diff options
| author | Günther Deschner <gd@samba.org> | 2005-06-29 14:03:53 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 10:58:07 -0500 |
| commit | 2e7f22e833fbb549f698460f9ed4d81af68b86e9 (patch) | |
| tree | 58f04a4311fa6cb4b2acdb33222b8b340675badb /source3/include/ads.h | |
| parent | 3922667cbe6cd56c6d29c88692b7e7d3342c1f1f (diff) | |
| download | samba-2e7f22e833fbb549f698460f9ed4d81af68b86e9.tar.gz samba-2e7f22e833fbb549f698460f9ed4d81af68b86e9.tar.bz2 samba-2e7f22e833fbb549f698460f9ed4d81af68b86e9.zip | |
r7994: This adds support in Winbindd's "security = ads"-mode to retrieve the POSIX
homedirectory and the loginshell from Active Directory's "Services for Unix".
Enable it with:
winbind sfu support = yes
User-Accounts without SFU-Unix-Attributes will be assigned template-based
Shells and Homedirs as before.
Note that it doesn't matter which version of Services for Unix you use (2.0,
2.2, 3.0 or 3.5). Samba should detect the correct attributes (msSFULoginShell,
msSFU30LoginShell, etc.) automatically.
If you also want to share the same uid/gid-space as SFU then also use PADL's
ad-idmap-Plugin:
idmap backend = ad
When using the idmap-plugin only those accounts will appear in Name Service
Switch that have those UNIX-attributes which avoids potential uid/gid-space
clashes between SFU-ids and automatically assigned idmap-ids.
Guenther
(This used to be commit 28b59699425b1c954d191fc0e3bd357e4a4e4cd8)
Diffstat (limited to 'source3/include/ads.h')
| -rw-r--r-- | source3/include/ads.h | 24 |
1 files changed, 20 insertions, 4 deletions
diff --git a/source3/include/ads.h b/source3/include/ads.h index 27f9384d5d..8f6cc6e582 100644 --- a/source3/include/ads.h +++ b/source3/include/ads.h @@ -36,9 +36,19 @@ typedef struct { struct { char *realm; char *bind_path; + char *schema_path; char *ldap_server_name; time_t current_time; } config; + + /* info derived from the servers schema */ + struct { + char *sfu_homedir_attr; + char *sfu_shell_attr; + char *sfu_uidnumber_attr; + char *sfu_gidnumber_attr; + } schema; + } ADS_STRUCT; /* there are 5 possible types of errors the ads subsystem can produce */ @@ -77,10 +87,16 @@ typedef void **ADS_MODLIST; #define ADS_RECONNECT_TIME 5 /* ldap control oids */ -#define ADS_PAGE_CTL_OID "1.2.840.113556.1.4.319" -#define ADS_NO_REFERRALS_OID "1.2.840.113556.1.4.1339" -#define ADS_SERVER_SORT_OID "1.2.840.113556.1.4.473" -#define ADS_PERMIT_MODIFY_OID "1.2.840.113556.1.4.1413" +#define ADS_PAGE_CTL_OID "1.2.840.113556.1.4.319" +#define ADS_NO_REFERRALS_OID "1.2.840.113556.1.4.1339" +#define ADS_SERVER_SORT_OID "1.2.840.113556.1.4.473" +#define ADS_PERMIT_MODIFY_OID "1.2.840.113556.1.4.1413" + +/* ldap attribute oids (Services for Unix) */ +#define ADS_ATTR_SFU_UIDNUMBER_OID "1.2.840.113556.1.6.18.1.310" +#define ADS_ATTR_SFU_GIDNUMBER_OID "1.2.840.113556.1.6.18.1.311" +#define ADS_ATTR_SFU_HOMEDIR_OID "1.2.840.113556.1.6.18.1.344" +#define ADS_ATTR_SFU_SHELL_OID "1.2.840.113556.1.6.18.1.312" /* UserFlags for userAccountControl */ #define UF_SCRIPT 0x00000001 |