4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 * Component: ldb update_keytabs module
25 * Description: Update keytabs whenever their matching secret record changes
27 * Author: Andrew Bartlett
31 #include "ldb_module.h"
32 #include "lib/util/dlinklist.h"
33 #include "auth/credentials/credentials.h"
34 #include "auth/credentials/credentials_krb5.h"
35 #include "system/kerberos.h"
36 #include "auth/kerberos/kerberos.h"
39 struct ldb_message *msg;
41 struct dn_list *prev, *next;
44 struct update_kt_private {
45 struct dn_list *changed_dns;
48 struct update_kt_ctx {
49 struct ldb_module *module;
50 struct ldb_request *req;
55 struct ldb_reply *op_reply;
59 static struct update_kt_ctx *update_kt_ctx_init(struct ldb_module *module,
60 struct ldb_request *req)
62 struct update_kt_ctx *ac;
64 ac = talloc_zero(req, struct update_kt_ctx);
66 ldb_oom(ldb_module_get_ctx(module));
76 /* FIXME: too many semi-async searches here for my taste, direct and indirect as
77 * cli_credentials_set_secrets() performs a sync ldb search.
78 * Just hope we are lucky and nothing breaks (using the tdb backend masks a lot
79 * of async issues). -SSS
81 static int add_modified(struct ldb_module *module, struct ldb_dn *dn, bool do_delete) {
82 struct ldb_context *ldb = ldb_module_get_ctx(module);
83 struct update_kt_private *data = talloc_get_type(ldb_module_get_private(module), struct update_kt_private);
86 struct ldb_result *res;
89 filter = talloc_asprintf(data, "(&(dn=%s)(&(objectClass=kerberosSecret)(privateKeytab=*)))",
90 ldb_dn_get_linearized(dn));
95 ret = ldb_search(ldb, data, &res,
96 dn, LDB_SCOPE_BASE, NULL, "%s", filter);
98 if (ret != LDB_SUCCESS) {
102 if (res->count != 1) {
103 /* if it's not a kerberosSecret then we don't have anything to update */
109 item = talloc(data->changed_dns? (void *)data->changed_dns: (void *)data, struct dn_list);
116 item->msg = talloc_steal(item, res->msgs[0]);
117 item->do_delete = do_delete;
120 DLIST_ADD_END(data->changed_dns, item, struct dn_list *);
124 static int ukt_search_modified(struct update_kt_ctx *ac);
126 static int update_kt_op_callback(struct ldb_request *req,
127 struct ldb_reply *ares)
129 struct ldb_context *ldb;
130 struct update_kt_ctx *ac;
133 ac = talloc_get_type(req->context, struct update_kt_ctx);
134 ldb = ldb_module_get_ctx(ac->module);
137 return ldb_module_done(ac->req, NULL, NULL,
138 LDB_ERR_OPERATIONS_ERROR);
140 if (ares->error != LDB_SUCCESS) {
141 return ldb_module_done(ac->req, ares->controls,
142 ares->response, ares->error);
145 if (ares->type != LDB_REPLY_DONE) {
146 ldb_set_errstring(ldb, "Invalid request type!\n");
147 return ldb_module_done(ac->req, NULL, NULL,
148 LDB_ERR_OPERATIONS_ERROR);
152 return ldb_module_done(ac->req, ares->controls,
153 ares->response, LDB_SUCCESS);
156 ac->op_reply = talloc_steal(ac, ares);
158 ret = ukt_search_modified(ac);
159 if (ret != LDB_SUCCESS) {
160 return ldb_module_done(ac->req, NULL, NULL, ret);
166 static int ukt_del_op(struct update_kt_ctx *ac)
168 struct ldb_context *ldb;
169 struct ldb_request *down_req;
172 ldb = ldb_module_get_ctx(ac->module);
174 ret = ldb_build_del_req(&down_req, ldb, ac,
177 ac, update_kt_op_callback,
179 LDB_REQ_SET_LOCATION(down_req);
180 if (ret != LDB_SUCCESS) {
183 return ldb_next_request(ac->module, down_req);
186 static int ukt_search_modified_callback(struct ldb_request *req,
187 struct ldb_reply *ares)
189 struct update_kt_ctx *ac;
192 ac = talloc_get_type(req->context, struct update_kt_ctx);
195 return ldb_module_done(ac->req, NULL, NULL,
196 LDB_ERR_OPERATIONS_ERROR);
198 if (ares->error != LDB_SUCCESS) {
199 return ldb_module_done(ac->req, ares->controls,
200 ares->response, ares->error);
203 switch (ares->type) {
204 case LDB_REPLY_ENTRY:
209 case LDB_REPLY_REFERRAL:
216 /* do the dirty sync job here :/ */
217 ret = add_modified(ac->module, ac->dn, ac->do_delete);
221 ret = ukt_del_op(ac);
222 if (ret != LDB_SUCCESS) {
223 return ldb_module_done(ac->req,
229 return ldb_module_done(ac->req, ac->op_reply->controls,
230 ac->op_reply->response, LDB_SUCCESS);
237 static int ukt_search_modified(struct update_kt_ctx *ac)
239 struct ldb_context *ldb;
240 static const char * const attrs[] = { "distinguishedName", NULL };
241 struct ldb_request *search_req;
244 ldb = ldb_module_get_ctx(ac->module);
246 ret = ldb_build_search_req(&search_req, ldb, ac,
247 ac->dn, LDB_SCOPE_BASE,
248 "(&(objectClass=kerberosSecret)"
249 "(privateKeytab=*))", attrs,
251 ac, ukt_search_modified_callback,
253 LDB_REQ_SET_LOCATION(search_req);
254 if (ret != LDB_SUCCESS) {
257 return ldb_next_request(ac->module, search_req);
262 static int update_kt_add(struct ldb_module *module, struct ldb_request *req)
264 struct ldb_context *ldb;
265 struct update_kt_ctx *ac;
266 struct ldb_request *down_req;
269 ldb = ldb_module_get_ctx(module);
271 ac = update_kt_ctx_init(module, req);
273 return ldb_operr(ldb);
276 ac->dn = req->op.add.message->dn;
278 ret = ldb_build_add_req(&down_req, ldb, ac,
281 ac, update_kt_op_callback,
283 LDB_REQ_SET_LOCATION(down_req);
284 if (ret != LDB_SUCCESS) {
288 return ldb_next_request(module, down_req);
292 static int update_kt_modify(struct ldb_module *module, struct ldb_request *req)
294 struct ldb_context *ldb;
295 struct update_kt_ctx *ac;
296 struct ldb_request *down_req;
299 ldb = ldb_module_get_ctx(module);
301 ac = update_kt_ctx_init(module, req);
303 return ldb_operr(ldb);
306 ac->dn = req->op.mod.message->dn;
308 ret = ldb_build_mod_req(&down_req, ldb, ac,
311 ac, update_kt_op_callback,
313 LDB_REQ_SET_LOCATION(down_req);
314 if (ret != LDB_SUCCESS) {
318 return ldb_next_request(module, down_req);
322 static int update_kt_delete(struct ldb_module *module, struct ldb_request *req)
324 struct update_kt_ctx *ac;
326 ac = update_kt_ctx_init(module, req);
328 return ldb_operr(ldb_module_get_ctx(module));
331 ac->dn = req->op.del.dn;
332 ac->do_delete = true;
334 return ukt_search_modified(ac);
338 static int update_kt_rename(struct ldb_module *module, struct ldb_request *req)
340 struct ldb_context *ldb;
341 struct update_kt_ctx *ac;
342 struct ldb_request *down_req;
345 ldb = ldb_module_get_ctx(module);
347 ac = update_kt_ctx_init(module, req);
349 return ldb_operr(ldb);
352 ac->dn = req->op.rename.newdn;
354 ret = ldb_build_rename_req(&down_req, ldb, ac,
355 req->op.rename.olddn,
356 req->op.rename.newdn,
358 ac, update_kt_op_callback,
360 LDB_REQ_SET_LOCATION(down_req);
361 if (ret != LDB_SUCCESS) {
365 return ldb_next_request(module, down_req);
368 /* prepare for a commit */
369 static int update_kt_prepare_commit(struct ldb_module *module)
371 struct ldb_context *ldb = ldb_module_get_ctx(module);
372 struct update_kt_private *data = talloc_get_type(ldb_module_get_private(module), struct update_kt_private);
374 struct smb_krb5_context *smb_krb5_context;
375 int krb5_ret = smb_krb5_init_context(data, ldb_get_event_context(ldb), ldb_get_opaque(ldb, "loadparm"),
378 talloc_free(data->changed_dns);
379 data->changed_dns = NULL;
380 ldb_asprintf_errstring(ldb, "Failed to setup krb5_context: %s", error_message(krb5_ret));
381 return LDB_ERR_OPERATIONS_ERROR;
384 ldb = ldb_module_get_ctx(module);
386 for (p=data->changed_dns; p; p = p->next) {
387 const char *error_string;
388 krb5_ret = smb_krb5_update_keytab(data, smb_krb5_context, ldb, p->msg, p->do_delete, &error_string);
390 talloc_free(data->changed_dns);
391 data->changed_dns = NULL;
392 ldb_asprintf_errstring(ldb, "Failed to update keytab from entry %s in %s: %s",
393 ldb_dn_get_linearized(p->msg->dn),
394 (const char *)ldb_get_opaque(ldb, "ldb_url"),
396 return LDB_ERR_OPERATIONS_ERROR;
400 talloc_free(data->changed_dns);
401 data->changed_dns = NULL;
403 return ldb_next_prepare_commit(module);
406 /* end a transaction */
407 static int update_kt_del_trans(struct ldb_module *module)
409 struct update_kt_private *data = talloc_get_type(ldb_module_get_private(module), struct update_kt_private);
411 talloc_free(data->changed_dns);
412 data->changed_dns = NULL;
414 return ldb_next_del_trans(module);
417 static int update_kt_init(struct ldb_module *module)
419 struct ldb_context *ldb;
420 struct update_kt_private *data;
422 ldb = ldb_module_get_ctx(module);
424 data = talloc(module, struct update_kt_private);
429 data->changed_dns = NULL;
431 ldb_module_set_private(module, data);
433 return ldb_next_init(module);
436 static const struct ldb_module_ops ldb_update_keytab_module_ops = {
437 .name = "update_keytab",
438 .init_context = update_kt_init,
439 .add = update_kt_add,
440 .modify = update_kt_modify,
441 .rename = update_kt_rename,
442 .del = update_kt_delete,
443 .prepare_commit = update_kt_prepare_commit,
444 .del_transaction = update_kt_del_trans,
447 int ldb_update_keytab_module_init(const char *version)
449 return ldb_register_module(&ldb_update_keytab_module_ops);