r11322: Start moving towards using the cracknames code in the KDC.

Andrew Bartlett
(This used to be commit cf67af421686e7a89334e10296a3a07c1f8f6298)

1 files changed, 70 insertions, 26 deletions

diff --git a/source4/kdc/hdb-ldb.c b/source4/kdc/hdb-ldb.c
index 7635501064..4100511a89 100644
--- a/source4/kdc/hdb-ldb.c
+++ b/source4/kdc/hdb-ldb.c
@@ -79,6 +79,17 @@ static const char * const krb5_attrs[] = {
 	NULL
 };
 
+const char *cross_ref_attrs[] = {
+	"nCName", 
+	NULL
+};
+
+const char *realm_attrs[] = {
+	"dnsDomain", 
+	"maxPwdAge",
+	NULL
+};
+
 static KerberosTime ldb_msg_find_krb5time_ldap_time(struct ldb_message *msg, const char *attr, KerberosTime default_val)
 {
     const char *tmp;
@@ -562,17 +573,6 @@ static krb5_error_code LDB_lookup_realm(krb5_context context, struct ldb_context
 	struct ldb_message **cross_ref_msg;
 	struct ldb_message **msg;
 
-	const char *cross_ref_attrs[] = {
-		"nCName", 
-		NULL
-	};
-
-	const char *realm_attrs[] = {
-		"dnsDomain", 
-		"maxPwdAge",
-		NULL
-	};
-
 	cross_ref_filter = talloc_asprintf(mem_ctx, 
 					   "(&(&(|(&(dnsRoot=%s)(nETBIOSName=*))(nETBIOSName=%s))(objectclass=crossRef))(ncName=*))",
 					   realm, realm);
@@ -752,19 +752,7 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags,
 		return ENOMEM;
 	}
 
-	realm = krb5_principal_get_realm(context, principal);
-
-	ret = LDB_lookup_realm(context, (struct ldb_context *)db->hdb_db, 
-			       mem_ctx, realm, &realm_msg);
-	if (ret != 0) {
-		krb5_warnx(context, "LDB_fetch: could not find realm");
-		talloc_free(mem_ctx);
-		return HDB_ERR_NOENTRY;
-	}
-
-	realm_dn = realm_msg[0]->dn;
-
-	/* Cludge, cludge cludge.  If the realm part of krbtgt/realm,
+		/* Cludge, cludge cludge.  If the realm part of krbtgt/realm,
 	 * is in our db, then direct the caller at our primary
 	 * krgtgt */
 	
@@ -791,13 +779,56 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags,
 				return ENOMEM;
 			}
 			ldb_ent_type = HDB_LDB_ENT_TYPE_KRBTGT;
+			break;
 		} else {
 			ldb_ent_type = HDB_LDB_ENT_TYPE_SERVER;
+			break;
 		}
-		break;
 	case HDB_ENT_TYPE_CLIENT:
+	{
+		int ldb_ret;
+		NTSTATUS nt_status;
+		struct ldb_dn *user_dn, *domain_dn;
+		char *principal_string;
 		ldb_ent_type = HDB_LDB_ENT_TYPE_CLIENT;
-		break;
+
+		ret = krb5_unparse_name(context, principal, &principal_string);
+		
+		if (ret != 0) {
+			talloc_free(mem_ctx);
+			return ret;
+		}
+
+		nt_status = crack_user_principal_name((struct ldb_context *)db->hdb_db,
+						      mem_ctx, principal_string, 
+						      &user_dn, &domain_dn);
+		free(principal_string);
+
+		if (!NT_STATUS_IS_OK(nt_status)) {
+			talloc_free(mem_ctx);
+			return HDB_ERR_NOENTRY;
+		}
+
+		ldb_ret = gendb_search_dn((struct ldb_context *)db->hdb_db,
+					  mem_ctx, user_dn, &msg, krb5_attrs);
+
+		if (ldb_ret != 1) {
+			return HDB_ERR_NOENTRY;
+		}
+
+		ldb_ret = gendb_search_dn((struct ldb_context *)db->hdb_db,
+					  mem_ctx, domain_dn, &realm_msg, realm_attrs);
+
+		if (ldb_ret != 1) {
+			return HDB_ERR_NOENTRY;
+		}
+
+		ret = LDB_message2entry(context, db, mem_ctx, 
+					principal, ldb_ent_type, 
+					realm_msg[0], msg[0], entry);
+		talloc_free(mem_ctx);
+		return ret;
+	}
 	case HDB_ENT_TYPE_ANY:
 		ldb_ent_type = HDB_LDB_ENT_TYPE_ANY;
 		break;
@@ -807,6 +838,19 @@ static krb5_error_code LDB_fetch(krb5_context context, HDB *db, unsigned flags,
 		return HDB_ERR_NOENTRY;
 	}
 
+
+	realm = krb5_principal_get_realm(context, principal);
+
+	ret = LDB_lookup_realm(context, (struct ldb_context *)db->hdb_db, 
+			       mem_ctx, realm, &realm_msg);
+	if (ret != 0) {
+		krb5_warnx(context, "LDB_fetch: could not find realm");
+		talloc_free(mem_ctx);
+		return HDB_ERR_NOENTRY;
+	}
+
+	realm_dn = realm_msg[0]->dn;
+
 	ret = LDB_lookup_principal(context, (struct ldb_context *)db->hdb_db, 
 				   mem_ctx, 
 				   principal, ldb_ent_type, realm_dn, &msg);