2 Unix SMB/CIFS implementation.
3 LDAP protocol helper functions for SAMBA
4 Copyright (C) Jean François Micouleau 1998
5 Copyright (C) Gerald Carter 2001-2003
6 Copyright (C) Shahms King 2001
7 Copyright (C) Andrew Bartlett 2002-2003
8 Copyright (C) Stefan (metze) Metzmacher 2002-2003
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 * persistent connections: if using NSS LDAP, many connections are made
28 * however, using only one within Samba would be nice
30 * Clean up SSL stuff, compile on OpenLDAP 1.x, 2.x, and Netscape SDK
32 * Other LDAP based login attributes: accountExpires, etc.
33 * (should be the domain of Samba proper, but the sam_password/SAM_ACCOUNT
34 * structures don't have fields for some of these attributes)
36 * SSL is done, but can't get the certificate based authentication to work
37 * against on my test platform (Linux 2.4, OpenLDAP 2.x)
40 /* NOTE: this will NOT work against an Active Directory server
41 * due to the fact that the two password fields cannot be retrieved
42 * from a server; recommend using security = domain in this situation
49 #define DBGC_CLASS DBGC_PASSDB
55 * Work around versions of the LDAP client libs that don't have the OIDs
56 * defined, or have them defined under the old name.
57 * This functionality is really a factor of the server, not the client
61 #if defined(LDAP_EXOP_X_MODIFY_PASSWD) && !defined(LDAP_EXOP_MODIFY_PASSWD)
62 #define LDAP_EXOP_MODIFY_PASSWD LDAP_EXOP_X_MODIFY_PASSWD
63 #elif !defined(LDAP_EXOP_MODIFY_PASSWD)
64 #define LDAP_EXOP_MODIFY_PASSWD "1.3.6.1.4.1.4203.1.11.1"
67 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_ID) && !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
68 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID LDAP_EXOP_X_MODIFY_PASSWD_ID
69 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_ID)
70 #define LDAP_TAG_EXOP_MODIFY_PASSWD_ID ((ber_tag_t) 0x80U)
73 #if defined(LDAP_EXOP_X_MODIFY_PASSWD_NEW) && !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
74 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW LDAP_EXOP_X_MODIFY_PASSWD_NEW
75 #elif !defined(LDAP_EXOP_MODIFY_PASSWD_NEW)
76 #define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ((ber_tag_t) 0x82U)
81 #define SAM_ACCOUNT struct sam_passwd
86 /**********************************************************************
87 Free a LDAPMessage (one is stored on the SAM_ACCOUNT).
88 **********************************************************************/
90 void private_data_free_fn(void **result)
92 ldap_msgfree(*result);
96 /**********************************************************************
97 Get the attribute name given a user schame version.
98 **********************************************************************/
100 static const char* get_userattr_key2string( int schema_ver, int key )
102 switch ( schema_ver ) {
103 case SCHEMAVER_SAMBAACCOUNT:
104 return get_attr_key2string( attrib_map_v22, key );
106 case SCHEMAVER_SAMBASAMACCOUNT:
107 return get_attr_key2string( attrib_map_v30, key );
110 DEBUG(0,("get_userattr_key2string: unknown schema version specified\n"));
116 /**********************************************************************
117 Return the list of attribute names given a user schema version.
118 **********************************************************************/
120 const char** get_userattr_list( int schema_ver )
122 switch ( schema_ver ) {
123 case SCHEMAVER_SAMBAACCOUNT:
124 return get_attr_list( attrib_map_v22 );
126 case SCHEMAVER_SAMBASAMACCOUNT:
127 return get_attr_list( attrib_map_v30 );
129 DEBUG(0,("get_userattr_list: unknown schema version specified!\n"));
136 /**************************************************************************
137 Return the list of attribute names to delete given a user schema version.
138 **************************************************************************/
140 static const char** get_userattr_delete_list( int schema_ver )
142 switch ( schema_ver ) {
143 case SCHEMAVER_SAMBAACCOUNT:
144 return get_attr_list( attrib_map_to_delete_v22 );
146 case SCHEMAVER_SAMBASAMACCOUNT:
147 return get_attr_list( attrib_map_to_delete_v30 );
149 DEBUG(0,("get_userattr_delete_list: unknown schema version specified!\n"));
157 /*******************************************************************
158 Generate the LDAP search filter for the objectclass based on the
159 version of the schema we are using.
160 ******************************************************************/
162 static const char* get_objclass_filter( int schema_ver )
164 static fstring objclass_filter;
166 switch( schema_ver ) {
167 case SCHEMAVER_SAMBAACCOUNT:
168 fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBAACCOUNT );
170 case SCHEMAVER_SAMBASAMACCOUNT:
171 fstr_sprintf( objclass_filter, "(objectclass=%s)", LDAP_OBJ_SAMBASAMACCOUNT );
174 DEBUG(0,("get_objclass_filter: Invalid schema version specified!\n"));
178 return objclass_filter;
181 /*******************************************************************
182 Run the search by name.
183 ******************************************************************/
185 int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
187 LDAPMessage ** result,
191 char *escape_user = escape_ldap_string_alloc(user);
194 return LDAP_NO_MEMORY;
198 * in the filter expression, replace %u with the real name
199 * so in ldap filter, %u MUST exist :-)
201 pstr_sprintf(filter, "(&%s%s)", lp_ldap_filter(),
202 get_objclass_filter(ldap_state->schema_ver));
205 * have to use this here because $ is filtered out
210 all_string_sub(filter, "%u", escape_user, sizeof(pstring));
211 SAFE_FREE(escape_user);
213 return smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
216 /*******************************************************************
217 Run the search by rid.
218 ******************************************************************/
220 static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
221 uint32 rid, LDAPMessage ** result,
227 pstr_sprintf(filter, "(&(rid=%i)%s)", rid,
228 get_objclass_filter(ldap_state->schema_ver));
230 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
235 /*******************************************************************
236 Run the search by SID.
237 ******************************************************************/
239 static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
240 const DOM_SID *sid, LDAPMessage ** result,
247 pstr_sprintf(filter, "(&(%s=%s)%s)",
248 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
249 sid_to_string(sid_string, sid),
250 get_objclass_filter(ldap_state->schema_ver));
252 rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
257 /*******************************************************************
258 Delete complete object or objectclass and attrs from
259 object found in search_result depending on lp_ldap_delete_dn
260 ******************************************************************/
262 static NTSTATUS ldapsam_delete_entry(struct ldapsam_privates *ldap_state,
264 const char *objectclass,
268 LDAPMessage *entry = NULL;
269 LDAPMod **mods = NULL;
271 BerElement *ptr = NULL;
273 rc = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
276 DEBUG(0, ("ldapsam_delete_entry: Entry must exist exactly once!\n"));
277 return NT_STATUS_UNSUCCESSFUL;
280 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
281 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
283 return NT_STATUS_UNSUCCESSFUL;
286 if (lp_ldap_delete_dn()) {
287 NTSTATUS ret = NT_STATUS_OK;
288 rc = smbldap_delete(ldap_state->smbldap_state, dn);
290 if (rc != LDAP_SUCCESS) {
291 DEBUG(0, ("ldapsam_delete_entry: Could not delete object %s\n", dn));
292 ret = NT_STATUS_UNSUCCESSFUL;
298 /* Ok, delete only the SAM attributes */
300 for (name = ldap_first_attribute(ldap_state->smbldap_state->ldap_struct, entry, &ptr);
302 name = ldap_next_attribute(ldap_state->smbldap_state->ldap_struct, entry, ptr)) {
305 /* We are only allowed to delete the attributes that
308 for (attrib = attrs; *attrib != NULL; attrib++) {
309 /* Don't delete LDAP_ATTR_MOD_TIMESTAMP attribute. */
310 if (strequal(*attrib, get_userattr_key2string(ldap_state->schema_ver,
311 LDAP_ATTR_MOD_TIMESTAMP))) {
314 if (strequal(*attrib, name)) {
315 DEBUG(10, ("ldapsam_delete_entry: deleting "
316 "attribute %s\n", name));
317 smbldap_set_mod(&mods, LDAP_MOD_DELETE, name,
329 smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
331 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
332 ldap_mods_free(mods, True);
334 if (rc != LDAP_SUCCESS) {
335 char *ld_error = NULL;
336 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
339 DEBUG(0, ("ldapsam_delete_entry: Could not delete attributes for %s, error: %s (%s)\n",
340 dn, ldap_err2string(rc), ld_error?ld_error:"unknown"));
343 return NT_STATUS_UNSUCCESSFUL;
350 /* New Interface is being implemented here */
352 #if 0 /* JERRY - not uesed anymore */
354 /**********************************************************************
355 Initialize SAM_ACCOUNT from an LDAP query (unix attributes only)
356 *********************************************************************/
357 static BOOL get_unix_attributes (struct ldapsam_privates *ldap_state,
358 SAM_ACCOUNT * sampass,
367 if ((ldap_values = ldap_get_values (ldap_state->smbldap_state->ldap_struct, entry, "objectClass")) == NULL) {
368 DEBUG (1, ("get_unix_attributes: no objectClass! \n"));
372 for (values=ldap_values;*values;values++) {
373 if (strequal(*values, LDAP_OBJ_POSIXACCOUNT )) {
378 if (!*values) { /*end of array, no posixAccount */
379 DEBUG(10, ("user does not have %s attributes\n", LDAP_OBJ_POSIXACCOUNT));
380 ldap_value_free(ldap_values);
383 ldap_value_free(ldap_values);
385 if ( !smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
386 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_UNIX_HOME), homedir) )
391 if ( !smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
392 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_GIDNUMBER), temp) )
397 *gid = (gid_t)atol(temp);
399 pdb_set_unix_homedir(sampass, homedir, PDB_SET);
401 DEBUG(10, ("user has %s attributes\n", LDAP_OBJ_POSIXACCOUNT));
408 static time_t ldapsam_get_entry_timestamp(
409 struct ldapsam_privates *ldap_state,
415 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
416 get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
420 strptime(temp, "%Y%m%d%H%M%SZ", &tm);
425 /**********************************************************************
426 Initialize SAM_ACCOUNT from an LDAP query.
427 (Based on init_sam_from_buffer in pdb_tdb.c)
428 *********************************************************************/
430 static BOOL init_sam_from_ldap(struct ldapsam_privates *ldap_state,
431 SAM_ACCOUNT * sampass,
438 pass_can_change_time,
439 pass_must_change_time,
452 char munged_dial[2048];
454 uint8 smblmpwd[LM_HASH_LEN],
455 smbntpwd[NT_HASH_LEN];
456 BOOL use_samba_attrs = True;
457 uint16 acct_ctrl = 0,
459 uint16 bad_password_count = 0,
462 uint8 hours[MAX_HOURS_LEN];
464 LOGIN_CACHE *cache_entry = NULL;
469 * do a little initialization
473 nt_username[0] = '\0';
477 logon_script[0] = '\0';
478 profile_path[0] = '\0';
480 munged_dial[0] = '\0';
481 workstations[0] = '\0';
484 if (sampass == NULL || ldap_state == NULL || entry == NULL) {
485 DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
489 if (ldap_state->smbldap_state->ldap_struct == NULL) {
490 DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->ldap_struct is NULL!\n"));
494 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry, "uid", username)) {
495 DEBUG(1, ("init_sam_from_ldap: No uid attribute found for this user!\n"));
499 DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
501 pstrcpy(nt_username, username);
503 pstrcpy(domain, ldap_state->domain_name);
505 pdb_set_username(sampass, username, PDB_SET);
507 pdb_set_domain(sampass, domain, PDB_DEFAULT);
508 pdb_set_nt_username(sampass, nt_username, PDB_SET);
510 /* deal with different attributes between the schema first */
512 if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
513 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
514 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp)) {
515 pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
518 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
519 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_SID), temp)) {
520 pdb_set_group_sid_from_string(sampass, temp, PDB_SET);
522 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
525 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
526 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp)) {
527 user_rid = (uint32)atol(temp);
528 pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
531 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
532 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PRIMARY_GROUP_RID), temp)) {
533 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
537 group_rid = (uint32)atol(temp);
539 /* for some reason, we often have 0 as a primary group RID.
540 Make sure that we treat this just as a 'default' value */
543 pdb_set_group_sid_from_rid(sampass, group_rid, PDB_SET);
545 pdb_set_group_sid_from_rid(sampass, DOMAIN_GROUP_RID_USERS, PDB_DEFAULT);
549 if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
550 DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
551 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
552 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
557 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
558 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) {
559 /* leave as default */
561 pass_last_set_time = (time_t) atol(temp);
562 pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
565 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
566 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp)) {
567 /* leave as default */
569 logon_time = (time_t) atol(temp);
570 pdb_set_logon_time(sampass, logon_time, PDB_SET);
573 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
574 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp)) {
575 /* leave as default */
577 logoff_time = (time_t) atol(temp);
578 pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
581 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
582 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp)) {
583 /* leave as default */
585 kickoff_time = (time_t) atol(temp);
586 pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
589 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
590 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp)) {
591 /* leave as default */
593 pass_can_change_time = (time_t) atol(temp);
594 pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
597 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
598 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp)) {
599 /* leave as default */
601 pass_must_change_time = (time_t) atol(temp);
602 pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
605 /* recommend that 'gecos' and 'displayName' should refer to the same
606 * attribute OID. userFullName depreciated, only used by Samba
607 * primary rules of LDAP: don't make a new attribute when one is already defined
608 * that fits your needs; using cn then displayName rather than 'userFullName'
611 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
612 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname)) {
613 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
614 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname)) {
615 /* leave as default */
617 pdb_set_fullname(sampass, fullname, PDB_SET);
620 pdb_set_fullname(sampass, fullname, PDB_SET);
623 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
624 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive))
626 pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
628 pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
631 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
632 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir))
634 pdb_set_homedir( sampass,
635 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_home()),
638 pstrcpy( tmpstring, homedir );
639 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
640 pdb_set_homedir(sampass, tmpstring, PDB_SET);
643 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
644 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script))
646 pdb_set_logon_script( sampass,
647 talloc_sub_basic(sampass->mem_ctx, username, lp_logon_script()),
650 pstrcpy( tmpstring, logon_script );
651 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
652 pdb_set_logon_script(sampass, tmpstring, PDB_SET);
655 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
656 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path))
658 pdb_set_profile_path( sampass,
659 talloc_sub_basic( sampass->mem_ctx, username, lp_logon_path()),
662 pstrcpy( tmpstring, profile_path );
663 standard_sub_basic( username, tmpstring, sizeof(tmpstring) );
664 pdb_set_profile_path(sampass, tmpstring, PDB_SET);
667 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
668 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC), acct_desc))
670 /* leave as default */
672 pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
675 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
676 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations)) {
677 /* leave as default */;
679 pdb_set_workstations(sampass, workstations, PDB_SET);
682 if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
683 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL), munged_dial, sizeof(munged_dial))) {
684 /* leave as default */;
686 pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
689 /* FIXME: hours stuff should be cleaner */
693 memset(hours, 0xff, hours_len);
695 if (ldap_state->is_nds_ldap) {
698 char clear_text_pw[512];
700 /* Make call to Novell eDirectory ldap extension to get clear text password.
701 NOTE: This will only work if we have an SSL connection to eDirectory. */
702 user_dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
703 if (user_dn != NULL) {
704 DEBUG(3, ("init_sam_from_ldap: smbldap_get_dn(%s) returned '%s'\n", username, user_dn));
706 pwd_len = sizeof(clear_text_pw);
707 if (pdb_nds_get_password(ldap_state->smbldap_state, user_dn, &pwd_len, clear_text_pw) == LDAP_SUCCESS) {
708 nt_lm_owf_gen(clear_text_pw, smbntpwd, smblmpwd);
709 if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
711 ZERO_STRUCT(smblmpwd);
712 if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
714 ZERO_STRUCT(smbntpwd);
715 use_samba_attrs = False;
718 DEBUG(0, ("init_sam_from_ldap: failed to get user_dn for '%s'\n", username));
722 if (use_samba_attrs) {
723 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
724 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp)) {
725 /* leave as default */
727 pdb_gethexpwd(temp, smblmpwd);
728 memset((char *)temp, '\0', strlen(temp)+1);
729 if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
731 ZERO_STRUCT(smblmpwd);
734 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
735 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp)) {
736 /* leave as default */
738 pdb_gethexpwd(temp, smbntpwd);
739 memset((char *)temp, '\0', strlen(temp)+1);
740 if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
742 ZERO_STRUCT(smbntpwd);
746 account_policy_get(AP_PASSWORD_HISTORY, &pwHistLen);
748 uint8 *pwhist = NULL;
751 /* We can only store (sizeof(pstring)-1)/64 password history entries. */
752 pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));
754 if ((pwhist = SMB_MALLOC(pwHistLen * PW_HISTORY_ENTRY_LEN)) == NULL){
755 DEBUG(0, ("init_sam_from_ldap: malloc failed!\n"));
758 memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
760 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
761 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY), temp)) {
762 /* leave as default - zeros */
764 BOOL hex_failed = False;
765 for (i = 0; i < pwHistLen; i++){
766 /* Get the 16 byte salt. */
767 if (!pdb_gethexpwd(&temp[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN])) {
771 /* Get the 16 byte MD5 hash of salt+passwd. */
772 if (!pdb_gethexpwd(&temp[(i*64)+32],
773 &pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN])) {
779 DEBUG(0,("init_sam_from_ldap: Failed to get password history for user %s\n",
781 memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
784 if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
791 if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
792 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp)) {
793 acct_ctrl |= ACB_NORMAL;
795 acct_ctrl = pdb_decode_acct_ctrl(temp);
798 acct_ctrl |= ACB_NORMAL;
800 pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
803 pdb_set_hours_len(sampass, hours_len, PDB_SET);
804 pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
806 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
807 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_COUNT), temp)) {
808 /* leave as default */
810 bad_password_count = (uint32) atol(temp);
811 pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET);
814 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
815 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_TIME), temp)) {
816 /* leave as default */
818 bad_password_time = (time_t) atol(temp);
819 pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
823 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
824 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_COUNT), temp)) {
825 /* leave as default */
827 logon_count = (uint32) atol(temp);
828 pdb_set_logon_count(sampass, logon_count, PDB_SET);
831 /* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
833 if(!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
834 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_HOURS), temp)) {
835 /* leave as default */
837 pdb_gethexhours(temp, hours);
838 memset((char *)temp, '\0', strlen(temp) +1);
839 pdb_set_hours(sampass, hours, PDB_SET);
843 /* check the timestamp of the cache vs ldap entry */
844 if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
848 /* see if we have newer updates */
849 if (!(cache_entry = login_cache_read(sampass))) {
850 DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
851 (unsigned int)pdb_get_bad_password_count(sampass),
852 (unsigned int)pdb_get_bad_password_time(sampass)));
856 DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
857 (unsigned int)ldap_entry_time, (unsigned int)cache_entry->entry_timestamp,
858 (unsigned int)cache_entry->bad_password_time));
860 if (ldap_entry_time > cache_entry->entry_timestamp) {
861 /* cache is older than directory , so
862 we need to delete the entry but allow the
863 fields to be written out */
864 login_cache_delentry(sampass);
867 pdb_set_acct_ctrl(sampass,
868 pdb_get_acct_ctrl(sampass) |
869 (cache_entry->acct_ctrl & ACB_AUTOLOCK),
871 pdb_set_bad_password_count(sampass,
872 cache_entry->bad_password_count,
874 pdb_set_bad_password_time(sampass,
875 cache_entry->bad_password_time,
879 SAFE_FREE(cache_entry);
883 /**********************************************************************
884 Initialize the ldap db from a SAM_ACCOUNT. Called on update.
885 (Based on init_buffer_from_sam in pdb_tdb.c)
886 *********************************************************************/
888 static BOOL init_ldap_from_sam (struct ldapsam_privates *ldap_state,
889 LDAPMessage *existing,
890 LDAPMod *** mods, SAM_ACCOUNT * sampass,
891 BOOL (*need_update)(const SAM_ACCOUNT *,
897 if (mods == NULL || sampass == NULL) {
898 DEBUG(0, ("init_ldap_from_sam: NULL parameters found!\n"));
905 * took out adding "objectclass: sambaAccount"
906 * do this on a per-mod basis
908 if (need_update(sampass, PDB_USERNAME))
909 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
910 "uid", pdb_get_username(sampass));
912 DEBUG(2, ("init_ldap_from_sam: Setting entry for user: %s\n", pdb_get_username(sampass)));
914 /* only update the RID if we actually need to */
915 if (need_update(sampass, PDB_USERSID)) {
917 fstring dom_sid_string;
918 const DOM_SID *user_sid = pdb_get_user_sid(sampass);
920 switch ( ldap_state->schema_ver ) {
921 case SCHEMAVER_SAMBAACCOUNT:
922 if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
923 DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
924 sid_to_string(sid_string, user_sid),
925 sid_to_string(dom_sid_string, &ldap_state->domain_sid)));
928 slprintf(temp, sizeof(temp) - 1, "%i", rid);
929 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
930 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
934 case SCHEMAVER_SAMBASAMACCOUNT:
935 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
936 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
937 sid_to_string(sid_string, user_sid));
941 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
946 /* we don't need to store the primary group RID - so leaving it
947 'free' to hang off the unix primary group makes life easier */
949 if (need_update(sampass, PDB_GROUPSID)) {
951 fstring dom_sid_string;
952 const DOM_SID *group_sid = pdb_get_group_sid(sampass);
954 switch ( ldap_state->schema_ver ) {
955 case SCHEMAVER_SAMBAACCOUNT:
956 if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
957 DEBUG(1, ("init_ldap_from_sam: User's Primary Group SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
958 sid_to_string(sid_string, group_sid),
959 sid_to_string(dom_sid_string, &ldap_state->domain_sid)));
963 slprintf(temp, sizeof(temp) - 1, "%i", rid);
964 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
965 get_userattr_key2string(ldap_state->schema_ver,
966 LDAP_ATTR_PRIMARY_GROUP_RID), temp);
969 case SCHEMAVER_SAMBASAMACCOUNT:
970 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
971 get_userattr_key2string(ldap_state->schema_ver,
972 LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_string(sid_string, group_sid));
976 DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
982 /* displayName, cn, and gecos should all be the same
983 * most easily accomplished by giving them the same OID
984 * gecos isn't set here b/c it should be handled by the
986 * We change displayName only and fall back to cn if
990 if (need_update(sampass, PDB_FULLNAME))
991 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
992 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME),
993 pdb_get_fullname(sampass));
995 if (need_update(sampass, PDB_ACCTDESC))
996 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
997 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC),
998 pdb_get_acct_desc(sampass));
1000 if (need_update(sampass, PDB_WORKSTATIONS))
1001 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1002 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
1003 pdb_get_workstations(sampass));
1005 if (need_update(sampass, PDB_MUNGEDDIAL))
1006 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1007 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL),
1008 pdb_get_munged_dial(sampass));
1010 if (need_update(sampass, PDB_SMBHOME))
1011 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1012 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
1013 pdb_get_homedir(sampass));
1015 if (need_update(sampass, PDB_DRIVE))
1016 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1017 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
1018 pdb_get_dir_drive(sampass));
1020 if (need_update(sampass, PDB_LOGONSCRIPT))
1021 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1022 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT),
1023 pdb_get_logon_script(sampass));
1025 if (need_update(sampass, PDB_PROFILE))
1026 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1027 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
1028 pdb_get_profile_path(sampass));
1030 slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logon_time(sampass));
1031 if (need_update(sampass, PDB_LOGONTIME))
1032 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1033 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
1035 slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logoff_time(sampass));
1036 if (need_update(sampass, PDB_LOGOFFTIME))
1037 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1038 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
1040 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_kickoff_time(sampass));
1041 if (need_update(sampass, PDB_KICKOFFTIME))
1042 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1043 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
1045 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_can_change_time(sampass));
1046 if (need_update(sampass, PDB_CANCHANGETIME))
1047 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1048 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
1050 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_must_change_time(sampass));
1051 if (need_update(sampass, PDB_MUSTCHANGETIME))
1052 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1053 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
1056 if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST))
1057 || (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
1059 if (need_update(sampass, PDB_LMPASSWD)) {
1060 const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
1062 pdb_sethexpwd(temp, lm_pw,
1063 pdb_get_acct_ctrl(sampass));
1064 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1065 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1068 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1069 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
1073 if (need_update(sampass, PDB_NTPASSWD)) {
1074 const uchar *nt_pw = pdb_get_nt_passwd(sampass);
1076 pdb_sethexpwd(temp, nt_pw,
1077 pdb_get_acct_ctrl(sampass));
1078 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1079 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1082 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1083 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
1088 if (need_update(sampass, PDB_PWHISTORY)) {
1089 uint32 pwHistLen = 0;
1090 account_policy_get(AP_PASSWORD_HISTORY, &pwHistLen);
1091 if (pwHistLen == 0) {
1092 /* Remove any password history from the LDAP store. */
1093 memset(temp, '0', 64); /* NOTE !!!! '0' *NOT '\0' */
1097 uint32 currHistLen = 0;
1098 const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
1099 if (pwhist != NULL) {
1100 /* We can only store (sizeof(pstring)-1)/64 password history entries. */
1101 pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));
1102 for (i=0; i< pwHistLen && i < currHistLen; i++) {
1103 /* Store the salt. */
1104 pdb_sethexpwd(&temp[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN], 0);
1105 /* Followed by the md5 hash of salt + md4 hash */
1106 pdb_sethexpwd(&temp[(i*64)+32],
1107 &pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
1108 DEBUG(100, ("temp=%s\n", temp));
1112 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1113 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
1117 if (need_update(sampass, PDB_PASSLASTSET)) {
1118 slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_last_set_time(sampass));
1119 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1120 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
1125 if (need_update(sampass, PDB_HOURS)) {
1126 const uint8 *hours = pdb_get_hours(sampass);
1128 pdb_sethexhours(temp, hours);
1129 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
1132 get_userattr_key2string(ldap_state->schema_ver,
1133 LDAP_ATTR_LOGON_HOURS),
1138 if (need_update(sampass, PDB_ACCTCTRL))
1139 smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
1140 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
1141 pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
1143 /* password lockout cache:
1144 - If we are now autolocking or clearing, we write to ldap
1145 - If we are clearing, we delete the cache entry
1146 - If the count is > 0, we update the cache
1148 This even means when autolocking, we cache, just in case the
1149 update doesn't work, and we have to cache the autolock flag */
1151 if (need_update(sampass, PDB_BAD_PASSWORD_COUNT)) /* &&
1152 need_update(sampass, PDB_BAD_PASSWORD_TIME)) */ {
1153 uint16 badcount = pdb_get_bad_password_count(sampass);
1154 time_t badtime = pdb_get_bad_password_time(sampass);
1156 account_policy_get(AP_BAD_ATTEMPT_LOCKOUT, &pol);
1158 DEBUG(3, ("updating bad password fields, policy=%u, count=%u, time=%u\n",
1159 (unsigned int)pol, (unsigned int)badcount, (unsigned int)badtime));
1161 if ((badcount >= pol) || (badcount == 0)) {
1162 DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
1163 (unsigned int)badcount, (unsigned int)badtime));
1164 slprintf (temp, sizeof (temp) - 1, "%li", (long)badcount);
1166 ldap_state->smbldap_state->ldap_struct,
1168 get_userattr_key2string(
1169 ldap_state->schema_ver,
1170 LDAP_ATTR_BAD_PASSWORD_COUNT),
1173 slprintf (temp, sizeof (temp) - 1, "%li", badtime);
1175 ldap_state->smbldap_state->ldap_struct,
1177 get_userattr_key2string(
1178 ldap_state->schema_ver,
1179 LDAP_ATTR_BAD_PASSWORD_TIME),
1182 if (badcount == 0) {
1183 DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
1184 login_cache_delentry(sampass);
1186 LOGIN_CACHE cache_entry;
1188 cache_entry.entry_timestamp = time(NULL);
1189 cache_entry.acct_ctrl = pdb_get_acct_ctrl(sampass);
1190 cache_entry.bad_password_count = badcount;
1191 cache_entry.bad_password_time = badtime;
1193 DEBUG(7, ("Updating bad password count and time in login cache\n"));
1194 login_cache_write(sampass, cache_entry);
1201 /**********************************************************************
1202 Connect to LDAP server for password enumeration.
1203 *********************************************************************/
1205 static NTSTATUS ldapsam_setsampwent(struct pdb_methods *my_methods, BOOL update, uint16 acb_mask)
1207 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1209 pstring filter, suffix;
1210 const char **attr_list;
1211 BOOL machine_mask = False, user_mask = False;
1213 pstr_sprintf( filter, "(&%s%s)", lp_ldap_filter(),
1214 get_objclass_filter(ldap_state->schema_ver));
1215 all_string_sub(filter, "%u", "*", sizeof(pstring));
1217 machine_mask = ((acb_mask != 0) && (acb_mask & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)));
1218 user_mask = ((acb_mask != 0) && (acb_mask & ACB_NORMAL));
1221 pstrcpy(suffix, lp_ldap_machine_suffix());
1222 } else if (user_mask) {
1223 pstrcpy(suffix, lp_ldap_user_suffix());
1225 pstrcpy(suffix, lp_ldap_suffix());
1228 DEBUG(10,("ldapsam_setsampwent: LDAP Query for acb_mask 0x%x will use suffix %s\n",
1231 attr_list = get_userattr_list(ldap_state->schema_ver);
1232 rc = smbldap_search(ldap_state->smbldap_state, suffix, LDAP_SCOPE_SUBTREE, filter,
1233 attr_list, 0, &ldap_state->result);
1234 free_attr_list( attr_list );
1236 if (rc != LDAP_SUCCESS) {
1237 DEBUG(0, ("ldapsam_setsampwent: LDAP search failed: %s\n", ldap_err2string(rc)));
1238 DEBUG(3, ("ldapsam_setsampwent: Query was: %s, %s\n", suffix, filter));
1239 ldap_msgfree(ldap_state->result);
1240 ldap_state->result = NULL;
1241 return NT_STATUS_UNSUCCESSFUL;
1244 DEBUG(2, ("ldapsam_setsampwent: %d entries in the base %s\n",
1245 ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
1246 ldap_state->result), suffix));
1248 ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
1249 ldap_state->result);
1250 ldap_state->index = 0;
1252 return NT_STATUS_OK;
1255 /**********************************************************************
1256 End enumeration of the LDAP password list.
1257 *********************************************************************/
1259 static void ldapsam_endsampwent(struct pdb_methods *my_methods)
1261 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1262 if (ldap_state->result) {
1263 ldap_msgfree(ldap_state->result);
1264 ldap_state->result = NULL;
1268 /**********************************************************************
1269 Get the next entry in the LDAP password database.
1270 *********************************************************************/
1272 static NTSTATUS ldapsam_getsampwent(struct pdb_methods *my_methods, SAM_ACCOUNT *user)
1274 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1275 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1279 if (!ldap_state->entry)
1282 ldap_state->index++;
1283 bret = init_sam_from_ldap(ldap_state, user, ldap_state->entry);
1285 ldap_state->entry = ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
1289 return NT_STATUS_OK;
1292 static void append_attr(const char ***attr_list, const char *new_attr)
1296 if (new_attr == NULL) {
1300 for (i=0; (*attr_list)[i] != NULL; i++) {
1304 (*attr_list) = SMB_REALLOC_ARRAY((*attr_list), const char *, i+2);
1305 SMB_ASSERT((*attr_list) != NULL);
1306 (*attr_list)[i] = SMB_STRDUP(new_attr);
1307 (*attr_list)[i+1] = NULL;
1310 /**********************************************************************
1311 Get SAM_ACCOUNT entry from LDAP by username.
1312 *********************************************************************/
1314 static NTSTATUS ldapsam_getsampwnam(struct pdb_methods *my_methods, SAM_ACCOUNT *user, const char *sname)
1316 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1317 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1318 LDAPMessage *result = NULL;
1319 LDAPMessage *entry = NULL;
1321 const char ** attr_list;
1324 attr_list = get_userattr_list( ldap_state->schema_ver );
1325 append_attr(&attr_list, get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP));
1326 rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result, attr_list);
1327 free_attr_list( attr_list );
1329 if ( rc != LDAP_SUCCESS )
1330 return NT_STATUS_NO_SUCH_USER;
1332 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1335 DEBUG(4, ("ldapsam_getsampwnam: Unable to locate user [%s] count=%d\n", sname, count));
1336 ldap_msgfree(result);
1337 return NT_STATUS_NO_SUCH_USER;
1338 } else if (count > 1) {
1339 DEBUG(1, ("ldapsam_getsampwnam: Duplicate entries for this user [%s] Failing. count=%d\n", sname, count));
1340 ldap_msgfree(result);
1341 return NT_STATUS_NO_SUCH_USER;
1344 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1346 if (!init_sam_from_ldap(ldap_state, user, entry)) {
1347 DEBUG(1,("ldapsam_getsampwnam: init_sam_from_ldap failed for user '%s'!\n", sname));
1348 ldap_msgfree(result);
1349 return NT_STATUS_NO_SUCH_USER;
1351 pdb_set_backend_private_data(user, result,
1352 private_data_free_fn,
1353 my_methods, PDB_CHANGED);
1356 ldap_msgfree(result);
1361 static int ldapsam_get_ldap_user_by_sid(struct ldapsam_privates *ldap_state,
1362 const DOM_SID *sid, LDAPMessage **result)
1365 const char ** attr_list;
1368 switch ( ldap_state->schema_ver ) {
1369 case SCHEMAVER_SAMBASAMACCOUNT:
1370 attr_list = get_userattr_list(ldap_state->schema_ver);
1371 append_attr(&attr_list, get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP));
1372 rc = ldapsam_search_suffix_by_sid(ldap_state, sid, result, attr_list);
1373 free_attr_list( attr_list );
1375 if ( rc != LDAP_SUCCESS )
1379 case SCHEMAVER_SAMBAACCOUNT:
1380 if (!sid_peek_check_rid(&ldap_state->domain_sid, sid, &rid)) {
1384 attr_list = get_userattr_list(ldap_state->schema_ver);
1385 rc = ldapsam_search_suffix_by_rid(ldap_state, rid, result, attr_list );
1386 free_attr_list( attr_list );
1388 if ( rc != LDAP_SUCCESS )
1395 /**********************************************************************
1396 Get SAM_ACCOUNT entry from LDAP by SID.
1397 *********************************************************************/
1399 static NTSTATUS ldapsam_getsampwsid(struct pdb_methods *my_methods, SAM_ACCOUNT * user, const DOM_SID *sid)
1401 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1402 LDAPMessage *result = NULL;
1403 LDAPMessage *entry = NULL;
1408 rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1410 if (rc != LDAP_SUCCESS)
1411 return NT_STATUS_NO_SUCH_USER;
1413 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1416 DEBUG(4, ("ldapsam_getsampwsid: Unable to locate SID [%s] count=%d\n", sid_to_string(sid_string, sid),
1418 ldap_msgfree(result);
1419 return NT_STATUS_NO_SUCH_USER;
1420 } else if (count > 1) {
1421 DEBUG(1, ("ldapsam_getsampwsid: More than one user with SID [%s]. Failing. count=%d\n", sid_to_string(sid_string, sid),
1423 ldap_msgfree(result);
1424 return NT_STATUS_NO_SUCH_USER;
1427 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1429 ldap_msgfree(result);
1430 return NT_STATUS_NO_SUCH_USER;
1433 if (!init_sam_from_ldap(ldap_state, user, entry)) {
1434 DEBUG(1,("ldapsam_getsampwsid: init_sam_from_ldap failed!\n"));
1435 ldap_msgfree(result);
1436 return NT_STATUS_NO_SUCH_USER;
1439 pdb_set_backend_private_data(user, result,
1440 private_data_free_fn,
1441 my_methods, PDB_CHANGED);
1442 return NT_STATUS_OK;
1445 static BOOL ldapsam_can_pwchange_exop(struct smbldap_state *ldap_state)
1447 return smbldap_has_extension(ldap_state, LDAP_EXOP_MODIFY_PASSWD);
1450 /********************************************************************
1451 Do the actual modification - also change a plaintext passord if
1453 **********************************************************************/
1455 static NTSTATUS ldapsam_modify_entry(struct pdb_methods *my_methods,
1456 SAM_ACCOUNT *newpwd, char *dn,
1457 LDAPMod **mods, int ldap_op,
1458 BOOL (*need_update)(const SAM_ACCOUNT *, enum pdb_elements))
1460 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1463 if (!my_methods || !newpwd || !dn) {
1464 return NT_STATUS_INVALID_PARAMETER;
1468 DEBUG(5,("ldapsam_modify_entry: mods is empty: nothing to modify\n"));
1469 /* may be password change below however */
1473 smbldap_set_mod(&mods, LDAP_MOD_ADD,
1476 rc = smbldap_add(ldap_state->smbldap_state,
1479 case LDAP_MOD_REPLACE:
1480 rc = smbldap_modify(ldap_state->smbldap_state,
1484 DEBUG(0,("ldapsam_modify_entry: Wrong LDAP operation type: %d!\n",
1486 return NT_STATUS_INVALID_PARAMETER;
1489 if (rc!=LDAP_SUCCESS) {
1490 char *ld_error = NULL;
1491 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1493 DEBUG(1, ("ldapsam_modify_entry: Failed to %s user dn= %s with: %s\n\t%s\n",
1494 ldap_op == LDAP_MOD_ADD ? "add" : "modify",
1495 dn, ldap_err2string(rc),
1496 ld_error?ld_error:"unknown"));
1497 SAFE_FREE(ld_error);
1498 return NT_STATUS_UNSUCCESSFUL;
1502 if (!(pdb_get_acct_ctrl(newpwd)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)) &&
1503 (lp_ldap_passwd_sync() != LDAP_PASSWD_SYNC_OFF) &&
1504 need_update(newpwd, PDB_PLAINTEXT_PW) &&
1505 (pdb_get_plaintext_passwd(newpwd)!=NULL)) {
1508 char *retoid = NULL;
1509 struct berval *retdata = NULL;
1510 char *utf8_password;
1513 if (!ldap_state->is_nds_ldap) {
1514 if (!ldapsam_can_pwchange_exop(ldap_state->smbldap_state)) {
1515 DEBUG(2, ("ldap password change requested, but LDAP "
1516 "server does not support it -- ignoring\n"));
1517 return NT_STATUS_OK;
1521 if (push_utf8_allocate(&utf8_password, pdb_get_plaintext_passwd(newpwd)) == (size_t)-1) {
1522 return NT_STATUS_NO_MEMORY;
1525 if (push_utf8_allocate(&utf8_dn, dn) == (size_t)-1) {
1526 return NT_STATUS_NO_MEMORY;
1529 if ((ber = ber_alloc_t(LBER_USE_DER))==NULL) {
1530 DEBUG(0,("ber_alloc_t returns NULL\n"));
1531 SAFE_FREE(utf8_password);
1532 return NT_STATUS_UNSUCCESSFUL;
1535 ber_printf (ber, "{");
1536 ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, utf8_dn);
1537 ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, utf8_password);
1538 ber_printf (ber, "N}");
1540 if ((rc = ber_flatten (ber, &bv))<0) {
1541 DEBUG(0,("ldapsam_modify_entry: ber_flatten returns a value <0\n"));
1544 SAFE_FREE(utf8_password);
1545 return NT_STATUS_UNSUCCESSFUL;
1549 SAFE_FREE(utf8_password);
1552 if (!ldap_state->is_nds_ldap) {
1553 rc = smbldap_extended_operation(ldap_state->smbldap_state,
1554 LDAP_EXOP_MODIFY_PASSWD,
1555 bv, NULL, NULL, &retoid,
1558 rc = pdb_nds_set_password(ldap_state->smbldap_state, dn,
1559 pdb_get_plaintext_passwd(newpwd));
1561 if (rc != LDAP_SUCCESS) {
1562 char *ld_error = NULL;
1564 if (rc == LDAP_OBJECT_CLASS_VIOLATION) {
1565 DEBUG(3, ("Could not set userPassword "
1566 "attribute due to an objectClass "
1567 "violation -- ignoring\n"));
1569 return NT_STATUS_OK;
1572 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1574 DEBUG(0,("ldapsam_modify_entry: LDAP Password could not be changed for user %s: %s\n\t%s\n",
1575 pdb_get_username(newpwd), ldap_err2string(rc), ld_error?ld_error:"unknown"));
1576 SAFE_FREE(ld_error);
1578 return NT_STATUS_UNSUCCESSFUL;
1580 DEBUG(3,("ldapsam_modify_entry: LDAP Password changed for user %s\n",pdb_get_username(newpwd)));
1581 #ifdef DEBUG_PASSWORD
1582 DEBUG(100,("ldapsam_modify_entry: LDAP Password changed to %s\n",pdb_get_plaintext_passwd(newpwd)));
1585 ber_bvfree(retdata);
1587 ber_memfree(retoid);
1591 return NT_STATUS_OK;
1594 /**********************************************************************
1595 Delete entry from LDAP for username.
1596 *********************************************************************/
1598 static NTSTATUS ldapsam_delete_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * sam_acct)
1600 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1603 LDAPMessage *result = NULL;
1605 const char **attr_list;
1609 DEBUG(0, ("ldapsam_delete_sam_account: sam_acct was NULL!\n"));
1610 return NT_STATUS_INVALID_PARAMETER;
1613 sname = pdb_get_username(sam_acct);
1615 DEBUG (3, ("ldapsam_delete_sam_account: Deleting user %s from LDAP.\n", sname));
1617 attr_list= get_userattr_delete_list( ldap_state->schema_ver );
1618 rc = ldapsam_search_suffix_by_name(ldap_state, sname, &result, attr_list);
1620 if (rc != LDAP_SUCCESS) {
1621 free_attr_list( attr_list );
1622 return NT_STATUS_NO_SUCH_USER;
1625 switch ( ldap_state->schema_ver ) {
1626 case SCHEMAVER_SAMBASAMACCOUNT:
1627 fstrcpy( objclass, LDAP_OBJ_SAMBASAMACCOUNT );
1630 case SCHEMAVER_SAMBAACCOUNT:
1631 fstrcpy( objclass, LDAP_OBJ_SAMBAACCOUNT );
1634 fstrcpy( objclass, "UNKNOWN" );
1635 DEBUG(0,("ldapsam_delete_sam_account: Unknown schema version specified!\n"));
1639 ret = ldapsam_delete_entry(ldap_state, result, objclass, attr_list );
1640 ldap_msgfree(result);
1641 free_attr_list( attr_list );
1646 /**********************************************************************
1647 Helper function to determine for update_sam_account whether
1648 we need LDAP modification.
1649 *********************************************************************/
1651 static BOOL element_is_changed(const SAM_ACCOUNT *sampass,
1652 enum pdb_elements element)
1654 return IS_SAM_CHANGED(sampass, element);
1657 /**********************************************************************
1659 *********************************************************************/
1661 static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd)
1663 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1664 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1667 LDAPMessage *result = NULL;
1668 LDAPMessage *entry = NULL;
1669 LDAPMod **mods = NULL;
1670 const char **attr_list;
1672 result = pdb_get_backend_private_data(newpwd, my_methods);
1674 attr_list = get_userattr_list(ldap_state->schema_ver);
1675 rc = ldapsam_search_suffix_by_name(ldap_state, pdb_get_username(newpwd), &result, attr_list );
1676 free_attr_list( attr_list );
1677 if (rc != LDAP_SUCCESS) {
1678 return NT_STATUS_UNSUCCESSFUL;
1680 pdb_set_backend_private_data(newpwd, result, private_data_free_fn, my_methods, PDB_CHANGED);
1683 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
1684 DEBUG(0, ("ldapsam_update_sam_account: No user to modify!\n"));
1685 return NT_STATUS_UNSUCCESSFUL;
1688 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
1689 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
1691 return NT_STATUS_UNSUCCESSFUL;
1694 DEBUG(4, ("ldapsam_update_sam_account: user %s to be modified has dn: %s\n", pdb_get_username(newpwd), dn));
1696 if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
1697 element_is_changed)) {
1698 DEBUG(0, ("ldapsam_update_sam_account: init_ldap_from_sam failed!\n"));
1701 ldap_mods_free(mods,True);
1702 return NT_STATUS_UNSUCCESSFUL;
1706 DEBUG(4,("ldapsam_update_sam_account: mods is empty: nothing to update for user: %s\n",
1707 pdb_get_username(newpwd)));
1709 return NT_STATUS_OK;
1712 ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,LDAP_MOD_REPLACE, element_is_changed);
1713 ldap_mods_free(mods,True);
1716 if (!NT_STATUS_IS_OK(ret)) {
1717 char *ld_error = NULL;
1718 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1720 DEBUG(0,("ldapsam_update_sam_account: failed to modify user with uid = %s, error: %s (%s)\n",
1721 pdb_get_username(newpwd), ld_error?ld_error:"(unknwon)", ldap_err2string(rc)));
1722 SAFE_FREE(ld_error);
1726 DEBUG(2, ("ldapsam_update_sam_account: successfully modified uid = %s in the LDAP database\n",
1727 pdb_get_username(newpwd)));
1728 return NT_STATUS_OK;
1731 /**********************************************************************
1732 Helper function to determine for update_sam_account whether
1733 we need LDAP modification.
1734 *********************************************************************/
1736 static BOOL element_is_set_or_changed(const SAM_ACCOUNT *sampass,
1737 enum pdb_elements element)
1739 return (IS_SAM_SET(sampass, element) ||
1740 IS_SAM_CHANGED(sampass, element));
1743 /**********************************************************************
1744 Add SAM_ACCOUNT to LDAP.
1745 *********************************************************************/
1747 static NTSTATUS ldapsam_add_sam_account(struct pdb_methods *my_methods, SAM_ACCOUNT * newpwd)
1749 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1750 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
1752 LDAPMessage *result = NULL;
1753 LDAPMessage *entry = NULL;
1755 LDAPMod **mods = NULL;
1756 int ldap_op = LDAP_MOD_REPLACE;
1758 const char **attr_list;
1760 const char *username = pdb_get_username(newpwd);
1761 const DOM_SID *sid = pdb_get_user_sid(newpwd);
1765 if (!username || !*username) {
1766 DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
1767 return NT_STATUS_INVALID_PARAMETER;
1770 /* free this list after the second search or in case we exit on failure */
1771 attr_list = get_userattr_list(ldap_state->schema_ver);
1773 rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
1775 if (rc != LDAP_SUCCESS) {
1776 free_attr_list( attr_list );
1777 return NT_STATUS_UNSUCCESSFUL;
1780 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
1781 DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
1783 ldap_msgfree(result);
1784 free_attr_list( attr_list );
1785 return NT_STATUS_UNSUCCESSFUL;
1787 ldap_msgfree(result);
1790 if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
1791 rc = ldapsam_get_ldap_user_by_sid(ldap_state,
1793 if (rc == LDAP_SUCCESS) {
1794 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
1795 DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n",
1796 sid_to_string(sid_string, sid)));
1797 free_attr_list( attr_list );
1798 ldap_msgfree(result);
1799 return NT_STATUS_UNSUCCESSFUL;
1801 ldap_msgfree(result);
1805 /* does the entry already exist but without a samba attributes?
1806 we need to return the samba attributes here */
1808 escape_user = escape_ldap_string_alloc( username );
1809 pstrcpy( filter, lp_ldap_filter() );
1810 all_string_sub( filter, "%u", escape_user, sizeof(filter) );
1811 SAFE_FREE( escape_user );
1813 rc = smbldap_search_suffix(ldap_state->smbldap_state,
1814 filter, attr_list, &result);
1815 if ( rc != LDAP_SUCCESS ) {
1816 free_attr_list( attr_list );
1817 return NT_STATUS_UNSUCCESSFUL;
1820 num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1822 if (num_result > 1) {
1823 DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
1824 free_attr_list( attr_list );
1825 ldap_msgfree(result);
1826 return NT_STATUS_UNSUCCESSFUL;
1829 /* Check if we need to update an existing entry */
1830 if (num_result == 1) {
1833 DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
1834 ldap_op = LDAP_MOD_REPLACE;
1835 entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
1836 tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
1838 free_attr_list( attr_list );
1839 ldap_msgfree(result);
1840 return NT_STATUS_UNSUCCESSFUL;
1842 slprintf (dn, sizeof (dn) - 1, "%s", tmp);
1845 } else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
1847 /* There might be a SID for this account already - say an idmap entry */
1849 pstr_sprintf(filter, "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))",
1850 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
1851 sid_to_string(sid_string, sid),
1852 LDAP_OBJ_IDMAP_ENTRY,
1853 LDAP_OBJ_SID_ENTRY);
1855 /* free old result before doing a new search */
1856 if (result != NULL) {
1857 ldap_msgfree(result);
1860 rc = smbldap_search_suffix(ldap_state->smbldap_state,
1861 filter, attr_list, &result);
1863 if ( rc != LDAP_SUCCESS ) {
1864 free_attr_list( attr_list );
1865 return NT_STATUS_UNSUCCESSFUL;
1868 num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
1870 if (num_result > 1) {
1871 DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
1872 free_attr_list( attr_list );
1873 ldap_msgfree(result);
1874 return NT_STATUS_UNSUCCESSFUL;
1877 /* Check if we need to update an existing entry */
1878 if (num_result == 1) {
1881 DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
1882 ldap_op = LDAP_MOD_REPLACE;
1883 entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
1884 tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
1886 free_attr_list( attr_list );
1887 ldap_msgfree(result);
1888 return NT_STATUS_UNSUCCESSFUL;
1890 slprintf (dn, sizeof (dn) - 1, "%s", tmp);
1895 free_attr_list( attr_list );
1897 if (num_result == 0) {
1898 /* Check if we need to add an entry */
1899 DEBUG(3,("ldapsam_add_sam_account: Adding new user\n"));
1900 ldap_op = LDAP_MOD_ADD;
1901 if (username[strlen(username)-1] == '$') {
1902 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_machine_suffix ());
1904 slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", username, lp_ldap_user_suffix ());
1908 if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
1909 element_is_set_or_changed)) {
1910 DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
1911 ldap_msgfree(result);
1913 ldap_mods_free(mods,True);
1914 return NT_STATUS_UNSUCCESSFUL;
1917 ldap_msgfree(result);
1920 DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
1921 return NT_STATUS_UNSUCCESSFUL;
1923 switch ( ldap_state->schema_ver ) {
1924 case SCHEMAVER_SAMBAACCOUNT:
1925 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBAACCOUNT);
1927 case SCHEMAVER_SAMBASAMACCOUNT:
1928 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_SAMBASAMACCOUNT);
1931 DEBUG(0,("ldapsam_add_sam_account: invalid schema version specified\n"));
1935 ret = ldapsam_modify_entry(my_methods,newpwd,dn,mods,ldap_op, element_is_set_or_changed);
1936 if (!NT_STATUS_IS_OK(ret)) {
1937 DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
1938 pdb_get_username(newpwd),dn));
1939 ldap_mods_free(mods, True);
1943 DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
1944 ldap_mods_free(mods, True);
1946 return NT_STATUS_OK;
1949 /**********************************************************************
1950 *********************************************************************/
1952 static int ldapsam_search_one_group (struct ldapsam_privates *ldap_state,
1954 LDAPMessage ** result)
1956 int scope = LDAP_SCOPE_SUBTREE;
1958 const char **attr_list;
1960 attr_list = get_attr_list(groupmap_attr_list);
1961 rc = smbldap_search(ldap_state->smbldap_state,
1962 lp_ldap_group_suffix (), scope,
1963 filter, attr_list, 0, result);
1964 free_attr_list( attr_list );
1966 if (rc != LDAP_SUCCESS) {
1967 char *ld_error = NULL;
1968 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
1970 DEBUG(0, ("ldapsam_search_one_group: "
1971 "Problem during the LDAP search: LDAP error: %s (%s)\n",
1972 ld_error?ld_error:"(unknown)", ldap_err2string(rc)));
1973 DEBUGADD(3, ("ldapsam_search_one_group: Query was: %s, %s\n",
1974 lp_ldap_group_suffix(), filter));
1975 SAFE_FREE(ld_error);
1981 /**********************************************************************
1982 *********************************************************************/
1984 static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state,
1985 GROUP_MAP *map, LDAPMessage *entry)
1989 if (ldap_state == NULL || map == NULL || entry == NULL ||
1990 ldap_state->smbldap_state->ldap_struct == NULL) {
1991 DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
1995 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
1996 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp)) {
1997 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
1998 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
2001 DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
2003 map->gid = (gid_t)atol(temp);
2005 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2006 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp)) {
2007 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2008 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
2012 if (!string_to_sid(&map->sid, temp)) {
2013 DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
2017 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2018 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) {
2019 DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
2020 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
2023 map->sid_name_use = (enum SID_NAME_USE)atol(temp);
2025 if ((map->sid_name_use < SID_NAME_USER) ||
2026 (map->sid_name_use > SID_NAME_UNKNOWN)) {
2027 DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
2031 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2032 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp)) {
2034 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2035 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp))
2037 DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
2038 for gidNumber(%lu)\n",(unsigned long)map->gid));
2042 fstrcpy(map->nt_name, temp);
2044 if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
2045 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp)) {
2048 fstrcpy(map->comment, temp);
2053 /**********************************************************************
2054 *********************************************************************/
2056 static BOOL init_ldap_from_group(LDAP *ldap_struct,
2057 LDAPMessage *existing,
2059 const GROUP_MAP *map)
2063 if (mods == NULL || map == NULL) {
2064 DEBUG(0, ("init_ldap_from_group: NULL parameters found!\n"));
2070 sid_to_string(tmp, &map->sid);
2072 smbldap_make_mod(ldap_struct, existing, mods,
2073 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID), tmp);
2074 pstr_sprintf(tmp, "%i", map->sid_name_use);
2075 smbldap_make_mod(ldap_struct, existing, mods,
2076 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), tmp);
2078 smbldap_make_mod(ldap_struct, existing, mods,
2079 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), map->nt_name);
2080 smbldap_make_mod(ldap_struct, existing, mods,
2081 get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), map->comment);
2086 /**********************************************************************
2087 *********************************************************************/
2089 static NTSTATUS ldapsam_getgroup(struct pdb_methods *methods,
2093 struct ldapsam_privates *ldap_state =
2094 (struct ldapsam_privates *)methods->private_data;
2095 LDAPMessage *result = NULL;
2096 LDAPMessage *entry = NULL;
2099 if (ldapsam_search_one_group(ldap_state, filter, &result)
2101 return NT_STATUS_NO_SUCH_GROUP;
2104 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2107 DEBUG(4, ("ldapsam_getgroup: Did not find group\n"));
2108 ldap_msgfree(result);
2109 return NT_STATUS_NO_SUCH_GROUP;
2113 DEBUG(1, ("ldapsam_getgroup: Duplicate entries for filter %s: count=%d\n",
2115 ldap_msgfree(result);
2116 return NT_STATUS_NO_SUCH_GROUP;
2119 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
2122 ldap_msgfree(result);
2123 return NT_STATUS_UNSUCCESSFUL;
2126 if (!init_group_from_ldap(ldap_state, map, entry)) {
2127 DEBUG(1, ("ldapsam_getgroup: init_group_from_ldap failed for group filter %s\n",
2129 ldap_msgfree(result);
2130 return NT_STATUS_NO_SUCH_GROUP;
2133 ldap_msgfree(result);
2134 return NT_STATUS_OK;
2137 /**********************************************************************
2138 *********************************************************************/
2140 static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
2145 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
2147 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
2148 sid_string_static(&sid));
2150 return ldapsam_getgroup(methods, filter, map);
2153 /**********************************************************************
2154 *********************************************************************/
2156 static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
2161 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%d))",
2163 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2166 return ldapsam_getgroup(methods, filter, map);
2169 /**********************************************************************
2170 *********************************************************************/
2172 static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
2176 char *escape_name = escape_ldap_string_alloc(name);
2179 return NT_STATUS_NO_MEMORY;
2182 pstr_sprintf(filter, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
2184 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
2185 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), escape_name);
2187 SAFE_FREE(escape_name);
2189 return ldapsam_getgroup(methods, filter, map);
2192 static void add_rid_to_array_unique(TALLOC_CTX *mem_ctx,
2193 uint32 rid, uint32 **rids, int *num)
2197 for (i=0; i<*num; i++) {
2198 if ((*rids)[i] == rid)
2202 *rids = TALLOC_REALLOC_ARRAY(mem_ctx, *rids, uint32, *num+1);
2207 (*rids)[*num] = rid;
2211 static BOOL ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
2213 const DOM_SID *domain_sid,
2219 if (!smbldap_get_single_attribute(ldap_struct, entry, "sambaSID",
2220 str, sizeof(str)-1)) {
2221 DEBUG(10, ("Could not find sambaSID attribute\n"));
2225 if (!string_to_sid(&sid, str)) {
2226 DEBUG(10, ("Could not convert string %s to sid\n", str));
2230 if (sid_compare_domain(&sid, domain_sid) != 0) {
2231 DEBUG(10, ("SID %s is not in expected domain %s\n",
2232 str, sid_string_static(domain_sid)));
2236 if (!sid_peek_rid(&sid, rid)) {
2237 DEBUG(10, ("Could not peek into RID\n"));
2244 static NTSTATUS ldapsam_enum_group_members(struct pdb_methods *methods,
2245 TALLOC_CTX *mem_ctx,
2246 const DOM_SID *group,
2247 uint32 **member_rids,
2250 struct ldapsam_privates *ldap_state =
2251 (struct ldapsam_privates *)methods->private_data;
2252 struct smbldap_state *conn = ldap_state->smbldap_state;
2255 LDAPMessage *msg = NULL;
2257 char **values = NULL;
2259 char *sid_filter = NULL;
2261 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2263 if (!lp_parm_bool(-1, "ldapsam", "trusted", False))
2264 return pdb_default_enum_group_members(methods, mem_ctx, group,
2268 *member_rids = NULL;
2271 pstr_sprintf(filter,
2272 "(&(objectClass=sambaSamAccount)"
2273 "(sambaPrimaryGroupSid=%s))",
2274 sid_string_static(group));
2277 const char *attrs[] = { "sambaSID", NULL };
2278 rc = smbldap_search(conn, lp_ldap_user_suffix(),
2279 LDAP_SCOPE_SUBTREE, filter, attrs, 0,
2283 if (rc != LDAP_SUCCESS)
2286 for (entry = ldap_first_entry(conn->ldap_struct, msg);
2288 entry = ldap_next_entry(conn->ldap_struct, entry))
2292 if (!ldapsam_extract_rid_from_entry(conn->ldap_struct,
2294 get_global_sam_sid(),
2296 DEBUG(2, ("Could not find sid from ldap entry\n"));
2300 add_rid_to_array_unique(mem_ctx, rid, member_rids,
2307 pstr_sprintf(filter,
2308 "(&(objectClass=sambaGroupMapping)"
2309 "(objectClass=posixGroup)"
2311 sid_string_static(group));
2314 const char *attrs[] = { "memberUid", NULL };
2315 rc = smbldap_search(conn, lp_ldap_group_suffix(),
2316 LDAP_SCOPE_SUBTREE, filter, attrs, 0,
2320 if (rc != LDAP_SUCCESS)
2323 count = ldap_count_entries(conn->ldap_struct, msg);
2326 DEBUG(1, ("Found more than one groupmap entry for %s\n",
2327 sid_string_static(group)));
2332 result = NT_STATUS_OK;
2336 entry = ldap_first_entry(conn->ldap_struct, msg);
2340 values = ldap_get_values(conn->ldap_struct, msg, "memberUid");
2341 if (values == NULL) {
2342 result = NT_STATUS_OK;
2346 sid_filter = strdup("(&(objectClass=sambaSamAccount)(|");
2347 if (sid_filter == NULL) {
2348 result = NT_STATUS_NO_MEMORY;
2352 for (memberuid = values; *memberuid != NULL; memberuid += 1) {
2354 asprintf(&sid_filter, "%s(uid=%s)", tmp, *memberuid);
2356 if (sid_filter == NULL) {
2357 result = NT_STATUS_NO_MEMORY;
2363 asprintf(&sid_filter, "%s))", sid_filter);
2365 if (sid_filter == NULL) {
2366 result = NT_STATUS_NO_MEMORY;
2371 const char *attrs[] = { "sambaSID", NULL };
2372 rc = smbldap_search(conn, lp_ldap_user_suffix(),
2373 LDAP_SCOPE_SUBTREE, sid_filter, attrs, 0,
2377 if (rc != LDAP_SUCCESS)
2380 for (entry = ldap_first_entry(conn->ldap_struct, msg);
2382 entry = ldap_next_entry(conn->ldap_struct, entry))
2388 if (!smbldap_get_single_attribute(conn->ldap_struct,
2390 str, sizeof(str)-1))
2393 if (!string_to_sid(&sid, str))
2396 if (!sid_check_is_in_our_domain(&sid)) {
2397 DEBUG(1, ("Inconsistent SAM -- group member uid not "
2398 "in our domain\n"));
2402 sid_peek_rid(&sid, &rid);
2404 add_rid_to_array_unique(mem_ctx, rid, member_rids,
2408 result = NT_STATUS_OK;
2411 SAFE_FREE(sid_filter);
2414 ldap_value_free(values);
2422 static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
2423 const char *username,
2425 DOM_SID **sids, gid_t **gids,
2428 struct ldapsam_privates *ldap_state =
2429 (struct ldapsam_privates *)methods->private_data;
2430 struct smbldap_state *conn = ldap_state->smbldap_state;
2432 const char *attrs[] = { "gidNumber", "sambaSID", NULL };
2435 LDAPMessage *msg = NULL;
2437 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2438 int num_sids, num_gids;
2439 extern DOM_SID global_sid_NULL;
2441 if (!lp_parm_bool(-1, "ldapsam", "trusted", False))
2442 return pdb_default_enum_group_memberships(methods, username,
2449 escape_name = escape_ldap_string_alloc(username);
2451 if (escape_name == NULL)
2452 return NT_STATUS_NO_MEMORY;
2454 pstr_sprintf(filter, "(&(objectClass=posixGroup)"
2455 "(|(memberUid=%s)(gidNumber=%d)))",
2456 username, primary_gid);
2458 rc = smbldap_search(conn, lp_ldap_group_suffix(),
2459 LDAP_SCOPE_SUBTREE, filter, attrs, 0, &msg);
2461 if (rc != LDAP_SUCCESS)
2470 /* We need to add the primary group as the first gid/sid */
2472 add_gid_to_array_unique(NULL, primary_gid, gids, &num_gids);
2474 /* This sid will be replaced later */
2476 add_sid_to_array_unique(NULL, &global_sid_NULL, sids, &num_sids);
2478 for (entry = ldap_first_entry(conn->ldap_struct, msg);
2480 entry = ldap_next_entry(conn->ldap_struct, entry))
2487 if (!smbldap_get_single_attribute(conn->ldap_struct,
2489 str, sizeof(str)-1))
2492 if (!string_to_sid(&sid, str))
2495 if (!smbldap_get_single_attribute(conn->ldap_struct,
2497 str, sizeof(str)-1))
2500 gid = strtoul(str, &end, 10);
2502 if (PTR_DIFF(end, str) != strlen(str))
2505 if (gid == primary_gid) {
2506 sid_copy(&(*sids)[0], &sid);
2508 add_gid_to_array_unique(NULL, gid, gids, &num_gids);
2509 add_sid_to_array_unique(NULL, &sid, sids, &num_sids);
2513 if (sid_compare(&global_sid_NULL, &(*sids)[0]) == 0) {
2514 DEBUG(3, ("primary group of [%s] not found\n", username));
2518 *num_groups = num_sids;
2520 result = NT_STATUS_OK;
2524 SAFE_FREE(escape_name);
2531 /**********************************************************************
2532 *********************************************************************/
2534 static int ldapsam_search_one_group_by_gid(struct ldapsam_privates *ldap_state,
2536 LDAPMessage **result)
2540 pstr_sprintf(filter, "(&(|(objectClass=%s)(objectclass=%s))(%s=%d))",
2541 LDAP_OBJ_POSIXGROUP, LDAP_OBJ_IDMAP_ENTRY,
2542 get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
2545 return ldapsam_search_one_group(ldap_state, filter, result);
2548 /**********************************************************************
2549 *********************************************************************/
2551 static NTSTATUS ldapsam_add_group_mapping_entry(struct pdb_methods *methods,
2554 struct ldapsam_privates *ldap_state =
2555 (struct ldapsam_privates *)methods->private_data;
2556 LDAPMessage *result = NULL;
2557 LDAPMod **mods = NULL;
2568 if (NT_STATUS_IS_OK(ldapsam_getgrgid(methods, &dummy,
2570 DEBUG(0, ("ldapsam_add_group_mapping_entry: Group %ld already exists in LDAP\n", (unsigned long)map->gid));
2571 return NT_STATUS_UNSUCCESSFUL;
2574 rc = ldapsam_search_one_group_by_gid(ldap_state, map->gid, &result);
2575 if (rc != LDAP_SUCCESS) {
2576 ldap_msgfree(result);
2577 return NT_STATUS_UNSUCCESSFUL;
2580 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2583 /* There's no posixGroup account, let's try to find an
2584 * appropriate idmap entry for aliases */
2588 const char **attr_list;
2590 ldap_msgfree(result);
2592 pstrcpy( suffix, lp_ldap_idmap_suffix() );
2593 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%d))",
2594 LDAP_OBJ_IDMAP_ENTRY, LDAP_ATTRIBUTE_GIDNUMBER,
2597 attr_list = get_attr_list( sidmap_attr_list );
2598 rc = smbldap_search(ldap_state->smbldap_state, suffix,
2599 LDAP_SCOPE_SUBTREE, filter, attr_list,
2602 free_attr_list(attr_list);
2604 if (rc != LDAP_SUCCESS) {
2605 DEBUG(3,("Failure looking up entry (%s)\n",
2606 ldap_err2string(rc) ));
2607 ldap_msgfree(result);
2608 return NT_STATUS_UNSUCCESSFUL;
2612 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
2614 ldap_msgfree(result);
2615 return NT_STATUS_UNSUCCESSFUL;
2619 DEBUG(2, ("ldapsam_add_group_mapping_entry: Group %lu must exist exactly once in LDAP\n",
2620 (unsigned long)map->gid));
2621 ldap_msgfree(result);
2622 return NT_STATUS_UNSUCCESSFUL;
2625 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
2626 tmp = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
2628 ldap_msgfree(result);
2629 return NT_STATUS_UNSUCCESSFUL;
2634 if (!init_ldap_from_group(ldap_state->smbldap_state->ldap_struct,
2635 result, &mods, map)) {
2636 DEBUG(0, ("ldapsam_add_group_mapping_entry: init_ldap_from_group failed!\n"));
2637 ldap_mods_free(mods, True);
2638 ldap_msgfree(result);
2639 return NT_STATUS_UNSUCCESSFUL;
2642 ldap_msgfree(result);
2645 DEBUG(0, ("ldapsam_add_group_mapping_entry: mods is empty\n"));
2646 return NT_STATUS_UNSUCCESSFUL;
2649 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP );
2651 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2652 ldap_mods_free(mods, True);
2654 if (rc != LDAP_SUCCESS) {
2655 char *ld_error = NULL;
2656 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
2658 DEBUG(0, ("ldapsam_add_group_mapping_entry: failed to add group %lu error: %s (%s)\n", (unsigned long)map->gid,
2659 ld_error ? ld_error : "(unknown)", ldap_err2string(rc)));
2660 SAFE_FREE(ld_error);
2661 return NT_STATUS_UNSUCCESSFUL;
2664 DEBUG(2, ("ldapsam_add_group_mapping_entry: successfully modified group %lu in LDAP\n", (unsigned long)map->gid));
2665 return NT_STATUS_OK;
2668 /**********************************************************************
2669 *********************************************************************/
2671 static NTSTATUS ldapsam_update_group_mapping_entry(struct pdb_methods *methods,
2674 struct ldapsam_privates *ldap_state =
2675 (struct ldapsam_privates *)methods->private_data;
2678 LDAPMessage *result = NULL;
2679 LDAPMessage *entry = NULL;
2680 LDAPMod **mods = NULL;
2682 rc = ldapsam_search_one_group_by_gid(ldap_state, map->gid, &result);
2684 if (rc != LDAP_SUCCESS) {
2685 return NT_STATUS_UNSUCCESSFUL;
2688 if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) == 0) {
2689 DEBUG(0, ("ldapsam_update_group_mapping_entry: No group to modify!\n"));
2690 ldap_msgfree(result);
2691 return NT_STATUS_UNSUCCESSFUL;
2694 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
2696 if (!init_ldap_from_group(ldap_state->smbldap_state->ldap_struct,
2697 result, &mods, map)) {
2698 DEBUG(0, ("ldapsam_update_group_mapping_entry: init_ldap_from_group failed\n"));
2699 ldap_msgfree(result);
2701 ldap_mods_free(mods,True);
2702 return NT_STATUS_UNSUCCESSFUL;
2706 DEBUG(4, ("ldapsam_update_group_mapping_entry: mods is empty: nothing to do\n"));
2707 ldap_msgfree(result);
2708 return NT_STATUS_OK;
2711 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
2713 ldap_msgfree(result);
2714 return NT_STATUS_UNSUCCESSFUL;
2716 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2719 ldap_mods_free(mods, True);
2720 ldap_msgfree(result);
2722 if (rc != LDAP_SUCCESS) {
2723 char *ld_error = NULL;
2724 ldap_get_option(ldap_state->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
2726 DEBUG(0, ("ldapsam_update_group_mapping_entry: failed to modify group %lu error: %s (%s)\n", (unsigned long)map->gid,
2727 ld_error ? ld_error : "(unknown)", ldap_err2string(rc)));
2728 SAFE_FREE(ld_error);
2729 return NT_STATUS_UNSUCCESSFUL;
2732 DEBUG(2, ("ldapsam_update_group_mapping_entry: successfully modified group %lu in LDAP\n", (unsigned long)map->gid));
2733 return NT_STATUS_OK;
2736 /**********************************************************************
2737 *********************************************************************/
2739 static NTSTATUS ldapsam_delete_group_mapping_entry(struct pdb_methods *methods,
2742 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)methods->private_data;
2743 pstring sidstring, filter;
2744 LDAPMessage *result = NULL;
2747 const char **attr_list;
2749 sid_to_string(sidstring, &sid);
2751 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
2752 LDAP_OBJ_GROUPMAP, LDAP_ATTRIBUTE_SID, sidstring);
2754 rc = ldapsam_search_one_group(ldap_state, filter, &result);
2756 if (rc != LDAP_SUCCESS) {
2757 return NT_STATUS_NO_SUCH_GROUP;
2760 attr_list = get_attr_list( groupmap_attr_list_to_delete );
2761 ret = ldapsam_delete_entry(ldap_state, result, LDAP_OBJ_GROUPMAP, attr_list);
2762 free_attr_list ( attr_list );
2764 ldap_msgfree(result);
2769 /**********************************************************************
2770 *********************************************************************/
2772 static NTSTATUS ldapsam_setsamgrent(struct pdb_methods *my_methods, BOOL update)
2774 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2777 const char **attr_list;
2779 pstr_sprintf( filter, "(objectclass=%s)", LDAP_OBJ_GROUPMAP);
2780 attr_list = get_attr_list( groupmap_attr_list );
2781 rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
2782 LDAP_SCOPE_SUBTREE, filter,
2783 attr_list, 0, &ldap_state->result);
2784 free_attr_list( attr_list );
2786 if (rc != LDAP_SUCCESS) {
2787 DEBUG(0, ("ldapsam_setsamgrent: LDAP search failed: %s\n", ldap_err2string(rc)));
2788 DEBUG(3, ("ldapsam_setsamgrent: Query was: %s, %s\n", lp_ldap_group_suffix(), filter));
2789 ldap_msgfree(ldap_state->result);
2790 ldap_state->result = NULL;
2791 return NT_STATUS_UNSUCCESSFUL;
2794 DEBUG(2, ("ldapsam_setsamgrent: %d entries in the base!\n",
2795 ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
2796 ldap_state->result)));
2798 ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, ldap_state->result);
2799 ldap_state->index = 0;
2801 return NT_STATUS_OK;
2804 /**********************************************************************
2805 *********************************************************************/
2807 static void ldapsam_endsamgrent(struct pdb_methods *my_methods)
2809 ldapsam_endsampwent(my_methods);
2812 /**********************************************************************
2813 *********************************************************************/
2815 static NTSTATUS ldapsam_getsamgrent(struct pdb_methods *my_methods,
2818 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
2819 struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
2823 if (!ldap_state->entry)
2826 ldap_state->index++;
2827 bret = init_group_from_ldap(ldap_state, map, ldap_state->entry);
2829 ldap_state->entry = ldap_next_entry(ldap_state->smbldap_state->ldap_struct,
2833 return NT_STATUS_OK;
2836 /**********************************************************************
2837 *********************************************************************/
2839 static NTSTATUS ldapsam_enum_group_mapping(struct pdb_methods *methods,
2840 enum SID_NAME_USE sid_name_use,
2841 GROUP_MAP **rmap, int *num_entries,
2851 if (!NT_STATUS_IS_OK(ldapsam_setsamgrent(methods, False))) {
2852 DEBUG(0, ("ldapsam_enum_group_mapping: Unable to open passdb\n"));
2853 return NT_STATUS_ACCESS_DENIED;
2856 while (NT_STATUS_IS_OK(ldapsam_getsamgrent(methods, &map))) {
2857 if (sid_name_use != SID_NAME_UNKNOWN &&
2858 sid_name_use != map.sid_name_use) {
2859 DEBUG(11,("ldapsam_enum_group_mapping: group %s is not of the requested type\n", map.nt_name));
2862 if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
2863 DEBUG(11,("ldapsam_enum_group_mapping: group %s is non mapped\n", map.nt_name));
2867 mapt=SMB_REALLOC_ARRAY((*rmap), GROUP_MAP, entries+1);
2869 DEBUG(0,("ldapsam_enum_group_mapping: Unable to enlarge group map!\n"));
2871 return NT_STATUS_UNSUCCESSFUL;
2876 mapt[entries] = map;
2881 ldapsam_endsamgrent(methods);
2883 *num_entries = entries;
2885 return NT_STATUS_OK;
2888 static NTSTATUS ldapsam_modify_aliasmem(struct pdb_methods *methods,
2889 const DOM_SID *alias,
2890 const DOM_SID *member,
2893 struct ldapsam_privates *ldap_state =
2894 (struct ldapsam_privates *)methods->private_data;
2896 LDAPMessage *result = NULL;
2897 LDAPMessage *entry = NULL;
2899 LDAPMod **mods = NULL;
2904 pstr_sprintf(filter, "(&(|(objectClass=%s)(objectclass=%s))(%s=%s))",
2905 LDAP_OBJ_GROUPMAP, LDAP_OBJ_IDMAP_ENTRY,
2906 get_attr_key2string(groupmap_attr_list,
2907 LDAP_ATTR_GROUP_SID),
2908 sid_string_static(alias));
2910 if (ldapsam_search_one_group(ldap_state, filter,
2911 &result) != LDAP_SUCCESS)
2912 return NT_STATUS_NO_SUCH_ALIAS;
2914 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
2918 DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
2919 ldap_msgfree(result);
2920 return NT_STATUS_NO_SUCH_ALIAS;
2924 DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for filter %s: "
2925 "count=%d\n", filter, count));
2926 ldap_msgfree(result);
2927 return NT_STATUS_NO_SUCH_ALIAS;
2930 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
2934 ldap_msgfree(result);
2935 return NT_STATUS_UNSUCCESSFUL;
2938 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
2940 ldap_msgfree(result);
2941 return NT_STATUS_UNSUCCESSFUL;
2944 smbldap_set_mod(&mods, modop,
2945 get_attr_key2string(groupmap_attr_list,
2946 LDAP_ATTR_SID_LIST),
2947 sid_string_static(member));
2949 rc = smbldap_modify(ldap_state->smbldap_state, dn, mods);
2951 ldap_mods_free(mods, True);
2952 ldap_msgfree(result);
2954 if (rc != LDAP_SUCCESS) {
2955 char *ld_error = NULL;
2956 ldap_get_option(ldap_state->smbldap_state->ldap_struct,
2957 LDAP_OPT_ERROR_STRING,&ld_error);
2959 DEBUG(0, ("ldapsam_modify_aliasmem: Could not modify alias "
2960 "for %s, error: %s (%s)\n", dn, ldap_err2string(rc),
2961 ld_error?ld_error:"unknown"));
2962 SAFE_FREE(ld_error);
2964 return NT_STATUS_UNSUCCESSFUL;
2969 return NT_STATUS_OK;
2972 static NTSTATUS ldapsam_add_aliasmem(struct pdb_methods *methods,
2973 const DOM_SID *alias,
2974 const DOM_SID *member)
2976 return ldapsam_modify_aliasmem(methods, alias, member, LDAP_MOD_ADD);
2979 static NTSTATUS ldapsam_del_aliasmem(struct pdb_methods *methods,
2980 const DOM_SID *alias,
2981 const DOM_SID *member)
2983 return ldapsam_modify_aliasmem(methods, alias, member,
2987 static NTSTATUS ldapsam_enum_aliasmem(struct pdb_methods *methods,
2988 const DOM_SID *alias, DOM_SID **members,
2991 struct ldapsam_privates *ldap_state =
2992 (struct ldapsam_privates *)methods->private_data;
2993 LDAPMessage *result = NULL;
2994 LDAPMessage *entry = NULL;
3003 pstr_sprintf(filter, "(&(|(objectClass=%s)(objectclass=%s))(%s=%s))",
3004 LDAP_OBJ_GROUPMAP, LDAP_OBJ_IDMAP_ENTRY,
3005 get_attr_key2string(groupmap_attr_list,
3006 LDAP_ATTR_GROUP_SID),
3007 sid_string_static(alias));
3009 if (ldapsam_search_one_group(ldap_state, filter,
3010 &result) != LDAP_SUCCESS)
3011 return NT_STATUS_NO_SUCH_ALIAS;
3013 count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
3017 DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
3018 ldap_msgfree(result);
3019 return NT_STATUS_NO_SUCH_ALIAS;
3023 DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for filter %s: "
3024 "count=%d\n", filter, count));
3025 ldap_msgfree(result);
3026 return NT_STATUS_NO_SUCH_ALIAS;
3029 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
3033 ldap_msgfree(result);
3034 return NT_STATUS_UNSUCCESSFUL;
3037 values = ldap_get_values(ldap_state->smbldap_state->ldap_struct,
3039 get_attr_key2string(groupmap_attr_list,
3040 LDAP_ATTR_SID_LIST));
3042 if (values == NULL) {
3043 ldap_msgfree(result);
3044 return NT_STATUS_OK;
3047 count = ldap_count_values(values);
3049 for (i=0; i<count; i++) {
3052 if (!string_to_sid(&member, values[i]))
3055 add_sid_to_array(NULL, &member, members, num_members);
3058 ldap_value_free(values);
3059 ldap_msgfree(result);
3061 return NT_STATUS_OK;
3064 static NTSTATUS ldapsam_alias_memberships(struct pdb_methods *methods,
3065 TALLOC_CTX *mem_ctx,
3066 const DOM_SID *domain_sid,
3067 const DOM_SID *members,
3069 uint32 **alias_rids,
3070 int *num_alias_rids)
3072 struct ldapsam_privates *ldap_state =
3073 (struct ldapsam_privates *)methods->private_data;
3076 const char *attrs[] = { LDAP_ATTRIBUTE_SID, NULL };
3078 LDAPMessage *result = NULL;
3079 LDAPMessage *entry = NULL;
3084 /* This query could be further optimized by adding a
3085 (&(sambaSID=<domain-sid>*)) so that only those aliases that are
3086 asked for in the getuseraliases are returned. */
3088 filter = talloc_asprintf(mem_ctx,
3089 "(&(|(objectclass=%s)(objectclass=%s))(|",
3090 LDAP_OBJ_GROUPMAP, LDAP_OBJ_IDMAP_ENTRY);
3092 for (i=0; i<num_members; i++)
3093 filter = talloc_asprintf(mem_ctx, "%s(sambaSIDList=%s)",
3095 sid_string_static(&members[i]));
3097 filter = talloc_asprintf(mem_ctx, "%s))", filter);
3099 rc = smbldap_search(ldap_state->smbldap_state, lp_ldap_group_suffix(),
3100 LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
3102 talloc_destroy(mem_ctx);
3104 if (rc != LDAP_SUCCESS)
3105 return NT_STATUS_UNSUCCESSFUL;
3107 ldap_struct = ldap_state->smbldap_state->ldap_struct;
3109 for (entry = ldap_first_entry(ldap_struct, result);
3111 entry = ldap_next_entry(ldap_struct, entry))
3117 if (!smbldap_get_single_attribute(ldap_struct, entry,
3123 if (!string_to_sid(&sid, sid_str))
3126 if (!sid_peek_check_rid(domain_sid, &sid, &rid))
3129 add_rid_to_array_unique(mem_ctx, rid, alias_rids,
3133 ldap_msgfree(result);
3134 return NT_STATUS_OK;
3137 static NTSTATUS ldapsam_lookup_rids(struct pdb_methods *methods,
3138 TALLOC_CTX *mem_ctx,
3139 const DOM_SID *domain_sid,
3142 const char ***names,
3145 struct ldapsam_privates *ldap_state =
3146 (struct ldapsam_privates *)methods->private_data;
3147 LDAP *ldap_struct = ldap_state->smbldap_state->ldap_struct;
3148 LDAPMessage *msg = NULL;
3150 char *allsids = NULL;
3152 int i, rc, num_mapped;
3153 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
3155 if (!lp_parm_bool(-1, "ldapsam", "trusted", False))
3156 return pdb_default_lookup_rids(methods, mem_ctx, domain_sid,
3157 num_rids, rids, names, attrs);
3159 if (!sid_equal(domain_sid, get_global_sam_sid())) {
3160 /* TODO: Sooner or later we need to look up BUILTIN rids as
3165 (*names) = TALLOC_ZERO_ARRAY(mem_ctx, const char *, num_rids);
3166 (*attrs) = TALLOC_ARRAY(mem_ctx, uint32, num_rids);
3168 if ((num_rids != 0) && (((*names) == NULL) || ((*attrs) == NULL)))
3169 return NT_STATUS_NO_MEMORY;
3171 for (i=0; i<num_rids; i++)
3172 (*attrs)[i] = SID_NAME_UNKNOWN;
3174 allsids = strdup("");
3175 if (allsids == NULL) return NT_STATUS_NO_MEMORY;
3177 for (i=0; i<num_rids; i++) {
3179 sid_copy(&sid, domain_sid);
3180 sid_append_rid(&sid, rids[i]);
3182 asprintf(&allsids, "%s(sambaSid=%s)", allsids,
3183 sid_string_static(&sid));
3184 if (allsids == NULL) return NT_STATUS_NO_MEMORY;
3188 /* First look for users */
3192 const char *ldap_attrs[] = { "uid", "sambaSid", NULL };
3194 asprintf(&filter, ("(&(objectClass=sambaSamAccount)(|%s))"),
3196 if (filter == NULL) return NT_STATUS_NO_MEMORY;
3198 rc = smbldap_search(ldap_state->smbldap_state,
3199 lp_ldap_user_suffix(),
3200 LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
3206 if (rc != LDAP_SUCCESS)
3211 for (entry = ldap_first_entry(ldap_struct, msg);
3213 entry = ldap_next_entry(ldap_struct, entry))
3219 if (!ldapsam_extract_rid_from_entry(ldap_struct, entry,
3220 get_global_sam_sid(),
3222 DEBUG(2, ("Could not find sid from ldap entry\n"));
3226 if (!smbldap_get_single_attribute(ldap_struct, entry,
3227 "uid", str, sizeof(str)-1)) {
3228 DEBUG(2, ("Could not retrieve uid attribute\n"));
3232 for (rid_index = 0; rid_index < num_rids; rid_index++) {
3233 if (rid == rids[rid_index])
3237 if (rid_index == num_rids) {
3238 DEBUG(2, ("Got a RID not asked for: %d\n", rid));
3242 (*attrs)[rid_index] = SID_NAME_USER;
3243 (*names)[rid_index] = talloc_strdup(mem_ctx, str);
3244 if ((*names)[rid_index] == NULL) return NT_STATUS_NO_MEMORY;
3249 if (num_mapped == num_rids) {
3250 /* No need to look for groups anymore -- we're done */
3251 result = NT_STATUS_OK;
3255 /* Same game for groups */
3259 const char *ldap_attrs[] = { "cn", "sambaSid", NULL };
3261 asprintf(&filter, ("(&(objectClass=sambaGroupMapping)(|%s))"),
3263 if (filter == NULL) return NT_STATUS_NO_MEMORY;
3265 rc = smbldap_search(ldap_state->smbldap_state,
3266 lp_ldap_group_suffix(),
3267 LDAP_SCOPE_SUBTREE, filter, ldap_attrs, 0,
3273 if (rc != LDAP_SUCCESS)
3276 for (entry = ldap_first_entry(ldap_struct, msg);
3278 entry = ldap_next_entry(ldap_struct, entry))
3284 if (!ldapsam_extract_rid_from_entry(ldap_struct, entry,
3285 get_global_sam_sid(),
3287 DEBUG(2, ("Could not find sid from ldap entry\n"));
3291 if (!smbldap_get_single_attribute(ldap_struct, entry,
3292 "cn", str, sizeof(str)-1)) {
3293 DEBUG(2, ("Could not retrieve cn attribute\n"));
3297 for (rid_index = 0; rid_index < num_rids; rid_index++) {
3298 if (rid == rids[rid_index])
3302 if (rid_index == num_rids) {
3303 DEBUG(2, ("Got a RID not asked for: %d\n", rid));
3307 (*attrs)[rid_index] = SID_NAME_DOM_GRP;
3308 (*names)[rid_index] = talloc_strdup(mem_ctx, str);
3309 if ((*names)[rid_index] == NULL) return NT_STATUS_NO_MEMORY;
3313 result = NT_STATUS_NONE_MAPPED;
3316 result = (num_mapped == num_rids) ?
3317 NT_STATUS_OK : STATUS_SOME_UNMAPPED;
3327 /**********************************************************************
3329 *********************************************************************/
3331 static void free_private_data(void **vp)
3333 struct ldapsam_privates **ldap_state = (struct ldapsam_privates **)vp;
3335 smbldap_free_struct(&(*ldap_state)->smbldap_state);
3337 if ((*ldap_state)->result != NULL) {
3338 ldap_msgfree((*ldap_state)->result);
3339 (*ldap_state)->result = NULL;
3341 if ((*ldap_state)->domain_dn != NULL) {
3342 SAFE_FREE((*ldap_state)->domain_dn);
3347 /* No need to free any further, as it is talloc()ed */
3350 /**********************************************************************
3351 Intitalise the parts of the pdb_context that are common to all pdb_ldap modes
3352 *********************************************************************/
3354 static NTSTATUS pdb_init_ldapsam_common(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method,
3355 const char *location)
3358 struct ldapsam_privates *ldap_state;
3360 if (!NT_STATUS_IS_OK(nt_status = make_pdb_methods(pdb_context->mem_ctx, pdb_method))) {
3364 (*pdb_method)->name = "ldapsam";
3366 (*pdb_method)->setsampwent = ldapsam_setsampwent;
3367 (*pdb_method)->endsampwent = ldapsam_endsampwent;
3368 (*pdb_method)->getsampwent = ldapsam_getsampwent;
3369 (*pdb_method)->getsampwnam = ldapsam_getsampwnam;
3370 (*pdb_method)->getsampwsid = ldapsam_getsampwsid;
3371 (*pdb_method)->add_sam_account = ldapsam_add_sam_account;
3372 (*pdb_method)->update_sam_account = ldapsam_update_sam_account;
3373 (*pdb_method)->delete_sam_account = ldapsam_delete_sam_account;
3375 (*pdb_method)->getgrsid = ldapsam_getgrsid;
3376 (*pdb_method)->getgrgid = ldapsam_getgrgid;
3377 (*pdb_method)->getgrnam = ldapsam_getgrnam;
3378 (*pdb_method)->add_group_mapping_entry = ldapsam_add_group_mapping_entry;
3379 (*pdb_method)->update_group_mapping_entry = ldapsam_update_group_mapping_entry;
3380 (*pdb_method)->delete_group_mapping_entry = ldapsam_delete_group_mapping_entry;
3381 (*pdb_method)->enum_group_mapping = ldapsam_enum_group_mapping;
3382 (*pdb_method)->enum_group_members = ldapsam_enum_group_members;
3383 (*pdb_method)->enum_group_memberships = ldapsam_enum_group_memberships;
3384 (*pdb_method)->lookup_rids = ldapsam_lookup_rids;
3386 /* TODO: Setup private data and free */
3388 ldap_state = TALLOC_ZERO_P(pdb_context->mem_ctx, struct ldapsam_privates);
3390 DEBUG(0, ("pdb_init_ldapsam_common: talloc() failed for ldapsam private_data!\n"));
3391 return NT_STATUS_NO_MEMORY;
3394 if (!NT_STATUS_IS_OK(nt_status =
3395 smbldap_init(pdb_context->mem_ctx, location,
3396 &ldap_state->smbldap_state)));
3398 ldap_state->domain_name = talloc_strdup(pdb_context->mem_ctx, get_global_sam_name());
3399 if (!ldap_state->domain_name) {
3400 return NT_STATUS_NO_MEMORY;
3403 (*pdb_method)->private_data = ldap_state;
3405 (*pdb_method)->free_private_data = free_private_data;
3407 return NT_STATUS_OK;
3410 /**********************************************************************
3411 Initialise the 'compat' mode for pdb_ldap
3412 *********************************************************************/
3414 NTSTATUS pdb_init_ldapsam_compat(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location)
3417 struct ldapsam_privates *ldap_state;
3419 #ifdef WITH_LDAP_SAMCONFIG
3421 int ldap_port = lp_ldap_port();
3423 /* remap default port if not using SSL (ie clear or TLS) */
3424 if ( (lp_ldap_ssl() != LDAP_SSL_ON) && (ldap_port == 636) ) {
3428 location = talloc_asprintf(pdb_context->mem_ctx, "%s://%s:%d", lp_ldap_ssl() == LDAP_SSL_ON ? "ldaps" : "ldap", lp_ldap_server(), ldap_port);
3430 return NT_STATUS_NO_MEMORY;
3435 if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) {
3439 (*pdb_method)->name = "ldapsam_compat";
3441 ldap_state = (*pdb_method)->private_data;
3442 ldap_state->schema_ver = SCHEMAVER_SAMBAACCOUNT;
3444 sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
3446 return NT_STATUS_OK;
3449 /**********************************************************************
3450 Initialise the normal mode for pdb_ldap
3451 *********************************************************************/
3453 NTSTATUS pdb_init_ldapsam(PDB_CONTEXT *pdb_context, PDB_METHODS **pdb_method, const char *location)
3456 struct ldapsam_privates *ldap_state;
3457 uint32 alg_rid_base;
3458 pstring alg_rid_base_string;
3459 LDAPMessage *result = NULL;
3460 LDAPMessage *entry = NULL;
3461 DOM_SID ldap_domain_sid;
3462 DOM_SID secrets_domain_sid;
3463 pstring domain_sid_string;
3466 if (!NT_STATUS_IS_OK(nt_status = pdb_init_ldapsam_common(pdb_context, pdb_method, location))) {
3470 (*pdb_method)->name = "ldapsam";
3472 (*pdb_method)->add_aliasmem = ldapsam_add_aliasmem;
3473 (*pdb_method)->del_aliasmem = ldapsam_del_aliasmem;
3474 (*pdb_method)->enum_aliasmem = ldapsam_enum_aliasmem;
3475 (*pdb_method)->enum_alias_memberships = ldapsam_alias_memberships;
3477 ldap_state = (*pdb_method)->private_data;
3478 ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
3480 /* Try to setup the Domain Name, Domain SID, algorithmic rid base */
3482 nt_status = smbldap_search_domain_info(ldap_state->smbldap_state, &result,
3483 ldap_state->domain_name, True);
3485 if ( !NT_STATUS_IS_OK(nt_status) ) {
3486 DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain info, nor add one to the domain\n"));
3487 DEBUGADD(2, ("pdb_init_ldapsam: Continuing on regardless, will be unable to allocate new users/groups, \
3488 and will risk BDCs having inconsistant SIDs\n"));
3489 sid_copy(&ldap_state->domain_sid, get_global_sam_sid());
3490 return NT_STATUS_OK;
3493 /* Given that the above might fail, everything below this must be optional */
3495 entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct, result);
3497 DEBUG(0, ("pdb_init_ldapsam: Could not get domain info entry\n"));
3498 ldap_msgfree(result);
3499 return NT_STATUS_UNSUCCESSFUL;
3502 dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
3504 return NT_STATUS_UNSUCCESSFUL;
3507 ldap_state->domain_dn = smb_xstrdup(dn);
3510 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
3511 get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
3512 domain_sid_string)) {
3514 if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
3515 DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be read as a valid SID\n", domain_sid_string));
3516 return NT_STATUS_INVALID_PARAMETER;
3518 found_sid = secrets_fetch_domain_sid(ldap_state->domain_name, &secrets_domain_sid);
3519 if (!found_sid || !sid_equal(&secrets_domain_sid, &ldap_domain_sid)) {
3520 fstring new_sid_str, old_sid_str;
3521 DEBUG(1, ("pdb_init_ldapsam: Resetting SID for domain %s based on pdb_ldap results %s -> %s\n",
3522 ldap_state->domain_name,
3523 sid_to_string(old_sid_str, &secrets_domain_sid),
3524 sid_to_string(new_sid_str, &ldap_domain_sid)));
3526 /* reset secrets.tdb sid */
3527 secrets_store_domain_sid(ldap_state->domain_name, &ldap_domain_sid);
3528 DEBUG(1, ("New global sam SID: %s\n", sid_to_string(new_sid_str, get_global_sam_sid())));
3530 sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
3533 if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
3534 get_attr_key2string( dominfo_attr_list, LDAP_ATTR_ALGORITHMIC_RID_BASE ),
3535 alg_rid_base_string)) {
3536 alg_rid_base = (uint32)atol(alg_rid_base_string);
3537 if (alg_rid_base != algorithmic_rid_base()) {
3538 DEBUG(0, ("The value of 'algorithmic RID base' has changed since the LDAP\n"
3539 "database was initialised. Aborting. \n"));
3540 ldap_msgfree(result);
3541 return NT_STATUS_UNSUCCESSFUL;
3544 ldap_msgfree(result);
3546 return NT_STATUS_OK;
3549 NTSTATUS pdb_ldap_init(void)
3552 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam", pdb_init_ldapsam)))
3555 if (!NT_STATUS_IS_OK(nt_status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "ldapsam_compat", pdb_init_ldapsam_compat)))
3558 /* Let pdb_nds register backends */
3561 return NT_STATUS_OK;