source: trunk-3.0/source/libgpo/gpo_ldap.c@ 103

Last change on this file since 103 was 39, checked in by Paul Smedley, 18 years ago

Upgrade source to 3.0.25a
File size: 18.6 KB
Line 
1/*
2 * Unix SMB/CIFS implementation.
3 * Group Policy Object Support
4 * Copyright (C) Guenther Deschner 2005
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 */
20
21#include "includes.h"
22
23#ifdef HAVE_LDAP
24
25/****************************************************************
26 parse the raw extension string into a GP_EXT structure
27****************************************************************/
28
29ADS_STATUS ads_parse_gp_ext(TALLOC_CTX *mem_ctx,
30 const char *extension_raw,
31 struct GP_EXT *gp_ext)
32{
33 char **ext_list;
34 char **ext_strings = NULL;
35 int i;
36
37 DEBUG(20,("ads_parse_gp_ext: %s\n", extension_raw));
38
39 ext_list = str_list_make_talloc(mem_ctx, extension_raw, "]");
40 if (ext_list == NULL) {
41 goto parse_error;
42 }
43
44 for (i = 0; ext_list[i] != NULL; i++) {
45 /* no op */
46 }
47
48 gp_ext->num_exts = i;
49
50 if (gp_ext->num_exts) {
51 gp_ext->extensions = TALLOC_ZERO_ARRAY(mem_ctx, char *, gp_ext->num_exts);
52 gp_ext->extensions_guid = TALLOC_ZERO_ARRAY(mem_ctx, char *, gp_ext->num_exts);
53 gp_ext->snapins = TALLOC_ZERO_ARRAY(mem_ctx, char *, gp_ext->num_exts);
54 gp_ext->snapins_guid = TALLOC_ZERO_ARRAY(mem_ctx, char *, gp_ext->num_exts);
55 } else {
56 gp_ext->extensions = NULL;
57 gp_ext->extensions_guid = NULL;
58 gp_ext->snapins = NULL;
59 gp_ext->snapins_guid = NULL;
60 }
61
62 if (gp_ext->extensions == NULL || gp_ext->extensions_guid == NULL ||
63 gp_ext->snapins == NULL || gp_ext->snapins_guid == NULL ||
64 gp_ext->gp_extension == NULL) {
65 goto parse_error;
66 }
67
68 gp_ext->gp_extension = talloc_strdup(mem_ctx, extension_raw);
69
70 for (i = 0; ext_list[i] != NULL; i++) {
71
72 int k;
73 char *p, *q;
74
75 DEBUGADD(10,("extension #%d\n", i));
76
77 p = ext_list[i];
78
79 if (p[0] == '[') {
80 p++;
81 }
82
83 ext_strings = str_list_make_talloc(mem_ctx, p, "}");
84 if (ext_strings == NULL) {
85 goto parse_error;
86 }
87
88 for (k = 0; ext_strings[k] != NULL; k++) {
89 /* no op */
90 }
91
92 q = ext_strings[0];
93
94 if (q[0] == '{') {
95 q++;
96 }
97
98 gp_ext->extensions[i] = talloc_strdup(mem_ctx, cse_gpo_guid_string_to_name(q));
99 gp_ext->extensions_guid[i] = talloc_strdup(mem_ctx, q);
100
101 /* we might have no name for the guid */
102 if (gp_ext->extensions_guid[i] == NULL) {
103 goto parse_error;
104 }
105
106 for (k = 1; ext_strings[k] != NULL; k++) {
107
108 char *m = ext_strings[k];
109
110 if (m[0] == '{') {
111 m++;
112 }
113
114 /* FIXME: theoretically there could be more than one snapin per extension */
115 gp_ext->snapins[i] = talloc_strdup(mem_ctx, cse_snapin_gpo_guid_string_to_name(m));
116 gp_ext->snapins_guid[i] = talloc_strdup(mem_ctx, m);
117
118 /* we might have no name for the guid */
119 if (gp_ext->snapins_guid[i] == NULL) {
120 goto parse_error;
121 }
122 }
123 }
124
125 if (ext_list) {
126 str_list_free_talloc(mem_ctx, &ext_list);
127 }
128 if (ext_strings) {
129 str_list_free_talloc(mem_ctx, &ext_strings);
130 }
131
132 return ADS_ERROR(LDAP_SUCCESS);
133
134parse_error:
135 if (ext_list) {
136 str_list_free_talloc(mem_ctx, &ext_list);
137 }
138 if (ext_strings) {
139 str_list_free_talloc(mem_ctx, &ext_strings);
140 }
141
142 return ADS_ERROR(LDAP_NO_MEMORY);
143}
144
145/****************************************************************
146 parse the raw link string into a GP_LINK structure
147****************************************************************/
148
149ADS_STATUS ads_parse_gplink(TALLOC_CTX *mem_ctx,
150 const char *gp_link_raw,
151 uint32 options,
152 struct GP_LINK *gp_link)
153{
154 char **link_list;
155 int i;
156
157 DEBUG(10,("ads_parse_gplink: gPLink: %s\n", gp_link_raw));
158
159 link_list = str_list_make_talloc(mem_ctx, gp_link_raw, "]");
160 if (link_list == NULL) {
161 goto parse_error;
162 }
163
164 for (i = 0; link_list[i] != NULL; i++) {
165 /* no op */
166 }
167
168 gp_link->gp_opts = options;
169 gp_link->num_links = i;
170
171 if (gp_link->num_links) {
172 gp_link->link_names = TALLOC_ZERO_ARRAY(mem_ctx, char *, gp_link->num_links);
173 gp_link->link_opts = TALLOC_ZERO_ARRAY(mem_ctx, uint32, gp_link->num_links);
174 } else {
175 gp_link->link_names = NULL;
176 gp_link->link_opts = NULL;
177 }
178
179 gp_link->gp_link = talloc_strdup(mem_ctx, gp_link_raw);
180
181 if (gp_link->link_names == NULL || gp_link->link_opts == NULL || gp_link->gp_link == NULL) {
182 goto parse_error;
183 }
184
185 for (i = 0; link_list[i] != NULL; i++) {
186
187 char *p, *q;
188
189 DEBUGADD(10,("ads_parse_gplink: processing link #%d\n", i));
190
191 q = link_list[i];
192 if (q[0] == '[') {
193 q++;
194 };
195
196 p = strchr(q, ';');
197
198 if (p == NULL) {
199 goto parse_error;
200 }
201
202 gp_link->link_names[i] = talloc_strdup(mem_ctx, q);
203 if (gp_link->link_names[i] == NULL) {
204 goto parse_error;
205 }
206 gp_link->link_names[i][PTR_DIFF(p, q)] = 0;
207
208 gp_link->link_opts[i] = atoi(p + 1);
209
210 DEBUGADD(10,("ads_parse_gplink: link: %s\n", gp_link->link_names[i]));
211 DEBUGADD(10,("ads_parse_gplink: opt: %d\n", gp_link->link_opts[i]));
212
213 }
214
215 if (link_list) {
216 str_list_free_talloc(mem_ctx, &link_list);
217 }
218
219 return ADS_ERROR(LDAP_SUCCESS);
220
221parse_error:
222 if (link_list) {
223 str_list_free_talloc(mem_ctx, &link_list);
224 }
225
226 return ADS_ERROR(LDAP_NO_MEMORY);
227}
228
229/****************************************************************
230 helper call to get a GP_LINK structure from a linkdn
231****************************************************************/
232
233ADS_STATUS ads_get_gpo_link(ADS_STRUCT *ads,
234 TALLOC_CTX *mem_ctx,
235 const char *link_dn,
236 struct GP_LINK *gp_link_struct)
237{
238 ADS_STATUS status;
239 const char *attrs[] = {"gPLink", "gPOptions", NULL};
240 LDAPMessage *res = NULL;
241 const char *gp_link;
242 uint32 gp_options;
243
244 ZERO_STRUCTP(gp_link_struct);
245
246 status = ads_search_dn(ads, &res, link_dn, attrs);
247 if (!ADS_ERR_OK(status)) {
248 DEBUG(10,("ads_get_gpo_link: search failed with %s\n", ads_errstr(status)));
249 return status;
250 }
251
252 if (ads_count_replies(ads, res) != 1) {
253 DEBUG(10,("ads_get_gpo_link: no result\n"));
254 ads_msgfree(ads, res);
255 return ADS_ERROR(LDAP_NO_SUCH_OBJECT);
256 }
257
258 gp_link = ads_pull_string(ads, mem_ctx, res, "gPLink");
259 if (gp_link == NULL) {
260 DEBUG(10,("ads_get_gpo_link: no 'gPLink' attribute found\n"));
261 ads_msgfree(ads, res);
262 return ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE);
263 }
264
265 /* perfectly leggal to have no options */
266 if (!ads_pull_uint32(ads, res, "gPOptions", &gp_options)) {
267 DEBUG(10,("ads_get_gpo_link: no 'gPOptions' attribute found\n"));
268 gp_options = 0;
269 }
270
271 ads_msgfree(ads, res);
272
273 return ads_parse_gplink(mem_ctx, gp_link, gp_options, gp_link_struct);
274}
275
276/****************************************************************
277 helper call to add a gp link
278****************************************************************/
279
280ADS_STATUS ads_add_gpo_link(ADS_STRUCT *ads,
281 TALLOC_CTX *mem_ctx,
282 const char *link_dn,
283 const char *gpo_dn,
284 uint32 gpo_opt)
285{
286 ADS_STATUS status;
287 const char *attrs[] = {"gPLink", NULL};
288 LDAPMessage *res = NULL;
289 const char *gp_link, *gp_link_new;
290 ADS_MODLIST mods;
291
292 /* although ADS allows to set anything here, we better check here if
293 * the gpo_dn is sane */
294
295 if (!strnequal(gpo_dn, "LDAP://CN={", strlen("LDAP://CN={")) != 0) {
296 return ADS_ERROR(LDAP_INVALID_DN_SYNTAX);
297 }
298
299 status = ads_search_dn(ads, &res, link_dn, attrs);
300 if (!ADS_ERR_OK(status)) {
301 DEBUG(10,("ads_add_gpo_link: search failed with %s\n", ads_errstr(status)));
302 return status;
303 }
304
305 if (ads_count_replies(ads, res) != 1) {
306 DEBUG(10,("ads_add_gpo_link: no result\n"));
307 ads_msgfree(ads, res);
308 return ADS_ERROR(LDAP_NO_SUCH_OBJECT);
309 }
310
311 gp_link = ads_pull_string(ads, mem_ctx, res, "gPLink");
312 if (gp_link == NULL) {
313 gp_link_new = talloc_asprintf(mem_ctx, "[%s;%d]", gpo_dn, gpo_opt);
314 } else {
315 gp_link_new = talloc_asprintf(mem_ctx, "%s[%s;%d]", gp_link, gpo_dn, gpo_opt);
316 }
317
318 ads_msgfree(ads, res);
319 ADS_ERROR_HAVE_NO_MEMORY(gp_link_new);
320
321 mods = ads_init_mods(mem_ctx);
322 ADS_ERROR_HAVE_NO_MEMORY(mods);
323
324 status = ads_mod_str(mem_ctx, &mods, "gPLink", gp_link_new);
325 if (!ADS_ERR_OK(status)) {
326 return status;
327 }
328
329 return ads_gen_mod(ads, link_dn, mods);
330}
331
332/****************************************************************
333 helper call to delete add a gp link
334****************************************************************/
335
336/* untested & broken */
337ADS_STATUS ads_delete_gpo_link(ADS_STRUCT *ads,
338 TALLOC_CTX *mem_ctx,
339 const char *link_dn,
340 const char *gpo_dn)
341{
342 ADS_STATUS status;
343 const char *attrs[] = {"gPLink", NULL};
344 LDAPMessage *res = NULL;
345 const char *gp_link, *gp_link_new = NULL;
346 ADS_MODLIST mods;
347
348 /* check for a sane gpo_dn */
349 if (gpo_dn[0] != '[') {
350 DEBUG(10,("ads_delete_gpo_link: first char not: [\n"));
351 return ADS_ERROR(LDAP_INVALID_DN_SYNTAX);
352 }
353
354 if (gpo_dn[strlen(gpo_dn)] != ']') {
355 DEBUG(10,("ads_delete_gpo_link: last char not: ]\n"));
356 return ADS_ERROR(LDAP_INVALID_DN_SYNTAX);
357 }
358
359 status = ads_search_dn(ads, &res, link_dn, attrs);
360 if (!ADS_ERR_OK(status)) {
361 DEBUG(10,("ads_delete_gpo_link: search failed with %s\n", ads_errstr(status)));
362 return status;
363 }
364
365 if (ads_count_replies(ads, res) != 1) {
366 DEBUG(10,("ads_delete_gpo_link: no result\n"));
367 ads_msgfree(ads, res);
368 return ADS_ERROR(LDAP_NO_SUCH_OBJECT);
369 }
370
371 gp_link = ads_pull_string(ads, mem_ctx, res, "gPLink");
372 if (gp_link == NULL) {
373 return ADS_ERROR(LDAP_NO_SUCH_ATTRIBUTE);
374 }
375
376 /* find link to delete */
377 /* gp_link_new = talloc_asprintf(mem_ctx, "%s[%s;%d]", gp_link, gpo_dn, gpo_opt); */
378
379 ads_msgfree(ads, res);
380 ADS_ERROR_HAVE_NO_MEMORY(gp_link_new);
381
382 mods = ads_init_mods(mem_ctx);
383 ADS_ERROR_HAVE_NO_MEMORY(mods);
384
385 status = ads_mod_str(mem_ctx, &mods, "gPLink", gp_link_new);
386 if (!ADS_ERR_OK(status)) {
387 return status;
388 }
389
390 return ads_gen_mod(ads, link_dn, mods);
391}
392
393/****************************************************************
394 parse a GROUP_POLICY_OBJECT structure from an LDAPMessage result
395****************************************************************/
396
397 ADS_STATUS ads_parse_gpo(ADS_STRUCT *ads,
398 TALLOC_CTX *mem_ctx,
399 LDAPMessage *res,
400 const char *gpo_dn,
401 struct GROUP_POLICY_OBJECT *gpo)
402{
403 ZERO_STRUCTP(gpo);
404
405 ADS_ERROR_HAVE_NO_MEMORY(res);
406
407 if (gpo_dn) {
408 gpo->ds_path = talloc_strdup(mem_ctx, gpo_dn);
409 } else {
410 gpo->ds_path = ads_get_dn(ads, res);
411 }
412
413 ADS_ERROR_HAVE_NO_MEMORY(gpo->ds_path);
414
415 if (!ads_pull_uint32(ads, res, "versionNumber", &gpo->version)) {
416 return ADS_ERROR(LDAP_NO_MEMORY);
417 }
418
419 /* sure ??? */
420 if (!ads_pull_uint32(ads, res, "flags", &gpo->options)) {
421 return ADS_ERROR(LDAP_NO_MEMORY);
422 }
423
424 gpo->file_sys_path = ads_pull_string(ads, mem_ctx, res, "gPCFileSysPath");
425 ADS_ERROR_HAVE_NO_MEMORY(gpo->file_sys_path);
426
427 gpo->display_name = ads_pull_string(ads, mem_ctx, res, "displayName");
428 ADS_ERROR_HAVE_NO_MEMORY(gpo->display_name);
429
430 gpo->name = ads_pull_string(ads, mem_ctx, res, "name");
431 ADS_ERROR_HAVE_NO_MEMORY(gpo->name);
432
433 /* ???, this is optional to have and what does it depend on, the 'flags' ?) */
434 gpo->machine_extensions = ads_pull_string(ads, mem_ctx, res, "gPCMachineExtensionNames");
435 gpo->user_extensions = ads_pull_string(ads, mem_ctx, res, "gPCUserExtensionNames");
436
437 return ADS_ERROR(LDAP_SUCCESS);
438}
439
440/****************************************************************
441 get a GROUP_POLICY_OBJECT structure based on different input paramters
442****************************************************************/
443
444ADS_STATUS ads_get_gpo(ADS_STRUCT *ads,
445 TALLOC_CTX *mem_ctx,
446 const char *gpo_dn,
447 const char *display_name,
448 const char *guid_name,
449 struct GROUP_POLICY_OBJECT *gpo)
450{
451 ADS_STATUS status;
452 LDAPMessage *res = NULL;
453 char *dn;
454 const char *filter;
455 const char *attrs[] = { "cn", "displayName", "flags", "gPCFileSysPath",
456 "gPCFunctionalityVersion", "gPCMachineExtensionNames",
457 "gPCUserExtensionNames", "gPCWQLFilter", "name",
458 "versionNumber", NULL};
459
460 ZERO_STRUCTP(gpo);
461
462 if (!gpo_dn && !display_name && !guid_name) {
463 return ADS_ERROR(LDAP_NO_SUCH_OBJECT);
464 }
465
466 if (gpo_dn) {
467
468 if (strnequal(gpo_dn, "LDAP://", strlen("LDAP://")) != 0) {
469 gpo_dn = gpo_dn + strlen("LDAP://");
470 }
471
472 status = ads_search_dn(ads, &res, gpo_dn, attrs);
473
474 } else if (display_name || guid_name) {
475
476 filter = talloc_asprintf(mem_ctx,
477 "(&(objectclass=groupPolicyContainer)(%s=%s))",
478 display_name ? "displayName" : "name",
479 display_name ? display_name : guid_name);
480 ADS_ERROR_HAVE_NO_MEMORY(filter);
481
482 status = ads_do_search_all(ads, ads->config.bind_path,
483 LDAP_SCOPE_SUBTREE, filter,
484 attrs, &res);
485 }
486
487 if (!ADS_ERR_OK(status)) {
488 DEBUG(10,("ads_get_gpo: search failed with %s\n", ads_errstr(status)));
489 return status;
490 }
491
492 if (ads_count_replies(ads, res) != 1) {
493 DEBUG(10,("ads_get_gpo: no result\n"));
494 ads_msgfree(ads, res);
495 return ADS_ERROR(LDAP_NO_SUCH_OBJECT);
496 }
497
498 dn = ads_get_dn(ads, res);
499 if (dn == NULL) {
500 ads_msgfree(ads, res);
501 return ADS_ERROR(LDAP_NO_MEMORY);
502 }
503
504 status = ads_parse_gpo(ads, mem_ctx, res, dn, gpo);
505 ads_msgfree(ads, res);
506 ads_memfree(ads, dn);
507
508 return status;
509}
510
511/****************************************************************
512 add a gplink to the GROUP_POLICY_OBJECT linked list
513****************************************************************/
514
515ADS_STATUS add_gplink_to_gpo_list(ADS_STRUCT *ads,
516 TALLOC_CTX *mem_ctx,
517 struct GROUP_POLICY_OBJECT **gpo_list,
518 const char *link_dn,
519 struct GP_LINK *gp_link,
520 enum GPO_LINK_TYPE link_type,
521 BOOL only_add_forced_gpos)
522{
523 ADS_STATUS status;
524 int i;
525
526 for (i = 0; i < gp_link->num_links; i++) {
527
528 struct GROUP_POLICY_OBJECT *new_gpo = NULL;
529
530 if (gp_link->link_opts[i] & GPO_LINK_OPT_DISABLED) {
531 DEBUG(10,("skipping disabled GPO\n"));
532 continue;
533 }
534
535 if (only_add_forced_gpos) {
536
537 if (! (gp_link->link_opts[i] & GPO_LINK_OPT_ENFORCED)) {
538 DEBUG(10,("skipping nonenforced GPO link because GPOPTIONS_BLOCK_INHERITANCE has been set\n"));
539 continue;
540 } else {
541 DEBUG(10,("adding enforced GPO link although the GPOPTIONS_BLOCK_INHERITANCE has been set\n"));
542 }
543 }
544
545 new_gpo = TALLOC_P(mem_ctx, struct GROUP_POLICY_OBJECT);
546 ADS_ERROR_HAVE_NO_MEMORY(new_gpo);
547
548 ZERO_STRUCTP(new_gpo);
549
550 status = ads_get_gpo(ads, mem_ctx, gp_link->link_names[i], NULL, NULL, new_gpo);
551 if (!ADS_ERR_OK(status)) {
552 return status;
553 }
554
555 new_gpo->link = link_dn;
556 new_gpo->link_type = link_type;
557
558 DLIST_ADD(*gpo_list, new_gpo);
559
560 DEBUG(10,("add_gplink_to_gplist: added GPLINK #%d %s to GPO list\n",
561 i, gp_link->link_names[i]));
562 }
563
564 return ADS_ERROR(LDAP_SUCCESS);
565}
566
567/****************************************************************
568 get the full list of GROUP_POLICY_OBJECTs for a given dn
569****************************************************************/
570
571ADS_STATUS ads_get_gpo_list(ADS_STRUCT *ads,
572 TALLOC_CTX *mem_ctx,
573 const char *dn,
574 uint32 flags,
575 struct GROUP_POLICY_OBJECT **gpo_list)
576{
577 /* (L)ocal (S)ite (D)omain (O)rganizational(U)nit */
578
579 ADS_STATUS status;
580 struct GP_LINK gp_link;
581 const char *parent_dn, *site_dn, *tmp_dn;
582 BOOL add_only_forced_gpos = False;
583
584 ZERO_STRUCTP(gpo_list);
585
586 DEBUG(10,("ads_get_gpo_list: getting GPO list for [%s]\n", dn));
587
588 /* (L)ocal */
589 /* not yet... */
590
591 /* (S)ite */
592
593 /* are site GPOs valid for users as well ??? */
594 if (flags & GPO_LIST_FLAG_MACHINE) {
595
596 status = ads_site_dn_for_machine(ads, mem_ctx, ads->config.ldap_server_name, &site_dn);
597 if (!ADS_ERR_OK(status)) {
598 return status;
599 }
600
601 DEBUG(10,("ads_get_gpo_list: query SITE: [%s] for GPOs\n", site_dn));
602
603 status = ads_get_gpo_link(ads, mem_ctx, site_dn, &gp_link);
604 if (ADS_ERR_OK(status)) {
605
606 if (DEBUGLEVEL >= 100) {
607 dump_gplink(ads, mem_ctx, &gp_link);
608 }
609
610 status = add_gplink_to_gpo_list(ads, mem_ctx, gpo_list,
611 site_dn, &gp_link, GP_LINK_SITE,
612 add_only_forced_gpos);
613 if (!ADS_ERR_OK(status)) {
614 return status;
615 }
616
617 if (flags & GPO_LIST_FLAG_SITEONLY) {
618 return ADS_ERROR(LDAP_SUCCESS);
619 }
620
621 /* inheritance can't be blocked at the site level */
622 }
623 }
624
625 tmp_dn = dn;
626
627 while ( (parent_dn = ads_parent_dn(tmp_dn)) &&
628 (!strequal(parent_dn, ads_parent_dn(ads->config.bind_path))) ) {
629
630 /* (D)omain */
631
632 /* An account can just be a member of one domain */
633 if (strncmp(parent_dn, "DC=", strlen("DC=")) == 0) {
634
635 DEBUG(10,("ads_get_gpo_list: query DC: [%s] for GPOs\n", parent_dn));
636
637 status = ads_get_gpo_link(ads, mem_ctx, parent_dn, &gp_link);
638 if (ADS_ERR_OK(status)) {
639
640 if (DEBUGLEVEL >= 100) {
641 dump_gplink(ads, mem_ctx, &gp_link);
642 }
643
644 /* block inheritance from now on */
645 if (gp_link.gp_opts & GPOPTIONS_BLOCK_INHERITANCE) {
646 add_only_forced_gpos = True;
647 }
648
649 status = add_gplink_to_gpo_list(ads, mem_ctx,
650 gpo_list, parent_dn,
651 &gp_link, GP_LINK_DOMAIN,
652 add_only_forced_gpos);
653 if (!ADS_ERR_OK(status)) {
654 return status;
655 }
656 }
657 }
658
659 tmp_dn = parent_dn;
660 }
661
662 /* reset dn again */
663 tmp_dn = dn;
664
665 while ( (parent_dn = ads_parent_dn(tmp_dn)) &&
666 (!strequal(parent_dn, ads_parent_dn(ads->config.bind_path))) ) {
667
668
669 /* (O)rganizational(U)nit */
670
671 /* An account can be a member of more OUs */
672 if (strncmp(parent_dn, "OU=", strlen("OU=")) == 0) {
673
674 DEBUG(10,("ads_get_gpo_list: query OU: [%s] for GPOs\n", parent_dn));
675
676 status = ads_get_gpo_link(ads, mem_ctx, parent_dn, &gp_link);
677 if (ADS_ERR_OK(status)) {
678
679 if (DEBUGLEVEL >= 100) {
680 dump_gplink(ads, mem_ctx, &gp_link);
681 }
682
683 /* block inheritance from now on */
684 if (gp_link.gp_opts & GPOPTIONS_BLOCK_INHERITANCE) {
685 add_only_forced_gpos = True;
686 }
687
688 status = add_gplink_to_gpo_list(ads, mem_ctx,
689 gpo_list, parent_dn,
690 &gp_link, GP_LINK_OU,
691 add_only_forced_gpos);
692 if (!ADS_ERR_OK(status)) {
693 return status;
694 }
695 }
696 }
697
698 tmp_dn = parent_dn;
699
700 };
701
702 return ADS_ERROR(LDAP_SUCCESS);
703}
704
705#endif /* HAVE_LDAP */
Note: See TracBrowser for help on using the repository browser.