source3/passdb/pdb_ipa.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    IPA helper functions for SAMBA
   4    Copyright (C) Sumit Bose <sbose@redhat.com> 2010
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18
  19 */
  20
  21 #include "includes.h"
  22
  23 #include "smbldap.h"
  24
  25 #define LDAP_TRUST_CONTAINER "ou=system"
  26 #define LDAP_ATTRIBUTE_CN "cn"
  27 #define LDAP_ATTRIBUTE_TRUST_TYPE "sambaTrustType"
  28 #define LDAP_ATTRIBUTE_TRUST_ATTRIBUTES "sambaTrustAttributes"
  29 #define LDAP_ATTRIBUTE_TRUST_DIRECTION "sambaTrustDirection"
  30 #define LDAP_ATTRIBUTE_TRUST_PARTNER "sambaTrustPartner"
  31 #define LDAP_ATTRIBUTE_FLAT_NAME "sambaFlatName"
  32 #define LDAP_ATTRIBUTE_TRUST_AUTH_OUTGOING "sambaTrustAuthOutgoing"
  33 #define LDAP_ATTRIBUTE_TRUST_AUTH_INCOMING "sambaTrustAuthIncoming"
  34 #define LDAP_ATTRIBUTE_SECURITY_IDENTIFIER "sambaSecurityIdentifier"
  35
  36 static bool ipasam_get_trusteddom_pw(struct pdb_methods *methods,
  37                                      const char *domain,
  38                                      char** pwd,
  39                                      struct dom_sid *sid,
  40                                      time_t *pass_last_set_time)
  41 {
  42         return false;
  43 }
  44
  45 static bool ipasam_set_trusteddom_pw(struct pdb_methods *methods,
  46                                      const char* domain,
  47                                      const char* pwd,
  48                                      const struct dom_sid *sid)
  49 {
  50         return false;
  51 }
  52
  53 static bool ipasam_del_trusteddom_pw(struct pdb_methods *methods,
  54                                      const char *domain)
  55 {
  56         return false;
  57 }
  58
  59 static char *trusted_domain_dn(struct ldapsam_privates *ldap_state,
  60                                const char *domain)
  61 {
  62         return talloc_asprintf(talloc_tos(), "%s=%s,%s,%s",
  63                                LDAP_ATTRIBUTE_CN, domain,
  64                                LDAP_TRUST_CONTAINER, ldap_state->domain_dn);
  65 }
  66
  67 static char *trusted_domain_base_dn(struct ldapsam_privates *ldap_state)
  68 {
  69         return talloc_asprintf(talloc_tos(), "%s,%s",
  70                                LDAP_TRUST_CONTAINER, ldap_state->domain_dn);
  71 }
  72
  73 static bool get_trusted_domain_int(struct ldapsam_privates *ldap_state,
  74                                    TALLOC_CTX *mem_ctx,
  75                                    const char *filter, LDAPMessage **entry)
  76 {
  77         int rc;
  78         char *base_dn = NULL;
  79         LDAPMessage *result = NULL;
  80         uint32_t num_result;
  81
  82         base_dn = trusted_domain_base_dn(ldap_state);
  83         if (base_dn == NULL) {
  84                 return false;
  85         }
  86
  87         rc = smbldap_search(ldap_state->smbldap_state, base_dn,
  88                             LDAP_SCOPE_SUBTREE, filter, NULL, 0, &result);
  89         TALLOC_FREE(base_dn);
  90
  91         if (result != NULL) {
  92                 talloc_autofree_ldapmsg(mem_ctx, result);
  93         }
  94
  95         if (rc == LDAP_NO_SUCH_OBJECT) {
  96                 *entry = NULL;
  97                 return true;
  98         }
  99
 100         if (rc != LDAP_SUCCESS) {
 101                 return false;
 102         }
 103
 104         num_result = ldap_count_entries(priv2ld(ldap_state), result);
 105
 106         if (num_result > 1) {
 107                 DEBUG(1, ("get_trusted_domain_int: more than one "
 108                           "%s object with filter '%s'?!\n",
 109                           LDAP_OBJ_TRUSTED_DOMAIN, filter));
 110                 return false;
 111         }
 112
 113         if (num_result == 0) {
 114                 DEBUG(1, ("get_trusted_domain_int: no "
 115                           "%s object with filter '%s'.\n",
 116                           LDAP_OBJ_TRUSTED_DOMAIN, filter));
 117                 *entry = NULL;
 118         } else {
 119                 *entry = ldap_first_entry(priv2ld(ldap_state), result);
 120         }
 121
 122         return true;
 123 }
 124
 125 static bool get_trusted_domain_by_name_int(struct ldapsam_privates *ldap_state,
 126                                           TALLOC_CTX *mem_ctx,
 127                                           const char *domain,
 128                                           LDAPMessage **entry)
 129 {
 130         char *filter = NULL;
 131
 132         filter = talloc_asprintf(talloc_tos(),
 133                                  "(&(objectClass=%s)(|(%s=%s)(%s=%s)(cn=%s)))",
 134                                  LDAP_OBJ_TRUSTED_DOMAIN,
 135                                  LDAP_ATTRIBUTE_FLAT_NAME, domain,
 136                                  LDAP_ATTRIBUTE_TRUST_PARTNER, domain, domain);
 137         if (filter == NULL) {
 138                 return false;
 139         }
 140
 141         return get_trusted_domain_int(ldap_state, mem_ctx, filter, entry);
 142 }
 143
 144 static bool get_trusted_domain_by_sid_int(struct ldapsam_privates *ldap_state,
 145                                            TALLOC_CTX *mem_ctx,
 146                                            const char *sid, LDAPMessage **entry)
 147 {
 148         char *filter = NULL;
 149
 150         filter = talloc_asprintf(talloc_tos(), "(&(objectClass=%s)(%s=%s))",
 151                                  LDAP_OBJ_TRUSTED_DOMAIN,
 152                                  LDAP_ATTRIBUTE_SECURITY_IDENTIFIER, sid);
 153         if (filter == NULL) {
 154                 return false;
 155         }
 156
 157         return get_trusted_domain_int(ldap_state, mem_ctx, filter, entry);
 158 }
 159
 160 static bool get_uint32_t_from_ldap_msg(struct ldapsam_privates *ldap_state,
 161                                        LDAPMessage *entry,
 162                                        const char *attr,
 163                                        uint32_t *val)
 164 {
 165         char *dummy;
 166         long int l;
 167         char *endptr;
 168
 169         dummy = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry,
 170                                                 attr, talloc_tos());
 171         if (dummy == NULL) {
 172                 DEBUG(9, ("Attribute %s not present.\n", attr));
 173                 *val = 0;
 174                 return true;
 175         }
 176
 177         l = strtoul(dummy, &endptr, 10);
 178         TALLOC_FREE(dummy);
 179
 180         if (l < 0 || l > UINT32_MAX || *endptr != '\0') {
 181                 return false;
 182         }
 183
 184         *val = l;
 185
 186         return true;
 187 }
 188
 189 static void get_data_blob_from_ldap_msg(TALLOC_CTX *mem_ctx,
 190                                         struct ldapsam_privates *ldap_state,
 191                                         LDAPMessage *entry, const char *attr,
 192                                         DATA_BLOB *_blob)
 193 {
 194         char *dummy;
 195         DATA_BLOB blob;
 196
 197         dummy = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry, attr,
 198                                                 talloc_tos());
 199         if (dummy == NULL) {
 200                 DEBUG(9, ("Attribute %s not present.\n", attr));
 201                 ZERO_STRUCTP(_blob);
 202         } else {
 203                 blob = base64_decode_data_blob(dummy);
 204                 if (blob.length == 0) {
 205                         ZERO_STRUCTP(_blob);
 206                 } else {
 207                         _blob->length = blob.length;
 208                         _blob->data = talloc_steal(mem_ctx, blob.data);
 209                 }
 210         }
 211         TALLOC_FREE(dummy);
 212 }
 213
 214 static bool fill_pdb_trusted_domain(TALLOC_CTX *mem_ctx,
 215                                     struct ldapsam_privates *ldap_state,
 216                                     LDAPMessage *entry,
 217                                     struct pdb_trusted_domain **_td)
 218 {
 219         char *dummy;
 220         bool res;
 221         struct pdb_trusted_domain *td;
 222
 223         if (entry == NULL) {
 224                 return false;
 225         }
 226
 227         td = talloc_zero(mem_ctx, struct pdb_trusted_domain);
 228         if (td == NULL) {
 229                 return false;
 230         }
 231
 232         /* All attributes are MAY */
 233
 234         dummy = smbldap_talloc_single_attribute(priv2ld(ldap_state), entry,
 235                                                 LDAP_ATTRIBUTE_SECURITY_IDENTIFIER,
 236                                                 talloc_tos());
 237         if (dummy == NULL) {
 238                 DEBUG(9, ("Attribute %s not present.\n",
 239                           LDAP_ATTRIBUTE_SECURITY_IDENTIFIER));
 240                 ZERO_STRUCT(td->security_identifier);
 241         } else {
 242                 res = string_to_sid(&td->security_identifier, dummy);
 243                 TALLOC_FREE(dummy);
 244                 if (!res) {
 245                         return false;
 246                 }
 247         }
 248
 249         get_data_blob_from_ldap_msg(td, ldap_state, entry,
 250                                     LDAP_ATTRIBUTE_TRUST_AUTH_INCOMING,
 251                                     &td->trust_auth_incoming);
 252
 253         get_data_blob_from_ldap_msg(td, ldap_state, entry,
 254                                     LDAP_ATTRIBUTE_TRUST_AUTH_OUTGOING,
 255                                     &td->trust_auth_outgoing);
 256
 257         td->netbios_name = smbldap_talloc_single_attribute(priv2ld(ldap_state),
 258                                                            entry,
 259                                                            LDAP_ATTRIBUTE_FLAT_NAME,
 260                                                            td);
 261         if (td->netbios_name == NULL) {
 262                 DEBUG(9, ("Attribute %s not present.\n",
 263                           LDAP_ATTRIBUTE_FLAT_NAME));
 264         }
 265
 266         td->domain_name = smbldap_talloc_single_attribute(priv2ld(ldap_state),
 267                                                           entry,
 268                                                           LDAP_ATTRIBUTE_TRUST_PARTNER,
 269                                                           td);
 270         if (td->domain_name == NULL) {
 271                 DEBUG(9, ("Attribute %s not present.\n",
 272                           LDAP_ATTRIBUTE_TRUST_PARTNER));
 273         }
 274
 275         res = get_uint32_t_from_ldap_msg(ldap_state, entry,
 276                                          LDAP_ATTRIBUTE_TRUST_DIRECTION,
 277                                          &td->trust_direction);
 278         if (!res) {
 279                 return false;
 280         }
 281
 282         res = get_uint32_t_from_ldap_msg(ldap_state, entry,
 283                                          LDAP_ATTRIBUTE_TRUST_ATTRIBUTES,
 284                                          &td->trust_attributes);
 285         if (!res) {
 286                 return false;
 287         }
 288
 289         res = get_uint32_t_from_ldap_msg(ldap_state, entry,
 290                                          LDAP_ATTRIBUTE_TRUST_TYPE,
 291                                          &td->trust_type);
 292         if (!res) {
 293                 return false;
 294         }
 295
 296         *_td = td;
 297
 298         return true;
 299 }
 300
 301 static NTSTATUS ipasam_get_trusted_domain(struct pdb_methods *methods,
 302                                           TALLOC_CTX *mem_ctx,
 303                                           const char *domain,
 304                                           struct pdb_trusted_domain **td)
 305 {
 306         struct ldapsam_privates *ldap_state =
 307                 (struct ldapsam_privates *)methods->private_data;
 308         LDAPMessage *entry = NULL;
 309
 310         DEBUG(10, ("ipasam_get_trusted_domain called for domain %s\n", domain));
 311
 312         if (!get_trusted_domain_by_name_int(ldap_state, talloc_tos(), domain,
 313                                             &entry)) {
 314                 return NT_STATUS_UNSUCCESSFUL;
 315         }
 316         if (entry == NULL) {
 317                 DEBUG(5, ("ipasam_get_trusted_domain: no such trusted domain: "
 318                           "%s\n", domain));
 319                 return NT_STATUS_NO_SUCH_DOMAIN;
 320         }
 321
 322         if (!fill_pdb_trusted_domain(mem_ctx, ldap_state, entry, td)) {
 323                 return NT_STATUS_UNSUCCESSFUL;
 324         }
 325
 326         return NT_STATUS_OK;
 327 }
 328
 329 static NTSTATUS ipasam_get_trusted_domain_by_sid(struct pdb_methods *methods,
 330                                                  TALLOC_CTX *mem_ctx,
 331                                                  struct dom_sid *sid,
 332                                                  struct pdb_trusted_domain **td)
 333 {
 334         struct ldapsam_privates *ldap_state =
 335                 (struct ldapsam_privates *)methods->private_data;
 336         LDAPMessage *entry = NULL;
 337         char *sid_str;
 338
 339         sid_str = sid_string_tos(sid);
 340
 341         DEBUG(10, ("ipasam_get_trusted_domain_by_sid called for sid %s\n",
 342                    sid_str));
 343
 344         if (!get_trusted_domain_by_sid_int(ldap_state, talloc_tos(), sid_str,
 345                                            &entry)) {
 346                 return NT_STATUS_UNSUCCESSFUL;
 347         }
 348         if (entry == NULL) {
 349                 DEBUG(5, ("ipasam_get_trusted_domain_by_sid: no trusted domain "
 350                           "with sid: %s\n", sid_str));
 351                 return NT_STATUS_NO_SUCH_DOMAIN;
 352         }
 353
 354         if (!fill_pdb_trusted_domain(mem_ctx, ldap_state, entry, td)) {
 355                 return NT_STATUS_UNSUCCESSFUL;
 356         }
 357
 358         return NT_STATUS_OK;
 359 }
 360
 361 static bool smbldap_make_mod_uint32_t(LDAP *ldap_struct, LDAPMessage *entry,
 362                                       LDAPMod ***mods, const char *attribute,
 363                                       const uint32_t val)
 364 {
 365         char *dummy;
 366
 367         dummy = talloc_asprintf(talloc_tos(), "%lu", (unsigned long) val);
 368         if (dummy == NULL) {
 369                 return false;
 370         }
 371         smbldap_make_mod(ldap_struct, entry, mods, attribute, dummy);
 372         TALLOC_FREE(dummy);
 373
 374         return true;
 375 }
 376
 377 static bool smbldap_make_mod_blob(LDAP *ldap_struct, LDAPMessage *entry,
 378                                   LDAPMod ***mods, const char *attribute,
 379                                   DATA_BLOB blob)
 380 {
 381         char *dummy;
 382
 383         dummy = base64_encode_data_blob(talloc_tos(), blob);
 384         if (dummy == NULL) {
 385                 return false;
 386         }
 387
 388         smbldap_make_mod(ldap_struct, entry, mods, attribute, dummy);
 389         TALLOC_FREE(dummy);
 390
 391         return true;
 392 }
 393
 394 static NTSTATUS ipasam_set_trusted_domain(struct pdb_methods *methods,
 395                                           const char* domain,
 396                                           const struct pdb_trusted_domain *td)
 397 {
 398         struct ldapsam_privates *ldap_state =
 399                 (struct ldapsam_privates *)methods->private_data;
 400         LDAPMessage *entry = NULL;
 401         LDAPMod **mods;
 402         bool res;
 403         char *trusted_dn = NULL;
 404         int ret;
 405
 406         DEBUG(10, ("ipasam_set_trusted_domain called for domain %s\n", domain));
 407
 408         res = get_trusted_domain_by_name_int(ldap_state, talloc_tos(), domain,
 409                                              &entry);
 410         if (!res) {
 411                 return NT_STATUS_UNSUCCESSFUL;
 412         }
 413
 414         mods = NULL;
 415         smbldap_make_mod(priv2ld(ldap_state), entry, &mods, "objectClass",
 416                          LDAP_OBJ_TRUSTED_DOMAIN);
 417
 418         if (td->netbios_name != NULL) {
 419                 smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
 420                                  LDAP_ATTRIBUTE_FLAT_NAME,
 421                                  td->netbios_name);
 422         }
 423
 424         if (td->domain_name != NULL) {
 425                 smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
 426                                  LDAP_ATTRIBUTE_TRUST_PARTNER,
 427                                  td->domain_name);
 428         }
 429
 430         if (!is_null_sid(&td->security_identifier)) {
 431                 smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
 432                                  LDAP_ATTRIBUTE_SECURITY_IDENTIFIER,
 433                                  sid_string_tos(&td->security_identifier));
 434         }
 435
 436         if (td->trust_type != 0) {
 437                 res = smbldap_make_mod_uint32_t(priv2ld(ldap_state), entry,
 438                                                 &mods, LDAP_ATTRIBUTE_TRUST_TYPE,
 439                                                 td->trust_type);
 440                 if (!res) {
 441                         return NT_STATUS_UNSUCCESSFUL;
 442                 }
 443         }
 444
 445         if (td->trust_attributes != 0) {
 446                 res = smbldap_make_mod_uint32_t(priv2ld(ldap_state), entry,
 447                                                 &mods,
 448                                                 LDAP_ATTRIBUTE_TRUST_ATTRIBUTES,
 449                                                 td->trust_attributes);
 450                 if (!res) {
 451                         return NT_STATUS_UNSUCCESSFUL;
 452                 }
 453         }
 454
 455         if (td->trust_direction != 0) {
 456                 res = smbldap_make_mod_uint32_t(priv2ld(ldap_state), entry,
 457                                                 &mods,
 458                                                 LDAP_ATTRIBUTE_TRUST_DIRECTION,
 459                                                 td->trust_direction);
 460                 if (!res) {
 461                         return NT_STATUS_UNSUCCESSFUL;
 462                 }
 463         }
 464
 465         if (td->trust_auth_outgoing.data != NULL) {
 466                 res = smbldap_make_mod_blob(priv2ld(ldap_state), entry,
 467                                             &mods,
 468                                             LDAP_ATTRIBUTE_TRUST_AUTH_OUTGOING,
 469                                             td->trust_auth_outgoing);
 470                 if (!res) {
 471                         return NT_STATUS_UNSUCCESSFUL;
 472                 }
 473         }
 474
 475         if (td->trust_auth_incoming.data != NULL) {
 476                 res = smbldap_make_mod_blob(priv2ld(ldap_state), entry,
 477                                             &mods,
 478                                             LDAP_ATTRIBUTE_TRUST_AUTH_INCOMING,
 479                                             td->trust_auth_incoming);
 480                 if (!res) {
 481                         return NT_STATUS_UNSUCCESSFUL;
 482                 }
 483         }
 484
 485         talloc_autofree_ldapmod(talloc_tos(), mods);
 486
 487         trusted_dn = trusted_domain_dn(ldap_state, domain);
 488         if (trusted_dn == NULL) {
 489                 return NT_STATUS_NO_MEMORY;
 490         }
 491         if (entry == NULL) {
 492                 ret = smbldap_add(ldap_state->smbldap_state, trusted_dn, mods);
 493         } else {
 494                 ret = smbldap_modify(ldap_state->smbldap_state, trusted_dn, mods);
 495         }
 496
 497         if (ret != LDAP_SUCCESS) {
 498                 DEBUG(1, ("error writing trusted domain data!\n"));
 499                 return NT_STATUS_UNSUCCESSFUL;
 500         }
 501         return NT_STATUS_OK;
 502 }
 503
 504 static NTSTATUS ipasam_del_trusted_domain(struct pdb_methods *methods,
 505                                           const char *domain)
 506 {
 507         int ret;
 508         struct ldapsam_privates *ldap_state =
 509                 (struct ldapsam_privates *)methods->private_data;
 510         LDAPMessage *entry = NULL;
 511         const char *dn;
 512
 513         if (!get_trusted_domain_by_name_int(ldap_state, talloc_tos(), domain,
 514                                             &entry)) {
 515                 return NT_STATUS_UNSUCCESSFUL;
 516         }
 517
 518         if (entry == NULL) {
 519                 DEBUG(5, ("ipasam_del_trusted_domain: no such trusted domain: "
 520                           "%s\n", domain));
 521                 return NT_STATUS_NO_SUCH_DOMAIN;
 522         }
 523
 524         dn = smbldap_talloc_dn(talloc_tos(), priv2ld(ldap_state), entry);
 525         if (dn == NULL) {
 526                 DEBUG(0,("ipasam_del_trusted_domain: Out of memory!\n"));
 527                 return NT_STATUS_NO_MEMORY;
 528         }
 529
 530         ret = smbldap_delete(ldap_state->smbldap_state, dn);
 531         if (ret != LDAP_SUCCESS) {
 532                 return NT_STATUS_UNSUCCESSFUL;
 533         }
 534
 535         return NT_STATUS_OK;
 536 }
 537
 538 static NTSTATUS ipasam_enum_trusted_domains(struct pdb_methods *methods,
 539                                             TALLOC_CTX *mem_ctx,
 540                                             uint32_t *num_domains,
 541                                             struct pdb_trusted_domain ***domains)
 542 {
 543         int rc;
 544         struct ldapsam_privates *ldap_state =
 545                 (struct ldapsam_privates *)methods->private_data;
 546         char *base_dn = NULL;
 547         char *filter = NULL;
 548         int scope = LDAP_SCOPE_SUBTREE;
 549         LDAPMessage *result = NULL;
 550         LDAPMessage *entry = NULL;
 551
 552         filter = talloc_asprintf(talloc_tos(), "(objectClass=%s)",
 553                                  LDAP_OBJ_TRUSTED_DOMAIN);
 554         if (filter == NULL) {
 555                 return NT_STATUS_NO_MEMORY;
 556         }
 557
 558         base_dn = trusted_domain_base_dn(ldap_state);
 559         if (base_dn == NULL) {
 560                 TALLOC_FREE(filter);
 561                 return NT_STATUS_NO_MEMORY;
 562         }
 563
 564         rc = smbldap_search(ldap_state->smbldap_state, base_dn, scope, filter,
 565                             NULL, 0, &result);
 566         TALLOC_FREE(filter);
 567         TALLOC_FREE(base_dn);
 568
 569         if (result != NULL) {
 570                 talloc_autofree_ldapmsg(mem_ctx, result);
 571         }
 572
 573         if (rc == LDAP_NO_SUCH_OBJECT) {
 574                 *num_domains = 0;
 575                 *domains = NULL;
 576                 return NT_STATUS_OK;
 577         }
 578
 579         if (rc != LDAP_SUCCESS) {
 580                 return NT_STATUS_UNSUCCESSFUL;
 581         }
 582
 583         *num_domains = 0;
 584         if (!(*domains = TALLOC_ARRAY(mem_ctx, struct pdb_trusted_domain *, 1))) {
 585                 DEBUG(1, ("talloc failed\n"));
 586                 return NT_STATUS_NO_MEMORY;
 587         }
 588
 589         for (entry = ldap_first_entry(priv2ld(ldap_state), result);
 590              entry != NULL;
 591              entry = ldap_next_entry(priv2ld(ldap_state), entry))
 592         {
 593                 struct pdb_trusted_domain *dom_info;
 594
 595                 if (!fill_pdb_trusted_domain(*domains, ldap_state, entry,
 596                                              &dom_info)) {
 597                         return NT_STATUS_UNSUCCESSFUL;
 598                 }
 599
 600                 ADD_TO_ARRAY(*domains, struct pdb_trusted_domain *, dom_info,
 601                              domains, num_domains);
 602
 603                 if (*domains == NULL) {
 604                         DEBUG(1, ("talloc failed\n"));
 605                         return NT_STATUS_NO_MEMORY;
 606                 }
 607         }
 608
 609         DEBUG(5, ("ipasam_enum_trusted_domains: got %d domains\n", *num_domains));
 610         return NT_STATUS_OK;
 611 }
 612
 613 static NTSTATUS ipasam_enum_trusteddoms(struct pdb_methods *methods,
 614                                         TALLOC_CTX *mem_ctx,
 615                                         uint32_t *num_domains,
 616                                         struct trustdom_info ***domains)
 617 {
 618         NTSTATUS status;
 619         struct pdb_trusted_domain **td;
 620         int i;
 621
 622         status = ipasam_enum_trusted_domains(methods, talloc_tos(),
 623                                              num_domains, &td);
 624         if (!NT_STATUS_IS_OK(status)) {
 625                 return status;
 626         }
 627
 628         if (*num_domains == 0) {
 629                 return NT_STATUS_OK;
 630         }
 631
 632         if (!(*domains = TALLOC_ARRAY(mem_ctx, struct trustdom_info *,
 633                                       *num_domains))) {
 634                 DEBUG(1, ("talloc failed\n"));
 635                 return NT_STATUS_NO_MEMORY;
 636         }
 637
 638         for (i = 0; i < *num_domains; i++) {
 639                 struct trustdom_info *dom_info;
 640
 641                 dom_info = TALLOC_P(*domains, struct trustdom_info);
 642                 if (dom_info == NULL) {
 643                         DEBUG(1, ("talloc failed\n"));
 644                         return NT_STATUS_NO_MEMORY;
 645                 }
 646
 647                 dom_info->name = talloc_steal(mem_ctx, td[i]->netbios_name);
 648                 sid_copy(&dom_info->sid, &td[i]->security_identifier);
 649
 650                 (*domains)[i] = dom_info;
 651         }
 652
 653         return NT_STATUS_OK;
 654 }
 655
 656 static NTSTATUS pdb_init_IPA_ldapsam(struct pdb_methods **pdb_method, const char *location)
 657 {
 658         struct ldapsam_privates *ldap_state;
 659
 660         NTSTATUS nt_status = pdb_init_ldapsam(pdb_method, location);
 661
 662         (*pdb_method)->name = "IPA_ldapsam";
 663
 664         ldap_state = (struct ldapsam_privates *)((*pdb_method)->private_data);
 665         ldap_state->is_ipa_ldap = true;
 666
 667         (*pdb_method)->get_trusteddom_pw = ipasam_get_trusteddom_pw;
 668         (*pdb_method)->set_trusteddom_pw = ipasam_set_trusteddom_pw;
 669         (*pdb_method)->del_trusteddom_pw = ipasam_del_trusteddom_pw;
 670         (*pdb_method)->enum_trusteddoms = ipasam_enum_trusteddoms;
 671
 672         (*pdb_method)->get_trusted_domain = ipasam_get_trusted_domain;
 673         (*pdb_method)->get_trusted_domain_by_sid = ipasam_get_trusted_domain_by_sid;
 674         (*pdb_method)->set_trusted_domain = ipasam_set_trusted_domain;
 675         (*pdb_method)->del_trusted_domain = ipasam_del_trusted_domain;
 676         (*pdb_method)->enum_trusted_domains = ipasam_enum_trusted_domains;
 677
 678         return nt_status;
 679 }
 680
 681 NTSTATUS pdb_ipa_init(void)
 682 {
 683         NTSTATUS nt_status;
 684
 685         if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "IPA_ldapsam", pdb_init_IPA_ldapsam)))
 686                 return nt_status;
 687
 688         return NT_STATUS_OK;
 689 }