddom_pw called for domain %s\n", domain));
5947
5948	/*
5949	* get the current entry (if there is one) in order to put the
5950	* current password into the previous password attribute
5951	*/
5952	if (!get_trusteddom_pw_int(ldap_state, talloc_tos(), domain, &entry)) {
5953	return False;
5954	}
5955
5956	mods = NULL;
5957	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "objectClass",
5958	LDAP_OBJ_TRUSTDOM_PASSWORD);
5959	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "sambaDomainName",
5960	domain);
5961	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "sambaSID",
5962	sid_string_tos(sid));
5963	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "sambaPwdLastSet",
5964	talloc_asprintf(talloc_tos(), "%li", (long int)time(NULL)));
5965	smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
5966	"sambaClearTextPassword", pwd);
5967
5968	talloc_autofree_ldapmod(talloc_tos(), mods);
5969
5970	if (entry != NULL) {
5971	prev_pwd = smbldap_talloc_single_attribute(priv2ld(ldap_state),
5972	entry, "sambaClearTextPassword", talloc_tos());
5973	if (prev_pwd != NULL) {
5974	smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
5975	"sambaPreviousClearTextPassword",
5976	prev_pwd);
5977	}
5978	}
5979
5980	trusted_dn = trusteddom_dn(ldap_state, domain);
5981	if (trusted_dn == NULL) {
5982	return False;
5983	}
5984	if (entry == NULL) {
5985	rc = smbldap_add(ldap_state->smbldap_state, trusted_dn, mods);
5986	} else {
5987	rc = smbldap_modify(ldap_state->smbldap_state, trusted_dn, mods);
5988	}
5989
5990	if (rc != LDAP_SUCCESS) {
5991	DEBUG(1, ("error writing trusted domain password!\n"));
5992	return False;
5993	}
5994
5995	return True;
5996	}
5997
5998	static bool ldapsam_del_trusteddom_pw(struct pdb_methods *methods,
5999	const char *domain)
6000	{
6001	int rc;
6002	struct ldapsam_privates *ldap_state =
6003	(struct ldapsam_privates *)methods->private_data;
6004	LDAPMessage *entry = NULL;
6005	const char *trusted_dn;
6006
6007	if (!get_trusteddom_pw_int(ldap_state, talloc_tos(), domain, &entry)) {
6008	return False;
6009	}
6010
6011	if (entry == NULL) {
6012	DEBUG(5, ("ldapsam_del_trusteddom_pw: no such trusted domain: "
6013	"%s\n", domain));
6014	return True;
6015	}
6016
6017	trusted_dn = smbldap_talloc_dn(talloc_tos(), priv2ld(ldap_state),
6018	entry);
6019	if (trusted_dn == NULL) {
6020	DEBUG(0,("ldapsam_del_trusteddom_pw: Out of memory!\n"));
6021	return False;
6022	}
6023
6024	rc = smbldap_delete(ldap_state->smbldap_state, trusted_dn);
6025	if (rc != LDAP_SUCCESS) {
6026	return False;
6027	}
6028
6029	return True;
6030	}
6031
6032	static NTSTATUS ldapsam_enum_trusteddoms(struct pdb_methods *methods,
6033	TALLOC_CTX *mem_ctx,
6034	uint32 *num_domains,
6035	struct trustdom_info ***domains)
6036	{
6037	int rc;
6038	struct ldapsam_privates *ldap_state =
6039	(struct ldapsam_privates *)methods->private_data;
6040	char *filter;
6041	int scope = LDAP_SCOPE_SUBTREE;
6042	const char *attrs[] = { "sambaDomainName", "sambaSID", NULL };
6043	int attrsonly = 0; /* 0: return values too */
6044	LDAPMessage *result = NULL;
6045	LDAPMessage *entry = NULL;
6046
6047	filter = talloc_asprintf(talloc_tos(), "(objectClass=%s)",
6048	LDAP_OBJ_TRUSTDOM_PASSWORD);
6049
6050	rc = smbldap_search(ldap_state->smbldap_state,
6051	ldap_state->domain_dn,
6052	scope,
6053	filter,
6054	attrs,
6055	attrsonly,
6056	&result);
6057
6058	if (result != NULL) {
6059	talloc_autofree_ldapmsg(mem_ctx, result);
6060	}
6061
6062	if (rc != LDAP_SUCCESS) {
6063	return NT_STATUS_UNSUCCESSFUL;
6064	}
6065
6066	*num_domains = 0;
6067	if (!(domains = TALLOC_ARRAY(mem_ctx, struct trustdom_info , 1))) {
6068	DEBUG(1, ("talloc failed\n"));
6069	return NT_STATUS_NO_MEMORY;
6070	}
6071
6072	for (entry = ldap_first_entry(priv2ld(ldap_state), result);
6073	entry != NULL;
6074	entry = ldap_next_entry(priv2ld(ldap_state), entry))
6075	{
6076	char dom_name, dom_sid_str;
6077	struct trustdom_info *dom_info;
6078
6079	dom_info = TALLOC_P(*domains, struct trustdom_info);
6080	if (dom_info == NULL) {
6081	DEBUG(1, ("talloc failed\n"));
6082	return NT_STATUS_NO_MEMORY;
6083	}
6084
6085	dom_name = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6086	entry,
6087	"sambaDomainName",
6088	talloc_tos());
6089	if (dom_name == NULL) {
6090	DEBUG(1, ("talloc failed\n"));
6091	return NT_STATUS_NO_MEMORY;
6092	}
6093	dom_info->name = dom_name;
6094
6095	dom_sid_str = smbldap_talloc_single_attribute(
6096	priv2ld(ldap_state), entry, "sambaSID",
6097	talloc_tos());
6098	if (dom_sid_str == NULL) {
6099	DEBUG(1, ("talloc failed\n"));
6100	return NT_STATUS_NO_MEMORY;
6101	}
6102	if (!string_to_sid(&dom_info->sid, dom_sid_str)) {
6103	DEBUG(1, ("Error calling string_to_sid on SID %s\n",
6104	dom_sid_str));
6105	return NT_STATUS_UNSUCCESSFUL;
6106	}
6107
6108	ADD_TO_ARRAY(domains, struct trustdom_info , dom_info,
6109	domains, num_domains);
6110
6111	if (*domains == NULL) {
6112	DEBUG(1, ("talloc failed\n"));
6113	return NT_STATUS_NO_MEMORY;
6114	}
6115	}
6116
6117	DEBUG(5, ("ldapsam_enum_trusteddoms: got %d domains\n", *num_domains));
6118	return NT_STATUS_OK;
6119	}
6120
6121
6122	/**********************************************************************
6123	Housekeeping
6124	*********************************************************************/
6125
6126	static void free_private_data(void **vp)
6127	{
6128	struct ldapsam_privates ldap_state = (struct ldapsam_privates )vp;
6129
6130	smbldap_free_struct(&(*ldap_state)->smbldap_state);
6131
6132	if ((*ldap_state)->result != NULL) {
6133	ldap_msgfree((*ldap_state)->result);
6134	(*ldap_state)->result = NULL;
6135	}
6136	if ((*ldap_state)->domain_dn != NULL) {
6137	SAFE_FREE((*ldap_state)->domain_dn);
6138	}
6139
6140	*ldap_state = NULL;
6141
6142	/* No need to free any further, as it is talloc()ed */
6143	}
6144
6145	/*********************************************************************
6146	Intitalise the parts of the pdb_methods structure that are common to
6147	all pdb_ldap modes
6148	*********************************************************************/
6149
6150	static NTSTATUS pdb_init_ldapsam_common(struct pdb_methods *pdb_method, const char location)
6151	{
6152	NTSTATUS nt_status;
6153	struct ldapsam_privates *ldap_state;
6154
6155	if (!NT_STATUS_IS_OK(nt_status = make_pdb_method( pdb_method ))) {
6156	return nt_status;
6157	}
6158
6159	(*pdb_method)->name = "ldapsam";
6160
6161	(*pdb_method)->getsampwnam = ldapsam_getsampwnam;
6162	(*pdb_method)->getsampwsid = ldapsam_getsampwsid;
6163	(*pdb_method)->add_sam_account = ldapsam_add_sam_account;
6164	(*pdb_method)->update_sam_account = ldapsam_update_sam_account;
6165	(*pdb_method)->delete_sam_account = ldapsam_delete_sam_account;
6166	(*pdb_method)->rename_sam_account = ldapsam_rename_sam_account;
6167
6168	(*pdb_method)->getgrsid = ldapsam_getgrsid;
6169	(*pdb_method)->getgrgid = ldapsam_getgrgid;
6170	(*pdb_method)->getgrnam = ldapsam_getgrnam;
6171	(*pdb_method)->add_group_mapping_entry = ldapsam_add_group_mapping_entry;
6172	(*pdb_method)->update_group_mapping_entry = ldapsam_update_group_mapping_entry;
6173	(*pdb_method)->delete_group_mapping_entry = ldapsam_delete_group_mapping_entry;
6174	(*pdb_method)->enum_group_mapping = ldapsam_enum_group_mapping;
6175
6176	(*pdb_method)->get_account_policy = ldapsam_get_account_policy;
6177	(*pdb_method)->set_account_policy = ldapsam_set_account_policy;
6178
6179	(*pdb_method)->get_seq_num = ldapsam_get_seq_num;
6180
6181	(*pdb_method)->rid_algorithm = ldapsam_rid_algorithm;
6182	(*pdb_method)->new_rid = ldapsam_new_rid;
6183
6184	(*pdb_method)->get_trusteddom_pw = ldapsam_get_trusteddom_pw;
6185	(*pdb_method)->set_trusteddom_pw = ldapsam_set_trusteddom_pw;
6186	(*pdb_method)->del_trusteddom_pw = ldapsam_del_trusteddom_pw;
6187	(*pdb_method)->enum_trusteddoms = ldapsam_enum_trusteddoms;
6188
6189	/* TODO: Setup private data and free */
6190
6191	if ( !(ldap_state = TALLOC_ZERO_P(*pdb_method, struct ldapsam_privates)) ) {
6192	DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
6193	return NT_STATUS_NO_MEMORY;
6194	}
6195
6196	nt_status = smbldap_init(*pdb_method, pdb_get_event_context(),
6197	location, &ldap_state->smbldap_state);
6198
6199	if ( !NT_STATUS_IS_OK(nt_status) ) {
6200	return nt_status;
6201	}
6202
6203	if ( !(ldap_state->domain_name = talloc_strdup(*pdb_method, get_global_sam_name()) ) ) {
6204	return NT_STATUS_NO_MEMORY;
6205	}
6206
6207	(*pdb_method)->private_data = ldap_state;
6208
6209	(*pdb_method)->free_private_data = free_private_data;
6210
6211	return NT_STATUS_OK;
6212	}
6213
6214	/**********************************************************************
6215	Initialise the 'compat' mode for pdb_ldap
6216	*********************************************************************/
6217
6218	NTSTATUS pdb_init_ldapsam_compat(struct pdb_methods *pdb_method, const char location)
6219	{
6220	NTSTATUS nt_status;
6221	struct ldapsam_privates *ldap_state;
6222	char *uri = talloc_strdup( NULL, location );
6223
6224	trim_char( uri, '\"', '\"' );
6225	nt_status = pdb_init_ldapsam_common( pdb_method, uri );
6226	if ( uri )
6227	TALLOC_FREE( uri );
6228
6229	if ( !NT_STATUS_IS_OK(nt_status) ) {
6230	return nt_status;
6231	}
6232
6233	(*pdb_method)->name = "ldapsam_compat";
6234
6235	ldap_state = (struct ldapsam_privates )((pdb_method)->private_data);
6236	ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT;
6237
6238	sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
6239
6240	return NT_STATUS_OK;
6241	}
6242
6243	/**********************************************************************
6244	Initialise the normal mode for pdb_ldap
6245	*********************************************************************/
6246
6247	NTSTATUS pdb_init_ldapsam(struct pdb_methods *pdb_method, const char location)
6248	{
6249	NTSTATUS nt_status;
6250	struct ldapsam_privates *ldap_state = NULL;
6251	uint32 alg_rid_base;
6252	char *alg_rid_base_string = NULL;
6253	LDAPMessage *result = NULL;
6254	LDAPMessage *entry = NULL;
6255	DOM_SID ldap_domain_sid;
6256	DOM_SID secrets_domain_sid;
6257	char *domain_sid_string = NULL;
6258	char *dn = NULL;
6259	char *uri = talloc_strdup( NULL, location );
6260
6261	trim_char( uri, '\"', '\"' );
6262	nt_status = pdb_init_ldapsam_common(pdb_method, uri);
6263	if (uri) {
6264	TALLOC_FREE(uri);
6265	}
6266
6267	if (!NT_STATUS_IS_OK(nt_status)) {
6268	return nt_status;
6269	}
6270
6271	(*pdb_method)->name = "ldapsam";
6272
6273	(*pdb_method)->add_aliasmem = ldapsam_add_aliasmem;
6274	(*pdb_method)->del_aliasmem = ldapsam_del_aliasmem;
6275	(*pdb_method)->enum_aliasmem = ldapsam_enum_aliasmem;
6276	(*pdb_method)->enum_alias_memberships = ldapsam_alias_memberships;
6277	(*pdb_method)->search_users = ldapsam_search_users;
6278	(*pdb_method)->search_groups = ldapsam_search_groups;
6279	(*pdb_method)->search_aliases = ldapsam_search_aliases;
6280
6281	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
6282	(*pdb_method)->enum_group_members = ldapsam_enum_group_members;
6283	(*pdb_method)->enum_group_memberships =
6284	ldapsam_enum_group_memberships;
6285	(*pdb_method)->lookup_rids = ldapsam_lookup_rids;
6286	(*pdb_method)->sid_to_id = ldapsam_sid_to_id;
6287
6288	if (lp_parm_bool(-1, "ldapsam", "editposix", False)) {
6289	(*pdb_method)->create_user = ldapsam_create_user;
6290	(*pdb_method)->delete_user = ldapsam_delete_user;
6291	(*pdb_method)->create_dom_group = ldapsam_create_dom_group;
6292	(*pdb_method)->delete_dom_group = ldapsam_delete_dom_group;
6293	(*pdb_method)->add_groupmem = ldapsam_add_groupmem;
6294	(*pdb_method)->del_groupmem = ldapsam_del_groupmem;
6295	(*pdb_method)->set_unix_primary_group = ldapsam_set_primary_group;
6296	}
6297	}
6298
6299	ldap_state = (struct ldapsam_privates )((pdb_method)->private_data);
6300	ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
6301
6302	/* Try to setup the Domain Name, Domain SID, algorithmic rid base */
6303
6304	nt_status = smbldap_search_domain_info(ldap_state->smbldap_state,
6305	&result,
6306	ldap_state->domain_name, True);
6307
6308	if ( !NT_STATUS_IS_OK(nt_status) ) {
6309	DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain "
6310	"info, nor add one to the domain\n"));
6311	DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, "
6312	"will be unable to allocate new users/groups, "
6313	"and will risk BDCs having inconsistant SIDs\n"));
6314	sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
6315	return NT_STATUS_OK;
6316	}
6317
6318	/* Given that the above might fail, everything below this must be
6319	* optional */
6320
6321	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
6322	result);
6323	if (!entry) {
6324	DEBUG(0, ("pdb_init_ldapsam: Could not get domain info "
6325	"entry\n"));
6326	ldap_msgfree(result);
6327	return NT_STATUS_UNSUCCESSFUL;
6328	}
6329
6330	dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
6331	if (!dn) {
6332	ldap_msgfree(result);
6333	return NT_STATUS_UNSUCCESSFUL;
6334	}
6335
6336	ldap_state->domain_dn = smb_xstrdup(dn);
6337	ldap_memfree(dn);
6338
6339	domain_sid_string = smbldap_talloc_single_attribute(
6340	ldap_state->smbldap_state->ldap_struct,
6341	entry,
6342	get_userattr_key2string(ldap_state->schema_ver,
6343	LDAP_ATTR_USER_SID),
6344	talloc_tos());
6345
6346	if (domain_sid_string) {
6347	bool found_sid;
6348	if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
6349	DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be "
6350	"read as a valid SID\n", domain_sid_string));
6351	ldap_msgfree(result);
6352	TALLOC_FREE(domain_sid_string);
6353	return NT_STATUS_INVALID_PARAMETER;
6354	}
6355	found_sid = secrets_fetch_domain_sid(ldap_state->domain_name,
6356	&secrets_domain_sid);
6357	if (!found_sid \|\| !sid_equal(&secrets_domain_sid,
6358	&ldap_domain_sid)) {
6359	DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain "
6360	"%s based on pdb_ldap results %s -> %s\n",
6361	ldap_state->domain_name,
6362	sid_string_dbg(&secrets_domain_sid),
6363	sid_string_dbg(&ldap_domain_sid)));
6364
6365	/* reset secrets.tdb sid */
6366	secrets_store_domain_sid(ldap_state->domain_name,
6367	&ldap_domain_sid);
6368	DEBUG(1, ("New global sam SID: %s\n",
6369	sid_string_dbg(get_global_sam_sid())));
6370	}
6371	sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
6372	TALLOC_FREE(domain_sid_string);
6373	}
6374
6375	alg_rid_base_string = smbldap_talloc_single_attribute(
6376	ldap_state->smbldap_state->ldap_struct,
6377	entry,
6378	get_attr_key2string( dominfo_attr_list,
6379	LDAP_ATTR_ALGORITHMIC_RID_BASE ),
6380	talloc_tos());
6381	if (alg_rid_base_string) {
6382	alg_rid_base = (uint32)atol(alg_rid_base_string);
6383	if (alg_rid_base != algorithmic_rid_base()) {
6384	DEBUG(0, ("The value of 'algorithmic RID base' has "
6385	"changed since the LDAP\n"
6386	"database was initialised. Aborting. \n"));
6387	ldap_msgfree(result);
6388	TALLOC_FREE(alg_rid_base_string);
6389	return NT_STATUS_UNSUCCESSFUL;
6390	}
6391	TALLOC_FREE(alg_rid_base_string);
6392	}
6393	ldap_msgfree(result);
6394
6395	return NT_STATUS_OK;
6396	}
6397
6398	NTSTATUS pdb_ldap_init(void)
6399	{
6400	NTSTATUS nt_status;
6401	if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam)))
6402	return nt_status;
6403
6404	if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_compat", pdb_init_ldapsam_compat)))
6405	return nt_status;
6406
6407	/* Let pdb_nds register backends */
6408	pdb_nds_init();
6409
6410	return NT_STATUS_OK;
6411	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: