2 * idmap_adex: Support for AD Forests
4 * Copyright (C) Gerald (Jerry) Carter 2006-2008
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 #include "idmap_adex.h"
26 #include "../libcli/security/dom_sid.h"
29 #define DBGC_CLASS DBGC_IDMAP
31 static struct likewise_cell *_lw_cell_list = NULL;
33 /**********************************************************************
34 Return the current HEAD of the list
35 *********************************************************************/
37 struct likewise_cell *cell_list_head(void)
43 /**********************************************************************
44 *********************************************************************/
46 void cell_destroy(struct likewise_cell *c)
52 ads_destroy(&c->conn);
57 /**********************************************************************
58 Free all cell entries and reset the list head to NULL
59 *********************************************************************/
61 void cell_list_destroy(void)
63 struct likewise_cell *p = _lw_cell_list;
66 struct likewise_cell *q = p->next;
78 /**********************************************************************
79 Add a new cell structure to the list
80 *********************************************************************/
82 struct likewise_cell* cell_new(void)
84 struct likewise_cell *c;
86 /* Each cell struct is a TALLOC_CTX* */
88 c = talloc_zero(NULL, struct likewise_cell);
90 DEBUG(0,("cell_new: memory allocation failure!\n"));
97 /**********************************************************************
98 Add a new cell structure to the list
99 *********************************************************************/
101 bool cell_list_add(struct likewise_cell * cell)
107 /* Always add to the end */
109 DLIST_ADD_END(_lw_cell_list, cell, struct likewise_cell *);
114 /**********************************************************************
115 Add a new cell structure to the list
116 *********************************************************************/
118 bool cell_list_remove(struct likewise_cell * cell)
124 /* Remove and drop the cell structure */
126 DLIST_REMOVE(_lw_cell_list, cell);
127 talloc_destroy(cell);
132 /**********************************************************************
133 Set the containing DNS domain for a cell
134 *********************************************************************/
136 void cell_set_dns_domain(struct likewise_cell *c, const char *dns_domain)
138 c->dns_domain = talloc_strdup(c, dns_domain);
141 /**********************************************************************
142 Set ADS connection for a cell
143 *********************************************************************/
145 void cell_set_connection(struct likewise_cell *c, ADS_STRUCT *ads)
150 /**********************************************************************
151 *********************************************************************/
153 void cell_set_flags(struct likewise_cell *c, uint32_t flags)
158 /**********************************************************************
159 *********************************************************************/
161 void cell_clear_flags(struct likewise_cell *c, uint32_t flags)
166 /**********************************************************************
168 *********************************************************************/
170 void cell_set_dn(struct likewise_cell *c, const char *dn)
177 c->dn = talloc_strdup(c, dn);
180 /**********************************************************************
181 *********************************************************************/
183 void cell_set_domain_sid(struct likewise_cell *c, struct dom_sid *sid)
185 sid_copy(&c->domain_sid, sid);
192 /**********************************************************************
193 *********************************************************************/
195 const char* cell_search_base(struct likewise_cell *c)
200 return talloc_asprintf(c, "cn=%s,%s", ADEX_CELL_RDN, c->dn);
203 /**********************************************************************
204 *********************************************************************/
206 bool cell_search_forest(struct likewise_cell *c)
208 uint32_t test_flags = LWCELL_FLAG_SEARCH_FOREST;
210 return ((c->flags & test_flags) == test_flags);
213 /**********************************************************************
214 *********************************************************************/
216 uint32_t cell_flags(struct likewise_cell *c)
224 /**********************************************************************
225 *********************************************************************/
227 const char *cell_dns_domain(struct likewise_cell *c)
232 return c->dns_domain;
235 /**********************************************************************
236 *********************************************************************/
238 ADS_STRUCT *cell_connection(struct likewise_cell *c)
247 * Connection functions
250 /********************************************************************
251 *******************************************************************/
253 NTSTATUS cell_connect(struct likewise_cell *c)
255 ADS_STRUCT *ads = NULL;
256 ADS_STATUS ads_status;
258 struct sockaddr_storage dcip;
259 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
261 /* have to at least have the AD domain name */
263 if (!c->dns_domain) {
264 nt_status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
265 BAIL_ON_NTSTATUS_ERROR(nt_status);
268 /* clear out any old information */
271 ads_destroy(&c->conn);
275 /* now setup the new connection */
277 ads = ads_init(c->dns_domain, NULL, NULL);
278 BAIL_ON_PTR_ERROR(ads, nt_status);
281 secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
282 ads->auth.realm = SMB_STRDUP(lp_realm());
284 /* Make the connection. We should already have an initial
285 TGT using the machine creds */
287 if (cell_flags(c) & LWCELL_FLAG_GC_CELL) {
288 ads_status = ads_connect_gc(ads);
290 /* Set up server affinity for normal cells and the client
293 if (!get_dc_name("", c->dns_domain, dc_name, &dcip)) {
294 nt_status = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
295 BAIL_ON_NTSTATUS_ERROR(nt_status);
298 ads_status = ads_connect(ads);
304 nt_status = ads_ntstatus(ads_status);
307 if (!NT_STATUS_IS_OK(nt_status)) {
315 /********************************************************************
316 *******************************************************************/
318 NTSTATUS cell_connect_dn(struct likewise_cell **c, const char *dn)
320 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
321 struct likewise_cell *new_cell = NULL;
322 char *dns_domain = NULL;
325 nt_status = NT_STATUS_INVALID_PARAMETER;
326 BAIL_ON_NTSTATUS_ERROR(nt_status);
329 if ((new_cell = cell_new()) == NULL) {
330 nt_status = NT_STATUS_NO_MEMORY;
331 BAIL_ON_NTSTATUS_ERROR(nt_status);
334 /* Set the DNS domain, dn, etc ... and add it to the list */
336 dns_domain = cell_dn_to_dns(dn);
337 cell_set_dns_domain(new_cell, dns_domain);
338 SAFE_FREE(dns_domain);
340 cell_set_dn(new_cell, dn);
342 nt_status = cell_connect(new_cell);
343 BAIL_ON_NTSTATUS_ERROR(nt_status);
348 if (!NT_STATUS_IS_OK(nt_status)) {
349 DEBUG(1,("LWI: Failled to connect to cell \"%s\" (%s)\n",
350 dn ? dn : "NULL", nt_errstr(nt_status)));
351 talloc_destroy(new_cell);
358 /********************************************************************
359 *******************************************************************/
361 #define MAX_SEARCH_COUNT 2
363 ADS_STATUS cell_do_search(struct likewise_cell *c,
364 const char *search_base,
370 int search_count = 0;
374 /* check for a NULL connection */
377 nt_status = cell_connect(c);
378 if (!NT_STATUS_IS_OK(nt_status)) {
379 status = ADS_ERROR_NT(nt_status);
384 DEBUG(10, ("cell_do_search: Base = %s, Filter = %s, Scope = %d, GC = %s\n",
385 search_base, expr, scope,
386 c->conn->server.gc ? "yes" : "no"));
388 /* we try multiple times in case the ADS_STRUCT is bad
389 and we need to reconnect */
391 while (search_count < MAX_SEARCH_COUNT) {
393 status = ads_do_search(c->conn, search_base,
394 scope, expr, attrs, msg);
395 if (ADS_ERR_OK(status)) {
396 if (DEBUGLEVEL >= 10) {
397 LDAPMessage *e = NULL;
399 int n = ads_count_replies(c->conn, *msg);
401 DEBUG(10,("cell_do_search: Located %d entries\n", n));
403 for (e=ads_first_entry(c->conn, *msg);
405 e = ads_next_entry(c->conn, e))
407 char *dn = ads_get_dn(c->conn, talloc_tos(), e);
409 DEBUGADD(10,(" dn: %s\n", dn ? dn : "<NULL>"));
418 DEBUG(5, ("cell_do_search: search[%d] failed (%s)\n",
419 search_count, ads_errstr(status)));
423 /* Houston, we have a problem */
425 if (status.error_type == ENUM_ADS_ERROR_LDAP) {
426 switch (status.err.rc) {
427 case LDAP_TIMELIMIT_EXCEEDED:
429 case -1: /* we get this error if we cannot contact
431 nt_status = cell_connect(c);
432 if (!NT_STATUS_IS_OK(nt_status)) {
433 status = ADS_ERROR_NT(nt_status);
438 /* we're all done here */
444 DEBUG(5, ("cell_do_search: exceeded maximum search count!\n"));
446 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);