From 6464bb0ae5d2cb774ccd5187f65a6ff83c051ed9 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Tue, 20 Nov 2001 08:54:15 +0000 Subject: added the beginnings of ADS support in smbd (This used to be commit c7f611691941ca92f57665e19d6e46b161599427) --- source3/libads/ldap.c | 324 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 324 insertions(+) create mode 100644 source3/libads/ldap.c (limited to 'source3/libads') diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c new file mode 100644 index 0000000000..2853dbbaa3 --- /dev/null +++ b/source3/libads/ldap.c @@ -0,0 +1,324 @@ +/* + Unix SMB/Netbios implementation. + Version 3.0 + ads (active directory) utility library + Copyright (C) Andrew Tridgell 2001 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" + +#ifdef HAVE_ADS + +/* return a dn of the form "dc=AA,dc=BB,dc=CC" from a + realm of the form AA.BB.CC + caller must free +*/ +static char *ads_build_dn(const char *realm) +{ + char *p, *r; + int numdots = 0; + char *ret; + int len; + + r = strdup(realm); + + if (!r || !*r) return r; + + for (p=r; *p; p++) { + if (*p == '.') numdots++; + } + + len = (numdots+1)*4 + strlen(r) + 1; + +ret = malloc(len); + strlcpy(ret,"dc=", len); + p=strtok(r,"."); + strlcat(ret, p, len); + + while ((p=strtok(NULL,"."))) { + strlcat(ret,",dc=", len); + strlcat(ret, p, len); + } + + free(r); + + return ret; +} + +/* + return a string for an error from a ads routine +*/ +char *ads_errstr(int rc) +{ + return ldap_err2string(rc); +} + +/* + initialise a ADS_STRUCT, ready for some ads_ ops +*/ +ADS_STRUCT *ads_init(const char *realm, + const char *ldap_server, + const char *bind_path) +{ + ADS_STRUCT *ads; + + ads = (ADS_STRUCT *)xmalloc(sizeof(*ads)); + memset(ads, 0, sizeof(*ads)); + + ads->realm = realm? strdup(realm) : NULL; + ads->ldap_server = ldap_server? strdup(ldap_server) : NULL; + ads->bind_path = bind_path? strdup(bind_path) : NULL; + ads->ldap_port = LDAP_PORT; + + if (!ads->bind_path) { + ads->bind_path = ads_build_dn(ads->realm); + } + + return ads; +} + + +/* + this is a minimal interact function, just enough for SASL to talk + GSSAPI/kerberos to W2K +*/ +static int sasl_interact(LDAP *ld,unsigned flags,void *defaults,void *in) +{ + sasl_interact_t *interact = in; + + while (interact->id != SASL_CB_LIST_END) { + interact->result = strdup(""); + interact->len = 0; + interact++; + } + + return LDAP_SUCCESS; +} + +/* + connect to the LDAP server +*/ +int ads_connect(ADS_STRUCT *ads) +{ + int version = LDAP_VERSION3; + int rc; + + ads->ld = ldap_open(ads->ldap_server, ads->ldap_port); + if (!ads->ld) { + return errno; + } + ldap_set_option(ads->ld, LDAP_OPT_PROTOCOL_VERSION, &version); + + rc = ldap_sasl_interactive_bind_s(ads->ld, NULL, NULL, NULL, NULL, 0, + sasl_interact, NULL); + + return rc; +} + + +/* + find a machine account given a hostname +*/ +int ads_find_machine_acct(ADS_STRUCT *ads, void **res, const char *host) +{ + int ret; + char *exp; + + /* the easiest way to find a machine account anywhere in the tree + is to look for hostname$ */ + asprintf(&exp, "(samAccountName=%s$)", host); + *res = NULL; + ret = ldap_search_s(ads->ld, ads->bind_path, + LDAP_SCOPE_SUBTREE, exp, NULL, 0, (LDAPMessage **)res); + free(exp); + return ret; +} + + +/* + a convenient routine for adding a generic LDAP record +*/ +int ads_gen_add(ADS_STRUCT *ads, const char *new_dn, ...) +{ + int i; + va_list ap; + LDAPMod **mods; + char *name, *value; + int ret; +#define MAX_MOD_VALUES 10 + + /* count the number of attributes */ + va_start(ap, new_dn); + for (i=0; va_arg(ap, char *); i++) { + /* skip the values */ + while (va_arg(ap, char *)) ; + } + va_end(ap); + + mods = malloc(sizeof(LDAPMod *) * (i+1)); + + va_start(ap, new_dn); + for (i=0; (name=va_arg(ap, char *)); i++) { + char **values; + int j; + values = (char **)malloc(sizeof(char *) * (MAX_MOD_VALUES+1)); + for (j=0; (value=va_arg(ap, char *)) && j < MAX_MOD_VALUES; j++) { + values[j] = value; + } + values[j] = NULL; + mods[i] = malloc(sizeof(LDAPMod)); + mods[i]->mod_type = name; + mods[i]->mod_op = LDAP_MOD_ADD; + mods[i]->mod_values = values; + } + mods[i] = NULL; + va_end(ap); + + ret = ldap_add_s(ads->ld, new_dn, mods); + + for (i=0; mods[i]; i++) { + free(mods[i]->mod_values); + free(mods[i]); + } + free(mods); + + return ret; +} + +/* + add a machine account to the ADS server +*/ +static int ads_add_machine_acct(ADS_STRUCT *ads, const char *hostname) +{ + int ret; + char *host_spn, *host_upn, *new_dn, *samAccountName, *controlstr; + + asprintf(&host_spn, "HOST/%s", hostname); + asprintf(&host_upn, "%s@%s", host_spn, ads->realm); + asprintf(&new_dn, "cn=%s,cn=Computers,%s", hostname, ads->bind_path); + asprintf(&samAccountName, "%s$", hostname); + asprintf(&controlstr, "%u", + UF_DONT_EXPIRE_PASSWD | UF_WORKSTATION_TRUST_ACCOUNT | + UF_TRUSTED_FOR_DELEGATION | UF_USE_DES_KEY_ONLY); + + ret = ads_gen_add(ads, new_dn, + "cn", hostname, NULL, + "sAMAccountName", samAccountName, NULL, + "objectClass", + "top", "person", "organizationalPerson", + "user", "computer", NULL, + "userPrincipalName", host_upn, NULL, + "servicePrincipalName", host_spn, NULL, + "dNSHostName", hostname, NULL, + "userAccountControl", controlstr, NULL, + "operatingSystem", "Samba", NULL, + "operatingSystemVersion", VERSION, NULL, + NULL); + + free(host_spn); + free(host_upn); + free(new_dn); + free(samAccountName); + free(controlstr); + + return ret; +} + +/* + dump a record from LDAP on stdout + used for debugging +*/ +void ads_dump(ADS_STRUCT *ads, void *res) +{ + char *field; + LDAPMessage *msg; + BerElement *b; + char *this_dn; + + for (msg = ldap_first_entry(ads->ld, (LDAPMessage *)res); + msg; msg = ldap_next_entry(ads->ld, msg)) { + this_dn = ldap_get_dn(ads->ld, (LDAPMessage *)res); + if (this_dn) { + printf("Dumping: %s\n", this_dn); + } + ldap_memfree(this_dn); + + for (field = ldap_first_attribute(ads->ld, msg, &b); + field; + field = ldap_next_attribute(ads->ld, msg, b)) { + char **values, **p; + values = ldap_get_values(ads->ld, msg, field); + for (p = values; *p; p++) { + printf("%s: %s\n", field, *p); + } + ldap_value_free(values); + ldap_memfree(field); + } + + ber_free(b, 1); + printf("\n"); + } +} + +/* + count how many replies are in a LDAPMessage +*/ +int ads_count_replies(ADS_STRUCT *ads, void *res) +{ + return ldap_count_entries(ads->ld, (LDAPMessage *)res); +} + +/* + join a machine to a realm, creating the machine account + and setting the machine password +*/ +int ads_join_realm(ADS_STRUCT *ads, const char *hostname) +{ + int rc; + LDAPMessage *res; + char *principal; + + rc = ads_find_machine_acct(ads, (void **)&res, hostname); + if (rc == LDAP_SUCCESS && ads_count_replies(ads, res) == 1) { + DEBUG(0, ("Host account for %s already exists\n", hostname)); + goto set_password; + } + + rc = ads_add_machine_acct(ads, hostname); + if (rc != LDAP_SUCCESS) { + DEBUG(0, ("ads_add_machine_acct: %s\n", ads_errstr(rc))); + return rc; + } + + rc = ads_find_machine_acct(ads, (void **)&res, hostname); + if (rc != LDAP_SUCCESS || ads_count_replies(ads, res) != 1) { + DEBUG(0, ("Host account test failed\n")); + /* hmmm, we need NTSTATUS */ + return -1; + } + +set_password: + asprintf(&principal, "HOST/%s@%s", hostname, ads->realm); +#if 0 + krb5_set_principal_password(principal, ads->ldap_server, hostname, ads->realm); +#endif + free(principal); + + return LDAP_SUCCESS; +} + +#endif -- cgit