Context Navigation

← Previous Revision
Next Revision →
Blame
Revision Log

source: vendor/3.5.0/source3/passdb/pdb_ldap.c

Visit:

Last change on this file was 414, checked in by Herwig Bauernfeind, 16 years ago
Samba 3.5.0: Initial import
File size: 181.0 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	LDAP protocol helper functions for SAMBA
4	Copyright (C) Jean François Micouleau 1998
5	Copyright (C) Gerald Carter 2001-2003
6	Copyright (C) Shahms King 2001
7	Copyright (C) Andrew Bartlett 2002-2003
8	Copyright (C) Stefan (metze) Metzmacher 2002-2003
9	Copyright (C) Simo Sorce 2006
10
11	This program is free software; you can redistribute it and/or modify
12	it under the terms of the GNU General Public License as published by
13	the Free Software Foundation; either version 3 of the License, or
14	(at your option) any later version.
15
16	This program is distributed in the hope that it will be useful,
17	but WITHOUT ANY WARRANTY; without even the implied warranty of
18	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19	GNU General Public License for more details.
20
21	You should have received a copy of the GNU General Public License
22	along with this program. If not, see <http://www.gnu.org/licenses/>.
23
24	*/
25
26	/* TODO:
27	* persistent connections: if using NSS LDAP, many connections are made
28	* however, using only one within Samba would be nice
29	*
30	* Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
31	*
32	* Other LDAP based login attributes: accountExpires, etc.
33	* (should be the domain of Samba proper, but the sam_password/struct samu
34	* structures don't have fields for some of these attributes)
35	*
36	* SSL is done, but can't get the certificate based authentication to work
37	* against on my test platform (Linux 2.4, OpenLDAP 2.x)
38	*/
39
40	/* NOTE: this will NOT work against an Active Directory server
41	* due to the fact that the two password fields cannot be retrieved
42	* from a server; recommend using security = domain in this situation
43	* and/or winbind
44	*/
45
46	#include "includes.h"
47	#include "../libcli/auth/libcli_auth.h"
48
49	#undef DBGC_CLASS
50	#define DBGC_CLASS DBGC_PASSDB
51
52	#include <lber.h>
53	#include <ldap.h>
54
55	/*
56	* Work around versions of the LDAP client libs that don't have the OIDs
57	* defined, or have them defined under the old name.
58	* This functionality is really a factor of the server, not the client
59	*
60	*/
61
62	#if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD)
63	#define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD
64	#elif !defined(LDAP_EXOP_MODIFY_PASSWD)
65	#define LDAP_EXOP_MODIFY_PASSWD "1.3.6.1.4.1.4203.1.11.1"
66	#endif
67
68	#if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
69	#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID
70	#elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
71	#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID ((ber_tag_t) 0x80U)
72	#endif
73
74	#if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
75	#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW
76	#elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
77	#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ((ber_tag_t) 0x82U)
78	#endif
79
80
81	#include "smbldap.h"
82
83	/**********************************************************************
84	Simple helper function to make stuff better readable
85	**********************************************************************/
86
87	static LDAP priv2ld(struct ldapsam_privates priv)
88	{
89	return priv->smbldap_state->ldap_struct;
90	}
91
92	/**********************************************************************
93	Get the attribute name given a user schame version.
94	**********************************************************************/
95
96	static const char* get_userattr_key2string( int schema_ver, int key )
97	{
98	switch ( schema_ver ) {
99	case SCHEMAVER_SAMBAACCOUNT:
100	return get_attr_key2string( attrib_map_v22, key );
101
102	case SCHEMAVER_SAMBASAMACCOUNT:
103	return get_attr_key2string( attrib_map_v30, key );
104
105	default:
106	DEBUG(0,("get_userattr_key2string: unknown schema version specified\n"));
107	break;
108	}
109	return NULL;
110	}
111
112	/**********************************************************************
113	Return the list of attribute names given a user schema version.
114	**********************************************************************/
115
116	const char** get_userattr_list( TALLOC_CTX *mem_ctx, int schema_ver )
117	{
118	switch ( schema_ver ) {
119	case SCHEMAVER_SAMBAACCOUNT:
120	return get_attr_list( mem_ctx, attrib_map_v22 );
121
122	case SCHEMAVER_SAMBASAMACCOUNT:
123	return get_attr_list( mem_ctx, attrib_map_v30 );
124	default:
125	DEBUG(0,("get_userattr_list: unknown schema version specified!\n"));
126	break;
127	}
128
129	return NULL;
130	}
131
132	/**************************************************************************
133	Return the list of attribute names to delete given a user schema version.
134	**************************************************************************/
135
136	static const char** get_userattr_delete_list( TALLOC_CTX *mem_ctx,
137	int schema_ver )
138	{
139	switch ( schema_ver ) {
140	case SCHEMAVER_SAMBAACCOUNT:
141	return get_attr_list( mem_ctx,
142	attrib_map_to_delete_v22 );
143
144	case SCHEMAVER_SAMBASAMACCOUNT:
145	return get_attr_list( mem_ctx,
146	attrib_map_to_delete_v30 );
147	default:
148	DEBUG(0,("get_userattr_delete_list: unknown schema version specified!\n"));
149	break;
150	}
151
152	return NULL;
153	}
154
155
156	/*******************************************************************
157	Generate the LDAP search filter for the objectclass based on the
158	version of the schema we are using.
159	******************************************************************/
160
161	static const char* get_objclass_filter( int schema_ver )
162	{
163	fstring objclass_filter;
164	char *result;
165
166	switch( schema_ver ) {
167	case SCHEMAVER_SAMBAACCOUNT:
168	fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT );
169	break;
170	case SCHEMAVER_SAMBASAMACCOUNT:
171	fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT );
172	break;
173	default:
174	DEBUG(0,("get_objclass_filter: Invalid schema version specified!\n"));
175	objclass_filter[0] = '\0';
176	break;
177	}
178
179	result = talloc_strdup(talloc_tos(), objclass_filter);
180	SMB_ASSERT(result != NULL);
181	return result;
182	}
183
184	/*****************************************************************
185	Scan a sequence number off OpenLDAP's syncrepl contextCSN
186	******************************************************************/
187
188	static NTSTATUS ldapsam_get_seq_num(struct pdb_methods my_methods, time_t seq_num)
189	{
190	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
191	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
192	LDAPMessage *msg = NULL;
193	LDAPMessage *entry = NULL;
194	TALLOC_CTX *mem_ctx;
195	char **values = NULL;
196	int rc, num_result, num_values, rid;
197	char *suffix = NULL;
198	char *tok;
199	const char *p;
200	const char **attrs;
201
202	/* Unfortunatly there is no proper way to detect syncrepl-support in
203	* smbldap_connect_system(). The syncrepl OIDs are submitted for publication
204	* but do not show up in the root-DSE yet. Neither we can query the
205	* subschema-context for the syncProviderSubentry or syncConsumerSubentry
206	* objectclass. Currently we require lp_ldap_suffix() to show up as
207	* namingContext. - Guenther
208	*/
209
210	if (!lp_parm_bool(-1, "ldapsam", "syncrepl_seqnum", False)) {
211	return ntstatus;
212	}
213
214	if (!seq_num) {
215	DEBUG(3,("ldapsam_get_seq_num: no sequence_number\n"));
216	return ntstatus;
217	}
218
219	if (!smbldap_has_naming_context(ldap_state->smbldap_state->ldap_struct, lp_ldap_suffix())) {
220	DEBUG(3,("ldapsam_get_seq_num: DIT not configured to hold %s "
221	"as top-level namingContext\n", lp_ldap_suffix()));
222	return ntstatus;
223	}
224
225	mem_ctx = talloc_init("ldapsam_get_seq_num");
226
227	if (mem_ctx == NULL)
228	return NT_STATUS_NO_MEMORY;
229
230	if ((attrs = TALLOC_ARRAY(mem_ctx, const char *, 2)) == NULL) {
231	ntstatus = NT_STATUS_NO_MEMORY;
232	goto done;
233	}
234
235	/* if we got a syncrepl-rid (up to three digits long) we speak with a consumer */
236	rid = lp_parm_int(-1, "ldapsam", "syncrepl_rid", -1);
237	if (rid > 0) {
238
239	/* consumer syncreplCookie: */
240	/* csn=20050126161620Z#0000001#00#00000 */
241	attrs[0] = talloc_strdup(mem_ctx, "syncreplCookie");
242	attrs[1] = NULL;
243	suffix = talloc_asprintf(mem_ctx,
244	"cn=syncrepl%d,%s", rid, lp_ldap_suffix());
245	if (!suffix) {
246	ntstatus = NT_STATUS_NO_MEMORY;
247	goto done;
248	}
249	} else {
250
251	/* provider contextCSN */
252	/* 20050126161620Z#000009#00#000000 */
253	attrs[0] = talloc_strdup(mem_ctx, "contextCSN");
254	attrs[1] = NULL;
255	suffix = talloc_asprintf(mem_ctx,
256	"cn=ldapsync,%s", lp_ldap_suffix());
257
258	if (!suffix) {
259	ntstatus = NT_STATUS_NO_MEMORY;
260	goto done;
261	}
262	}
263
264	rc = smbldap_search(ldap_state->smbldap_state, suffix,
265	LDAP_SCOPE_BASE, "(objectclass=*)", attrs, 0, &msg);
266
267	if (rc != LDAP_SUCCESS) {
268	goto done;
269	}
270
271	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg);
272	if (num_result != 1) {
273	DEBUG(3,("ldapsam_get_seq_num: Expected one entry, got %d\n", num_result));
274	goto done;
275	}
276
277	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg);
278	if (entry == NULL) {
279	DEBUG(3,("ldapsam_get_seq_num: Could not retrieve entry\n"));
280	goto done;
281	}
282
283	values = ldap_get_values(ldap_state->smbldap_state->ldap_struct, entry, attrs[0]);
284	if (values == NULL) {
285	DEBUG(3,("ldapsam_get_seq_num: no values\n"));
286	goto done;
287	}
288
289	num_values = ldap_count_values(values);
290	if (num_values == 0) {
291	DEBUG(3,("ldapsam_get_seq_num: not a single value\n"));
292	goto done;
293	}
294
295	p = values[0];
296	if (!next_token_talloc(mem_ctx, &p, &tok, "#")) {
297	DEBUG(0,("ldapsam_get_seq_num: failed to parse sequence number\n"));
298	goto done;
299	}
300
301	p = tok;
302	if (!strncmp(p, "csn=", strlen("csn=")))
303	p += strlen("csn=");
304
305	DEBUG(10,("ldapsam_get_seq_num: got %s: %s\n", attrs[0], p));
306
307	*seq_num = generalized_to_unix_time(p);
308
309	/* very basic sanity check */
310	if (*seq_num <= 0) {
311	DEBUG(3,("ldapsam_get_seq_num: invalid sequence number: %d\n",
312	(int)*seq_num));
313	goto done;
314	}
315
316	ntstatus = NT_STATUS_OK;
317
318	done:
319	if (values != NULL)
320	ldap_value_free(values);
321	if (msg != NULL)
322	ldap_msgfree(msg);
323	if (mem_ctx)
324	talloc_destroy(mem_ctx);
325
326	return ntstatus;
327	}
328
329	/*******************************************************************
330	Run the search by name.
331	******************************************************************/
332
333	int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
334	const char *user,
335	LDAPMessage ** result,
336	const char **attr)
337	{
338	char *filter = NULL;
339	char *escape_user = escape_ldap_string(talloc_tos(), user);
340	int ret = -1;
341
342	if (!escape_user) {
343	return LDAP_NO_MEMORY;
344	}
345
346	/*
347	* in the filter expression, replace %u with the real name
348	* so in ldap filter, %u MUST exist :-)
349	*/
350	filter = talloc_asprintf(talloc_tos(), "(&%s%s)", "(uid=%u)",
351	get_objclass_filter(ldap_state->schema_ver));
352	if (!filter) {
353	TALLOC_FREE(escape_user);
354	return LDAP_NO_MEMORY;
355	}
356	/*
357	* have to use this here because $ is filtered out
358	* in string_sub
359	*/
360
361	filter = talloc_all_string_sub(talloc_tos(),
362	filter, "%u", escape_user);
363	TALLOC_FREE(escape_user);
364	if (!filter) {
365	return LDAP_NO_MEMORY;
366	}
367
368	ret = smbldap_search_suffix(ldap_state->smbldap_state,
369	filter, attr, result);
370	TALLOC_FREE(filter);
371	return ret;
372	}
373
374	/*******************************************************************
375	Run the search by rid.
376	******************************************************************/
377
378	static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
379	uint32 rid, LDAPMessage ** result,
380	const char **attr)
381	{
382	char *filter = NULL;
383	int rc;
384
385	filter = talloc_asprintf(talloc_tos(), "(&(rid=%i)%s)", rid,
386	get_objclass_filter(ldap_state->schema_ver));
387	if (!filter) {
388	return LDAP_NO_MEMORY;
389	}
390
391	rc = smbldap_search_suffix(ldap_state->smbldap_state,
392	filter, attr, result);
393	TALLOC_FREE(filter);
394	return rc;
395	}
396
397	/*******************************************************************
398	Run the search by SID.
399	******************************************************************/
400
401	static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
402	const DOM_SID sid, LDAPMessage * result,
403	const char **attr)
404	{
405	char *filter = NULL;
406	int rc;
407	fstring sid_string;
408
409	filter = talloc_asprintf(talloc_tos(), "(&(%s=%s)%s)",
410	get_userattr_key2string(ldap_state->schema_ver,
411	LDAP_ATTR_USER_SID),
412	sid_to_fstring(sid_string, sid),
413	get_objclass_filter(ldap_state->schema_ver));
414	if (!filter) {
415	return LDAP_NO_MEMORY;
416	}
417
418	rc = smbldap_search_suffix(ldap_state->smbldap_state,
419	filter, attr, result);
420
421	TALLOC_FREE(filter);
422	return rc;
423	}
424
425	/*******************************************************************
426	Delete complete object or objectclass and attrs from
427	object found in search_result depending on lp_ldap_delete_dn
428	******************************************************************/
429
430	static int ldapsam_delete_entry(struct ldapsam_privates *priv,
431	TALLOC_CTX *mem_ctx,
432	LDAPMessage *entry,
433	const char *objectclass,
434	const char **attrs)
435	{
436	LDAPMod **mods = NULL;
437	char *name;
438	const char *dn;
439	BerElement *ptr = NULL;
440
441	dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry);
442	if (dn == NULL) {
443	return LDAP_NO_MEMORY;
444	}
445
446	if (lp_ldap_delete_dn()) {
447	return smbldap_delete(priv->smbldap_state, dn);
448	}
449
450	/* Ok, delete only the SAM attributes */
451
452	for (name = ldap_first_attribute(priv2ld(priv), entry, &ptr);
453	name != NULL;
454	name = ldap_next_attribute(priv2ld(priv), entry, ptr)) {
455	const char **attrib;
456
457	/* We are only allowed to delete the attributes that
458	really exist. */
459
460	for (attrib = attrs; *attrib != NULL; attrib++) {
461	if (strequal(*attrib, name)) {
462	DEBUG(10, ("ldapsam_delete_entry: deleting "
463	"attribute %s\n", name));
464	smbldap_set_mod(&mods, LDAP_MOD_DELETE, name,
465	NULL);
466	}
467	}
468	ldap_memfree(name);
469	}
470
471	if (ptr != NULL) {
472	ber_free(ptr, 0);
473	}
474
475	smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
476	talloc_autofree_ldapmod(mem_ctx, mods);
477
478	return smbldap_modify(priv->smbldap_state, dn, mods);
479	}
480
481	static time_t ldapsam_get_entry_timestamp( struct ldapsam_privates ldap_state, LDAPMessage entry)
482	{
483	char *temp;
484	struct tm tm;
485
486	temp = smbldap_talloc_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
487	get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
488	talloc_tos());
489	if (!temp) {
490	return (time_t) 0;
491	}
492
493	if ( !strptime(temp, "%Y%m%d%H%M%SZ", &tm)) {
494	DEBUG(2,("ldapsam_get_entry_timestamp: strptime failed on: %s\n",
495	(char*)temp));
496	TALLOC_FREE(temp);
497	return (time_t) 0;
498	}
499	TALLOC_FREE(temp);
500	tzset();
501	return timegm(&tm);
502	}
503
504	/**********************************************************************
505	Initialize struct samu from an LDAP query.
506	(Based on init_sam_from_buffer in pdb_tdb.c)
507	*********************************************************************/
508
509	static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
510	struct samu * sampass,
511	LDAPMessage * entry)
512	{
513	time_t logon_time,
514	logoff_time,
515	kickoff_time,
516	pass_last_set_time,
517	pass_can_change_time,
518	pass_must_change_time,
519	ldap_entry_time,
520	bad_password_time;
521	char *username = NULL,
522	*domain = NULL,
523	*nt_username = NULL,
524	*fullname = NULL,
525	*homedir = NULL,
526	*dir_drive = NULL,
527	*logon_script = NULL,
528	*profile_path = NULL,
529	*acct_desc = NULL,
530	*workstations = NULL,
531	*munged_dial = NULL;
532	uint32 user_rid;
533	uint8 smblmpwd[LM_HASH_LEN],
534	smbntpwd[NT_HASH_LEN];
535	bool use_samba_attrs = True;
536	uint32 acct_ctrl = 0;
537	uint16 logon_divs;
538	uint16 bad_password_count = 0,
539	logon_count = 0;
540	uint32 hours_len;
541	uint8 hours[MAX_HOURS_LEN];
542	char *temp = NULL;
543	LOGIN_CACHE *cache_entry = NULL;
544	uint32 pwHistLen;
545	bool expand_explicit = lp_passdb_expand_explicit();
546	bool ret = false;
547	TALLOC_CTX *ctx = talloc_init("init_sam_from_ldap");
548
549	if (!ctx) {
550	return false;
551	}
552	if (sampass == NULL \|\| ldap_state == NULL \|\| entry == NULL) {
553	DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
554	goto fn_exit;
555	}
556
557	if (priv2ld(ldap_state) == NULL) {
558	DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->"
559	"ldap_struct is NULL!\n"));
560	goto fn_exit;
561	}
562
563	if (!(username = smbldap_talloc_first_attribute(priv2ld(ldap_state),
564	entry,
565	"uid",
566	ctx))) {
567	DEBUG(1, ("init_sam_from_ldap: No uid attribute found for "
568	"this user!\n"));
569	goto fn_exit;
570	}
571
572	DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
573
574	nt_username = talloc_strdup(ctx, username);
575	if (!nt_username) {
576	goto fn_exit;
577	}
578
579	domain = talloc_strdup(ctx, ldap_state->domain_name);
580	if (!domain) {
581	goto fn_exit;
582	}
583
584	pdb_set_username(sampass, username, PDB_SET);
585
586	pdb_set_domain(sampass, domain, PDB_DEFAULT);
587	pdb_set_nt_username(sampass, nt_username, PDB_SET);
588
589	/* deal with different attributes between the schema first */
590
591	if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
592	if ((temp = smbldap_talloc_single_attribute(
593	ldap_state->smbldap_state->ldap_struct,
594	entry,
595	get_userattr_key2string(ldap_state->schema_ver,
596	LDAP_ATTR_USER_SID),
597	ctx))!=NULL) {
598	pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
599	}
600	} else {
601	if ((temp = smbldap_talloc_single_attribute(
602	ldap_state->smbldap_state->ldap_struct,
603	entry,
604	get_userattr_key2string(ldap_state->schema_ver,
605	LDAP_ATTR_USER_RID),
606	ctx))!=NULL) {
607	user_rid = (uint32)atol(temp);
608	pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
609	}
610	}
611
612	if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
613	DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
614	get_userattr_key2string(ldap_state->schema_ver,
615	LDAP_ATTR_USER_SID),
616	get_userattr_key2string(ldap_state->schema_ver,
617	LDAP_ATTR_USER_RID),
618	username));
619	return False;
620	}
621
622	temp = smbldap_talloc_single_attribute(
623	ldap_state->smbldap_state->ldap_struct,
624	entry,
625	get_userattr_key2string(ldap_state->schema_ver,
626	LDAP_ATTR_PWD_LAST_SET),
627	ctx);
628	if (temp) {
629	pass_last_set_time = (time_t) atol(temp);
630	pdb_set_pass_last_set_time(sampass,
631	pass_last_set_time, PDB_SET);
632	}
633
634	temp = smbldap_talloc_single_attribute(
635	ldap_state->smbldap_state->ldap_struct,
636	entry,
637	get_userattr_key2string(ldap_state->schema_ver,
638	LDAP_ATTR_LOGON_TIME),
639	ctx);
640	if (temp) {
641	logon_time = (time_t) atol(temp);
642	pdb_set_logon_time(sampass, logon_time, PDB_SET);
643	}
644
645	temp = smbldap_talloc_single_attribute(
646	ldap_state->smbldap_state->ldap_struct,
647	entry,
648	get_userattr_key2string(ldap_state->schema_ver,
649	LDAP_ATTR_LOGOFF_TIME),
650	ctx);
651	if (temp) {
652	logoff_time = (time_t) atol(temp);
653	pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
654	}
655
656	temp = smbldap_talloc_single_attribute(
657	ldap_state->smbldap_state->ldap_struct,
658	entry,
659	get_userattr_key2string(ldap_state->schema_ver,
660	LDAP_ATTR_KICKOFF_TIME),
661	ctx);
662	if (temp) {
663	kickoff_time = (time_t) atol(temp);
664	pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
665	}
666
667	temp = smbldap_talloc_single_attribute(
668	ldap_state->smbldap_state->ldap_struct,
669	entry,
670	get_userattr_key2string(ldap_state->schema_ver,
671	LDAP_ATTR_PWD_CAN_CHANGE),
672	ctx);
673	if (temp) {
674	pass_can_change_time = (time_t) atol(temp);
675	pdb_set_pass_can_change_time(sampass,
676	pass_can_change_time, PDB_SET);
677	}
678
679	temp = smbldap_talloc_single_attribute(
680	ldap_state->smbldap_state->ldap_struct,
681	entry,
682	get_userattr_key2string(ldap_state->schema_ver,
683	LDAP_ATTR_PWD_MUST_CHANGE),
684	ctx);
685	if (temp) {
686	pass_must_change_time = (time_t) atol(temp);
687	pdb_set_pass_must_change_time(sampass,
688	pass_must_change_time, PDB_SET);
689	}
690
691	/* recommend that 'gecos' and 'displayName' should refer to the same
692	* attribute OID. userFullName depreciated, only used by Samba
693	* primary rules of LDAP: don't make a new attribute when one is already defined
694	* that fits your needs; using cn then displayName rather than 'userFullName'
695	*/
696
697	fullname = smbldap_talloc_single_attribute(
698	ldap_state->smbldap_state->ldap_struct,
699	entry,
700	get_userattr_key2string(ldap_state->schema_ver,
701	LDAP_ATTR_DISPLAY_NAME),
702	ctx);
703	if (fullname) {
704	pdb_set_fullname(sampass, fullname, PDB_SET);
705	} else {
706	fullname = smbldap_talloc_single_attribute(
707	ldap_state->smbldap_state->ldap_struct,
708	entry,
709	get_userattr_key2string(ldap_state->schema_ver,
710	LDAP_ATTR_CN),
711	ctx);
712	if (fullname) {
713	pdb_set_fullname(sampass, fullname, PDB_SET);
714	}
715	}
716
717	dir_drive = smbldap_talloc_single_attribute(
718	ldap_state->smbldap_state->ldap_struct,
719	entry,
720	get_userattr_key2string(ldap_state->schema_ver,
721	LDAP_ATTR_HOME_DRIVE),
722	ctx);
723	if (dir_drive) {
724	pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
725	} else {
726	pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
727	}
728
729	homedir = smbldap_talloc_single_attribute(
730	ldap_state->smbldap_state->ldap_struct,
731	entry,
732	get_userattr_key2string(ldap_state->schema_ver,
733	LDAP_ATTR_HOME_PATH),
734	ctx);
735	if (homedir) {
736	if (expand_explicit) {
737	homedir = talloc_sub_basic(ctx,
738	username,
739	domain,
740	homedir);
741	if (!homedir) {
742	goto fn_exit;
743	}
744	}
745	pdb_set_homedir(sampass, homedir, PDB_SET);
746	} else {
747	pdb_set_homedir(sampass,
748	talloc_sub_basic(ctx, username, domain,
749	lp_logon_home()),
750	PDB_DEFAULT);
751	}
752
753	logon_script = smbldap_talloc_single_attribute(
754	ldap_state->smbldap_state->ldap_struct,
755	entry,
756	get_userattr_key2string(ldap_state->schema_ver,
757	LDAP_ATTR_LOGON_SCRIPT),
758	ctx);
759	if (logon_script) {
760	if (expand_explicit) {
761	logon_script = talloc_sub_basic(ctx,
762	username,
763	domain,
764	logon_script);
765	if (!logon_script) {
766	goto fn_exit;
767	}
768	}
769	pdb_set_logon_script(sampass, logon_script, PDB_SET);
770	} else {
771	pdb_set_logon_script(sampass,
772	talloc_sub_basic(ctx, username, domain,
773	lp_logon_script()),
774	PDB_DEFAULT );
775	}
776
777	profile_path = smbldap_talloc_single_attribute(
778	ldap_state->smbldap_state->ldap_struct,
779	entry,
780	get_userattr_key2string(ldap_state->schema_ver,
781	LDAP_ATTR_PROFILE_PATH),
782	ctx);
783	if (profile_path) {
784	if (expand_explicit) {
785	profile_path = talloc_sub_basic(ctx,
786	username,
787	domain,
788	profile_path);
789	if (!profile_path) {
790	goto fn_exit;
791	}
792	}
793	pdb_set_profile_path(sampass, profile_path, PDB_SET);
794	} else {
795	pdb_set_profile_path(sampass,
796	talloc_sub_basic(ctx, username, domain,
797	lp_logon_path()),
798	PDB_DEFAULT );
799	}
800
801	acct_desc = smbldap_talloc_single_attribute(
802	ldap_state->smbldap_state->ldap_struct,
803	entry,
804	get_userattr_key2string(ldap_state->schema_ver,
805	LDAP_ATTR_DESC),
806	ctx);
807	if (acct_desc) {
808	pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
809	}
810
811	workstations = smbldap_talloc_single_attribute(
812	ldap_state->smbldap_state->ldap_struct,
813	entry,
814	get_userattr_key2string(ldap_state->schema_ver,
815	LDAP_ATTR_USER_WKS),
816	ctx);
817	if (workstations) {
818	pdb_set_workstations(sampass, workstations, PDB_SET);
819	}
820
821	munged_dial = smbldap_talloc_single_attribute(
822	ldap_state->smbldap_state->ldap_struct,
823	entry,
824	get_userattr_key2string(ldap_state->schema_ver,
825	LDAP_ATTR_MUNGED_DIAL),
826	ctx);
827	if (munged_dial) {
828	pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
829	}
830
831	/* FIXME: hours stuff should be cleaner */
832
833	logon_divs = 168;
834	hours_len = 21;
835	memset(hours, 0xff, hours_len);
836
837	if (ldap_state->is_nds_ldap) {
838	char *user_dn;
839	size_t pwd_len;
840	char clear_text_pw[512];
841
842	/* Make call to Novell eDirectory ldap extension to get clear text password.
843	NOTE: This will only work if we have an SSL connection to eDirectory. */
844	user_dn = smbldap_talloc_dn(ctx, ldap_state->smbldap_state->ldap_struct, entry);
845	if (user_dn != NULL) {
846	DEBUG(3, ("init_sam_from_ldap: smbldap_talloc_dn(ctx, %s) returned '%s'\n", username, user_dn));
847
848	pwd_len = sizeof(clear_text_pw);
849	if (pdb_nds_get_password(ldap_state->smbldap_state, user_dn, &pwd_len, clear_text_pw) == LDAP_SUCCESS) {
850	nt_lm_owf_gen(clear_text_pw, smbntpwd, smblmpwd);
851	if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET)) {
852	TALLOC_FREE(user_dn);
853	return False;
854	}
855	ZERO_STRUCT(smblmpwd);
856	if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET)) {
857	TALLOC_FREE(user_dn);
858	return False;
859	}
860	ZERO_STRUCT(smbntpwd);
861	use_samba_attrs = False;
862	}
863
864	TALLOC_FREE(user_dn);
865
866	} else {
867	DEBUG(0, ("init_sam_from_ldap: failed to get user_dn for '%s'\n", username));
868	}
869	}
870
871	if (use_samba_attrs) {
872	temp = smbldap_talloc_single_attribute(
873	ldap_state->smbldap_state->ldap_struct,
874	entry,
875	get_userattr_key2string(ldap_state->schema_ver,
876	LDAP_ATTR_LMPW),
877	ctx);
878	if (temp) {
879	pdb_gethexpwd(temp, smblmpwd);
880	memset((char *)temp, '\0', strlen(temp)+1);
881	if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET)) {
882	goto fn_exit;
883	}
884	ZERO_STRUCT(smblmpwd);
885	}
886
887	temp = smbldap_talloc_single_attribute(
888	ldap_state->smbldap_state->ldap_struct,
889	entry,
890	get_userattr_key2string(ldap_state->schema_ver,
891	LDAP_ATTR_NTPW),
892	ctx);
893	if (temp) {
894	pdb_gethexpwd(temp, smbntpwd);
895	memset((char *)temp, '\0', strlen(temp)+1);
896	if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET)) {
897	goto fn_exit;
898	}
899	ZERO_STRUCT(smbntpwd);
900	}
901	}
902
903	pwHistLen = 0;
904
905	pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
906	if (pwHistLen > 0){
907	uint8 *pwhist = NULL;
908	int i;
909	char *history_string = TALLOC_ARRAY(ctx, char,
910	MAX_PW_HISTORY_LEN*64);
911
912	if (!history_string) {
913	goto fn_exit;
914	}
915
916	pwHistLen = MIN(pwHistLen, MAX_PW_HISTORY_LEN);
917
918	if ((pwhist = TALLOC_ARRAY(ctx, uint8,
919	pwHistLen * PW_HISTORY_ENTRY_LEN)) ==
920	NULL){
921	DEBUG(0, ("init_sam_from_ldap: talloc failed!\n"));
922	goto fn_exit;
923	}
924	memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
925
926	if (smbldap_get_single_attribute(
927	ldap_state->smbldap_state->ldap_struct,
928	entry,
929	get_userattr_key2string(ldap_state->schema_ver,
930	LDAP_ATTR_PWD_HISTORY),
931	history_string,
932	MAX_PW_HISTORY_LEN*64)) {
933	bool hex_failed = false;
934	for (i = 0; i < pwHistLen; i++){
935	/* Get the 16 byte salt. */
936	if (!pdb_gethexpwd(&history_string[i*64],
937	&pwhist[i*PW_HISTORY_ENTRY_LEN])) {
938	hex_failed = true;
939	break;
940	}
941	/* Get the 16 byte MD5 hash of salt+passwd. */
942	if (!pdb_gethexpwd(&history_string[(i*64)+32],
943	&pwhist[(i*PW_HISTORY_ENTRY_LEN)+
944	PW_HISTORY_SALT_LEN])) {
945	hex_failed = True;
946	break;
947	}
948	}
949	if (hex_failed) {
950	DEBUG(2,("init_sam_from_ldap: Failed to get password history for user %s\n",
951	username));
952	memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
953	}
954	}
955	if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
956	goto fn_exit;
957	}
958	}
959
960	temp = smbldap_talloc_single_attribute(
961	ldap_state->smbldap_state->ldap_struct,
962	entry,
963	get_userattr_key2string(ldap_state->schema_ver,
964	LDAP_ATTR_ACB_INFO),
965	ctx);
966	if (temp) {
967	acct_ctrl = pdb_decode_acct_ctrl(temp);
968
969	if (acct_ctrl == 0) {
970	acct_ctrl \|= ACB_NORMAL;
971	}
972
973	pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
974	} else {
975	acct_ctrl \|= ACB_NORMAL;
976	}
977
978	pdb_set_hours_len(sampass, hours_len, PDB_SET);
979	pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
980
981	temp = smbldap_talloc_single_attribute(
982	ldap_state->smbldap_state->ldap_struct,
983	entry,
984	get_userattr_key2string(ldap_state->schema_ver,
985	LDAP_ATTR_BAD_PASSWORD_COUNT),
986	ctx);
987	if (temp) {
988	bad_password_count = (uint32) atol(temp);
989	pdb_set_bad_password_count(sampass,
990	bad_password_count, PDB_SET);
991	}
992
993	temp = smbldap_talloc_single_attribute(
994	ldap_state->smbldap_state->ldap_struct,
995	entry,
996	get_userattr_key2string(ldap_state->schema_ver,
997	LDAP_ATTR_BAD_PASSWORD_TIME),
998	ctx);
999	if (temp) {
1000	bad_password_time = (time_t) atol(temp);
1001	pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
1002	}
1003
1004
1005	temp = smbldap_talloc_single_attribute(
1006	ldap_state->smbldap_state->ldap_struct,
1007	entry,
1008	get_userattr_key2string(ldap_state->schema_ver,
1009	LDAP_ATTR_LOGON_COUNT),
1010	ctx);
1011	if (temp) {
1012	logon_count = (uint32) atol(temp);
1013	pdb_set_logon_count(sampass, logon_count, PDB_SET);
1014	}
1015
1016	/* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
1017
1018	temp = smbldap_talloc_single_attribute(
1019	ldap_state->smbldap_state->ldap_struct,
1020	entry,
1021	get_userattr_key2string(ldap_state->schema_ver,
1022	LDAP_ATTR_LOGON_HOURS),
1023	ctx);
1024	if (temp) {
1025	pdb_gethexhours(temp, hours);
1026	memset((char *)temp, '\0', strlen(temp) +1);
1027	pdb_set_hours(sampass, hours, PDB_SET);
1028	ZERO_STRUCT(hours);
1029	}
1030
1031	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
1032	struct passwd unix_pw;
1033	bool have_uid = false;
1034	bool have_gid = false;
1035	DOM_SID mapped_gsid;
1036	const DOM_SID *primary_gsid;
1037
1038	ZERO_STRUCT(unix_pw);
1039
1040	unix_pw.pw_name = username;
1041	unix_pw.pw_passwd = discard_const_p(char, "x");
1042
1043	temp = smbldap_talloc_single_attribute(
1044	priv2ld(ldap_state),
1045	entry,
1046	"uidNumber",
1047	ctx);
1048	if (temp) {
1049	/* We've got a uid, feed the cache */
1050	unix_pw.pw_uid = strtoul(temp, NULL, 10);
1051	have_uid = true;
1052	}
1053	temp = smbldap_talloc_single_attribute(
1054	priv2ld(ldap_state),
1055	entry,
1056	"gidNumber",
1057	ctx);
1058	if (temp) {
1059	/* We've got a uid, feed the cache */
1060	unix_pw.pw_gid = strtoul(temp, NULL, 10);
1061	have_gid = true;
1062	}
1063	unix_pw.pw_gecos = smbldap_talloc_single_attribute(
1064	priv2ld(ldap_state),
1065	entry,
1066	"gecos",
1067	ctx);
1068	if (unix_pw.pw_gecos) {
1069	unix_pw.pw_gecos = fullname;
1070	}
1071	unix_pw.pw_dir = smbldap_talloc_single_attribute(
1072	priv2ld(ldap_state),
1073	entry,
1074	"homeDirectory",
1075	ctx);
1076	if (unix_pw.pw_dir) {
1077	unix_pw.pw_dir = discard_const_p(char, "");
1078	}
1079	unix_pw.pw_shell = smbldap_talloc_single_attribute(
1080	priv2ld(ldap_state),
1081	entry,
1082	"loginShell",
1083	ctx);
1084	if (unix_pw.pw_shell) {
1085	unix_pw.pw_shell = discard_const_p(char, "");
1086	}
1087
1088	if (have_uid && have_gid) {
1089	sampass->unix_pw = tcopy_passwd(sampass, &unix_pw);
1090	} else {
1091	sampass->unix_pw = Get_Pwnam_alloc(sampass, unix_pw.pw_name);
1092	}
1093
1094	if (sampass->unix_pw == NULL) {
1095	DEBUG(0,("init_sam_from_ldap: Failed to find Unix account for %s\n",
1096	pdb_get_username(sampass)));
1097	goto fn_exit;
1098	}
1099
1100	store_uid_sid_cache(pdb_get_user_sid(sampass),
1101	sampass->unix_pw->pw_uid);
1102	idmap_cache_set_sid2uid(pdb_get_user_sid(sampass),
1103	sampass->unix_pw->pw_uid);
1104
1105	gid_to_sid(&mapped_gsid, sampass->unix_pw->pw_gid);
1106	primary_gsid = pdb_get_group_sid(sampass);
1107	if (primary_gsid && sid_equal(primary_gsid, &mapped_gsid)) {
1108	store_gid_sid_cache(primary_gsid,
1109	sampass->unix_pw->pw_gid);
1110	idmap_cache_set_sid2uid(primary_gsid,
1111	sampass->unix_pw->pw_gid);
1112	}
1113	}
1114
1115	/* check the timestamp of the cache vs ldap entry */
1116	if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
1117	entry))) {
1118	ret = true;
1119	goto fn_exit;
1120	}
1121
1122	/* see if we have newer updates */
1123	if (!(cache_entry = login_cache_read(sampass))) {
1124	DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
1125	(unsigned int)pdb_get_bad_password_count(sampass),
1126	(unsigned int)pdb_get_bad_password_time(sampass)));
1127	ret = true;
1128	goto fn_exit;
1129	}
1130
1131	DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
1132	(unsigned int)ldap_entry_time,
1133	(unsigned int)cache_entry->entry_timestamp,
1134	(unsigned int)cache_entry->bad_password_time));
1135
1136	if (ldap_entry_time > cache_entry->entry_timestamp) {
1137	/* cache is older than directory , so
1138	we need to delete the entry but allow the
1139	fields to be written out */
1140	login_cache_delentry(sampass);
1141	} else {
1142	/* read cache in */
1143	pdb_set_acct_ctrl(sampass,
1144	pdb_get_acct_ctrl(sampass) \|
1145	(cache_entry->acct_ctrl & ACB_AUTOLOCK),
1146	PDB_SET);
1147	pdb_set_bad_password_count(sampass,
1148	cache_entry->bad_password_count,
1149	PDB_SET);
1150	pdb_set_bad_password_time(sampass,
1151	cache_entry->bad_password_time,
1152	PDB_SET);
1153	}
1154
1155	ret = true;
1156
1157	fn_exit:
1158
1159	TALLOC_FREE(ctx);
1160	SAFE_FREE(cache_entry);
1161	return ret;
1162	}
1163
1164	/**********************************************************************
1165	Initialize the ldap db from a struct samu. Called on update.
1166	(Based on init_buffer_from_sam in pdb_tdb.c)
1167	*********************************************************************/
1168
1169	static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
1170	LDAPMessage *existing,
1171	LDAPMod *** mods, struct samu * sampass,
1172	bool (need_update)(const struct samu ,
1173	enum pdb_elements))
1174	{
1175	char *temp = NULL;
1176	uint32 rid;
1177
1178	if (mods == NULL \|\| sampass == NULL) {
1179	DEBUG(0, ("init_ldap_from_sam: NULL parameters found!\n"));
1180	return False;
1181	}
1182
1183	*mods = NULL;
1184
1185	/*
1186	* took out adding "objectclass: sambaAccount"
1187	* do this on a per-mod basis
1188	*/
1189	if (need_update(sampass, PDB_USERNAME)) {
1190	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1191	"uid", pdb_get_username(sampass));
1192	if (ldap_state->is_nds_ldap) {
1193	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1194	"cn", pdb_get_username(sampass));
1195	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1196	"sn", pdb_get_username(sampass));
1197	}
1198	}
1199
1200	DEBUG(2, ("init_ldap_from_sam: Setting entry for user: %s\n", pdb_get_username(sampass)));
1201
1202	/* only update the RID if we actually need to */
1203	if (need_update(sampass, PDB_USERSID)) {
1204	fstring sid_string;
1205	const DOM_SID *user_sid = pdb_get_user_sid(sampass);
1206
1207	switch ( ldap_state->schema_ver ) {
1208	case SCHEMAVER_SAMBAACCOUNT:
1209	if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
1210	DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
1211	sid_string_dbg(user_sid),
1212	sid_string_dbg(
1213	&ldap_state->domain_sid)));
1214	return False;
1215	}
1216	if (asprintf(&temp, "%i", rid) < 0) {
1217	return false;
1218	}
1219	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1220	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
1221	temp);
1222	SAFE_FREE(temp);
1223	break;
1224
1225	case SCHEMAVER_SAMBASAMACCOUNT:
1226	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1227	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
1228	sid_to_fstring(sid_string, user_sid));
1229	break;
1230
1231	default:
1232	DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
1233	break;
1234	}
1235	}
1236
1237	/* we don't need to store the primary group RID - so leaving it
1238	'free' to hang off the unix primary group makes life easier */
1239
1240	if (need_update(sampass, PDB_GROUPSID)) {
1241	fstring sid_string;
1242	const DOM_SID *group_sid = pdb_get_group_sid(sampass);
1243
1244	switch ( ldap_state->schema_ver ) {
1245	case SCHEMAVER_SAMBAACCOUNT:
1246	if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
1247	DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
1248	sid_string_dbg(group_sid),
1249	sid_string_dbg(
1250	&ldap_state->domain_sid)));
1251	return False;
1252	}
1253
1254	if (asprintf(&temp, "%i", rid) < 0) {
1255	return false;
1256	}
1257	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1258	get_userattr_key2string(ldap_state->schema_ver,
1259	LDAP_ATTR_PRIMARY_GROUP_RID), temp);
1260	SAFE_FREE(temp);
1261	break;
1262
1263	case SCHEMAVER_SAMBASAMACCOUNT:
1264	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1265	get_userattr_key2string(ldap_state->schema_ver,
1266	LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_fstring(sid_string, group_sid));
1267	break;
1268
1269	default:
1270	DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
1271	break;
1272	}
1273
1274	}
1275
1276	/* displayName, cn, and gecos should all be the same
1277	* most easily accomplished by giving them the same OID
1278	* gecos isn't set here b/c it should be handled by the
1279	* add-user script
1280	* We change displayName only and fall back to cn if
1281	* it does not exist.
1282	*/
1283
1284	if (need_update(sampass, PDB_FULLNAME))
1285	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1286	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME),
1287	pdb_get_fullname(sampass));
1288
1289	if (need_update(sampass, PDB_ACCTDESC))
1290	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1291	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC),
1292	pdb_get_acct_desc(sampass));
1293
1294	if (need_update(sampass, PDB_WORKSTATIONS))
1295	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1296	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
1297	pdb_get_workstations(sampass));
1298
1299	if (need_update(sampass, PDB_MUNGEDDIAL))
1300	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1301	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL),
1302	pdb_get_munged_dial(sampass));
1303
1304	if (need_update(sampass, PDB_SMBHOME))
1305	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1306	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
1307	pdb_get_homedir(sampass));
1308
1309	if (need_update(sampass, PDB_DRIVE))
1310	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1311	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
1312	pdb_get_dir_drive(sampass));
1313
1314	if (need_update(sampass, PDB_LOGONSCRIPT))
1315	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1316	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT),
1317	pdb_get_logon_script(sampass));
1318
1319	if (need_update(sampass, PDB_PROFILE))
1320	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1321	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
1322	pdb_get_profile_path(sampass));
1323
1324	if (asprintf(&temp, "%li", (long int)pdb_get_logon_time(sampass)) < 0) {
1325	return false;
1326	}
1327	if (need_update(sampass, PDB_LOGONTIME))
1328	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1329	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
1330	SAFE_FREE(temp);
1331
1332	if (asprintf(&temp, "%li", (long int)pdb_get_logoff_time(sampass)) < 0) {
1333	return false;
1334	}
1335	if (need_update(sampass, PDB_LOGOFFTIME))
1336	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1337	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
1338	SAFE_FREE(temp);
1339
1340	if (asprintf(&temp, "%li", (long int)pdb_get_kickoff_time(sampass)) < 0) {
1341	return false;
1342	}
1343	if (need_update(sampass, PDB_KICKOFFTIME))
1344	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1345	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
1346	SAFE_FREE(temp);
1347
1348	if (asprintf(&temp, "%li", (long int)pdb_get_pass_can_change_time_noncalc(sampass)) < 0) {
1349	return false;
1350	}
1351	if (need_update(sampass, PDB_CANCHANGETIME))
1352	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1353	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
1354	SAFE_FREE(temp);
1355
1356	if (asprintf(&temp, "%li", (long int)pdb_get_pass_must_change_time(sampass)) < 0) {
1357	return false;
1358	}
1359	if (need_update(sampass, PDB_MUSTCHANGETIME))
1360	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1361	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
1362	SAFE_FREE(temp);
1363
1364	if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST))
1365	\|\| (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
1366
1367	if (need_update(sampass, PDB_LMPASSWD)) {
1368	const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
1369	if (lm_pw) {
1370	char pwstr[34];
1371	pdb_sethexpwd(pwstr, lm_pw,
1372	pdb_get_acct_ctrl(sampass));
1373	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1374	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1375	pwstr);
1376	} else {
1377	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1378	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1379	NULL);
1380	}
1381	}
1382	if (need_update(sampass, PDB_NTPASSWD)) {
1383	const uchar *nt_pw = pdb_get_nt_passwd(sampass);
1384	if (nt_pw) {
1385	char pwstr[34];
1386	pdb_sethexpwd(pwstr, nt_pw,
1387	pdb_get_acct_ctrl(sampass));
1388	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1389	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1390	pwstr);
1391	} else {
1392	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1393	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1394	NULL);
1395	}
1396	}
1397
1398	if (need_update(sampass, PDB_PWHISTORY)) {
1399	char *pwstr = NULL;
1400	uint32 pwHistLen = 0;
1401	pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
1402
1403	pwstr = SMB_MALLOC_ARRAY(char, 1024);
1404	if (!pwstr) {
1405	return false;
1406	}
1407	if (pwHistLen == 0) {
1408	/* Remove any password history from the LDAP store. */
1409	memset(pwstr, '0', 64); /* NOTE !!!! '0' NOT '\0' /
1410	pwstr[64] = '\0';
1411	} else {
1412	int i;
1413	uint32 currHistLen = 0;
1414	const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
1415	if (pwhist != NULL) {
1416	/* We can only store (1024-1/64 password history entries. */
1417	pwHistLen = MIN(pwHistLen, ((1024-1)/64));
1418	for (i=0; i< pwHistLen && i < currHistLen; i++) {
1419	/* Store the salt. */
1420	pdb_sethexpwd(&pwstr[i64], &pwhist[iPW_HISTORY_ENTRY_LEN], 0);
1421	/* Followed by the md5 hash of salt + md4 hash */
1422	pdb_sethexpwd(&pwstr[(i*64)+32],
1423	&pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
1424	DEBUG(100, ("pwstr=%s\n", pwstr));
1425	}
1426	}
1427	}
1428	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1429	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
1430	pwstr);
1431	SAFE_FREE(pwstr);
1432	}
1433
1434	if (need_update(sampass, PDB_PASSLASTSET)) {
1435	if (asprintf(&temp, "%li",
1436	(long int)pdb_get_pass_last_set_time(sampass)) < 0) {
1437	return false;
1438	}
1439	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1440	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
1441	temp);
1442	SAFE_FREE(temp);
1443	}
1444	}
1445
1446	if (need_update(sampass, PDB_HOURS)) {
1447	const uint8 *hours = pdb_get_hours(sampass);
1448	if (hours) {
1449	char hourstr[44];
1450	pdb_sethexhours(hourstr, hours);
1451	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
1452	existing,
1453	mods,
1454	get_userattr_key2string(ldap_state->schema_ver,
1455	LDAP_ATTR_LOGON_HOURS),
1456	hourstr);
1457	}
1458	}
1459
1460	if (need_update(sampass, PDB_ACCTCTRL))
1461	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1462	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
1463	pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
1464
1465	/* password lockout cache:
1466	- If we are now autolocking or clearing, we write to ldap
1467	- If we are clearing, we delete the cache entry
1468	- If the count is > 0, we update the cache
1469
1470	This even means when autolocking, we cache, just in case the
1471	update doesn't work, and we have to cache the autolock flag */
1472
1473	if (need_update(sampass, PDB_BAD_PASSWORD_COUNT)) /* &&
1474	need_update(sampass, PDB_BAD_PASSWORD_TIME)) */ {
1475	uint16 badcount = pdb_get_bad_password_count(sampass);
1476	time_t badtime = pdb_get_bad_password_time(sampass);
1477	uint32 pol;
1478	pdb_get_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT, &pol);
1479
1480	DEBUG(3, ("updating bad password fields, policy=%u, count=%u, time=%u\n",
1481	(unsigned int)pol, (unsigned int)badcount, (unsigned int)badtime));
1482
1483	if ((badcount >= pol) \|\| (badcount == 0)) {
1484	DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
1485	(unsigned int)badcount, (unsigned int)badtime));
1486	if (asprintf(&temp, "%li", (long)badcount) < 0) {
1487	return false;
1488	}
1489	smbldap_make_mod(
1490	ldap_state->smbldap_state->ldap_struct,
1491	existing, mods,
1492	get_userattr_key2string(
1493	ldap_state->schema_ver,
1494	LDAP_ATTR_BAD_PASSWORD_COUNT),
1495	temp);
1496	SAFE_FREE(temp);
1497
1498	if (asprintf(&temp, "%li", (long int)badtime) < 0) {
1499	return false;
1500	}
1501	smbldap_make_mod(
1502	ldap_state->smbldap_state->ldap_struct,
1503	existing, mods,
1504	get_userattr_key2string(
1505	ldap_state->schema_ver,
1506	LDAP_ATTR_BAD_PASSWORD_TIME),
1507	temp);
1508	SAFE_FREE(temp);
1509	}
1510	if (badcount == 0) {
1511	DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
1512	login_cache_delentry(sampass);
1513	} else {
1514	LOGIN_CACHE cache_entry;
1515
1516	cache_entry.entry_timestamp = time(NULL);
1517	cache_entry.acct_ctrl = pdb_get_acct_ctrl(sampass);
1518	cache_entry.bad_password_count = badcount;
1519	cache_entry.bad_password_time = badtime;
1520
1521	DEBUG(7, ("Updating bad password count and time in login cache\n"));
1522	login_cache_write(sampass, cache_entry);
1523	}
1524	}
1525
1526	return True;
1527	}
1528
1529	/**********************************************************************
1530	End enumeration of the LDAP password list.
1531	*********************************************************************/
1532
1533	static void ldapsam_endsampwent(struct pdb_methods *my_methods)
1534	{
1535	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1536	if (ldap_state->result) {
1537	ldap_msgfree(ldap_state->result);
1538	ldap_state->result = NULL;
1539	}
1540	}
1541
1542	static void append_attr(TALLOC_CTX mem_ctx, const char **attr_list,
1543	const char *new_attr)
1544	{
1545	int i;
1546
1547	if (new_attr == NULL) {
1548	return;
1549	}
1550
1551	for (i=0; (*attr_list)[i] != NULL; i++) {
1552	;
1553	}
1554
1555	(attr_list) = TALLOC_REALLOC_ARRAY(mem_ctx, (attr_list),
1556	const char *, i+2);
1557	SMB_ASSERT((*attr_list) != NULL);
1558	(attr_list)[i] = talloc_strdup((attr_list), new_attr);
1559	(*attr_list)[i+1] = NULL;
1560	}
1561
1562	static void ldapsam_add_unix_attributes(TALLOC_CTX *mem_ctx,
1563	const char ***attr_list)
1564	{
1565	append_attr(mem_ctx, attr_list, "uidNumber");
1566	append_attr(mem_ctx, attr_list, "gidNumber");
1567	append_attr(mem_ctx, attr_list, "homeDirectory");
1568	append_attr(mem_ctx, attr_list, "loginShell");
1569	append_attr(mem_ctx, attr_list, "gecos");
1570	}
1571
1572	/**********************************************************************
1573	Get struct samu entry from LDAP by username.
1574	*********************************************************************/
1575
1576	static NTSTATUS ldapsam_getsampwnam(struct pdb_methods my_methods, struct samu user, const char *sname)
1577	{
1578	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1579	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1580	LDAPMessage *result = NULL;
1581	LDAPMessage *entry = NULL;
1582	int count;
1583	const char ** attr_list;
1584	int rc;
1585
1586	attr_list = get_userattr_list( user, ldap_state->schema_ver );
1587	append_attr(user, &attr_list,
1588	get_userattr_key2string(ldap_state->schema_ver,
1589	LDAP_ATTR_MOD_TIMESTAMP));
1590	ldapsam_add_unix_attributes(user, &attr_list);
1591	rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result,
1592	attr_list);
1593	TALLOC_FREE( attr_list );
1594
1595	if ( rc != LDAP_SUCCESS )
1596	return NT_STATUS_NO_SUCH_USER;
1597
1598	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1599
1600	if (count < 1) {
1601	DEBUG(4, ("ldapsam_getsampwnam: Unable to locate user [%s] count=%d\n", sname, count));
1602	ldap_msgfree(result);
1603	return NT_STATUS_NO_SUCH_USER;
1604	} else if (count > 1) {
1605	DEBUG(1, ("ldapsam_getsampwnam: Duplicate entries for this user [%s] Failing. count=%d\n", sname, count));
1606	ldap_msgfree(result);
1607	return NT_STATUS_NO_SUCH_USER;
1608	}
1609
1610	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1611	if (entry) {
1612	if (!init_sam_from_ldap(ldap_state, user, entry)) {
1613	DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname));
1614	ldap_msgfree(result);
1615	return NT_STATUS_NO_SUCH_USER;
1616	}
1617	pdb_set_backend_private_data(user, result, NULL,
1618	my_methods, PDB_CHANGED);
1619	talloc_autofree_ldapmsg(user, result);
1620	ret = NT_STATUS_OK;
1621	} else {
1622	ldap_msgfree(result);
1623	}
1624	return ret;
1625	}
1626
1627	static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state,
1628	const DOM_SID sid, LDAPMessage *result)
1629	{
1630	int rc = -1;
1631	const char ** attr_list;
1632	uint32 rid;
1633
1634	switch ( ldap_state->schema_ver ) {
1635	case SCHEMAVER_SAMBASAMACCOUNT: {
1636	TALLOC_CTX *tmp_ctx = talloc_new(NULL);
1637	if (tmp_ctx == NULL) {
1638	return LDAP_NO_MEMORY;
1639	}
1640
1641	attr_list = get_userattr_list(tmp_ctx,
1642	ldap_state->schema_ver);
1643	append_attr(tmp_ctx, &attr_list,
1644	get_userattr_key2string(
1645	ldap_state->schema_ver,
1646	LDAP_ATTR_MOD_TIMESTAMP));
1647	ldapsam_add_unix_attributes(tmp_ctx, &attr_list);
1648	rc = ldapsam_search_suffix_by_sid(ldap_state, sid,
1649	result, attr_list);
1650	TALLOC_FREE(tmp_ctx);
1651
1652	if ( rc != LDAP_SUCCESS )
1653	return rc;
1654	break;
1655	}
1656
1657	case SCHEMAVER_SAMBAACCOUNT:
1658	if (!sid_peek_check_rid(&ldap_state->domain_sid, sid, &rid)) {
1659	return rc;
1660	}
1661
1662	attr_list = get_userattr_list(NULL,
1663	ldap_state->schema_ver);
1664	rc = ldapsam_search_suffix_by_rid(ldap_state, rid, result, attr_list );
1665	TALLOC_FREE( attr_list );
1666
1667	if ( rc != LDAP_SUCCESS )
1668	return rc;
1669	break;
1670	}
1671	return rc;
1672	}
1673
1674	/**********************************************************************
1675	Get struct samu entry from LDAP by SID.
1676	*********************************************************************/
1677
1678	static NTSTATUS ldapsam_getsampwsid(struct pdb_methods my_methods, struct samu user, const DOM_SID *sid)
1679	{
1680	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1681	LDAPMessage *result = NULL;
1682	LDAPMessage *entry = NULL;
1683	int count;
1684	int rc;
1685
1686	rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1687	sid, &result);
1688	if (rc != LDAP_SUCCESS)
1689	return NT_STATUS_NO_SUCH_USER;
1690
1691	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1692
1693	if (count < 1) {
1694	DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] "
1695	"count=%d\n", sid_string_dbg(sid), count));
1696	ldap_msgfree(result);
1697	return NT_STATUS_NO_SUCH_USER;
1698	} else if (count > 1) {
1699	DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID "
1700	"[%s]. Failing. count=%d\n", sid_string_dbg(sid),
1701	count));
1702	ldap_msgfree(result);
1703	return NT_STATUS_NO_SUCH_USER;
1704	}
1705
1706	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1707	if (!entry) {
1708	ldap_msgfree(result);
1709	return NT_STATUS_NO_SUCH_USER;
1710	}
1711
1712	if (!init_sam_from_ldap(ldap_state, user, entry)) {
1713	DEBUG(1,("ldapsam_getsampwsid: init_sam_from_ldap failed!\n"));
1714	ldap_msgfree(result);
1715	return NT_STATUS_NO_SUCH_USER;
1716	}
1717
1718	pdb_set_backend_private_data(user, result, NULL,
1719	my_methods, PDB_CHANGED);
1720	talloc_autofree_ldapmsg(user, result);
1721	return NT_STATUS_OK;
1722	}
1723
1724	/********************************************************************
1725	Do the actual modification - also change a plaintext passord if
1726	it it set.
1727	**********************************************************************/
1728
1729	static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods,
1730	struct samu newpwd, char dn,
1731	LDAPMod **mods, int ldap_op,
1732	bool (need_update)(const struct samu , enum pdb_elements))
1733	{
1734	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1735	int rc;
1736
1737	if (!newpwd \|\| !dn) {
1738	return NT_STATUS_INVALID_PARAMETER;
1739	}
1740
1741	if (!mods) {
1742	DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
1743	/* may be password change below however */
1744	} else {
1745	switch(ldap_op) {
1746	case LDAP_MOD_ADD:
1747	if (ldap_state->is_nds_ldap) {
1748	smbldap_set_mod(&mods, LDAP_MOD_ADD,
1749	"objectclass",
1750	"inetOrgPerson");
1751	} else {
1752	smbldap_set_mod(&mods, LDAP_MOD_ADD,
1753	"objectclass",
1754	LDAP_OBJ_ACCOUNT);
1755	}
1756	rc = smbldap_add(ldap_state->smbldap_state,
1757	dn, mods);
1758	break;
1759	case LDAP_MOD_REPLACE:
1760	rc = smbldap_modify(ldap_state->smbldap_state,
1761	dn ,mods);
1762	break;
1763	default:
1764	DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n",
1765	ldap_op));
1766	return NT_STATUS_INVALID_PARAMETER;
1767	}
1768
1769	if (rc!=LDAP_SUCCESS) {
1770	return NT_STATUS_UNSUCCESSFUL;
1771	}
1772	}
1773
1774	if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST)) &&
1775	(lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) &&
1776	need_update(newpwd, PDB_PLAINTEXT_PW) &&
1777	(pdb_get_plaintext_passwd(newpwd)!=NULL)) {
1778	BerElement *ber;
1779	struct berval *bv;
1780	char *retoid = NULL;
1781	struct berval *retdata = NULL;
1782	char *utf8_password;
1783	char *utf8_dn;
1784	size_t converted_size;
1785	int ret;
1786
1787	if (!ldap_state->is_nds_ldap) {
1788
1789	if (!smbldap_has_extension(ldap_state->smbldap_state->ldap_struct,
1790	LDAP_EXOP_MODIFY_PASSWD)) {
1791	DEBUG(2, ("ldap password change requested, but LDAP "
1792	"server does not support it -- ignoring\n"));
1793	return NT_STATUS_OK;
1794	}
1795	}
1796
1797	if (!push_utf8_talloc(talloc_tos(), &utf8_password,
1798	pdb_get_plaintext_passwd(newpwd),
1799	&converted_size))
1800	{
1801	return NT_STATUS_NO_MEMORY;
1802	}
1803
1804	if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1805	TALLOC_FREE(utf8_password);
1806	return NT_STATUS_NO_MEMORY;
1807	}
1808
1809	if ((ber = ber_alloc_t(LBER_USE_DER))==NULL) {
1810	DEBUG(0,("ber_alloc_t returns NULL\n"));
1811	TALLOC_FREE(utf8_password);
1812	TALLOC_FREE(utf8_dn);
1813	return NT_STATUS_UNSUCCESSFUL;
1814	}
1815
1816	if ((ber_printf (ber, "{") < 0) \|\|
1817	(ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID,
1818	utf8_dn) < 0)) {
1819	DEBUG(0,("ldapsam_modify_entry: ber_printf returns a "
1820	"value <0\n"));
1821	ber_free(ber,1);
1822	TALLOC_FREE(utf8_dn);
1823	TALLOC_FREE(utf8_password);
1824	return NT_STATUS_UNSUCCESSFUL;
1825	}
1826
1827	if ((utf8_password != NULL) && (*utf8_password != '\0')) {
1828	ret = ber_printf(ber, "ts}",
1829	LDAP_TAG_EXOP_MODIFY_PASSWD_NEW,
1830	utf8_password);
1831	} else {
1832	ret = ber_printf(ber, "}");
1833	}
1834
1835	if (ret < 0) {
1836	DEBUG(0,("ldapsam_modify_entry: ber_printf returns a "
1837	"value <0\n"));
1838	ber_free(ber,1);
1839	TALLOC_FREE(utf8_dn);
1840	TALLOC_FREE(utf8_password);
1841	return NT_STATUS_UNSUCCESSFUL;
1842	}
1843
1844	if ((rc = ber_flatten (ber, &bv))<0) {
1845	DEBUG(0,("ldapsam_modify_entry: ber_flatten returns a value <0\n"));
1846	ber_free(ber,1);
1847	TALLOC_FREE(utf8_dn);
1848	TALLOC_FREE(utf8_password);
1849	return NT_STATUS_UNSUCCESSFUL;
1850	}
1851
1852	TALLOC_FREE(utf8_dn);
1853	TALLOC_FREE(utf8_password);
1854	ber_free(ber, 1);
1855
1856	if (!ldap_state->is_nds_ldap) {
1857	rc = smbldap_extended_operation(ldap_state->smbldap_state,
1858	LDAP_EXOP_MODIFY_PASSWD,
1859	bv, NULL, NULL, &retoid,
1860	&retdata);
1861	} else {
1862	rc = pdb_nds_set_password(ldap_state->smbldap_state, dn,
1863	pdb_get_plaintext_passwd(newpwd));
1864	}
1865	if (rc != LDAP_SUCCESS) {
1866	char *ld_error = NULL;
1867
1868	if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
1869	DEBUG(3, ("Could not set userPassword "
1870	"attribute due to an objectClass "
1871	"violation -- ignoring\n"));
1872	ber_bvfree(bv);
1873	return NT_STATUS_OK;
1874	}
1875
1876	ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1877	&ld_error);
1878	DEBUG(0,("ldapsam_modify_entry: LDAP Password could not be changed for user %s: %s\n\t%s\n",
1879	pdb_get_username(newpwd), ldap_err2string(rc), ld_error?ld_error:"unknown"));
1880	SAFE_FREE(ld_error);
1881	ber_bvfree(bv);
1882	#if defined(LDAP_CONSTRAINT_VIOLATION)
1883	if (rc == LDAP_CONSTRAINT_VIOLATION)
1884	return NT_STATUS_PASSWORD_RESTRICTION;
1885	#endif
1886	return NT_STATUS_UNSUCCESSFUL;
1887	} else {
1888	DEBUG(3,("ldapsam_modify_entry: LDAP Password changed for user %s\n",pdb_get_username(newpwd)));
1889	#ifdef DEBUG_PASSWORD
1890	DEBUG(100,("ldapsam_modify_entry: LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd)));
1891	#endif
1892	if (retdata)
1893	ber_bvfree(retdata);
1894	if (retoid)
1895	ldap_memfree(retoid);
1896	}
1897	ber_bvfree(bv);
1898	}
1899	return NT_STATUS_OK;
1900	}
1901
1902	/**********************************************************************
1903	Delete entry from LDAP for username.
1904	*********************************************************************/
1905
1906	static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods,
1907	struct samu * sam_acct)
1908	{
1909	struct ldapsam_privates *priv =
1910	(struct ldapsam_privates *)my_methods->private_data;
1911	const char *sname;
1912	int rc;
1913	LDAPMessage msg, entry;
1914	NTSTATUS result = NT_STATUS_NO_MEMORY;
1915	const char **attr_list;
1916	TALLOC_CTX *mem_ctx;
1917
1918	if (!sam_acct) {
1919	DEBUG(0, ("ldapsam_delete_sam_account: sam_acct was NULL!\n"));
1920	return NT_STATUS_INVALID_PARAMETER;
1921	}
1922
1923	sname = pdb_get_username(sam_acct);
1924
1925	DEBUG(3, ("ldapsam_delete_sam_account: Deleting user %s from "
1926	"LDAP.\n", sname));
1927
1928	mem_ctx = talloc_new(NULL);
1929	if (mem_ctx == NULL) {
1930	DEBUG(0, ("talloc_new failed\n"));
1931	goto done;
1932	}
1933
1934	attr_list = get_userattr_delete_list(mem_ctx, priv->schema_ver );
1935	if (attr_list == NULL) {
1936	goto done;
1937	}
1938
1939	rc = ldapsam_search_suffix_by_name(priv, sname, &msg, attr_list);
1940
1941	if ((rc != LDAP_SUCCESS) \|\|
1942	(ldap_count_entries(priv2ld(priv), msg) != 1) \|\|
1943	((entry = ldap_first_entry(priv2ld(priv), msg)) == NULL)) {
1944	DEBUG(5, ("Could not find user %s\n", sname));
1945	result = NT_STATUS_NO_SUCH_USER;
1946	goto done;
1947	}
1948
1949	rc = ldapsam_delete_entry(
1950	priv, mem_ctx, entry,
1951	priv->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ?
1952	LDAP_OBJ_SAMBASAMACCOUNT : LDAP_OBJ_SAMBAACCOUNT,
1953	attr_list);
1954
1955	result = (rc == LDAP_SUCCESS) ?
1956	NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
1957
1958	done:
1959	TALLOC_FREE(mem_ctx);
1960	return result;
1961	}
1962
1963	/**********************************************************************
1964	Helper function to determine for update_sam_account whether
1965	we need LDAP modification.
1966	*********************************************************************/
1967
1968	static bool element_is_changed(const struct samu *sampass,
1969	enum pdb_elements element)
1970	{
1971	return IS_SAM_CHANGED(sampass, element);
1972	}
1973
1974	/**********************************************************************
1975	Update struct samu.
1976	*********************************************************************/
1977
1978	static NTSTATUS ldapsam_update_sam_account(struct pdb_methods my_methods, struct samu newpwd)
1979	{
1980	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1981	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1982	int rc = 0;
1983	char *dn;
1984	LDAPMessage *result = NULL;
1985	LDAPMessage *entry = NULL;
1986	LDAPMod **mods = NULL;
1987	const char **attr_list;
1988
1989	result = (LDAPMessage *)pdb_get_backend_private_data(newpwd, my_methods);
1990	if (!result) {
1991	attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
1992	if (pdb_get_username(newpwd) == NULL) {
1993	return NT_STATUS_INVALID_PARAMETER;
1994	}
1995	rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list );
1996	TALLOC_FREE( attr_list );
1997	if (rc != LDAP_SUCCESS) {
1998	return NT_STATUS_UNSUCCESSFUL;
1999	}
2000	pdb_set_backend_private_data(newpwd, result, NULL,
2001	my_methods, PDB_CHANGED);
2002	talloc_autofree_ldapmsg(newpwd, result);
2003	}
2004
2005	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
2006	DEBUG(0, ("ldapsam_update_sam_account: No user to modify!\n"));
2007	return NT_STATUS_UNSUCCESSFUL;
2008	}
2009
2010	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
2011	dn = smbldap_talloc_dn(talloc_tos(), ldap_state->smbldap_state->ldap_struct, entry);
2012	if (!dn) {
2013	return NT_STATUS_UNSUCCESSFUL;
2014	}
2015
2016	DEBUG(4, ("ldapsam_update_sam_account: user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn));
2017
2018	if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
2019	element_is_changed)) {
2020	DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
2021	TALLOC_FREE(dn);
2022	if (mods != NULL)
2023	ldap_mods_free(mods,True);
2024	return NT_STATUS_UNSUCCESSFUL;
2025	}
2026
2027	if ((lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_ONLY)
2028	&& (mods == NULL)) {
2029	DEBUG(4,("ldapsam_update_sam_account: mods is empty: nothing to update for user: %s\n",
2030	pdb_get_username(newpwd)));
2031	TALLOC_FREE(dn);
2032	return NT_STATUS_OK;
2033	}
2034
2035	ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed);
2036
2037	if (mods != NULL) {
2038	ldap_mods_free(mods,True);
2039	}
2040
2041	TALLOC_FREE(dn);
2042
2043	/*
2044	* We need to set the backend private data to NULL here. For example
2045	* setuserinfo level 25 does a pdb_update_sam_account twice on the
2046	* same one, and with the explicit delete / add logic for attribute
2047	* values the second time we would use the wrong "old" value which
2048	* does not exist in LDAP anymore. Thus the LDAP server would refuse
2049	* the update.
2050	* The existing LDAPMessage is still being auto-freed by the
2051	* destructor.
2052	*/
2053	pdb_set_backend_private_data(newpwd, NULL, NULL, my_methods,
2054	PDB_CHANGED);
2055
2056	if (!NT_STATUS_IS_OK(ret)) {
2057	return ret;
2058	}
2059
2060	DEBUG(2, ("ldapsam_update_sam_account: successfully modified uid = %s in the LDAP database\n",
2061	pdb_get_username(newpwd)));
2062	return NT_STATUS_OK;
2063	}
2064
2065	/***************************************************************************
2066	Renames a struct samu
2067	- The "rename user script" has full responsibility for changing everything
2068	***************************************************************************/
2069
2070	static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
2071	TALLOC_CTX *tmp_ctx,
2072	uint32 group_rid,
2073	uint32 member_rid);
2074
2075	static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
2076	TALLOC_CTX *mem_ctx,
2077	struct samu *user,
2078	DOM_SID **pp_sids,
2079	gid_t **pp_gids,
2080	size_t *p_num_groups);
2081
2082	static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
2083	struct samu *old_acct,
2084	const char *newname)
2085	{
2086	const char *oldname;
2087	int rc;
2088	char *rename_script = NULL;
2089	fstring oldname_lower, newname_lower;
2090
2091	if (!old_acct) {
2092	DEBUG(0, ("ldapsam_rename_sam_account: old_acct was NULL!\n"));
2093	return NT_STATUS_INVALID_PARAMETER;
2094	}
2095	if (!newname) {
2096	DEBUG(0, ("ldapsam_rename_sam_account: newname was NULL!\n"));
2097	return NT_STATUS_INVALID_PARAMETER;
2098	}
2099
2100	oldname = pdb_get_username(old_acct);
2101
2102	/* rename the posix user */
2103	rename_script = SMB_STRDUP(lp_renameuser_script());
2104	if (rename_script == NULL) {
2105	return NT_STATUS_NO_MEMORY;
2106	}
2107
2108	if (!(*rename_script)) {
2109	SAFE_FREE(rename_script);
2110	return NT_STATUS_ACCESS_DENIED;
2111	}
2112
2113	DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n",
2114	oldname, newname));
2115
2116	/* We have to allow the account name to end with a '$'.
2117	Also, follow the semantics in _samr_create_user() and lower case the
2118	posix name but preserve the case in passdb */
2119
2120	fstrcpy( oldname_lower, oldname );
2121	strlower_m( oldname_lower );
2122	fstrcpy( newname_lower, newname );
2123	strlower_m( newname_lower );
2124	rename_script = realloc_string_sub2(rename_script,
2125	"%unew",
2126	newname_lower,
2127	true,
2128	true);
2129	if (!rename_script) {
2130	return NT_STATUS_NO_MEMORY;
2131	}
2132	rename_script = realloc_string_sub2(rename_script,
2133	"%uold",
2134	oldname_lower,
2135	true,
2136	true);
2137	rc = smbrun(rename_script, NULL);
2138
2139	DEBUG(rc ? 0 : 3,("Running the command `%s' gave %d\n",
2140	rename_script, rc));
2141
2142	SAFE_FREE(rename_script);
2143
2144	if (rc == 0) {
2145	smb_nscd_flush_user_cache();
2146	}
2147
2148	if (rc)
2149	return NT_STATUS_UNSUCCESSFUL;
2150
2151	return NT_STATUS_OK;
2152	}
2153
2154	/**********************************************************************
2155	Helper function to determine for update_sam_account whether
2156	we need LDAP modification.
2157	*********************************************************************/
2158
2159	static bool element_is_set_or_changed(const struct samu *sampass,
2160	enum pdb_elements element)
2161	{
2162	return (IS_SAM_SET(sampass, element) \|\|
2163	IS_SAM_CHANGED(sampass, element));
2164	}
2165
2166	/**********************************************************************
2167	Add struct samu to LDAP.
2168	*********************************************************************/
2169
2170	static NTSTATUS ldapsam_add_sam_account(struct pdb_methods my_methods, struct samu newpwd)
2171	{
2172	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2173	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
2174	int rc;
2175	LDAPMessage *result = NULL;
2176	LDAPMessage *entry = NULL;
2177	LDAPMod **mods = NULL;
2178	int ldap_op = LDAP_MOD_REPLACE;
2179	uint32 num_result;
2180	const char **attr_list;
2181	char *escape_user = NULL;
2182	const char *username = pdb_get_username(newpwd);
2183	const DOM_SID *sid = pdb_get_user_sid(newpwd);
2184	char *filter = NULL;
2185	char *dn = NULL;
2186	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
2187	TALLOC_CTX *ctx = talloc_init("ldapsam_add_sam_account");
2188
2189	if (!ctx) {
2190	return NT_STATUS_NO_MEMORY;
2191	}
2192
2193	if (!username \|\| !*username) {
2194	DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
2195	status = NT_STATUS_INVALID_PARAMETER;
2196	goto fn_exit;
2197	}
2198
2199	/* free this list after the second search or in case we exit on failure */
2200	attr_list = get_userattr_list(ctx, ldap_state->schema_ver);
2201
2202	rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
2203
2204	if (rc != LDAP_SUCCESS) {
2205	goto fn_exit;
2206	}
2207
2208	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
2209	DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
2210	username));
2211	goto fn_exit;
2212	}
2213	ldap_msgfree(result);
2214	result = NULL;
2215
2216	if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
2217	rc = ldapsam_get_ldap_user_by_sid(ldap_state,
2218	sid, &result);
2219	if (rc == LDAP_SUCCESS) {
2220	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
2221	DEBUG(0,("ldapsam_add_sam_account: SID '%s' "
2222	"already in the base, with samba "
2223	"attributes\n", sid_string_dbg(sid)));
2224	goto fn_exit;
2225	}
2226	ldap_msgfree(result);
2227	result = NULL;
2228	}
2229	}
2230
2231	/* does the entry already exist but without a samba attributes?
2232	we need to return the samba attributes here */
2233
2234	escape_user = escape_ldap_string(talloc_tos(), username);
2235	filter = talloc_strdup(attr_list, "(uid=%u)");
2236	if (!filter) {
2237	status = NT_STATUS_NO_MEMORY;
2238	goto fn_exit;
2239	}
2240	filter = talloc_all_string_sub(attr_list, filter, "%u", escape_user);
2241	TALLOC_FREE(escape_user);
2242	if (!filter) {
2243	status = NT_STATUS_NO_MEMORY;
2244	goto fn_exit;
2245	}
2246
2247	rc = smbldap_search_suffix(ldap_state->smbldap_state,
2248	filter, attr_list, &result);
2249	if ( rc != LDAP_SUCCESS ) {
2250	goto fn_exit;
2251	}
2252
2253	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2254
2255	if (num_result > 1) {
2256	DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
2257	goto fn_exit;
2258	}
2259
2260	/* Check if we need to update an existing entry */
2261	if (num_result == 1) {
2262	DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
2263	ldap_op = LDAP_MOD_REPLACE;
2264	entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
2265	dn = smbldap_talloc_dn(ctx, ldap_state->smbldap_state->ldap_struct, entry);
2266	if (!dn) {
2267	status = NT_STATUS_NO_MEMORY;
2268	goto fn_exit;
2269	}
2270
2271	} else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
2272
2273	/* There might be a SID for this account already - say an idmap entry */
2274
2275	filter = talloc_asprintf(ctx,
2276	"(&(%s=%s)(\|(objectClass=%s)(objectClass=%s)))",
2277	get_userattr_key2string(ldap_state->schema_ver,
2278	LDAP_ATTR_USER_SID),
2279	sid_string_talloc(ctx, sid),
2280	LDAP_OBJ_IDMAP_ENTRY,
2281	LDAP_OBJ_SID_ENTRY);
2282	if (!filter) {
2283	status = NT_STATUS_NO_MEMORY;
2284	goto fn_exit;
2285	}
2286
2287	/* free old result before doing a new search */
2288	if (result != NULL) {
2289	ldap_msgfree(result);
2290	result = NULL;
2291	}
2292	rc = smbldap_search_suffix(ldap_state->smbldap_state,
2293	filter, attr_list, &result);
2294
2295	if ( rc != LDAP_SUCCESS ) {
2296	goto fn_exit;
2297	}
2298
2299	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2300
2301	if (num_result > 1) {
2302	DEBUG (0, ("ldapsam_add_sam_account: More than one user with specified Sid exists: bailing out!\n"));
2303	goto fn_exit;
2304	}
2305
2306	/* Check if we need to update an existing entry */
2307	if (num_result == 1) {
2308
2309	DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
2310	ldap_op = LDAP_MOD_REPLACE;
2311	entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
2312	dn = smbldap_talloc_dn (ctx, ldap_state->smbldap_state->ldap_struct, entry);
2313	if (!dn) {
2314	status = NT_STATUS_NO_MEMORY;
2315	goto fn_exit;
2316	}
2317	}
2318	}
2319
2320	if (num_result == 0) {
2321	char *escape_username;
2322	/* Check if we need to add an entry */
2323	DEBUG(3,("ldapsam_add_sam_account: Adding new user\n"));
2324	ldap_op = LDAP_MOD_ADD;
2325
2326	escape_username = escape_rdn_val_string_alloc(username);
2327	if (!escape_username) {
2328	status = NT_STATUS_NO_MEMORY;
2329	goto fn_exit;
2330	}
2331
2332	if (username[strlen(username)-1] == '$') {
2333	dn = talloc_asprintf(ctx,
2334	"uid=%s,%s",
2335	escape_username,
2336	lp_ldap_machine_suffix());
2337	} else {
2338	dn = talloc_asprintf(ctx,
2339	"uid=%s,%s",
2340	escape_username,
2341	lp_ldap_user_suffix());
2342	}
2343
2344	SAFE_FREE(escape_username);
2345	if (!dn) {
2346	status = NT_STATUS_NO_MEMORY;
2347	goto fn_exit;
2348	}
2349	}
2350
2351	if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
2352	element_is_set_or_changed)) {
2353	DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
2354	if (mods != NULL) {
2355	ldap_mods_free(mods, true);
2356	}
2357	goto fn_exit;
2358	}
2359
2360	if (mods == NULL) {
2361	DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
2362	goto fn_exit;
2363	}
2364	switch ( ldap_state->schema_ver ) {
2365	case SCHEMAVER_SAMBAACCOUNT:
2366	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT);
2367	break;
2368	case SCHEMAVER_SAMBASAMACCOUNT:
2369	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT);
2370	break;
2371	default:
2372	DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n"));
2373	break;
2374	}
2375
2376	ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed);
2377	if (!NT_STATUS_IS_OK(ret)) {
2378	DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
2379	pdb_get_username(newpwd),dn));
2380	ldap_mods_free(mods, true);
2381	goto fn_exit;
2382	}
2383
2384	DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
2385	ldap_mods_free(mods, true);
2386
2387	status = NT_STATUS_OK;
2388
2389	fn_exit:
2390
2391	TALLOC_FREE(ctx);
2392	if (result) {
2393	ldap_msgfree(result);
2394	}
2395	return status;
2396	}
2397
2398	/**********************************************************************
2399	*********************************************************************/
2400
2401	static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
2402	const char *filter,
2403	LDAPMessage ** result)
2404	{
2405	int scope = LDAP_SCOPE_SUBTREE;
2406	int rc;
2407	const char **attr_list;
2408
2409	attr_list = get_attr_list(NULL, groupmap_attr_list);
2410	rc = smbldap_search(ldap_state->smbldap_state,
2411	lp_ldap_suffix (), scope,
2412	filter, attr_list, 0, result);
2413	TALLOC_FREE(attr_list);
2414
2415	return rc;
2416	}
2417
2418	/**********************************************************************
2419	*********************************************************************/
2420
2421	static bool init_group_from_ldap(struct ldapsam_privates *ldap_state,
2422	GROUP_MAP map, LDAPMessage entry)
2423	{
2424	char *temp = NULL;
2425	TALLOC_CTX *ctx = talloc_init("init_group_from_ldap");
2426
2427	if (ldap_state == NULL \|\| map == NULL \|\| entry == NULL \|\|
2428	ldap_state->smbldap_state->ldap_struct == NULL) {
2429	DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
2430	TALLOC_FREE(ctx);
2431	return false;
2432	}
2433
2434	temp = smbldap_talloc_single_attribute(
2435	ldap_state->smbldap_state->ldap_struct,
2436	entry,
2437	get_attr_key2string(groupmap_attr_list,
2438	LDAP_ATTR_GIDNUMBER),
2439	ctx);
2440	if (!temp) {
2441	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2442	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
2443	TALLOC_FREE(ctx);
2444	return false;
2445	}
2446	DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
2447
2448	map->gid = (gid_t)atol(temp);
2449
2450	TALLOC_FREE(temp);
2451	temp = smbldap_talloc_single_attribute(
2452	ldap_state->smbldap_state->ldap_struct,
2453	entry,
2454	get_attr_key2string(groupmap_attr_list,
2455	LDAP_ATTR_GROUP_SID),
2456	ctx);
2457	if (!temp) {
2458	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2459	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
2460	TALLOC_FREE(ctx);
2461	return false;
2462	}
2463
2464	if (!string_to_sid(&map->sid, temp)) {
2465	DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
2466	TALLOC_FREE(ctx);
2467	return false;
2468	}
2469
2470	TALLOC_FREE(temp);
2471	temp = smbldap_talloc_single_attribute(
2472	ldap_state->smbldap_state->ldap_struct,
2473	entry,
2474	get_attr_key2string(groupmap_attr_list,
2475	LDAP_ATTR_GROUP_TYPE),
2476	ctx);
2477	if (!temp) {
2478	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2479	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
2480	TALLOC_FREE(ctx);
2481	return false;
2482	}
2483	map->sid_name_use = (enum lsa_SidType)atol(temp);
2484
2485	if ((map->sid_name_use < SID_NAME_USER) \|\|
2486	(map->sid_name_use > SID_NAME_UNKNOWN)) {
2487	DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
2488	TALLOC_FREE(ctx);
2489	return false;
2490	}
2491
2492	TALLOC_FREE(temp);
2493	temp = smbldap_talloc_single_attribute(
2494	ldap_state->smbldap_state->ldap_struct,
2495	entry,
2496	get_attr_key2string(groupmap_attr_list,
2497	LDAP_ATTR_DISPLAY_NAME),
2498	ctx);
2499	if (!temp) {
2500	temp = smbldap_talloc_single_attribute(
2501	ldap_state->smbldap_state->ldap_struct,
2502	entry,
2503	get_attr_key2string(groupmap_attr_list,
2504	LDAP_ATTR_CN),
2505	ctx);
2506	if (!temp) {
2507	DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
2508	for gidNumber(%lu)\n",(unsigned long)map->gid));
2509	TALLOC_FREE(ctx);
2510	return false;
2511	}
2512	}
2513	fstrcpy(map->nt_name, temp);
2514
2515	TALLOC_FREE(temp);
2516	temp = smbldap_talloc_single_attribute(
2517	ldap_state->smbldap_state->ldap_struct,
2518	entry,
2519	get_attr_key2string(groupmap_attr_list,
2520	LDAP_ATTR_DESC),
2521	ctx);
2522	if (!temp) {
2523	temp = talloc_strdup(ctx, "");
2524	if (!temp) {
2525	TALLOC_FREE(ctx);
2526	return false;
2527	}
2528	}
2529	fstrcpy(map->comment, temp);
2530
2531	if (lp_parm_bool(-1, "ldapsam", "trusted", false)) {
2532	store_gid_sid_cache(&map->sid, map->gid);
2533	idmap_cache_set_sid2gid(&map->sid, map->gid);
2534	}
2535
2536	TALLOC_FREE(ctx);
2537	return true;
2538	}
2539
2540	/**********************************************************************
2541	*********************************************************************/
2542
2543	static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods,
2544	const char *filter,
2545	GROUP_MAP *map)
2546	{
2547	struct ldapsam_privates *ldap_state =
2548	(struct ldapsam_privates *)methods->private_data;
2549	LDAPMessage *result = NULL;
2550	LDAPMessage *entry = NULL;
2551	int count;
2552
2553	if (ldapsam_search_one_group(ldap_state, filter, &result)
2554	!= LDAP_SUCCESS) {
2555	return NT_STATUS_NO_SUCH_GROUP;
2556	}
2557
2558	count = ldap_count_entries(priv2ld(ldap_state), result);
2559
2560	if (count < 1) {
2561	DEBUG(4, ("ldapsam_getgroup: Did not find group, filter was "
2562	"%s\n", filter));
2563	ldap_msgfree(result);
2564	return NT_STATUS_NO_SUCH_GROUP;
2565	}
2566
2567	if (count > 1) {
2568	DEBUG(1, ("ldapsam_getgroup: Duplicate entries for filter %s: "
2569	"count=%d\n", filter, count));
2570	ldap_msgfree(result);
2571	return NT_STATUS_NO_SUCH_GROUP;
2572	}
2573
2574	entry = ldap_first_entry(priv2ld(ldap_state), result);
2575
2576	if (!entry) {
2577	ldap_msgfree(result);
2578	return NT_STATUS_UNSUCCESSFUL;
2579	}
2580
2581	if (!init_group_from_ldap(ldap_state, map, entry)) {
2582	DEBUG(1, ("ldapsam_getgroup: init_group_from_ldap failed for "
2583	"group filter %s\n", filter));
2584	ldap_msgfree(result);
2585	return NT_STATUS_NO_SUCH_GROUP;
2586	}
2587
2588	ldap_msgfree(result);
2589	return NT_STATUS_OK;
2590	}
2591
2592	/**********************************************************************
2593	*********************************************************************/
2594
2595	static NTSTATUS ldapsam_getgrsid(struct pdb_methods methods, GROUP_MAP map,
2596	DOM_SID sid)
2597	{
2598	char *filter = NULL;
2599	NTSTATUS status;
2600	fstring tmp;
2601
2602	if (asprintf(&filter, "(&(objectClass=%s)(%s=%s))",
2603	LDAP_OBJ_GROUPMAP,
2604	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
2605	sid_to_fstring(tmp, &sid)) < 0) {
2606	return NT_STATUS_NO_MEMORY;
2607	}
2608
2609	status = ldapsam_getgroup(methods, filter, map);
2610	SAFE_FREE(filter);
2611	return status;
2612	}
2613
2614	/**********************************************************************
2615	*********************************************************************/
2616
2617	static NTSTATUS ldapsam_getgrgid(struct pdb_methods methods, GROUP_MAP map,
2618	gid_t gid)
2619	{
2620	char *filter = NULL;
2621	NTSTATUS status;
2622
2623	if (asprintf(&filter, "(&(objectClass=%s)(%s=%lu))",
2624	LDAP_OBJ_GROUPMAP,
2625	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2626	(unsigned long)gid) < 0) {
2627	return NT_STATUS_NO_MEMORY;
2628	}
2629
2630	status = ldapsam_getgroup(methods, filter, map);
2631	SAFE_FREE(filter);
2632	return status;
2633	}
2634
2635	/**********************************************************************
2636	*********************************************************************/
2637
2638	static NTSTATUS ldapsam_getgrnam(struct pdb_methods methods, GROUP_MAP map,
2639	const char *name)
2640	{
2641	char *filter = NULL;
2642	char *escape_name = escape_ldap_string(talloc_tos(), name);
2643	NTSTATUS status;
2644
2645	if (!escape_name) {
2646	return NT_STATUS_NO_MEMORY;
2647	}
2648
2649	if (asprintf(&filter, "(&(objectClass=%s)(\|(%s=%s)(%s=%s)))",
2650	LDAP_OBJ_GROUPMAP,
2651	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
2652	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN),
2653	escape_name) < 0) {
2654	TALLOC_FREE(escape_name);
2655	return NT_STATUS_NO_MEMORY;
2656	}
2657
2658	TALLOC_FREE(escape_name);
2659	status = ldapsam_getgroup(methods, filter, map);
2660	SAFE_FREE(filter);
2661	return status;
2662	}
2663
2664	static bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
2665	LDAPMessage *entry,
2666	const DOM_SID *domain_sid,
2667	uint32 *rid)
2668	{
2669	fstring str;
2670	DOM_SID sid;
2671
2672	if (!smbldap_get_single_attribute(ldap_struct, entry, "sambaSID",
2673	str, sizeof(str)-1)) {
2674	DEBUG(10, ("Could not find sambaSID attribute\n"));
2675	return False;
2676	}
2677
2678	if (!string_to_sid(&sid, str)) {
2679	DEBUG(10, ("Could not convert string %s to sid\n", str));
2680	return False;
2681	}
2682
2683	if (sid_compare_domain(&sid, domain_sid) != 0) {
2684	DEBUG(10, ("SID %s is not in expected domain %s\n",
2685	str, sid_string_dbg(domain_sid)));
2686	return False;
2687	}
2688
2689	if (!sid_peek_rid(&sid, rid)) {
2690	DEBUG(10, ("Could not peek into RID\n"));
2691	return False;
2692	}
2693
2694	return True;
2695	}
2696
2697	static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
2698	TALLOC_CTX *mem_ctx,
2699	const DOM_SID *group,
2700	uint32 **pp_member_rids,
2701	size_t *p_num_members)
2702	{
2703	struct ldapsam_privates *ldap_state =
2704	(struct ldapsam_privates *)methods->private_data;
2705	struct smbldap_state *conn = ldap_state->smbldap_state;
2706	const char *id_attrs[] = { "memberUid", "gidNumber", NULL };
2707	const char *sid_attrs[] = { "sambaSID", NULL };
2708	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2709	LDAPMessage *result = NULL;
2710	LDAPMessage *entry;
2711	char *filter;
2712	char **values = NULL;
2713	char **memberuid;
2714	char *gidstr;
2715	int rc, count;
2716
2717	*pp_member_rids = NULL;
2718	*p_num_members = 0;
2719
2720	filter = talloc_asprintf(mem_ctx,
2721	"(&(objectClass=%s)"
2722	"(objectClass=%s)"
2723	"(sambaSID=%s))",
2724	LDAP_OBJ_POSIXGROUP,
2725	LDAP_OBJ_GROUPMAP,
2726	sid_string_talloc(mem_ctx, group));
2727	if (filter == NULL) {
2728	ret = NT_STATUS_NO_MEMORY;
2729	goto done;
2730	}
2731
2732	rc = smbldap_search(conn, lp_ldap_suffix(),
2733	LDAP_SCOPE_SUBTREE, filter, id_attrs, 0,
2734	&result);
2735
2736	if (rc != LDAP_SUCCESS)
2737	goto done;
2738
2739	talloc_autofree_ldapmsg(mem_ctx, result);
2740
2741	count = ldap_count_entries(conn->ldap_struct, result);
2742
2743	if (count > 1) {
2744	DEBUG(1, ("Found more than one groupmap entry for %s\n",
2745	sid_string_dbg(group)));
2746	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2747	goto done;
2748	}
2749
2750	if (count == 0) {
2751	ret = NT_STATUS_NO_SUCH_GROUP;
2752	goto done;
2753	}
2754
2755	entry = ldap_first_entry(conn->ldap_struct, result);
2756	if (entry == NULL)
2757	goto done;
2758
2759	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", mem_ctx);
2760	if (!gidstr) {
2761	DEBUG (0, ("ldapsam_enum_group_members: Unable to find the group's gid!\n"));
2762	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2763	goto done;
2764	}
2765
2766	values = ldap_get_values(conn->ldap_struct, entry, "memberUid");
2767
2768	if ((values != NULL) && (values[0] != NULL)) {
2769
2770	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(\|", LDAP_OBJ_SAMBASAMACCOUNT);
2771	if (filter == NULL) {
2772	ret = NT_STATUS_NO_MEMORY;
2773	goto done;
2774	}
2775
2776	for (memberuid = values; *memberuid != NULL; memberuid += 1) {
2777	char *escape_memberuid;
2778
2779	escape_memberuid = escape_ldap_string(talloc_tos(),
2780	*memberuid);
2781	if (escape_memberuid == NULL) {
2782	ret = NT_STATUS_NO_MEMORY;
2783	goto done;
2784	}
2785
2786	filter = talloc_asprintf_append_buffer(filter, "(uid=%s)", escape_memberuid);
2787	TALLOC_FREE(escape_memberuid);
2788	if (filter == NULL) {
2789	ret = NT_STATUS_NO_MEMORY;
2790	goto done;
2791	}
2792	}
2793
2794	filter = talloc_asprintf_append_buffer(filter, "))");
2795	if (filter == NULL) {
2796	ret = NT_STATUS_NO_MEMORY;
2797	goto done;
2798	}
2799
2800	rc = smbldap_search(conn, lp_ldap_suffix(),
2801	LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
2802	&result);
2803
2804	if (rc != LDAP_SUCCESS)
2805	goto done;
2806
2807	count = ldap_count_entries(conn->ldap_struct, result);
2808	DEBUG(10,("ldapsam_enum_group_members: found %d accounts\n", count));
2809
2810	talloc_autofree_ldapmsg(mem_ctx, result);
2811
2812	for (entry = ldap_first_entry(conn->ldap_struct, result);
2813	entry != NULL;
2814	entry = ldap_next_entry(conn->ldap_struct, entry))
2815	{
2816	char *sidstr;
2817	DOM_SID sid;
2818	uint32 rid;
2819
2820	sidstr = smbldap_talloc_single_attribute(conn->ldap_struct,
2821	entry, "sambaSID",
2822	mem_ctx);
2823	if (!sidstr) {
2824	DEBUG(0, ("Severe DB error, %s can't miss the sambaSID"
2825	"attribute\n", LDAP_OBJ_SAMBASAMACCOUNT));
2826	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2827	goto done;
2828	}
2829
2830	if (!string_to_sid(&sid, sidstr))
2831	goto done;
2832
2833	if (!sid_check_is_in_our_domain(&sid)) {
2834	DEBUG(0, ("Inconsistent SAM -- group member uid not "
2835	"in our domain\n"));
2836	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2837	goto done;
2838	}
2839
2840	sid_peek_rid(&sid, &rid);
2841
2842	if (!add_rid_to_array_unique(mem_ctx, rid, pp_member_rids,
2843	p_num_members)) {
2844	ret = NT_STATUS_NO_MEMORY;
2845	goto done;
2846	}
2847	}
2848	}
2849
2850	filter = talloc_asprintf(mem_ctx,
2851	"(&(objectClass=%s)"
2852	"(gidNumber=%s))",
2853	LDAP_OBJ_SAMBASAMACCOUNT,
2854	gidstr);
2855
2856	rc = smbldap_search(conn, lp_ldap_suffix(),
2857	LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
2858	&result);
2859
2860	if (rc != LDAP_SUCCESS)
2861	goto done;
2862
2863	talloc_autofree_ldapmsg(mem_ctx, result);
2864
2865	for (entry = ldap_first_entry(conn->ldap_struct, result);
2866	entry != NULL;
2867	entry = ldap_next_entry(conn->ldap_struct, entry))
2868	{
2869	uint32 rid;
2870
2871	if (!ldapsam_extract_rid_from_entry(conn->ldap_struct,
2872	entry,
2873	get_global_sam_sid(),
2874	&rid)) {
2875	DEBUG(0, ("Severe DB error, %s can't miss the samba SID" "attribute\n", LDAP_OBJ_SAMBASAMACCOUNT));
2876	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2877	goto done;
2878	}
2879
2880	if (!add_rid_to_array_unique(mem_ctx, rid, pp_member_rids,
2881	p_num_members)) {
2882	ret = NT_STATUS_NO_MEMORY;
2883	goto done;
2884	}
2885	}
2886
2887	ret = NT_STATUS_OK;
2888
2889	done:
2890
2891	if (values)
2892	ldap_value_free(values);
2893
2894	return ret;
2895	}
2896
2897	static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
2898	TALLOC_CTX *mem_ctx,
2899	struct samu *user,
2900	DOM_SID **pp_sids,
2901	gid_t **pp_gids,
2902	size_t *p_num_groups)
2903	{
2904	struct ldapsam_privates *ldap_state =
2905	(struct ldapsam_privates *)methods->private_data;
2906	struct smbldap_state *conn = ldap_state->smbldap_state;
2907	char *filter;
2908	const char *attrs[] = { "gidNumber", "sambaSID", NULL };
2909	char *escape_name;
2910	int rc, count;
2911	LDAPMessage *result = NULL;
2912	LDAPMessage *entry;
2913	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2914	size_t num_sids, num_gids;
2915	char *gidstr;
2916	gid_t primary_gid = -1;
2917
2918	*pp_sids = NULL;
2919	num_sids = 0;
2920
2921	if (pdb_get_username(user) == NULL) {
2922	return NT_STATUS_INVALID_PARAMETER;
2923	}
2924
2925	escape_name = escape_ldap_string(talloc_tos(), pdb_get_username(user));
2926	if (escape_name == NULL)
2927	return NT_STATUS_NO_MEMORY;
2928
2929	if (user->unix_pw) {
2930	primary_gid = user->unix_pw->pw_gid;
2931	} else {
2932	/* retrieve the users primary gid */
2933	filter = talloc_asprintf(mem_ctx,
2934	"(&(objectClass=%s)(uid=%s))",
2935	LDAP_OBJ_SAMBASAMACCOUNT,
2936	escape_name);
2937	if (filter == NULL) {
2938	ret = NT_STATUS_NO_MEMORY;
2939	goto done;
2940	}
2941
2942	rc = smbldap_search(conn, lp_ldap_suffix(),
2943	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
2944
2945	if (rc != LDAP_SUCCESS)
2946	goto done;
2947
2948	talloc_autofree_ldapmsg(mem_ctx, result);
2949
2950	count = ldap_count_entries(priv2ld(ldap_state), result);
2951
2952	switch (count) {
2953	case 0:
2954	DEBUG(1, ("User account [%s] not found!\n", pdb_get_username(user)));
2955	ret = NT_STATUS_NO_SUCH_USER;
2956	goto done;
2957	case 1:
2958	entry = ldap_first_entry(priv2ld(ldap_state), result);
2959
2960	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", mem_ctx);
2961	if (!gidstr) {
2962	DEBUG (1, ("Unable to find the member's gid!\n"));
2963	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2964	goto done;
2965	}
2966	primary_gid = strtoul(gidstr, NULL, 10);
2967	break;
2968	default:
2969	DEBUG(1, ("found more than one account with the same user name ?!\n"));
2970	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2971	goto done;
2972	}
2973	}
2974
2975	filter = talloc_asprintf(mem_ctx,
2976	"(&(objectClass=%s)(\|(memberUid=%s)(gidNumber=%u)))",
2977	LDAP_OBJ_POSIXGROUP, escape_name, (unsigned int)primary_gid);
2978	if (filter == NULL) {
2979	ret = NT_STATUS_NO_MEMORY;
2980	goto done;
2981	}
2982
2983	rc = smbldap_search(conn, lp_ldap_suffix(),
2984	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
2985
2986	if (rc != LDAP_SUCCESS)
2987	goto done;
2988
2989	talloc_autofree_ldapmsg(mem_ctx, result);
2990
2991	num_gids = 0;
2992	*pp_gids = NULL;
2993
2994	num_sids = 0;
2995	*pp_sids = NULL;
2996
2997	/* We need to add the primary group as the first gid/sid */
2998
2999	if (!add_gid_to_array_unique(mem_ctx, primary_gid, pp_gids, &num_gids)) {
3000	ret = NT_STATUS_NO_MEMORY;
3001	goto done;
3002	}
3003
3004	/* This sid will be replaced later */
3005
3006	ret = add_sid_to_array_unique(mem_ctx, &global_sid_NULL, pp_sids,
3007	&num_sids);
3008	if (!NT_STATUS_IS_OK(ret)) {
3009	goto done;
3010	}
3011
3012	for (entry = ldap_first_entry(conn->ldap_struct, result);
3013	entry != NULL;
3014	entry = ldap_next_entry(conn->ldap_struct, entry))
3015	{
3016	fstring str;
3017	DOM_SID sid;
3018	gid_t gid;
3019	char *end;
3020
3021	if (!smbldap_get_single_attribute(conn->ldap_struct,
3022	entry, "sambaSID",
3023	str, sizeof(str)-1))
3024	continue;
3025
3026	if (!string_to_sid(&sid, str))
3027	goto done;
3028
3029	if (!smbldap_get_single_attribute(conn->ldap_struct,
3030	entry, "gidNumber",
3031	str, sizeof(str)-1))
3032	continue;
3033
3034	gid = strtoul(str, &end, 10);
3035
3036	if (PTR_DIFF(end, str) != strlen(str))
3037	goto done;
3038
3039	if (gid == primary_gid) {
3040	sid_copy(&(*pp_sids)[0], &sid);
3041	} else {
3042	if (!add_gid_to_array_unique(mem_ctx, gid, pp_gids,
3043	&num_gids)) {
3044	ret = NT_STATUS_NO_MEMORY;
3045	goto done;
3046	}
3047	ret = add_sid_to_array_unique(mem_ctx, &sid, pp_sids,
3048	&num_sids);
3049	if (!NT_STATUS_IS_OK(ret)) {
3050	goto done;
3051	}
3052	}
3053	}
3054
3055	if (sid_compare(&global_sid_NULL, &(*pp_sids)[0]) == 0) {
3056	DEBUG(3, ("primary group of [%s] not found\n",
3057	pdb_get_username(user)));
3058	goto done;
3059	}
3060
3061	*p_num_groups = num_sids;
3062
3063	ret = NT_STATUS_OK;
3064
3065	done:
3066
3067	TALLOC_FREE(escape_name);
3068	return ret;
3069	}
3070
3071	/**********************************************************************
3072	* Augment a posixGroup object with a sambaGroupMapping domgroup
3073	*********************************************************************/
3074
3075	static NTSTATUS ldapsam_map_posixgroup(TALLOC_CTX *mem_ctx,
3076	struct ldapsam_privates *ldap_state,
3077	GROUP_MAP *map)
3078	{
3079	const char filter, dn;
3080	LDAPMessage msg, entry;
3081	LDAPMod **mods;
3082	int rc;
3083
3084	filter = talloc_asprintf(mem_ctx,
3085	"(&(objectClass=%s)(gidNumber=%u))",
3086	LDAP_OBJ_POSIXGROUP, (unsigned int)map->gid);
3087	if (filter == NULL) {
3088	return NT_STATUS_NO_MEMORY;
3089	}
3090
3091	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter,
3092	get_attr_list(mem_ctx, groupmap_attr_list),
3093	&msg);
3094	talloc_autofree_ldapmsg(mem_ctx, msg);
3095
3096	if ((rc != LDAP_SUCCESS) \|\|
3097	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) != 1) \|\|
3098	((entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg)) == NULL)) {
3099	return NT_STATUS_NO_SUCH_GROUP;
3100	}
3101
3102	dn = smbldap_talloc_dn(mem_ctx, ldap_state->smbldap_state->ldap_struct, entry);
3103	if (dn == NULL) {
3104	return NT_STATUS_NO_MEMORY;
3105	}
3106
3107	mods = NULL;
3108	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass",
3109	LDAP_OBJ_GROUPMAP);
3110	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "sambaSid",
3111	sid_string_talloc(mem_ctx, &map->sid));
3112	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "sambaGroupType",
3113	talloc_asprintf(mem_ctx, "%d", map->sid_name_use));
3114	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "displayName",
3115	map->nt_name);
3116	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
3117	map->comment);
3118	talloc_autofree_ldapmod(mem_ctx, mods);
3119
3120	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3121	if (rc != LDAP_SUCCESS) {
3122	return NT_STATUS_ACCESS_DENIED;
3123	}
3124
3125	return NT_STATUS_OK;
3126	}
3127
3128	static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
3129	GROUP_MAP *map)
3130	{
3131	struct ldapsam_privates *ldap_state =
3132	(struct ldapsam_privates *)methods->private_data;
3133	LDAPMessage *msg = NULL;
3134	LDAPMod **mods = NULL;
3135	const char *attrs[] = { NULL };
3136	char *filter;
3137
3138	char *dn;
3139	TALLOC_CTX *mem_ctx;
3140	NTSTATUS result;
3141
3142	DOM_SID sid;
3143
3144	int rc;
3145
3146	mem_ctx = talloc_new(NULL);
3147	if (mem_ctx == NULL) {
3148	DEBUG(0, ("talloc_new failed\n"));
3149	return NT_STATUS_NO_MEMORY;
3150	}
3151
3152	filter = talloc_asprintf(mem_ctx, "(sambaSid=%s)",
3153	sid_string_talloc(mem_ctx, &map->sid));
3154	if (filter == NULL) {
3155	result = NT_STATUS_NO_MEMORY;
3156	goto done;
3157	}
3158
3159	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
3160	LDAP_SCOPE_SUBTREE, filter, attrs, True, &msg);
3161	talloc_autofree_ldapmsg(mem_ctx, msg);
3162
3163	if ((rc == LDAP_SUCCESS) &&
3164	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) > 0)) {
3165
3166	DEBUG(3, ("SID %s already present in LDAP, refusing to add "
3167	"group mapping entry\n", sid_string_dbg(&map->sid)));
3168	result = NT_STATUS_GROUP_EXISTS;
3169	goto done;
3170	}
3171
3172	switch (map->sid_name_use) {
3173
3174	case SID_NAME_DOM_GRP:
3175	/* To map a domain group we need to have a posix group
3176	to attach to. */
3177	result = ldapsam_map_posixgroup(mem_ctx, ldap_state, map);
3178	goto done;
3179	break;
3180
3181	case SID_NAME_ALIAS:
3182	if (!sid_check_is_in_our_domain(&map->sid)
3183	&& !sid_check_is_in_builtin(&map->sid) )
3184	{
3185	DEBUG(3, ("Refusing to map sid %s as an alias, not in our domain\n",
3186	sid_string_dbg(&map->sid)));
3187	result = NT_STATUS_INVALID_PARAMETER;
3188	goto done;
3189	}
3190	break;
3191
3192	default:
3193	DEBUG(3, ("Got invalid use '%s' for mapping\n",
3194	sid_type_lookup(map->sid_name_use)));
3195	result = NT_STATUS_INVALID_PARAMETER;
3196	goto done;
3197	}
3198
3199	/* Domain groups have been mapped in a separate routine, we have to
3200	* create an alias now */
3201
3202	if (map->gid == -1) {
3203	DEBUG(10, ("Refusing to map gid==-1\n"));
3204	result = NT_STATUS_INVALID_PARAMETER;
3205	goto done;
3206	}
3207
3208	if (pdb_gid_to_sid(map->gid, &sid)) {
3209	DEBUG(3, ("Gid %u is already mapped to SID %s, refusing to "
3210	"add\n", (unsigned int)map->gid, sid_string_dbg(&sid)));
3211	result = NT_STATUS_GROUP_EXISTS;
3212	goto done;
3213	}
3214
3215	/* Ok, enough checks done. It's still racy to go ahead now, but that's
3216	* the best we can get out of LDAP. */
3217
3218	dn = talloc_asprintf(mem_ctx, "sambaSid=%s,%s",
3219	sid_string_talloc(mem_ctx, &map->sid),
3220	lp_ldap_group_suffix());
3221	if (dn == NULL) {
3222	result = NT_STATUS_NO_MEMORY;
3223	goto done;
3224	}
3225
3226	mods = NULL;
3227
3228	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "objectClass",
3229	LDAP_OBJ_SID_ENTRY);
3230	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "objectClass",
3231	LDAP_OBJ_GROUPMAP);
3232	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "sambaSid",
3233	sid_string_talloc(mem_ctx, &map->sid));
3234	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "sambaGroupType",
3235	talloc_asprintf(mem_ctx, "%d", map->sid_name_use));
3236	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "displayName",
3237	map->nt_name);
3238	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "description",
3239	map->comment);
3240	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "gidNumber",
3241	talloc_asprintf(mem_ctx, "%u", (unsigned int)map->gid));
3242	talloc_autofree_ldapmod(mem_ctx, mods);
3243
3244	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
3245
3246	result = (rc == LDAP_SUCCESS) ?
3247	NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
3248
3249	done:
3250	TALLOC_FREE(mem_ctx);
3251	return result;
3252	}
3253
3254	/**********************************************************************
3255	* Update a group mapping entry. We're quite strict about what can be changed:
3256	* Only the description and displayname may be changed. It simply does not
3257	* make any sense to change the SID, gid or the type in a mapping.
3258	*********************************************************************/
3259
3260	static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods,
3261	GROUP_MAP *map)
3262	{
3263	struct ldapsam_privates *ldap_state =
3264	(struct ldapsam_privates *)methods->private_data;
3265	int rc;
3266	const char filter, dn;
3267	LDAPMessage *msg = NULL;
3268	LDAPMessage *entry = NULL;
3269	LDAPMod **mods = NULL;
3270	TALLOC_CTX *mem_ctx;
3271	NTSTATUS result;
3272
3273	mem_ctx = talloc_new(NULL);
3274	if (mem_ctx == NULL) {
3275	DEBUG(0, ("talloc_new failed\n"));
3276	return NT_STATUS_NO_MEMORY;
3277	}
3278
3279	/* Make 100% sure that sid, gid and type are not changed by looking up
3280	* exactly the values we're given in LDAP. */
3281
3282	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)"
3283	"(sambaSid=%s)(gidNumber=%u)"
3284	"(sambaGroupType=%d))",
3285	LDAP_OBJ_GROUPMAP,
3286	sid_string_talloc(mem_ctx, &map->sid),
3287	(unsigned int)map->gid, map->sid_name_use);
3288	if (filter == NULL) {
3289	result = NT_STATUS_NO_MEMORY;
3290	goto done;
3291	}
3292
3293	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter,
3294	get_attr_list(mem_ctx, groupmap_attr_list),
3295	&msg);
3296	talloc_autofree_ldapmsg(mem_ctx, msg);
3297
3298	if ((rc != LDAP_SUCCESS) \|\|
3299	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) != 1) \|\|
3300	((entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg)) == NULL)) {
3301	result = NT_STATUS_NO_SUCH_GROUP;
3302	goto done;
3303	}
3304
3305	dn = smbldap_talloc_dn(mem_ctx, ldap_state->smbldap_state->ldap_struct, entry);
3306
3307	if (dn == NULL) {
3308	result = NT_STATUS_NO_MEMORY;
3309	goto done;
3310	}
3311
3312	mods = NULL;
3313	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "displayName",
3314	map->nt_name);
3315	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
3316	map->comment);
3317	talloc_autofree_ldapmod(mem_ctx, mods);
3318
3319	if (mods == NULL) {
3320	DEBUG(4, ("ldapsam_update_group_mapping_entry: mods is empty: "
3321	"nothing to do\n"));
3322	result = NT_STATUS_OK;
3323	goto done;
3324	}
3325
3326	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3327
3328	if (rc != LDAP_SUCCESS) {
3329	result = NT_STATUS_ACCESS_DENIED;
3330	goto done;
3331	}
3332
3333	DEBUG(2, ("ldapsam_update_group_mapping_entry: successfully modified "
3334	"group %lu in LDAP\n", (unsigned long)map->gid));
3335
3336	result = NT_STATUS_OK;
3337
3338	done:
3339	TALLOC_FREE(mem_ctx);
3340	return result;
3341	}
3342
3343	/**********************************************************************
3344	*********************************************************************/
3345
3346	static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods,
3347	DOM_SID sid)
3348	{
3349	struct ldapsam_privates *priv =
3350	(struct ldapsam_privates *)methods->private_data;
3351	LDAPMessage msg, entry;
3352	int rc;
3353	NTSTATUS result;
3354	TALLOC_CTX *mem_ctx;
3355	char *filter;
3356
3357	mem_ctx = talloc_new(NULL);
3358	if (mem_ctx == NULL) {
3359	DEBUG(0, ("talloc_new failed\n"));
3360	return NT_STATUS_NO_MEMORY;
3361	}
3362
3363	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(%s=%s))",
3364	LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID,
3365	sid_string_talloc(mem_ctx, &sid));
3366	if (filter == NULL) {
3367	result = NT_STATUS_NO_MEMORY;
3368	goto done;
3369	}
3370	rc = smbldap_search_suffix(priv->smbldap_state, filter,
3371	get_attr_list(mem_ctx, groupmap_attr_list),
3372	&msg);
3373	talloc_autofree_ldapmsg(mem_ctx, msg);
3374
3375	if ((rc != LDAP_SUCCESS) \|\|
3376	(ldap_count_entries(priv2ld(priv), msg) != 1) \|\|
3377	((entry = ldap_first_entry(priv2ld(priv), msg)) == NULL)) {
3378	result = NT_STATUS_NO_SUCH_GROUP;
3379	goto done;
3380	}
3381
3382	rc = ldapsam_delete_entry(priv, mem_ctx, entry, LDAP_OBJ_GROUPMAP,
3383	get_attr_list(mem_ctx,
3384	groupmap_attr_list_to_delete));
3385
3386	if ((rc == LDAP_NAMING_VIOLATION) \|\|
3387	(rc == LDAP_NOT_ALLOWED_ON_RDN) \|\|
3388	(rc == LDAP_OBJECT_CLASS_VIOLATION)) {
3389	const char *attrs[] = { "sambaGroupType", "description",
3390	"displayName", "sambaSIDList",
3391	NULL };
3392
3393	/* Second try. Don't delete the sambaSID attribute, this is
3394	for "old" entries that are tacked on a winbind
3395	sambaIdmapEntry. */
3396
3397	rc = ldapsam_delete_entry(priv, mem_ctx, entry,
3398	LDAP_OBJ_GROUPMAP, attrs);
3399	}
3400
3401	if ((rc == LDAP_NAMING_VIOLATION) \|\|
3402	(rc == LDAP_NOT_ALLOWED_ON_RDN) \|\|
3403	(rc == LDAP_OBJECT_CLASS_VIOLATION)) {
3404	const char *attrs[] = { "sambaGroupType", "description",
3405	"displayName", "sambaSIDList",
3406	"gidNumber", NULL };
3407
3408	/* Third try. This is a post-3.0.21 alias (containing only
3409	* sambaSidEntry and sambaGroupMapping classes), we also have
3410	* to delete the gidNumber attribute, only the sambaSidEntry
3411	* remains */
3412
3413	rc = ldapsam_delete_entry(priv, mem_ctx, entry,
3414	LDAP_OBJ_GROUPMAP, attrs);
3415	}
3416
3417	result = (rc == LDAP_SUCCESS) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
3418
3419	done:
3420	TALLOC_FREE(mem_ctx);
3421	return result;
3422	}
3423
3424	/**********************************************************************
3425	*********************************************************************/
3426
3427	static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods,
3428	bool update)
3429	{
3430	struct ldapsam_privates *ldap_state =
3431	(struct ldapsam_privates *)my_methods->private_data;
3432	char *filter = NULL;
3433	int rc;
3434	const char **attr_list;
3435
3436	filter = talloc_asprintf(NULL, "(objectclass=%s)", LDAP_OBJ_GROUPMAP);
3437	if (!filter) {
3438	return NT_STATUS_NO_MEMORY;
3439	}
3440	attr_list = get_attr_list( NULL, groupmap_attr_list );
3441	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
3442	LDAP_SCOPE_SUBTREE, filter,
3443	attr_list, 0, &ldap_state->result);
3444	TALLOC_FREE(attr_list);
3445
3446	if (rc != LDAP_SUCCESS) {
3447	DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n",
3448	ldap_err2string(rc)));
3449	DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n",
3450	lp_ldap_suffix(), filter));
3451	ldap_msgfree(ldap_state->result);
3452	ldap_state->result = NULL;
3453	TALLOC_FREE(filter);
3454	return NT_STATUS_UNSUCCESSFUL;
3455	}
3456
3457	TALLOC_FREE(filter);
3458
3459	DEBUG(2, ("ldapsam_setsamgrent: %d entries in the base!\n",
3460	ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3461	ldap_state->result)));
3462
3463	ldap_state->entry =
3464	ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3465	ldap_state->result);
3466	ldap_state->index = 0;
3467
3468	return NT_STATUS_OK;
3469	}
3470
3471	/**********************************************************************
3472	*********************************************************************/
3473
3474	static void ldapsam_endsamgrent(struct pdb_methods *my_methods)
3475	{
3476	ldapsam_endsampwent(my_methods);
3477	}
3478
3479	/**********************************************************************
3480	*********************************************************************/
3481
3482	static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods,
3483	GROUP_MAP *map)
3484	{
3485	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
3486	struct ldapsam_privates *ldap_state =
3487	(struct ldapsam_privates *)my_methods->private_data;
3488	bool bret = False;
3489
3490	while (!bret) {
3491	if (!ldap_state->entry)
3492	return ret;
3493
3494	ldap_state->index++;
3495	bret = init_group_from_ldap(ldap_state, map,
3496	ldap_state->entry);
3497
3498	ldap_state->entry =
3499	ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
3500	ldap_state->entry);
3501	}
3502
3503	return NT_STATUS_OK;
3504	}
3505
3506	/**********************************************************************
3507	*********************************************************************/
3508
3509	static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
3510	const DOM_SID *domsid, enum lsa_SidType sid_name_use,
3511	GROUP_MAP **pp_rmap,
3512	size_t *p_num_entries,
3513	bool unix_only)
3514	{
3515	GROUP_MAP map;
3516	size_t entries = 0;
3517
3518	*p_num_entries = 0;
3519	*pp_rmap = NULL;
3520
3521	if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods, False))) {
3522	DEBUG(0, ("ldapsam_enum_group_mapping: Unable to open "
3523	"passdb\n"));
3524	return NT_STATUS_ACCESS_DENIED;
3525	}
3526
3527	while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) {
3528	if (sid_name_use != SID_NAME_UNKNOWN &&
3529	sid_name_use != map.sid_name_use) {
3530	DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
3531	"not of the requested type\n", map.nt_name));
3532	continue;
3533	}
3534	if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
3535	DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
3536	"non mapped\n", map.nt_name));
3537	continue;
3538	}
3539
3540	(pp_rmap)=SMB_REALLOC_ARRAY((pp_rmap), GROUP_MAP, entries+1);
3541	if (!(*pp_rmap)) {
3542	DEBUG(0,("ldapsam_enum_group_mapping: Unable to "
3543	"enlarge group map!\n"));
3544	return NT_STATUS_UNSUCCESSFUL;
3545	}
3546
3547	(*pp_rmap)[entries] = map;
3548
3549	entries += 1;
3550
3551	}
3552	ldapsam_endsamgrent(methods);
3553
3554	*p_num_entries = entries;
3555
3556	return NT_STATUS_OK;
3557	}
3558
3559	static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
3560	const DOM_SID *alias,
3561	const DOM_SID *member,
3562	int modop)
3563	{
3564	struct ldapsam_privates *ldap_state =
3565	(struct ldapsam_privates *)methods->private_data;
3566	char *dn = NULL;
3567	LDAPMessage *result = NULL;
3568	LDAPMessage *entry = NULL;
3569	int count;
3570	LDAPMod **mods = NULL;
3571	int rc;
3572	enum lsa_SidType type = SID_NAME_USE_NONE;
3573	fstring tmp;
3574
3575	char *filter = NULL;
3576
3577	if (sid_check_is_in_builtin(alias)) {
3578	type = SID_NAME_ALIAS;
3579	}
3580
3581	if (sid_check_is_in_our_domain(alias)) {
3582	type = SID_NAME_ALIAS;
3583	}
3584
3585	if (type == SID_NAME_USE_NONE) {
3586	DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
3587	sid_string_dbg(alias)));
3588	return NT_STATUS_NO_SUCH_ALIAS;
3589	}
3590
3591	if (asprintf(&filter,
3592	"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
3593	LDAP_OBJ_GROUPMAP, sid_to_fstring(tmp, alias),
3594	type) < 0) {
3595	return NT_STATUS_NO_MEMORY;
3596	}
3597
3598	if (ldapsam_search_one_group(ldap_state, filter,
3599	&result) != LDAP_SUCCESS) {
3600	SAFE_FREE(filter);
3601	return NT_STATUS_NO_SUCH_ALIAS;
3602	}
3603
3604	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3605	result);
3606
3607	if (count < 1) {
3608	DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
3609	ldap_msgfree(result);
3610	SAFE_FREE(filter);
3611	return NT_STATUS_NO_SUCH_ALIAS;
3612	}
3613
3614	if (count > 1) {
3615	DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for "
3616	"filter %s: count=%d\n", filter, count));
3617	ldap_msgfree(result);
3618	SAFE_FREE(filter);
3619	return NT_STATUS_NO_SUCH_ALIAS;
3620	}
3621
3622	SAFE_FREE(filter);
3623
3624	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3625	result);
3626
3627	if (!entry) {
3628	ldap_msgfree(result);
3629	return NT_STATUS_UNSUCCESSFUL;
3630	}
3631
3632	dn = smbldap_talloc_dn(talloc_tos(), ldap_state->smbldap_state->ldap_struct, entry);
3633	if (!dn) {
3634	ldap_msgfree(result);
3635	return NT_STATUS_UNSUCCESSFUL;
3636	}
3637
3638	smbldap_set_mod(&mods, modop,
3639	get_attr_key2string(groupmap_attr_list,
3640	LDAP_ATTR_SID_LIST),
3641	sid_to_fstring(tmp, member));
3642
3643	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3644
3645	ldap_mods_free(mods, True);
3646	ldap_msgfree(result);
3647	TALLOC_FREE(dn);
3648
3649	if (rc == LDAP_TYPE_OR_VALUE_EXISTS) {
3650	return NT_STATUS_MEMBER_IN_ALIAS;
3651	}
3652
3653	if (rc == LDAP_NO_SUCH_ATTRIBUTE) {
3654	return NT_STATUS_MEMBER_NOT_IN_ALIAS;
3655	}
3656
3657	if (rc != LDAP_SUCCESS) {
3658	return NT_STATUS_UNSUCCESSFUL;
3659	}
3660
3661	return NT_STATUS_OK;
3662	}
3663
3664	static NTSTATUS ldapsam_add_aliasmem(struct pdb_methods *methods,
3665	const DOM_SID *alias,
3666	const DOM_SID *member)
3667	{
3668	return ldapsam_modify_aliasmem(methods, alias, member, LDAP_MOD_ADD);
3669	}
3670
3671	static NTSTATUS ldapsam_del_aliasmem(struct pdb_methods *methods,
3672	const DOM_SID *alias,
3673	const DOM_SID *member)
3674	{
3675	return ldapsam_modify_aliasmem(methods, alias, member,
3676	LDAP_MOD_DELETE);
3677	}
3678
3679	static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
3680	const DOM_SID *alias,
3681	TALLOC_CTX *mem_ctx,
3682	DOM_SID **pp_members,
3683	size_t *p_num_members)
3684	{
3685	struct ldapsam_privates *ldap_state =
3686	(struct ldapsam_privates *)methods->private_data;
3687	LDAPMessage *result = NULL;
3688	LDAPMessage *entry = NULL;
3689	int count;
3690	char **values = NULL;
3691	int i;
3692	char *filter = NULL;
3693	size_t num_members = 0;
3694	enum lsa_SidType type = SID_NAME_USE_NONE;
3695	fstring tmp;
3696
3697	*pp_members = NULL;
3698	*p_num_members = 0;
3699
3700	if (sid_check_is_in_builtin(alias)) {
3701	type = SID_NAME_ALIAS;
3702	}
3703
3704	if (sid_check_is_in_our_domain(alias)) {
3705	type = SID_NAME_ALIAS;
3706	}
3707
3708	if (type == SID_NAME_USE_NONE) {
3709	DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
3710	sid_string_dbg(alias)));
3711	return NT_STATUS_NO_SUCH_ALIAS;
3712	}
3713
3714	if (asprintf(&filter,
3715	"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
3716	LDAP_OBJ_GROUPMAP, sid_to_fstring(tmp, alias),
3717	type) < 0) {
3718	return NT_STATUS_NO_MEMORY;
3719	}
3720
3721	if (ldapsam_search_one_group(ldap_state, filter,
3722	&result) != LDAP_SUCCESS) {
3723	SAFE_FREE(filter);
3724	return NT_STATUS_NO_SUCH_ALIAS;
3725	}
3726
3727	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3728	result);
3729
3730	if (count < 1) {
3731	DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
3732	ldap_msgfree(result);
3733	SAFE_FREE(filter);
3734	return NT_STATUS_NO_SUCH_ALIAS;
3735	}
3736
3737	if (count > 1) {
3738	DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for "
3739	"filter %s: count=%d\n", filter, count));
3740	ldap_msgfree(result);
3741	SAFE_FREE(filter);
3742	return NT_STATUS_NO_SUCH_ALIAS;
3743	}
3744
3745	SAFE_FREE(filter);
3746
3747	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3748	result);
3749
3750	if (!entry) {
3751	ldap_msgfree(result);
3752	return NT_STATUS_UNSUCCESSFUL;
3753	}
3754
3755	values = ldap_get_values(ldap_state->smbldap_state->ldap_struct,
3756	entry,
3757	get_attr_key2string(groupmap_attr_list,
3758	LDAP_ATTR_SID_LIST));
3759
3760	if (values == NULL) {
3761	ldap_msgfree(result);
3762	return NT_STATUS_OK;
3763	}
3764
3765	count = ldap_count_values(values);
3766
3767	for (i=0; i<count; i++) {
3768	DOM_SID member;
3769	NTSTATUS status;
3770
3771	if (!string_to_sid(&member, values[i]))
3772	continue;
3773
3774	status = add_sid_to_array(mem_ctx, &member, pp_members,
3775	&num_members);
3776	if (!NT_STATUS_IS_OK(status)) {
3777	ldap_value_free(values);
3778	ldap_msgfree(result);
3779	return status;
3780	}
3781	}
3782
3783	*p_num_members = num_members;
3784	ldap_value_free(values);
3785	ldap_msgfree(result);
3786
3787	return NT_STATUS_OK;
3788	}
3789
3790	static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
3791	TALLOC_CTX *mem_ctx,
3792	const DOM_SID *domain_sid,
3793	const DOM_SID *members,
3794	size_t num_members,
3795	uint32 **pp_alias_rids,
3796	size_t *p_num_alias_rids)
3797	{
3798	struct ldapsam_privates *ldap_state =
3799	(struct ldapsam_privates *)methods->private_data;
3800	LDAP *ldap_struct;
3801
3802	const char *attrs[] = { LDAP_ATTRIBUTE_SID, NULL };
3803
3804	LDAPMessage *result = NULL;
3805	LDAPMessage *entry = NULL;
3806	int i;
3807	int rc;
3808	char *filter;
3809	enum lsa_SidType type = SID_NAME_USE_NONE;
3810	bool is_builtin = false;
3811	bool sid_added = false;
3812
3813	*pp_alias_rids = NULL;
3814	*p_num_alias_rids = 0;
3815
3816	if (sid_check_is_builtin(domain_sid)) {
3817	is_builtin = true;
3818	type = SID_NAME_ALIAS;
3819	}
3820
3821	if (sid_check_is_domain(domain_sid)) {
3822	type = SID_NAME_ALIAS;
3823	}
3824
3825	if (type == SID_NAME_USE_NONE) {
3826	DEBUG(5, ("SID %s is neither builtin nor domain!\n",
3827	sid_string_dbg(domain_sid)));
3828	return NT_STATUS_UNSUCCESSFUL;
3829	}
3830
3831	if (num_members == 0) {
3832	return NT_STATUS_OK;
3833	}
3834
3835	filter = talloc_asprintf(mem_ctx,
3836	"(&(objectclass=%s)(sambaGroupType=%d)(\|",
3837	LDAP_OBJ_GROUPMAP, type);
3838
3839	for (i=0; i<num_members; i++)
3840	filter = talloc_asprintf(mem_ctx, "%s(sambaSIDList=%s)",
3841	filter,
3842	sid_string_talloc(mem_ctx,
3843	&members[i]));
3844
3845	filter = talloc_asprintf(mem_ctx, "%s))", filter);
3846
3847	if (filter == NULL) {
3848	return NT_STATUS_NO_MEMORY;
3849	}
3850
3851	if (is_builtin &&
3852	ldap_state->search_cache.filter &&
3853	strcmp(ldap_state->search_cache.filter, filter) == 0) {
3854	filter = talloc_move(filter, &ldap_state->search_cache.filter);
3855	result = ldap_state->search_cache.result;
3856	ldap_state->search_cache.result = NULL;
3857	} else {
3858	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
3859	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
3860	if (rc != LDAP_SUCCESS) {
3861	return NT_STATUS_UNSUCCESSFUL;
3862	}
3863	talloc_autofree_ldapmsg(filter, result);
3864	}
3865
3866	ldap_struct = ldap_state->smbldap_state->ldap_struct;
3867
3868	for (entry = ldap_first_entry(ldap_struct, result);
3869	entry != NULL;
3870	entry = ldap_next_entry(ldap_struct, entry))
3871	{
3872	fstring sid_str;
3873	DOM_SID sid;
3874	uint32 rid;
3875
3876	if (!smbldap_get_single_attribute(ldap_struct, entry,
3877	LDAP_ATTRIBUTE_SID,
3878	sid_str,
3879	sizeof(sid_str)-1))
3880	continue;
3881
3882	if (!string_to_sid(&sid, sid_str))
3883	continue;
3884
3885	if (!sid_peek_check_rid(domain_sid, &sid, &rid))
3886	continue;
3887
3888	sid_added = true;
3889
3890	if (!add_rid_to_array_unique(mem_ctx, rid, pp_alias_rids,
3891	p_num_alias_rids)) {
3892	return NT_STATUS_NO_MEMORY;
3893	}
3894	}
3895
3896	if (!is_builtin && !sid_added) {
3897	TALLOC_FREE(ldap_state->search_cache.filter);
3898	/*
3899	* Note: result is a talloc child of filter because of the
3900	* talloc_autofree_ldapmsg() usage
3901	*/
3902	ldap_state->search_cache.filter = talloc_move(ldap_state, &filter);
3903	ldap_state->search_cache.result = result;
3904	}
3905
3906	return NT_STATUS_OK;
3907	}
3908
3909	static NTSTATUS ldapsam_set_account_policy_in_ldap(struct pdb_methods *methods,
3910	enum pdb_policy_type type,
3911	uint32 value)
3912	{
3913	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3914	int rc;
3915	LDAPMod **mods = NULL;
3916	fstring value_string;
3917	const char *policy_attr = NULL;
3918
3919	struct ldapsam_privates *ldap_state =
3920	(struct ldapsam_privates *)methods->private_data;
3921
3922	DEBUG(10,("ldapsam_set_account_policy_in_ldap\n"));
3923
3924	if (!ldap_state->domain_dn) {
3925	return NT_STATUS_INVALID_PARAMETER;
3926	}
3927
3928	policy_attr = get_account_policy_attr(type);
3929	if (policy_attr == NULL) {
3930	DEBUG(0,("ldapsam_set_account_policy_in_ldap: invalid "
3931	"policy\n"));
3932	return ntstatus;
3933	}
3934
3935	slprintf(value_string, sizeof(value_string) - 1, "%i", value);
3936
3937	smbldap_set_mod(&mods, LDAP_MOD_REPLACE, policy_attr, value_string);
3938
3939	rc = smbldap_modify(ldap_state->smbldap_state, ldap_state->domain_dn,
3940	mods);
3941
3942	ldap_mods_free(mods, True);
3943
3944	if (rc != LDAP_SUCCESS) {
3945	return ntstatus;
3946	}
3947
3948	if (!cache_account_policy_set(type, value)) {
3949	DEBUG(0,("ldapsam_set_account_policy_in_ldap: failed to "
3950	"update local tdb cache\n"));
3951	return ntstatus;
3952	}
3953
3954	return NT_STATUS_OK;
3955	}
3956
3957	static NTSTATUS ldapsam_set_account_policy(struct pdb_methods *methods,
3958	enum pdb_policy_type type,
3959	uint32_t value)
3960	{
3961	return ldapsam_set_account_policy_in_ldap(methods, type,
3962	value);
3963	}
3964
3965	static NTSTATUS ldapsam_get_account_policy_from_ldap(struct pdb_methods *methods,
3966	enum pdb_policy_type type,
3967	uint32 *value)
3968	{
3969	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3970	LDAPMessage *result = NULL;
3971	LDAPMessage *entry = NULL;
3972	int count;
3973	int rc;
3974	char **vals = NULL;
3975	char *filter;
3976	const char *policy_attr = NULL;
3977
3978	struct ldapsam_privates *ldap_state =
3979	(struct ldapsam_privates *)methods->private_data;
3980
3981	const char *attrs[2];
3982
3983	DEBUG(10,("ldapsam_get_account_policy_from_ldap\n"));
3984
3985	if (!ldap_state->domain_dn) {
3986	return NT_STATUS_INVALID_PARAMETER;
3987	}
3988
3989	policy_attr = get_account_policy_attr(type);
3990	if (!policy_attr) {
3991	DEBUG(0,("ldapsam_get_account_policy_from_ldap: invalid "
3992	"policy index: %d\n", type));
3993	return ntstatus;
3994	}
3995
3996	attrs[0] = policy_attr;
3997	attrs[1] = NULL;
3998
3999	filter = talloc_asprintf(NULL, "(objectClass=%s)", LDAP_OBJ_DOMINFO);
4000	if (filter == NULL) {
4001	return NT_STATUS_NO_MEMORY;
4002	}
4003	rc = smbldap_search(ldap_state->smbldap_state, ldap_state->domain_dn,
4004	LDAP_SCOPE_BASE, filter, attrs, 0,
4005	&result);
4006
4007	if (rc != LDAP_SUCCESS) {
4008	return ntstatus;
4009	}
4010
4011	count = ldap_count_entries(priv2ld(ldap_state), result);
4012	if (count < 1) {
4013	goto out;
4014	}
4015
4016	entry = ldap_first_entry(priv2ld(ldap_state), result);
4017	if (entry == NULL) {
4018	goto out;
4019	}
4020
4021	vals = ldap_get_values(priv2ld(ldap_state), entry, policy_attr);
4022	if (vals == NULL) {
4023	goto out;
4024	}
4025
4026	*value = (uint32)atol(vals[0]);
4027
4028	ntstatus = NT_STATUS_OK;
4029
4030	out:
4031	if (vals)
4032	ldap_value_free(vals);
4033	ldap_msgfree(result);
4034
4035	return ntstatus;
4036	}
4037
4038	/* wrapper around ldapsam_get_account_policy_from_ldap(), handles tdb as cache
4039
4040	- if user hasn't decided to use account policies inside LDAP just reuse the
4041	old tdb values
4042
4043	- if there is a valid cache entry, return that
4044	- if there is an LDAP entry, update cache and return
4045	- otherwise set to default, update cache and return
4046
4047	Guenther
4048	*/
4049	static NTSTATUS ldapsam_get_account_policy(struct pdb_methods *methods,
4050	enum pdb_policy_type type,
4051	uint32_t *value)
4052	{
4053	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
4054
4055	if (cache_account_policy_get(type, value)) {
4056	DEBUG(11,("ldapsam_get_account_policy: got valid value from "
4057	"cache\n"));
4058	return NT_STATUS_OK;
4059	}
4060
4061	ntstatus = ldapsam_get_account_policy_from_ldap(methods, type,
4062	value);
4063	if (NT_STATUS_IS_OK(ntstatus)) {
4064	goto update_cache;
4065	}
4066
4067	DEBUG(10,("ldapsam_get_account_policy: failed to retrieve from "
4068	"ldap\n"));
4069
4070	#if 0
4071	/* should we automagically migrate old tdb value here ? */
4072	if (account_policy_get(type, value))
4073	goto update_ldap;
4074
4075	DEBUG(10,("ldapsam_get_account_policy: no tdb for %d, trying "
4076	"default\n", type));
4077	#endif
4078
4079	if (!account_policy_get_default(type, value)) {
4080	return ntstatus;
4081	}
4082
4083	/* update_ldap: */
4084
4085	ntstatus = ldapsam_set_account_policy(methods, type, *value);
4086	if (!NT_STATUS_IS_OK(ntstatus)) {
4087	return ntstatus;
4088	}
4089
4090	update_cache:
4091
4092	if (!cache_account_policy_set(type, *value)) {
4093	DEBUG(0,("ldapsam_get_account_policy: failed to update local "
4094	"tdb as a cache\n"));
4095	return NT_STATUS_UNSUCCESSFUL;
4096	}
4097
4098	return NT_STATUS_OK;
4099	}
4100
4101	static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
4102	const DOM_SID *domain_sid,
4103	int num_rids,
4104	uint32 *rids,
4105	const char **names,
4106	enum lsa_SidType *attrs)
4107	{
4108	struct ldapsam_privates *ldap_state =
4109	(struct ldapsam_privates *)methods->private_data;
4110	LDAPMessage *msg = NULL;
4111	LDAPMessage *entry;
4112	char *allsids = NULL;
4113	int i, rc, num_mapped;
4114	NTSTATUS result = NT_STATUS_NO_MEMORY;
4115	TALLOC_CTX *mem_ctx;
4116	LDAP *ld;
4117	bool is_builtin;
4118
4119	mem_ctx = talloc_new(NULL);
4120	if (mem_ctx == NULL) {
4121	DEBUG(0, ("talloc_new failed\n"));
4122	goto done;
4123	}
4124
4125	if (!sid_check_is_builtin(domain_sid) &&
4126	!sid_check_is_domain(domain_sid)) {
4127	result = NT_STATUS_INVALID_PARAMETER;
4128	goto done;
4129	}
4130
4131	if (num_rids == 0) {
4132	result = NT_STATUS_NONE_MAPPED;
4133	goto done;
4134	}
4135
4136	for (i=0; i<num_rids; i++)
4137	attrs[i] = SID_NAME_UNKNOWN;
4138
4139	allsids = talloc_strdup(mem_ctx, "");
4140	if (allsids == NULL) {
4141	goto done;
4142	}
4143
4144	for (i=0; i<num_rids; i++) {
4145	DOM_SID sid;
4146	sid_compose(&sid, domain_sid, rids[i]);
4147	allsids = talloc_asprintf_append_buffer(
4148	allsids, "(sambaSid=%s)",
4149	sid_string_talloc(mem_ctx, &sid));
4150	if (allsids == NULL) {
4151	goto done;
4152	}
4153	}
4154
4155	/* First look for users */
4156
4157	{
4158	char *filter;
4159	const char *ldap_attrs[] = { "uid", "sambaSid", NULL };
4160
4161	filter = talloc_asprintf(
4162	mem_ctx, ("(&(objectClass=%s)(\|%s))"),
4163	LDAP_OBJ_SAMBASAMACCOUNT, allsids);
4164
4165	if (filter == NULL) {
4166	goto done;
4167	}
4168
4169	rc = smbldap_search(ldap_state->smbldap_state,
4170	lp_ldap_user_suffix(),
4171	LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
4172	&msg);
4173	talloc_autofree_ldapmsg(mem_ctx, msg);
4174	}
4175
4176	if (rc != LDAP_SUCCESS)
4177	goto done;
4178
4179	ld = ldap_state->smbldap_state->ldap_struct;
4180	num_mapped = 0;
4181
4182	for (entry = ldap_first_entry(ld, msg);
4183	entry != NULL;
4184	entry = ldap_next_entry(ld, entry)) {
4185	uint32 rid;
4186	int rid_index;
4187	const char *name;
4188
4189	if (!ldapsam_extract_rid_from_entry(ld, entry, domain_sid,
4190	&rid)) {
4191	DEBUG(2, ("Could not find sid from ldap entry\n"));
4192	continue;
4193	}
4194
4195	name = smbldap_talloc_single_attribute(ld, entry, "uid",
4196	names);
4197	if (name == NULL) {
4198	DEBUG(2, ("Could not retrieve uid attribute\n"));
4199	continue;
4200	}
4201
4202	for (rid_index = 0; rid_index < num_rids; rid_index++) {
4203	if (rid == rids[rid_index])
4204	break;
4205	}
4206
4207	if (rid_index == num_rids) {
4208	DEBUG(2, ("Got a RID not asked for: %d\n", rid));
4209	continue;
4210	}
4211
4212	attrs[rid_index] = SID_NAME_USER;
4213	names[rid_index] = name;
4214	num_mapped += 1;
4215	}
4216
4217	if (num_mapped == num_rids) {
4218	/* No need to look for groups anymore -- we're done */
4219	result = NT_STATUS_OK;
4220	goto done;
4221	}
4222
4223	/* Same game for groups */
4224
4225	{
4226	char *filter;
4227	const char *ldap_attrs[] = { "cn", "displayName", "sambaSid",
4228	"sambaGroupType", NULL };
4229
4230	filter = talloc_asprintf(
4231	mem_ctx, "(&(objectClass=%s)(\|%s))",
4232	LDAP_OBJ_GROUPMAP, allsids);
4233	if (filter == NULL) {
4234	goto done;
4235	}
4236
4237	rc = smbldap_search(ldap_state->smbldap_state,
4238	lp_ldap_suffix(),
4239	LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
4240	&msg);
4241	talloc_autofree_ldapmsg(mem_ctx, msg);
4242	}
4243
4244	if (rc != LDAP_SUCCESS)
4245	goto done;
4246
4247	/* ldap_struct might have changed due to a reconnect */
4248
4249	ld = ldap_state->smbldap_state->ldap_struct;
4250
4251	/* For consistency checks, we already checked we're only domain or builtin */
4252
4253	is_builtin = sid_check_is_builtin(domain_sid);
4254
4255	for (entry = ldap_first_entry(ld, msg);
4256	entry != NULL;
4257	entry = ldap_next_entry(ld, entry))
4258	{
4259	uint32 rid;
4260	int rid_index;
4261	const char *attr;
4262	enum lsa_SidType type;
4263	const char *dn = smbldap_talloc_dn(mem_ctx, ld, entry);
4264
4265	attr = smbldap_talloc_single_attribute(ld, entry, "sambaGroupType",
4266	mem_ctx);
4267	if (attr == NULL) {
4268	DEBUG(2, ("Could not extract type from ldap entry %s\n",
4269	dn));
4270	continue;
4271	}
4272
4273	type = (enum lsa_SidType)atol(attr);
4274
4275	/* Consistency checks */
4276	if ((is_builtin && (type != SID_NAME_ALIAS)) \|\|
4277	(!is_builtin && ((type != SID_NAME_ALIAS) &&
4278	(type != SID_NAME_DOM_GRP)))) {
4279	DEBUG(2, ("Rejecting invalid group mapping entry %s\n", dn));
4280	}
4281
4282	if (!ldapsam_extract_rid_from_entry(ld, entry, domain_sid,
4283	&rid)) {
4284	DEBUG(2, ("Could not find sid from ldap entry %s\n", dn));
4285	continue;
4286	}
4287
4288	attr = smbldap_talloc_single_attribute(ld, entry, "displayName", names);
4289
4290	if (attr == NULL) {
4291	DEBUG(10, ("Could not retrieve 'displayName' attribute from %s\n",
4292	dn));
4293	attr = smbldap_talloc_single_attribute(ld, entry, "cn", names);
4294	}
4295
4296	if (attr == NULL) {
4297	DEBUG(2, ("Could not retrieve naming attribute from %s\n",
4298	dn));
4299	continue;
4300	}
4301
4302	for (rid_index = 0; rid_index < num_rids; rid_index++) {
4303	if (rid == rids[rid_index])
4304	break;
4305	}
4306
4307	if (rid_index == num_rids) {
4308	DEBUG(2, ("Got a RID not asked for: %d\n", rid));
4309	continue;
4310	}
4311
4312	attrs[rid_index] = type;
4313	names[rid_index] = attr;
4314	num_mapped += 1;
4315	}
4316
4317	result = NT_STATUS_NONE_MAPPED;
4318
4319	if (num_mapped > 0)
4320	result = (num_mapped == num_rids) ?
4321	NT_STATUS_OK : STATUS_SOME_UNMAPPED;
4322	done:
4323	TALLOC_FREE(mem_ctx);
4324	return result;
4325	}
4326
4327	static char get_ldap_filter(TALLOC_CTX mem_ctx, const char *username)
4328	{
4329	char *filter = NULL;
4330	char *escaped = NULL;
4331	char *result = NULL;
4332
4333	if (asprintf(&filter, "(&%s(objectclass=%s))",
4334	"(uid=%u)", LDAP_OBJ_SAMBASAMACCOUNT) < 0) {
4335	goto done;
4336	}
4337
4338	escaped = escape_ldap_string(talloc_tos(), username);
4339	if (escaped == NULL) goto done;
4340
4341	result = talloc_string_sub(mem_ctx, filter, "%u", username);
4342
4343	done:
4344	SAFE_FREE(filter);
4345	TALLOC_FREE(escaped);
4346
4347	return result;
4348	}
4349
4350	const char *talloc_attrs(TALLOC_CTX mem_ctx, ...)
4351	{
4352	int i, num = 0;
4353	va_list ap;
4354	const char **result;
4355
4356	va_start(ap, mem_ctx);
4357	while (va_arg(ap, const char *) != NULL)
4358	num += 1;
4359	va_end(ap);
4360
4361	if ((result = TALLOC_ARRAY(mem_ctx, const char *, num+1)) == NULL) {
4362	return NULL;
4363	}
4364
4365	va_start(ap, mem_ctx);
4366	for (i=0; i<num; i++) {
4367	result[i] = talloc_strdup(result, va_arg(ap, const char*));
4368	if (result[i] == NULL) {
4369	talloc_free(result);
4370	va_end(ap);
4371	return NULL;
4372	}
4373	}
4374	va_end(ap);
4375
4376	result[num] = NULL;
4377	return result;
4378	}
4379
4380	struct ldap_search_state {
4381	struct smbldap_state *connection;
4382
4383	uint32 acct_flags;
4384	uint16 group_type;
4385
4386	const char *base;
4387	int scope;
4388	const char *filter;
4389	const char **attrs;
4390	int attrsonly;
4391	void *pagedresults_cookie;
4392
4393	LDAPMessage entries, current_entry;
4394	bool (ldap2displayentry)(struct ldap_search_state state,
4395	TALLOC_CTX *mem_ctx,
4396	LDAP ld, LDAPMessage entry,
4397	struct samr_displayentry *result);
4398	};
4399
4400	static bool ldapsam_search_firstpage(struct pdb_search *search)
4401	{
4402	struct ldap_search_state *state =
4403	(struct ldap_search_state *)search->private_data;
4404	LDAP *ld;
4405	int rc = LDAP_OPERATIONS_ERROR;
4406
4407	state->entries = NULL;
4408
4409	if (state->connection->paged_results) {
4410	rc = smbldap_search_paged(state->connection, state->base,
4411	state->scope, state->filter,
4412	state->attrs, state->attrsonly,
4413	lp_ldap_page_size(), &state->entries,
4414	&state->pagedresults_cookie);
4415	}
4416
4417	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL)) {
4418
4419	if (state->entries != NULL) {
4420	/* Left over from unsuccessful paged attempt */
4421	ldap_msgfree(state->entries);
4422	state->entries = NULL;
4423	}
4424
4425	rc = smbldap_search(state->connection, state->base,
4426	state->scope, state->filter, state->attrs,
4427	state->attrsonly, &state->entries);
4428
4429	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL))
4430	return False;
4431
4432	/* Ok, the server was lying. It told us it could do paged
4433	* searches when it could not. */
4434	state->connection->paged_results = False;
4435	}
4436
4437	ld = state->connection->ldap_struct;
4438	if ( ld == NULL) {
4439	DEBUG(5, ("Don't have an LDAP connection right after a "
4440	"search\n"));
4441	return False;
4442	}
4443	state->current_entry = ldap_first_entry(ld, state->entries);
4444
4445	if (state->current_entry == NULL) {
4446	ldap_msgfree(state->entries);
4447	state->entries = NULL;
4448	return false;
4449	}
4450
4451	return True;
4452	}
4453
4454	static bool ldapsam_search_nextpage(struct pdb_search *search)
4455	{
4456	struct ldap_search_state *state =
4457	(struct ldap_search_state *)search->private_data;
4458	int rc;
4459
4460	if (!state->connection->paged_results) {
4461	/* There is no next page when there are no paged results */
4462	return False;
4463	}
4464
4465	rc = smbldap_search_paged(state->connection, state->base,
4466	state->scope, state->filter, state->attrs,
4467	state->attrsonly, lp_ldap_page_size(),
4468	&state->entries,
4469	&state->pagedresults_cookie);
4470
4471	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL))
4472	return False;
4473
4474	state->current_entry = ldap_first_entry(state->connection->ldap_struct, state->entries);
4475
4476	if (state->current_entry == NULL) {
4477	ldap_msgfree(state->entries);
4478	state->entries = NULL;
4479	return false;
4480	}
4481
4482	return True;
4483	}
4484
4485	static bool ldapsam_search_next_entry(struct pdb_search *search,
4486	struct samr_displayentry *entry)
4487	{
4488	struct ldap_search_state *state =
4489	(struct ldap_search_state *)search->private_data;
4490	bool result;
4491
4492	retry:
4493	if ((state->entries == NULL) && (state->pagedresults_cookie == NULL))
4494	return False;
4495
4496	if ((state->entries == NULL) &&
4497	!ldapsam_search_nextpage(search))
4498	return False;
4499
4500	result = state->ldap2displayentry(state, search,
4501	state->connection->ldap_struct,
4502	state->current_entry, entry);
4503
4504	if (!result) {
4505	char *dn;
4506	dn = ldap_get_dn(state->connection->ldap_struct, state->current_entry);
4507	DEBUG(5, ("Skipping entry %s\n", dn != NULL ? dn : "<NULL>"));
4508	if (dn != NULL) ldap_memfree(dn);
4509	}
4510
4511	state->current_entry = ldap_next_entry(state->connection->ldap_struct, state->current_entry);
4512
4513	if (state->current_entry == NULL) {
4514	ldap_msgfree(state->entries);
4515	state->entries = NULL;
4516	}
4517
4518	if (!result) goto retry;
4519
4520	return True;
4521	}
4522
4523	static void ldapsam_search_end(struct pdb_search *search)
4524	{
4525	struct ldap_search_state *state =
4526	(struct ldap_search_state *)search->private_data;
4527	int rc;
4528
4529	if (state->pagedresults_cookie == NULL)
4530	return;
4531
4532	if (state->entries != NULL)
4533	ldap_msgfree(state->entries);
4534
4535	state->entries = NULL;
4536	state->current_entry = NULL;
4537
4538	if (!state->connection->paged_results)
4539	return;
4540
4541	/* Tell the LDAP server we're not interested in the rest anymore. */
4542
4543	rc = smbldap_search_paged(state->connection, state->base, state->scope,
4544	state->filter, state->attrs,
4545	state->attrsonly, 0, &state->entries,
4546	&state->pagedresults_cookie);
4547
4548	if (rc != LDAP_SUCCESS)
4549	DEBUG(5, ("Could not end search properly\n"));
4550
4551	return;
4552	}
4553
4554	static bool ldapuser2displayentry(struct ldap_search_state *state,
4555	TALLOC_CTX *mem_ctx,
4556	LDAP ld, LDAPMessage entry,
4557	struct samr_displayentry *result)
4558	{
4559	char **vals;
4560	size_t converted_size;
4561	DOM_SID sid;
4562	uint32 acct_flags;
4563
4564	vals = ldap_get_values(ld, entry, "sambaAcctFlags");
4565	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4566	DEBUG(5, ("\"sambaAcctFlags\" not found\n"));
4567	return False;
4568	}
4569	acct_flags = pdb_decode_acct_ctrl(vals[0]);
4570	ldap_value_free(vals);
4571
4572	if ((state->acct_flags != 0) &&
4573	((state->acct_flags & acct_flags) == 0))
4574	return False;
4575
4576	result->acct_flags = acct_flags;
4577	result->account_name = "";
4578	result->fullname = "";
4579	result->description = "";
4580
4581	vals = ldap_get_values(ld, entry, "uid");
4582	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4583	DEBUG(5, ("\"uid\" not found\n"));
4584	return False;
4585	}
4586	if (!pull_utf8_talloc(mem_ctx,
4587	CONST_DISCARD(char **, &result->account_name),
4588	vals[0], &converted_size))
4589	{
4590	DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",
4591	strerror(errno)));
4592	}
4593
4594	ldap_value_free(vals);
4595
4596	vals = ldap_get_values(ld, entry, "displayName");
4597	if ((vals == NULL) \|\| (vals[0] == NULL))
4598	DEBUG(8, ("\"displayName\" not found\n"));
4599	else if (!pull_utf8_talloc(mem_ctx,
4600	CONST_DISCARD(char **, &result->fullname),
4601	vals[0], &converted_size))
4602	{
4603	DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",
4604	strerror(errno)));
4605	}
4606
4607	ldap_value_free(vals);
4608
4609	vals = ldap_get_values(ld, entry, "description");
4610	if ((vals == NULL) \|\| (vals[0] == NULL))
4611	DEBUG(8, ("\"description\" not found\n"));
4612	else if (!pull_utf8_talloc(mem_ctx,
4613	CONST_DISCARD(char **, &result->description),
4614	vals[0], &converted_size))
4615	{
4616	DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",
4617	strerror(errno)));
4618	}
4619
4620	ldap_value_free(vals);
4621
4622	if ((result->account_name == NULL) \|\|
4623	(result->fullname == NULL) \|\|
4624	(result->description == NULL)) {
4625	DEBUG(0, ("talloc failed\n"));
4626	return False;
4627	}
4628
4629	vals = ldap_get_values(ld, entry, "sambaSid");
4630	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4631	DEBUG(0, ("\"objectSid\" not found\n"));
4632	return False;
4633	}
4634
4635	if (!string_to_sid(&sid, vals[0])) {
4636	DEBUG(0, ("Could not convert %s to SID\n", vals[0]));
4637	ldap_value_free(vals);
4638	return False;
4639	}
4640	ldap_value_free(vals);
4641
4642	if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)) {
4643	DEBUG(0, ("sid %s does not belong to our domain\n",
4644	sid_string_dbg(&sid)));
4645	return False;
4646	}
4647
4648	return True;
4649	}
4650
4651
4652	static bool ldapsam_search_users(struct pdb_methods *methods,
4653	struct pdb_search *search,
4654	uint32 acct_flags)
4655	{
4656	struct ldapsam_privates *ldap_state =
4657	(struct ldapsam_privates *)methods->private_data;
4658	struct ldap_search_state *state;
4659
4660	state = talloc(search, struct ldap_search_state);
4661	if (state == NULL) {
4662	DEBUG(0, ("talloc failed\n"));
4663	return False;
4664	}
4665
4666	state->connection = ldap_state->smbldap_state;
4667
4668	if ((acct_flags != 0) && ((acct_flags & ACB_NORMAL) != 0))
4669	state->base = lp_ldap_user_suffix();
4670	else if ((acct_flags != 0) &&
4671	((acct_flags & (ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST)) != 0))
4672	state->base = lp_ldap_machine_suffix();
4673	else
4674	state->base = lp_ldap_suffix();
4675
4676	state->acct_flags = acct_flags;
4677	state->base = talloc_strdup(search, state->base);
4678	state->scope = LDAP_SCOPE_SUBTREE;
4679	state->filter = get_ldap_filter(search, "*");
4680	state->attrs = talloc_attrs(search, "uid", "sambaSid",
4681	"displayName", "description",
4682	"sambaAcctFlags", NULL);
4683	state->attrsonly = 0;
4684	state->pagedresults_cookie = NULL;
4685	state->entries = NULL;
4686	state->ldap2displayentry = ldapuser2displayentry;
4687
4688	if ((state->filter == NULL) \|\| (state->attrs == NULL)) {
4689	DEBUG(0, ("talloc failed\n"));
4690	return False;
4691	}
4692
4693	search->private_data = state;
4694	search->next_entry = ldapsam_search_next_entry;
4695	search->search_end = ldapsam_search_end;
4696
4697	return ldapsam_search_firstpage(search);
4698	}
4699
4700	static bool ldapgroup2displayentry(struct ldap_search_state *state,
4701	TALLOC_CTX *mem_ctx,
4702	LDAP ld, LDAPMessage entry,
4703	struct samr_displayentry *result)
4704	{
4705	char **vals;
4706	size_t converted_size;
4707	DOM_SID sid;
4708	uint16 group_type;
4709
4710	result->account_name = "";
4711	result->fullname = "";
4712	result->description = "";
4713
4714
4715	vals = ldap_get_values(ld, entry, "sambaGroupType");
4716	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4717	DEBUG(5, ("\"sambaGroupType\" not found\n"));
4718	if (vals != NULL) {
4719	ldap_value_free(vals);
4720	}
4721	return False;
4722	}
4723
4724	group_type = atoi(vals[0]);
4725
4726	if ((state->group_type != 0) &&
4727	((state->group_type != group_type))) {
4728	ldap_value_free(vals);
4729	return False;
4730	}
4731
4732	ldap_value_free(vals);
4733
4734	/* display name is the NT group name */
4735
4736	vals = ldap_get_values(ld, entry, "displayName");
4737	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4738	DEBUG(8, ("\"displayName\" not found\n"));
4739
4740	/* fallback to the 'cn' attribute */
4741	vals = ldap_get_values(ld, entry, "cn");
4742	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4743	DEBUG(5, ("\"cn\" not found\n"));
4744	return False;
4745	}
4746	if (!pull_utf8_talloc(mem_ctx,
4747	CONST_DISCARD(char **,
4748	&result->account_name),
4749	vals[0], &converted_size))
4750	{
4751	DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc "
4752	"failed: %s", strerror(errno)));
4753	}
4754	}
4755	else if (!pull_utf8_talloc(mem_ctx,
4756	CONST_DISCARD(char **,
4757	&result->account_name),
4758	vals[0], &converted_size))
4759	{
4760	DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc failed: %s",
4761	strerror(errno)));
4762	}
4763
4764	ldap_value_free(vals);
4765
4766	vals = ldap_get_values(ld, entry, "description");
4767	if ((vals == NULL) \|\| (vals[0] == NULL))
4768	DEBUG(8, ("\"description\" not found\n"));
4769	else if (!pull_utf8_talloc(mem_ctx,
4770	CONST_DISCARD(char **, &result->description),
4771	vals[0], &converted_size))
4772	{
4773	DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc failed: %s",
4774	strerror(errno)));
4775	}
4776	ldap_value_free(vals);
4777
4778	if ((result->account_name == NULL) \|\|
4779	(result->fullname == NULL) \|\|
4780	(result->description == NULL)) {
4781	DEBUG(0, ("talloc failed\n"));
4782	return False;
4783	}
4784
4785	vals = ldap_get_values(ld, entry, "sambaSid");
4786	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4787	DEBUG(0, ("\"objectSid\" not found\n"));
4788	if (vals != NULL) {
4789	ldap_value_free(vals);
4790	}
4791	return False;
4792	}
4793
4794	if (!string_to_sid(&sid, vals[0])) {
4795	DEBUG(0, ("Could not convert %s to SID\n", vals[0]));
4796	return False;
4797	}
4798
4799	ldap_value_free(vals);
4800
4801	switch (group_type) {
4802	case SID_NAME_DOM_GRP:
4803	case SID_NAME_ALIAS:
4804
4805	if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)
4806	&& !sid_peek_check_rid(&global_sid_Builtin, &sid, &result->rid))
4807	{
4808	DEBUG(0, ("%s is not in our domain\n",
4809	sid_string_dbg(&sid)));
4810	return False;
4811	}
4812	break;
4813
4814	default:
4815	DEBUG(0,("unkown group type: %d\n", group_type));
4816	return False;
4817	}
4818
4819	result->acct_flags = 0;
4820
4821	return True;
4822	}
4823
4824	static bool ldapsam_search_grouptype(struct pdb_methods *methods,
4825	struct pdb_search *search,
4826	const DOM_SID *sid,
4827	enum lsa_SidType type)
4828	{
4829	struct ldapsam_privates *ldap_state =
4830	(struct ldapsam_privates *)methods->private_data;
4831	struct ldap_search_state *state;
4832	fstring tmp;
4833
4834	state = talloc(search, struct ldap_search_state);
4835	if (state == NULL) {
4836	DEBUG(0, ("talloc failed\n"));
4837	return False;
4838	}
4839
4840	state->connection = ldap_state->smbldap_state;
4841
4842	state->base = talloc_strdup(search, lp_ldap_suffix());
4843	state->connection = ldap_state->smbldap_state;
4844	state->scope = LDAP_SCOPE_SUBTREE;
4845	state->filter = talloc_asprintf(search, "(&(objectclass=%s)"
4846	"(sambaGroupType=%d)(sambaSID=%s*))",
4847	LDAP_OBJ_GROUPMAP,
4848	type, sid_to_fstring(tmp, sid));
4849	state->attrs = talloc_attrs(search, "cn", "sambaSid",
4850	"displayName", "description",
4851	"sambaGroupType", NULL);
4852	state->attrsonly = 0;
4853	state->pagedresults_cookie = NULL;
4854	state->entries = NULL;
4855	state->group_type = type;
4856	state->ldap2displayentry = ldapgroup2displayentry;
4857
4858	if ((state->filter == NULL) \|\| (state->attrs == NULL)) {
4859	DEBUG(0, ("talloc failed\n"));
4860	return False;
4861	}
4862
4863	search->private_data = state;
4864	search->next_entry = ldapsam_search_next_entry;
4865	search->search_end = ldapsam_search_end;
4866
4867	return ldapsam_search_firstpage(search);
4868	}
4869
4870	static bool ldapsam_search_groups(struct pdb_methods *methods,
4871	struct pdb_search *search)
4872	{
4873	return ldapsam_search_grouptype(methods, search, get_global_sam_sid(), SID_NAME_DOM_GRP);
4874	}
4875
4876	static bool ldapsam_search_aliases(struct pdb_methods *methods,
4877	struct pdb_search *search,
4878	const DOM_SID *sid)
4879	{
4880	return ldapsam_search_grouptype(methods, search, sid, SID_NAME_ALIAS);
4881	}
4882
4883	static uint32_t ldapsam_capabilities(struct pdb_methods *methods)
4884	{
4885	return PDB_CAP_STORE_RIDS;
4886	}
4887
4888	static NTSTATUS ldapsam_get_new_rid(struct ldapsam_privates *priv,
4889	uint32 *rid)
4890	{
4891	struct smbldap_state *smbldap_state = priv->smbldap_state;
4892
4893	LDAPMessage *result = NULL;
4894	LDAPMessage *entry = NULL;
4895	LDAPMod **mods = NULL;
4896	NTSTATUS status;
4897	char *value;
4898	int rc;
4899	uint32 nextRid = 0;
4900	const char *dn;
4901
4902	TALLOC_CTX *mem_ctx;
4903
4904	mem_ctx = talloc_new(NULL);
4905	if (mem_ctx == NULL) {
4906	DEBUG(0, ("talloc_new failed\n"));
4907	return NT_STATUS_NO_MEMORY;
4908	}
4909
4910	status = smbldap_search_domain_info(smbldap_state, &result,
4911	get_global_sam_name(), False);
4912	if (!NT_STATUS_IS_OK(status)) {
4913	DEBUG(3, ("Could not get domain info: %s\n",
4914	nt_errstr(status)));
4915	goto done;
4916	}
4917
4918	talloc_autofree_ldapmsg(mem_ctx, result);
4919
4920	entry = ldap_first_entry(priv2ld(priv), result);
4921	if (entry == NULL) {
4922	DEBUG(0, ("Could not get domain info entry\n"));
4923	status = NT_STATUS_INTERNAL_DB_CORRUPTION;
4924	goto done;
4925	}
4926
4927	/* Find the largest of the three attributes "sambaNextRid",
4928	"sambaNextGroupRid" and "sambaNextUserRid". I gave up on the
4929	concept of differentiating between user and group rids, and will
4930	use only "sambaNextRid" in the future. But for compatibility
4931	reasons I look if others have chosen different strategies -- VL */
4932
4933	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4934	"sambaNextRid", mem_ctx);
4935	if (value != NULL) {
4936	uint32 tmp = (uint32)strtoul(value, NULL, 10);
4937	nextRid = MAX(nextRid, tmp);
4938	}
4939
4940	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4941	"sambaNextUserRid", mem_ctx);
4942	if (value != NULL) {
4943	uint32 tmp = (uint32)strtoul(value, NULL, 10);
4944	nextRid = MAX(nextRid, tmp);
4945	}
4946
4947	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4948	"sambaNextGroupRid", mem_ctx);
4949	if (value != NULL) {
4950	uint32 tmp = (uint32)strtoul(value, NULL, 10);
4951	nextRid = MAX(nextRid, tmp);
4952	}
4953
4954	if (nextRid == 0) {
4955	nextRid = BASE_RID-1;
4956	}
4957
4958	nextRid += 1;
4959
4960	smbldap_make_mod(priv2ld(priv), entry, &mods, "sambaNextRid",
4961	talloc_asprintf(mem_ctx, "%d", nextRid));
4962	talloc_autofree_ldapmod(mem_ctx, mods);
4963
4964	if ((dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)) == NULL) {
4965	status = NT_STATUS_NO_MEMORY;
4966	goto done;
4967	}
4968
4969	rc = smbldap_modify(smbldap_state, dn, mods);
4970
4971	/* ACCESS_DENIED is used as a placeholder for "the modify failed,
4972	* please retry" */
4973
4974	status = (rc == LDAP_SUCCESS) ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
4975
4976	done:
4977	if (NT_STATUS_IS_OK(status)) {
4978	*rid = nextRid;
4979	}
4980
4981	TALLOC_FREE(mem_ctx);
4982	return status;
4983	}
4984
4985	static NTSTATUS ldapsam_new_rid_internal(struct pdb_methods methods, uint32 rid)
4986	{
4987	int i;
4988
4989	for (i=0; i<10; i++) {
4990	NTSTATUS result = ldapsam_get_new_rid(
4991	(struct ldapsam_privates *)methods->private_data, rid);
4992	if (NT_STATUS_IS_OK(result)) {
4993	return result;
4994	}
4995
4996	if (!NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
4997	return result;
4998	}
4999
5000	/* The ldap update failed (maybe a race condition), retry */
5001	}
5002
5003	/* Tried 10 times, fail. */
5004	return NT_STATUS_ACCESS_DENIED;
5005	}
5006
5007	static bool ldapsam_new_rid(struct pdb_methods methods, uint32 rid)
5008	{
5009	NTSTATUS result = ldapsam_new_rid_internal(methods, rid);
5010	return NT_STATUS_IS_OK(result) ? True : False;
5011	}
5012
5013	static bool ldapsam_sid_to_id(struct pdb_methods *methods,
5014	const DOM_SID *sid,
5015	union unid_t id, enum lsa_SidType type)
5016	{
5017	struct ldapsam_privates *priv =
5018	(struct ldapsam_privates *)methods->private_data;
5019	char *filter;
5020	const char *attrs[] = { "sambaGroupType", "gidNumber", "uidNumber",
5021	NULL };
5022	LDAPMessage *result = NULL;
5023	LDAPMessage *entry = NULL;
5024	bool ret = False;
5025	char *value;
5026	int rc;
5027
5028	TALLOC_CTX *mem_ctx;
5029
5030	mem_ctx = talloc_new(NULL);
5031	if (mem_ctx == NULL) {
5032	DEBUG(0, ("talloc_new failed\n"));
5033	return False;
5034	}
5035
5036	filter = talloc_asprintf(mem_ctx,
5037	"(&(sambaSid=%s)"
5038	"(\|(objectClass=%s)(objectClass=%s)))",
5039	sid_string_talloc(mem_ctx, sid),
5040	LDAP_OBJ_GROUPMAP, LDAP_OBJ_SAMBASAMACCOUNT);
5041	if (filter == NULL) {
5042	DEBUG(5, ("talloc_asprintf failed\n"));
5043	goto done;
5044	}
5045
5046	rc = smbldap_search_suffix(priv->smbldap_state, filter,
5047	attrs, &result);
5048	if (rc != LDAP_SUCCESS) {
5049	goto done;
5050	}
5051	talloc_autofree_ldapmsg(mem_ctx, result);
5052
5053	if (ldap_count_entries(priv2ld(priv), result) != 1) {
5054	DEBUG(10, ("Got %d entries, expected one\n",
5055	ldap_count_entries(priv2ld(priv), result)));
5056	goto done;
5057	}
5058
5059	entry = ldap_first_entry(priv2ld(priv), result);
5060
5061	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
5062	"sambaGroupType", mem_ctx);
5063
5064	if (value != NULL) {
5065	const char *gid_str;
5066	/* It's a group */
5067
5068	gid_str = smbldap_talloc_single_attribute(
5069	priv2ld(priv), entry, "gidNumber", mem_ctx);
5070	if (gid_str == NULL) {
5071	DEBUG(1, ("%s has sambaGroupType but no gidNumber\n",
5072	smbldap_talloc_dn(mem_ctx, priv2ld(priv),
5073	entry)));
5074	goto done;
5075	}
5076
5077	id->gid = strtoul(gid_str, NULL, 10);
5078	*type = (enum lsa_SidType)strtoul(value, NULL, 10);
5079	store_gid_sid_cache(sid, id->gid);
5080	idmap_cache_set_sid2gid(sid, id->gid);
5081	ret = True;
5082	goto done;
5083	}
5084
5085	/* It must be a user */
5086
5087	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
5088	"uidNumber", mem_ctx);
5089	if (value == NULL) {
5090	DEBUG(1, ("Could not find uidNumber in %s\n",
5091	smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)));
5092	goto done;
5093	}
5094
5095	id->uid = strtoul(value, NULL, 10);
5096	*type = SID_NAME_USER;
5097	store_uid_sid_cache(sid, id->uid);
5098	idmap_cache_set_sid2uid(sid, id->uid);
5099
5100	ret = True;
5101	done:
5102	TALLOC_FREE(mem_ctx);
5103	return ret;
5104	}
5105
5106	/**
5107	* Find the SID for a uid.
5108	* This is shortcut is only used if ldapsam:trusted is set to true.
5109	*/
5110	static bool ldapsam_uid_to_sid(struct pdb_methods *methods, uid_t uid,
5111	DOM_SID *sid)
5112	{
5113	struct ldapsam_privates *priv =
5114	(struct ldapsam_privates *)methods->private_data;
5115	char *filter;
5116	const char *attrs[] = { "sambaSID", NULL };
5117	LDAPMessage *result = NULL;
5118	LDAPMessage *entry = NULL;
5119	bool ret = false;
5120	char *user_sid_string;
5121	DOM_SID *user_sid;
5122	int rc;
5123	TALLOC_CTX *tmp_ctx = talloc_stackframe();
5124
5125	filter = talloc_asprintf(tmp_ctx,
5126	"(&(uidNumber=%u)"
5127	"(objectClass=%s)"
5128	"(objectClass=%s))",
5129	(unsigned int)uid,
5130	LDAP_OBJ_POSIXACCOUNT,
5131	LDAP_OBJ_SAMBASAMACCOUNT);
5132	if (filter == NULL) {
5133	DEBUG(3, ("talloc_asprintf failed\n"));
5134	goto done;
5135	}
5136
5137	rc = smbldap_search_suffix(priv->smbldap_state, filter, attrs, &result);
5138	if (rc != LDAP_SUCCESS) {
5139	goto done;
5140	}
5141	talloc_autofree_ldapmsg(tmp_ctx, result);
5142
5143	if (ldap_count_entries(priv2ld(priv), result) != 1) {
5144	DEBUG(3, ("ERROR: Got %d entries for uid %u, expected one\n",
5145	ldap_count_entries(priv2ld(priv), result),
5146	(unsigned int)uid));
5147	goto done;
5148	}
5149
5150	entry = ldap_first_entry(priv2ld(priv), result);
5151
5152	user_sid_string = smbldap_talloc_single_attribute(priv2ld(priv), entry,
5153	"sambaSID", tmp_ctx);
5154	if (user_sid_string == NULL) {
5155	DEBUG(1, ("Could not find sambaSID in object '%s'\n",
5156	smbldap_talloc_dn(tmp_ctx, priv2ld(priv), entry)));
5157	goto done;
5158	}
5159
5160	user_sid = string_sid_talloc(tmp_ctx, user_sid_string);
5161	if (user_sid == NULL) {
5162	DEBUG(3, ("Error calling sid_string_talloc for sid '%s'\n",
5163	user_sid_string));
5164	goto done;
5165	}
5166
5167	sid_copy(sid, user_sid);
5168
5169	store_uid_sid_cache(sid, uid);
5170	idmap_cache_set_sid2uid(sid, uid);
5171
5172	ret = true;
5173
5174	done:
5175	TALLOC_FREE(tmp_ctx);
5176	return ret;
5177	}
5178
5179	/**
5180	* Find the SID for a gid.
5181	* This is shortcut is only used if ldapsam:trusted is set to true.
5182	*/
5183	static bool ldapsam_gid_to_sid(struct pdb_methods *methods, gid_t gid,
5184	DOM_SID *sid)
5185	{
5186	struct ldapsam_privates *priv =
5187	(struct ldapsam_privates *)methods->private_data;
5188	char *filter;
5189	const char *attrs[] = { "sambaSID", NULL };
5190	LDAPMessage *result = NULL;
5191	LDAPMessage *entry = NULL;
5192	bool ret = false;
5193	char *group_sid_string;
5194	DOM_SID group_sid;
5195	int rc;
5196	TALLOC_CTX *tmp_ctx = talloc_stackframe();
5197
5198	filter = talloc_asprintf(tmp_ctx,
5199	"(&(gidNumber=%u)"
5200	"(objectClass=%s))",
5201	(unsigned int)gid,
5202	LDAP_OBJ_GROUPMAP);
5203	if (filter == NULL) {
5204	DEBUG(3, ("talloc_asprintf failed\n"));
5205	goto done;
5206	}
5207
5208	rc = smbldap_search_suffix(priv->smbldap_state, filter, attrs, &result);
5209	if (rc != LDAP_SUCCESS) {
5210	goto done;
5211	}
5212	talloc_autofree_ldapmsg(tmp_ctx, result);
5213
5214	if (ldap_count_entries(priv2ld(priv), result) != 1) {
5215	DEBUG(3, ("ERROR: Got %d entries for gid %u, expected one\n",
5216	ldap_count_entries(priv2ld(priv), result),
5217	(unsigned int)gid));
5218	goto done;
5219	}
5220
5221	entry = ldap_first_entry(priv2ld(priv), result);
5222
5223	group_sid_string = smbldap_talloc_single_attribute(priv2ld(priv), entry,
5224	"sambaSID", tmp_ctx);
5225	if (group_sid_string == NULL) {
5226	DEBUG(1, ("Could not find sambaSID in object '%s'\n",
5227	smbldap_talloc_dn(tmp_ctx, priv2ld(priv), entry)));
5228	goto done;
5229	}
5230
5231	if (!string_to_sid(&group_sid, group_sid_string)) {
5232	DEBUG(3, ("Error calling sid_string_talloc for sid '%s'\n",
5233	group_sid_string));
5234	goto done;
5235	}
5236
5237	sid_copy(sid, &group_sid);
5238
5239	store_gid_sid_cache(sid, gid);
5240	idmap_cache_set_sid2gid(sid, gid);
5241
5242	ret = true;
5243
5244	done:
5245	TALLOC_FREE(tmp_ctx);
5246	return ret;
5247	}
5248
5249
5250	/*
5251	* The following functions are called only if
5252	* ldapsam:trusted and ldapsam:editposix are
5253	* set to true
5254	*/
5255
5256	/*
5257	* ldapsam_create_user creates a new
5258	* posixAccount and sambaSamAccount object
5259	* in the ldap users subtree
5260	*
5261	* The uid is allocated by winbindd.
5262	*/
5263
5264	static NTSTATUS ldapsam_create_user(struct pdb_methods *my_methods,
5265	TALLOC_CTX tmp_ctx, const char name,
5266	uint32 acb_info, uint32 *rid)
5267	{
5268	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5269	LDAPMessage *entry = NULL;
5270	LDAPMessage *result = NULL;
5271	uint32 num_result;
5272	bool is_machine = False;
5273	bool add_posix = False;
5274	LDAPMod **mods = NULL;
5275	struct samu *user;
5276	char *filter;
5277	char *username;
5278	char *homedir;
5279	char *gidstr;
5280	char *uidstr;
5281	char *shell;
5282	const char *dn = NULL;
5283	DOM_SID group_sid;
5284	DOM_SID user_sid;
5285	gid_t gid = -1;
5286	uid_t uid = -1;
5287	NTSTATUS ret;
5288	int rc;
5289
5290	if (((acb_info & ACB_NORMAL) && name[strlen(name)-1] == '$') \|\|
5291	acb_info & ACB_WSTRUST \|\|
5292	acb_info & ACB_SVRTRUST \|\|
5293	acb_info & ACB_DOMTRUST) {
5294	is_machine = True;
5295	}
5296
5297	username = escape_ldap_string(talloc_tos(), name);
5298	filter = talloc_asprintf(tmp_ctx, "(&(uid=%s)(objectClass=%s))",
5299	username, LDAP_OBJ_POSIXACCOUNT);
5300	TALLOC_FREE(username);
5301
5302	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5303	if (rc != LDAP_SUCCESS) {
5304	DEBUG(0,("ldapsam_create_user: ldap search failed!\n"));
5305	return NT_STATUS_ACCESS_DENIED;
5306	}
5307	talloc_autofree_ldapmsg(tmp_ctx, result);
5308
5309	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5310
5311	if (num_result > 1) {
5312	DEBUG (0, ("ldapsam_create_user: More than one user with name [%s] ?!\n", name));
5313	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5314	}
5315
5316	if (num_result == 1) {
5317	char *tmp;
5318	/* check if it is just a posix account.
5319	* or if there is a sid attached to this entry
5320	*/
5321
5322	entry = ldap_first_entry(priv2ld(ldap_state), result);
5323	if (!entry) {
5324	return NT_STATUS_UNSUCCESSFUL;
5325	}
5326
5327	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "sambaSID", tmp_ctx);
5328	if (tmp) {
5329	DEBUG (1, ("ldapsam_create_user: The user [%s] already exist!\n", name));
5330	return NT_STATUS_USER_EXISTS;
5331	}
5332
5333	/* it is just a posix account, retrieve the dn for later use */
5334	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5335	if (!dn) {
5336	DEBUG(0,("ldapsam_create_user: Out of memory!\n"));
5337	return NT_STATUS_NO_MEMORY;
5338	}
5339	}
5340
5341	if (num_result == 0) {
5342	add_posix = True;
5343	}
5344
5345	/* Create the basic samu structure and generate the mods for the ldap commit */
5346	if (!NT_STATUS_IS_OK((ret = ldapsam_new_rid_internal(my_methods, rid)))) {
5347	DEBUG(1, ("ldapsam_create_user: Could not allocate a new RID\n"));
5348	return ret;
5349	}
5350
5351	sid_compose(&user_sid, get_global_sam_sid(), *rid);
5352
5353	user = samu_new(tmp_ctx);
5354	if (!user) {
5355	DEBUG(1,("ldapsam_create_user: Unable to allocate user struct\n"));
5356	return NT_STATUS_NO_MEMORY;
5357	}
5358
5359	if (!pdb_set_username(user, name, PDB_SET)) {
5360	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5361	return NT_STATUS_UNSUCCESSFUL;
5362	}
5363	if (!pdb_set_domain(user, get_global_sam_name(), PDB_SET)) {
5364	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5365	return NT_STATUS_UNSUCCESSFUL;
5366	}
5367	if (is_machine) {
5368	if (acb_info & ACB_NORMAL) {
5369	if (!pdb_set_acct_ctrl(user, ACB_WSTRUST, PDB_SET)) {
5370	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5371	return NT_STATUS_UNSUCCESSFUL;
5372	}
5373	} else {
5374	if (!pdb_set_acct_ctrl(user, acb_info, PDB_SET)) {
5375	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5376	return NT_STATUS_UNSUCCESSFUL;
5377	}
5378	}
5379	} else {
5380	if (!pdb_set_acct_ctrl(user, ACB_NORMAL \| ACB_DISABLED, PDB_SET)) {
5381	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5382	return NT_STATUS_UNSUCCESSFUL;
5383	}
5384	}
5385
5386	if (!pdb_set_user_sid(user, &user_sid, PDB_SET)) {
5387	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5388	return NT_STATUS_UNSUCCESSFUL;
5389	}
5390
5391	if (!init_ldap_from_sam(ldap_state, NULL, &mods, user, element_is_set_or_changed)) {
5392	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5393	return NT_STATUS_UNSUCCESSFUL;
5394	}
5395
5396	if (ldap_state->schema_ver != SCHEMAVER_SAMBASAMACCOUNT) {
5397	DEBUG(1,("ldapsam_create_user: Unsupported schema version\n"));
5398	}
5399	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
5400
5401	if (add_posix) {
5402	char *escape_name;
5403
5404	DEBUG(3,("ldapsam_create_user: Creating new posix user\n"));
5405
5406	/* retrieve the Domain Users group gid */
5407	if (!sid_compose(&group_sid, get_global_sam_sid(), DOMAIN_GROUP_RID_USERS) \|\|
5408	!sid_to_gid(&group_sid, &gid)) {
5409	DEBUG (0, ("ldapsam_create_user: Unable to get the Domain Users gid: bailing out!\n"));
5410	return NT_STATUS_INVALID_PRIMARY_GROUP;
5411	}
5412
5413	/* lets allocate a new userid for this user */
5414	if (!winbind_allocate_uid(&uid)) {
5415	DEBUG (0, ("ldapsam_create_user: Unable to allocate a new user id: bailing out!\n"));
5416	return NT_STATUS_UNSUCCESSFUL;
5417	}
5418
5419
5420	if (is_machine) {
5421	/* TODO: choose a more appropriate default for machines */
5422	homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), "SMB_workstations_home", ldap_state->domain_name, uid, gid);
5423	shell = talloc_strdup(tmp_ctx, "/bin/false");
5424	} else {
5425	homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), name, ldap_state->domain_name, uid, gid);
5426	shell = talloc_sub_specified(tmp_ctx, lp_template_shell(), name, ldap_state->domain_name, uid, gid);
5427	}
5428	uidstr = talloc_asprintf(tmp_ctx, "%u", (unsigned int)uid);
5429	gidstr = talloc_asprintf(tmp_ctx, "%u", (unsigned int)gid);
5430
5431	escape_name = escape_rdn_val_string_alloc(name);
5432	if (!escape_name) {
5433	DEBUG (0, ("ldapsam_create_user: Out of memory!\n"));
5434	return NT_STATUS_NO_MEMORY;
5435	}
5436
5437	if (is_machine) {
5438	dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_machine_suffix ());
5439	} else {
5440	dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_user_suffix ());
5441	}
5442
5443	SAFE_FREE(escape_name);
5444
5445	if (!homedir \|\| !shell \|\| !uidstr \|\| !gidstr \|\| !dn) {
5446	DEBUG (0, ("ldapsam_create_user: Out of memory!\n"));
5447	return NT_STATUS_NO_MEMORY;
5448	}
5449
5450	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
5451	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
5452	smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
5453	smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
5454	smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
5455	smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", homedir);
5456	smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", shell);
5457	}
5458
5459	talloc_autofree_ldapmod(tmp_ctx, mods);
5460
5461	if (add_posix) {
5462	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5463	} else {
5464	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5465	}
5466
5467	if (rc != LDAP_SUCCESS) {
5468	DEBUG(0,("ldapsam_create_user: failed to create a new user [%s] (dn = %s)\n", name ,dn));
5469	return NT_STATUS_UNSUCCESSFUL;
5470	}
5471
5472	DEBUG(2,("ldapsam_create_user: added account [%s] in the LDAP database\n", name));
5473
5474	flush_pwnam_cache();
5475
5476	return NT_STATUS_OK;
5477	}
5478
5479	static NTSTATUS ldapsam_delete_user(struct pdb_methods my_methods, TALLOC_CTX tmp_ctx, struct samu *sam_acct)
5480	{
5481	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5482	LDAPMessage *result = NULL;
5483	LDAPMessage *entry = NULL;
5484	int num_result;
5485	const char *dn;
5486	char *filter;
5487	int rc;
5488
5489	DEBUG(0,("ldapsam_delete_user: Attempt to delete user [%s]\n", pdb_get_username(sam_acct)));
5490
5491	filter = talloc_asprintf(tmp_ctx,
5492	"(&(uid=%s)"
5493	"(objectClass=%s)"
5494	"(objectClass=%s))",
5495	pdb_get_username(sam_acct),
5496	LDAP_OBJ_POSIXACCOUNT,
5497	LDAP_OBJ_SAMBASAMACCOUNT);
5498	if (filter == NULL) {
5499	return NT_STATUS_NO_MEMORY;
5500	}
5501
5502	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5503	if (rc != LDAP_SUCCESS) {
5504	DEBUG(0,("ldapsam_delete_user: user search failed!\n"));
5505	return NT_STATUS_UNSUCCESSFUL;
5506	}
5507	talloc_autofree_ldapmsg(tmp_ctx, result);
5508
5509	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5510
5511	if (num_result == 0) {
5512	DEBUG(0,("ldapsam_delete_user: user not found!\n"));
5513	return NT_STATUS_NO_SUCH_USER;
5514	}
5515
5516	if (num_result > 1) {
5517	DEBUG (0, ("ldapsam_delete_user: More than one user with name [%s] ?!\n", pdb_get_username(sam_acct)));
5518	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5519	}
5520
5521	entry = ldap_first_entry(priv2ld(ldap_state), result);
5522	if (!entry) {
5523	return NT_STATUS_UNSUCCESSFUL;
5524	}
5525
5526	/* it is just a posix account, retrieve the dn for later use */
5527	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5528	if (!dn) {
5529	DEBUG(0,("ldapsam_delete_user: Out of memory!\n"));
5530	return NT_STATUS_NO_MEMORY;
5531	}
5532
5533	/* try to remove memberships first */
5534	{
5535	NTSTATUS status;
5536	struct dom_sid *sids = NULL;
5537	gid_t *gids = NULL;
5538	size_t num_groups = 0;
5539	int i;
5540	uint32_t user_rid = pdb_get_user_rid(sam_acct);
5541
5542	status = ldapsam_enum_group_memberships(my_methods,
5543	tmp_ctx,
5544	sam_acct,
5545	&sids,
5546	&gids,
5547	&num_groups);
5548	if (!NT_STATUS_IS_OK(status)) {
5549	goto delete_dn;
5550	}
5551
5552	for (i=0; i < num_groups; i++) {
5553
5554	uint32_t group_rid;
5555
5556	sid_peek_rid(&sids[i], &group_rid);
5557
5558	ldapsam_del_groupmem(my_methods,
5559	tmp_ctx,
5560	group_rid,
5561	user_rid);
5562	}
5563	}
5564
5565	delete_dn:
5566
5567	rc = smbldap_delete(ldap_state->smbldap_state, dn);
5568	if (rc != LDAP_SUCCESS) {
5569	return NT_STATUS_UNSUCCESSFUL;
5570	}
5571
5572	flush_pwnam_cache();
5573
5574	return NT_STATUS_OK;
5575	}
5576
5577	/*
5578	* ldapsam_create_group creates a new
5579	* posixGroup and sambaGroupMapping object
5580	* in the ldap groups subtree
5581	*
5582	* The gid is allocated by winbindd.
5583	*/
5584
5585	static NTSTATUS ldapsam_create_dom_group(struct pdb_methods *my_methods,
5586	TALLOC_CTX *tmp_ctx,
5587	const char *name,
5588	uint32 *rid)
5589	{
5590	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5591	NTSTATUS ret;
5592	LDAPMessage *entry = NULL;
5593	LDAPMessage *result = NULL;
5594	uint32 num_result;
5595	bool is_new_entry = False;
5596	LDAPMod **mods = NULL;
5597	char *filter;
5598	char *groupsidstr;
5599	char *groupname;
5600	char *grouptype;
5601	char *gidstr;
5602	const char *dn = NULL;
5603	DOM_SID group_sid;
5604	gid_t gid = -1;
5605	int rc;
5606
5607	groupname = escape_ldap_string(talloc_tos(), name);
5608	filter = talloc_asprintf(tmp_ctx, "(&(cn=%s)(objectClass=%s))",
5609	groupname, LDAP_OBJ_POSIXGROUP);
5610	TALLOC_FREE(groupname);
5611
5612	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5613	if (rc != LDAP_SUCCESS) {
5614	DEBUG(0,("ldapsam_create_group: ldap search failed!\n"));
5615	return NT_STATUS_UNSUCCESSFUL;
5616	}
5617	talloc_autofree_ldapmsg(tmp_ctx, result);
5618
5619	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5620
5621	if (num_result > 1) {
5622	DEBUG (0, ("ldapsam_create_group: There exists more than one group with name [%s]: bailing out!\n", name));
5623	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5624	}
5625
5626	if (num_result == 1) {
5627	char *tmp;
5628	/* check if it is just a posix group.
5629	* or if there is a sid attached to this entry
5630	*/
5631
5632	entry = ldap_first_entry(priv2ld(ldap_state), result);
5633	if (!entry) {
5634	return NT_STATUS_UNSUCCESSFUL;
5635	}
5636
5637	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "sambaSID", tmp_ctx);
5638	if (tmp) {
5639	DEBUG (1, ("ldapsam_create_group: The group [%s] already exist!\n", name));
5640	return NT_STATUS_GROUP_EXISTS;
5641	}
5642
5643	/* it is just a posix group, retrieve the gid and the dn for later use */
5644	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5645	if (!tmp) {
5646	DEBUG (1, ("ldapsam_create_group: Couldn't retrieve the gidNumber for [%s]?!?!\n", name));
5647	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5648	}
5649
5650	gid = strtoul(tmp, NULL, 10);
5651
5652	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5653	if (!dn) {
5654	DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
5655	return NT_STATUS_NO_MEMORY;
5656	}
5657	}
5658
5659	if (num_result == 0) {
5660	char *escape_name;
5661
5662	DEBUG(3,("ldapsam_create_user: Creating new posix group\n"));
5663
5664	is_new_entry = True;
5665
5666	/* lets allocate a new groupid for this group */
5667	if (!winbind_allocate_gid(&gid)) {
5668	DEBUG (0, ("ldapsam_create_group: Unable to allocate a new group id: bailing out!\n"));
5669	return NT_STATUS_UNSUCCESSFUL;
5670	}
5671
5672	gidstr = talloc_asprintf(tmp_ctx, "%u", (unsigned int)gid);
5673
5674	escape_name = escape_rdn_val_string_alloc(name);
5675	if (!escape_name) {
5676	DEBUG (0, ("ldapsam_create_group: Out of memory!\n"));
5677	return NT_STATUS_NO_MEMORY;
5678	}
5679
5680	dn = talloc_asprintf(tmp_ctx, "cn=%s,%s", escape_name, lp_ldap_group_suffix());
5681
5682	SAFE_FREE(escape_name);
5683
5684	if (!gidstr \|\| !dn) {
5685	DEBUG (0, ("ldapsam_create_group: Out of memory!\n"));
5686	return NT_STATUS_NO_MEMORY;
5687	}
5688
5689	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_POSIXGROUP);
5690	smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
5691	smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
5692	}
5693
5694	if (!NT_STATUS_IS_OK((ret = ldapsam_new_rid_internal(my_methods, rid)))) {
5695	DEBUG(1, ("ldapsam_create_group: Could not allocate a new RID\n"));
5696	return ret;
5697	}
5698
5699	sid_compose(&group_sid, get_global_sam_sid(), *rid);
5700
5701	groupsidstr = talloc_strdup(tmp_ctx, sid_string_talloc(tmp_ctx,
5702	&group_sid));
5703	grouptype = talloc_asprintf(tmp_ctx, "%d", SID_NAME_DOM_GRP);
5704
5705	if (!groupsidstr \|\| !grouptype) {
5706	DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
5707	return NT_STATUS_NO_MEMORY;
5708	}
5709
5710	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
5711	smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid", groupsidstr);
5712	smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", grouptype);
5713	smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
5714	talloc_autofree_ldapmod(tmp_ctx, mods);
5715
5716	if (is_new_entry) {
5717	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5718	#if 0
5719	if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
5720	/* This call may fail with rfc2307bis schema */
5721	/* Retry adding a structural class */
5722	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "????");
5723	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5724	}
5725	#endif
5726	} else {
5727	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5728	}
5729
5730	if (rc != LDAP_SUCCESS) {
5731	DEBUG(0,("ldapsam_create_group: failed to create a new group [%s] (dn = %s)\n", name ,dn));
5732	return NT_STATUS_UNSUCCESSFUL;
5733	}
5734
5735	DEBUG(2,("ldapsam_create_group: added group [%s] in the LDAP database\n", name));
5736
5737	return NT_STATUS_OK;
5738	}
5739
5740	static NTSTATUS ldapsam_delete_dom_group(struct pdb_methods my_methods, TALLOC_CTX tmp_ctx, uint32 rid)
5741	{
5742	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5743	LDAPMessage *result = NULL;
5744	LDAPMessage *entry = NULL;
5745	int num_result;
5746	const char *dn;
5747	char *gidstr;
5748	char *filter;
5749	DOM_SID group_sid;
5750	int rc;
5751
5752	/* get the group sid */
5753	sid_compose(&group_sid, get_global_sam_sid(), rid);
5754
5755	filter = talloc_asprintf(tmp_ctx,
5756	"(&(sambaSID=%s)"
5757	"(objectClass=%s)"
5758	"(objectClass=%s))",
5759	sid_string_talloc(tmp_ctx, &group_sid),
5760	LDAP_OBJ_POSIXGROUP,
5761	LDAP_OBJ_GROUPMAP);
5762	if (filter == NULL) {
5763	return NT_STATUS_NO_MEMORY;
5764	}
5765
5766	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5767	if (rc != LDAP_SUCCESS) {
5768	DEBUG(1,("ldapsam_delete_dom_group: group search failed!\n"));
5769	return NT_STATUS_UNSUCCESSFUL;
5770	}
5771	talloc_autofree_ldapmsg(tmp_ctx, result);
5772
5773	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5774
5775	if (num_result == 0) {
5776	DEBUG(1,("ldapsam_delete_dom_group: group not found!\n"));
5777	return NT_STATUS_NO_SUCH_GROUP;
5778	}
5779
5780	if (num_result > 1) {
5781	DEBUG (0, ("ldapsam_delete_dom_group: More than one group with the same SID ?!\n"));
5782	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5783	}
5784
5785	entry = ldap_first_entry(priv2ld(ldap_state), result);
5786	if (!entry) {
5787	return NT_STATUS_UNSUCCESSFUL;
5788	}
5789
5790	/* here it is, retrieve the dn for later use */
5791	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5792	if (!dn) {
5793	DEBUG(0,("ldapsam_delete_dom_group: Out of memory!\n"));
5794	return NT_STATUS_NO_MEMORY;
5795	}
5796
5797	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5798	if (!gidstr) {
5799	DEBUG (0, ("ldapsam_delete_dom_group: Unable to find the group's gid!\n"));
5800	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5801	}
5802
5803	/* check no user have this group marked as primary group */
5804	filter = talloc_asprintf(tmp_ctx,
5805	"(&(gidNumber=%s)"
5806	"(objectClass=%s)"
5807	"(objectClass=%s))",
5808	gidstr,
5809	LDAP_OBJ_POSIXACCOUNT,
5810	LDAP_OBJ_SAMBASAMACCOUNT);
5811
5812	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5813	if (rc != LDAP_SUCCESS) {
5814	DEBUG(1,("ldapsam_delete_dom_group: accounts search failed!\n"));
5815	return NT_STATUS_UNSUCCESSFUL;
5816	}
5817	talloc_autofree_ldapmsg(tmp_ctx, result);
5818
5819	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5820
5821	if (num_result != 0) {
5822	DEBUG(3,("ldapsam_delete_dom_group: Can't delete group, it is a primary group for %d users\n", num_result));
5823	return NT_STATUS_MEMBERS_PRIMARY_GROUP;
5824	}
5825
5826	rc = smbldap_delete(ldap_state->smbldap_state, dn);
5827	if (rc != LDAP_SUCCESS) {
5828	return NT_STATUS_UNSUCCESSFUL;
5829	}
5830
5831	return NT_STATUS_OK;
5832	}
5833
5834	static NTSTATUS ldapsam_change_groupmem(struct pdb_methods *my_methods,
5835	TALLOC_CTX *tmp_ctx,
5836	uint32 group_rid,
5837	uint32 member_rid,
5838	int modop)
5839	{
5840	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5841	LDAPMessage *entry = NULL;
5842	LDAPMessage *result = NULL;
5843	uint32 num_result;
5844	LDAPMod **mods = NULL;
5845	char *filter;
5846	char *uidstr;
5847	const char *dn = NULL;
5848	DOM_SID group_sid;
5849	DOM_SID member_sid;
5850	int rc;
5851
5852	switch (modop) {
5853	case LDAP_MOD_ADD:
5854	DEBUG(1,("ldapsam_change_groupmem: add new member(rid=%d) to a domain group(rid=%d)", member_rid, group_rid));
5855	break;
5856	case LDAP_MOD_DELETE:
5857	DEBUG(1,("ldapsam_change_groupmem: delete member(rid=%d) from a domain group(rid=%d)", member_rid, group_rid));
5858	break;
5859	default:
5860	return NT_STATUS_UNSUCCESSFUL;
5861	}
5862
5863	/* get member sid */
5864	sid_compose(&member_sid, get_global_sam_sid(), member_rid);
5865
5866	/* get the group sid */
5867	sid_compose(&group_sid, get_global_sam_sid(), group_rid);
5868
5869	filter = talloc_asprintf(tmp_ctx,
5870	"(&(sambaSID=%s)"
5871	"(objectClass=%s)"
5872	"(objectClass=%s))",
5873	sid_string_talloc(tmp_ctx, &member_sid),
5874	LDAP_OBJ_POSIXACCOUNT,
5875	LDAP_OBJ_SAMBASAMACCOUNT);
5876	if (filter == NULL) {
5877	return NT_STATUS_NO_MEMORY;
5878	}
5879
5880	/* get the member uid */
5881	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5882	if (rc != LDAP_SUCCESS) {
5883	DEBUG(1,("ldapsam_change_groupmem: member search failed!\n"));
5884	return NT_STATUS_UNSUCCESSFUL;
5885	}
5886	talloc_autofree_ldapmsg(tmp_ctx, result);
5887
5888	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5889
5890	if (num_result == 0) {
5891	DEBUG(1,("ldapsam_change_groupmem: member not found!\n"));
5892	return NT_STATUS_NO_SUCH_MEMBER;
5893	}
5894
5895	if (num_result > 1) {
5896	DEBUG (0, ("ldapsam_change_groupmem: More than one account with the same SID ?!\n"));
5897	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5898	}
5899
5900	entry = ldap_first_entry(priv2ld(ldap_state), result);
5901	if (!entry) {
5902	return NT_STATUS_UNSUCCESSFUL;
5903	}
5904
5905	if (modop == LDAP_MOD_DELETE) {
5906	/* check if we are trying to remove the member from his primary group */
5907	char *gidstr;
5908	gid_t user_gid, group_gid;
5909
5910	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5911	if (!gidstr) {
5912	DEBUG (0, ("ldapsam_change_groupmem: Unable to find the member's gid!\n"));
5913	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5914	}
5915
5916	user_gid = strtoul(gidstr, NULL, 10);
5917
5918	if (!sid_to_gid(&group_sid, &group_gid)) {
5919	DEBUG (0, ("ldapsam_change_groupmem: Unable to get group gid from SID!\n"));
5920	return NT_STATUS_UNSUCCESSFUL;
5921	}
5922
5923	if (user_gid == group_gid) {
5924	DEBUG (3, ("ldapsam_change_groupmem: can't remove user from its own primary group!\n"));
5925	return NT_STATUS_MEMBERS_PRIMARY_GROUP;
5926	}
5927	}
5928
5929	/* here it is, retrieve the uid for later use */
5930	uidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "uid", tmp_ctx);
5931	if (!uidstr) {
5932	DEBUG (0, ("ldapsam_change_groupmem: Unable to find the member's name!\n"));
5933	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5934	}
5935
5936	filter = talloc_asprintf(tmp_ctx,
5937	"(&(sambaSID=%s)"
5938	"(objectClass=%s)"
5939	"(objectClass=%s))",
5940	sid_string_talloc(tmp_ctx, &group_sid),
5941	LDAP_OBJ_POSIXGROUP,
5942	LDAP_OBJ_GROUPMAP);
5943
5944	/* get the group */
5945	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5946	if (rc != LDAP_SUCCESS) {
5947	DEBUG(1,("ldapsam_change_groupmem: group search failed!\n"));
5948	return NT_STATUS_UNSUCCESSFUL;
5949	}
5950	talloc_autofree_ldapmsg(tmp_ctx, result);
5951
5952	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5953
5954	if (num_result == 0) {
5955	DEBUG(1,("ldapsam_change_groupmem: group not found!\n"));
5956	return NT_STATUS_NO_SUCH_GROUP;
5957	}
5958
5959	if (num_result > 1) {
5960	DEBUG (0, ("ldapsam_change_groupmem: More than one group with the same SID ?!\n"));
5961	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5962	}
5963
5964	entry = ldap_first_entry(priv2ld(ldap_state), result);
5965	if (!entry) {
5966	return NT_STATUS_UNSUCCESSFUL;
5967	}
5968
5969	/* here it is, retrieve the dn for later use */
5970	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5971	if (!dn) {
5972	DEBUG(0,("ldapsam_change_groupmem: Out of memory!\n"));
5973	return NT_STATUS_NO_MEMORY;
5974	}
5975
5976	smbldap_set_mod(&mods, modop, "memberUid", uidstr);
5977
5978	talloc_autofree_ldapmod(tmp_ctx, mods);
5979
5980	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5981	if (rc != LDAP_SUCCESS) {
5982	if (rc == LDAP_TYPE_OR_VALUE_EXISTS && modop == LDAP_MOD_ADD) {
5983	DEBUG(1,("ldapsam_change_groupmem: member is already in group, add failed!\n"));
5984	return NT_STATUS_MEMBER_IN_GROUP;
5985	}
5986	if (rc == LDAP_NO_SUCH_ATTRIBUTE && modop == LDAP_MOD_DELETE) {
5987	DEBUG(1,("ldapsam_change_groupmem: member is not in group, delete failed!\n"));
5988	return NT_STATUS_MEMBER_NOT_IN_GROUP;
5989	}
5990	return NT_STATUS_UNSUCCESSFUL;
5991	}
5992
5993	return NT_STATUS_OK;
5994	}
5995
5996	static NTSTATUS ldapsam_add_groupmem(struct pdb_methods *my_methods,
5997	TALLOC_CTX *tmp_ctx,
5998	uint32 group_rid,
5999	uint32 member_rid)
6000	{
6001	return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_ADD);
6002	}
6003	static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
6004	TALLOC_CTX *tmp_ctx,
6005	uint32 group_rid,
6006	uint32 member_rid)
6007	{
6008	return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_DELETE);
6009	}
6010
6011	static NTSTATUS ldapsam_set_primary_group(struct pdb_methods *my_methods,
6012	TALLOC_CTX *mem_ctx,
6013	struct samu *sampass)
6014	{
6015	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
6016	LDAPMessage *entry = NULL;
6017	LDAPMessage *result = NULL;
6018	uint32 num_result;
6019	LDAPMod **mods = NULL;
6020	char *filter;
6021	char *escape_username;
6022	char *gidstr;
6023	const char *dn = NULL;
6024	gid_t gid;
6025	int rc;
6026
6027	DEBUG(0,("ldapsam_set_primary_group: Attempt to set primary group for user [%s]\n", pdb_get_username(sampass)));
6028
6029	if (!sid_to_gid(pdb_get_group_sid(sampass), &gid)) {
6030	DEBUG(0,("ldapsam_set_primary_group: failed to retrieve gid from user's group SID!\n"));
6031	return NT_STATUS_UNSUCCESSFUL;
6032	}
6033	gidstr = talloc_asprintf(mem_ctx, "%u", (unsigned int)gid);
6034	if (!gidstr) {
6035	DEBUG(0,("ldapsam_set_primary_group: Out of Memory!\n"));
6036	return NT_STATUS_NO_MEMORY;
6037	}
6038
6039	escape_username = escape_ldap_string(talloc_tos(),
6040	pdb_get_username(sampass));
6041	if (escape_username== NULL) {
6042	return NT_STATUS_NO_MEMORY;
6043	}
6044
6045	filter = talloc_asprintf(mem_ctx,
6046	"(&(uid=%s)"
6047	"(objectClass=%s)"
6048	"(objectClass=%s))",
6049	escape_username,
6050	LDAP_OBJ_POSIXACCOUNT,
6051	LDAP_OBJ_SAMBASAMACCOUNT);
6052
6053	TALLOC_FREE(escape_username);
6054
6055	if (filter == NULL) {
6056	return NT_STATUS_NO_MEMORY;
6057	}
6058
6059	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
6060	if (rc != LDAP_SUCCESS) {
6061	DEBUG(0,("ldapsam_set_primary_group: user search failed!\n"));
6062	return NT_STATUS_UNSUCCESSFUL;
6063	}
6064	talloc_autofree_ldapmsg(mem_ctx, result);
6065
6066	num_result = ldap_count_entries(priv2ld(ldap_state), result);
6067
6068	if (num_result == 0) {
6069	DEBUG(0,("ldapsam_set_primary_group: user not found!\n"));
6070	return NT_STATUS_NO_SUCH_USER;
6071	}
6072
6073	if (num_result > 1) {
6074	DEBUG (0, ("ldapsam_set_primary_group: More than one user with name [%s] ?!\n", pdb_get_username(sampass)));
6075	return NT_STATUS_INTERNAL_DB_CORRUPTION;
6076	}
6077
6078	entry = ldap_first_entry(priv2ld(ldap_state), result);
6079	if (!entry) {
6080	return NT_STATUS_UNSUCCESSFUL;
6081	}
6082
6083	/* retrieve the dn for later use */
6084	dn = smbldap_talloc_dn(mem_ctx, priv2ld(ldap_state), entry);
6085	if (!dn) {
6086	DEBUG(0,("ldapsam_set_primary_group: Out of memory!\n"));
6087	return NT_STATUS_NO_MEMORY;
6088	}
6089
6090	/* remove the old one, and add the new one, this way we do not risk races */
6091	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "gidNumber", gidstr);
6092
6093	if (mods == NULL) {
6094	return NT_STATUS_OK;
6095	}
6096
6097	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
6098
6099	if (rc != LDAP_SUCCESS) {
6100	DEBUG(0,("ldapsam_set_primary_group: failed to modify [%s] primary group to [%s]\n",
6101	pdb_get_username(sampass), gidstr));
6102	return NT_STATUS_UNSUCCESSFUL;
6103	}
6104
6105	flush_pwnam_cache();
6106
6107	return NT_STATUS_OK;
6108	}
6109
6110
6111	/**********************************************************************
6112	trusted domains functions
6113	*********************************************************************/
6114
6115	static char trusteddom_dn(struct ldapsam_privates ldap_state,
6116	const char *domain)
6117	{
6118	return talloc_asprintf(talloc_tos(), "sambaDomainName=%s,%s", domain,
6119	ldap_state->domain_dn);
6120	}
6121
6122	static bool get_trusteddom_pw_int(struct ldapsam_privates *ldap_state,
6123	TALLOC_CTX *mem_ctx,
6124	const char domain, LDAPMessage *entry)
6125	{
6126	int rc;
6127	char *filter;
6128	int scope = LDAP_SCOPE_SUBTREE;
6129	const char *attrs = NULL; / NULL: get all attrs */
6130	int attrsonly = 0; /* 0: return values too */
6131	LDAPMessage *result = NULL;
6132	char *trusted_dn;
6133	uint32 num_result;
6134
6135	filter = talloc_asprintf(talloc_tos(),
6136	"(&(objectClass=%s)(sambaDomainName=%s))",
6137	LDAP_OBJ_TRUSTDOM_PASSWORD, domain);
6138
6139	trusted_dn = trusteddom_dn(ldap_state, domain);
6140	if (trusted_dn == NULL) {
6141	return False;
6142	}
6143	rc = smbldap_search(ldap_state->smbldap_state, trusted_dn, scope,
6144	filter, attrs, attrsonly, &result);
6145
6146	if (result != NULL) {
6147	talloc_autofree_ldapmsg(mem_ctx, result);
6148	}
6149
6150	if (rc == LDAP_NO_SUCH_OBJECT) {
6151	*entry = NULL;
6152	return True;
6153	}
6154
6155	if (rc != LDAP_SUCCESS) {
6156	return False;
6157	}
6158
6159	num_result = ldap_count_entries(priv2ld(ldap_state), result);
6160
6161	if (num_result > 1) {
6162	DEBUG(1, ("ldapsam_get_trusteddom_pw: more than one "
6163	"%s object for domain '%s'?!\n",
6164	LDAP_OBJ_TRUSTDOM_PASSWORD, domain));
6165	return False;
6166	}
6167
6168	if (num_result == 0) {
6169	DEBUG(1, ("ldapsam_get_trusteddom_pw: no "
6170	"%s object for domain %s.\n",
6171	LDAP_OBJ_TRUSTDOM_PASSWORD, domain));
6172	*entry = NULL;
6173	} else {
6174	*entry = ldap_first_entry(priv2ld(ldap_state), result);
6175	}
6176
6177	return True;
6178	}
6179
6180	static bool ldapsam_get_trusteddom_pw(struct pdb_methods *methods,
6181	const char *domain,
6182	char** pwd,
6183	DOM_SID *sid,
6184	time_t *pass_last_set_time)
6185	{
6186	struct ldapsam_privates *ldap_state =
6187	(struct ldapsam_privates *)methods->private_data;
6188	LDAPMessage *entry = NULL;
6189
6190	DEBUG(10, ("ldapsam_get_trusteddom_pw called for domain %s\n", domain));
6191
6192	if (!get_trusteddom_pw_int(ldap_state, talloc_tos(), domain, &entry) \|\|
6193	(entry == NULL))
6194	{
6195	return False;
6196	}
6197
6198	/* password */
6199	if (pwd != NULL) {
6200	char *pwd_str;
6201	pwd_str = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6202	entry, "sambaClearTextPassword", talloc_tos());
6203	if (pwd_str == NULL) {
6204	return False;
6205	}
6206	/* trusteddom_pw routines do not use talloc yet... */
6207	*pwd = SMB_STRDUP(pwd_str);
6208	if (*pwd == NULL) {
6209	return False;
6210	}
6211	}
6212
6213	/* last change time */
6214	if (pass_last_set_time != NULL) {
6215	char *time_str;
6216	time_str = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6217	entry, "sambaPwdLastSet", talloc_tos());
6218	if (time_str == NULL) {
6219	return False;
6220	}
6221	*pass_last_set_time = (time_t)atol(time_str);
6222	}
6223
6224	/* domain sid */
6225	if (sid != NULL) {
6226	char *sid_str;
6227	DOM_SID *dom_sid;
6228	sid_str = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6229	entry, "sambaSID",
6230	talloc_tos());
6231	if (sid_str == NULL) {
6232	return False;
6233	}
6234	dom_sid = string_sid_talloc(talloc_tos(), sid_str);
6235	if (dom_sid == NULL) {
6236	return False;
6237	}
6238	sid_copy(sid, dom_sid);
6239	}
6240
6241	return True;
6242	}
6243
6244	static bool ldapsam_set_trusteddom_pw(struct pdb_methods *methods,
6245	const char* domain,
6246	const char* pwd,
6247	const DOM_SID *sid)
6248	{
6249	struct ldapsam_privates *ldap_state =
6250	(struct ldapsam_privates *)methods->private_data;
6251	LDAPMessage *entry = NULL;
6252	LDAPMod **mods = NULL;
6253	char *prev_pwd = NULL;
6254	char *trusted_dn = NULL;
6255	int rc;
6256
6257	DEBUG(10, ("ldapsam_set_trusteddom_pw called for domain %s\n", domain));
6258
6259	/*
6260	* get the current entry (if there is one) in order to put the
6261	* current password into the previous password attribute
6262	*/
6263	if (!get_trusteddom_pw_int(ldap_state, talloc_tos(), domain, &entry)) {
6264	return False;
6265	}
6266
6267	mods = NULL;
6268	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "objectClass",
6269	LDAP_OBJ_TRUSTDOM_PASSWORD);
6270	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "sambaDomainName",
6271	domain);
6272	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "sambaSID",
6273	sid_string_tos(sid));
6274	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "sambaPwdLastSet",
6275	talloc_asprintf(talloc_tos(), "%li", (long int)time(NULL)));
6276	smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
6277	"sambaClearTextPassword", pwd);
6278
6279	if (entry != NULL) {
6280	prev_pwd = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6281	entry, "sambaClearTextPassword", talloc_tos());
6282	if (prev_pwd != NULL) {
6283	smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
6284	"sambaPreviousClearTextPassword",
6285	prev_pwd);
6286	}
6287	}
6288
6289	talloc_autofree_ldapmod(talloc_tos(), mods);
6290
6291	trusted_dn = trusteddom_dn(ldap_state, domain);
6292	if (trusted_dn == NULL) {
6293	return False;
6294	}
6295	if (entry == NULL) {
6296	rc = smbldap_add(ldap_state->smbldap_state, trusted_dn, mods);
6297	} else {
6298	rc = smbldap_modify(ldap_state->smbldap_state, trusted_dn, mods);
6299	}
6300
6301	if (rc != LDAP_SUCCESS) {
6302	DEBUG(1, ("error writing trusted domain password!\n"));
6303	return False;
6304	}
6305
6306	return True;
6307	}
6308
6309	static bool ldapsam_del_trusteddom_pw(struct pdb_methods *methods,
6310	const char *domain)
6311	{
6312	int rc;
6313	struct ldapsam_privates *ldap_state =
6314	(struct ldapsam_privates *)methods->private_data;
6315	LDAPMessage *entry = NULL;
6316	const char *trusted_dn;
6317
6318	if (!get_trusteddom_pw_int(ldap_state, talloc_tos(), domain, &entry)) {
6319	return False;
6320	}
6321
6322	if (entry == NULL) {
6323	DEBUG(5, ("ldapsam_del_trusteddom_pw: no such trusted domain: "
6324	"%s\n", domain));
6325	return True;
6326	}
6327
6328	trusted_dn = smbldap_talloc_dn(talloc_tos(), priv2ld(ldap_state),
6329	entry);
6330	if (trusted_dn == NULL) {
6331	DEBUG(0,("ldapsam_del_trusteddom_pw: Out of memory!\n"));
6332	return False;
6333	}
6334
6335	rc = smbldap_delete(ldap_state->smbldap_state, trusted_dn);
6336	if (rc != LDAP_SUCCESS) {
6337	return False;
6338	}
6339
6340	return True;
6341	}
6342
6343	static NTSTATUS ldapsam_enum_trusteddoms(struct pdb_methods *methods,
6344	TALLOC_CTX *mem_ctx,
6345	uint32 *num_domains,
6346	struct trustdom_info ***domains)
6347	{
6348	int rc;
6349	struct ldapsam_privates *ldap_state =
6350	(struct ldapsam_privates *)methods->private_data;
6351	char *filter;
6352	int scope = LDAP_SCOPE_SUBTREE;
6353	const char *attrs[] = { "sambaDomainName", "sambaSID", NULL };
6354	int attrsonly = 0; /* 0: return values too */
6355	LDAPMessage *result = NULL;
6356	LDAPMessage *entry = NULL;
6357
6358	filter = talloc_asprintf(talloc_tos(), "(objectClass=%s)",
6359	LDAP_OBJ_TRUSTDOM_PASSWORD);
6360
6361	rc = smbldap_search(ldap_state->smbldap_state,
6362	ldap_state->domain_dn,
6363	scope,
6364	filter,
6365	attrs,
6366	attrsonly,
6367	&result);
6368
6369	if (result != NULL) {
6370	talloc_autofree_ldapmsg(mem_ctx, result);
6371	}
6372
6373	if (rc != LDAP_SUCCESS) {
6374	return NT_STATUS_UNSUCCESSFUL;
6375	}
6376
6377	*num_domains = 0;
6378	if (!(domains = TALLOC_ARRAY(mem_ctx, struct trustdom_info , 1))) {
6379	DEBUG(1, ("talloc failed\n"));
6380	return NT_STATUS_NO_MEMORY;
6381	}
6382
6383	for (entry = ldap_first_entry(priv2ld(ldap_state), result);
6384	entry != NULL;
6385	entry = ldap_next_entry(priv2ld(ldap_state), entry))
6386	{
6387	char dom_name, dom_sid_str;
6388	struct trustdom_info *dom_info;
6389
6390	dom_info = TALLOC_P(*domains, struct trustdom_info);
6391	if (dom_info == NULL) {
6392	DEBUG(1, ("talloc failed\n"));
6393	return NT_STATUS_NO_MEMORY;
6394	}
6395
6396	dom_name = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6397	entry,
6398	"sambaDomainName",
6399	talloc_tos());
6400	if (dom_name == NULL) {
6401	DEBUG(1, ("talloc failed\n"));
6402	return NT_STATUS_NO_MEMORY;
6403	}
6404	dom_info->name = dom_name;
6405
6406	dom_sid_str = smbldap_talloc_single_attribute(
6407	priv2ld(ldap_state), entry, "sambaSID",
6408	talloc_tos());
6409	if (dom_sid_str == NULL) {
6410	DEBUG(1, ("talloc failed\n"));
6411	return NT_STATUS_NO_MEMORY;
6412	}
6413	if (!string_to_sid(&dom_info->sid, dom_sid_str)) {
6414	DEBUG(1, ("Error calling string_to_sid on SID %s\n",
6415	dom_sid_str));
6416	return NT_STATUS_UNSUCCESSFUL;
6417	}
6418
6419	ADD_TO_ARRAY(domains, struct trustdom_info , dom_info,
6420	domains, num_domains);
6421
6422	if (*domains == NULL) {
6423	DEBUG(1, ("talloc failed\n"));
6424	return NT_STATUS_NO_MEMORY;
6425	}
6426	}
6427
6428	DEBUG(5, ("ldapsam_enum_trusteddoms: got %d domains\n", *num_domains));
6429	return NT_STATUS_OK;
6430	}
6431
6432
6433	/**********************************************************************
6434	Housekeeping
6435	*********************************************************************/
6436
6437	static void free_private_data(void **vp)
6438	{
6439	struct ldapsam_privates ldap_state = (struct ldapsam_privates )vp;
6440
6441	smbldap_free_struct(&(*ldap_state)->smbldap_state);
6442
6443	if ((*ldap_state)->result != NULL) {
6444	ldap_msgfree((*ldap_state)->result);
6445	(*ldap_state)->result = NULL;
6446	}
6447	if ((*ldap_state)->domain_dn != NULL) {
6448	SAFE_FREE((*ldap_state)->domain_dn);
6449	}
6450
6451	*ldap_state = NULL;
6452
6453	/* No need to free any further, as it is talloc()ed */
6454	}
6455
6456	/*********************************************************************
6457	Intitalise the parts of the pdb_methods structure that are common to
6458	all pdb_ldap modes
6459	*********************************************************************/
6460
6461	static NTSTATUS pdb_init_ldapsam_common(struct pdb_methods *pdb_method, const char location)
6462	{
6463	NTSTATUS nt_status;
6464	struct ldapsam_privates *ldap_state;
6465
6466	if (!NT_STATUS_IS_OK(nt_status = make_pdb_method( pdb_method ))) {
6467	return nt_status;
6468	}
6469
6470	(*pdb_method)->name = "ldapsam";
6471
6472	(*pdb_method)->getsampwnam = ldapsam_getsampwnam;
6473	(*pdb_method)->getsampwsid = ldapsam_getsampwsid;
6474	(*pdb_method)->add_sam_account = ldapsam_add_sam_account;
6475	(*pdb_method)->update_sam_account = ldapsam_update_sam_account;
6476	(*pdb_method)->delete_sam_account = ldapsam_delete_sam_account;
6477	(*pdb_method)->rename_sam_account = ldapsam_rename_sam_account;
6478
6479	(*pdb_method)->getgrsid = ldapsam_getgrsid;
6480	(*pdb_method)->getgrgid = ldapsam_getgrgid;
6481	(*pdb_method)->getgrnam = ldapsam_getgrnam;
6482	(*pdb_method)->add_group_mapping_entry = ldapsam_add_group_mapping_entry;
6483	(*pdb_method)->update_group_mapping_entry = ldapsam_update_group_mapping_entry;
6484	(*pdb_method)->delete_group_mapping_entry = ldapsam_delete_group_mapping_entry;
6485	(*pdb_method)->enum_group_mapping = ldapsam_enum_group_mapping;
6486
6487	(*pdb_method)->get_account_policy = ldapsam_get_account_policy;
6488	(*pdb_method)->set_account_policy = ldapsam_set_account_policy;
6489
6490	(*pdb_method)->get_seq_num = ldapsam_get_seq_num;
6491
6492	(*pdb_method)->capabilities = ldapsam_capabilities;
6493	(*pdb_method)->new_rid = ldapsam_new_rid;
6494
6495	(*pdb_method)->get_trusteddom_pw = ldapsam_get_trusteddom_pw;
6496	(*pdb_method)->set_trusteddom_pw = ldapsam_set_trusteddom_pw;
6497	(*pdb_method)->del_trusteddom_pw = ldapsam_del_trusteddom_pw;
6498	(*pdb_method)->enum_trusteddoms = ldapsam_enum_trusteddoms;
6499
6500	/* TODO: Setup private data and free */
6501
6502	if ( !(ldap_state = TALLOC_ZERO_P(*pdb_method, struct ldapsam_privates)) ) {
6503	DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
6504	return NT_STATUS_NO_MEMORY;
6505	}
6506
6507	nt_status = smbldap_init(*pdb_method, pdb_get_event_context(),
6508	location, &ldap_state->smbldap_state);
6509
6510	if ( !NT_STATUS_IS_OK(nt_status) ) {
6511	return nt_status;
6512	}
6513
6514	if ( !(ldap_state->domain_name = talloc_strdup(*pdb_method, get_global_sam_name()) ) ) {
6515	return NT_STATUS_NO_MEMORY;
6516	}
6517
6518	(*pdb_method)->private_data = ldap_state;
6519
6520	(*pdb_method)->free_private_data = free_private_data;
6521
6522	return NT_STATUS_OK;
6523	}
6524
6525	/**********************************************************************
6526	Initialise the 'compat' mode for pdb_ldap
6527	*********************************************************************/
6528
6529	NTSTATUS pdb_init_ldapsam_compat(struct pdb_methods *pdb_method, const char location)
6530	{
6531	NTSTATUS nt_status;
6532	struct ldapsam_privates *ldap_state;
6533	char *uri = talloc_strdup( NULL, location );
6534
6535	trim_char( uri, '\"', '\"' );
6536	nt_status = pdb_init_ldapsam_common( pdb_method, uri );
6537	if ( uri )
6538	TALLOC_FREE( uri );
6539
6540	if ( !NT_STATUS_IS_OK(nt_status) ) {
6541	return nt_status;
6542	}
6543
6544	(*pdb_method)->name = "ldapsam_compat";
6545
6546	ldap_state = (struct ldapsam_privates )((pdb_method)->private_data);
6547	ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT;
6548
6549	sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
6550
6551	return NT_STATUS_OK;
6552	}
6553
6554	/**********************************************************************
6555	Initialise the normal mode for pdb_ldap
6556	*********************************************************************/
6557
6558	NTSTATUS pdb_init_ldapsam(struct pdb_methods *pdb_method, const char location)
6559	{
6560	NTSTATUS nt_status;
6561	struct ldapsam_privates *ldap_state = NULL;
6562	uint32 alg_rid_base;
6563	char *alg_rid_base_string = NULL;
6564	LDAPMessage *result = NULL;
6565	LDAPMessage *entry = NULL;
6566	DOM_SID ldap_domain_sid;
6567	DOM_SID secrets_domain_sid;
6568	char *domain_sid_string = NULL;
6569	char *dn = NULL;
6570	char *uri = talloc_strdup( NULL, location );
6571
6572	trim_char( uri, '\"', '\"' );
6573	nt_status = pdb_init_ldapsam_common(pdb_method, uri);
6574	if (uri) {
6575	TALLOC_FREE(uri);
6576	}
6577
6578	if (!NT_STATUS_IS_OK(nt_status)) {
6579	return nt_status;
6580	}
6581
6582	(*pdb_method)->name = "ldapsam";
6583
6584	(*pdb_method)->add_aliasmem = ldapsam_add_aliasmem;
6585	(*pdb_method)->del_aliasmem = ldapsam_del_aliasmem;
6586	(*pdb_method)->enum_aliasmem = ldapsam_enum_aliasmem;
6587	(*pdb_method)->enum_alias_memberships = ldapsam_alias_memberships;
6588	(*pdb_method)->search_users = ldapsam_search_users;
6589	(*pdb_method)->search_groups = ldapsam_search_groups;
6590	(*pdb_method)->search_aliases = ldapsam_search_aliases;
6591
6592	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
6593	(*pdb_method)->enum_group_members = ldapsam_enum_group_members;
6594	(*pdb_method)->enum_group_memberships =
6595	ldapsam_enum_group_memberships;
6596	(*pdb_method)->lookup_rids = ldapsam_lookup_rids;
6597	(*pdb_method)->sid_to_id = ldapsam_sid_to_id;
6598	(*pdb_method)->uid_to_sid = ldapsam_uid_to_sid;
6599	(*pdb_method)->gid_to_sid = ldapsam_gid_to_sid;
6600
6601	if (lp_parm_bool(-1, "ldapsam", "editposix", False)) {
6602	(*pdb_method)->create_user = ldapsam_create_user;
6603	(*pdb_method)->delete_user = ldapsam_delete_user;
6604	(*pdb_method)->create_dom_group = ldapsam_create_dom_group;
6605	(*pdb_method)->delete_dom_group = ldapsam_delete_dom_group;
6606	(*pdb_method)->add_groupmem = ldapsam_add_groupmem;
6607	(*pdb_method)->del_groupmem = ldapsam_del_groupmem;
6608	(*pdb_method)->set_unix_primary_group = ldapsam_set_primary_group;
6609	}
6610	}
6611
6612	ldap_state = (struct ldapsam_privates )((pdb_method)->private_data);
6613	ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
6614
6615	/* Try to setup the Domain Name, Domain SID, algorithmic rid base */
6616
6617	nt_status = smbldap_search_domain_info(ldap_state->smbldap_state,
6618	&result,
6619	ldap_state->domain_name, True);
6620
6621	if ( !NT_STATUS_IS_OK(nt_status) ) {
6622	DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain "
6623	"info, nor add one to the domain\n"));
6624	DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, "
6625	"will be unable to allocate new users/groups, "
6626	"and will risk BDCs having inconsistant SIDs\n"));
6627	sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
6628	return NT_STATUS_OK;
6629	}
6630
6631	/* Given that the above might fail, everything below this must be
6632	* optional */
6633
6634	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
6635	result);
6636	if (!entry) {
6637	DEBUG(0, ("pdb_init_ldapsam: Could not get domain info "
6638	"entry\n"));
6639	ldap_msgfree(result);
6640	return NT_STATUS_UNSUCCESSFUL;
6641	}
6642
6643	dn = smbldap_talloc_dn(talloc_tos(), ldap_state->smbldap_state->ldap_struct, entry);
6644	if (!dn) {
6645	ldap_msgfree(result);
6646	return NT_STATUS_UNSUCCESSFUL;
6647	}
6648
6649	ldap_state->domain_dn = smb_xstrdup(dn);
6650	TALLOC_FREE(dn);
6651
6652	domain_sid_string = smbldap_talloc_single_attribute(
6653	ldap_state->smbldap_state->ldap_struct,
6654	entry,
6655	get_userattr_key2string(ldap_state->schema_ver,
6656	LDAP_ATTR_USER_SID),
6657	talloc_tos());
6658
6659	if (domain_sid_string) {
6660	bool found_sid;
6661	if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
6662	DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be "
6663	"read as a valid SID\n", domain_sid_string));
6664	ldap_msgfree(result);
6665	TALLOC_FREE(domain_sid_string);
6666	return NT_STATUS_INVALID_PARAMETER;
6667	}
6668	found_sid = secrets_fetch_domain_sid(ldap_state->domain_name,
6669	&secrets_domain_sid);
6670	if (!found_sid \|\| !sid_equal(&secrets_domain_sid,
6671	&ldap_domain_sid)) {
6672	DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain "
6673	"%s based on pdb_ldap results %s -> %s\n",
6674	ldap_state->domain_name,
6675	sid_string_dbg(&secrets_domain_sid),
6676	sid_string_dbg(&ldap_domain_sid)));
6677
6678	/* reset secrets.tdb sid */
6679	secrets_store_domain_sid(ldap_state->domain_name,
6680	&ldap_domain_sid);
6681	DEBUG(1, ("New global sam SID: %s\n",
6682	sid_string_dbg(get_global_sam_sid())));
6683	}
6684	sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
6685	TALLOC_FREE(domain_sid_string);
6686	}
6687
6688	alg_rid_base_string = smbldap_talloc_single_attribute(
6689	ldap_state->smbldap_state->ldap_struct,
6690	entry,
6691	get_attr_key2string( dominfo_attr_list,
6692	LDAP_ATTR_ALGORITHMIC_RID_BASE ),
6693	talloc_tos());
6694	if (alg_rid_base_string) {
6695	alg_rid_base = (uint32)atol(alg_rid_base_string);
6696	if (alg_rid_base != algorithmic_rid_base()) {
6697	DEBUG(0, ("The value of 'algorithmic RID base' has "
6698	"changed since the LDAP\n"
6699	"database was initialised. Aborting. \n"));
6700	ldap_msgfree(result);
6701	TALLOC_FREE(alg_rid_base_string);
6702	return NT_STATUS_UNSUCCESSFUL;
6703	}
6704	TALLOC_FREE(alg_rid_base_string);
6705	}
6706	ldap_msgfree(result);
6707
6708	return NT_STATUS_OK;
6709	}
6710
6711	NTSTATUS pdb_ldap_init(void)
6712	{
6713	NTSTATUS nt_status;
6714	if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam)))
6715	return nt_status;
6716
6717	if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_compat", pdb_init_ldapsam_compat)))
6718	return nt_status;
6719
6720	/* Let pdb_nds register backends */
6721	pdb_nds_init();
6722
6723	return NT_STATUS_OK;
6724	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: