Context Navigation

source: vendor/3.6.9/source3/passdb/pdb_ldap.c

Visit:

Last change on this file was 746, checked in by Silvan Scherrer, 13 years ago
Samba Server: updated vendor to 3.6.9
File size: 187.2 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	LDAP protocol helper functions for SAMBA
4	Copyright (C) Jean François Micouleau 1998
5	Copyright (C) Gerald Carter 2001-2003
6	Copyright (C) Shahms King 2001
7	Copyright (C) Andrew Bartlett 2002-2003
8	Copyright (C) Stefan (metze) Metzmacher 2002-2003
9	Copyright (C) Simo Sorce 2006
10
11	This program is free software; you can redistribute it and/or modify
12	it under the terms of the GNU General Public License as published by
13	the Free Software Foundation; either version 3 of the License, or
14	(at your option) any later version.
15
16	This program is distributed in the hope that it will be useful,
17	but WITHOUT ANY WARRANTY; without even the implied warranty of
18	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19	GNU General Public License for more details.
20
21	You should have received a copy of the GNU General Public License
22	along with this program. If not, see <http://www.gnu.org/licenses/>.
23
24	*/
25
26	/* TODO:
27	* persistent connections: if using NSS LDAP, many connections are made
28	* however, using only one within Samba would be nice
29	*
30	* Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
31	*
32	* Other LDAP based login attributes: accountExpires, etc.
33	* (should be the domain of Samba proper, but the sam_password/struct samu
34	* structures don't have fields for some of these attributes)
35	*
36	* SSL is done, but can't get the certificate based authentication to work
37	* against on my test platform (Linux 2.4, OpenLDAP 2.x)
38	*/
39
40	/* NOTE: this will NOT work against an Active Directory server
41	* due to the fact that the two password fields cannot be retrieved
42	* from a server; recommend using security = domain in this situation
43	* and/or winbind
44	*/
45
46	#include "includes.h"
47	#include "passdb.h"
48	#include "../libcli/auth/libcli_auth.h"
49	#include "secrets.h"
50	#include "idmap_cache.h"
51	#include "../libcli/security/security.h"
52	#include "../lib/util/util_pw.h"
53	#include "lib/winbind_util.h"
54
55	#undef DBGC_CLASS
56	#define DBGC_CLASS DBGC_PASSDB
57
58	#include <lber.h>
59	#include <ldap.h>
60
61
62	#include "smbldap.h"
63
64	/**********************************************************************
65	Simple helper function to make stuff better readable
66	**********************************************************************/
67
68	LDAP priv2ld(struct ldapsam_privates priv)
69	{
70	return priv->smbldap_state->ldap_struct;
71	}
72
73	/**********************************************************************
74	Get the attribute name given a user schame version.
75	**********************************************************************/
76
77	static const char* get_userattr_key2string( int schema_ver, int key )
78	{
79	switch ( schema_ver ) {
80	case SCHEMAVER_SAMBAACCOUNT:
81	return get_attr_key2string( attrib_map_v22, key );
82
83	case SCHEMAVER_SAMBASAMACCOUNT:
84	return get_attr_key2string( attrib_map_v30, key );
85
86	default:
87	DEBUG(0,("get_userattr_key2string: unknown schema version specified\n"));
88	break;
89	}
90	return NULL;
91	}
92
93	/**********************************************************************
94	Return the list of attribute names given a user schema version.
95	**********************************************************************/
96
97	const char** get_userattr_list( TALLOC_CTX *mem_ctx, int schema_ver )
98	{
99	switch ( schema_ver ) {
100	case SCHEMAVER_SAMBAACCOUNT:
101	return get_attr_list( mem_ctx, attrib_map_v22 );
102
103	case SCHEMAVER_SAMBASAMACCOUNT:
104	return get_attr_list( mem_ctx, attrib_map_v30 );
105	default:
106	DEBUG(0,("get_userattr_list: unknown schema version specified!\n"));
107	break;
108	}
109
110	return NULL;
111	}
112
113	/**************************************************************************
114	Return the list of attribute names to delete given a user schema version.
115	**************************************************************************/
116
117	static const char** get_userattr_delete_list( TALLOC_CTX *mem_ctx,
118	int schema_ver )
119	{
120	switch ( schema_ver ) {
121	case SCHEMAVER_SAMBAACCOUNT:
122	return get_attr_list( mem_ctx,
123	attrib_map_to_delete_v22 );
124
125	case SCHEMAVER_SAMBASAMACCOUNT:
126	return get_attr_list( mem_ctx,
127	attrib_map_to_delete_v30 );
128	default:
129	DEBUG(0,("get_userattr_delete_list: unknown schema version specified!\n"));
130	break;
131	}
132
133	return NULL;
134	}
135
136
137	/*******************************************************************
138	Generate the LDAP search filter for the objectclass based on the
139	version of the schema we are using.
140	******************************************************************/
141
142	static const char* get_objclass_filter( int schema_ver )
143	{
144	fstring objclass_filter;
145	char *result;
146
147	switch( schema_ver ) {
148	case SCHEMAVER_SAMBAACCOUNT:
149	fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT );
150	break;
151	case SCHEMAVER_SAMBASAMACCOUNT:
152	fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT );
153	break;
154	default:
155	DEBUG(0,("get_objclass_filter: Invalid schema version specified!\n"));
156	objclass_filter[0] = '\0';
157	break;
158	}
159
160	result = talloc_strdup(talloc_tos(), objclass_filter);
161	SMB_ASSERT(result != NULL);
162	return result;
163	}
164
165	/*****************************************************************
166	Scan a sequence number off OpenLDAP's syncrepl contextCSN
167	******************************************************************/
168
169	static NTSTATUS ldapsam_get_seq_num(struct pdb_methods my_methods, time_t seq_num)
170	{
171	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
172	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
173	LDAPMessage *msg = NULL;
174	LDAPMessage *entry = NULL;
175	TALLOC_CTX *mem_ctx;
176	char **values = NULL;
177	int rc, num_result, num_values, rid;
178	char *suffix = NULL;
179	char *tok;
180	const char *p;
181	const char **attrs;
182
183	/* Unfortunatly there is no proper way to detect syncrepl-support in
184	* smbldap_connect_system(). The syncrepl OIDs are submitted for publication
185	* but do not show up in the root-DSE yet. Neither we can query the
186	* subschema-context for the syncProviderSubentry or syncConsumerSubentry
187	* objectclass. Currently we require lp_ldap_suffix() to show up as
188	* namingContext. - Guenther
189	*/
190
191	if (!lp_parm_bool(-1, "ldapsam", "syncrepl_seqnum", False)) {
192	return ntstatus;
193	}
194
195	if (!seq_num) {
196	DEBUG(3,("ldapsam_get_seq_num: no sequence_number\n"));
197	return ntstatus;
198	}
199
200	if (!smbldap_has_naming_context(ldap_state->smbldap_state->ldap_struct, lp_ldap_suffix())) {
201	DEBUG(3,("ldapsam_get_seq_num: DIT not configured to hold %s "
202	"as top-level namingContext\n", lp_ldap_suffix()));
203	return ntstatus;
204	}
205
206	mem_ctx = talloc_init("ldapsam_get_seq_num");
207
208	if (mem_ctx == NULL)
209	return NT_STATUS_NO_MEMORY;
210
211	if ((attrs = TALLOC_ARRAY(mem_ctx, const char *, 2)) == NULL) {
212	ntstatus = NT_STATUS_NO_MEMORY;
213	goto done;
214	}
215
216	/* if we got a syncrepl-rid (up to three digits long) we speak with a consumer */
217	rid = lp_parm_int(-1, "ldapsam", "syncrepl_rid", -1);
218	if (rid > 0) {
219
220	/* consumer syncreplCookie: */
221	/* csn=20050126161620Z#0000001#00#00000 */
222	attrs[0] = talloc_strdup(mem_ctx, "syncreplCookie");
223	attrs[1] = NULL;
224	suffix = talloc_asprintf(mem_ctx,
225	"cn=syncrepl%d,%s", rid, lp_ldap_suffix());
226	if (!suffix) {
227	ntstatus = NT_STATUS_NO_MEMORY;
228	goto done;
229	}
230	} else {
231
232	/* provider contextCSN */
233	/* 20050126161620Z#000009#00#000000 */
234	attrs[0] = talloc_strdup(mem_ctx, "contextCSN");
235	attrs[1] = NULL;
236	suffix = talloc_asprintf(mem_ctx,
237	"cn=ldapsync,%s", lp_ldap_suffix());
238
239	if (!suffix) {
240	ntstatus = NT_STATUS_NO_MEMORY;
241	goto done;
242	}
243	}
244
245	rc = smbldap_search(ldap_state->smbldap_state, suffix,
246	LDAP_SCOPE_BASE, "(objectclass=*)", attrs, 0, &msg);
247
248	if (rc != LDAP_SUCCESS) {
249	goto done;
250	}
251
252	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg);
253	if (num_result != 1) {
254	DEBUG(3,("ldapsam_get_seq_num: Expected one entry, got %d\n", num_result));
255	goto done;
256	}
257
258	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg);
259	if (entry == NULL) {
260	DEBUG(3,("ldapsam_get_seq_num: Could not retrieve entry\n"));
261	goto done;
262	}
263
264	values = ldap_get_values(ldap_state->smbldap_state->ldap_struct, entry, attrs[0]);
265	if (values == NULL) {
266	DEBUG(3,("ldapsam_get_seq_num: no values\n"));
267	goto done;
268	}
269
270	num_values = ldap_count_values(values);
271	if (num_values == 0) {
272	DEBUG(3,("ldapsam_get_seq_num: not a single value\n"));
273	goto done;
274	}
275
276	p = values[0];
277	if (!next_token_talloc(mem_ctx, &p, &tok, "#")) {
278	DEBUG(0,("ldapsam_get_seq_num: failed to parse sequence number\n"));
279	goto done;
280	}
281
282	p = tok;
283	if (!strncmp(p, "csn=", strlen("csn=")))
284	p += strlen("csn=");
285
286	DEBUG(10,("ldapsam_get_seq_num: got %s: %s\n", attrs[0], p));
287
288	*seq_num = generalized_to_unix_time(p);
289
290	/* very basic sanity check */
291	if (*seq_num <= 0) {
292	DEBUG(3,("ldapsam_get_seq_num: invalid sequence number: %d\n",
293	(int)*seq_num));
294	goto done;
295	}
296
297	ntstatus = NT_STATUS_OK;
298
299	done:
300	if (values != NULL)
301	ldap_value_free(values);
302	if (msg != NULL)
303	ldap_msgfree(msg);
304	if (mem_ctx)
305	talloc_destroy(mem_ctx);
306
307	return ntstatus;
308	}
309
310	/*******************************************************************
311	Run the search by name.
312	******************************************************************/
313
314	int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
315	const char *user,
316	LDAPMessage ** result,
317	const char **attr)
318	{
319	char *filter = NULL;
320	char *escape_user = escape_ldap_string(talloc_tos(), user);
321	int ret = -1;
322
323	if (!escape_user) {
324	return LDAP_NO_MEMORY;
325	}
326
327	/*
328	* in the filter expression, replace %u with the real name
329	* so in ldap filter, %u MUST exist :-)
330	*/
331	filter = talloc_asprintf(talloc_tos(), "(&%s%s)", "(uid=%u)",
332	get_objclass_filter(ldap_state->schema_ver));
333	if (!filter) {
334	TALLOC_FREE(escape_user);
335	return LDAP_NO_MEMORY;
336	}
337	/*
338	* have to use this here because $ is filtered out
339	* in string_sub
340	*/
341
342	filter = talloc_all_string_sub(talloc_tos(),
343	filter, "%u", escape_user);
344	TALLOC_FREE(escape_user);
345	if (!filter) {
346	return LDAP_NO_MEMORY;
347	}
348
349	ret = smbldap_search_suffix(ldap_state->smbldap_state,
350	filter, attr, result);
351	TALLOC_FREE(filter);
352	return ret;
353	}
354
355	/*******************************************************************
356	Run the search by rid.
357	******************************************************************/
358
359	static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
360	uint32_t rid, LDAPMessage ** result,
361	const char **attr)
362	{
363	char *filter = NULL;
364	int rc;
365
366	filter = talloc_asprintf(talloc_tos(), "(&(rid=%i)%s)", rid,
367	get_objclass_filter(ldap_state->schema_ver));
368	if (!filter) {
369	return LDAP_NO_MEMORY;
370	}
371
372	rc = smbldap_search_suffix(ldap_state->smbldap_state,
373	filter, attr, result);
374	TALLOC_FREE(filter);
375	return rc;
376	}
377
378	/*******************************************************************
379	Run the search by SID.
380	******************************************************************/
381
382	static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
383	const struct dom_sid sid, LDAPMessage * result,
384	const char **attr)
385	{
386	char *filter = NULL;
387	int rc;
388	fstring sid_string;
389
390	filter = talloc_asprintf(talloc_tos(), "(&(%s=%s)%s)",
391	get_userattr_key2string(ldap_state->schema_ver,
392	LDAP_ATTR_USER_SID),
393	sid_to_fstring(sid_string, sid),
394	get_objclass_filter(ldap_state->schema_ver));
395	if (!filter) {
396	return LDAP_NO_MEMORY;
397	}
398
399	rc = smbldap_search_suffix(ldap_state->smbldap_state,
400	filter, attr, result);
401
402	TALLOC_FREE(filter);
403	return rc;
404	}
405
406	/*******************************************************************
407	Delete complete object or objectclass and attrs from
408	object found in search_result depending on lp_ldap_delete_dn
409	******************************************************************/
410
411	static int ldapsam_delete_entry(struct ldapsam_privates *priv,
412	TALLOC_CTX *mem_ctx,
413	LDAPMessage *entry,
414	const char *objectclass,
415	const char **attrs)
416	{
417	LDAPMod **mods = NULL;
418	char *name;
419	const char *dn;
420	BerElement *ptr = NULL;
421
422	dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry);
423	if (dn == NULL) {
424	return LDAP_NO_MEMORY;
425	}
426
427	if (lp_ldap_delete_dn()) {
428	return smbldap_delete(priv->smbldap_state, dn);
429	}
430
431	/* Ok, delete only the SAM attributes */
432
433	for (name = ldap_first_attribute(priv2ld(priv), entry, &ptr);
434	name != NULL;
435	name = ldap_next_attribute(priv2ld(priv), entry, ptr)) {
436	const char **attrib;
437
438	/* We are only allowed to delete the attributes that
439	really exist. */
440
441	for (attrib = attrs; *attrib != NULL; attrib++) {
442	if (strequal(*attrib, name)) {
443	DEBUG(10, ("ldapsam_delete_entry: deleting "
444	"attribute %s\n", name));
445	smbldap_set_mod(&mods, LDAP_MOD_DELETE, name,
446	NULL);
447	}
448	}
449	ldap_memfree(name);
450	}
451
452	if (ptr != NULL) {
453	ber_free(ptr, 0);
454	}
455
456	smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
457	talloc_autofree_ldapmod(mem_ctx, mods);
458
459	return smbldap_modify(priv->smbldap_state, dn, mods);
460	}
461
462	static time_t ldapsam_get_entry_timestamp( struct ldapsam_privates ldap_state, LDAPMessage entry)
463	{
464	char *temp;
465	struct tm tm;
466
467	temp = smbldap_talloc_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
468	get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
469	talloc_tos());
470	if (!temp) {
471	return (time_t) 0;
472	}
473
474	if ( !strptime(temp, "%Y%m%d%H%M%SZ", &tm)) {
475	DEBUG(2,("ldapsam_get_entry_timestamp: strptime failed on: %s\n",
476	(char*)temp));
477	TALLOC_FREE(temp);
478	return (time_t) 0;
479	}
480	TALLOC_FREE(temp);
481	tzset();
482	return timegm(&tm);
483	}
484
485	/**********************************************************************
486	Initialize struct samu from an LDAP query.
487	(Based on init_sam_from_buffer in pdb_tdb.c)
488	*********************************************************************/
489
490	static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
491	struct samu * sampass,
492	LDAPMessage * entry)
493	{
494	time_t logon_time,
495	logoff_time,
496	kickoff_time,
497	pass_last_set_time,
498	pass_can_change_time,
499	pass_must_change_time,
500	ldap_entry_time,
501	bad_password_time;
502	char *username = NULL,
503	*domain = NULL,
504	*nt_username = NULL,
505	*fullname = NULL,
506	*homedir = NULL,
507	*dir_drive = NULL,
508	*logon_script = NULL,
509	*profile_path = NULL,
510	*acct_desc = NULL,
511	*workstations = NULL,
512	*munged_dial = NULL;
513	uint32_t user_rid;
514	uint8 smblmpwd[LM_HASH_LEN],
515	smbntpwd[NT_HASH_LEN];
516	bool use_samba_attrs = True;
517	uint32_t acct_ctrl = 0;
518	uint16_t logon_divs;
519	uint16_t bad_password_count = 0,
520	logon_count = 0;
521	uint32_t hours_len;
522	uint8 hours[MAX_HOURS_LEN];
523	char *temp = NULL;
524	struct login_cache cache_entry;
525	uint32_t pwHistLen;
526	bool expand_explicit = lp_passdb_expand_explicit();
527	bool ret = false;
528	TALLOC_CTX *ctx = talloc_init("init_sam_from_ldap");
529
530	if (!ctx) {
531	return false;
532	}
533	if (sampass == NULL \|\| ldap_state == NULL \|\| entry == NULL) {
534	DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
535	goto fn_exit;
536	}
537
538	if (priv2ld(ldap_state) == NULL) {
539	DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->"
540	"ldap_struct is NULL!\n"));
541	goto fn_exit;
542	}
543
544	if (!(username = smbldap_talloc_first_attribute(priv2ld(ldap_state),
545	entry,
546	"uid",
547	ctx))) {
548	DEBUG(1, ("init_sam_from_ldap: No uid attribute found for "
549	"this user!\n"));
550	goto fn_exit;
551	}
552
553	DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
554
555	nt_username = talloc_strdup(ctx, username);
556	if (!nt_username) {
557	goto fn_exit;
558	}
559
560	domain = talloc_strdup(ctx, ldap_state->domain_name);
561	if (!domain) {
562	goto fn_exit;
563	}
564
565	pdb_set_username(sampass, username, PDB_SET);
566
567	pdb_set_domain(sampass, domain, PDB_DEFAULT);
568	pdb_set_nt_username(sampass, nt_username, PDB_SET);
569
570	/* deal with different attributes between the schema first */
571
572	if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
573	if ((temp = smbldap_talloc_single_attribute(
574	ldap_state->smbldap_state->ldap_struct,
575	entry,
576	get_userattr_key2string(ldap_state->schema_ver,
577	LDAP_ATTR_USER_SID),
578	ctx))!=NULL) {
579	pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
580	}
581	} else {
582	if ((temp = smbldap_talloc_single_attribute(
583	ldap_state->smbldap_state->ldap_struct,
584	entry,
585	get_userattr_key2string(ldap_state->schema_ver,
586	LDAP_ATTR_USER_RID),
587	ctx))!=NULL) {
588	user_rid = (uint32_t)atol(temp);
589	pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
590	}
591	}
592
593	if (IS_SAM_DEFAULT(sampass, PDB_USERSID)) {
594	DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
595	get_userattr_key2string(ldap_state->schema_ver,
596	LDAP_ATTR_USER_SID),
597	get_userattr_key2string(ldap_state->schema_ver,
598	LDAP_ATTR_USER_RID),
599	username));
600	return False;
601	}
602
603	temp = smbldap_talloc_single_attribute(
604	ldap_state->smbldap_state->ldap_struct,
605	entry,
606	get_userattr_key2string(ldap_state->schema_ver,
607	LDAP_ATTR_PWD_LAST_SET),
608	ctx);
609	if (temp) {
610	pass_last_set_time = (time_t) atol(temp);
611	pdb_set_pass_last_set_time(sampass,
612	pass_last_set_time, PDB_SET);
613	}
614
615	temp = smbldap_talloc_single_attribute(
616	ldap_state->smbldap_state->ldap_struct,
617	entry,
618	get_userattr_key2string(ldap_state->schema_ver,
619	LDAP_ATTR_LOGON_TIME),
620	ctx);
621	if (temp) {
622	logon_time = (time_t) atol(temp);
623	pdb_set_logon_time(sampass, logon_time, PDB_SET);
624	}
625
626	temp = smbldap_talloc_single_attribute(
627	ldap_state->smbldap_state->ldap_struct,
628	entry,
629	get_userattr_key2string(ldap_state->schema_ver,
630	LDAP_ATTR_LOGOFF_TIME),
631	ctx);
632	if (temp) {
633	logoff_time = (time_t) atol(temp);
634	pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
635	}
636
637	temp = smbldap_talloc_single_attribute(
638	ldap_state->smbldap_state->ldap_struct,
639	entry,
640	get_userattr_key2string(ldap_state->schema_ver,
641	LDAP_ATTR_KICKOFF_TIME),
642	ctx);
643	if (temp) {
644	kickoff_time = (time_t) atol(temp);
645	pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
646	}
647
648	temp = smbldap_talloc_single_attribute(
649	ldap_state->smbldap_state->ldap_struct,
650	entry,
651	get_userattr_key2string(ldap_state->schema_ver,
652	LDAP_ATTR_PWD_CAN_CHANGE),
653	ctx);
654	if (temp) {
655	pass_can_change_time = (time_t) atol(temp);
656	pdb_set_pass_can_change_time(sampass,
657	pass_can_change_time, PDB_SET);
658	}
659
660	temp = smbldap_talloc_single_attribute(
661	ldap_state->smbldap_state->ldap_struct,
662	entry,
663	get_userattr_key2string(ldap_state->schema_ver,
664	LDAP_ATTR_PWD_MUST_CHANGE),
665	ctx);
666	if (temp) {
667	pass_must_change_time = (time_t) atol(temp);
668	pdb_set_pass_must_change_time(sampass,
669	pass_must_change_time, PDB_SET);
670	}
671
672	/* recommend that 'gecos' and 'displayName' should refer to the same
673	* attribute OID. userFullName depreciated, only used by Samba
674	* primary rules of LDAP: don't make a new attribute when one is already defined
675	* that fits your needs; using cn then displayName rather than 'userFullName'
676	*/
677
678	fullname = smbldap_talloc_single_attribute(
679	ldap_state->smbldap_state->ldap_struct,
680	entry,
681	get_userattr_key2string(ldap_state->schema_ver,
682	LDAP_ATTR_DISPLAY_NAME),
683	ctx);
684	if (fullname) {
685	pdb_set_fullname(sampass, fullname, PDB_SET);
686	} else {
687	fullname = smbldap_talloc_single_attribute(
688	ldap_state->smbldap_state->ldap_struct,
689	entry,
690	get_userattr_key2string(ldap_state->schema_ver,
691	LDAP_ATTR_CN),
692	ctx);
693	if (fullname) {
694	pdb_set_fullname(sampass, fullname, PDB_SET);
695	}
696	}
697
698	dir_drive = smbldap_talloc_single_attribute(
699	ldap_state->smbldap_state->ldap_struct,
700	entry,
701	get_userattr_key2string(ldap_state->schema_ver,
702	LDAP_ATTR_HOME_DRIVE),
703	ctx);
704	if (dir_drive) {
705	pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
706	} else {
707	pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
708	}
709
710	homedir = smbldap_talloc_single_attribute(
711	ldap_state->smbldap_state->ldap_struct,
712	entry,
713	get_userattr_key2string(ldap_state->schema_ver,
714	LDAP_ATTR_HOME_PATH),
715	ctx);
716	if (homedir) {
717	if (expand_explicit) {
718	homedir = talloc_sub_basic(ctx,
719	username,
720	domain,
721	homedir);
722	if (!homedir) {
723	goto fn_exit;
724	}
725	}
726	pdb_set_homedir(sampass, homedir, PDB_SET);
727	} else {
728	pdb_set_homedir(sampass,
729	talloc_sub_basic(ctx, username, domain,
730	lp_logon_home()),
731	PDB_DEFAULT);
732	}
733
734	logon_script = smbldap_talloc_single_attribute(
735	ldap_state->smbldap_state->ldap_struct,
736	entry,
737	get_userattr_key2string(ldap_state->schema_ver,
738	LDAP_ATTR_LOGON_SCRIPT),
739	ctx);
740	if (logon_script) {
741	if (expand_explicit) {
742	logon_script = talloc_sub_basic(ctx,
743	username,
744	domain,
745	logon_script);
746	if (!logon_script) {
747	goto fn_exit;
748	}
749	}
750	pdb_set_logon_script(sampass, logon_script, PDB_SET);
751	} else {
752	pdb_set_logon_script(sampass,
753	talloc_sub_basic(ctx, username, domain,
754	lp_logon_script()),
755	PDB_DEFAULT );
756	}
757
758	profile_path = smbldap_talloc_single_attribute(
759	ldap_state->smbldap_state->ldap_struct,
760	entry,
761	get_userattr_key2string(ldap_state->schema_ver,
762	LDAP_ATTR_PROFILE_PATH),
763	ctx);
764	if (profile_path) {
765	if (expand_explicit) {
766	profile_path = talloc_sub_basic(ctx,
767	username,
768	domain,
769	profile_path);
770	if (!profile_path) {
771	goto fn_exit;
772	}
773	}
774	pdb_set_profile_path(sampass, profile_path, PDB_SET);
775	} else {
776	pdb_set_profile_path(sampass,
777	talloc_sub_basic(ctx, username, domain,
778	lp_logon_path()),
779	PDB_DEFAULT );
780	}
781
782	acct_desc = smbldap_talloc_single_attribute(
783	ldap_state->smbldap_state->ldap_struct,
784	entry,
785	get_userattr_key2string(ldap_state->schema_ver,
786	LDAP_ATTR_DESC),
787	ctx);
788	if (acct_desc) {
789	pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
790	}
791
792	workstations = smbldap_talloc_single_attribute(
793	ldap_state->smbldap_state->ldap_struct,
794	entry,
795	get_userattr_key2string(ldap_state->schema_ver,
796	LDAP_ATTR_USER_WKS),
797	ctx);
798	if (workstations) {
799	pdb_set_workstations(sampass, workstations, PDB_SET);
800	}
801
802	munged_dial = smbldap_talloc_single_attribute(
803	ldap_state->smbldap_state->ldap_struct,
804	entry,
805	get_userattr_key2string(ldap_state->schema_ver,
806	LDAP_ATTR_MUNGED_DIAL),
807	ctx);
808	if (munged_dial) {
809	pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
810	}
811
812	/* FIXME: hours stuff should be cleaner */
813
814	logon_divs = 168;
815	hours_len = 21;
816	memset(hours, 0xff, hours_len);
817
818	if (ldap_state->is_nds_ldap) {
819	char *user_dn;
820	size_t pwd_len;
821	char clear_text_pw[512];
822
823	/* Make call to Novell eDirectory ldap extension to get clear text password.
824	NOTE: This will only work if we have an SSL connection to eDirectory. */
825	user_dn = smbldap_talloc_dn(ctx, ldap_state->smbldap_state->ldap_struct, entry);
826	if (user_dn != NULL) {
827	DEBUG(3, ("init_sam_from_ldap: smbldap_talloc_dn(ctx, %s) returned '%s'\n", username, user_dn));
828
829	pwd_len = sizeof(clear_text_pw);
830	if (pdb_nds_get_password(ldap_state->smbldap_state, user_dn, &pwd_len, clear_text_pw) == LDAP_SUCCESS) {
831	nt_lm_owf_gen(clear_text_pw, smbntpwd, smblmpwd);
832	if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET)) {
833	TALLOC_FREE(user_dn);
834	return False;
835	}
836	ZERO_STRUCT(smblmpwd);
837	if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET)) {
838	TALLOC_FREE(user_dn);
839	return False;
840	}
841	ZERO_STRUCT(smbntpwd);
842	use_samba_attrs = False;
843	}
844
845	TALLOC_FREE(user_dn);
846
847	} else {
848	DEBUG(0, ("init_sam_from_ldap: failed to get user_dn for '%s'\n", username));
849	}
850	}
851
852	if (use_samba_attrs) {
853	temp = smbldap_talloc_single_attribute(
854	ldap_state->smbldap_state->ldap_struct,
855	entry,
856	get_userattr_key2string(ldap_state->schema_ver,
857	LDAP_ATTR_LMPW),
858	ctx);
859	if (temp) {
860	pdb_gethexpwd(temp, smblmpwd);
861	memset((char *)temp, '\0', strlen(temp)+1);
862	if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET)) {
863	goto fn_exit;
864	}
865	ZERO_STRUCT(smblmpwd);
866	}
867
868	temp = smbldap_talloc_single_attribute(
869	ldap_state->smbldap_state->ldap_struct,
870	entry,
871	get_userattr_key2string(ldap_state->schema_ver,
872	LDAP_ATTR_NTPW),
873	ctx);
874	if (temp) {
875	pdb_gethexpwd(temp, smbntpwd);
876	memset((char *)temp, '\0', strlen(temp)+1);
877	if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET)) {
878	goto fn_exit;
879	}
880	ZERO_STRUCT(smbntpwd);
881	}
882	}
883
884	pwHistLen = 0;
885
886	pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
887	if (pwHistLen > 0){
888	uint8 *pwhist = NULL;
889	int i;
890	char *history_string = TALLOC_ARRAY(ctx, char,
891	MAX_PW_HISTORY_LEN*64);
892
893	if (!history_string) {
894	goto fn_exit;
895	}
896
897	pwHistLen = MIN(pwHistLen, MAX_PW_HISTORY_LEN);
898
899	pwhist = TALLOC_ARRAY(ctx, uint8,
900	pwHistLen * PW_HISTORY_ENTRY_LEN);
901	if (pwhist == NULL) {
902	DEBUG(0, ("init_sam_from_ldap: talloc failed!\n"));
903	goto fn_exit;
904	}
905	memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
906
907	if (smbldap_get_single_attribute(
908	ldap_state->smbldap_state->ldap_struct,
909	entry,
910	get_userattr_key2string(ldap_state->schema_ver,
911	LDAP_ATTR_PWD_HISTORY),
912	history_string,
913	MAX_PW_HISTORY_LEN*64)) {
914	bool hex_failed = false;
915	for (i = 0; i < pwHistLen; i++){
916	/* Get the 16 byte salt. */
917	if (!pdb_gethexpwd(&history_string[i*64],
918	&pwhist[i*PW_HISTORY_ENTRY_LEN])) {
919	hex_failed = true;
920	break;
921	}
922	/* Get the 16 byte MD5 hash of salt+passwd. */
923	if (!pdb_gethexpwd(&history_string[(i*64)+32],
924	&pwhist[(i*PW_HISTORY_ENTRY_LEN)+
925	PW_HISTORY_SALT_LEN])) {
926	hex_failed = True;
927	break;
928	}
929	}
930	if (hex_failed) {
931	DEBUG(2,("init_sam_from_ldap: Failed to get password history for user %s\n",
932	username));
933	memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
934	}
935	}
936	if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
937	goto fn_exit;
938	}
939	}
940
941	temp = smbldap_talloc_single_attribute(
942	ldap_state->smbldap_state->ldap_struct,
943	entry,
944	get_userattr_key2string(ldap_state->schema_ver,
945	LDAP_ATTR_ACB_INFO),
946	ctx);
947	if (temp) {
948	acct_ctrl = pdb_decode_acct_ctrl(temp);
949
950	if (acct_ctrl == 0) {
951	acct_ctrl \|= ACB_NORMAL;
952	}
953
954	pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
955	} else {
956	acct_ctrl \|= ACB_NORMAL;
957	}
958
959	pdb_set_hours_len(sampass, hours_len, PDB_SET);
960	pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
961
962	temp = smbldap_talloc_single_attribute(
963	ldap_state->smbldap_state->ldap_struct,
964	entry,
965	get_userattr_key2string(ldap_state->schema_ver,
966	LDAP_ATTR_BAD_PASSWORD_COUNT),
967	ctx);
968	if (temp) {
969	bad_password_count = (uint32_t) atol(temp);
970	pdb_set_bad_password_count(sampass,
971	bad_password_count, PDB_SET);
972	}
973
974	temp = smbldap_talloc_single_attribute(
975	ldap_state->smbldap_state->ldap_struct,
976	entry,
977	get_userattr_key2string(ldap_state->schema_ver,
978	LDAP_ATTR_BAD_PASSWORD_TIME),
979	ctx);
980	if (temp) {
981	bad_password_time = (time_t) atol(temp);
982	pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
983	}
984
985
986	temp = smbldap_talloc_single_attribute(
987	ldap_state->smbldap_state->ldap_struct,
988	entry,
989	get_userattr_key2string(ldap_state->schema_ver,
990	LDAP_ATTR_LOGON_COUNT),
991	ctx);
992	if (temp) {
993	logon_count = (uint32_t) atol(temp);
994	pdb_set_logon_count(sampass, logon_count, PDB_SET);
995	}
996
997	/* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
998
999	temp = smbldap_talloc_single_attribute(
1000	ldap_state->smbldap_state->ldap_struct,
1001	entry,
1002	get_userattr_key2string(ldap_state->schema_ver,
1003	LDAP_ATTR_LOGON_HOURS),
1004	ctx);
1005	if (temp) {
1006	pdb_gethexhours(temp, hours);
1007	memset((char *)temp, '\0', strlen(temp) +1);
1008	pdb_set_hours(sampass, hours, hours_len, PDB_SET);
1009	ZERO_STRUCT(hours);
1010	}
1011
1012	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
1013	struct passwd unix_pw;
1014	bool have_uid = false;
1015	bool have_gid = false;
1016	struct dom_sid mapped_gsid;
1017	const struct dom_sid *primary_gsid;
1018
1019	ZERO_STRUCT(unix_pw);
1020
1021	unix_pw.pw_name = username;
1022	unix_pw.pw_passwd = discard_const_p(char, "x");
1023
1024	temp = smbldap_talloc_single_attribute(
1025	priv2ld(ldap_state),
1026	entry,
1027	"uidNumber",
1028	ctx);
1029	if (temp) {
1030	/* We've got a uid, feed the cache */
1031	unix_pw.pw_uid = strtoul(temp, NULL, 10);
1032	have_uid = true;
1033	}
1034	temp = smbldap_talloc_single_attribute(
1035	priv2ld(ldap_state),
1036	entry,
1037	"gidNumber",
1038	ctx);
1039	if (temp) {
1040	/* We've got a uid, feed the cache */
1041	unix_pw.pw_gid = strtoul(temp, NULL, 10);
1042	have_gid = true;
1043	}
1044	unix_pw.pw_gecos = smbldap_talloc_single_attribute(
1045	priv2ld(ldap_state),
1046	entry,
1047	"gecos",
1048	ctx);
1049	if (unix_pw.pw_gecos) {
1050	unix_pw.pw_gecos = fullname;
1051	}
1052	unix_pw.pw_dir = smbldap_talloc_single_attribute(
1053	priv2ld(ldap_state),
1054	entry,
1055	"homeDirectory",
1056	ctx);
1057	if (unix_pw.pw_dir) {
1058	unix_pw.pw_dir = discard_const_p(char, "");
1059	}
1060	unix_pw.pw_shell = smbldap_talloc_single_attribute(
1061	priv2ld(ldap_state),
1062	entry,
1063	"loginShell",
1064	ctx);
1065	if (unix_pw.pw_shell) {
1066	unix_pw.pw_shell = discard_const_p(char, "");
1067	}
1068
1069	if (have_uid && have_gid) {
1070	sampass->unix_pw = tcopy_passwd(sampass, &unix_pw);
1071	} else {
1072	sampass->unix_pw = Get_Pwnam_alloc(sampass, unix_pw.pw_name);
1073	}
1074
1075	if (sampass->unix_pw == NULL) {
1076	DEBUG(0,("init_sam_from_ldap: Failed to find Unix account for %s\n",
1077	pdb_get_username(sampass)));
1078	goto fn_exit;
1079	}
1080
1081	store_uid_sid_cache(pdb_get_user_sid(sampass),
1082	sampass->unix_pw->pw_uid);
1083	idmap_cache_set_sid2uid(pdb_get_user_sid(sampass),
1084	sampass->unix_pw->pw_uid);
1085
1086	gid_to_sid(&mapped_gsid, sampass->unix_pw->pw_gid);
1087	primary_gsid = pdb_get_group_sid(sampass);
1088	if (primary_gsid && dom_sid_equal(primary_gsid, &mapped_gsid)) {
1089	store_gid_sid_cache(primary_gsid,
1090	sampass->unix_pw->pw_gid);
1091	idmap_cache_set_sid2gid(primary_gsid,
1092	sampass->unix_pw->pw_gid);
1093	}
1094	}
1095
1096	/* check the timestamp of the cache vs ldap entry */
1097	if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
1098	entry))) {
1099	ret = true;
1100	goto fn_exit;
1101	}
1102
1103	/* see if we have newer updates */
1104	if (!login_cache_read(sampass, &cache_entry)) {
1105	DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
1106	(unsigned int)pdb_get_bad_password_count(sampass),
1107	(unsigned int)pdb_get_bad_password_time(sampass)));
1108	ret = true;
1109	goto fn_exit;
1110	}
1111
1112	DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
1113	(unsigned int)ldap_entry_time,
1114	(unsigned int)cache_entry.entry_timestamp,
1115	(unsigned int)cache_entry.bad_password_time));
1116
1117	if (ldap_entry_time > cache_entry.entry_timestamp) {
1118	/* cache is older than directory , so
1119	we need to delete the entry but allow the
1120	fields to be written out */
1121	login_cache_delentry(sampass);
1122	} else {
1123	/* read cache in */
1124	pdb_set_acct_ctrl(sampass,
1125	pdb_get_acct_ctrl(sampass) \|
1126	(cache_entry.acct_ctrl & ACB_AUTOLOCK),
1127	PDB_SET);
1128	pdb_set_bad_password_count(sampass,
1129	cache_entry.bad_password_count,
1130	PDB_SET);
1131	pdb_set_bad_password_time(sampass,
1132	cache_entry.bad_password_time,
1133	PDB_SET);
1134	}
1135
1136	ret = true;
1137
1138	fn_exit:
1139
1140	TALLOC_FREE(ctx);
1141	return ret;
1142	}
1143
1144	/**********************************************************************
1145	Initialize the ldap db from a struct samu. Called on update.
1146	(Based on init_buffer_from_sam in pdb_tdb.c)
1147	*********************************************************************/
1148
1149	static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
1150	LDAPMessage *existing,
1151	LDAPMod *** mods, struct samu * sampass,
1152	bool (need_update)(const struct samu ,
1153	enum pdb_elements))
1154	{
1155	char *temp = NULL;
1156	uint32_t rid;
1157
1158	if (mods == NULL \|\| sampass == NULL) {
1159	DEBUG(0, ("init_ldap_from_sam: NULL parameters found!\n"));
1160	return False;
1161	}
1162
1163	*mods = NULL;
1164
1165	/*
1166	* took out adding "objectclass: sambaAccount"
1167	* do this on a per-mod basis
1168	*/
1169	if (need_update(sampass, PDB_USERNAME)) {
1170	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1171	"uid", pdb_get_username(sampass));
1172	if (ldap_state->is_nds_ldap) {
1173	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1174	"cn", pdb_get_username(sampass));
1175	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1176	"sn", pdb_get_username(sampass));
1177	}
1178	}
1179
1180	DEBUG(2, ("init_ldap_from_sam: Setting entry for user: %s\n", pdb_get_username(sampass)));
1181
1182	/* only update the RID if we actually need to */
1183	if (need_update(sampass, PDB_USERSID)) {
1184	fstring sid_string;
1185	const struct dom_sid *user_sid = pdb_get_user_sid(sampass);
1186
1187	switch ( ldap_state->schema_ver ) {
1188	case SCHEMAVER_SAMBAACCOUNT:
1189	if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
1190	DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
1191	sid_string_dbg(user_sid),
1192	sid_string_dbg(
1193	&ldap_state->domain_sid)));
1194	return False;
1195	}
1196	if (asprintf(&temp, "%i", rid) < 0) {
1197	return false;
1198	}
1199	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1200	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
1201	temp);
1202	SAFE_FREE(temp);
1203	break;
1204
1205	case SCHEMAVER_SAMBASAMACCOUNT:
1206	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1207	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
1208	sid_to_fstring(sid_string, user_sid));
1209	break;
1210
1211	default:
1212	DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
1213	break;
1214	}
1215	}
1216
1217	/* we don't need to store the primary group RID - so leaving it
1218	'free' to hang off the unix primary group makes life easier */
1219
1220	if (need_update(sampass, PDB_GROUPSID)) {
1221	fstring sid_string;
1222	const struct dom_sid *group_sid = pdb_get_group_sid(sampass);
1223
1224	switch ( ldap_state->schema_ver ) {
1225	case SCHEMAVER_SAMBAACCOUNT:
1226	if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
1227	DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
1228	sid_string_dbg(group_sid),
1229	sid_string_dbg(
1230	&ldap_state->domain_sid)));
1231	return False;
1232	}
1233
1234	if (asprintf(&temp, "%i", rid) < 0) {
1235	return false;
1236	}
1237	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1238	get_userattr_key2string(ldap_state->schema_ver,
1239	LDAP_ATTR_PRIMARY_GROUP_RID), temp);
1240	SAFE_FREE(temp);
1241	break;
1242
1243	case SCHEMAVER_SAMBASAMACCOUNT:
1244	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1245	get_userattr_key2string(ldap_state->schema_ver,
1246	LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_fstring(sid_string, group_sid));
1247	break;
1248
1249	default:
1250	DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
1251	break;
1252	}
1253
1254	}
1255
1256	/* displayName, cn, and gecos should all be the same
1257	* most easily accomplished by giving them the same OID
1258	* gecos isn't set here b/c it should be handled by the
1259	* add-user script
1260	* We change displayName only and fall back to cn if
1261	* it does not exist.
1262	*/
1263
1264	if (need_update(sampass, PDB_FULLNAME))
1265	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1266	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME),
1267	pdb_get_fullname(sampass));
1268
1269	if (need_update(sampass, PDB_ACCTDESC))
1270	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1271	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC),
1272	pdb_get_acct_desc(sampass));
1273
1274	if (need_update(sampass, PDB_WORKSTATIONS))
1275	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1276	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
1277	pdb_get_workstations(sampass));
1278
1279	if (need_update(sampass, PDB_MUNGEDDIAL))
1280	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1281	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL),
1282	pdb_get_munged_dial(sampass));
1283
1284	if (need_update(sampass, PDB_SMBHOME))
1285	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1286	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
1287	pdb_get_homedir(sampass));
1288
1289	if (need_update(sampass, PDB_DRIVE))
1290	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1291	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
1292	pdb_get_dir_drive(sampass));
1293
1294	if (need_update(sampass, PDB_LOGONSCRIPT))
1295	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1296	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT),
1297	pdb_get_logon_script(sampass));
1298
1299	if (need_update(sampass, PDB_PROFILE))
1300	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1301	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
1302	pdb_get_profile_path(sampass));
1303
1304	if (asprintf(&temp, "%li", (long int)pdb_get_logon_time(sampass)) < 0) {
1305	return false;
1306	}
1307	if (need_update(sampass, PDB_LOGONTIME))
1308	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1309	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
1310	SAFE_FREE(temp);
1311
1312	if (asprintf(&temp, "%li", (long int)pdb_get_logoff_time(sampass)) < 0) {
1313	return false;
1314	}
1315	if (need_update(sampass, PDB_LOGOFFTIME))
1316	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1317	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
1318	SAFE_FREE(temp);
1319
1320	if (asprintf(&temp, "%li", (long int)pdb_get_kickoff_time(sampass)) < 0) {
1321	return false;
1322	}
1323	if (need_update(sampass, PDB_KICKOFFTIME))
1324	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1325	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
1326	SAFE_FREE(temp);
1327
1328	if (asprintf(&temp, "%li", (long int)pdb_get_pass_can_change_time_noncalc(sampass)) < 0) {
1329	return false;
1330	}
1331	if (need_update(sampass, PDB_CANCHANGETIME))
1332	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1333	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
1334	SAFE_FREE(temp);
1335
1336	if (asprintf(&temp, "%li", (long int)pdb_get_pass_must_change_time(sampass)) < 0) {
1337	return false;
1338	}
1339	if (need_update(sampass, PDB_MUSTCHANGETIME))
1340	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1341	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
1342	SAFE_FREE(temp);
1343
1344	if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST))
1345	\|\| (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
1346
1347	if (need_update(sampass, PDB_LMPASSWD)) {
1348	const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
1349	if (lm_pw) {
1350	char pwstr[34];
1351	pdb_sethexpwd(pwstr, lm_pw,
1352	pdb_get_acct_ctrl(sampass));
1353	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1354	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1355	pwstr);
1356	} else {
1357	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1358	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1359	NULL);
1360	}
1361	}
1362	if (need_update(sampass, PDB_NTPASSWD)) {
1363	const uchar *nt_pw = pdb_get_nt_passwd(sampass);
1364	if (nt_pw) {
1365	char pwstr[34];
1366	pdb_sethexpwd(pwstr, nt_pw,
1367	pdb_get_acct_ctrl(sampass));
1368	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1369	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1370	pwstr);
1371	} else {
1372	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1373	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1374	NULL);
1375	}
1376	}
1377
1378	if (need_update(sampass, PDB_PWHISTORY)) {
1379	char *pwstr = NULL;
1380	uint32_t pwHistLen = 0;
1381	pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
1382
1383	pwstr = SMB_MALLOC_ARRAY(char, 1024);
1384	if (!pwstr) {
1385	return false;
1386	}
1387	if (pwHistLen == 0) {
1388	/* Remove any password history from the LDAP store. */
1389	memset(pwstr, '0', 64); /* NOTE !!!! '0' NOT '\0' /
1390	pwstr[64] = '\0';
1391	} else {
1392	int i;
1393	uint32_t currHistLen = 0;
1394	const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
1395	if (pwhist != NULL) {
1396	/* We can only store (1024-1/64 password history entries. */
1397	pwHistLen = MIN(pwHistLen, ((1024-1)/64));
1398	for (i=0; i< pwHistLen && i < currHistLen; i++) {
1399	/* Store the salt. */
1400	pdb_sethexpwd(&pwstr[i64], &pwhist[iPW_HISTORY_ENTRY_LEN], 0);
1401	/* Followed by the md5 hash of salt + md4 hash */
1402	pdb_sethexpwd(&pwstr[(i*64)+32],
1403	&pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
1404	DEBUG(100, ("pwstr=%s\n", pwstr));
1405	}
1406	}
1407	}
1408	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1409	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
1410	pwstr);
1411	SAFE_FREE(pwstr);
1412	}
1413
1414	if (need_update(sampass, PDB_PASSLASTSET)) {
1415	if (asprintf(&temp, "%li",
1416	(long int)pdb_get_pass_last_set_time(sampass)) < 0) {
1417	return false;
1418	}
1419	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1420	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
1421	temp);
1422	SAFE_FREE(temp);
1423	}
1424	}
1425
1426	if (need_update(sampass, PDB_HOURS)) {
1427	const uint8 *hours = pdb_get_hours(sampass);
1428	if (hours) {
1429	char hourstr[44];
1430	pdb_sethexhours(hourstr, hours);
1431	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
1432	existing,
1433	mods,
1434	get_userattr_key2string(ldap_state->schema_ver,
1435	LDAP_ATTR_LOGON_HOURS),
1436	hourstr);
1437	}
1438	}
1439
1440	if (need_update(sampass, PDB_ACCTCTRL))
1441	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1442	get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
1443	pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
1444
1445	/* password lockout cache:
1446	- If we are now autolocking or clearing, we write to ldap
1447	- If we are clearing, we delete the cache entry
1448	- If the count is > 0, we update the cache
1449
1450	This even means when autolocking, we cache, just in case the
1451	update doesn't work, and we have to cache the autolock flag */
1452
1453	if (need_update(sampass, PDB_BAD_PASSWORD_COUNT)) /* &&
1454	need_update(sampass, PDB_BAD_PASSWORD_TIME)) */ {
1455	uint16_t badcount = pdb_get_bad_password_count(sampass);
1456	time_t badtime = pdb_get_bad_password_time(sampass);
1457	uint32_t pol;
1458	pdb_get_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT, &pol);
1459
1460	DEBUG(3, ("updating bad password fields, policy=%u, count=%u, time=%u\n",
1461	(unsigned int)pol, (unsigned int)badcount, (unsigned int)badtime));
1462
1463	if ((badcount >= pol) \|\| (badcount == 0)) {
1464	DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
1465	(unsigned int)badcount, (unsigned int)badtime));
1466	if (asprintf(&temp, "%li", (long)badcount) < 0) {
1467	return false;
1468	}
1469	smbldap_make_mod(
1470	ldap_state->smbldap_state->ldap_struct,
1471	existing, mods,
1472	get_userattr_key2string(
1473	ldap_state->schema_ver,
1474	LDAP_ATTR_BAD_PASSWORD_COUNT),
1475	temp);
1476	SAFE_FREE(temp);
1477
1478	if (asprintf(&temp, "%li", (long int)badtime) < 0) {
1479	return false;
1480	}
1481	smbldap_make_mod(
1482	ldap_state->smbldap_state->ldap_struct,
1483	existing, mods,
1484	get_userattr_key2string(
1485	ldap_state->schema_ver,
1486	LDAP_ATTR_BAD_PASSWORD_TIME),
1487	temp);
1488	SAFE_FREE(temp);
1489	}
1490	if (badcount == 0) {
1491	DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
1492	login_cache_delentry(sampass);
1493	} else {
1494	struct login_cache cache_entry;
1495
1496	cache_entry.entry_timestamp = time(NULL);
1497	cache_entry.acct_ctrl = pdb_get_acct_ctrl(sampass);
1498	cache_entry.bad_password_count = badcount;
1499	cache_entry.bad_password_time = badtime;
1500
1501	DEBUG(7, ("Updating bad password count and time in login cache\n"));
1502	login_cache_write(sampass, &cache_entry);
1503	}
1504	}
1505
1506	return True;
1507	}
1508
1509	/**********************************************************************
1510	End enumeration of the LDAP password list.
1511	*********************************************************************/
1512
1513	static void ldapsam_endsampwent(struct pdb_methods *my_methods)
1514	{
1515	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1516	if (ldap_state->result) {
1517	ldap_msgfree(ldap_state->result);
1518	ldap_state->result = NULL;
1519	}
1520	}
1521
1522	static void append_attr(TALLOC_CTX mem_ctx, const char **attr_list,
1523	const char *new_attr)
1524	{
1525	int i;
1526
1527	if (new_attr == NULL) {
1528	return;
1529	}
1530
1531	for (i=0; (*attr_list)[i] != NULL; i++) {
1532	;
1533	}
1534
1535	(attr_list) = TALLOC_REALLOC_ARRAY(mem_ctx, (attr_list),
1536	const char *, i+2);
1537	SMB_ASSERT((*attr_list) != NULL);
1538	(attr_list)[i] = talloc_strdup((attr_list), new_attr);
1539	(*attr_list)[i+1] = NULL;
1540	}
1541
1542	static void ldapsam_add_unix_attributes(TALLOC_CTX *mem_ctx,
1543	const char ***attr_list)
1544	{
1545	append_attr(mem_ctx, attr_list, "uidNumber");
1546	append_attr(mem_ctx, attr_list, "gidNumber");
1547	append_attr(mem_ctx, attr_list, "homeDirectory");
1548	append_attr(mem_ctx, attr_list, "loginShell");
1549	append_attr(mem_ctx, attr_list, "gecos");
1550	}
1551
1552	/**********************************************************************
1553	Get struct samu entry from LDAP by username.
1554	*********************************************************************/
1555
1556	static NTSTATUS ldapsam_getsampwnam(struct pdb_methods my_methods, struct samu user, const char *sname)
1557	{
1558	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1559	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1560	LDAPMessage *result = NULL;
1561	LDAPMessage *entry = NULL;
1562	int count;
1563	const char ** attr_list;
1564	int rc;
1565
1566	attr_list = get_userattr_list( user, ldap_state->schema_ver );
1567	append_attr(user, &attr_list,
1568	get_userattr_key2string(ldap_state->schema_ver,
1569	LDAP_ATTR_MOD_TIMESTAMP));
1570	ldapsam_add_unix_attributes(user, &attr_list);
1571	rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result,
1572	attr_list);
1573	TALLOC_FREE( attr_list );
1574
1575	if ( rc != LDAP_SUCCESS )
1576	return NT_STATUS_NO_SUCH_USER;
1577
1578	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1579
1580	if (count < 1) {
1581	DEBUG(4, ("ldapsam_getsampwnam: Unable to locate user [%s] count=%d\n", sname, count));
1582	ldap_msgfree(result);
1583	return NT_STATUS_NO_SUCH_USER;
1584	} else if (count > 1) {
1585	DEBUG(1, ("ldapsam_getsampwnam: Duplicate entries for this user [%s] Failing. count=%d\n", sname, count));
1586	ldap_msgfree(result);
1587	return NT_STATUS_NO_SUCH_USER;
1588	}
1589
1590	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1591	if (entry) {
1592	if (!init_sam_from_ldap(ldap_state, user, entry)) {
1593	DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname));
1594	ldap_msgfree(result);
1595	return NT_STATUS_NO_SUCH_USER;
1596	}
1597	pdb_set_backend_private_data(user, result, NULL,
1598	my_methods, PDB_CHANGED);
1599	talloc_autofree_ldapmsg(user, result);
1600	ret = NT_STATUS_OK;
1601	} else {
1602	ldap_msgfree(result);
1603	}
1604	return ret;
1605	}
1606
1607	static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state,
1608	const struct dom_sid sid, LDAPMessage *result)
1609	{
1610	int rc = -1;
1611	const char ** attr_list;
1612	uint32_t rid;
1613
1614	switch ( ldap_state->schema_ver ) {
1615	case SCHEMAVER_SAMBASAMACCOUNT: {
1616	TALLOC_CTX *tmp_ctx = talloc_new(NULL);
1617	if (tmp_ctx == NULL) {
1618	return LDAP_NO_MEMORY;
1619	}
1620
1621	attr_list = get_userattr_list(tmp_ctx,
1622	ldap_state->schema_ver);
1623	append_attr(tmp_ctx, &attr_list,
1624	get_userattr_key2string(
1625	ldap_state->schema_ver,
1626	LDAP_ATTR_MOD_TIMESTAMP));
1627	ldapsam_add_unix_attributes(tmp_ctx, &attr_list);
1628	rc = ldapsam_search_suffix_by_sid(ldap_state, sid,
1629	result, attr_list);
1630	TALLOC_FREE(tmp_ctx);
1631
1632	if ( rc != LDAP_SUCCESS )
1633	return rc;
1634	break;
1635	}
1636
1637	case SCHEMAVER_SAMBAACCOUNT:
1638	if (!sid_peek_check_rid(&ldap_state->domain_sid, sid, &rid)) {
1639	return rc;
1640	}
1641
1642	attr_list = get_userattr_list(NULL,
1643	ldap_state->schema_ver);
1644	rc = ldapsam_search_suffix_by_rid(ldap_state, rid, result, attr_list );
1645	TALLOC_FREE( attr_list );
1646
1647	if ( rc != LDAP_SUCCESS )
1648	return rc;
1649	break;
1650	}
1651	return rc;
1652	}
1653
1654	/**********************************************************************
1655	Get struct samu entry from LDAP by SID.
1656	*********************************************************************/
1657
1658	static NTSTATUS ldapsam_getsampwsid(struct pdb_methods my_methods, struct samu user, const struct dom_sid *sid)
1659	{
1660	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1661	LDAPMessage *result = NULL;
1662	LDAPMessage *entry = NULL;
1663	int count;
1664	int rc;
1665
1666	rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1667	sid, &result);
1668	if (rc != LDAP_SUCCESS)
1669	return NT_STATUS_NO_SUCH_USER;
1670
1671	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1672
1673	if (count < 1) {
1674	DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] "
1675	"count=%d\n", sid_string_dbg(sid), count));
1676	ldap_msgfree(result);
1677	return NT_STATUS_NO_SUCH_USER;
1678	} else if (count > 1) {
1679	DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID "
1680	"[%s]. Failing. count=%d\n", sid_string_dbg(sid),
1681	count));
1682	ldap_msgfree(result);
1683	return NT_STATUS_NO_SUCH_USER;
1684	}
1685
1686	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1687	if (!entry) {
1688	ldap_msgfree(result);
1689	return NT_STATUS_NO_SUCH_USER;
1690	}
1691
1692	if (!init_sam_from_ldap(ldap_state, user, entry)) {
1693	DEBUG(1,("ldapsam_getsampwsid: init_sam_from_ldap failed!\n"));
1694	ldap_msgfree(result);
1695	return NT_STATUS_NO_SUCH_USER;
1696	}
1697
1698	pdb_set_backend_private_data(user, result, NULL,
1699	my_methods, PDB_CHANGED);
1700	talloc_autofree_ldapmsg(user, result);
1701	return NT_STATUS_OK;
1702	}
1703
1704	/********************************************************************
1705	Do the actual modification - also change a plaintext passord if
1706	it it set.
1707	**********************************************************************/
1708
1709	static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods,
1710	struct samu newpwd, char dn,
1711	LDAPMod **mods, int ldap_op,
1712	bool (need_update)(const struct samu , enum pdb_elements))
1713	{
1714	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1715	int rc;
1716
1717	if (!newpwd \|\| !dn) {
1718	return NT_STATUS_INVALID_PARAMETER;
1719	}
1720
1721	if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST)) &&
1722	(lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) &&
1723	need_update(newpwd, PDB_PLAINTEXT_PW) &&
1724	(pdb_get_plaintext_passwd(newpwd)!=NULL)) {
1725	BerElement *ber;
1726	struct berval *bv;
1727	char *retoid = NULL;
1728	struct berval *retdata = NULL;
1729	char *utf8_password;
1730	char *utf8_dn;
1731	size_t converted_size;
1732	int ret;
1733
1734	if (!ldap_state->is_nds_ldap) {
1735
1736	if (!smbldap_has_extension(ldap_state->smbldap_state->ldap_struct,
1737	LDAP_EXOP_MODIFY_PASSWD)) {
1738	DEBUG(2, ("ldap password change requested, but LDAP "
1739	"server does not support it -- ignoring\n"));
1740	return NT_STATUS_OK;
1741	}
1742	}
1743
1744	if (!push_utf8_talloc(talloc_tos(), &utf8_password,
1745	pdb_get_plaintext_passwd(newpwd),
1746	&converted_size))
1747	{
1748	return NT_STATUS_NO_MEMORY;
1749	}
1750
1751	if (!push_utf8_talloc(talloc_tos(), &utf8_dn, dn, &converted_size)) {
1752	TALLOC_FREE(utf8_password);
1753	return NT_STATUS_NO_MEMORY;
1754	}
1755
1756	if ((ber = ber_alloc_t(LBER_USE_DER))==NULL) {
1757	DEBUG(0,("ber_alloc_t returns NULL\n"));
1758	TALLOC_FREE(utf8_password);
1759	TALLOC_FREE(utf8_dn);
1760	return NT_STATUS_UNSUCCESSFUL;
1761	}
1762
1763	if ((ber_printf (ber, "{") < 0) \|\|
1764	(ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID,
1765	utf8_dn) < 0)) {
1766	DEBUG(0,("ldapsam_modify_entry: ber_printf returns a "
1767	"value <0\n"));
1768	ber_free(ber,1);
1769	TALLOC_FREE(utf8_dn);
1770	TALLOC_FREE(utf8_password);
1771	return NT_STATUS_UNSUCCESSFUL;
1772	}
1773
1774	if ((utf8_password != NULL) && (*utf8_password != '\0')) {
1775	ret = ber_printf(ber, "ts}",
1776	LDAP_TAG_EXOP_MODIFY_PASSWD_NEW,
1777	utf8_password);
1778	} else {
1779	ret = ber_printf(ber, "}");
1780	}
1781
1782	if (ret < 0) {
1783	DEBUG(0,("ldapsam_modify_entry: ber_printf returns a "
1784	"value <0\n"));
1785	ber_free(ber,1);
1786	TALLOC_FREE(utf8_dn);
1787	TALLOC_FREE(utf8_password);
1788	return NT_STATUS_UNSUCCESSFUL;
1789	}
1790
1791	if ((rc = ber_flatten (ber, &bv))<0) {
1792	DEBUG(0,("ldapsam_modify_entry: ber_flatten returns a value <0\n"));
1793	ber_free(ber,1);
1794	TALLOC_FREE(utf8_dn);
1795	TALLOC_FREE(utf8_password);
1796	return NT_STATUS_UNSUCCESSFUL;
1797	}
1798
1799	TALLOC_FREE(utf8_dn);
1800	TALLOC_FREE(utf8_password);
1801	ber_free(ber, 1);
1802
1803	if (!ldap_state->is_nds_ldap) {
1804	rc = smbldap_extended_operation(ldap_state->smbldap_state,
1805	LDAP_EXOP_MODIFY_PASSWD,
1806	bv, NULL, NULL, &retoid,
1807	&retdata);
1808	} else {
1809	rc = pdb_nds_set_password(ldap_state->smbldap_state, dn,
1810	pdb_get_plaintext_passwd(newpwd));
1811	}
1812	if (rc != LDAP_SUCCESS) {
1813	char *ld_error = NULL;
1814
1815	if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
1816	DEBUG(3, ("Could not set userPassword "
1817	"attribute due to an objectClass "
1818	"violation -- ignoring\n"));
1819	ber_bvfree(bv);
1820	return NT_STATUS_OK;
1821	}
1822
1823	ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1824	&ld_error);
1825	DEBUG(0,("ldapsam_modify_entry: LDAP Password could not be changed for user %s: %s\n\t%s\n",
1826	pdb_get_username(newpwd), ldap_err2string(rc), ld_error?ld_error:"unknown"));
1827	SAFE_FREE(ld_error);
1828	ber_bvfree(bv);
1829	#if defined(LDAP_CONSTRAINT_VIOLATION)
1830	if (rc == LDAP_CONSTRAINT_VIOLATION)
1831	return NT_STATUS_PASSWORD_RESTRICTION;
1832	#endif
1833	return NT_STATUS_UNSUCCESSFUL;
1834	} else {
1835	DEBUG(3,("ldapsam_modify_entry: LDAP Password changed for user %s\n",pdb_get_username(newpwd)));
1836	#ifdef DEBUG_PASSWORD
1837	DEBUG(100,("ldapsam_modify_entry: LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd)));
1838	#endif
1839	if (retdata)
1840	ber_bvfree(retdata);
1841	if (retoid)
1842	ldap_memfree(retoid);
1843	}
1844	ber_bvfree(bv);
1845	}
1846
1847	if (!mods) {
1848	DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
1849	/* may be password change below however */
1850	} else {
1851	switch(ldap_op) {
1852	case LDAP_MOD_ADD:
1853	if (ldap_state->is_nds_ldap) {
1854	smbldap_set_mod(&mods, LDAP_MOD_ADD,
1855	"objectclass",
1856	"inetOrgPerson");
1857	} else {
1858	smbldap_set_mod(&mods, LDAP_MOD_ADD,
1859	"objectclass",
1860	LDAP_OBJ_ACCOUNT);
1861	}
1862	rc = smbldap_add(ldap_state->smbldap_state,
1863	dn, mods);
1864	break;
1865	case LDAP_MOD_REPLACE:
1866	rc = smbldap_modify(ldap_state->smbldap_state,
1867	dn ,mods);
1868	break;
1869	default:
1870	DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n",
1871	ldap_op));
1872	return NT_STATUS_INVALID_PARAMETER;
1873	}
1874
1875	if (rc!=LDAP_SUCCESS) {
1876	return NT_STATUS_UNSUCCESSFUL;
1877	}
1878	}
1879
1880	return NT_STATUS_OK;
1881	}
1882
1883	/**********************************************************************
1884	Delete entry from LDAP for username.
1885	*********************************************************************/
1886
1887	static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods,
1888	struct samu * sam_acct)
1889	{
1890	struct ldapsam_privates *priv =
1891	(struct ldapsam_privates *)my_methods->private_data;
1892	const char *sname;
1893	int rc;
1894	LDAPMessage msg, entry;
1895	NTSTATUS result = NT_STATUS_NO_MEMORY;
1896	const char **attr_list;
1897	TALLOC_CTX *mem_ctx;
1898
1899	if (!sam_acct) {
1900	DEBUG(0, ("ldapsam_delete_sam_account: sam_acct was NULL!\n"));
1901	return NT_STATUS_INVALID_PARAMETER;
1902	}
1903
1904	sname = pdb_get_username(sam_acct);
1905
1906	DEBUG(3, ("ldapsam_delete_sam_account: Deleting user %s from "
1907	"LDAP.\n", sname));
1908
1909	mem_ctx = talloc_new(NULL);
1910	if (mem_ctx == NULL) {
1911	DEBUG(0, ("talloc_new failed\n"));
1912	goto done;
1913	}
1914
1915	attr_list = get_userattr_delete_list(mem_ctx, priv->schema_ver );
1916	if (attr_list == NULL) {
1917	goto done;
1918	}
1919
1920	rc = ldapsam_search_suffix_by_name(priv, sname, &msg, attr_list);
1921
1922	if ((rc != LDAP_SUCCESS) \|\|
1923	(ldap_count_entries(priv2ld(priv), msg) != 1) \|\|
1924	((entry = ldap_first_entry(priv2ld(priv), msg)) == NULL)) {
1925	DEBUG(5, ("Could not find user %s\n", sname));
1926	result = NT_STATUS_NO_SUCH_USER;
1927	goto done;
1928	}
1929
1930	rc = ldapsam_delete_entry(
1931	priv, mem_ctx, entry,
1932	priv->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ?
1933	LDAP_OBJ_SAMBASAMACCOUNT : LDAP_OBJ_SAMBAACCOUNT,
1934	attr_list);
1935
1936	result = (rc == LDAP_SUCCESS) ?
1937	NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
1938
1939	done:
1940	TALLOC_FREE(mem_ctx);
1941	return result;
1942	}
1943
1944	/**********************************************************************
1945	Helper function to determine for update_sam_account whether
1946	we need LDAP modification.
1947	*********************************************************************/
1948
1949	static bool element_is_changed(const struct samu *sampass,
1950	enum pdb_elements element)
1951	{
1952	return IS_SAM_CHANGED(sampass, element);
1953	}
1954
1955	/**********************************************************************
1956	Update struct samu.
1957	*********************************************************************/
1958
1959	static NTSTATUS ldapsam_update_sam_account(struct pdb_methods my_methods, struct samu newpwd)
1960	{
1961	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1962	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
1963	int rc = 0;
1964	char *dn;
1965	LDAPMessage *result = NULL;
1966	LDAPMessage *entry = NULL;
1967	LDAPMod **mods = NULL;
1968	const char **attr_list;
1969
1970	result = (LDAPMessage *)pdb_get_backend_private_data(newpwd, my_methods);
1971	if (!result) {
1972	attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
1973	if (pdb_get_username(newpwd) == NULL) {
1974	return NT_STATUS_INVALID_PARAMETER;
1975	}
1976	rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list );
1977	TALLOC_FREE( attr_list );
1978	if (rc != LDAP_SUCCESS) {
1979	return NT_STATUS_UNSUCCESSFUL;
1980	}
1981	pdb_set_backend_private_data(newpwd, result, NULL,
1982	my_methods, PDB_CHANGED);
1983	talloc_autofree_ldapmsg(newpwd, result);
1984	}
1985
1986	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
1987	DEBUG(0, ("ldapsam_update_sam_account: No user to modify!\n"));
1988	return NT_STATUS_UNSUCCESSFUL;
1989	}
1990
1991	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1992	dn = smbldap_talloc_dn(talloc_tos(), ldap_state->smbldap_state->ldap_struct, entry);
1993	if (!dn) {
1994	return NT_STATUS_UNSUCCESSFUL;
1995	}
1996
1997	DEBUG(4, ("ldapsam_update_sam_account: user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn));
1998
1999	if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
2000	element_is_changed)) {
2001	DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
2002	TALLOC_FREE(dn);
2003	if (mods != NULL)
2004	ldap_mods_free(mods,True);
2005	return NT_STATUS_UNSUCCESSFUL;
2006	}
2007
2008	if ((lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_ONLY)
2009	&& (mods == NULL)) {
2010	DEBUG(4,("ldapsam_update_sam_account: mods is empty: nothing to update for user: %s\n",
2011	pdb_get_username(newpwd)));
2012	TALLOC_FREE(dn);
2013	return NT_STATUS_OK;
2014	}
2015
2016	ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed);
2017
2018	if (mods != NULL) {
2019	ldap_mods_free(mods,True);
2020	}
2021
2022	TALLOC_FREE(dn);
2023
2024	/*
2025	* We need to set the backend private data to NULL here. For example
2026	* setuserinfo level 25 does a pdb_update_sam_account twice on the
2027	* same one, and with the explicit delete / add logic for attribute
2028	* values the second time we would use the wrong "old" value which
2029	* does not exist in LDAP anymore. Thus the LDAP server would refuse
2030	* the update.
2031	* The existing LDAPMessage is still being auto-freed by the
2032	* destructor.
2033	*/
2034	pdb_set_backend_private_data(newpwd, NULL, NULL, my_methods,
2035	PDB_CHANGED);
2036
2037	if (!NT_STATUS_IS_OK(ret)) {
2038	return ret;
2039	}
2040
2041	DEBUG(2, ("ldapsam_update_sam_account: successfully modified uid = %s in the LDAP database\n",
2042	pdb_get_username(newpwd)));
2043	return NT_STATUS_OK;
2044	}
2045
2046	/***************************************************************************
2047	Renames a struct samu
2048	- The "rename user script" has full responsibility for changing everything
2049	***************************************************************************/
2050
2051	static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
2052	TALLOC_CTX *tmp_ctx,
2053	uint32_t group_rid,
2054	uint32_t member_rid);
2055
2056	static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
2057	TALLOC_CTX *mem_ctx,
2058	struct samu *user,
2059	struct dom_sid **pp_sids,
2060	gid_t **pp_gids,
2061	uint32_t *p_num_groups);
2062
2063	static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
2064	struct samu *old_acct,
2065	const char *newname)
2066	{
2067	const char *oldname;
2068	int rc;
2069	char *rename_script = NULL;
2070	fstring oldname_lower, newname_lower;
2071
2072	if (!old_acct) {
2073	DEBUG(0, ("ldapsam_rename_sam_account: old_acct was NULL!\n"));
2074	return NT_STATUS_INVALID_PARAMETER;
2075	}
2076	if (!newname) {
2077	DEBUG(0, ("ldapsam_rename_sam_account: newname was NULL!\n"));
2078	return NT_STATUS_INVALID_PARAMETER;
2079	}
2080
2081	oldname = pdb_get_username(old_acct);
2082
2083	/* rename the posix user */
2084	rename_script = SMB_STRDUP(lp_renameuser_script());
2085	if (rename_script == NULL) {
2086	return NT_STATUS_NO_MEMORY;
2087	}
2088
2089	if (!(*rename_script)) {
2090	SAFE_FREE(rename_script);
2091	return NT_STATUS_ACCESS_DENIED;
2092	}
2093
2094	DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n",
2095	oldname, newname));
2096
2097	/* We have to allow the account name to end with a '$'.
2098	Also, follow the semantics in _samr_create_user() and lower case the
2099	posix name but preserve the case in passdb */
2100
2101	fstrcpy( oldname_lower, oldname );
2102	strlower_m( oldname_lower );
2103	fstrcpy( newname_lower, newname );
2104	strlower_m( newname_lower );
2105	rename_script = realloc_string_sub2(rename_script,
2106	"%unew",
2107	newname_lower,
2108	true,
2109	true);
2110	if (!rename_script) {
2111	return NT_STATUS_NO_MEMORY;
2112	}
2113	rename_script = realloc_string_sub2(rename_script,
2114	"%uold",
2115	oldname_lower,
2116	true,
2117	true);
2118	rc = smbrun(rename_script, NULL);
2119
2120	DEBUG(rc ? 0 : 3,("Running the command `%s' gave %d\n",
2121	rename_script, rc));
2122
2123	SAFE_FREE(rename_script);
2124
2125	if (rc == 0) {
2126	smb_nscd_flush_user_cache();
2127	}
2128
2129	if (rc)
2130	return NT_STATUS_UNSUCCESSFUL;
2131
2132	return NT_STATUS_OK;
2133	}
2134
2135	/**********************************************************************
2136	Helper function to determine for update_sam_account whether
2137	we need LDAP modification.
2138	*********************************************************************/
2139
2140	static bool element_is_set_or_changed(const struct samu *sampass,
2141	enum pdb_elements element)
2142	{
2143	return (IS_SAM_SET(sampass, element) \|\|
2144	IS_SAM_CHANGED(sampass, element));
2145	}
2146
2147	/**********************************************************************
2148	Add struct samu to LDAP.
2149	*********************************************************************/
2150
2151	static NTSTATUS ldapsam_add_sam_account(struct pdb_methods my_methods, struct samu newpwd)
2152	{
2153	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2154	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
2155	int rc;
2156	LDAPMessage *result = NULL;
2157	LDAPMessage *entry = NULL;
2158	LDAPMod **mods = NULL;
2159	int ldap_op = LDAP_MOD_REPLACE;
2160	uint32_t num_result;
2161	const char **attr_list;
2162	char *escape_user = NULL;
2163	const char *username = pdb_get_username(newpwd);
2164	const struct dom_sid *sid = pdb_get_user_sid(newpwd);
2165	char *filter = NULL;
2166	char *dn = NULL;
2167	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
2168	TALLOC_CTX *ctx = talloc_init("ldapsam_add_sam_account");
2169
2170	if (!ctx) {
2171	return NT_STATUS_NO_MEMORY;
2172	}
2173
2174	if (!username \|\| !*username) {
2175	DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
2176	status = NT_STATUS_INVALID_PARAMETER;
2177	goto fn_exit;
2178	}
2179
2180	/* free this list after the second search or in case we exit on failure */
2181	attr_list = get_userattr_list(ctx, ldap_state->schema_ver);
2182
2183	rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
2184
2185	if (rc != LDAP_SUCCESS) {
2186	goto fn_exit;
2187	}
2188
2189	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
2190	DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
2191	username));
2192	goto fn_exit;
2193	}
2194	ldap_msgfree(result);
2195	result = NULL;
2196
2197	if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
2198	rc = ldapsam_get_ldap_user_by_sid(ldap_state,
2199	sid, &result);
2200	if (rc == LDAP_SUCCESS) {
2201	if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
2202	DEBUG(0,("ldapsam_add_sam_account: SID '%s' "
2203	"already in the base, with samba "
2204	"attributes\n", sid_string_dbg(sid)));
2205	goto fn_exit;
2206	}
2207	ldap_msgfree(result);
2208	result = NULL;
2209	}
2210	}
2211
2212	/* does the entry already exist but without a samba attributes?
2213	we need to return the samba attributes here */
2214
2215	escape_user = escape_ldap_string(talloc_tos(), username);
2216	filter = talloc_strdup(attr_list, "(uid=%u)");
2217	if (!filter) {
2218	status = NT_STATUS_NO_MEMORY;
2219	goto fn_exit;
2220	}
2221	filter = talloc_all_string_sub(attr_list, filter, "%u", escape_user);
2222	TALLOC_FREE(escape_user);
2223	if (!filter) {
2224	status = NT_STATUS_NO_MEMORY;
2225	goto fn_exit;
2226	}
2227
2228	rc = smbldap_search_suffix(ldap_state->smbldap_state,
2229	filter, attr_list, &result);
2230	if ( rc != LDAP_SUCCESS ) {
2231	goto fn_exit;
2232	}
2233
2234	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2235
2236	if (num_result > 1) {
2237	DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
2238	goto fn_exit;
2239	}
2240
2241	/* Check if we need to update an existing entry */
2242	if (num_result == 1) {
2243	DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
2244	ldap_op = LDAP_MOD_REPLACE;
2245	entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
2246	dn = smbldap_talloc_dn(ctx, ldap_state->smbldap_state->ldap_struct, entry);
2247	if (!dn) {
2248	status = NT_STATUS_NO_MEMORY;
2249	goto fn_exit;
2250	}
2251
2252	} else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
2253
2254	/* There might be a SID for this account already - say an idmap entry */
2255
2256	filter = talloc_asprintf(ctx,
2257	"(&(%s=%s)(\|(objectClass=%s)(objectClass=%s)))",
2258	get_userattr_key2string(ldap_state->schema_ver,
2259	LDAP_ATTR_USER_SID),
2260	sid_string_talloc(ctx, sid),
2261	LDAP_OBJ_IDMAP_ENTRY,
2262	LDAP_OBJ_SID_ENTRY);
2263	if (!filter) {
2264	status = NT_STATUS_NO_MEMORY;
2265	goto fn_exit;
2266	}
2267
2268	/* free old result before doing a new search */
2269	if (result != NULL) {
2270	ldap_msgfree(result);
2271	result = NULL;
2272	}
2273	rc = smbldap_search_suffix(ldap_state->smbldap_state,
2274	filter, attr_list, &result);
2275
2276	if ( rc != LDAP_SUCCESS ) {
2277	goto fn_exit;
2278	}
2279
2280	num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2281
2282	if (num_result > 1) {
2283	DEBUG (0, ("ldapsam_add_sam_account: More than one user with specified Sid exists: bailing out!\n"));
2284	goto fn_exit;
2285	}
2286
2287	/* Check if we need to update an existing entry */
2288	if (num_result == 1) {
2289
2290	DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
2291	ldap_op = LDAP_MOD_REPLACE;
2292	entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
2293	dn = smbldap_talloc_dn (ctx, ldap_state->smbldap_state->ldap_struct, entry);
2294	if (!dn) {
2295	status = NT_STATUS_NO_MEMORY;
2296	goto fn_exit;
2297	}
2298	}
2299	}
2300
2301	if (num_result == 0) {
2302	char *escape_username;
2303	/* Check if we need to add an entry */
2304	DEBUG(3,("ldapsam_add_sam_account: Adding new user\n"));
2305	ldap_op = LDAP_MOD_ADD;
2306
2307	escape_username = escape_rdn_val_string_alloc(username);
2308	if (!escape_username) {
2309	status = NT_STATUS_NO_MEMORY;
2310	goto fn_exit;
2311	}
2312
2313	if (username[strlen(username)-1] == '$') {
2314	dn = talloc_asprintf(ctx,
2315	"uid=%s,%s",
2316	escape_username,
2317	lp_ldap_machine_suffix());
2318	} else {
2319	dn = talloc_asprintf(ctx,
2320	"uid=%s,%s",
2321	escape_username,
2322	lp_ldap_user_suffix());
2323	}
2324
2325	SAFE_FREE(escape_username);
2326	if (!dn) {
2327	status = NT_STATUS_NO_MEMORY;
2328	goto fn_exit;
2329	}
2330	}
2331
2332	if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
2333	element_is_set_or_changed)) {
2334	DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
2335	if (mods != NULL) {
2336	ldap_mods_free(mods, true);
2337	}
2338	goto fn_exit;
2339	}
2340
2341	if (mods == NULL) {
2342	DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
2343	goto fn_exit;
2344	}
2345	switch ( ldap_state->schema_ver ) {
2346	case SCHEMAVER_SAMBAACCOUNT:
2347	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT);
2348	break;
2349	case SCHEMAVER_SAMBASAMACCOUNT:
2350	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT);
2351	break;
2352	default:
2353	DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n"));
2354	break;
2355	}
2356
2357	ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed);
2358	if (!NT_STATUS_IS_OK(ret)) {
2359	DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
2360	pdb_get_username(newpwd),dn));
2361	ldap_mods_free(mods, true);
2362	goto fn_exit;
2363	}
2364
2365	DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
2366	ldap_mods_free(mods, true);
2367
2368	status = NT_STATUS_OK;
2369
2370	fn_exit:
2371
2372	TALLOC_FREE(ctx);
2373	if (result) {
2374	ldap_msgfree(result);
2375	}
2376	return status;
2377	}
2378
2379	/**********************************************************************
2380	*********************************************************************/
2381
2382	static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
2383	const char *filter,
2384	LDAPMessage ** result)
2385	{
2386	int scope = LDAP_SCOPE_SUBTREE;
2387	int rc;
2388	const char **attr_list;
2389
2390	attr_list = get_attr_list(NULL, groupmap_attr_list);
2391	rc = smbldap_search(ldap_state->smbldap_state,
2392	lp_ldap_suffix (), scope,
2393	filter, attr_list, 0, result);
2394	TALLOC_FREE(attr_list);
2395
2396	return rc;
2397	}
2398
2399	/**********************************************************************
2400	*********************************************************************/
2401
2402	static bool init_group_from_ldap(struct ldapsam_privates *ldap_state,
2403	GROUP_MAP map, LDAPMessage entry)
2404	{
2405	char *temp = NULL;
2406	TALLOC_CTX *ctx = talloc_init("init_group_from_ldap");
2407
2408	if (ldap_state == NULL \|\| map == NULL \|\| entry == NULL \|\|
2409	ldap_state->smbldap_state->ldap_struct == NULL) {
2410	DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
2411	TALLOC_FREE(ctx);
2412	return false;
2413	}
2414
2415	temp = smbldap_talloc_single_attribute(
2416	ldap_state->smbldap_state->ldap_struct,
2417	entry,
2418	get_attr_key2string(groupmap_attr_list,
2419	LDAP_ATTR_GIDNUMBER),
2420	ctx);
2421	if (!temp) {
2422	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2423	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
2424	TALLOC_FREE(ctx);
2425	return false;
2426	}
2427	DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
2428
2429	map->gid = (gid_t)atol(temp);
2430
2431	TALLOC_FREE(temp);
2432	temp = smbldap_talloc_single_attribute(
2433	ldap_state->smbldap_state->ldap_struct,
2434	entry,
2435	get_attr_key2string(groupmap_attr_list,
2436	LDAP_ATTR_GROUP_SID),
2437	ctx);
2438	if (!temp) {
2439	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2440	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
2441	TALLOC_FREE(ctx);
2442	return false;
2443	}
2444
2445	if (!string_to_sid(&map->sid, temp)) {
2446	DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
2447	TALLOC_FREE(ctx);
2448	return false;
2449	}
2450
2451	TALLOC_FREE(temp);
2452	temp = smbldap_talloc_single_attribute(
2453	ldap_state->smbldap_state->ldap_struct,
2454	entry,
2455	get_attr_key2string(groupmap_attr_list,
2456	LDAP_ATTR_GROUP_TYPE),
2457	ctx);
2458	if (!temp) {
2459	DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2460	get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
2461	TALLOC_FREE(ctx);
2462	return false;
2463	}
2464	map->sid_name_use = (enum lsa_SidType)atol(temp);
2465
2466	if ((map->sid_name_use < SID_NAME_USER) \|\|
2467	(map->sid_name_use > SID_NAME_UNKNOWN)) {
2468	DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
2469	TALLOC_FREE(ctx);
2470	return false;
2471	}
2472
2473	TALLOC_FREE(temp);
2474	temp = smbldap_talloc_single_attribute(
2475	ldap_state->smbldap_state->ldap_struct,
2476	entry,
2477	get_attr_key2string(groupmap_attr_list,
2478	LDAP_ATTR_DISPLAY_NAME),
2479	ctx);
2480	if (!temp) {
2481	temp = smbldap_talloc_single_attribute(
2482	ldap_state->smbldap_state->ldap_struct,
2483	entry,
2484	get_attr_key2string(groupmap_attr_list,
2485	LDAP_ATTR_CN),
2486	ctx);
2487	if (!temp) {
2488	DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
2489	for gidNumber(%lu)\n",(unsigned long)map->gid));
2490	TALLOC_FREE(ctx);
2491	return false;
2492	}
2493	}
2494	fstrcpy(map->nt_name, temp);
2495
2496	TALLOC_FREE(temp);
2497	temp = smbldap_talloc_single_attribute(
2498	ldap_state->smbldap_state->ldap_struct,
2499	entry,
2500	get_attr_key2string(groupmap_attr_list,
2501	LDAP_ATTR_DESC),
2502	ctx);
2503	if (!temp) {
2504	temp = talloc_strdup(ctx, "");
2505	if (!temp) {
2506	TALLOC_FREE(ctx);
2507	return false;
2508	}
2509	}
2510	fstrcpy(map->comment, temp);
2511
2512	if (lp_parm_bool(-1, "ldapsam", "trusted", false)) {
2513	store_gid_sid_cache(&map->sid, map->gid);
2514	idmap_cache_set_sid2gid(&map->sid, map->gid);
2515	}
2516
2517	TALLOC_FREE(ctx);
2518	return true;
2519	}
2520
2521	/**********************************************************************
2522	*********************************************************************/
2523
2524	static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods,
2525	const char *filter,
2526	GROUP_MAP *map)
2527	{
2528	struct ldapsam_privates *ldap_state =
2529	(struct ldapsam_privates *)methods->private_data;
2530	LDAPMessage *result = NULL;
2531	LDAPMessage *entry = NULL;
2532	int count;
2533
2534	if (ldapsam_search_one_group(ldap_state, filter, &result)
2535	!= LDAP_SUCCESS) {
2536	return NT_STATUS_NO_SUCH_GROUP;
2537	}
2538
2539	count = ldap_count_entries(priv2ld(ldap_state), result);
2540
2541	if (count < 1) {
2542	DEBUG(4, ("ldapsam_getgroup: Did not find group, filter was "
2543	"%s\n", filter));
2544	ldap_msgfree(result);
2545	return NT_STATUS_NO_SUCH_GROUP;
2546	}
2547
2548	if (count > 1) {
2549	DEBUG(1, ("ldapsam_getgroup: Duplicate entries for filter %s: "
2550	"count=%d\n", filter, count));
2551	ldap_msgfree(result);
2552	return NT_STATUS_NO_SUCH_GROUP;
2553	}
2554
2555	entry = ldap_first_entry(priv2ld(ldap_state), result);
2556
2557	if (!entry) {
2558	ldap_msgfree(result);
2559	return NT_STATUS_UNSUCCESSFUL;
2560	}
2561
2562	if (!init_group_from_ldap(ldap_state, map, entry)) {
2563	DEBUG(1, ("ldapsam_getgroup: init_group_from_ldap failed for "
2564	"group filter %s\n", filter));
2565	ldap_msgfree(result);
2566	return NT_STATUS_NO_SUCH_GROUP;
2567	}
2568
2569	ldap_msgfree(result);
2570	return NT_STATUS_OK;
2571	}
2572
2573	/**********************************************************************
2574	*********************************************************************/
2575
2576	static NTSTATUS ldapsam_getgrsid(struct pdb_methods methods, GROUP_MAP map,
2577	struct dom_sid sid)
2578	{
2579	char *filter = NULL;
2580	NTSTATUS status;
2581	fstring tmp;
2582
2583	if (asprintf(&filter, "(&(objectClass=%s)(%s=%s))",
2584	LDAP_OBJ_GROUPMAP,
2585	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
2586	sid_to_fstring(tmp, &sid)) < 0) {
2587	return NT_STATUS_NO_MEMORY;
2588	}
2589
2590	status = ldapsam_getgroup(methods, filter, map);
2591	SAFE_FREE(filter);
2592	return status;
2593	}
2594
2595	/**********************************************************************
2596	*********************************************************************/
2597
2598	static NTSTATUS ldapsam_getgrgid(struct pdb_methods methods, GROUP_MAP map,
2599	gid_t gid)
2600	{
2601	char *filter = NULL;
2602	NTSTATUS status;
2603
2604	if (asprintf(&filter, "(&(objectClass=%s)(%s=%lu))",
2605	LDAP_OBJ_GROUPMAP,
2606	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2607	(unsigned long)gid) < 0) {
2608	return NT_STATUS_NO_MEMORY;
2609	}
2610
2611	status = ldapsam_getgroup(methods, filter, map);
2612	SAFE_FREE(filter);
2613	return status;
2614	}
2615
2616	/**********************************************************************
2617	*********************************************************************/
2618
2619	static NTSTATUS ldapsam_getgrnam(struct pdb_methods methods, GROUP_MAP map,
2620	const char *name)
2621	{
2622	char *filter = NULL;
2623	char *escape_name = escape_ldap_string(talloc_tos(), name);
2624	NTSTATUS status;
2625
2626	if (!escape_name) {
2627	return NT_STATUS_NO_MEMORY;
2628	}
2629
2630	if (asprintf(&filter, "(&(objectClass=%s)(\|(%s=%s)(%s=%s)))",
2631	LDAP_OBJ_GROUPMAP,
2632	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
2633	get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN),
2634	escape_name) < 0) {
2635	TALLOC_FREE(escape_name);
2636	return NT_STATUS_NO_MEMORY;
2637	}
2638
2639	TALLOC_FREE(escape_name);
2640	status = ldapsam_getgroup(methods, filter, map);
2641	SAFE_FREE(filter);
2642	return status;
2643	}
2644
2645	static bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
2646	LDAPMessage *entry,
2647	const struct dom_sid *domain_sid,
2648	uint32_t *rid)
2649	{
2650	fstring str;
2651	struct dom_sid sid;
2652
2653	if (!smbldap_get_single_attribute(ldap_struct, entry, "sambaSID",
2654	str, sizeof(str)-1)) {
2655	DEBUG(10, ("Could not find sambaSID attribute\n"));
2656	return False;
2657	}
2658
2659	if (!string_to_sid(&sid, str)) {
2660	DEBUG(10, ("Could not convert string %s to sid\n", str));
2661	return False;
2662	}
2663
2664	if (dom_sid_compare_domain(&sid, domain_sid) != 0) {
2665	DEBUG(10, ("SID %s is not in expected domain %s\n",
2666	str, sid_string_dbg(domain_sid)));
2667	return False;
2668	}
2669
2670	if (!sid_peek_rid(&sid, rid)) {
2671	DEBUG(10, ("Could not peek into RID\n"));
2672	return False;
2673	}
2674
2675	return True;
2676	}
2677
2678	static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
2679	TALLOC_CTX *mem_ctx,
2680	const struct dom_sid *group,
2681	uint32_t **pp_member_rids,
2682	size_t *p_num_members)
2683	{
2684	struct ldapsam_privates *ldap_state =
2685	(struct ldapsam_privates *)methods->private_data;
2686	struct smbldap_state *conn = ldap_state->smbldap_state;
2687	const char *id_attrs[] = { "memberUid", "gidNumber", NULL };
2688	const char *sid_attrs[] = { "sambaSID", NULL };
2689	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2690	LDAPMessage *result = NULL;
2691	LDAPMessage *entry;
2692	char *filter;
2693	char **values = NULL;
2694	char **memberuid;
2695	char *gidstr;
2696	int rc, count;
2697
2698	*pp_member_rids = NULL;
2699	*p_num_members = 0;
2700
2701	filter = talloc_asprintf(mem_ctx,
2702	"(&(objectClass=%s)"
2703	"(objectClass=%s)"
2704	"(sambaSID=%s))",
2705	LDAP_OBJ_POSIXGROUP,
2706	LDAP_OBJ_GROUPMAP,
2707	sid_string_talloc(mem_ctx, group));
2708	if (filter == NULL) {
2709	ret = NT_STATUS_NO_MEMORY;
2710	goto done;
2711	}
2712
2713	rc = smbldap_search(conn, lp_ldap_suffix(),
2714	LDAP_SCOPE_SUBTREE, filter, id_attrs, 0,
2715	&result);
2716
2717	if (rc != LDAP_SUCCESS)
2718	goto done;
2719
2720	talloc_autofree_ldapmsg(mem_ctx, result);
2721
2722	count = ldap_count_entries(conn->ldap_struct, result);
2723
2724	if (count > 1) {
2725	DEBUG(1, ("Found more than one groupmap entry for %s\n",
2726	sid_string_dbg(group)));
2727	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2728	goto done;
2729	}
2730
2731	if (count == 0) {
2732	ret = NT_STATUS_NO_SUCH_GROUP;
2733	goto done;
2734	}
2735
2736	entry = ldap_first_entry(conn->ldap_struct, result);
2737	if (entry == NULL)
2738	goto done;
2739
2740	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", mem_ctx);
2741	if (!gidstr) {
2742	DEBUG (0, ("ldapsam_enum_group_members: Unable to find the group's gid!\n"));
2743	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2744	goto done;
2745	}
2746
2747	values = ldap_get_values(conn->ldap_struct, entry, "memberUid");
2748
2749	if ((values != NULL) && (values[0] != NULL)) {
2750
2751	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(\|", LDAP_OBJ_SAMBASAMACCOUNT);
2752	if (filter == NULL) {
2753	ret = NT_STATUS_NO_MEMORY;
2754	goto done;
2755	}
2756
2757	for (memberuid = values; *memberuid != NULL; memberuid += 1) {
2758	char *escape_memberuid;
2759
2760	escape_memberuid = escape_ldap_string(talloc_tos(),
2761	*memberuid);
2762	if (escape_memberuid == NULL) {
2763	ret = NT_STATUS_NO_MEMORY;
2764	goto done;
2765	}
2766
2767	filter = talloc_asprintf_append_buffer(filter, "(uid=%s)", escape_memberuid);
2768	TALLOC_FREE(escape_memberuid);
2769	if (filter == NULL) {
2770	ret = NT_STATUS_NO_MEMORY;
2771	goto done;
2772	}
2773	}
2774
2775	filter = talloc_asprintf_append_buffer(filter, "))");
2776	if (filter == NULL) {
2777	ret = NT_STATUS_NO_MEMORY;
2778	goto done;
2779	}
2780
2781	rc = smbldap_search(conn, lp_ldap_suffix(),
2782	LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
2783	&result);
2784
2785	if (rc != LDAP_SUCCESS)
2786	goto done;
2787
2788	count = ldap_count_entries(conn->ldap_struct, result);
2789	DEBUG(10,("ldapsam_enum_group_members: found %d accounts\n", count));
2790
2791	talloc_autofree_ldapmsg(mem_ctx, result);
2792
2793	for (entry = ldap_first_entry(conn->ldap_struct, result);
2794	entry != NULL;
2795	entry = ldap_next_entry(conn->ldap_struct, entry))
2796	{
2797	char *sidstr;
2798	struct dom_sid sid;
2799	uint32_t rid;
2800
2801	sidstr = smbldap_talloc_single_attribute(conn->ldap_struct,
2802	entry, "sambaSID",
2803	mem_ctx);
2804	if (!sidstr) {
2805	DEBUG(0, ("Severe DB error, %s can't miss the sambaSID"
2806	"attribute\n", LDAP_OBJ_SAMBASAMACCOUNT));
2807	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2808	goto done;
2809	}
2810
2811	if (!string_to_sid(&sid, sidstr))
2812	goto done;
2813
2814	if (!sid_check_is_in_our_domain(&sid)) {
2815	DEBUG(0, ("Inconsistent SAM -- group member uid not "
2816	"in our domain\n"));
2817	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2818	goto done;
2819	}
2820
2821	sid_peek_rid(&sid, &rid);
2822
2823	if (!add_rid_to_array_unique(mem_ctx, rid, pp_member_rids,
2824	p_num_members)) {
2825	ret = NT_STATUS_NO_MEMORY;
2826	goto done;
2827	}
2828	}
2829	}
2830
2831	filter = talloc_asprintf(mem_ctx,
2832	"(&(objectClass=%s)"
2833	"(gidNumber=%s))",
2834	LDAP_OBJ_SAMBASAMACCOUNT,
2835	gidstr);
2836
2837	rc = smbldap_search(conn, lp_ldap_suffix(),
2838	LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
2839	&result);
2840
2841	if (rc != LDAP_SUCCESS)
2842	goto done;
2843
2844	talloc_autofree_ldapmsg(mem_ctx, result);
2845
2846	for (entry = ldap_first_entry(conn->ldap_struct, result);
2847	entry != NULL;
2848	entry = ldap_next_entry(conn->ldap_struct, entry))
2849	{
2850	uint32_t rid;
2851
2852	if (!ldapsam_extract_rid_from_entry(conn->ldap_struct,
2853	entry,
2854	get_global_sam_sid(),
2855	&rid)) {
2856	DEBUG(0, ("Severe DB error, %s can't miss the samba SID" "attribute\n", LDAP_OBJ_SAMBASAMACCOUNT));
2857	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2858	goto done;
2859	}
2860
2861	if (!add_rid_to_array_unique(mem_ctx, rid, pp_member_rids,
2862	p_num_members)) {
2863	ret = NT_STATUS_NO_MEMORY;
2864	goto done;
2865	}
2866	}
2867
2868	ret = NT_STATUS_OK;
2869
2870	done:
2871
2872	if (values)
2873	ldap_value_free(values);
2874
2875	return ret;
2876	}
2877
2878	static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
2879	TALLOC_CTX *mem_ctx,
2880	struct samu *user,
2881	struct dom_sid **pp_sids,
2882	gid_t **pp_gids,
2883	uint32_t *p_num_groups)
2884	{
2885	struct ldapsam_privates *ldap_state =
2886	(struct ldapsam_privates *)methods->private_data;
2887	struct smbldap_state *conn = ldap_state->smbldap_state;
2888	char *filter;
2889	const char *attrs[] = { "gidNumber", "sambaSID", NULL };
2890	char *escape_name;
2891	int rc, count;
2892	LDAPMessage *result = NULL;
2893	LDAPMessage *entry;
2894	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2895	uint32_t num_sids;
2896	uint32_t num_gids;
2897	char *gidstr;
2898	gid_t primary_gid = -1;
2899
2900	*pp_sids = NULL;
2901	num_sids = 0;
2902
2903	if (pdb_get_username(user) == NULL) {
2904	return NT_STATUS_INVALID_PARAMETER;
2905	}
2906
2907	escape_name = escape_ldap_string(talloc_tos(), pdb_get_username(user));
2908	if (escape_name == NULL)
2909	return NT_STATUS_NO_MEMORY;
2910
2911	if (user->unix_pw) {
2912	primary_gid = user->unix_pw->pw_gid;
2913	} else {
2914	/* retrieve the users primary gid */
2915	filter = talloc_asprintf(mem_ctx,
2916	"(&(objectClass=%s)(uid=%s))",
2917	LDAP_OBJ_SAMBASAMACCOUNT,
2918	escape_name);
2919	if (filter == NULL) {
2920	ret = NT_STATUS_NO_MEMORY;
2921	goto done;
2922	}
2923
2924	rc = smbldap_search(conn, lp_ldap_suffix(),
2925	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
2926
2927	if (rc != LDAP_SUCCESS)
2928	goto done;
2929
2930	talloc_autofree_ldapmsg(mem_ctx, result);
2931
2932	count = ldap_count_entries(priv2ld(ldap_state), result);
2933
2934	switch (count) {
2935	case 0:
2936	DEBUG(1, ("User account [%s] not found!\n", pdb_get_username(user)));
2937	ret = NT_STATUS_NO_SUCH_USER;
2938	goto done;
2939	case 1:
2940	entry = ldap_first_entry(priv2ld(ldap_state), result);
2941
2942	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", mem_ctx);
2943	if (!gidstr) {
2944	DEBUG (1, ("Unable to find the member's gid!\n"));
2945	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2946	goto done;
2947	}
2948	primary_gid = strtoul(gidstr, NULL, 10);
2949	break;
2950	default:
2951	DEBUG(1, ("found more than one account with the same user name ?!\n"));
2952	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
2953	goto done;
2954	}
2955	}
2956
2957	filter = talloc_asprintf(mem_ctx,
2958	"(&(objectClass=%s)(\|(memberUid=%s)(gidNumber=%u)))",
2959	LDAP_OBJ_POSIXGROUP, escape_name, (unsigned int)primary_gid);
2960	if (filter == NULL) {
2961	ret = NT_STATUS_NO_MEMORY;
2962	goto done;
2963	}
2964
2965	rc = smbldap_search(conn, lp_ldap_suffix(),
2966	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
2967
2968	if (rc != LDAP_SUCCESS)
2969	goto done;
2970
2971	talloc_autofree_ldapmsg(mem_ctx, result);
2972
2973	num_gids = 0;
2974	*pp_gids = NULL;
2975
2976	num_sids = 0;
2977	*pp_sids = NULL;
2978
2979	/* We need to add the primary group as the first gid/sid */
2980
2981	if (!add_gid_to_array_unique(mem_ctx, primary_gid, pp_gids, &num_gids)) {
2982	ret = NT_STATUS_NO_MEMORY;
2983	goto done;
2984	}
2985
2986	/* This sid will be replaced later */
2987
2988	ret = add_sid_to_array_unique(mem_ctx, &global_sid_NULL, pp_sids,
2989	&num_sids);
2990	if (!NT_STATUS_IS_OK(ret)) {
2991	goto done;
2992	}
2993
2994	for (entry = ldap_first_entry(conn->ldap_struct, result);
2995	entry != NULL;
2996	entry = ldap_next_entry(conn->ldap_struct, entry))
2997	{
2998	fstring str;
2999	struct dom_sid sid;
3000	gid_t gid;
3001	char *end;
3002
3003	if (!smbldap_get_single_attribute(conn->ldap_struct,
3004	entry, "sambaSID",
3005	str, sizeof(str)-1))
3006	continue;
3007
3008	if (!string_to_sid(&sid, str))
3009	goto done;
3010
3011	if (!smbldap_get_single_attribute(conn->ldap_struct,
3012	entry, "gidNumber",
3013	str, sizeof(str)-1))
3014	continue;
3015
3016	gid = strtoul(str, &end, 10);
3017
3018	if (PTR_DIFF(end, str) != strlen(str))
3019	goto done;
3020
3021	if (gid == primary_gid) {
3022	sid_copy(&(*pp_sids)[0], &sid);
3023	} else {
3024	if (!add_gid_to_array_unique(mem_ctx, gid, pp_gids,
3025	&num_gids)) {
3026	ret = NT_STATUS_NO_MEMORY;
3027	goto done;
3028	}
3029	ret = add_sid_to_array_unique(mem_ctx, &sid, pp_sids,
3030	&num_sids);
3031	if (!NT_STATUS_IS_OK(ret)) {
3032	goto done;
3033	}
3034	}
3035	}
3036
3037	if (dom_sid_compare(&global_sid_NULL, &(*pp_sids)[0]) == 0) {
3038	DEBUG(3, ("primary group of [%s] not found\n",
3039	pdb_get_username(user)));
3040	ret = NT_STATUS_INTERNAL_DB_CORRUPTION;
3041	goto done;
3042	}
3043
3044	*p_num_groups = num_sids;
3045
3046	ret = NT_STATUS_OK;
3047
3048	done:
3049
3050	TALLOC_FREE(escape_name);
3051	return ret;
3052	}
3053
3054	/**********************************************************************
3055	* Augment a posixGroup object with a sambaGroupMapping domgroup
3056	*********************************************************************/
3057
3058	static NTSTATUS ldapsam_map_posixgroup(TALLOC_CTX *mem_ctx,
3059	struct ldapsam_privates *ldap_state,
3060	GROUP_MAP *map)
3061	{
3062	const char filter, dn;
3063	LDAPMessage msg, entry;
3064	LDAPMod **mods;
3065	int rc;
3066
3067	filter = talloc_asprintf(mem_ctx,
3068	"(&(objectClass=%s)(gidNumber=%u))",
3069	LDAP_OBJ_POSIXGROUP, (unsigned int)map->gid);
3070	if (filter == NULL) {
3071	return NT_STATUS_NO_MEMORY;
3072	}
3073
3074	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter,
3075	get_attr_list(mem_ctx, groupmap_attr_list),
3076	&msg);
3077	talloc_autofree_ldapmsg(mem_ctx, msg);
3078
3079	if ((rc != LDAP_SUCCESS) \|\|
3080	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) != 1) \|\|
3081	((entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg)) == NULL)) {
3082	return NT_STATUS_NO_SUCH_GROUP;
3083	}
3084
3085	dn = smbldap_talloc_dn(mem_ctx, ldap_state->smbldap_state->ldap_struct, entry);
3086	if (dn == NULL) {
3087	return NT_STATUS_NO_MEMORY;
3088	}
3089
3090	mods = NULL;
3091	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass",
3092	LDAP_OBJ_GROUPMAP);
3093	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "sambaSid",
3094	sid_string_talloc(mem_ctx, &map->sid));
3095	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "sambaGroupType",
3096	talloc_asprintf(mem_ctx, "%d", map->sid_name_use));
3097	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "displayName",
3098	map->nt_name);
3099	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
3100	map->comment);
3101	talloc_autofree_ldapmod(mem_ctx, mods);
3102
3103	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3104	if (rc != LDAP_SUCCESS) {
3105	return NT_STATUS_ACCESS_DENIED;
3106	}
3107
3108	return NT_STATUS_OK;
3109	}
3110
3111	static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
3112	GROUP_MAP *map)
3113	{
3114	struct ldapsam_privates *ldap_state =
3115	(struct ldapsam_privates *)methods->private_data;
3116	LDAPMessage *msg = NULL;
3117	LDAPMod **mods = NULL;
3118	const char *attrs[] = { NULL };
3119	char *filter;
3120
3121	char *dn;
3122	TALLOC_CTX *mem_ctx;
3123	NTSTATUS result;
3124
3125	struct dom_sid sid;
3126
3127	int rc;
3128
3129	mem_ctx = talloc_new(NULL);
3130	if (mem_ctx == NULL) {
3131	DEBUG(0, ("talloc_new failed\n"));
3132	return NT_STATUS_NO_MEMORY;
3133	}
3134
3135	filter = talloc_asprintf(mem_ctx, "(sambaSid=%s)",
3136	sid_string_talloc(mem_ctx, &map->sid));
3137	if (filter == NULL) {
3138	result = NT_STATUS_NO_MEMORY;
3139	goto done;
3140	}
3141
3142	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
3143	LDAP_SCOPE_SUBTREE, filter, attrs, True, &msg);
3144	talloc_autofree_ldapmsg(mem_ctx, msg);
3145
3146	if ((rc == LDAP_SUCCESS) &&
3147	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) > 0)) {
3148
3149	DEBUG(3, ("SID %s already present in LDAP, refusing to add "
3150	"group mapping entry\n", sid_string_dbg(&map->sid)));
3151	result = NT_STATUS_GROUP_EXISTS;
3152	goto done;
3153	}
3154
3155	switch (map->sid_name_use) {
3156
3157	case SID_NAME_DOM_GRP:
3158	/* To map a domain group we need to have a posix group
3159	to attach to. */
3160	result = ldapsam_map_posixgroup(mem_ctx, ldap_state, map);
3161	goto done;
3162	break;
3163
3164	case SID_NAME_ALIAS:
3165	if (!sid_check_is_in_our_domain(&map->sid)
3166	&& !sid_check_is_in_builtin(&map->sid) )
3167	{
3168	DEBUG(3, ("Refusing to map sid %s as an alias, not in our domain\n",
3169	sid_string_dbg(&map->sid)));
3170	result = NT_STATUS_INVALID_PARAMETER;
3171	goto done;
3172	}
3173	break;
3174
3175	default:
3176	DEBUG(3, ("Got invalid use '%s' for mapping\n",
3177	sid_type_lookup(map->sid_name_use)));
3178	result = NT_STATUS_INVALID_PARAMETER;
3179	goto done;
3180	}
3181
3182	/* Domain groups have been mapped in a separate routine, we have to
3183	* create an alias now */
3184
3185	if (map->gid == -1) {
3186	DEBUG(10, ("Refusing to map gid==-1\n"));
3187	result = NT_STATUS_INVALID_PARAMETER;
3188	goto done;
3189	}
3190
3191	if (pdb_gid_to_sid(map->gid, &sid)) {
3192	DEBUG(3, ("Gid %u is already mapped to SID %s, refusing to "
3193	"add\n", (unsigned int)map->gid, sid_string_dbg(&sid)));
3194	result = NT_STATUS_GROUP_EXISTS;
3195	goto done;
3196	}
3197
3198	/* Ok, enough checks done. It's still racy to go ahead now, but that's
3199	* the best we can get out of LDAP. */
3200
3201	dn = talloc_asprintf(mem_ctx, "sambaSid=%s,%s",
3202	sid_string_talloc(mem_ctx, &map->sid),
3203	lp_ldap_group_suffix());
3204	if (dn == NULL) {
3205	result = NT_STATUS_NO_MEMORY;
3206	goto done;
3207	}
3208
3209	mods = NULL;
3210
3211	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "objectClass",
3212	LDAP_OBJ_SID_ENTRY);
3213	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "objectClass",
3214	LDAP_OBJ_GROUPMAP);
3215	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "sambaSid",
3216	sid_string_talloc(mem_ctx, &map->sid));
3217	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "sambaGroupType",
3218	talloc_asprintf(mem_ctx, "%d", map->sid_name_use));
3219	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "displayName",
3220	map->nt_name);
3221	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "description",
3222	map->comment);
3223	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, NULL, &mods, "gidNumber",
3224	talloc_asprintf(mem_ctx, "%u", (unsigned int)map->gid));
3225	talloc_autofree_ldapmod(mem_ctx, mods);
3226
3227	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
3228
3229	result = (rc == LDAP_SUCCESS) ?
3230	NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
3231
3232	done:
3233	TALLOC_FREE(mem_ctx);
3234	return result;
3235	}
3236
3237	/**********************************************************************
3238	* Update a group mapping entry. We're quite strict about what can be changed:
3239	* Only the description and displayname may be changed. It simply does not
3240	* make any sense to change the SID, gid or the type in a mapping.
3241	*********************************************************************/
3242
3243	static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods,
3244	GROUP_MAP *map)
3245	{
3246	struct ldapsam_privates *ldap_state =
3247	(struct ldapsam_privates *)methods->private_data;
3248	int rc;
3249	const char filter, dn;
3250	LDAPMessage *msg = NULL;
3251	LDAPMessage *entry = NULL;
3252	LDAPMod **mods = NULL;
3253	TALLOC_CTX *mem_ctx;
3254	NTSTATUS result;
3255
3256	mem_ctx = talloc_new(NULL);
3257	if (mem_ctx == NULL) {
3258	DEBUG(0, ("talloc_new failed\n"));
3259	return NT_STATUS_NO_MEMORY;
3260	}
3261
3262	/* Make 100% sure that sid, gid and type are not changed by looking up
3263	* exactly the values we're given in LDAP. */
3264
3265	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)"
3266	"(sambaSid=%s)(gidNumber=%u)"
3267	"(sambaGroupType=%d))",
3268	LDAP_OBJ_GROUPMAP,
3269	sid_string_talloc(mem_ctx, &map->sid),
3270	(unsigned int)map->gid, map->sid_name_use);
3271	if (filter == NULL) {
3272	result = NT_STATUS_NO_MEMORY;
3273	goto done;
3274	}
3275
3276	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter,
3277	get_attr_list(mem_ctx, groupmap_attr_list),
3278	&msg);
3279	talloc_autofree_ldapmsg(mem_ctx, msg);
3280
3281	if ((rc != LDAP_SUCCESS) \|\|
3282	(ldap_count_entries(ldap_state->smbldap_state->ldap_struct, msg) != 1) \|\|
3283	((entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, msg)) == NULL)) {
3284	result = NT_STATUS_NO_SUCH_GROUP;
3285	goto done;
3286	}
3287
3288	dn = smbldap_talloc_dn(mem_ctx, ldap_state->smbldap_state->ldap_struct, entry);
3289
3290	if (dn == NULL) {
3291	result = NT_STATUS_NO_MEMORY;
3292	goto done;
3293	}
3294
3295	mods = NULL;
3296	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "displayName",
3297	map->nt_name);
3298	smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, entry, &mods, "description",
3299	map->comment);
3300	talloc_autofree_ldapmod(mem_ctx, mods);
3301
3302	if (mods == NULL) {
3303	DEBUG(4, ("ldapsam_update_group_mapping_entry: mods is empty: "
3304	"nothing to do\n"));
3305	result = NT_STATUS_OK;
3306	goto done;
3307	}
3308
3309	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3310
3311	if (rc != LDAP_SUCCESS) {
3312	result = NT_STATUS_ACCESS_DENIED;
3313	goto done;
3314	}
3315
3316	DEBUG(2, ("ldapsam_update_group_mapping_entry: successfully modified "
3317	"group %lu in LDAP\n", (unsigned long)map->gid));
3318
3319	result = NT_STATUS_OK;
3320
3321	done:
3322	TALLOC_FREE(mem_ctx);
3323	return result;
3324	}
3325
3326	/**********************************************************************
3327	*********************************************************************/
3328
3329	static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods,
3330	struct dom_sid sid)
3331	{
3332	struct ldapsam_privates *priv =
3333	(struct ldapsam_privates *)methods->private_data;
3334	LDAPMessage msg, entry;
3335	int rc;
3336	NTSTATUS result;
3337	TALLOC_CTX *mem_ctx;
3338	char *filter;
3339
3340	mem_ctx = talloc_new(NULL);
3341	if (mem_ctx == NULL) {
3342	DEBUG(0, ("talloc_new failed\n"));
3343	return NT_STATUS_NO_MEMORY;
3344	}
3345
3346	filter = talloc_asprintf(mem_ctx, "(&(objectClass=%s)(%s=%s))",
3347	LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID,
3348	sid_string_talloc(mem_ctx, &sid));
3349	if (filter == NULL) {
3350	result = NT_STATUS_NO_MEMORY;
3351	goto done;
3352	}
3353	rc = smbldap_search_suffix(priv->smbldap_state, filter,
3354	get_attr_list(mem_ctx, groupmap_attr_list),
3355	&msg);
3356	talloc_autofree_ldapmsg(mem_ctx, msg);
3357
3358	if ((rc != LDAP_SUCCESS) \|\|
3359	(ldap_count_entries(priv2ld(priv), msg) != 1) \|\|
3360	((entry = ldap_first_entry(priv2ld(priv), msg)) == NULL)) {
3361	result = NT_STATUS_NO_SUCH_GROUP;
3362	goto done;
3363	}
3364
3365	rc = ldapsam_delete_entry(priv, mem_ctx, entry, LDAP_OBJ_GROUPMAP,
3366	get_attr_list(mem_ctx,
3367	groupmap_attr_list_to_delete));
3368
3369	if ((rc == LDAP_NAMING_VIOLATION) \|\|
3370	(rc == LDAP_NOT_ALLOWED_ON_RDN) \|\|
3371	(rc == LDAP_OBJECT_CLASS_VIOLATION)) {
3372	const char *attrs[] = { "sambaGroupType", "description",
3373	"displayName", "sambaSIDList",
3374	NULL };
3375
3376	/* Second try. Don't delete the sambaSID attribute, this is
3377	for "old" entries that are tacked on a winbind
3378	sambaIdmapEntry. */
3379
3380	rc = ldapsam_delete_entry(priv, mem_ctx, entry,
3381	LDAP_OBJ_GROUPMAP, attrs);
3382	}
3383
3384	if ((rc == LDAP_NAMING_VIOLATION) \|\|
3385	(rc == LDAP_NOT_ALLOWED_ON_RDN) \|\|
3386	(rc == LDAP_OBJECT_CLASS_VIOLATION)) {
3387	const char *attrs[] = { "sambaGroupType", "description",
3388	"displayName", "sambaSIDList",
3389	"gidNumber", NULL };
3390
3391	/* Third try. This is a post-3.0.21 alias (containing only
3392	* sambaSidEntry and sambaGroupMapping classes), we also have
3393	* to delete the gidNumber attribute, only the sambaSidEntry
3394	* remains */
3395
3396	rc = ldapsam_delete_entry(priv, mem_ctx, entry,
3397	LDAP_OBJ_GROUPMAP, attrs);
3398	}
3399
3400	result = (rc == LDAP_SUCCESS) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
3401
3402	done:
3403	TALLOC_FREE(mem_ctx);
3404	return result;
3405	}
3406
3407	/**********************************************************************
3408	*********************************************************************/
3409
3410	static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods,
3411	bool update)
3412	{
3413	struct ldapsam_privates *ldap_state =
3414	(struct ldapsam_privates *)my_methods->private_data;
3415	char *filter = NULL;
3416	int rc;
3417	const char **attr_list;
3418
3419	filter = talloc_asprintf(NULL, "(objectclass=%s)", LDAP_OBJ_GROUPMAP);
3420	if (!filter) {
3421	return NT_STATUS_NO_MEMORY;
3422	}
3423	attr_list = get_attr_list( NULL, groupmap_attr_list );
3424	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
3425	LDAP_SCOPE_SUBTREE, filter,
3426	attr_list, 0, &ldap_state->result);
3427	TALLOC_FREE(attr_list);
3428
3429	if (rc != LDAP_SUCCESS) {
3430	DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n",
3431	ldap_err2string(rc)));
3432	DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n",
3433	lp_ldap_suffix(), filter));
3434	ldap_msgfree(ldap_state->result);
3435	ldap_state->result = NULL;
3436	TALLOC_FREE(filter);
3437	return NT_STATUS_UNSUCCESSFUL;
3438	}
3439
3440	TALLOC_FREE(filter);
3441
3442	DEBUG(2, ("ldapsam_setsamgrent: %d entries in the base!\n",
3443	ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3444	ldap_state->result)));
3445
3446	ldap_state->entry =
3447	ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3448	ldap_state->result);
3449	ldap_state->index = 0;
3450
3451	return NT_STATUS_OK;
3452	}
3453
3454	/**********************************************************************
3455	*********************************************************************/
3456
3457	static void ldapsam_endsamgrent(struct pdb_methods *my_methods)
3458	{
3459	ldapsam_endsampwent(my_methods);
3460	}
3461
3462	/**********************************************************************
3463	*********************************************************************/
3464
3465	static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods,
3466	GROUP_MAP *map)
3467	{
3468	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
3469	struct ldapsam_privates *ldap_state =
3470	(struct ldapsam_privates *)my_methods->private_data;
3471	bool bret = False;
3472
3473	while (!bret) {
3474	if (!ldap_state->entry)
3475	return ret;
3476
3477	ldap_state->index++;
3478	bret = init_group_from_ldap(ldap_state, map,
3479	ldap_state->entry);
3480
3481	ldap_state->entry =
3482	ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
3483	ldap_state->entry);
3484	}
3485
3486	return NT_STATUS_OK;
3487	}
3488
3489	/**********************************************************************
3490	*********************************************************************/
3491
3492	static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
3493	const struct dom_sid *domsid, enum lsa_SidType sid_name_use,
3494	GROUP_MAP **pp_rmap,
3495	size_t *p_num_entries,
3496	bool unix_only)
3497	{
3498	GROUP_MAP map = { 0, };
3499	size_t entries = 0;
3500
3501	*p_num_entries = 0;
3502	*pp_rmap = NULL;
3503
3504	if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods, False))) {
3505	DEBUG(0, ("ldapsam_enum_group_mapping: Unable to open "
3506	"passdb\n"));
3507	return NT_STATUS_ACCESS_DENIED;
3508	}
3509
3510	while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) {
3511	if (sid_name_use != SID_NAME_UNKNOWN &&
3512	sid_name_use != map.sid_name_use) {
3513	DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
3514	"not of the requested type\n", map.nt_name));
3515	continue;
3516	}
3517	if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
3518	DEBUG(11,("ldapsam_enum_group_mapping: group %s is "
3519	"non mapped\n", map.nt_name));
3520	continue;
3521	}
3522
3523	(pp_rmap)=SMB_REALLOC_ARRAY((pp_rmap), GROUP_MAP, entries+1);
3524	if (!(*pp_rmap)) {
3525	DEBUG(0,("ldapsam_enum_group_mapping: Unable to "
3526	"enlarge group map!\n"));
3527	return NT_STATUS_UNSUCCESSFUL;
3528	}
3529
3530	(*pp_rmap)[entries] = map;
3531
3532	entries += 1;
3533
3534	}
3535	ldapsam_endsamgrent(methods);
3536
3537	*p_num_entries = entries;
3538
3539	return NT_STATUS_OK;
3540	}
3541
3542	static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
3543	const struct dom_sid *alias,
3544	const struct dom_sid *member,
3545	int modop)
3546	{
3547	struct ldapsam_privates *ldap_state =
3548	(struct ldapsam_privates *)methods->private_data;
3549	char *dn = NULL;
3550	LDAPMessage *result = NULL;
3551	LDAPMessage *entry = NULL;
3552	int count;
3553	LDAPMod **mods = NULL;
3554	int rc;
3555	enum lsa_SidType type = SID_NAME_USE_NONE;
3556	fstring tmp;
3557
3558	char *filter = NULL;
3559
3560	if (sid_check_is_in_builtin(alias)) {
3561	type = SID_NAME_ALIAS;
3562	}
3563
3564	if (sid_check_is_in_our_domain(alias)) {
3565	type = SID_NAME_ALIAS;
3566	}
3567
3568	if (type == SID_NAME_USE_NONE) {
3569	DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
3570	sid_string_dbg(alias)));
3571	return NT_STATUS_NO_SUCH_ALIAS;
3572	}
3573
3574	if (asprintf(&filter,
3575	"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
3576	LDAP_OBJ_GROUPMAP, sid_to_fstring(tmp, alias),
3577	type) < 0) {
3578	return NT_STATUS_NO_MEMORY;
3579	}
3580
3581	if (ldapsam_search_one_group(ldap_state, filter,
3582	&result) != LDAP_SUCCESS) {
3583	SAFE_FREE(filter);
3584	return NT_STATUS_NO_SUCH_ALIAS;
3585	}
3586
3587	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3588	result);
3589
3590	if (count < 1) {
3591	DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
3592	ldap_msgfree(result);
3593	SAFE_FREE(filter);
3594	return NT_STATUS_NO_SUCH_ALIAS;
3595	}
3596
3597	if (count > 1) {
3598	DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for "
3599	"filter %s: count=%d\n", filter, count));
3600	ldap_msgfree(result);
3601	SAFE_FREE(filter);
3602	return NT_STATUS_NO_SUCH_ALIAS;
3603	}
3604
3605	SAFE_FREE(filter);
3606
3607	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3608	result);
3609
3610	if (!entry) {
3611	ldap_msgfree(result);
3612	return NT_STATUS_UNSUCCESSFUL;
3613	}
3614
3615	dn = smbldap_talloc_dn(talloc_tos(), ldap_state->smbldap_state->ldap_struct, entry);
3616	if (!dn) {
3617	ldap_msgfree(result);
3618	return NT_STATUS_UNSUCCESSFUL;
3619	}
3620
3621	smbldap_set_mod(&mods, modop,
3622	get_attr_key2string(groupmap_attr_list,
3623	LDAP_ATTR_SID_LIST),
3624	sid_to_fstring(tmp, member));
3625
3626	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
3627
3628	ldap_mods_free(mods, True);
3629	ldap_msgfree(result);
3630	TALLOC_FREE(dn);
3631
3632	if (rc == LDAP_TYPE_OR_VALUE_EXISTS) {
3633	return NT_STATUS_MEMBER_IN_ALIAS;
3634	}
3635
3636	if (rc == LDAP_NO_SUCH_ATTRIBUTE) {
3637	return NT_STATUS_MEMBER_NOT_IN_ALIAS;
3638	}
3639
3640	if (rc != LDAP_SUCCESS) {
3641	return NT_STATUS_UNSUCCESSFUL;
3642	}
3643
3644	return NT_STATUS_OK;
3645	}
3646
3647	static NTSTATUS ldapsam_add_aliasmem(struct pdb_methods *methods,
3648	const struct dom_sid *alias,
3649	const struct dom_sid *member)
3650	{
3651	return ldapsam_modify_aliasmem(methods, alias, member, LDAP_MOD_ADD);
3652	}
3653
3654	static NTSTATUS ldapsam_del_aliasmem(struct pdb_methods *methods,
3655	const struct dom_sid *alias,
3656	const struct dom_sid *member)
3657	{
3658	return ldapsam_modify_aliasmem(methods, alias, member,
3659	LDAP_MOD_DELETE);
3660	}
3661
3662	static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
3663	const struct dom_sid *alias,
3664	TALLOC_CTX *mem_ctx,
3665	struct dom_sid **pp_members,
3666	size_t *p_num_members)
3667	{
3668	struct ldapsam_privates *ldap_state =
3669	(struct ldapsam_privates *)methods->private_data;
3670	LDAPMessage *result = NULL;
3671	LDAPMessage *entry = NULL;
3672	int count;
3673	char **values = NULL;
3674	int i;
3675	char *filter = NULL;
3676	uint32_t num_members = 0;
3677	enum lsa_SidType type = SID_NAME_USE_NONE;
3678	fstring tmp;
3679
3680	*pp_members = NULL;
3681	*p_num_members = 0;
3682
3683	if (sid_check_is_in_builtin(alias)) {
3684	type = SID_NAME_ALIAS;
3685	}
3686
3687	if (sid_check_is_in_our_domain(alias)) {
3688	type = SID_NAME_ALIAS;
3689	}
3690
3691	if (type == SID_NAME_USE_NONE) {
3692	DEBUG(5, ("SID %s is neither in builtin nor in our domain!\n",
3693	sid_string_dbg(alias)));
3694	return NT_STATUS_NO_SUCH_ALIAS;
3695	}
3696
3697	if (asprintf(&filter,
3698	"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
3699	LDAP_OBJ_GROUPMAP, sid_to_fstring(tmp, alias),
3700	type) < 0) {
3701	return NT_STATUS_NO_MEMORY;
3702	}
3703
3704	if (ldapsam_search_one_group(ldap_state, filter,
3705	&result) != LDAP_SUCCESS) {
3706	SAFE_FREE(filter);
3707	return NT_STATUS_NO_SUCH_ALIAS;
3708	}
3709
3710	count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3711	result);
3712
3713	if (count < 1) {
3714	DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
3715	ldap_msgfree(result);
3716	SAFE_FREE(filter);
3717	return NT_STATUS_NO_SUCH_ALIAS;
3718	}
3719
3720	if (count > 1) {
3721	DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for "
3722	"filter %s: count=%d\n", filter, count));
3723	ldap_msgfree(result);
3724	SAFE_FREE(filter);
3725	return NT_STATUS_NO_SUCH_ALIAS;
3726	}
3727
3728	SAFE_FREE(filter);
3729
3730	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3731	result);
3732
3733	if (!entry) {
3734	ldap_msgfree(result);
3735	return NT_STATUS_UNSUCCESSFUL;
3736	}
3737
3738	values = ldap_get_values(ldap_state->smbldap_state->ldap_struct,
3739	entry,
3740	get_attr_key2string(groupmap_attr_list,
3741	LDAP_ATTR_SID_LIST));
3742
3743	if (values == NULL) {
3744	ldap_msgfree(result);
3745	return NT_STATUS_OK;
3746	}
3747
3748	count = ldap_count_values(values);
3749
3750	for (i=0; i<count; i++) {
3751	struct dom_sid member;
3752	NTSTATUS status;
3753
3754	if (!string_to_sid(&member, values[i]))
3755	continue;
3756
3757	status = add_sid_to_array(mem_ctx, &member, pp_members,
3758	&num_members);
3759	if (!NT_STATUS_IS_OK(status)) {
3760	ldap_value_free(values);
3761	ldap_msgfree(result);
3762	return status;
3763	}
3764	}
3765
3766	*p_num_members = num_members;
3767	ldap_value_free(values);
3768	ldap_msgfree(result);
3769
3770	return NT_STATUS_OK;
3771	}
3772
3773	static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
3774	TALLOC_CTX *mem_ctx,
3775	const struct dom_sid *domain_sid,
3776	const struct dom_sid *members,
3777	size_t num_members,
3778	uint32_t **pp_alias_rids,
3779	size_t *p_num_alias_rids)
3780	{
3781	struct ldapsam_privates *ldap_state =
3782	(struct ldapsam_privates *)methods->private_data;
3783	LDAP *ldap_struct;
3784
3785	const char *attrs[] = { LDAP_ATTRIBUTE_SID, NULL };
3786
3787	LDAPMessage *result = NULL;
3788	LDAPMessage *entry = NULL;
3789	int i;
3790	int rc;
3791	char *filter;
3792	enum lsa_SidType type = SID_NAME_USE_NONE;
3793	bool is_builtin = false;
3794	bool sid_added = false;
3795
3796	*pp_alias_rids = NULL;
3797	*p_num_alias_rids = 0;
3798
3799	if (sid_check_is_builtin(domain_sid)) {
3800	is_builtin = true;
3801	type = SID_NAME_ALIAS;
3802	}
3803
3804	if (sid_check_is_domain(domain_sid)) {
3805	type = SID_NAME_ALIAS;
3806	}
3807
3808	if (type == SID_NAME_USE_NONE) {
3809	DEBUG(5, ("SID %s is neither builtin nor domain!\n",
3810	sid_string_dbg(domain_sid)));
3811	return NT_STATUS_UNSUCCESSFUL;
3812	}
3813
3814	if (num_members == 0) {
3815	return NT_STATUS_OK;
3816	}
3817
3818	filter = talloc_asprintf(mem_ctx,
3819	"(&(objectclass=%s)(sambaGroupType=%d)(\|",
3820	LDAP_OBJ_GROUPMAP, type);
3821
3822	for (i=0; i<num_members; i++)
3823	filter = talloc_asprintf(mem_ctx, "%s(sambaSIDList=%s)",
3824	filter,
3825	sid_string_talloc(mem_ctx,
3826	&members[i]));
3827
3828	filter = talloc_asprintf(mem_ctx, "%s))", filter);
3829
3830	if (filter == NULL) {
3831	return NT_STATUS_NO_MEMORY;
3832	}
3833
3834	if (is_builtin &&
3835	ldap_state->search_cache.filter &&
3836	strcmp(ldap_state->search_cache.filter, filter) == 0) {
3837	filter = talloc_move(filter, &ldap_state->search_cache.filter);
3838	result = ldap_state->search_cache.result;
3839	ldap_state->search_cache.result = NULL;
3840	} else {
3841	rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_suffix(),
3842	LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
3843	if (rc != LDAP_SUCCESS) {
3844	return NT_STATUS_UNSUCCESSFUL;
3845	}
3846	talloc_autofree_ldapmsg(filter, result);
3847	}
3848
3849	ldap_struct = ldap_state->smbldap_state->ldap_struct;
3850
3851	for (entry = ldap_first_entry(ldap_struct, result);
3852	entry != NULL;
3853	entry = ldap_next_entry(ldap_struct, entry))
3854	{
3855	fstring sid_str;
3856	struct dom_sid sid;
3857	uint32_t rid;
3858
3859	if (!smbldap_get_single_attribute(ldap_struct, entry,
3860	LDAP_ATTRIBUTE_SID,
3861	sid_str,
3862	sizeof(sid_str)-1))
3863	continue;
3864
3865	if (!string_to_sid(&sid, sid_str))
3866	continue;
3867
3868	if (!sid_peek_check_rid(domain_sid, &sid, &rid))
3869	continue;
3870
3871	sid_added = true;
3872
3873	if (!add_rid_to_array_unique(mem_ctx, rid, pp_alias_rids,
3874	p_num_alias_rids)) {
3875	return NT_STATUS_NO_MEMORY;
3876	}
3877	}
3878
3879	if (!is_builtin && !sid_added) {
3880	TALLOC_FREE(ldap_state->search_cache.filter);
3881	/*
3882	* Note: result is a talloc child of filter because of the
3883	* talloc_autofree_ldapmsg() usage
3884	*/
3885	ldap_state->search_cache.filter = talloc_move(ldap_state, &filter);
3886	ldap_state->search_cache.result = result;
3887	}
3888
3889	return NT_STATUS_OK;
3890	}
3891
3892	static NTSTATUS ldapsam_set_account_policy_in_ldap(struct pdb_methods *methods,
3893	enum pdb_policy_type type,
3894	uint32_t value)
3895	{
3896	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3897	int rc;
3898	LDAPMod **mods = NULL;
3899	fstring value_string;
3900	const char *policy_attr = NULL;
3901
3902	struct ldapsam_privates *ldap_state =
3903	(struct ldapsam_privates *)methods->private_data;
3904
3905	DEBUG(10,("ldapsam_set_account_policy_in_ldap\n"));
3906
3907	if (!ldap_state->domain_dn) {
3908	return NT_STATUS_INVALID_PARAMETER;
3909	}
3910
3911	policy_attr = get_account_policy_attr(type);
3912	if (policy_attr == NULL) {
3913	DEBUG(0,("ldapsam_set_account_policy_in_ldap: invalid "
3914	"policy\n"));
3915	return ntstatus;
3916	}
3917
3918	slprintf(value_string, sizeof(value_string) - 1, "%i", value);
3919
3920	smbldap_set_mod(&mods, LDAP_MOD_REPLACE, policy_attr, value_string);
3921
3922	rc = smbldap_modify(ldap_state->smbldap_state, ldap_state->domain_dn,
3923	mods);
3924
3925	ldap_mods_free(mods, True);
3926
3927	if (rc != LDAP_SUCCESS) {
3928	return ntstatus;
3929	}
3930
3931	if (!cache_account_policy_set(type, value)) {
3932	DEBUG(0,("ldapsam_set_account_policy_in_ldap: failed to "
3933	"update local tdb cache\n"));
3934	return ntstatus;
3935	}
3936
3937	return NT_STATUS_OK;
3938	}
3939
3940	static NTSTATUS ldapsam_set_account_policy(struct pdb_methods *methods,
3941	enum pdb_policy_type type,
3942	uint32_t value)
3943	{
3944	return ldapsam_set_account_policy_in_ldap(methods, type,
3945	value);
3946	}
3947
3948	static NTSTATUS ldapsam_get_account_policy_from_ldap(struct pdb_methods *methods,
3949	enum pdb_policy_type type,
3950	uint32_t *value)
3951	{
3952	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
3953	LDAPMessage *result = NULL;
3954	LDAPMessage *entry = NULL;
3955	int count;
3956	int rc;
3957	char **vals = NULL;
3958	char *filter;
3959	const char *policy_attr = NULL;
3960
3961	struct ldapsam_privates *ldap_state =
3962	(struct ldapsam_privates *)methods->private_data;
3963
3964	const char *attrs[2];
3965
3966	DEBUG(10,("ldapsam_get_account_policy_from_ldap\n"));
3967
3968	if (!ldap_state->domain_dn) {
3969	return NT_STATUS_INVALID_PARAMETER;
3970	}
3971
3972	policy_attr = get_account_policy_attr(type);
3973	if (!policy_attr) {
3974	DEBUG(0,("ldapsam_get_account_policy_from_ldap: invalid "
3975	"policy index: %d\n", type));
3976	return ntstatus;
3977	}
3978
3979	attrs[0] = policy_attr;
3980	attrs[1] = NULL;
3981
3982	filter = talloc_asprintf(talloc_tos(), "(objectClass=%s)", LDAP_OBJ_DOMINFO);
3983	if (filter == NULL) {
3984	return NT_STATUS_NO_MEMORY;
3985	}
3986	rc = smbldap_search(ldap_state->smbldap_state, ldap_state->domain_dn,
3987	LDAP_SCOPE_BASE, filter, attrs, 0,
3988	&result);
3989	TALLOC_FREE(filter);
3990	if (rc != LDAP_SUCCESS) {
3991	return ntstatus;
3992	}
3993
3994	count = ldap_count_entries(priv2ld(ldap_state), result);
3995	if (count < 1) {
3996	goto out;
3997	}
3998
3999	entry = ldap_first_entry(priv2ld(ldap_state), result);
4000	if (entry == NULL) {
4001	goto out;
4002	}
4003
4004	vals = ldap_get_values(priv2ld(ldap_state), entry, policy_attr);
4005	if (vals == NULL) {
4006	goto out;
4007	}
4008
4009	*value = (uint32_t)atol(vals[0]);
4010
4011	ntstatus = NT_STATUS_OK;
4012
4013	out:
4014	if (vals)
4015	ldap_value_free(vals);
4016	ldap_msgfree(result);
4017
4018	return ntstatus;
4019	}
4020
4021	/* wrapper around ldapsam_get_account_policy_from_ldap(), handles tdb as cache
4022
4023	- if user hasn't decided to use account policies inside LDAP just reuse the
4024	old tdb values
4025
4026	- if there is a valid cache entry, return that
4027	- if there is an LDAP entry, update cache and return
4028	- otherwise set to default, update cache and return
4029
4030	Guenther
4031	*/
4032	static NTSTATUS ldapsam_get_account_policy(struct pdb_methods *methods,
4033	enum pdb_policy_type type,
4034	uint32_t *value)
4035	{
4036	NTSTATUS ntstatus = NT_STATUS_UNSUCCESSFUL;
4037
4038	if (cache_account_policy_get(type, value)) {
4039	DEBUG(11,("ldapsam_get_account_policy: got valid value from "
4040	"cache\n"));
4041	return NT_STATUS_OK;
4042	}
4043
4044	ntstatus = ldapsam_get_account_policy_from_ldap(methods, type,
4045	value);
4046	if (NT_STATUS_IS_OK(ntstatus)) {
4047	goto update_cache;
4048	}
4049
4050	DEBUG(10,("ldapsam_get_account_policy: failed to retrieve from "
4051	"ldap\n"));
4052
4053	#if 0
4054	/* should we automagically migrate old tdb value here ? */
4055	if (account_policy_get(type, value))
4056	goto update_ldap;
4057
4058	DEBUG(10,("ldapsam_get_account_policy: no tdb for %d, trying "
4059	"default\n", type));
4060	#endif
4061
4062	if (!account_policy_get_default(type, value)) {
4063	return ntstatus;
4064	}
4065
4066	/* update_ldap: */
4067
4068	ntstatus = ldapsam_set_account_policy(methods, type, *value);
4069	if (!NT_STATUS_IS_OK(ntstatus)) {
4070	return ntstatus;
4071	}
4072
4073	update_cache:
4074
4075	if (!cache_account_policy_set(type, *value)) {
4076	DEBUG(0,("ldapsam_get_account_policy: failed to update local "
4077	"tdb as a cache\n"));
4078	return NT_STATUS_UNSUCCESSFUL;
4079	}
4080
4081	return NT_STATUS_OK;
4082	}
4083
4084	static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
4085	const struct dom_sid *domain_sid,
4086	int num_rids,
4087	uint32_t *rids,
4088	const char **names,
4089	enum lsa_SidType *attrs)
4090	{
4091	struct ldapsam_privates *ldap_state =
4092	(struct ldapsam_privates *)methods->private_data;
4093	LDAPMessage *msg = NULL;
4094	LDAPMessage *entry;
4095	char *allsids = NULL;
4096	int i, rc, num_mapped;
4097	NTSTATUS result = NT_STATUS_NO_MEMORY;
4098	TALLOC_CTX *mem_ctx;
4099	LDAP *ld;
4100	bool is_builtin;
4101
4102	mem_ctx = talloc_new(NULL);
4103	if (mem_ctx == NULL) {
4104	DEBUG(0, ("talloc_new failed\n"));
4105	goto done;
4106	}
4107
4108	if (!sid_check_is_builtin(domain_sid) &&
4109	!sid_check_is_domain(domain_sid)) {
4110	result = NT_STATUS_INVALID_PARAMETER;
4111	goto done;
4112	}
4113
4114	if (num_rids == 0) {
4115	result = NT_STATUS_NONE_MAPPED;
4116	goto done;
4117	}
4118
4119	for (i=0; i<num_rids; i++)
4120	attrs[i] = SID_NAME_UNKNOWN;
4121
4122	allsids = talloc_strdup(mem_ctx, "");
4123	if (allsids == NULL) {
4124	goto done;
4125	}
4126
4127	for (i=0; i<num_rids; i++) {
4128	struct dom_sid sid;
4129	sid_compose(&sid, domain_sid, rids[i]);
4130	allsids = talloc_asprintf_append_buffer(
4131	allsids, "(sambaSid=%s)",
4132	sid_string_talloc(mem_ctx, &sid));
4133	if (allsids == NULL) {
4134	goto done;
4135	}
4136	}
4137
4138	/* First look for users */
4139
4140	{
4141	char *filter;
4142	const char *ldap_attrs[] = { "uid", "sambaSid", NULL };
4143
4144	filter = talloc_asprintf(
4145	mem_ctx, ("(&(objectClass=%s)(\|%s))"),
4146	LDAP_OBJ_SAMBASAMACCOUNT, allsids);
4147
4148	if (filter == NULL) {
4149	goto done;
4150	}
4151
4152	rc = smbldap_search(ldap_state->smbldap_state,
4153	lp_ldap_user_suffix(),
4154	LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
4155	&msg);
4156	talloc_autofree_ldapmsg(mem_ctx, msg);
4157	}
4158
4159	if (rc != LDAP_SUCCESS)
4160	goto done;
4161
4162	ld = ldap_state->smbldap_state->ldap_struct;
4163	num_mapped = 0;
4164
4165	for (entry = ldap_first_entry(ld, msg);
4166	entry != NULL;
4167	entry = ldap_next_entry(ld, entry)) {
4168	uint32_t rid;
4169	int rid_index;
4170	const char *name;
4171
4172	if (!ldapsam_extract_rid_from_entry(ld, entry, domain_sid,
4173	&rid)) {
4174	DEBUG(2, ("Could not find sid from ldap entry\n"));
4175	continue;
4176	}
4177
4178	name = smbldap_talloc_single_attribute(ld, entry, "uid",
4179	names);
4180	if (name == NULL) {
4181	DEBUG(2, ("Could not retrieve uid attribute\n"));
4182	continue;
4183	}
4184
4185	for (rid_index = 0; rid_index < num_rids; rid_index++) {
4186	if (rid == rids[rid_index])
4187	break;
4188	}
4189
4190	if (rid_index == num_rids) {
4191	DEBUG(2, ("Got a RID not asked for: %d\n", rid));
4192	continue;
4193	}
4194
4195	attrs[rid_index] = SID_NAME_USER;
4196	names[rid_index] = name;
4197	num_mapped += 1;
4198	}
4199
4200	if (num_mapped == num_rids) {
4201	/* No need to look for groups anymore -- we're done */
4202	result = NT_STATUS_OK;
4203	goto done;
4204	}
4205
4206	/* Same game for groups */
4207
4208	{
4209	char *filter;
4210	const char *ldap_attrs[] = { "cn", "displayName", "sambaSid",
4211	"sambaGroupType", NULL };
4212
4213	filter = talloc_asprintf(
4214	mem_ctx, "(&(objectClass=%s)(\|%s))",
4215	LDAP_OBJ_GROUPMAP, allsids);
4216	if (filter == NULL) {
4217	goto done;
4218	}
4219
4220	rc = smbldap_search(ldap_state->smbldap_state,
4221	lp_ldap_suffix(),
4222	LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
4223	&msg);
4224	talloc_autofree_ldapmsg(mem_ctx, msg);
4225	}
4226
4227	if (rc != LDAP_SUCCESS)
4228	goto done;
4229
4230	/* ldap_struct might have changed due to a reconnect */
4231
4232	ld = ldap_state->smbldap_state->ldap_struct;
4233
4234	/* For consistency checks, we already checked we're only domain or builtin */
4235
4236	is_builtin = sid_check_is_builtin(domain_sid);
4237
4238	for (entry = ldap_first_entry(ld, msg);
4239	entry != NULL;
4240	entry = ldap_next_entry(ld, entry))
4241	{
4242	uint32_t rid;
4243	int rid_index;
4244	const char *attr;
4245	enum lsa_SidType type;
4246	const char *dn = smbldap_talloc_dn(mem_ctx, ld, entry);
4247
4248	attr = smbldap_talloc_single_attribute(ld, entry, "sambaGroupType",
4249	mem_ctx);
4250	if (attr == NULL) {
4251	DEBUG(2, ("Could not extract type from ldap entry %s\n",
4252	dn));
4253	continue;
4254	}
4255
4256	type = (enum lsa_SidType)atol(attr);
4257
4258	/* Consistency checks */
4259	if ((is_builtin && (type != SID_NAME_ALIAS)) \|\|
4260	(!is_builtin && ((type != SID_NAME_ALIAS) &&
4261	(type != SID_NAME_DOM_GRP)))) {
4262	DEBUG(2, ("Rejecting invalid group mapping entry %s\n", dn));
4263	}
4264
4265	if (!ldapsam_extract_rid_from_entry(ld, entry, domain_sid,
4266	&rid)) {
4267	DEBUG(2, ("Could not find sid from ldap entry %s\n", dn));
4268	continue;
4269	}
4270
4271	attr = smbldap_talloc_single_attribute(ld, entry, "displayName", names);
4272
4273	if (attr == NULL) {
4274	DEBUG(10, ("Could not retrieve 'displayName' attribute from %s\n",
4275	dn));
4276	attr = smbldap_talloc_single_attribute(ld, entry, "cn", names);
4277	}
4278
4279	if (attr == NULL) {
4280	DEBUG(2, ("Could not retrieve naming attribute from %s\n",
4281	dn));
4282	continue;
4283	}
4284
4285	for (rid_index = 0; rid_index < num_rids; rid_index++) {
4286	if (rid == rids[rid_index])
4287	break;
4288	}
4289
4290	if (rid_index == num_rids) {
4291	DEBUG(2, ("Got a RID not asked for: %d\n", rid));
4292	continue;
4293	}
4294
4295	attrs[rid_index] = type;
4296	names[rid_index] = attr;
4297	num_mapped += 1;
4298	}
4299
4300	result = NT_STATUS_NONE_MAPPED;
4301
4302	if (num_mapped > 0)
4303	result = (num_mapped == num_rids) ?
4304	NT_STATUS_OK : STATUS_SOME_UNMAPPED;
4305	done:
4306	TALLOC_FREE(mem_ctx);
4307	return result;
4308	}
4309
4310	static char get_ldap_filter(TALLOC_CTX mem_ctx, const char *username)
4311	{
4312	char *filter = NULL;
4313	char *escaped = NULL;
4314	char *result = NULL;
4315
4316	if (asprintf(&filter, "(&%s(objectclass=%s))",
4317	"(uid=%u)", LDAP_OBJ_SAMBASAMACCOUNT) < 0) {
4318	goto done;
4319	}
4320
4321	escaped = escape_ldap_string(talloc_tos(), username);
4322	if (escaped == NULL) goto done;
4323
4324	result = talloc_string_sub(mem_ctx, filter, "%u", username);
4325
4326	done:
4327	SAFE_FREE(filter);
4328	TALLOC_FREE(escaped);
4329
4330	return result;
4331	}
4332
4333	static const char *talloc_attrs(TALLOC_CTX mem_ctx, ...)
4334	{
4335	int i, num = 0;
4336	va_list ap;
4337	const char **result;
4338
4339	va_start(ap, mem_ctx);
4340	while (va_arg(ap, const char *) != NULL)
4341	num += 1;
4342	va_end(ap);
4343
4344	if ((result = TALLOC_ARRAY(mem_ctx, const char *, num+1)) == NULL) {
4345	return NULL;
4346	}
4347
4348	va_start(ap, mem_ctx);
4349	for (i=0; i<num; i++) {
4350	result[i] = talloc_strdup(result, va_arg(ap, const char*));
4351	if (result[i] == NULL) {
4352	talloc_free(result);
4353	va_end(ap);
4354	return NULL;
4355	}
4356	}
4357	va_end(ap);
4358
4359	result[num] = NULL;
4360	return result;
4361	}
4362
4363	struct ldap_search_state {
4364	struct smbldap_state *connection;
4365
4366	uint32_t acct_flags;
4367	uint16_t group_type;
4368
4369	const char *base;
4370	int scope;
4371	const char *filter;
4372	const char **attrs;
4373	int attrsonly;
4374	void *pagedresults_cookie;
4375
4376	LDAPMessage entries, current_entry;
4377	bool (ldap2displayentry)(struct ldap_search_state state,
4378	TALLOC_CTX *mem_ctx,
4379	LDAP ld, LDAPMessage entry,
4380	struct samr_displayentry *result);
4381	};
4382
4383	static bool ldapsam_search_firstpage(struct pdb_search *search)
4384	{
4385	struct ldap_search_state *state =
4386	(struct ldap_search_state *)search->private_data;
4387	LDAP *ld;
4388	int rc = LDAP_OPERATIONS_ERROR;
4389
4390	state->entries = NULL;
4391
4392	if (state->connection->paged_results) {
4393	rc = smbldap_search_paged(state->connection, state->base,
4394	state->scope, state->filter,
4395	state->attrs, state->attrsonly,
4396	lp_ldap_page_size(), &state->entries,
4397	&state->pagedresults_cookie);
4398	}
4399
4400	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL)) {
4401
4402	if (state->entries != NULL) {
4403	/* Left over from unsuccessful paged attempt */
4404	ldap_msgfree(state->entries);
4405	state->entries = NULL;
4406	}
4407
4408	rc = smbldap_search(state->connection, state->base,
4409	state->scope, state->filter, state->attrs,
4410	state->attrsonly, &state->entries);
4411
4412	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL))
4413	return False;
4414
4415	/* Ok, the server was lying. It told us it could do paged
4416	* searches when it could not. */
4417	state->connection->paged_results = False;
4418	}
4419
4420	ld = state->connection->ldap_struct;
4421	if ( ld == NULL) {
4422	DEBUG(5, ("Don't have an LDAP connection right after a "
4423	"search\n"));
4424	return False;
4425	}
4426	state->current_entry = ldap_first_entry(ld, state->entries);
4427
4428	return True;
4429	}
4430
4431	static bool ldapsam_search_nextpage(struct pdb_search *search)
4432	{
4433	struct ldap_search_state *state =
4434	(struct ldap_search_state *)search->private_data;
4435	int rc;
4436
4437	if (!state->connection->paged_results) {
4438	/* There is no next page when there are no paged results */
4439	return False;
4440	}
4441
4442	rc = smbldap_search_paged(state->connection, state->base,
4443	state->scope, state->filter, state->attrs,
4444	state->attrsonly, lp_ldap_page_size(),
4445	&state->entries,
4446	&state->pagedresults_cookie);
4447
4448	if ((rc != LDAP_SUCCESS) \|\| (state->entries == NULL))
4449	return False;
4450
4451	state->current_entry = ldap_first_entry(state->connection->ldap_struct, state->entries);
4452
4453	if (state->current_entry == NULL) {
4454	ldap_msgfree(state->entries);
4455	state->entries = NULL;
4456	return false;
4457	}
4458
4459	return True;
4460	}
4461
4462	static bool ldapsam_search_next_entry(struct pdb_search *search,
4463	struct samr_displayentry *entry)
4464	{
4465	struct ldap_search_state *state =
4466	(struct ldap_search_state *)search->private_data;
4467	bool result;
4468
4469	retry:
4470	if ((state->entries == NULL) && (state->pagedresults_cookie == NULL))
4471	return False;
4472
4473	if ((state->entries == NULL) &&
4474	!ldapsam_search_nextpage(search))
4475	return False;
4476
4477	if (state->current_entry == NULL) {
4478	return false;
4479	}
4480
4481	result = state->ldap2displayentry(state, search,
4482	state->connection->ldap_struct,
4483	state->current_entry, entry);
4484
4485	if (!result) {
4486	char *dn;
4487	dn = ldap_get_dn(state->connection->ldap_struct, state->current_entry);
4488	DEBUG(5, ("Skipping entry %s\n", dn != NULL ? dn : "<NULL>"));
4489	if (dn != NULL) ldap_memfree(dn);
4490	}
4491
4492	state->current_entry = ldap_next_entry(state->connection->ldap_struct, state->current_entry);
4493
4494	if (state->current_entry == NULL) {
4495	ldap_msgfree(state->entries);
4496	state->entries = NULL;
4497	}
4498
4499	if (!result) goto retry;
4500
4501	return True;
4502	}
4503
4504	static void ldapsam_search_end(struct pdb_search *search)
4505	{
4506	struct ldap_search_state *state =
4507	(struct ldap_search_state *)search->private_data;
4508	int rc;
4509
4510	if (state->pagedresults_cookie == NULL)
4511	return;
4512
4513	if (state->entries != NULL)
4514	ldap_msgfree(state->entries);
4515
4516	state->entries = NULL;
4517	state->current_entry = NULL;
4518
4519	if (!state->connection->paged_results)
4520	return;
4521
4522	/* Tell the LDAP server we're not interested in the rest anymore. */
4523
4524	rc = smbldap_search_paged(state->connection, state->base, state->scope,
4525	state->filter, state->attrs,
4526	state->attrsonly, 0, &state->entries,
4527	&state->pagedresults_cookie);
4528
4529	if (rc != LDAP_SUCCESS)
4530	DEBUG(5, ("Could not end search properly\n"));
4531
4532	return;
4533	}
4534
4535	static bool ldapuser2displayentry(struct ldap_search_state *state,
4536	TALLOC_CTX *mem_ctx,
4537	LDAP ld, LDAPMessage entry,
4538	struct samr_displayentry *result)
4539	{
4540	char **vals;
4541	size_t converted_size;
4542	struct dom_sid sid;
4543	uint32_t acct_flags;
4544
4545	vals = ldap_get_values(ld, entry, "sambaAcctFlags");
4546	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4547	DEBUG(5, ("\"sambaAcctFlags\" not found\n"));
4548	return False;
4549	}
4550	acct_flags = pdb_decode_acct_ctrl(vals[0]);
4551	ldap_value_free(vals);
4552
4553	if ((state->acct_flags != 0) &&
4554	((state->acct_flags & acct_flags) == 0))
4555	return False;
4556
4557	result->acct_flags = acct_flags;
4558	result->account_name = "";
4559	result->fullname = "";
4560	result->description = "";
4561
4562	vals = ldap_get_values(ld, entry, "uid");
4563	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4564	DEBUG(5, ("\"uid\" not found\n"));
4565	return False;
4566	}
4567	if (!pull_utf8_talloc(mem_ctx,
4568	CONST_DISCARD(char **, &result->account_name),
4569	vals[0], &converted_size))
4570	{
4571	DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",
4572	strerror(errno)));
4573	}
4574
4575	ldap_value_free(vals);
4576
4577	vals = ldap_get_values(ld, entry, "displayName");
4578	if ((vals == NULL) \|\| (vals[0] == NULL))
4579	DEBUG(8, ("\"displayName\" not found\n"));
4580	else if (!pull_utf8_talloc(mem_ctx,
4581	CONST_DISCARD(char **, &result->fullname),
4582	vals[0], &converted_size))
4583	{
4584	DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",
4585	strerror(errno)));
4586	}
4587
4588	ldap_value_free(vals);
4589
4590	vals = ldap_get_values(ld, entry, "description");
4591	if ((vals == NULL) \|\| (vals[0] == NULL))
4592	DEBUG(8, ("\"description\" not found\n"));
4593	else if (!pull_utf8_talloc(mem_ctx,
4594	CONST_DISCARD(char **, &result->description),
4595	vals[0], &converted_size))
4596	{
4597	DEBUG(0,("ldapuser2displayentry: pull_utf8_talloc failed: %s",
4598	strerror(errno)));
4599	}
4600
4601	ldap_value_free(vals);
4602
4603	if ((result->account_name == NULL) \|\|
4604	(result->fullname == NULL) \|\|
4605	(result->description == NULL)) {
4606	DEBUG(0, ("talloc failed\n"));
4607	return False;
4608	}
4609
4610	vals = ldap_get_values(ld, entry, "sambaSid");
4611	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4612	DEBUG(0, ("\"objectSid\" not found\n"));
4613	return False;
4614	}
4615
4616	if (!string_to_sid(&sid, vals[0])) {
4617	DEBUG(0, ("Could not convert %s to SID\n", vals[0]));
4618	ldap_value_free(vals);
4619	return False;
4620	}
4621	ldap_value_free(vals);
4622
4623	if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)) {
4624	DEBUG(0, ("sid %s does not belong to our domain\n",
4625	sid_string_dbg(&sid)));
4626	return False;
4627	}
4628
4629	return True;
4630	}
4631
4632
4633	static bool ldapsam_search_users(struct pdb_methods *methods,
4634	struct pdb_search *search,
4635	uint32_t acct_flags)
4636	{
4637	struct ldapsam_privates *ldap_state =
4638	(struct ldapsam_privates *)methods->private_data;
4639	struct ldap_search_state *state;
4640
4641	state = talloc(search, struct ldap_search_state);
4642	if (state == NULL) {
4643	DEBUG(0, ("talloc failed\n"));
4644	return False;
4645	}
4646
4647	state->connection = ldap_state->smbldap_state;
4648
4649	if ((acct_flags != 0) && ((acct_flags & ACB_NORMAL) != 0))
4650	state->base = lp_ldap_user_suffix();
4651	else if ((acct_flags != 0) &&
4652	((acct_flags & (ACB_WSTRUST\|ACB_SVRTRUST\|ACB_DOMTRUST)) != 0))
4653	state->base = lp_ldap_machine_suffix();
4654	else
4655	state->base = lp_ldap_suffix();
4656
4657	state->acct_flags = acct_flags;
4658	state->base = talloc_strdup(search, state->base);
4659	state->scope = LDAP_SCOPE_SUBTREE;
4660	state->filter = get_ldap_filter(search, "*");
4661	state->attrs = talloc_attrs(search, "uid", "sambaSid",
4662	"displayName", "description",
4663	"sambaAcctFlags", NULL);
4664	state->attrsonly = 0;
4665	state->pagedresults_cookie = NULL;
4666	state->entries = NULL;
4667	state->ldap2displayentry = ldapuser2displayentry;
4668
4669	if ((state->filter == NULL) \|\| (state->attrs == NULL)) {
4670	DEBUG(0, ("talloc failed\n"));
4671	return False;
4672	}
4673
4674	search->private_data = state;
4675	search->next_entry = ldapsam_search_next_entry;
4676	search->search_end = ldapsam_search_end;
4677
4678	return ldapsam_search_firstpage(search);
4679	}
4680
4681	static bool ldapgroup2displayentry(struct ldap_search_state *state,
4682	TALLOC_CTX *mem_ctx,
4683	LDAP ld, LDAPMessage entry,
4684	struct samr_displayentry *result)
4685	{
4686	char **vals;
4687	size_t converted_size;
4688	struct dom_sid sid;
4689	uint16_t group_type;
4690
4691	result->account_name = "";
4692	result->fullname = "";
4693	result->description = "";
4694
4695
4696	vals = ldap_get_values(ld, entry, "sambaGroupType");
4697	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4698	DEBUG(5, ("\"sambaGroupType\" not found\n"));
4699	if (vals != NULL) {
4700	ldap_value_free(vals);
4701	}
4702	return False;
4703	}
4704
4705	group_type = atoi(vals[0]);
4706
4707	if ((state->group_type != 0) &&
4708	((state->group_type != group_type))) {
4709	ldap_value_free(vals);
4710	return False;
4711	}
4712
4713	ldap_value_free(vals);
4714
4715	/* display name is the NT group name */
4716
4717	vals = ldap_get_values(ld, entry, "displayName");
4718	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4719	DEBUG(8, ("\"displayName\" not found\n"));
4720
4721	/* fallback to the 'cn' attribute */
4722	vals = ldap_get_values(ld, entry, "cn");
4723	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4724	DEBUG(5, ("\"cn\" not found\n"));
4725	return False;
4726	}
4727	if (!pull_utf8_talloc(mem_ctx,
4728	CONST_DISCARD(char **,
4729	&result->account_name),
4730	vals[0], &converted_size))
4731	{
4732	DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc "
4733	"failed: %s", strerror(errno)));
4734	}
4735	}
4736	else if (!pull_utf8_talloc(mem_ctx,
4737	CONST_DISCARD(char **,
4738	&result->account_name),
4739	vals[0], &converted_size))
4740	{
4741	DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc failed: %s",
4742	strerror(errno)));
4743	}
4744
4745	ldap_value_free(vals);
4746
4747	vals = ldap_get_values(ld, entry, "description");
4748	if ((vals == NULL) \|\| (vals[0] == NULL))
4749	DEBUG(8, ("\"description\" not found\n"));
4750	else if (!pull_utf8_talloc(mem_ctx,
4751	CONST_DISCARD(char **, &result->description),
4752	vals[0], &converted_size))
4753	{
4754	DEBUG(0,("ldapgroup2displayentry: pull_utf8_talloc failed: %s",
4755	strerror(errno)));
4756	}
4757	ldap_value_free(vals);
4758
4759	if ((result->account_name == NULL) \|\|
4760	(result->fullname == NULL) \|\|
4761	(result->description == NULL)) {
4762	DEBUG(0, ("talloc failed\n"));
4763	return False;
4764	}
4765
4766	vals = ldap_get_values(ld, entry, "sambaSid");
4767	if ((vals == NULL) \|\| (vals[0] == NULL)) {
4768	DEBUG(0, ("\"objectSid\" not found\n"));
4769	if (vals != NULL) {
4770	ldap_value_free(vals);
4771	}
4772	return False;
4773	}
4774
4775	if (!string_to_sid(&sid, vals[0])) {
4776	DEBUG(0, ("Could not convert %s to SID\n", vals[0]));
4777	return False;
4778	}
4779
4780	ldap_value_free(vals);
4781
4782	switch (group_type) {
4783	case SID_NAME_DOM_GRP:
4784	case SID_NAME_ALIAS:
4785
4786	if (!sid_peek_check_rid(get_global_sam_sid(), &sid, &result->rid)
4787	&& !sid_peek_check_rid(&global_sid_Builtin, &sid, &result->rid))
4788	{
4789	DEBUG(0, ("%s is not in our domain\n",
4790	sid_string_dbg(&sid)));
4791	return False;
4792	}
4793	break;
4794
4795	default:
4796	DEBUG(0,("unknown group type: %d\n", group_type));
4797	return False;
4798	}
4799
4800	result->acct_flags = 0;
4801
4802	return True;
4803	}
4804
4805	static bool ldapsam_search_grouptype(struct pdb_methods *methods,
4806	struct pdb_search *search,
4807	const struct dom_sid *sid,
4808	enum lsa_SidType type)
4809	{
4810	struct ldapsam_privates *ldap_state =
4811	(struct ldapsam_privates *)methods->private_data;
4812	struct ldap_search_state *state;
4813	fstring tmp;
4814
4815	state = talloc(search, struct ldap_search_state);
4816	if (state == NULL) {
4817	DEBUG(0, ("talloc failed\n"));
4818	return False;
4819	}
4820
4821	state->connection = ldap_state->smbldap_state;
4822
4823	state->base = talloc_strdup(search, lp_ldap_suffix());
4824	state->connection = ldap_state->smbldap_state;
4825	state->scope = LDAP_SCOPE_SUBTREE;
4826	state->filter = talloc_asprintf(search, "(&(objectclass=%s)"
4827	"(sambaGroupType=%d)(sambaSID=%s*))",
4828	LDAP_OBJ_GROUPMAP,
4829	type, sid_to_fstring(tmp, sid));
4830	state->attrs = talloc_attrs(search, "cn", "sambaSid",
4831	"displayName", "description",
4832	"sambaGroupType", NULL);
4833	state->attrsonly = 0;
4834	state->pagedresults_cookie = NULL;
4835	state->entries = NULL;
4836	state->group_type = type;
4837	state->ldap2displayentry = ldapgroup2displayentry;
4838
4839	if ((state->filter == NULL) \|\| (state->attrs == NULL)) {
4840	DEBUG(0, ("talloc failed\n"));
4841	return False;
4842	}
4843
4844	search->private_data = state;
4845	search->next_entry = ldapsam_search_next_entry;
4846	search->search_end = ldapsam_search_end;
4847
4848	return ldapsam_search_firstpage(search);
4849	}
4850
4851	static bool ldapsam_search_groups(struct pdb_methods *methods,
4852	struct pdb_search *search)
4853	{
4854	return ldapsam_search_grouptype(methods, search, get_global_sam_sid(), SID_NAME_DOM_GRP);
4855	}
4856
4857	static bool ldapsam_search_aliases(struct pdb_methods *methods,
4858	struct pdb_search *search,
4859	const struct dom_sid *sid)
4860	{
4861	return ldapsam_search_grouptype(methods, search, sid, SID_NAME_ALIAS);
4862	}
4863
4864	static uint32_t ldapsam_capabilities(struct pdb_methods *methods)
4865	{
4866	return PDB_CAP_STORE_RIDS;
4867	}
4868
4869	static NTSTATUS ldapsam_get_new_rid(struct ldapsam_privates *priv,
4870	uint32_t *rid)
4871	{
4872	struct smbldap_state *smbldap_state = priv->smbldap_state;
4873
4874	LDAPMessage *result = NULL;
4875	LDAPMessage *entry = NULL;
4876	LDAPMod **mods = NULL;
4877	NTSTATUS status;
4878	char *value;
4879	int rc;
4880	uint32_t nextRid = 0;
4881	const char *dn;
4882
4883	TALLOC_CTX *mem_ctx;
4884
4885	mem_ctx = talloc_new(NULL);
4886	if (mem_ctx == NULL) {
4887	DEBUG(0, ("talloc_new failed\n"));
4888	return NT_STATUS_NO_MEMORY;
4889	}
4890
4891	status = smbldap_search_domain_info(smbldap_state, &result,
4892	get_global_sam_name(), False);
4893	if (!NT_STATUS_IS_OK(status)) {
4894	DEBUG(3, ("Could not get domain info: %s\n",
4895	nt_errstr(status)));
4896	goto done;
4897	}
4898
4899	talloc_autofree_ldapmsg(mem_ctx, result);
4900
4901	entry = ldap_first_entry(priv2ld(priv), result);
4902	if (entry == NULL) {
4903	DEBUG(0, ("Could not get domain info entry\n"));
4904	status = NT_STATUS_INTERNAL_DB_CORRUPTION;
4905	goto done;
4906	}
4907
4908	/* Find the largest of the three attributes "sambaNextRid",
4909	"sambaNextGroupRid" and "sambaNextUserRid". I gave up on the
4910	concept of differentiating between user and group rids, and will
4911	use only "sambaNextRid" in the future. But for compatibility
4912	reasons I look if others have chosen different strategies -- VL */
4913
4914	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4915	"sambaNextRid", mem_ctx);
4916	if (value != NULL) {
4917	uint32_t tmp = (uint32_t)strtoul(value, NULL, 10);
4918	nextRid = MAX(nextRid, tmp);
4919	}
4920
4921	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4922	"sambaNextUserRid", mem_ctx);
4923	if (value != NULL) {
4924	uint32_t tmp = (uint32_t)strtoul(value, NULL, 10);
4925	nextRid = MAX(nextRid, tmp);
4926	}
4927
4928	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
4929	"sambaNextGroupRid", mem_ctx);
4930	if (value != NULL) {
4931	uint32_t tmp = (uint32_t)strtoul(value, NULL, 10);
4932	nextRid = MAX(nextRid, tmp);
4933	}
4934
4935	if (nextRid == 0) {
4936	nextRid = BASE_RID-1;
4937	}
4938
4939	nextRid += 1;
4940
4941	smbldap_make_mod(priv2ld(priv), entry, &mods, "sambaNextRid",
4942	talloc_asprintf(mem_ctx, "%d", nextRid));
4943	talloc_autofree_ldapmod(mem_ctx, mods);
4944
4945	if ((dn = smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)) == NULL) {
4946	status = NT_STATUS_NO_MEMORY;
4947	goto done;
4948	}
4949
4950	rc = smbldap_modify(smbldap_state, dn, mods);
4951
4952	/* ACCESS_DENIED is used as a placeholder for "the modify failed,
4953	* please retry" */
4954
4955	status = (rc == LDAP_SUCCESS) ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
4956
4957	done:
4958	if (NT_STATUS_IS_OK(status)) {
4959	*rid = nextRid;
4960	}
4961
4962	TALLOC_FREE(mem_ctx);
4963	return status;
4964	}
4965
4966	static NTSTATUS ldapsam_new_rid_internal(struct pdb_methods methods, uint32_t rid)
4967	{
4968	int i;
4969
4970	for (i=0; i<10; i++) {
4971	NTSTATUS result = ldapsam_get_new_rid(
4972	(struct ldapsam_privates *)methods->private_data, rid);
4973	if (NT_STATUS_IS_OK(result)) {
4974	return result;
4975	}
4976
4977	if (!NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
4978	return result;
4979	}
4980
4981	/* The ldap update failed (maybe a race condition), retry */
4982	}
4983
4984	/* Tried 10 times, fail. */
4985	return NT_STATUS_ACCESS_DENIED;
4986	}
4987
4988	static bool ldapsam_new_rid(struct pdb_methods methods, uint32_t rid)
4989	{
4990	NTSTATUS result = ldapsam_new_rid_internal(methods, rid);
4991	return NT_STATUS_IS_OK(result) ? True : False;
4992	}
4993
4994	static bool ldapsam_sid_to_id(struct pdb_methods *methods,
4995	const struct dom_sid *sid,
4996	union unid_t id, enum lsa_SidType type)
4997	{
4998	struct ldapsam_privates *priv =
4999	(struct ldapsam_privates *)methods->private_data;
5000	char *filter;
5001	const char *attrs[] = { "sambaGroupType", "gidNumber", "uidNumber",
5002	NULL };
5003	LDAPMessage *result = NULL;
5004	LDAPMessage *entry = NULL;
5005	bool ret = False;
5006	char *value;
5007	int rc;
5008
5009	TALLOC_CTX *mem_ctx;
5010
5011	mem_ctx = talloc_new(NULL);
5012	if (mem_ctx == NULL) {
5013	DEBUG(0, ("talloc_new failed\n"));
5014	return False;
5015	}
5016
5017	filter = talloc_asprintf(mem_ctx,
5018	"(&(sambaSid=%s)"
5019	"(\|(objectClass=%s)(objectClass=%s)))",
5020	sid_string_talloc(mem_ctx, sid),
5021	LDAP_OBJ_GROUPMAP, LDAP_OBJ_SAMBASAMACCOUNT);
5022	if (filter == NULL) {
5023	DEBUG(5, ("talloc_asprintf failed\n"));
5024	goto done;
5025	}
5026
5027	rc = smbldap_search_suffix(priv->smbldap_state, filter,
5028	attrs, &result);
5029	if (rc != LDAP_SUCCESS) {
5030	goto done;
5031	}
5032	talloc_autofree_ldapmsg(mem_ctx, result);
5033
5034	if (ldap_count_entries(priv2ld(priv), result) != 1) {
5035	DEBUG(10, ("Got %d entries, expected one\n",
5036	ldap_count_entries(priv2ld(priv), result)));
5037	goto done;
5038	}
5039
5040	entry = ldap_first_entry(priv2ld(priv), result);
5041
5042	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
5043	"sambaGroupType", mem_ctx);
5044
5045	if (value != NULL) {
5046	const char *gid_str;
5047	/* It's a group */
5048
5049	gid_str = smbldap_talloc_single_attribute(
5050	priv2ld(priv), entry, "gidNumber", mem_ctx);
5051	if (gid_str == NULL) {
5052	DEBUG(1, ("%s has sambaGroupType but no gidNumber\n",
5053	smbldap_talloc_dn(mem_ctx, priv2ld(priv),
5054	entry)));
5055	goto done;
5056	}
5057
5058	id->gid = strtoul(gid_str, NULL, 10);
5059	*type = (enum lsa_SidType)strtoul(value, NULL, 10);
5060	store_gid_sid_cache(sid, id->gid);
5061	idmap_cache_set_sid2gid(sid, id->gid);
5062	ret = True;
5063	goto done;
5064	}
5065
5066	/* It must be a user */
5067
5068	value = smbldap_talloc_single_attribute(priv2ld(priv), entry,
5069	"uidNumber", mem_ctx);
5070	if (value == NULL) {
5071	DEBUG(1, ("Could not find uidNumber in %s\n",
5072	smbldap_talloc_dn(mem_ctx, priv2ld(priv), entry)));
5073	goto done;
5074	}
5075
5076	id->uid = strtoul(value, NULL, 10);
5077	*type = SID_NAME_USER;
5078	store_uid_sid_cache(sid, id->uid);
5079	idmap_cache_set_sid2uid(sid, id->uid);
5080
5081	ret = True;
5082	done:
5083	TALLOC_FREE(mem_ctx);
5084	return ret;
5085	}
5086
5087	/**
5088	* Find the SID for a uid.
5089	* This is shortcut is only used if ldapsam:trusted is set to true.
5090	*/
5091	static bool ldapsam_uid_to_sid(struct pdb_methods *methods, uid_t uid,
5092	struct dom_sid *sid)
5093	{
5094	struct ldapsam_privates *priv =
5095	(struct ldapsam_privates *)methods->private_data;
5096	char *filter;
5097	const char *attrs[] = { "sambaSID", NULL };
5098	LDAPMessage *result = NULL;
5099	LDAPMessage *entry = NULL;
5100	bool ret = false;
5101	char *user_sid_string;
5102	struct dom_sid user_sid;
5103	int rc;
5104	TALLOC_CTX *tmp_ctx = talloc_stackframe();
5105
5106	filter = talloc_asprintf(tmp_ctx,
5107	"(&(uidNumber=%u)"
5108	"(objectClass=%s)"
5109	"(objectClass=%s))",
5110	(unsigned int)uid,
5111	LDAP_OBJ_POSIXACCOUNT,
5112	LDAP_OBJ_SAMBASAMACCOUNT);
5113	if (filter == NULL) {
5114	DEBUG(3, ("talloc_asprintf failed\n"));
5115	goto done;
5116	}
5117
5118	rc = smbldap_search_suffix(priv->smbldap_state, filter, attrs, &result);
5119	if (rc != LDAP_SUCCESS) {
5120	goto done;
5121	}
5122	talloc_autofree_ldapmsg(tmp_ctx, result);
5123
5124	if (ldap_count_entries(priv2ld(priv), result) != 1) {
5125	DEBUG(3, ("ERROR: Got %d entries for uid %u, expected one\n",
5126	ldap_count_entries(priv2ld(priv), result),
5127	(unsigned int)uid));
5128	goto done;
5129	}
5130
5131	entry = ldap_first_entry(priv2ld(priv), result);
5132
5133	user_sid_string = smbldap_talloc_single_attribute(priv2ld(priv), entry,
5134	"sambaSID", tmp_ctx);
5135	if (user_sid_string == NULL) {
5136	DEBUG(1, ("Could not find sambaSID in object '%s'\n",
5137	smbldap_talloc_dn(tmp_ctx, priv2ld(priv), entry)));
5138	goto done;
5139	}
5140
5141	if (!string_to_sid(&user_sid, user_sid_string)) {
5142	DEBUG(3, ("Error calling sid_string_talloc for sid '%s'\n",
5143	user_sid_string));
5144	goto done;
5145	}
5146
5147	sid_copy(sid, &user_sid);
5148
5149	store_uid_sid_cache(sid, uid);
5150	idmap_cache_set_sid2uid(sid, uid);
5151
5152	ret = true;
5153
5154	done:
5155	TALLOC_FREE(tmp_ctx);
5156	return ret;
5157	}
5158
5159	/**
5160	* Find the SID for a gid.
5161	* This is shortcut is only used if ldapsam:trusted is set to true.
5162	*/
5163	static bool ldapsam_gid_to_sid(struct pdb_methods *methods, gid_t gid,
5164	struct dom_sid *sid)
5165	{
5166	struct ldapsam_privates *priv =
5167	(struct ldapsam_privates *)methods->private_data;
5168	char *filter;
5169	const char *attrs[] = { "sambaSID", NULL };
5170	LDAPMessage *result = NULL;
5171	LDAPMessage *entry = NULL;
5172	bool ret = false;
5173	char *group_sid_string;
5174	struct dom_sid group_sid;
5175	int rc;
5176	TALLOC_CTX *tmp_ctx = talloc_stackframe();
5177
5178	filter = talloc_asprintf(tmp_ctx,
5179	"(&(gidNumber=%u)"
5180	"(objectClass=%s))",
5181	(unsigned int)gid,
5182	LDAP_OBJ_GROUPMAP);
5183	if (filter == NULL) {
5184	DEBUG(3, ("talloc_asprintf failed\n"));
5185	goto done;
5186	}
5187
5188	rc = smbldap_search_suffix(priv->smbldap_state, filter, attrs, &result);
5189	if (rc != LDAP_SUCCESS) {
5190	goto done;
5191	}
5192	talloc_autofree_ldapmsg(tmp_ctx, result);
5193
5194	if (ldap_count_entries(priv2ld(priv), result) != 1) {
5195	DEBUG(3, ("ERROR: Got %d entries for gid %u, expected one\n",
5196	ldap_count_entries(priv2ld(priv), result),
5197	(unsigned int)gid));
5198	goto done;
5199	}
5200
5201	entry = ldap_first_entry(priv2ld(priv), result);
5202
5203	group_sid_string = smbldap_talloc_single_attribute(priv2ld(priv), entry,
5204	"sambaSID", tmp_ctx);
5205	if (group_sid_string == NULL) {
5206	DEBUG(1, ("Could not find sambaSID in object '%s'\n",
5207	smbldap_talloc_dn(tmp_ctx, priv2ld(priv), entry)));
5208	goto done;
5209	}
5210
5211	if (!string_to_sid(&group_sid, group_sid_string)) {
5212	DEBUG(3, ("Error calling sid_string_talloc for sid '%s'\n",
5213	group_sid_string));
5214	goto done;
5215	}
5216
5217	sid_copy(sid, &group_sid);
5218
5219	store_gid_sid_cache(sid, gid);
5220	idmap_cache_set_sid2gid(sid, gid);
5221
5222	ret = true;
5223
5224	done:
5225	TALLOC_FREE(tmp_ctx);
5226	return ret;
5227	}
5228
5229
5230	/*
5231	* The following functions are called only if
5232	* ldapsam:trusted and ldapsam:editposix are
5233	* set to true
5234	*/
5235
5236	/*
5237	* ldapsam_create_user creates a new
5238	* posixAccount and sambaSamAccount object
5239	* in the ldap users subtree
5240	*
5241	* The uid is allocated by winbindd.
5242	*/
5243
5244	static NTSTATUS ldapsam_create_user(struct pdb_methods *my_methods,
5245	TALLOC_CTX tmp_ctx, const char name,
5246	uint32_t acb_info, uint32_t *rid)
5247	{
5248	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5249	LDAPMessage *entry = NULL;
5250	LDAPMessage *result = NULL;
5251	uint32_t num_result;
5252	bool is_machine = False;
5253	bool add_posix = False;
5254	LDAPMod **mods = NULL;
5255	struct samu *user;
5256	char *filter;
5257	char *username;
5258	char *homedir;
5259	char *gidstr;
5260	char *uidstr;
5261	char *shell;
5262	const char *dn = NULL;
5263	struct dom_sid group_sid;
5264	struct dom_sid user_sid;
5265	gid_t gid = -1;
5266	uid_t uid = -1;
5267	NTSTATUS ret;
5268	int rc;
5269
5270	if (((acb_info & ACB_NORMAL) && name[strlen(name)-1] == '$') \|\|
5271	acb_info & ACB_WSTRUST \|\|
5272	acb_info & ACB_SVRTRUST \|\|
5273	acb_info & ACB_DOMTRUST) {
5274	is_machine = True;
5275	}
5276
5277	username = escape_ldap_string(talloc_tos(), name);
5278	filter = talloc_asprintf(tmp_ctx, "(&(uid=%s)(objectClass=%s))",
5279	username, LDAP_OBJ_POSIXACCOUNT);
5280	TALLOC_FREE(username);
5281
5282	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5283	if (rc != LDAP_SUCCESS) {
5284	DEBUG(0,("ldapsam_create_user: ldap search failed!\n"));
5285	return NT_STATUS_ACCESS_DENIED;
5286	}
5287	talloc_autofree_ldapmsg(tmp_ctx, result);
5288
5289	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5290
5291	if (num_result > 1) {
5292	DEBUG (0, ("ldapsam_create_user: More than one user with name [%s] ?!\n", name));
5293	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5294	}
5295
5296	if (num_result == 1) {
5297	char *tmp;
5298	/* check if it is just a posix account.
5299	* or if there is a sid attached to this entry
5300	*/
5301
5302	entry = ldap_first_entry(priv2ld(ldap_state), result);
5303	if (!entry) {
5304	return NT_STATUS_UNSUCCESSFUL;
5305	}
5306
5307	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "sambaSID", tmp_ctx);
5308	if (tmp) {
5309	DEBUG (1, ("ldapsam_create_user: The user [%s] already exist!\n", name));
5310	return NT_STATUS_USER_EXISTS;
5311	}
5312
5313	/* it is just a posix account, retrieve the dn for later use */
5314	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5315	if (!dn) {
5316	DEBUG(0,("ldapsam_create_user: Out of memory!\n"));
5317	return NT_STATUS_NO_MEMORY;
5318	}
5319	}
5320
5321	if (num_result == 0) {
5322	add_posix = True;
5323	}
5324
5325	/* Create the basic samu structure and generate the mods for the ldap commit */
5326	if (!NT_STATUS_IS_OK((ret = ldapsam_new_rid_internal(my_methods, rid)))) {
5327	DEBUG(1, ("ldapsam_create_user: Could not allocate a new RID\n"));
5328	return ret;
5329	}
5330
5331	sid_compose(&user_sid, get_global_sam_sid(), *rid);
5332
5333	user = samu_new(tmp_ctx);
5334	if (!user) {
5335	DEBUG(1,("ldapsam_create_user: Unable to allocate user struct\n"));
5336	return NT_STATUS_NO_MEMORY;
5337	}
5338
5339	if (!pdb_set_username(user, name, PDB_SET)) {
5340	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5341	return NT_STATUS_UNSUCCESSFUL;
5342	}
5343	if (!pdb_set_domain(user, get_global_sam_name(), PDB_SET)) {
5344	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5345	return NT_STATUS_UNSUCCESSFUL;
5346	}
5347	if (is_machine) {
5348	if (acb_info & ACB_NORMAL) {
5349	if (!pdb_set_acct_ctrl(user, ACB_WSTRUST, PDB_SET)) {
5350	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5351	return NT_STATUS_UNSUCCESSFUL;
5352	}
5353	} else {
5354	if (!pdb_set_acct_ctrl(user, acb_info, PDB_SET)) {
5355	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5356	return NT_STATUS_UNSUCCESSFUL;
5357	}
5358	}
5359	} else {
5360	if (!pdb_set_acct_ctrl(user, ACB_NORMAL \| ACB_DISABLED, PDB_SET)) {
5361	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5362	return NT_STATUS_UNSUCCESSFUL;
5363	}
5364	}
5365
5366	if (!pdb_set_user_sid(user, &user_sid, PDB_SET)) {
5367	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5368	return NT_STATUS_UNSUCCESSFUL;
5369	}
5370
5371	if (!init_ldap_from_sam(ldap_state, entry, &mods, user, element_is_set_or_changed)) {
5372	DEBUG(1,("ldapsam_create_user: Unable to fill user structs\n"));
5373	return NT_STATUS_UNSUCCESSFUL;
5374	}
5375
5376	if (ldap_state->schema_ver != SCHEMAVER_SAMBASAMACCOUNT) {
5377	DEBUG(1,("ldapsam_create_user: Unsupported schema version\n"));
5378	}
5379	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
5380
5381	if (add_posix) {
5382	char *escape_name;
5383
5384	DEBUG(3,("ldapsam_create_user: Creating new posix user\n"));
5385
5386	/* retrieve the Domain Users group gid */
5387	if (!sid_compose(&group_sid, get_global_sam_sid(), DOMAIN_RID_USERS) \|\|
5388	!sid_to_gid(&group_sid, &gid)) {
5389	DEBUG (0, ("ldapsam_create_user: Unable to get the Domain Users gid: bailing out!\n"));
5390	return NT_STATUS_INVALID_PRIMARY_GROUP;
5391	}
5392
5393	/* lets allocate a new userid for this user */
5394	if (!winbind_allocate_uid(&uid)) {
5395	DEBUG (0, ("ldapsam_create_user: Unable to allocate a new user id: bailing out!\n"));
5396	return NT_STATUS_UNSUCCESSFUL;
5397	}
5398
5399
5400	if (is_machine) {
5401	/* TODO: choose a more appropriate default for machines */
5402	homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), "SMB_workstations_home", ldap_state->domain_name, uid, gid);
5403	shell = talloc_strdup(tmp_ctx, "/bin/false");
5404	} else {
5405	homedir = talloc_sub_specified(tmp_ctx, lp_template_homedir(), name, ldap_state->domain_name, uid, gid);
5406	shell = talloc_sub_specified(tmp_ctx, lp_template_shell(), name, ldap_state->domain_name, uid, gid);
5407	}
5408	uidstr = talloc_asprintf(tmp_ctx, "%u", (unsigned int)uid);
5409	gidstr = talloc_asprintf(tmp_ctx, "%u", (unsigned int)gid);
5410
5411	escape_name = escape_rdn_val_string_alloc(name);
5412	if (!escape_name) {
5413	DEBUG (0, ("ldapsam_create_user: Out of memory!\n"));
5414	return NT_STATUS_NO_MEMORY;
5415	}
5416
5417	if (is_machine) {
5418	dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_machine_suffix ());
5419	} else {
5420	dn = talloc_asprintf(tmp_ctx, "uid=%s,%s", escape_name, lp_ldap_user_suffix ());
5421	}
5422
5423	SAFE_FREE(escape_name);
5424
5425	if (!homedir \|\| !shell \|\| !uidstr \|\| !gidstr \|\| !dn) {
5426	DEBUG (0, ("ldapsam_create_user: Out of memory!\n"));
5427	return NT_STATUS_NO_MEMORY;
5428	}
5429
5430	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
5431	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
5432	smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
5433	smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
5434	smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
5435	smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", homedir);
5436	smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", shell);
5437	}
5438
5439	talloc_autofree_ldapmod(tmp_ctx, mods);
5440
5441	if (add_posix) {
5442	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5443	} else {
5444	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5445	}
5446
5447	if (rc != LDAP_SUCCESS) {
5448	DEBUG(0,("ldapsam_create_user: failed to create a new user [%s] (dn = %s)\n", name ,dn));
5449	return NT_STATUS_UNSUCCESSFUL;
5450	}
5451
5452	DEBUG(2,("ldapsam_create_user: added account [%s] in the LDAP database\n", name));
5453
5454	flush_pwnam_cache();
5455
5456	return NT_STATUS_OK;
5457	}
5458
5459	static NTSTATUS ldapsam_delete_user(struct pdb_methods my_methods, TALLOC_CTX tmp_ctx, struct samu *sam_acct)
5460	{
5461	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5462	LDAPMessage *result = NULL;
5463	LDAPMessage *entry = NULL;
5464	int num_result;
5465	const char *dn;
5466	char *filter;
5467	int rc;
5468
5469	DEBUG(0,("ldapsam_delete_user: Attempt to delete user [%s]\n", pdb_get_username(sam_acct)));
5470
5471	filter = talloc_asprintf(tmp_ctx,
5472	"(&(uid=%s)"
5473	"(objectClass=%s)"
5474	"(objectClass=%s))",
5475	pdb_get_username(sam_acct),
5476	LDAP_OBJ_POSIXACCOUNT,
5477	LDAP_OBJ_SAMBASAMACCOUNT);
5478	if (filter == NULL) {
5479	return NT_STATUS_NO_MEMORY;
5480	}
5481
5482	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5483	if (rc != LDAP_SUCCESS) {
5484	DEBUG(0,("ldapsam_delete_user: user search failed!\n"));
5485	return NT_STATUS_UNSUCCESSFUL;
5486	}
5487	talloc_autofree_ldapmsg(tmp_ctx, result);
5488
5489	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5490
5491	if (num_result == 0) {
5492	DEBUG(0,("ldapsam_delete_user: user not found!\n"));
5493	return NT_STATUS_NO_SUCH_USER;
5494	}
5495
5496	if (num_result > 1) {
5497	DEBUG (0, ("ldapsam_delete_user: More than one user with name [%s] ?!\n", pdb_get_username(sam_acct)));
5498	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5499	}
5500
5501	entry = ldap_first_entry(priv2ld(ldap_state), result);
5502	if (!entry) {
5503	return NT_STATUS_UNSUCCESSFUL;
5504	}
5505
5506	/* it is just a posix account, retrieve the dn for later use */
5507	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5508	if (!dn) {
5509	DEBUG(0,("ldapsam_delete_user: Out of memory!\n"));
5510	return NT_STATUS_NO_MEMORY;
5511	}
5512
5513	/* try to remove memberships first */
5514	{
5515	NTSTATUS status;
5516	struct dom_sid *sids = NULL;
5517	gid_t *gids = NULL;
5518	uint32_t num_groups = 0;
5519	int i;
5520	uint32_t user_rid = pdb_get_user_rid(sam_acct);
5521
5522	status = ldapsam_enum_group_memberships(my_methods,
5523	tmp_ctx,
5524	sam_acct,
5525	&sids,
5526	&gids,
5527	&num_groups);
5528	if (!NT_STATUS_IS_OK(status)) {
5529	goto delete_dn;
5530	}
5531
5532	for (i=0; i < num_groups; i++) {
5533
5534	uint32_t group_rid;
5535
5536	sid_peek_rid(&sids[i], &group_rid);
5537
5538	ldapsam_del_groupmem(my_methods,
5539	tmp_ctx,
5540	group_rid,
5541	user_rid);
5542	}
5543	}
5544
5545	delete_dn:
5546
5547	rc = smbldap_delete(ldap_state->smbldap_state, dn);
5548	if (rc != LDAP_SUCCESS) {
5549	return NT_STATUS_UNSUCCESSFUL;
5550	}
5551
5552	flush_pwnam_cache();
5553
5554	return NT_STATUS_OK;
5555	}
5556
5557	/*
5558	* ldapsam_create_group creates a new
5559	* posixGroup and sambaGroupMapping object
5560	* in the ldap groups subtree
5561	*
5562	* The gid is allocated by winbindd.
5563	*/
5564
5565	static NTSTATUS ldapsam_create_dom_group(struct pdb_methods *my_methods,
5566	TALLOC_CTX *tmp_ctx,
5567	const char *name,
5568	uint32_t *rid)
5569	{
5570	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5571	NTSTATUS ret;
5572	LDAPMessage *entry = NULL;
5573	LDAPMessage *result = NULL;
5574	uint32_t num_result;
5575	bool is_new_entry = False;
5576	LDAPMod **mods = NULL;
5577	char *filter;
5578	char *groupsidstr;
5579	char *groupname;
5580	char *grouptype;
5581	char *gidstr;
5582	const char *dn = NULL;
5583	struct dom_sid group_sid;
5584	gid_t gid = -1;
5585	int rc;
5586
5587	groupname = escape_ldap_string(talloc_tos(), name);
5588	filter = talloc_asprintf(tmp_ctx, "(&(cn=%s)(objectClass=%s))",
5589	groupname, LDAP_OBJ_POSIXGROUP);
5590	TALLOC_FREE(groupname);
5591
5592	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5593	if (rc != LDAP_SUCCESS) {
5594	DEBUG(0,("ldapsam_create_group: ldap search failed!\n"));
5595	return NT_STATUS_UNSUCCESSFUL;
5596	}
5597	talloc_autofree_ldapmsg(tmp_ctx, result);
5598
5599	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5600
5601	if (num_result > 1) {
5602	DEBUG (0, ("ldapsam_create_group: There exists more than one group with name [%s]: bailing out!\n", name));
5603	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5604	}
5605
5606	if (num_result == 1) {
5607	char *tmp;
5608	/* check if it is just a posix group.
5609	* or if there is a sid attached to this entry
5610	*/
5611
5612	entry = ldap_first_entry(priv2ld(ldap_state), result);
5613	if (!entry) {
5614	return NT_STATUS_UNSUCCESSFUL;
5615	}
5616
5617	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "sambaSID", tmp_ctx);
5618	if (tmp) {
5619	DEBUG (1, ("ldapsam_create_group: The group [%s] already exist!\n", name));
5620	return NT_STATUS_GROUP_EXISTS;
5621	}
5622
5623	/* it is just a posix group, retrieve the gid and the dn for later use */
5624	tmp = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5625	if (!tmp) {
5626	DEBUG (1, ("ldapsam_create_group: Couldn't retrieve the gidNumber for [%s]?!?!\n", name));
5627	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5628	}
5629
5630	gid = strtoul(tmp, NULL, 10);
5631
5632	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5633	if (!dn) {
5634	DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
5635	return NT_STATUS_NO_MEMORY;
5636	}
5637	}
5638
5639	if (num_result == 0) {
5640	is_new_entry = true;
5641	}
5642
5643	if (!NT_STATUS_IS_OK((ret = ldapsam_new_rid_internal(my_methods, rid)))) {
5644	DEBUG(1, ("ldapsam_create_group: Could not allocate a new RID\n"));
5645	return ret;
5646	}
5647
5648	sid_compose(&group_sid, get_global_sam_sid(), *rid);
5649
5650	groupsidstr = talloc_strdup(tmp_ctx, sid_string_talloc(tmp_ctx,
5651	&group_sid));
5652	grouptype = talloc_asprintf(tmp_ctx, "%d", SID_NAME_DOM_GRP);
5653
5654	if (!groupsidstr \|\| !grouptype) {
5655	DEBUG(0,("ldapsam_create_group: Out of memory!\n"));
5656	return NT_STATUS_NO_MEMORY;
5657	}
5658
5659	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
5660	smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid", groupsidstr);
5661	smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", grouptype);
5662	smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
5663
5664	if (is_new_entry) {
5665	char *escape_name;
5666
5667	DEBUG(3,("ldapsam_create_user: Creating new posix group\n"));
5668
5669	/* lets allocate a new groupid for this group */
5670	if (!winbind_allocate_gid(&gid)) {
5671	DEBUG (0, ("ldapsam_create_group: Unable to allocate a new group id: bailing out!\n"));
5672	return NT_STATUS_UNSUCCESSFUL;
5673	}
5674
5675	gidstr = talloc_asprintf(tmp_ctx, "%u", (unsigned int)gid);
5676
5677	escape_name = escape_rdn_val_string_alloc(name);
5678	if (!escape_name) {
5679	DEBUG (0, ("ldapsam_create_group: Out of memory!\n"));
5680	return NT_STATUS_NO_MEMORY;
5681	}
5682
5683	dn = talloc_asprintf(tmp_ctx, "cn=%s,%s", escape_name, lp_ldap_group_suffix());
5684
5685	SAFE_FREE(escape_name);
5686
5687	if (!gidstr \|\| !dn) {
5688	DEBUG (0, ("ldapsam_create_group: Out of memory!\n"));
5689	return NT_STATUS_NO_MEMORY;
5690	}
5691
5692	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_POSIXGROUP);
5693	smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
5694	smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
5695	}
5696
5697	talloc_autofree_ldapmod(tmp_ctx, mods);
5698
5699	if (is_new_entry) {
5700	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5701	#if 0
5702	if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
5703	/* This call may fail with rfc2307bis schema */
5704	/* Retry adding a structural class */
5705	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "????");
5706	rc = smbldap_add(ldap_state->smbldap_state, dn, mods);
5707	}
5708	#endif
5709	} else {
5710	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5711	}
5712
5713	if (rc != LDAP_SUCCESS) {
5714	DEBUG(0,("ldapsam_create_group: failed to create a new group [%s] (dn = %s)\n", name ,dn));
5715	return NT_STATUS_UNSUCCESSFUL;
5716	}
5717
5718	DEBUG(2,("ldapsam_create_group: added group [%s] in the LDAP database\n", name));
5719
5720	return NT_STATUS_OK;
5721	}
5722
5723	static NTSTATUS ldapsam_delete_dom_group(struct pdb_methods my_methods, TALLOC_CTX tmp_ctx, uint32_t rid)
5724	{
5725	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5726	LDAPMessage *result = NULL;
5727	LDAPMessage *entry = NULL;
5728	int num_result;
5729	const char *dn;
5730	char *gidstr;
5731	char *filter;
5732	struct dom_sid group_sid;
5733	int rc;
5734
5735	/* get the group sid */
5736	sid_compose(&group_sid, get_global_sam_sid(), rid);
5737
5738	filter = talloc_asprintf(tmp_ctx,
5739	"(&(sambaSID=%s)"
5740	"(objectClass=%s)"
5741	"(objectClass=%s))",
5742	sid_string_talloc(tmp_ctx, &group_sid),
5743	LDAP_OBJ_POSIXGROUP,
5744	LDAP_OBJ_GROUPMAP);
5745	if (filter == NULL) {
5746	return NT_STATUS_NO_MEMORY;
5747	}
5748
5749	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5750	if (rc != LDAP_SUCCESS) {
5751	DEBUG(1,("ldapsam_delete_dom_group: group search failed!\n"));
5752	return NT_STATUS_UNSUCCESSFUL;
5753	}
5754	talloc_autofree_ldapmsg(tmp_ctx, result);
5755
5756	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5757
5758	if (num_result == 0) {
5759	DEBUG(1,("ldapsam_delete_dom_group: group not found!\n"));
5760	return NT_STATUS_NO_SUCH_GROUP;
5761	}
5762
5763	if (num_result > 1) {
5764	DEBUG (0, ("ldapsam_delete_dom_group: More than one group with the same SID ?!\n"));
5765	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5766	}
5767
5768	entry = ldap_first_entry(priv2ld(ldap_state), result);
5769	if (!entry) {
5770	return NT_STATUS_UNSUCCESSFUL;
5771	}
5772
5773	/* here it is, retrieve the dn for later use */
5774	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5775	if (!dn) {
5776	DEBUG(0,("ldapsam_delete_dom_group: Out of memory!\n"));
5777	return NT_STATUS_NO_MEMORY;
5778	}
5779
5780	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5781	if (!gidstr) {
5782	DEBUG (0, ("ldapsam_delete_dom_group: Unable to find the group's gid!\n"));
5783	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5784	}
5785
5786	/* check no user have this group marked as primary group */
5787	filter = talloc_asprintf(tmp_ctx,
5788	"(&(gidNumber=%s)"
5789	"(objectClass=%s)"
5790	"(objectClass=%s))",
5791	gidstr,
5792	LDAP_OBJ_POSIXACCOUNT,
5793	LDAP_OBJ_SAMBASAMACCOUNT);
5794
5795	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5796	if (rc != LDAP_SUCCESS) {
5797	DEBUG(1,("ldapsam_delete_dom_group: accounts search failed!\n"));
5798	return NT_STATUS_UNSUCCESSFUL;
5799	}
5800	talloc_autofree_ldapmsg(tmp_ctx, result);
5801
5802	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5803
5804	if (num_result != 0) {
5805	DEBUG(3,("ldapsam_delete_dom_group: Can't delete group, it is a primary group for %d users\n", num_result));
5806	return NT_STATUS_MEMBERS_PRIMARY_GROUP;
5807	}
5808
5809	rc = smbldap_delete(ldap_state->smbldap_state, dn);
5810	if (rc != LDAP_SUCCESS) {
5811	return NT_STATUS_UNSUCCESSFUL;
5812	}
5813
5814	return NT_STATUS_OK;
5815	}
5816
5817	static NTSTATUS ldapsam_change_groupmem(struct pdb_methods *my_methods,
5818	TALLOC_CTX *tmp_ctx,
5819	uint32_t group_rid,
5820	uint32_t member_rid,
5821	int modop)
5822	{
5823	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5824	LDAPMessage *entry = NULL;
5825	LDAPMessage *result = NULL;
5826	uint32_t num_result;
5827	LDAPMod **mods = NULL;
5828	char *filter;
5829	char *uidstr;
5830	const char *dn = NULL;
5831	struct dom_sid group_sid;
5832	struct dom_sid member_sid;
5833	int rc;
5834
5835	switch (modop) {
5836	case LDAP_MOD_ADD:
5837	DEBUG(1,("ldapsam_change_groupmem: add new member(rid=%d) to a domain group(rid=%d)", member_rid, group_rid));
5838	break;
5839	case LDAP_MOD_DELETE:
5840	DEBUG(1,("ldapsam_change_groupmem: delete member(rid=%d) from a domain group(rid=%d)", member_rid, group_rid));
5841	break;
5842	default:
5843	return NT_STATUS_UNSUCCESSFUL;
5844	}
5845
5846	/* get member sid */
5847	sid_compose(&member_sid, get_global_sam_sid(), member_rid);
5848
5849	/* get the group sid */
5850	sid_compose(&group_sid, get_global_sam_sid(), group_rid);
5851
5852	filter = talloc_asprintf(tmp_ctx,
5853	"(&(sambaSID=%s)"
5854	"(objectClass=%s)"
5855	"(objectClass=%s))",
5856	sid_string_talloc(tmp_ctx, &member_sid),
5857	LDAP_OBJ_POSIXACCOUNT,
5858	LDAP_OBJ_SAMBASAMACCOUNT);
5859	if (filter == NULL) {
5860	return NT_STATUS_NO_MEMORY;
5861	}
5862
5863	/* get the member uid */
5864	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5865	if (rc != LDAP_SUCCESS) {
5866	DEBUG(1,("ldapsam_change_groupmem: member search failed!\n"));
5867	return NT_STATUS_UNSUCCESSFUL;
5868	}
5869	talloc_autofree_ldapmsg(tmp_ctx, result);
5870
5871	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5872
5873	if (num_result == 0) {
5874	DEBUG(1,("ldapsam_change_groupmem: member not found!\n"));
5875	return NT_STATUS_NO_SUCH_MEMBER;
5876	}
5877
5878	if (num_result > 1) {
5879	DEBUG (0, ("ldapsam_change_groupmem: More than one account with the same SID ?!\n"));
5880	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5881	}
5882
5883	entry = ldap_first_entry(priv2ld(ldap_state), result);
5884	if (!entry) {
5885	return NT_STATUS_UNSUCCESSFUL;
5886	}
5887
5888	if (modop == LDAP_MOD_DELETE) {
5889	/* check if we are trying to remove the member from his primary group */
5890	char *gidstr;
5891	gid_t user_gid, group_gid;
5892
5893	gidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "gidNumber", tmp_ctx);
5894	if (!gidstr) {
5895	DEBUG (0, ("ldapsam_change_groupmem: Unable to find the member's gid!\n"));
5896	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5897	}
5898
5899	user_gid = strtoul(gidstr, NULL, 10);
5900
5901	if (!sid_to_gid(&group_sid, &group_gid)) {
5902	DEBUG (0, ("ldapsam_change_groupmem: Unable to get group gid from SID!\n"));
5903	return NT_STATUS_UNSUCCESSFUL;
5904	}
5905
5906	if (user_gid == group_gid) {
5907	DEBUG (3, ("ldapsam_change_groupmem: can't remove user from its own primary group!\n"));
5908	return NT_STATUS_MEMBERS_PRIMARY_GROUP;
5909	}
5910	}
5911
5912	/* here it is, retrieve the uid for later use */
5913	uidstr = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, "uid", tmp_ctx);
5914	if (!uidstr) {
5915	DEBUG (0, ("ldapsam_change_groupmem: Unable to find the member's name!\n"));
5916	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5917	}
5918
5919	filter = talloc_asprintf(tmp_ctx,
5920	"(&(sambaSID=%s)"
5921	"(objectClass=%s)"
5922	"(objectClass=%s))",
5923	sid_string_talloc(tmp_ctx, &group_sid),
5924	LDAP_OBJ_POSIXGROUP,
5925	LDAP_OBJ_GROUPMAP);
5926
5927	/* get the group */
5928	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
5929	if (rc != LDAP_SUCCESS) {
5930	DEBUG(1,("ldapsam_change_groupmem: group search failed!\n"));
5931	return NT_STATUS_UNSUCCESSFUL;
5932	}
5933	talloc_autofree_ldapmsg(tmp_ctx, result);
5934
5935	num_result = ldap_count_entries(priv2ld(ldap_state), result);
5936
5937	if (num_result == 0) {
5938	DEBUG(1,("ldapsam_change_groupmem: group not found!\n"));
5939	return NT_STATUS_NO_SUCH_GROUP;
5940	}
5941
5942	if (num_result > 1) {
5943	DEBUG (0, ("ldapsam_change_groupmem: More than one group with the same SID ?!\n"));
5944	return NT_STATUS_INTERNAL_DB_CORRUPTION;
5945	}
5946
5947	entry = ldap_first_entry(priv2ld(ldap_state), result);
5948	if (!entry) {
5949	return NT_STATUS_UNSUCCESSFUL;
5950	}
5951
5952	/* here it is, retrieve the dn for later use */
5953	dn = smbldap_talloc_dn(tmp_ctx, priv2ld(ldap_state), entry);
5954	if (!dn) {
5955	DEBUG(0,("ldapsam_change_groupmem: Out of memory!\n"));
5956	return NT_STATUS_NO_MEMORY;
5957	}
5958
5959	smbldap_set_mod(&mods, modop, "memberUid", uidstr);
5960
5961	talloc_autofree_ldapmod(tmp_ctx, mods);
5962
5963	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
5964	if (rc != LDAP_SUCCESS) {
5965	if (rc == LDAP_TYPE_OR_VALUE_EXISTS && modop == LDAP_MOD_ADD) {
5966	DEBUG(1,("ldapsam_change_groupmem: member is already in group, add failed!\n"));
5967	return NT_STATUS_MEMBER_IN_GROUP;
5968	}
5969	if (rc == LDAP_NO_SUCH_ATTRIBUTE && modop == LDAP_MOD_DELETE) {
5970	DEBUG(1,("ldapsam_change_groupmem: member is not in group, delete failed!\n"));
5971	return NT_STATUS_MEMBER_NOT_IN_GROUP;
5972	}
5973	return NT_STATUS_UNSUCCESSFUL;
5974	}
5975
5976	return NT_STATUS_OK;
5977	}
5978
5979	static NTSTATUS ldapsam_add_groupmem(struct pdb_methods *my_methods,
5980	TALLOC_CTX *tmp_ctx,
5981	uint32_t group_rid,
5982	uint32_t member_rid)
5983	{
5984	return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_ADD);
5985	}
5986	static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
5987	TALLOC_CTX *tmp_ctx,
5988	uint32_t group_rid,
5989	uint32_t member_rid)
5990	{
5991	return ldapsam_change_groupmem(my_methods, tmp_ctx, group_rid, member_rid, LDAP_MOD_DELETE);
5992	}
5993
5994	static NTSTATUS ldapsam_set_primary_group(struct pdb_methods *my_methods,
5995	TALLOC_CTX *mem_ctx,
5996	struct samu *sampass)
5997	{
5998	struct ldapsam_privates ldap_state = (struct ldapsam_privates )my_methods->private_data;
5999	LDAPMessage *entry = NULL;
6000	LDAPMessage *result = NULL;
6001	uint32_t num_result;
6002	LDAPMod **mods = NULL;
6003	char *filter;
6004	char *escape_username;
6005	char *gidstr;
6006	const char *dn = NULL;
6007	gid_t gid;
6008	int rc;
6009
6010	DEBUG(0,("ldapsam_set_primary_group: Attempt to set primary group for user [%s]\n", pdb_get_username(sampass)));
6011
6012	if (!sid_to_gid(pdb_get_group_sid(sampass), &gid)) {
6013	DEBUG(0,("ldapsam_set_primary_group: failed to retrieve gid from user's group SID!\n"));
6014	return NT_STATUS_UNSUCCESSFUL;
6015	}
6016	gidstr = talloc_asprintf(mem_ctx, "%u", (unsigned int)gid);
6017	if (!gidstr) {
6018	DEBUG(0,("ldapsam_set_primary_group: Out of Memory!\n"));
6019	return NT_STATUS_NO_MEMORY;
6020	}
6021
6022	escape_username = escape_ldap_string(talloc_tos(),
6023	pdb_get_username(sampass));
6024	if (escape_username== NULL) {
6025	return NT_STATUS_NO_MEMORY;
6026	}
6027
6028	filter = talloc_asprintf(mem_ctx,
6029	"(&(uid=%s)"
6030	"(objectClass=%s)"
6031	"(objectClass=%s))",
6032	escape_username,
6033	LDAP_OBJ_POSIXACCOUNT,
6034	LDAP_OBJ_SAMBASAMACCOUNT);
6035
6036	TALLOC_FREE(escape_username);
6037
6038	if (filter == NULL) {
6039	return NT_STATUS_NO_MEMORY;
6040	}
6041
6042	rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL, &result);
6043	if (rc != LDAP_SUCCESS) {
6044	DEBUG(0,("ldapsam_set_primary_group: user search failed!\n"));
6045	return NT_STATUS_UNSUCCESSFUL;
6046	}
6047	talloc_autofree_ldapmsg(mem_ctx, result);
6048
6049	num_result = ldap_count_entries(priv2ld(ldap_state), result);
6050
6051	if (num_result == 0) {
6052	DEBUG(0,("ldapsam_set_primary_group: user not found!\n"));
6053	return NT_STATUS_NO_SUCH_USER;
6054	}
6055
6056	if (num_result > 1) {
6057	DEBUG (0, ("ldapsam_set_primary_group: More than one user with name [%s] ?!\n", pdb_get_username(sampass)));
6058	return NT_STATUS_INTERNAL_DB_CORRUPTION;
6059	}
6060
6061	entry = ldap_first_entry(priv2ld(ldap_state), result);
6062	if (!entry) {
6063	return NT_STATUS_UNSUCCESSFUL;
6064	}
6065
6066	/* retrieve the dn for later use */
6067	dn = smbldap_talloc_dn(mem_ctx, priv2ld(ldap_state), entry);
6068	if (!dn) {
6069	DEBUG(0,("ldapsam_set_primary_group: Out of memory!\n"));
6070	return NT_STATUS_NO_MEMORY;
6071	}
6072
6073	/* remove the old one, and add the new one, this way we do not risk races */
6074	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "gidNumber", gidstr);
6075
6076	if (mods == NULL) {
6077	return NT_STATUS_OK;
6078	}
6079
6080	rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
6081
6082	if (rc != LDAP_SUCCESS) {
6083	DEBUG(0,("ldapsam_set_primary_group: failed to modify [%s] primary group to [%s]\n",
6084	pdb_get_username(sampass), gidstr));
6085	return NT_STATUS_UNSUCCESSFUL;
6086	}
6087
6088	flush_pwnam_cache();
6089
6090	return NT_STATUS_OK;
6091	}
6092
6093
6094	/**********************************************************************
6095	trusted domains functions
6096	*********************************************************************/
6097
6098	static char trusteddom_dn(struct ldapsam_privates ldap_state,
6099	const char *domain)
6100	{
6101	return talloc_asprintf(talloc_tos(), "sambaDomainName=%s,%s", domain,
6102	ldap_state->domain_dn);
6103	}
6104
6105	static bool get_trusteddom_pw_int(struct ldapsam_privates *ldap_state,
6106	TALLOC_CTX *mem_ctx,
6107	const char domain, LDAPMessage *entry)
6108	{
6109	int rc;
6110	char *filter;
6111	int scope = LDAP_SCOPE_SUBTREE;
6112	const char *attrs = NULL; / NULL: get all attrs */
6113	int attrsonly = 0; /* 0: return values too */
6114	LDAPMessage *result = NULL;
6115	char *trusted_dn;
6116	uint32_t num_result;
6117
6118	filter = talloc_asprintf(talloc_tos(),
6119	"(&(objectClass=%s)(sambaDomainName=%s))",
6120	LDAP_OBJ_TRUSTDOM_PASSWORD, domain);
6121
6122	trusted_dn = trusteddom_dn(ldap_state, domain);
6123	if (trusted_dn == NULL) {
6124	return False;
6125	}
6126	rc = smbldap_search(ldap_state->smbldap_state, trusted_dn, scope,
6127	filter, attrs, attrsonly, &result);
6128
6129	if (result != NULL) {
6130	talloc_autofree_ldapmsg(mem_ctx, result);
6131	}
6132
6133	if (rc == LDAP_NO_SUCH_OBJECT) {
6134	*entry = NULL;
6135	return True;
6136	}
6137
6138	if (rc != LDAP_SUCCESS) {
6139	return False;
6140	}
6141
6142	num_result = ldap_count_entries(priv2ld(ldap_state), result);
6143
6144	if (num_result > 1) {
6145	DEBUG(1, ("ldapsam_get_trusteddom_pw: more than one "
6146	"%s object for domain '%s'?!\n",
6147	LDAP_OBJ_TRUSTDOM_PASSWORD, domain));
6148	return False;
6149	}
6150
6151	if (num_result == 0) {
6152	DEBUG(1, ("ldapsam_get_trusteddom_pw: no "
6153	"%s object for domain %s.\n",
6154	LDAP_OBJ_TRUSTDOM_PASSWORD, domain));
6155	*entry = NULL;
6156	} else {
6157	*entry = ldap_first_entry(priv2ld(ldap_state), result);
6158	}
6159
6160	return True;
6161	}
6162
6163	static bool ldapsam_get_trusteddom_pw(struct pdb_methods *methods,
6164	const char *domain,
6165	char** pwd,
6166	struct dom_sid *sid,
6167	time_t *pass_last_set_time)
6168	{
6169	struct ldapsam_privates *ldap_state =
6170	(struct ldapsam_privates *)methods->private_data;
6171	LDAPMessage *entry = NULL;
6172
6173	DEBUG(10, ("ldapsam_get_trusteddom_pw called for domain %s\n", domain));
6174
6175	if (!get_trusteddom_pw_int(ldap_state, talloc_tos(), domain, &entry) \|\|
6176	(entry == NULL))
6177	{
6178	return False;
6179	}
6180
6181	/* password */
6182	if (pwd != NULL) {
6183	char *pwd_str;
6184	pwd_str = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6185	entry, "sambaClearTextPassword", talloc_tos());
6186	if (pwd_str == NULL) {
6187	return False;
6188	}
6189	/* trusteddom_pw routines do not use talloc yet... */
6190	*pwd = SMB_STRDUP(pwd_str);
6191	if (*pwd == NULL) {
6192	return False;
6193	}
6194	}
6195
6196	/* last change time */
6197	if (pass_last_set_time != NULL) {
6198	char *time_str;
6199	time_str = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6200	entry, "sambaPwdLastSet", talloc_tos());
6201	if (time_str == NULL) {
6202	return False;
6203	}
6204	*pass_last_set_time = (time_t)atol(time_str);
6205	}
6206
6207	/* domain sid */
6208	if (sid != NULL) {
6209	char *sid_str;
6210	struct dom_sid dom_sid;
6211	sid_str = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6212	entry, "sambaSID",
6213	talloc_tos());
6214	if (sid_str == NULL) {
6215	return False;
6216	}
6217	if (!string_to_sid(&dom_sid, sid_str)) {
6218	return False;
6219	}
6220	sid_copy(sid, &dom_sid);
6221	}
6222
6223	return True;
6224	}
6225
6226	static bool ldapsam_set_trusteddom_pw(struct pdb_methods *methods,
6227	const char* domain,
6228	const char* pwd,
6229	const struct dom_sid *sid)
6230	{
6231	struct ldapsam_privates *ldap_state =
6232	(struct ldapsam_privates *)methods->private_data;
6233	LDAPMessage *entry = NULL;
6234	LDAPMod **mods = NULL;
6235	char *prev_pwd = NULL;
6236	char *trusted_dn = NULL;
6237	int rc;
6238
6239	DEBUG(10, ("ldapsam_set_trusteddom_pw called for domain %s\n", domain));
6240
6241	/*
6242	* get the current entry (if there is one) in order to put the
6243	* current password into the previous password attribute
6244	*/
6245	if (!get_trusteddom_pw_int(ldap_state, talloc_tos(), domain, &entry)) {
6246	return False;
6247	}
6248
6249	mods = NULL;
6250	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "objectClass",
6251	LDAP_OBJ_TRUSTDOM_PASSWORD);
6252	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "sambaDomainName",
6253	domain);
6254	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "sambaSID",
6255	sid_string_tos(sid));
6256	smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "sambaPwdLastSet",
6257	talloc_asprintf(talloc_tos(), "%li", (long int)time(NULL)));
6258	smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
6259	"sambaClearTextPassword", pwd);
6260
6261	if (entry != NULL) {
6262	prev_pwd = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6263	entry, "sambaClearTextPassword", talloc_tos());
6264	if (prev_pwd != NULL) {
6265	smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
6266	"sambaPreviousClearTextPassword",
6267	prev_pwd);
6268	}
6269	}
6270
6271	talloc_autofree_ldapmod(talloc_tos(), mods);
6272
6273	trusted_dn = trusteddom_dn(ldap_state, domain);
6274	if (trusted_dn == NULL) {
6275	return False;
6276	}
6277	if (entry == NULL) {
6278	rc = smbldap_add(ldap_state->smbldap_state, trusted_dn, mods);
6279	} else {
6280	rc = smbldap_modify(ldap_state->smbldap_state, trusted_dn, mods);
6281	}
6282
6283	if (rc != LDAP_SUCCESS) {
6284	DEBUG(1, ("error writing trusted domain password!\n"));
6285	return False;
6286	}
6287
6288	return True;
6289	}
6290
6291	static bool ldapsam_del_trusteddom_pw(struct pdb_methods *methods,
6292	const char *domain)
6293	{
6294	int rc;
6295	struct ldapsam_privates *ldap_state =
6296	(struct ldapsam_privates *)methods->private_data;
6297	LDAPMessage *entry = NULL;
6298	const char *trusted_dn;
6299
6300	if (!get_trusteddom_pw_int(ldap_state, talloc_tos(), domain, &entry)) {
6301	return False;
6302	}
6303
6304	if (entry == NULL) {
6305	DEBUG(5, ("ldapsam_del_trusteddom_pw: no such trusted domain: "
6306	"%s\n", domain));
6307	return True;
6308	}
6309
6310	trusted_dn = smbldap_talloc_dn(talloc_tos(), priv2ld(ldap_state),
6311	entry);
6312	if (trusted_dn == NULL) {
6313	DEBUG(0,("ldapsam_del_trusteddom_pw: Out of memory!\n"));
6314	return False;
6315	}
6316
6317	rc = smbldap_delete(ldap_state->smbldap_state, trusted_dn);
6318	if (rc != LDAP_SUCCESS) {
6319	return False;
6320	}
6321
6322	return True;
6323	}
6324
6325	static NTSTATUS ldapsam_enum_trusteddoms(struct pdb_methods *methods,
6326	TALLOC_CTX *mem_ctx,
6327	uint32_t *num_domains,
6328	struct trustdom_info ***domains)
6329	{
6330	int rc;
6331	struct ldapsam_privates *ldap_state =
6332	(struct ldapsam_privates *)methods->private_data;
6333	char *filter;
6334	int scope = LDAP_SCOPE_SUBTREE;
6335	const char *attrs[] = { "sambaDomainName", "sambaSID", NULL };
6336	int attrsonly = 0; /* 0: return values too */
6337	LDAPMessage *result = NULL;
6338	LDAPMessage *entry = NULL;
6339
6340	filter = talloc_asprintf(talloc_tos(), "(objectClass=%s)",
6341	LDAP_OBJ_TRUSTDOM_PASSWORD);
6342
6343	rc = smbldap_search(ldap_state->smbldap_state,
6344	ldap_state->domain_dn,
6345	scope,
6346	filter,
6347	attrs,
6348	attrsonly,
6349	&result);
6350
6351	if (result != NULL) {
6352	talloc_autofree_ldapmsg(mem_ctx, result);
6353	}
6354
6355	if (rc != LDAP_SUCCESS) {
6356	return NT_STATUS_UNSUCCESSFUL;
6357	}
6358
6359	*num_domains = 0;
6360	if (!(domains = TALLOC_ARRAY(mem_ctx, struct trustdom_info , 1))) {
6361	DEBUG(1, ("talloc failed\n"));
6362	return NT_STATUS_NO_MEMORY;
6363	}
6364
6365	for (entry = ldap_first_entry(priv2ld(ldap_state), result);
6366	entry != NULL;
6367	entry = ldap_next_entry(priv2ld(ldap_state), entry))
6368	{
6369	char dom_name, dom_sid_str;
6370	struct trustdom_info *dom_info;
6371
6372	dom_info = TALLOC_P(*domains, struct trustdom_info);
6373	if (dom_info == NULL) {
6374	DEBUG(1, ("talloc failed\n"));
6375	return NT_STATUS_NO_MEMORY;
6376	}
6377
6378	dom_name = smbldap_talloc_single_attribute(priv2ld(ldap_state),
6379	entry,
6380	"sambaDomainName",
6381	talloc_tos());
6382	if (dom_name == NULL) {
6383	DEBUG(1, ("talloc failed\n"));
6384	return NT_STATUS_NO_MEMORY;
6385	}
6386	dom_info->name = dom_name;
6387
6388	dom_sid_str = smbldap_talloc_single_attribute(
6389	priv2ld(ldap_state), entry, "sambaSID",
6390	talloc_tos());
6391	if (dom_sid_str == NULL) {
6392	DEBUG(1, ("talloc failed\n"));
6393	return NT_STATUS_NO_MEMORY;
6394	}
6395	if (!string_to_sid(&dom_info->sid, dom_sid_str)) {
6396	DEBUG(1, ("Error calling string_to_sid on SID %s\n",
6397	dom_sid_str));
6398	return NT_STATUS_UNSUCCESSFUL;
6399	}
6400
6401	ADD_TO_ARRAY(domains, struct trustdom_info , dom_info,
6402	domains, num_domains);
6403
6404	if (*domains == NULL) {
6405	DEBUG(1, ("talloc failed\n"));
6406	return NT_STATUS_NO_MEMORY;
6407	}
6408	}
6409
6410	DEBUG(5, ("ldapsam_enum_trusteddoms: got %d domains\n", *num_domains));
6411	return NT_STATUS_OK;
6412	}
6413
6414
6415	/**********************************************************************
6416	Housekeeping
6417	*********************************************************************/
6418
6419	static void free_private_data(void **vp)
6420	{
6421	struct ldapsam_privates ldap_state = (struct ldapsam_privates )vp;
6422
6423	smbldap_free_struct(&(*ldap_state)->smbldap_state);
6424
6425	if ((*ldap_state)->result != NULL) {
6426	ldap_msgfree((*ldap_state)->result);
6427	(*ldap_state)->result = NULL;
6428	}
6429	if ((*ldap_state)->domain_dn != NULL) {
6430	SAFE_FREE((*ldap_state)->domain_dn);
6431	}
6432
6433	*ldap_state = NULL;
6434
6435	/* No need to free any further, as it is talloc()ed */
6436	}
6437
6438	/*********************************************************************
6439	Intitalise the parts of the pdb_methods structure that are common to
6440	all pdb_ldap modes
6441	*********************************************************************/
6442
6443	static NTSTATUS pdb_init_ldapsam_common(struct pdb_methods *pdb_method, const char location)
6444	{
6445	NTSTATUS nt_status;
6446	struct ldapsam_privates *ldap_state;
6447
6448	if (!NT_STATUS_IS_OK(nt_status = make_pdb_method( pdb_method ))) {
6449	return nt_status;
6450	}
6451
6452	(*pdb_method)->name = "ldapsam";
6453
6454	(*pdb_method)->getsampwnam = ldapsam_getsampwnam;
6455	(*pdb_method)->getsampwsid = ldapsam_getsampwsid;
6456	(*pdb_method)->add_sam_account = ldapsam_add_sam_account;
6457	(*pdb_method)->update_sam_account = ldapsam_update_sam_account;
6458	(*pdb_method)->delete_sam_account = ldapsam_delete_sam_account;
6459	(*pdb_method)->rename_sam_account = ldapsam_rename_sam_account;
6460
6461	(*pdb_method)->getgrsid = ldapsam_getgrsid;
6462	(*pdb_method)->getgrgid = ldapsam_getgrgid;
6463	(*pdb_method)->getgrnam = ldapsam_getgrnam;
6464	(*pdb_method)->add_group_mapping_entry = ldapsam_add_group_mapping_entry;
6465	(*pdb_method)->update_group_mapping_entry = ldapsam_update_group_mapping_entry;
6466	(*pdb_method)->delete_group_mapping_entry = ldapsam_delete_group_mapping_entry;
6467	(*pdb_method)->enum_group_mapping = ldapsam_enum_group_mapping;
6468
6469	(*pdb_method)->get_account_policy = ldapsam_get_account_policy;
6470	(*pdb_method)->set_account_policy = ldapsam_set_account_policy;
6471
6472	(*pdb_method)->get_seq_num = ldapsam_get_seq_num;
6473
6474	(*pdb_method)->capabilities = ldapsam_capabilities;
6475	(*pdb_method)->new_rid = ldapsam_new_rid;
6476
6477	(*pdb_method)->get_trusteddom_pw = ldapsam_get_trusteddom_pw;
6478	(*pdb_method)->set_trusteddom_pw = ldapsam_set_trusteddom_pw;
6479	(*pdb_method)->del_trusteddom_pw = ldapsam_del_trusteddom_pw;
6480	(*pdb_method)->enum_trusteddoms = ldapsam_enum_trusteddoms;
6481
6482	/* TODO: Setup private data and free */
6483
6484	if ( !(ldap_state = TALLOC_ZERO_P(*pdb_method, struct ldapsam_privates)) ) {
6485	DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
6486	return NT_STATUS_NO_MEMORY;
6487	}
6488
6489	nt_status = smbldap_init(*pdb_method, pdb_get_event_context(),
6490	location, &ldap_state->smbldap_state);
6491
6492	if ( !NT_STATUS_IS_OK(nt_status) ) {
6493	return nt_status;
6494	}
6495
6496	if ( !(ldap_state->domain_name = talloc_strdup(*pdb_method, get_global_sam_name()) ) ) {
6497	return NT_STATUS_NO_MEMORY;
6498	}
6499
6500	(*pdb_method)->private_data = ldap_state;
6501
6502	(*pdb_method)->free_private_data = free_private_data;
6503
6504	return NT_STATUS_OK;
6505	}
6506
6507	/**********************************************************************
6508	Initialise the 'compat' mode for pdb_ldap
6509	*********************************************************************/
6510
6511	NTSTATUS pdb_init_ldapsam_compat(struct pdb_methods *pdb_method, const char location)
6512	{
6513	NTSTATUS nt_status;
6514	struct ldapsam_privates *ldap_state;
6515	char *uri = talloc_strdup( NULL, location );
6516
6517	trim_char( uri, '\"', '\"' );
6518	nt_status = pdb_init_ldapsam_common( pdb_method, uri );
6519	if ( uri )
6520	TALLOC_FREE( uri );
6521
6522	if ( !NT_STATUS_IS_OK(nt_status) ) {
6523	return nt_status;
6524	}
6525
6526	(*pdb_method)->name = "ldapsam_compat";
6527
6528	ldap_state = (struct ldapsam_privates )((pdb_method)->private_data);
6529	ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT;
6530
6531	sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
6532
6533	return NT_STATUS_OK;
6534	}
6535
6536	/**********************************************************************
6537	Initialise the normal mode for pdb_ldap
6538	*********************************************************************/
6539
6540	NTSTATUS pdb_init_ldapsam(struct pdb_methods *pdb_method, const char location)
6541	{
6542	NTSTATUS nt_status;
6543	struct ldapsam_privates *ldap_state = NULL;
6544	uint32_t alg_rid_base;
6545	char *alg_rid_base_string = NULL;
6546	LDAPMessage *result = NULL;
6547	LDAPMessage *entry = NULL;
6548	struct dom_sid ldap_domain_sid;
6549	struct dom_sid secrets_domain_sid;
6550	char *domain_sid_string = NULL;
6551	char *dn = NULL;
6552	char *uri = talloc_strdup( NULL, location );
6553
6554	trim_char( uri, '\"', '\"' );
6555	nt_status = pdb_init_ldapsam_common(pdb_method, uri);
6556
6557	TALLOC_FREE(uri);
6558
6559	if (!NT_STATUS_IS_OK(nt_status)) {
6560	return nt_status;
6561	}
6562
6563	(*pdb_method)->name = "ldapsam";
6564
6565	(*pdb_method)->add_aliasmem = ldapsam_add_aliasmem;
6566	(*pdb_method)->del_aliasmem = ldapsam_del_aliasmem;
6567	(*pdb_method)->enum_aliasmem = ldapsam_enum_aliasmem;
6568	(*pdb_method)->enum_alias_memberships = ldapsam_alias_memberships;
6569	(*pdb_method)->search_users = ldapsam_search_users;
6570	(*pdb_method)->search_groups = ldapsam_search_groups;
6571	(*pdb_method)->search_aliases = ldapsam_search_aliases;
6572
6573	if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
6574	(*pdb_method)->enum_group_members = ldapsam_enum_group_members;
6575	(*pdb_method)->enum_group_memberships =
6576	ldapsam_enum_group_memberships;
6577	(*pdb_method)->lookup_rids = ldapsam_lookup_rids;
6578	(*pdb_method)->sid_to_id = ldapsam_sid_to_id;
6579	(*pdb_method)->uid_to_sid = ldapsam_uid_to_sid;
6580	(*pdb_method)->gid_to_sid = ldapsam_gid_to_sid;
6581
6582	if (lp_parm_bool(-1, "ldapsam", "editposix", False)) {
6583	(*pdb_method)->create_user = ldapsam_create_user;
6584	(*pdb_method)->delete_user = ldapsam_delete_user;
6585	(*pdb_method)->create_dom_group = ldapsam_create_dom_group;
6586	(*pdb_method)->delete_dom_group = ldapsam_delete_dom_group;
6587	(*pdb_method)->add_groupmem = ldapsam_add_groupmem;
6588	(*pdb_method)->del_groupmem = ldapsam_del_groupmem;
6589	(*pdb_method)->set_unix_primary_group = ldapsam_set_primary_group;
6590	}
6591	}
6592
6593	ldap_state = (struct ldapsam_privates )((pdb_method)->private_data);
6594	ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
6595
6596	/* Try to setup the Domain Name, Domain SID, algorithmic rid base */
6597
6598	nt_status = smbldap_search_domain_info(ldap_state->smbldap_state,
6599	&result,
6600	ldap_state->domain_name, True);
6601
6602	if ( !NT_STATUS_IS_OK(nt_status) ) {
6603	DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain "
6604	"info, nor add one to the domain\n"));
6605	DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, "
6606	"will be unable to allocate new users/groups, "
6607	"and will risk BDCs having inconsistent SIDs\n"));
6608	sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
6609	return NT_STATUS_OK;
6610	}
6611
6612	/* Given that the above might fail, everything below this must be
6613	* optional */
6614
6615	entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
6616	result);
6617	if (!entry) {
6618	DEBUG(0, ("pdb_init_ldapsam: Could not get domain info "
6619	"entry\n"));
6620	ldap_msgfree(result);
6621	return NT_STATUS_UNSUCCESSFUL;
6622	}
6623
6624	dn = smbldap_talloc_dn(talloc_tos(), ldap_state->smbldap_state->ldap_struct, entry);
6625	if (!dn) {
6626	ldap_msgfree(result);
6627	return NT_STATUS_UNSUCCESSFUL;
6628	}
6629
6630	ldap_state->domain_dn = smb_xstrdup(dn);
6631	TALLOC_FREE(dn);
6632
6633	domain_sid_string = smbldap_talloc_single_attribute(
6634	ldap_state->smbldap_state->ldap_struct,
6635	entry,
6636	get_userattr_key2string(ldap_state->schema_ver,
6637	LDAP_ATTR_USER_SID),
6638	talloc_tos());
6639
6640	if (domain_sid_string) {
6641	bool found_sid;
6642	if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
6643	DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be "
6644	"read as a valid SID\n", domain_sid_string));
6645	ldap_msgfree(result);
6646	TALLOC_FREE(domain_sid_string);
6647	return NT_STATUS_INVALID_PARAMETER;
6648	}
6649	found_sid = secrets_fetch_domain_sid(ldap_state->domain_name,
6650	&secrets_domain_sid);
6651	if (!found_sid \|\| !dom_sid_equal(&secrets_domain_sid,
6652	&ldap_domain_sid)) {
6653	DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain "
6654	"%s based on pdb_ldap results %s -> %s\n",
6655	ldap_state->domain_name,
6656	sid_string_dbg(&secrets_domain_sid),
6657	sid_string_dbg(&ldap_domain_sid)));
6658
6659	/* reset secrets.tdb sid */
6660	secrets_store_domain_sid(ldap_state->domain_name,
6661	&ldap_domain_sid);
6662	DEBUG(1, ("New global sam SID: %s\n",
6663	sid_string_dbg(get_global_sam_sid())));
6664	}
6665	sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
6666	TALLOC_FREE(domain_sid_string);
6667	}
6668
6669	alg_rid_base_string = smbldap_talloc_single_attribute(
6670	ldap_state->smbldap_state->ldap_struct,
6671	entry,
6672	get_attr_key2string( dominfo_attr_list,
6673	LDAP_ATTR_ALGORITHMIC_RID_BASE ),
6674	talloc_tos());
6675	if (alg_rid_base_string) {
6676	alg_rid_base = (uint32_t)atol(alg_rid_base_string);
6677	if (alg_rid_base != algorithmic_rid_base()) {
6678	DEBUG(0, ("The value of 'algorithmic RID base' has "
6679	"changed since the LDAP\n"
6680	"database was initialised. Aborting. \n"));
6681	ldap_msgfree(result);
6682	TALLOC_FREE(alg_rid_base_string);
6683	return NT_STATUS_UNSUCCESSFUL;
6684	}
6685	TALLOC_FREE(alg_rid_base_string);
6686	}
6687	ldap_msgfree(result);
6688
6689	return NT_STATUS_OK;
6690	}
6691
6692	NTSTATUS pdb_ldap_init(void)
6693	{
6694	NTSTATUS nt_status;
6695	if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam)))
6696	return nt_status;
6697
6698	if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_compat", pdb_init_ldapsam_compat)))
6699	return nt_status;
6700
6701	/* Let pdb_nds register backends */
6702	pdb_nds_init();
6703
6704	pdb_ipa_init();
6705
6706	return NT_STATUS_OK;
6707	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: