2 Unix SMB/CIFS implementation.
3 IPA helper functions for SAMBA
4 Copyright (C) Sumit Bose <sbose@redhat.com> 2010
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "libcli/security/dom_sid.h"
24 #include "../librpc/ndr/libndr.h"
25 #include "librpc/gen_ndr/samr.h"
29 #include "passdb/pdb_ldap.h"
30 #include "passdb/pdb_ipa.h"
31 #include "passdb/pdb_ldap_schema.h"
32 #include "lib/util/base64.h"
34 #define IPA_KEYTAB_SET_OID "2.16.840.1.113730.3.8.3.1"
35 #define IPA_MAGIC_ID_STR "999"
37 #define LDAP_TRUST_CONTAINER "ou=system"
38 #define LDAP_ATTRIBUTE_CN "cn"
39 #define LDAP_ATTRIBUTE_TRUST_TYPE "sambaTrustType"
40 #define LDAP_ATTRIBUTE_TRUST_ATTRIBUTES "sambaTrustAttributes"
41 #define LDAP_ATTRIBUTE_TRUST_DIRECTION "sambaTrustDirection"
42 #define LDAP_ATTRIBUTE_TRUST_POSIX_OFFSET "sambaTrustPosixOffset"
43 #define LDAP_ATTRIBUTE_SUPPORTED_ENC_TYPE "sambaSupportedEncryptionTypes"
44 #define LDAP_ATTRIBUTE_TRUST_PARTNER "sambaTrustPartner"
45 #define LDAP_ATTRIBUTE_FLAT_NAME "sambaFlatName"
46 #define LDAP_ATTRIBUTE_TRUST_AUTH_OUTGOING "sambaTrustAuthOutgoing"
47 #define LDAP_ATTRIBUTE_TRUST_AUTH_INCOMING "sambaTrustAuthIncoming"
48 #define LDAP_ATTRIBUTE_SECURITY_IDENTIFIER "sambaSecurityIdentifier"
49 #define LDAP_ATTRIBUTE_TRUST_FOREST_TRUST_INFO "sambaTrustForestTrustInfo"
50 #define LDAP_ATTRIBUTE_OBJECTCLASS "objectClass"
52 #define LDAP_OBJ_KRB_PRINCIPAL "krbPrincipal"
53 #define LDAP_OBJ_KRB_PRINCIPAL_AUX "krbPrincipalAux"
54 #define LDAP_ATTRIBUTE_KRB_PRINCIPAL "krbPrincipalName"
56 #define LDAP_OBJ_IPAOBJECT "ipaObject"
57 #define LDAP_OBJ_IPAHOST "ipaHost"
58 #define LDAP_OBJ_POSIXACCOUNT "posixAccount"
60 #define LDAP_OBJ_GROUPOFNAMES "groupOfNames"
61 #define LDAP_OBJ_NESTEDGROUP "nestedGroup"
62 #define LDAP_OBJ_IPAUSERGROUP "ipaUserGroup"
63 #define LDAP_OBJ_POSIXGROUP "posixGroup"
65 #define HAS_KRB_PRINCIPAL (1<<0)
66 #define HAS_KRB_PRINCIPAL_AUX (1<<1)
67 #define HAS_IPAOBJECT (1<<2)
68 #define HAS_IPAHOST (1<<3)
69 #define HAS_POSIXACCOUNT (1<<4)
70 #define HAS_GROUPOFNAMES (1<<5)
71 #define HAS_NESTEDGROUP (1<<6)
72 #define HAS_IPAUSERGROUP (1<<7)
73 #define HAS_POSIXGROUP (1<<8)
75 struct ipasam_privates {
77 NTSTATUS (*ldapsam_add_sam_account)(struct pdb_methods *,
78 struct samu *sampass);
79 NTSTATUS (*ldapsam_update_sam_account)(struct pdb_methods *,
80 struct samu *sampass);
81 NTSTATUS (*ldapsam_create_user)(struct pdb_methods *my_methods,
82 TALLOC_CTX *tmp_ctx, const char *name,
83 uint32_t acb_info, uint32_t *rid);
84 NTSTATUS (*ldapsam_create_dom_group)(struct pdb_methods *my_methods,
90 static bool ipasam_get_trusteddom_pw(struct pdb_methods *methods,
94 time_t *pass_last_set_time)
99 static bool ipasam_set_trusteddom_pw(struct pdb_methods *methods,
102 const struct dom_sid *sid)
107 static bool ipasam_del_trusteddom_pw(struct pdb_methods *methods,
113 static char *get_account_dn(const char *name)
118 escape_name = escape_rdn_val_string_alloc(name);
123 if (name[strlen(name)-1] == '$') {
124 dn = talloc_asprintf(talloc_tos(), "uid=%s,%s", escape_name,
125 lp_ldap_machine_suffix(talloc_tos()));
127 dn = talloc_asprintf(talloc_tos(), "uid=%s,%s", escape_name,
128 lp_ldap_user_suffix(talloc_tos()));
131 SAFE_FREE(escape_name);
136 static char *trusted_domain_dn(struct ldapsam_privates *ldap_state,
139 return talloc_asprintf(talloc_tos(), "%s=%s,%s,%s",
140 LDAP_ATTRIBUTE_CN, domain,
141 LDAP_TRUST_CONTAINER, ldap_state->domain_dn);
144 static char *trusted_domain_base_dn(struct ldapsam_privates *ldap_state)
146 return talloc_asprintf(talloc_tos(), "%s,%s",
147 LDAP_TRUST_CONTAINER, ldap_state->domain_dn);
150 static bool get_trusted_domain_int(struct ldapsam_privates *ldap_state,
152 const char *filter, LDAPMessage **entry)
155 char *base_dn = NULL;
156 LDAPMessage *result = NULL;
159 base_dn = trusted_domain_base_dn(ldap_state);
160 if (base_dn == NULL) {
164 rc = smbldap_search(ldap_state->smbldap_state, base_dn,
165 LDAP_SCOPE_SUBTREE, filter, NULL, 0, &result);
166 TALLOC_FREE(base_dn);
168 if (result != NULL) {
169 smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
172 if (rc == LDAP_NO_SUCH_OBJECT) {
177 if (rc != LDAP_SUCCESS) {
181 num_result = ldap_count_entries(priv2ld(ldap_state), result);
183 if (num_result > 1) {
184 DEBUG(1, ("get_trusted_domain_int: more than one "
185 "%s object with filter '%s'?!\n",
186 LDAP_OBJ_TRUSTED_DOMAIN, filter));
190 if (num_result == 0) {
191 DEBUG(1, ("get_trusted_domain_int: no "
192 "%s object with filter '%s'.\n",
193 LDAP_OBJ_TRUSTED_DOMAIN, filter));
196 *entry = ldap_first_entry(priv2ld(ldap_state), result);
202 static bool get_trusted_domain_by_name_int(struct ldapsam_privates *ldap_state,
209 filter = talloc_asprintf(talloc_tos(),
210 "(&(objectClass=%s)(|(%s=%s)(%s=%s)(cn=%s)))",
211 LDAP_OBJ_TRUSTED_DOMAIN,
212 LDAP_ATTRIBUTE_FLAT_NAME, domain,
213 LDAP_ATTRIBUTE_TRUST_PARTNER, domain, domain);
214 if (filter == NULL) {
218 return get_trusted_domain_int(ldap_state, mem_ctx, filter, entry);
221 static bool get_trusted_domain_by_sid_int(struct ldapsam_privates *ldap_state,
223 const char *sid, LDAPMessage **entry)
227 filter = talloc_asprintf(talloc_tos(), "(&(objectClass=%s)(%s=%s))",
228 LDAP_OBJ_TRUSTED_DOMAIN,
229 LDAP_ATTRIBUTE_SECURITY_IDENTIFIER, sid);
230 if (filter == NULL) {
234 return get_trusted_domain_int(ldap_state, mem_ctx, filter, entry);
237 static bool get_uint32_t_from_ldap_msg(struct ldapsam_privates *ldap_state,
246 dummy = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry,
249 DEBUG(9, ("Attribute %s not present.\n", attr));
254 l = strtoul(dummy, &endptr, 10);
257 if (l < 0 || l > UINT32_MAX || *endptr != '\0') {
266 static void get_data_blob_from_ldap_msg(TALLOC_CTX *mem_ctx,
267 struct ldapsam_privates *ldap_state,
268 LDAPMessage *entry, const char *attr,
274 dummy = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, attr,
277 DEBUG(9, ("Attribute %s not present.\n", attr));
280 blob = base64_decode_data_blob(dummy);
281 if (blob.length == 0) {
284 _blob->length = blob.length;
285 _blob->data = talloc_steal(mem_ctx, blob.data);
291 static bool fill_pdb_trusted_domain(TALLOC_CTX *mem_ctx,
292 struct ldapsam_privates *ldap_state,
294 struct pdb_trusted_domain **_td)
298 struct pdb_trusted_domain *td;
304 td = talloc_zero(mem_ctx, struct pdb_trusted_domain);
309 /* All attributes are MAY */
311 dummy = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry,
312 LDAP_ATTRIBUTE_SECURITY_IDENTIFIER,
315 DEBUG(9, ("Attribute %s not present.\n",
316 LDAP_ATTRIBUTE_SECURITY_IDENTIFIER));
317 ZERO_STRUCT(td->security_identifier);
319 res = string_to_sid(&td->security_identifier, dummy);
326 get_data_blob_from_ldap_msg(td, ldap_state, entry,
327 LDAP_ATTRIBUTE_TRUST_AUTH_INCOMING,
328 &td->trust_auth_incoming);
330 get_data_blob_from_ldap_msg(td, ldap_state, entry,
331 LDAP_ATTRIBUTE_TRUST_AUTH_OUTGOING,
332 &td->trust_auth_outgoing);
334 td->netbios_name = smbldap_talloc_single_attribute(priv2ld(ldap_state),
336 LDAP_ATTRIBUTE_FLAT_NAME,
338 if (td->netbios_name == NULL) {
339 DEBUG(9, ("Attribute %s not present.\n",
340 LDAP_ATTRIBUTE_FLAT_NAME));
343 td->domain_name = smbldap_talloc_single_attribute(priv2ld(ldap_state),
345 LDAP_ATTRIBUTE_TRUST_PARTNER,
347 if (td->domain_name == NULL) {
348 DEBUG(9, ("Attribute %s not present.\n",
349 LDAP_ATTRIBUTE_TRUST_PARTNER));
352 res = get_uint32_t_from_ldap_msg(ldap_state, entry,
353 LDAP_ATTRIBUTE_TRUST_DIRECTION,
354 &td->trust_direction);
359 res = get_uint32_t_from_ldap_msg(ldap_state, entry,
360 LDAP_ATTRIBUTE_TRUST_ATTRIBUTES,
361 &td->trust_attributes);
366 res = get_uint32_t_from_ldap_msg(ldap_state, entry,
367 LDAP_ATTRIBUTE_TRUST_TYPE,
373 td->trust_posix_offset = talloc(td, uint32_t);
374 if (td->trust_posix_offset == NULL) {
377 res = get_uint32_t_from_ldap_msg(ldap_state, entry,
378 LDAP_ATTRIBUTE_TRUST_POSIX_OFFSET,
379 td->trust_posix_offset);
384 td->supported_enc_type = talloc(td, uint32_t);
385 if (td->supported_enc_type == NULL) {
388 res = get_uint32_t_from_ldap_msg(ldap_state, entry,
389 LDAP_ATTRIBUTE_SUPPORTED_ENC_TYPE,
390 td->supported_enc_type);
396 get_data_blob_from_ldap_msg(td, ldap_state, entry,
397 LDAP_ATTRIBUTE_TRUST_FOREST_TRUST_INFO,
398 &td->trust_forest_trust_info);
405 static NTSTATUS ipasam_get_trusted_domain(struct pdb_methods *methods,
408 struct pdb_trusted_domain **td)
410 struct ldapsam_privates *ldap_state =
411 (struct ldapsam_privates *)methods->private_data;
412 LDAPMessage *entry = NULL;
414 DEBUG(10, ("ipasam_get_trusted_domain called for domain %s\n", domain));
416 if (!get_trusted_domain_by_name_int(ldap_state, talloc_tos(), domain,
418 return NT_STATUS_UNSUCCESSFUL;
421 DEBUG(5, ("ipasam_get_trusted_domain: no such trusted domain: "
423 return NT_STATUS_NO_SUCH_DOMAIN;
426 if (!fill_pdb_trusted_domain(mem_ctx, ldap_state, entry, td)) {
427 return NT_STATUS_UNSUCCESSFUL;
433 static NTSTATUS ipasam_get_trusted_domain_by_sid(struct pdb_methods *methods,
436 struct pdb_trusted_domain **td)
438 struct ldapsam_privates *ldap_state =
439 (struct ldapsam_privates *)methods->private_data;
440 LDAPMessage *entry = NULL;
443 sid_str = sid_string_tos(sid);
445 DEBUG(10, ("ipasam_get_trusted_domain_by_sid called for sid %s\n",
448 if (!get_trusted_domain_by_sid_int(ldap_state, talloc_tos(), sid_str,
450 return NT_STATUS_UNSUCCESSFUL;
453 DEBUG(5, ("ipasam_get_trusted_domain_by_sid: no trusted domain "
454 "with sid: %s\n", sid_str));
455 return NT_STATUS_NO_SUCH_DOMAIN;
458 if (!fill_pdb_trusted_domain(mem_ctx, ldap_state, entry, td)) {
459 return NT_STATUS_UNSUCCESSFUL;
465 static bool smbldap_make_mod_uint32_t(LDAP *ldap_struct, LDAPMessage *entry,
466 LDAPMod ***mods, const char *attribute,
471 dummy = talloc_asprintf(talloc_tos(), "%lu", (unsigned long) val);
475 smbldap_make_mod(ldap_struct, entry, mods, attribute, dummy);
481 static NTSTATUS ipasam_set_trusted_domain(struct pdb_methods *methods,
483 const struct pdb_trusted_domain *td)
485 struct ldapsam_privates *ldap_state =
486 (struct ldapsam_privates *)methods->private_data;
487 LDAPMessage *entry = NULL;
490 char *trusted_dn = NULL;
493 DEBUG(10, ("ipasam_set_trusted_domain called for domain %s\n", domain));
495 res = get_trusted_domain_by_name_int(ldap_state, talloc_tos(), domain,
498 return NT_STATUS_UNSUCCESSFUL;
502 smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "objectClass",
503 LDAP_OBJ_TRUSTED_DOMAIN);
505 if (td->netbios_name != NULL) {
506 smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
507 LDAP_ATTRIBUTE_FLAT_NAME,
511 if (td->domain_name != NULL) {
512 smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
513 LDAP_ATTRIBUTE_TRUST_PARTNER,
517 if (!is_null_sid(&td->security_identifier)) {
518 smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
519 LDAP_ATTRIBUTE_SECURITY_IDENTIFIER,
520 sid_string_tos(&td->security_identifier));
523 if (td->trust_type != 0) {
524 res = smbldap_make_mod_uint32_t(priv2ld(ldap_state), entry,
525 &mods, LDAP_ATTRIBUTE_TRUST_TYPE,
528 return NT_STATUS_UNSUCCESSFUL;
532 if (td->trust_attributes != 0) {
533 res = smbldap_make_mod_uint32_t(priv2ld(ldap_state), entry,
535 LDAP_ATTRIBUTE_TRUST_ATTRIBUTES,
536 td->trust_attributes);
538 return NT_STATUS_UNSUCCESSFUL;
542 if (td->trust_direction != 0) {
543 res = smbldap_make_mod_uint32_t(priv2ld(ldap_state), entry,
545 LDAP_ATTRIBUTE_TRUST_DIRECTION,
546 td->trust_direction);
548 return NT_STATUS_UNSUCCESSFUL;
552 if (td->trust_posix_offset != NULL) {
553 res = smbldap_make_mod_uint32_t(priv2ld(ldap_state), entry,
555 LDAP_ATTRIBUTE_TRUST_POSIX_OFFSET,
556 *td->trust_posix_offset);
558 return NT_STATUS_UNSUCCESSFUL;
562 if (td->supported_enc_type != NULL) {
563 res = smbldap_make_mod_uint32_t(priv2ld(ldap_state), entry,
565 LDAP_ATTRIBUTE_SUPPORTED_ENC_TYPE,
566 *td->supported_enc_type);
568 return NT_STATUS_UNSUCCESSFUL;
572 if (td->trust_auth_outgoing.data != NULL) {
573 smbldap_make_mod_blob(priv2ld(ldap_state), entry, &mods,
574 LDAP_ATTRIBUTE_TRUST_AUTH_OUTGOING,
575 &td->trust_auth_outgoing);
578 if (td->trust_auth_incoming.data != NULL) {
579 smbldap_make_mod_blob(priv2ld(ldap_state), entry, &mods,
580 LDAP_ATTRIBUTE_TRUST_AUTH_INCOMING,
581 &td->trust_auth_incoming);
584 if (td->trust_forest_trust_info.data != NULL) {
585 smbldap_make_mod_blob(priv2ld(ldap_state), entry, &mods,
586 LDAP_ATTRIBUTE_TRUST_FOREST_TRUST_INFO,
587 &td->trust_forest_trust_info);
590 smbldap_talloc_autofree_ldapmod(talloc_tos(), mods);
592 trusted_dn = trusted_domain_dn(ldap_state, domain);
593 if (trusted_dn == NULL) {
594 return NT_STATUS_NO_MEMORY;
597 ret = smbldap_add(ldap_state->smbldap_state, trusted_dn, mods);
599 ret = smbldap_modify(ldap_state->smbldap_state, trusted_dn, mods);
602 if (ret != LDAP_SUCCESS) {
603 DEBUG(1, ("error writing trusted domain data!\n"));
604 return NT_STATUS_UNSUCCESSFUL;
609 static NTSTATUS ipasam_del_trusted_domain(struct pdb_methods *methods,
613 struct ldapsam_privates *ldap_state =
614 (struct ldapsam_privates *)methods->private_data;
615 LDAPMessage *entry = NULL;
618 if (!get_trusted_domain_by_name_int(ldap_state, talloc_tos(), domain,
620 return NT_STATUS_UNSUCCESSFUL;
624 DEBUG(5, ("ipasam_del_trusted_domain: no such trusted domain: "
626 return NT_STATUS_NO_SUCH_DOMAIN;
629 dn = smbldap_talloc_dn(talloc_tos(), priv2ld(ldap_state), entry);
631 DEBUG(0,("ipasam_del_trusted_domain: Out of memory!\n"));
632 return NT_STATUS_NO_MEMORY;
635 ret = smbldap_delete(ldap_state->smbldap_state, dn);
636 if (ret != LDAP_SUCCESS) {
637 return NT_STATUS_UNSUCCESSFUL;
643 static NTSTATUS ipasam_enum_trusted_domains(struct pdb_methods *methods,
645 uint32_t *num_domains,
646 struct pdb_trusted_domain ***domains)
649 struct ldapsam_privates *ldap_state =
650 (struct ldapsam_privates *)methods->private_data;
651 char *base_dn = NULL;
653 int scope = LDAP_SCOPE_SUBTREE;
654 LDAPMessage *result = NULL;
655 LDAPMessage *entry = NULL;
657 filter = talloc_asprintf(talloc_tos(), "(objectClass=%s)",
658 LDAP_OBJ_TRUSTED_DOMAIN);
659 if (filter == NULL) {
660 return NT_STATUS_NO_MEMORY;
663 base_dn = trusted_domain_base_dn(ldap_state);
664 if (base_dn == NULL) {
666 return NT_STATUS_NO_MEMORY;
669 rc = smbldap_search(ldap_state->smbldap_state, base_dn, scope, filter,
672 TALLOC_FREE(base_dn);
674 if (result != NULL) {
675 smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
678 if (rc == LDAP_NO_SUCH_OBJECT) {
684 if (rc != LDAP_SUCCESS) {
685 return NT_STATUS_UNSUCCESSFUL;
689 if (!(*domains = talloc_array(mem_ctx, struct pdb_trusted_domain *, 1))) {
690 DEBUG(1, ("talloc failed\n"));
691 return NT_STATUS_NO_MEMORY;
694 for (entry = ldap_first_entry(priv2ld(ldap_state), result);
696 entry = ldap_next_entry(priv2ld(ldap_state), entry))
698 struct pdb_trusted_domain *dom_info;
700 if (!fill_pdb_trusted_domain(*domains, ldap_state, entry,
702 return NT_STATUS_UNSUCCESSFUL;
705 ADD_TO_ARRAY(*domains, struct pdb_trusted_domain *, dom_info,
706 domains, num_domains);
708 if (*domains == NULL) {
709 DEBUG(1, ("talloc failed\n"));
710 return NT_STATUS_NO_MEMORY;
714 DEBUG(5, ("ipasam_enum_trusted_domains: got %d domains\n", *num_domains));
718 static NTSTATUS ipasam_enum_trusteddoms(struct pdb_methods *methods,
720 uint32_t *num_domains,
721 struct trustdom_info ***domains)
724 struct pdb_trusted_domain **td;
727 status = ipasam_enum_trusted_domains(methods, talloc_tos(),
729 if (!NT_STATUS_IS_OK(status)) {
733 if (*num_domains == 0) {
737 if (!(*domains = talloc_array(mem_ctx, struct trustdom_info *,
739 DEBUG(1, ("talloc failed\n"));
740 return NT_STATUS_NO_MEMORY;
743 for (i = 0; i < *num_domains; i++) {
744 struct trustdom_info *dom_info;
746 dom_info = talloc(*domains, struct trustdom_info);
747 if (dom_info == NULL) {
748 DEBUG(1, ("talloc failed\n"));
749 return NT_STATUS_NO_MEMORY;
752 dom_info->name = talloc_steal(mem_ctx, td[i]->netbios_name);
753 sid_copy(&dom_info->sid, &td[i]->security_identifier);
755 (*domains)[i] = dom_info;
761 static uint32_t pdb_ipasam_capabilities(struct pdb_methods *methods)
763 return PDB_CAP_STORE_RIDS | PDB_CAP_ADS | PDB_CAP_TRUSTED_DOMAINS_EX;
766 static struct pdb_domain_info *pdb_ipasam_get_domain_info(struct pdb_methods *pdb_methods,
769 struct pdb_domain_info *info;
770 struct ldapsam_privates *ldap_state =
771 (struct ldapsam_privates *)pdb_methods->private_data;
776 info = talloc(mem_ctx, struct pdb_domain_info);
781 info->name = talloc_strdup(info, ldap_state->domain_name);
782 if (info->name == NULL) {
786 /* TODO: read dns_domain, dns_forest and guid from LDAP */
787 info->dns_domain = talloc_strdup(info, lp_realm());
788 if (info->dns_domain == NULL) {
791 if (!strlower_m(info->dns_domain)) {
794 info->dns_forest = talloc_strdup(info, info->dns_domain);
796 /* we expect a domain SID to have 4 sub IDs */
797 if (ldap_state->domain_sid.num_auths != 4) {
801 sid_copy(&info->sid, &ldap_state->domain_sid);
803 if (!sid_linearize(sid_buf, sizeof(sid_buf), &info->sid)) {
807 /* the first 8 bytes of the linearized SID are not random,
809 sid_blob.data = (uint8_t *) sid_buf + 8 ;
810 sid_blob.length = 16;
812 status = GUID_from_ndr_blob(&sid_blob, &info->guid);
813 if (!NT_STATUS_IS_OK(status)) {
824 static NTSTATUS modify_ipa_password_exop(struct ldapsam_privates *ldap_state,
825 struct samu *sampass)
828 BerElement *ber = NULL;
829 struct berval *bv = NULL;
831 struct berval *retdata = NULL;
832 const char *password;
835 password = pdb_get_plaintext_passwd(sampass);
836 if (password == NULL || *password == '\0') {
837 return NT_STATUS_INVALID_PARAMETER;
840 dn = get_account_dn(pdb_get_username(sampass));
842 return NT_STATUS_INVALID_PARAMETER;
845 ber = ber_alloc_t( LBER_USE_DER );
847 DEBUG(7, ("ber_alloc_t failed.\n"));
848 return NT_STATUS_NO_MEMORY;
851 ret = ber_printf(ber, "{tsts}", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, dn,
852 LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, password);
854 DEBUG(7, ("ber_printf failed.\n"));
856 return NT_STATUS_UNSUCCESSFUL;
859 ret = ber_flatten(ber, &bv);
862 DEBUG(1, ("ber_flatten failed.\n"));
863 return NT_STATUS_UNSUCCESSFUL;
866 ret = smbldap_extended_operation(ldap_state->smbldap_state,
867 LDAP_EXOP_MODIFY_PASSWD, bv, NULL,
868 NULL, &retoid, &retdata);
874 ldap_memfree(retoid);
876 if (ret != LDAP_SUCCESS) {
877 DEBUG(1, ("smbldap_extended_operation LDAP_EXOP_MODIFY_PASSWD failed.\n"));
878 return NT_STATUS_UNSUCCESSFUL;
884 static NTSTATUS ipasam_get_objectclasses(struct ldapsam_privates *ldap_state,
885 const char *dn, LDAPMessage *entry,
886 uint32_t *has_objectclass)
888 char **objectclasses;
891 objectclasses = ldap_get_values(priv2ld(ldap_state), entry,
892 LDAP_ATTRIBUTE_OBJECTCLASS);
893 if (objectclasses == NULL) {
894 DEBUG(0, ("Entry [%s] does not have any objectclasses.\n", dn));
895 return NT_STATUS_INTERNAL_DB_CORRUPTION;
898 *has_objectclass = 0;
899 for (c = 0; objectclasses[c] != NULL; c++) {
900 if (strequal(objectclasses[c], LDAP_OBJ_KRB_PRINCIPAL)) {
901 *has_objectclass |= HAS_KRB_PRINCIPAL;
902 } else if (strequal(objectclasses[c],
903 LDAP_OBJ_KRB_PRINCIPAL_AUX)) {
904 *has_objectclass |= HAS_KRB_PRINCIPAL_AUX;
905 } else if (strequal(objectclasses[c], LDAP_OBJ_IPAOBJECT)) {
906 *has_objectclass |= HAS_IPAOBJECT;
907 } else if (strequal(objectclasses[c], LDAP_OBJ_IPAHOST)) {
908 *has_objectclass |= HAS_IPAHOST;
909 } else if (strequal(objectclasses[c], LDAP_OBJ_POSIXACCOUNT)) {
910 *has_objectclass |= HAS_POSIXACCOUNT;
911 } else if (strequal(objectclasses[c], LDAP_OBJ_GROUPOFNAMES)) {
912 *has_objectclass |= HAS_GROUPOFNAMES;
913 } else if (strequal(objectclasses[c], LDAP_OBJ_NESTEDGROUP)) {
914 *has_objectclass |= HAS_NESTEDGROUP;
915 } else if (strequal(objectclasses[c], LDAP_OBJ_IPAUSERGROUP)) {
916 *has_objectclass |= HAS_IPAUSERGROUP;
917 } else if (strequal(objectclasses[c], LDAP_OBJ_POSIXGROUP)) {
918 *has_objectclass |= HAS_POSIXGROUP;
921 ldap_value_free(objectclasses);
932 static NTSTATUS find_obj(struct ldapsam_privates *ldap_state, const char *name,
933 enum obj_type type, char **_dn,
934 uint32_t *_has_objectclass)
939 LDAPMessage *result = NULL;
940 LDAPMessage *entry = NULL;
943 uint32_t has_objectclass;
945 const char *obj_class = NULL;
949 obj_class = LDAP_OBJ_POSIXACCOUNT;
952 obj_class = LDAP_OBJ_POSIXGROUP;
955 DEBUG(0, ("Unsupported IPA object.\n"));
956 return NT_STATUS_INVALID_PARAMETER;
959 username = escape_ldap_string(talloc_tos(), name);
960 if (username == NULL) {
961 return NT_STATUS_NO_MEMORY;
963 filter = talloc_asprintf(talloc_tos(), "(&(uid=%s)(objectClass=%s))",
964 username, obj_class);
965 if (filter == NULL) {
966 return NT_STATUS_NO_MEMORY;
968 TALLOC_FREE(username);
970 ret = smbldap_search_suffix(ldap_state->smbldap_state, filter, NULL,
972 if (ret != LDAP_SUCCESS) {
973 DEBUG(0, ("smbldap_search_suffix failed.\n"));
974 return NT_STATUS_ACCESS_DENIED;
977 num_result = ldap_count_entries(priv2ld(ldap_state), result);
979 if (num_result != 1) {
980 if (num_result == 0) {
983 status = NT_STATUS_NO_SUCH_USER;
986 status = NT_STATUS_NO_SUCH_GROUP;
989 status = NT_STATUS_INVALID_PARAMETER;
992 DEBUG (0, ("find_user: More than one object with name [%s] ?!\n",
994 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
999 entry = ldap_first_entry(priv2ld(ldap_state), result);
1001 DEBUG(0,("find_user: Out of memory!\n"));
1002 status = NT_STATUS_UNSUCCESSFUL;
1006 dn = smbldap_talloc_dn(talloc_tos(), priv2ld(ldap_state), entry);
1008 DEBUG(0,("find_user: Out of memory!\n"));
1009 status = NT_STATUS_NO_MEMORY;
1013 status = ipasam_get_objectclasses(ldap_state, dn, entry, &has_objectclass);
1014 if (!NT_STATUS_IS_OK(status)) {
1019 *_has_objectclass = has_objectclass;
1021 status = NT_STATUS_OK;
1024 ldap_msgfree(result);
1029 static NTSTATUS find_user(struct ldapsam_privates *ldap_state, const char *name,
1030 char **_dn, uint32_t *_has_objectclass)
1032 return find_obj(ldap_state, name, IPA_USER_OBJ, _dn, _has_objectclass);
1035 static NTSTATUS find_group(struct ldapsam_privates *ldap_state, const char *name,
1036 char **_dn, uint32_t *_has_objectclass)
1038 return find_obj(ldap_state, name, IPA_GROUP_OBJ, _dn, _has_objectclass);
1041 static NTSTATUS ipasam_add_posix_account_objectclass(struct ldapsam_privates *ldap_state,
1044 const char *username)
1047 LDAPMod **mods = NULL;
1049 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1050 "objectclass", "posixAccount");
1051 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1053 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1054 "uidNumber", IPA_MAGIC_ID_STR);
1055 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1056 "gidNumber", "12345");
1057 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1058 "homeDirectory", "/dev/null");
1060 if (ldap_op == LDAP_MOD_ADD) {
1061 ret = smbldap_add(ldap_state->smbldap_state, dn, mods);
1063 ret = smbldap_modify(ldap_state->smbldap_state, dn, mods);
1065 ldap_mods_free(mods, 1);
1066 if (ret != LDAP_SUCCESS) {
1067 DEBUG(1, ("failed to modify/add user with uid = %s (dn = %s)\n",
1069 return NT_STATUS_LDAP(ret);
1072 return NT_STATUS_OK;
1075 static NTSTATUS ipasam_add_ipa_group_objectclasses(struct ldapsam_privates *ldap_state,
1078 uint32_t has_objectclass)
1080 LDAPMod **mods = NULL;
1083 if (!(has_objectclass & HAS_GROUPOFNAMES)) {
1084 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1085 LDAP_ATTRIBUTE_OBJECTCLASS,
1086 LDAP_OBJ_GROUPOFNAMES);
1089 if (!(has_objectclass & HAS_NESTEDGROUP)) {
1090 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1091 LDAP_ATTRIBUTE_OBJECTCLASS,
1092 LDAP_OBJ_NESTEDGROUP);
1095 if (!(has_objectclass & HAS_IPAUSERGROUP)) {
1096 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1097 LDAP_ATTRIBUTE_OBJECTCLASS,
1098 LDAP_OBJ_IPAUSERGROUP);
1101 if (!(has_objectclass & HAS_IPAOBJECT)) {
1102 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1103 LDAP_ATTRIBUTE_OBJECTCLASS,
1104 LDAP_OBJ_IPAOBJECT);
1107 if (!(has_objectclass & HAS_POSIXGROUP)) {
1108 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1109 LDAP_ATTRIBUTE_OBJECTCLASS,
1110 LDAP_OBJ_POSIXGROUP);
1111 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1114 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1115 LDAP_ATTRIBUTE_GIDNUMBER,
1119 ret = smbldap_modify(ldap_state->smbldap_state, dn, mods);
1120 ldap_mods_free(mods, 1);
1121 if (ret != LDAP_SUCCESS) {
1122 DEBUG(1, ("failed to modify/add group %s (dn = %s)\n",
1124 return NT_STATUS_LDAP(ret);
1127 return NT_STATUS_OK;
1130 static NTSTATUS ipasam_add_ipa_objectclasses(struct ldapsam_privates *ldap_state,
1131 const char *dn, const char *name,
1133 uint32_t acct_flags,
1134 uint32_t has_objectclass)
1136 LDAPMod **mods = NULL;
1140 if (!(has_objectclass & HAS_KRB_PRINCIPAL)) {
1141 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1142 LDAP_ATTRIBUTE_OBJECTCLASS,
1143 LDAP_OBJ_KRB_PRINCIPAL);
1145 princ = talloc_asprintf(talloc_tos(), "%s@%s", name, lp_realm());
1146 if (princ == NULL) {
1147 return NT_STATUS_NO_MEMORY;
1150 smbldap_set_mod(&mods, LDAP_MOD_ADD, LDAP_ATTRIBUTE_KRB_PRINCIPAL, princ);
1153 if (!(has_objectclass & HAS_KRB_PRINCIPAL_AUX)) {
1154 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1155 LDAP_ATTRIBUTE_OBJECTCLASS,
1156 LDAP_OBJ_KRB_PRINCIPAL_AUX);
1159 if (!(has_objectclass & HAS_IPAOBJECT)) {
1160 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1161 LDAP_ATTRIBUTE_OBJECTCLASS, LDAP_OBJ_IPAOBJECT);
1164 if ((acct_flags != 0) &&
1165 (((acct_flags & ACB_NORMAL) && name[strlen(name)-1] == '$') ||
1166 ((acct_flags & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) != 0))) {
1168 if (!(has_objectclass & HAS_IPAHOST)) {
1169 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1170 LDAP_ATTRIBUTE_OBJECTCLASS,
1173 if (domain == NULL) {
1174 return NT_STATUS_INVALID_PARAMETER;
1177 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1182 if (!(has_objectclass & HAS_POSIXACCOUNT)) {
1183 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1184 "objectclass", "posixAccount");
1185 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
1186 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1187 "uidNumber", IPA_MAGIC_ID_STR);
1188 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1189 "gidNumber", "12345");
1190 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1191 "homeDirectory", "/dev/null");
1195 ret = smbldap_modify(ldap_state->smbldap_state, dn, mods);
1196 ldap_mods_free(mods, 1);
1197 if (ret != LDAP_SUCCESS) {
1198 DEBUG(1, ("failed to modify/add user with uid = %s (dn = %s)\n",
1200 return NT_STATUS_LDAP(ret);
1204 return NT_STATUS_OK;
1207 static NTSTATUS pdb_ipasam_add_sam_account(struct pdb_methods *pdb_methods,
1208 struct samu *sampass)
1211 struct ldapsam_privates *ldap_state;
1214 uint32_t has_objectclass;
1216 struct dom_sid user_sid;
1218 ldap_state = (struct ldapsam_privates *)(pdb_methods->private_data);
1220 if (IS_SAM_SET(sampass, PDB_USERSID) ||
1221 IS_SAM_CHANGED(sampass, PDB_USERSID)) {
1222 if (!pdb_new_rid(&rid)) {
1223 return NT_STATUS_DS_NO_MORE_RIDS;
1225 sid_compose(&user_sid, get_global_sam_sid(), rid);
1226 if (!pdb_set_user_sid(sampass, &user_sid, PDB_SET)) {
1227 return NT_STATUS_UNSUCCESSFUL;
1231 status = ldap_state->ipasam_privates->ldapsam_add_sam_account(pdb_methods,
1233 if (!NT_STATUS_IS_OK(status)) {
1237 if (ldap_state->ipasam_privates->server_is_ipa) {
1238 name = pdb_get_username(sampass);
1239 if (name == NULL || *name == '\0') {
1240 return NT_STATUS_INVALID_PARAMETER;
1243 status = find_user(ldap_state, name, &dn, &has_objectclass);
1244 if (!NT_STATUS_IS_OK(status)) {
1248 status = ipasam_add_ipa_objectclasses(ldap_state, dn, name,
1249 pdb_get_domain(sampass),
1250 pdb_get_acct_ctrl(sampass),
1252 if (!NT_STATUS_IS_OK(status)) {
1256 if (!(has_objectclass & HAS_POSIXACCOUNT)) {
1257 status = ipasam_add_posix_account_objectclass(ldap_state,
1260 if (!NT_STATUS_IS_OK(status)) {
1265 if (pdb_get_init_flags(sampass, PDB_PLAINTEXT_PW) == PDB_CHANGED) {
1266 status = modify_ipa_password_exop(ldap_state, sampass);
1267 if (!NT_STATUS_IS_OK(status)) {
1273 return NT_STATUS_OK;
1276 static NTSTATUS pdb_ipasam_update_sam_account(struct pdb_methods *pdb_methods,
1277 struct samu *sampass)
1280 struct ldapsam_privates *ldap_state;
1281 ldap_state = (struct ldapsam_privates *)(pdb_methods->private_data);
1283 status = ldap_state->ipasam_privates->ldapsam_update_sam_account(pdb_methods,
1285 if (!NT_STATUS_IS_OK(status)) {
1289 if (ldap_state->ipasam_privates->server_is_ipa) {
1290 if (pdb_get_init_flags(sampass, PDB_PLAINTEXT_PW) == PDB_CHANGED) {
1291 status = modify_ipa_password_exop(ldap_state, sampass);
1292 if (!NT_STATUS_IS_OK(status)) {
1298 return NT_STATUS_OK;
1301 static NTSTATUS ipasam_create_dom_group(struct pdb_methods *pdb_methods,
1302 TALLOC_CTX *tmp_ctx, const char *name,
1306 struct ldapsam_privates *ldap_state;
1308 uint32_t has_objectclass = 0;
1310 ldap_state = (struct ldapsam_privates *)(pdb_methods->private_data);
1312 if (name == NULL || *name == '\0') {
1313 return NT_STATUS_INVALID_PARAMETER;
1316 status = find_group(ldap_state, name, &dn, &has_objectclass);
1317 if (!NT_STATUS_IS_OK(status) &&
1318 !NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1322 if (!(has_objectclass & HAS_POSIXGROUP)) {
1323 status = ipasam_add_ipa_group_objectclasses(ldap_state, dn,
1326 if (!NT_STATUS_IS_OK(status)) {
1331 status = ldap_state->ipasam_privates->ldapsam_create_dom_group(pdb_methods,
1335 if (!NT_STATUS_IS_OK(status)) {
1339 return NT_STATUS_OK;
1341 static NTSTATUS ipasam_create_user(struct pdb_methods *pdb_methods,
1342 TALLOC_CTX *tmp_ctx, const char *name,
1343 uint32_t acb_info, uint32_t *rid)
1346 struct ldapsam_privates *ldap_state;
1347 int ldap_op = LDAP_MOD_REPLACE;
1349 uint32_t has_objectclass = 0;
1351 ldap_state = (struct ldapsam_privates *)(pdb_methods->private_data);
1353 if (name == NULL || *name == '\0') {
1354 return NT_STATUS_INVALID_PARAMETER;
1357 status = find_user(ldap_state, name, &dn, &has_objectclass);
1358 if (NT_STATUS_IS_OK(status)) {
1359 ldap_op = LDAP_MOD_REPLACE;
1360 } else if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1361 char *escape_username;
1362 ldap_op = LDAP_MOD_ADD;
1363 escape_username = escape_rdn_val_string_alloc(name);
1364 if (!escape_username) {
1365 return NT_STATUS_NO_MEMORY;
1367 if (name[strlen(name)-1] == '$') {
1368 dn = talloc_asprintf(tmp_ctx, "uid=%s,%s",
1370 lp_ldap_machine_suffix(talloc_tos()));
1372 dn = talloc_asprintf(tmp_ctx, "uid=%s,%s",
1374 lp_ldap_user_suffix(talloc_tos()));
1376 SAFE_FREE(escape_username);
1378 return NT_STATUS_NO_MEMORY;
1384 if (!(has_objectclass & HAS_POSIXACCOUNT)) {
1385 status = ipasam_add_posix_account_objectclass(ldap_state, ldap_op,
1387 if (!NT_STATUS_IS_OK(status)) {
1390 has_objectclass |= HAS_POSIXACCOUNT;
1393 status = ldap_state->ipasam_privates->ldapsam_create_user(pdb_methods,
1396 if (!NT_STATUS_IS_OK(status)) {
1400 status = ipasam_add_ipa_objectclasses(ldap_state, dn, name, lp_realm(),
1401 acb_info, has_objectclass);
1402 if (!NT_STATUS_IS_OK(status)) {
1406 return NT_STATUS_OK;
1409 static NTSTATUS pdb_ipa_init_secrets(struct pdb_methods *m)
1411 struct pdb_domain_info *dom_info;
1414 dom_info = pdb_ipasam_get_domain_info(m, m);
1416 return NT_STATUS_UNSUCCESSFUL;
1419 PDB_secrets_clear_domain_protection(dom_info->name);
1420 ret = PDB_secrets_store_domain_sid(dom_info->name,
1425 ret = PDB_secrets_store_domain_guid(dom_info->name,
1430 ret = PDB_secrets_mark_domain_protected(dom_info->name);
1436 TALLOC_FREE(dom_info);
1438 return NT_STATUS_UNSUCCESSFUL;
1440 return NT_STATUS_OK;
1443 static NTSTATUS pdb_init_IPA_ldapsam(struct pdb_methods **pdb_method, const char *location)
1445 struct ldapsam_privates *ldap_state;
1448 status = pdb_ldapsam_init_common(pdb_method, location);
1449 if (!NT_STATUS_IS_OK(status)) {
1453 (*pdb_method)->name = "IPA_ldapsam";
1455 ldap_state = (struct ldapsam_privates *)((*pdb_method)->private_data);
1456 ldap_state->ipasam_privates = talloc_zero(ldap_state,
1457 struct ipasam_privates);
1458 if (ldap_state->ipasam_privates == NULL) {
1459 return NT_STATUS_NO_MEMORY;
1461 ldap_state->is_ipa_ldap = True;
1463 ldap_state->ipasam_privates->server_is_ipa = smbldap_has_extension(
1464 priv2ld(ldap_state), IPA_KEYTAB_SET_OID);
1465 ldap_state->ipasam_privates->ldapsam_add_sam_account = (*pdb_method)->add_sam_account;
1466 ldap_state->ipasam_privates->ldapsam_update_sam_account = (*pdb_method)->update_sam_account;
1467 ldap_state->ipasam_privates->ldapsam_create_user = (*pdb_method)->create_user;
1468 ldap_state->ipasam_privates->ldapsam_create_dom_group = (*pdb_method)->create_dom_group;
1470 (*pdb_method)->add_sam_account = pdb_ipasam_add_sam_account;
1471 (*pdb_method)->update_sam_account = pdb_ipasam_update_sam_account;
1473 if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
1474 if (lp_parm_bool(-1, "ldapsam", "editposix", False)) {
1475 (*pdb_method)->create_user = ipasam_create_user;
1476 (*pdb_method)->create_dom_group = ipasam_create_dom_group;
1480 (*pdb_method)->capabilities = pdb_ipasam_capabilities;
1481 (*pdb_method)->get_domain_info = pdb_ipasam_get_domain_info;
1483 (*pdb_method)->get_trusteddom_pw = ipasam_get_trusteddom_pw;
1484 (*pdb_method)->set_trusteddom_pw = ipasam_set_trusteddom_pw;
1485 (*pdb_method)->del_trusteddom_pw = ipasam_del_trusteddom_pw;
1486 (*pdb_method)->enum_trusteddoms = ipasam_enum_trusteddoms;
1488 (*pdb_method)->get_trusted_domain = ipasam_get_trusted_domain;
1489 (*pdb_method)->get_trusted_domain_by_sid = ipasam_get_trusted_domain_by_sid;
1490 (*pdb_method)->set_trusted_domain = ipasam_set_trusted_domain;
1491 (*pdb_method)->del_trusted_domain = ipasam_del_trusted_domain;
1492 (*pdb_method)->enum_trusted_domains = ipasam_enum_trusted_domains;
1494 status = pdb_ipa_init_secrets(*pdb_method);
1495 if (!NT_STATUS_IS_OK(status)) {
1496 DEBUG(10, ("pdb_ipa_init_secrets failed!\n"));
1500 return NT_STATUS_OK;
1503 NTSTATUS pdb_ipa_init(void)
1507 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "IPA_ldapsam", pdb_init_IPA_ldapsam)))
1510 return NT_STATUS_OK;