4 LDAP semantics mapping module
6 Copyright (C) Jelmer Vernooij 2005
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 This module relies on ldb_map to do all the real work, but performs
25 some of the trivial mappings between AD semantics and that provided
26 by OpenLDAP and similar servers.
30 #include "ldb/include/ldb.h"
31 #include "ldb/include/ldb_private.h"
32 #include "ldb/include/ldb_errors.h"
33 #include "ldb/ldb_map/ldb_map.h"
35 #include "librpc/gen_ndr/ndr_misc.h"
36 #include "librpc/ndr/libndr.h"
38 struct entryuuid_private {
39 struct ldb_dn **base_dns;
42 static struct ldb_val encode_guid(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
45 NTSTATUS status = GUID_from_string((char *)val->data, &guid);
46 enum ndr_err_code ndr_err;
47 struct ldb_val out = data_blob(NULL, 0);
49 if (!NT_STATUS_IS_OK(status)) {
52 ndr_err = ndr_push_struct_blob(&out, ctx, NULL, &guid,
53 (ndr_push_flags_fn_t)ndr_push_GUID);
54 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
61 static struct ldb_val guid_always_string(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
64 struct ldb_val out = data_blob(NULL, 0);
65 if (val->length >= 32 && val->data[val->length] == '\0') {
66 ldb_handler_copy(module->ldb, ctx, val, &out);
68 enum ndr_err_code ndr_err;
70 guid = talloc(ctx, struct GUID);
74 ndr_err = ndr_pull_struct_blob(val, guid, guid,
75 (ndr_pull_flags_fn_t)ndr_pull_GUID);
76 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
80 out = data_blob_string_const(GUID_string(ctx, guid));
86 static struct ldb_val encode_ns_guid(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
89 NTSTATUS status = NS_GUID_from_string((char *)val->data, &guid);
90 enum ndr_err_code ndr_err;
91 struct ldb_val out = data_blob(NULL, 0);
93 if (!NT_STATUS_IS_OK(status)) {
96 ndr_err = ndr_push_struct_blob(&out, ctx, NULL, &guid,
97 (ndr_push_flags_fn_t)ndr_push_GUID);
98 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
105 static struct ldb_val guid_ns_string(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
107 struct ldb_val out = data_blob(NULL, 0);
108 if (val->length >= 32 && val->data[val->length] == '\0') {
110 GUID_from_string((char *)val->data, &guid);
111 out = data_blob_string_const(NS_GUID_string(ctx, &guid));
113 enum ndr_err_code ndr_err;
115 guid_p = talloc(ctx, struct GUID);
116 if (guid_p == NULL) {
119 ndr_err = ndr_pull_struct_blob(val, guid_p, guid_p,
120 (ndr_pull_flags_fn_t)ndr_pull_GUID);
121 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
125 out = data_blob_string_const(NS_GUID_string(ctx, guid_p));
131 /* The backend holds binary sids, so just copy them back */
132 static struct ldb_val val_copy(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
134 struct ldb_val out = data_blob(NULL, 0);
135 ldb_handler_copy(module->ldb, ctx, val, &out);
140 /* Ensure we always convert sids into binary, so the backend doesn't have to know about both forms */
141 static struct ldb_val sid_always_binary(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
143 struct ldb_val out = data_blob(NULL, 0);
144 const struct ldb_schema_attribute *a = ldb_schema_attribute_by_name(module->ldb, "objectSid");
146 if (a->syntax->canonicalise_fn(module->ldb, ctx, val, &out) != LDB_SUCCESS) {
147 return data_blob(NULL, 0);
153 /* Ensure we always convert objectCategory into a DN */
154 static struct ldb_val objectCategory_always_dn(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
156 struct ldb_val out = data_blob(NULL, 0);
157 const struct ldb_schema_attribute *a = ldb_schema_attribute_by_name(module->ldb, "objectCategory");
159 if (a->syntax->canonicalise_fn(module->ldb, ctx, val, &out) != LDB_SUCCESS) {
160 return data_blob(NULL, 0);
166 static struct ldb_val normalise_to_signed32(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
168 long long int signed_ll = strtoll((const char *)val->data, NULL, 10);
169 if (signed_ll >= 0x80000000LL) {
172 uint32_t unsigned_int;
174 .unsigned_int = strtoul((const char *)val->data, NULL, 10)
177 struct ldb_val out = data_blob_string_const(talloc_asprintf(ctx, "%d", u.signed_int));
180 return val_copy(module, ctx, val);
183 static struct ldb_val usn_to_entryCSN(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
186 unsigned long long usn = strtoull((const char *)val->data, NULL, 10);
187 time_t t = (usn >> 24);
188 out = data_blob_string_const(talloc_asprintf(ctx, "%s#%06x#00#000000", ldb_timestring(ctx, t), (unsigned int)(usn & 0xFFFFFF)));
192 static unsigned long long entryCSN_to_usn_int(TALLOC_CTX *ctx, const struct ldb_val *val)
194 char *entryCSN = talloc_strdup(ctx, (const char *)val->data);
197 unsigned long long usn;
202 p = strchr(entryCSN, '#');
217 usn = strtol(mod_per_sec, NULL, 16);
219 t = ldb_string_to_time(entryCSN);
221 usn = usn | ((unsigned long long)t <<24);
225 static struct ldb_val entryCSN_to_usn(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
228 unsigned long long usn = entryCSN_to_usn_int(ctx, val);
229 out = data_blob_string_const(talloc_asprintf(ctx, "%lld", usn));
233 static struct ldb_val usn_to_timestamp(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
236 unsigned long long usn = strtoull((const char *)val->data, NULL, 10);
237 time_t t = (usn >> 24);
238 out = data_blob_string_const(ldb_timestring(ctx, t));
242 static struct ldb_val timestamp_to_usn(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
246 unsigned long long usn;
248 t = ldb_string_to_time((const char *)val->data);
250 usn = ((unsigned long long)t <<24);
252 out = data_blob_string_const(talloc_asprintf(ctx, "%lld", usn));
257 static const struct ldb_map_attribute entryuuid_attributes[] =
261 .local_name = "objectGUID",
265 .remote_name = "entryUUID",
266 .convert_local = guid_always_string,
267 .convert_remote = encode_guid,
273 .local_name = "invocationId",
277 .remote_name = "invocationId",
278 .convert_local = guid_always_string,
279 .convert_remote = encode_guid,
285 .local_name = "objectSid",
289 .remote_name = "objectSid",
290 .convert_local = sid_always_binary,
291 .convert_remote = val_copy,
296 .local_name = "name",
300 .remote_name = "samba4RDN"
305 .local_name = "whenCreated",
309 .remote_name = "createTimestamp"
314 .local_name = "whenChanged",
318 .remote_name = "modifyTimestamp"
323 .local_name = "objectClasses",
327 .remote_name = "samba4ObjectClasses"
332 .local_name = "dITContentRules",
336 .remote_name = "samba4DITContentRules"
341 .local_name = "attributeTypes",
345 .remote_name = "samba4AttributeTypes"
350 .local_name = "sambaPassword",
354 .remote_name = "userPassword"
359 .local_name = "objectCategory",
363 .remote_name = "objectCategory",
364 .convert_local = objectCategory_always_dn,
365 .convert_remote = val_copy,
370 .local_name = "distinguishedName",
374 .remote_name = "entryDN"
383 .remote_name = "entryDN"
388 .local_name = "groupType",
392 .remote_name = "groupType",
393 .convert_local = normalise_to_signed32,
394 .convert_remote = val_copy,
399 .local_name = "sAMAccountType",
403 .remote_name = "sAMAccountType",
404 .convert_local = normalise_to_signed32,
405 .convert_remote = val_copy,
410 .local_name = "usnChanged",
414 .remote_name = "entryCSN",
415 .convert_local = usn_to_entryCSN,
416 .convert_remote = entryCSN_to_usn
421 .local_name = "usnCreated",
425 .remote_name = "createTimestamp",
426 .convert_local = usn_to_timestamp,
427 .convert_remote = timestamp_to_usn,
440 /* This objectClass conflicts with builtin classes on OpenLDAP */
441 const struct ldb_map_objectclass entryuuid_objectclasses[] =
444 .local_name = "subSchema",
445 .remote_name = "samba4SubSchema"
452 /* These things do not show up in wildcard searches in OpenLDAP, but
453 * we need them to show up in the AD-like view */
454 static const char * const entryuuid_wildcard_attributes[] = {
463 static const struct ldb_map_attribute nsuniqueid_attributes[] =
467 .local_name = "objectGUID",
471 .remote_name = "nsuniqueid",
472 .convert_local = guid_ns_string,
473 .convert_remote = encode_ns_guid,
479 .local_name = "objectSid",
483 .remote_name = "objectSid",
484 .convert_local = sid_always_binary,
485 .convert_remote = val_copy,
490 .local_name = "whenCreated",
494 .remote_name = "createTimestamp"
499 .local_name = "whenChanged",
503 .remote_name = "modifyTimestamp"
508 .local_name = "sambaPassword",
512 .remote_name = "userPassword"
517 .local_name = "objectCategory",
521 .remote_name = "objectCategory",
522 .convert_local = objectCategory_always_dn,
523 .convert_remote = val_copy,
528 .local_name = "distinguishedName",
532 .remote_name = "entryDN"
541 .remote_name = "entryDN"
546 .local_name = "groupType",
550 .remote_name = "groupType",
551 .convert_local = normalise_to_signed32,
552 .convert_remote = val_copy,
557 .local_name = "sAMAccountType",
561 .remote_name = "sAMAccountType",
562 .convert_local = normalise_to_signed32,
563 .convert_remote = val_copy,
568 .local_name = "usnChanged",
572 .remote_name = "modifyTimestamp",
573 .convert_local = usn_to_timestamp,
574 .convert_remote = timestamp_to_usn,
579 .local_name = "usnCreated",
583 .remote_name = "createTimestamp",
584 .convert_local = usn_to_timestamp,
585 .convert_remote = timestamp_to_usn,
598 /* These things do not show up in wildcard searches in OpenLDAP, but
599 * we need them to show up in the AD-like view */
600 static const char * const nsuniqueid_wildcard_attributes[] = {
609 static int get_remote_rootdse(struct ldb_context *ldb, void *context,
610 struct ldb_reply *ares)
612 struct entryuuid_private *entryuuid_private;
613 entryuuid_private = talloc_get_type(context,
614 struct entryuuid_private);
615 if (ares->type == LDB_REPLY_ENTRY) {
617 struct ldb_message_element *el = ldb_msg_find_element(ares->message, "namingContexts");
618 entryuuid_private->base_dns = talloc_realloc(entryuuid_private, entryuuid_private->base_dns, struct ldb_dn *,
620 for (i=0; i < el->num_values; i++) {
621 if (!entryuuid_private->base_dns) {
622 return LDB_ERR_OPERATIONS_ERROR;
624 entryuuid_private->base_dns[i] = ldb_dn_new(entryuuid_private->base_dns, ldb, (const char *)el->values[i].data);
625 if ( ! ldb_dn_validate(entryuuid_private->base_dns[i])) {
626 return LDB_ERR_OPERATIONS_ERROR;
629 entryuuid_private->base_dns[i] = NULL;
635 static int find_base_dns(struct ldb_module *module,
636 struct entryuuid_private *entryuuid_private)
639 struct ldb_request *req;
640 const char *naming_context_attr[] = {
644 req = talloc(entryuuid_private, struct ldb_request);
646 ldb_set_errstring(module->ldb, "Out of Memory");
647 return LDB_ERR_OPERATIONS_ERROR;
650 req->operation = LDB_SEARCH;
651 req->op.search.base = ldb_dn_new(req, module->ldb, NULL);
652 req->op.search.scope = LDB_SCOPE_BASE;
654 req->op.search.tree = ldb_parse_tree(req, "objectClass=*");
655 if (req->op.search.tree == NULL) {
656 ldb_set_errstring(module->ldb, "Unable to parse search expression");
658 return LDB_ERR_OPERATIONS_ERROR;
661 req->op.search.attrs = naming_context_attr;
662 req->controls = NULL;
663 req->context = entryuuid_private;
664 req->callback = get_remote_rootdse;
665 ldb_set_timeout(module->ldb, req, 0); /* use default timeout */
667 ret = ldb_next_request(module, req);
669 if (ret == LDB_SUCCESS) {
670 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
674 if (ret != LDB_SUCCESS) {
681 /* the context init function */
682 static int entryuuid_init(struct ldb_module *module)
685 struct map_private *map_private;
686 struct entryuuid_private *entryuuid_private;
688 ret = ldb_map_init(module, entryuuid_attributes, entryuuid_objectclasses, entryuuid_wildcard_attributes, NULL);
689 if (ret != LDB_SUCCESS)
692 map_private = talloc_get_type(module->private_data, struct map_private);
694 entryuuid_private = talloc_zero(map_private, struct entryuuid_private);
695 map_private->caller_private = entryuuid_private;
697 ret = find_base_dns(module, entryuuid_private);
699 return ldb_next_init(module);
702 /* the context init function */
703 static int nsuniqueid_init(struct ldb_module *module)
706 struct map_private *map_private;
707 struct entryuuid_private *entryuuid_private;
709 ret = ldb_map_init(module, nsuniqueid_attributes, NULL, nsuniqueid_wildcard_attributes, NULL);
710 if (ret != LDB_SUCCESS)
713 map_private = talloc_get_type(module->private_data, struct map_private);
715 entryuuid_private = talloc_zero(map_private, struct entryuuid_private);
716 map_private->caller_private = entryuuid_private;
718 ret = find_base_dns(module, entryuuid_private);
720 return ldb_next_init(module);
723 static int get_seq(struct ldb_context *ldb, void *context,
724 struct ldb_reply *ares)
726 unsigned long long *max_seq = (unsigned long long *)context;
727 unsigned long long seq;
728 if (ares->type == LDB_REPLY_ENTRY) {
729 struct ldb_message_element *el = ldb_msg_find_element(ares->message, "contextCSN");
731 seq = entryCSN_to_usn_int(ares, &el->values[0]);
732 *max_seq = MAX(seq, *max_seq);
739 static int entryuuid_sequence_number(struct ldb_module *module, struct ldb_request *req)
742 struct map_private *map_private;
743 struct entryuuid_private *entryuuid_private;
744 unsigned long long max_seq = 0;
745 struct ldb_request *search_req;
746 map_private = talloc_get_type(module->private_data, struct map_private);
748 entryuuid_private = talloc_get_type(map_private->caller_private, struct entryuuid_private);
750 /* Search the baseDNs for a sequence number */
751 for (i=0; entryuuid_private &&
752 entryuuid_private->base_dns &&
753 entryuuid_private->base_dns[i];
755 static const char *contextCSN_attr[] = {
758 search_req = talloc(req, struct ldb_request);
759 if (search_req == NULL) {
760 ldb_set_errstring(module->ldb, "Out of Memory");
761 return LDB_ERR_OPERATIONS_ERROR;
764 search_req->operation = LDB_SEARCH;
765 search_req->op.search.base = entryuuid_private->base_dns[i];
766 search_req->op.search.scope = LDB_SCOPE_BASE;
768 search_req->op.search.tree = ldb_parse_tree(search_req, "objectClass=*");
769 if (search_req->op.search.tree == NULL) {
770 ldb_set_errstring(module->ldb, "Unable to parse search expression");
771 talloc_free(search_req);
772 return LDB_ERR_OPERATIONS_ERROR;
775 search_req->op.search.attrs = contextCSN_attr;
776 search_req->controls = NULL;
777 search_req->context = &max_seq;
778 search_req->callback = get_seq;
779 ldb_set_timeout(module->ldb, search_req, 0); /* use default timeout */
781 ret = ldb_next_request(module, search_req);
783 if (ret == LDB_SUCCESS) {
784 ret = ldb_wait(search_req->handle, LDB_WAIT_ALL);
787 talloc_free(search_req);
788 if (ret != LDB_SUCCESS) {
793 switch (req->op.seq_num.type) {
794 case LDB_SEQ_HIGHEST_SEQ:
795 req->op.seq_num.seq_num = max_seq;
798 req->op.seq_num.seq_num = max_seq;
799 req->op.seq_num.seq_num++;
801 case LDB_SEQ_HIGHEST_TIMESTAMP:
803 req->op.seq_num.seq_num = (max_seq >> 24);
807 req->op.seq_num.flags = 0;
808 req->op.seq_num.flags |= LDB_SEQ_TIMESTAMP_SEQUENCE;
809 req->op.seq_num.flags |= LDB_SEQ_GLOBAL_SEQUENCE;
813 static struct ldb_module_ops entryuuid_ops = {
815 .init_context = entryuuid_init,
816 .sequence_number = entryuuid_sequence_number
819 static struct ldb_module_ops nsuniqueid_ops = {
820 .name = "nsuniqueid",
821 .init_context = nsuniqueid_init,
822 .sequence_number = entryuuid_sequence_number
825 /* the init function */
826 int ldb_simple_ldap_map_module_init(void)
829 struct ldb_module_ops ops = ldb_map_get_ops();
830 entryuuid_ops.add = ops.add;
831 entryuuid_ops.modify = ops.modify;
832 entryuuid_ops.del = ops.del;
833 entryuuid_ops.rename = ops.rename;
834 entryuuid_ops.search = ops.search;
835 entryuuid_ops.wait = ops.wait;
836 ret = ldb_register_module(&entryuuid_ops);
842 nsuniqueid_ops.add = ops.add;
843 nsuniqueid_ops.modify = ops.modify;
844 nsuniqueid_ops.del = ops.del;
845 nsuniqueid_ops.rename = ops.rename;
846 nsuniqueid_ops.search = ops.search;
847 nsuniqueid_ops.wait = ops.wait;
848 ret = ldb_register_module(&nsuniqueid_ops);