sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-06 13:18:07 +03:00
Code
910a331f3e
samba-mirror/source3/include/ads.h

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

84 lines
2.1 KiB
C
Raw Normal View History

r17970: Add missing include-guards around ads.h and ads_cldap.h. Remove all reference to "Default-First-Site-Name" and treat it like any other site. Jeremy. (This used to be commit 5ae3564d6844f44a6943b2028917bd457371af1e)
2006-08-31 20:26:32 +04:00
#ifndef _INCLUDE_ADS_H_
#define _INCLUDE_ADS_H_
forgot this file (This used to be commit 1dd255b06d4c8669d839a387d4c63ff3475ab1ab)
2001-11-20 14:32:16 +03:00
/*
header for ads (active directory) library routines
basically this is a wrapper around ldap
*/
s3:libads: add ads_set_reconnect_fn() and only reconnect if we can get creds This reconnect is only useful for long running connections (e.g. in winbindd) and there we'll make use of it... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-03-06 12:13:11 +03:00
struct cli_credentials;
struct ads_reconnect_state;
s3-includes: no need to globally include libads/ads_status.h. Guenther
2011-05-06 14:54:59 +04:00
#include "libads/ads_status.h"
s3-build: stop including ldap and lber headers everywhere in the code. Instead use new header smb_ldap.h where all LDAP API related things are handled, while smbldap.h only deals with our smbldap_X() API. Guenther Autobuild-User: Günther Deschner <gd@samba.org> Autobuild-Date: Wed Mar 16 10:54:51 CET 2011 on sn-devel-104
2011-02-24 13:56:08 +03:00
#include "smb_ldap.h"
s3-librpc: add ads.idl and convert ads_struct to talloc. Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-17 12:58:02 +03:00
#include "librpc/gen_ndr/ads.h"
s3-build: stop including ldap and lber headers everywhere in the code. Instead use new header smb_ldap.h where all LDAP API related things are handled, while smbldap.h only deals with our smbldap_X() API. Guenther Autobuild-User: Günther Deschner <gd@samba.org> Autobuild-Date: Wed Mar 16 10:54:51 CET 2011 on sn-devel-104
2011-02-24 13:56:08 +03:00
libads: abstract out SASL wrapping code Prepare for rebasing libads on top of libsmbldap. To make libads using 'struct smbldap_state' instead of direct LDAP structure, we need to abstract out libads logic from connection handling. SASL wrapping does not really depend on availability of LDAP handle and does not need direct access to ADS_STRUCT. As result, we'll be able to move SASL wrapping code under smbldap once the latter is able to pass settings that libads passes to the SASL wrapping. Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-05-05 15:37:20 +03:00
struct ads_saslwrap;
r23922: implement input buffer handling for the SASL read wrapper metze (This used to be commit 7d8518ebd9470062b499b7074a940e14520e99f2)
2007-07-17 14:13:53 +04:00
struct ads_saslwrap_ops {
const char *name;
libads: abstract out SASL wrapping code Prepare for rebasing libads on top of libsmbldap. To make libads using 'struct smbldap_state' instead of direct LDAP structure, we need to abstract out libads logic from connection handling. SASL wrapping does not really depend on availability of LDAP handle and does not need direct access to ADS_STRUCT. As result, we'll be able to move SASL wrapping code under smbldap once the latter is able to pass settings that libads passes to the SASL wrapping. Signed-off-by: Alexander Bokovoy <ab@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-05-05 15:37:20 +03:00
ADS_STATUS (*wrap)(struct ads_saslwrap *, uint8_t *buf, uint32_t len);
ADS_STATUS (*unwrap)(struct ads_saslwrap *);
void (*disconnect)(struct ads_saslwrap *);
r23922: implement input buffer handling for the SASL read wrapper metze (This used to be commit 7d8518ebd9470062b499b7074a940e14520e99f2)
2007-07-17 14:13:53 +04:00
};
s3:libads: add ads_set_reconnect_fn() and only reconnect if we can get creds This reconnect is only useful for long running connections (e.g. in winbindd) and there we'll make use of it... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2024-03-06 12:13:11 +03:00
struct ads_reconnect_state {
NTSTATUS (*fn)(struct ads_struct *ads,
void *private_data,
TALLOC_CTX *mem_ctx,
struct cli_credentials **creds);
void *private_data;
};
s3-librpc: add ads.idl and convert ads_struct to talloc. Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-17 12:58:02 +03:00
typedef struct ads_struct ADS_STRUCT;
r7994: This adds support in Winbindd's "security = ads"-mode to retrieve the POSIX homedirectory and the loginshell from Active Directory's "Services for Unix". Enable it with: winbind sfu support = yes User-Accounts without SFU-Unix-Attributes will be assigned template-based Shells and Homedirs as before. Note that it doesn't matter which version of Services for Unix you use (2.0, 2.2, 3.0 or 3.5). Samba should detect the correct attributes (msSFULoginShell, msSFU30LoginShell, etc.) automatically. If you also want to share the same uid/gid-space as SFU then also use PADL's ad-idmap-Plugin: idmap backend = ad When using the idmap-plugin only those accounts will appear in Name Service Switch that have those UNIX-attributes which avoids potential uid/gid-space clashes between SFU-ids and automatically assigned idmap-ids. Guenther (This used to be commit 28b59699425b1c954d191fc0e3bd357e4a4e4cd8)
2005-06-29 18:03:53 +04:00
Add ability to extend ads modification list on the fly. Added ADS_MODLIST type. (This used to be commit 3f7ba70615008d74a145a94aa087cae08efab343)
2002-02-11 18:48:34 +03:00
#ifdef HAVE_ADS
typedef LDAPMod **ADS_MODLIST;
#else
typedef void **ADS_MODLIST;
#endif
added timeouts and retries to ldap operations (This used to be commit 4f004eb54d66b6f811cb2f4791da6c70d77f87c2)
2001-12-05 12:19:25 +03:00
/* time between reconnect attempts */
#define ADS_RECONNECT_TIME 5
Add ads ldap server controls (This used to be commit 9126f008ef542b80f0040f621aa28478be5c80a0)
2002-04-10 17:25:40 +04:00
/* ldap control oids */
r7994: This adds support in Winbindd's "security = ads"-mode to retrieve the POSIX homedirectory and the loginshell from Active Directory's "Services for Unix". Enable it with: winbind sfu support = yes User-Accounts without SFU-Unix-Attributes will be assigned template-based Shells and Homedirs as before. Note that it doesn't matter which version of Services for Unix you use (2.0, 2.2, 3.0 or 3.5). Samba should detect the correct attributes (msSFULoginShell, msSFU30LoginShell, etc.) automatically. If you also want to share the same uid/gid-space as SFU then also use PADL's ad-idmap-Plugin: idmap backend = ad When using the idmap-plugin only those accounts will appear in Name Service Switch that have those UNIX-attributes which avoids potential uid/gid-space clashes between SFU-ids and automatically assigned idmap-ids. Guenther (This used to be commit 28b59699425b1c954d191fc0e3bd357e4a4e4cd8)
2005-06-29 18:03:53 +04:00
#define ADS_PAGE_CTL_OID "1.2.840.113556.1.4.319"
#define ADS_NO_REFERRALS_OID "1.2.840.113556.1.4.1339"
#define ADS_SERVER_SORT_OID "1.2.840.113556.1.4.473"
#define ADS_PERMIT_MODIFY_OID "1.2.840.113556.1.4.1413"
r13316: Let the carnage begin.... Sync with trunk as off r13315 (This used to be commit 17e63ac4ed8325c0d44fe62b2442449f3298559f)
2006-02-04 01:19:41 +03:00
#define ADS_ASQ_OID "1.2.840.113556.1.4.1504"
r15698: An attempt to make the winbind lookup_usergroups() call in security=ads more scalable: The most efficient way is to use the "tokenGroups" attribute which gives the nested group membership. As this attribute can not always be retrieved when binding with the machine account (the only garanteed way to get the tokenGroups I could find is when the machine account is a member of the "Pre Win2k Access" builtin group). Our current fallback when "tokenGroups" failed is looking for all groups where the userdn was in the "member" attribute. This behaves not very well in very large AD domains. The patch first tries the "memberOf" attribute on the user's dn in that case and directly retrieves the group's sids by using the LDAP Extended DN control from the user's object. The way to pass down the control to the ldap search call is rather painfull and probably will be rearranged later on. Successfully tested on win2k sp0, win2k sp4, wink3 sp1 and win2k3 r2. Guenther (This used to be commit 7d766b5505e4099ef7dd4e88bb000ebe38d71bd0)
2006-05-18 23:34:25 +04:00
#define ADS_EXTENDED_DN_OID "1.2.840.113556.1.4.529"
r23607: Add legacy support for Services for Unix (SFU) 2.0. Guenther (This used to be commit 11b390309b9677805e5b68f3a1b780658ae85137)
2007-06-26 13:15:37 +04:00
#define ADS_SD_FLAGS_OID "1.2.840.113556.1.4.801"
r7994: This adds support in Winbindd's "security = ads"-mode to retrieve the POSIX homedirectory and the loginshell from Active Directory's "Services for Unix". Enable it with: winbind sfu support = yes User-Accounts without SFU-Unix-Attributes will be assigned template-based Shells and Homedirs as before. Note that it doesn't matter which version of Services for Unix you use (2.0, 2.2, 3.0 or 3.5). Samba should detect the correct attributes (msSFULoginShell, msSFU30LoginShell, etc.) automatically. If you also want to share the same uid/gid-space as SFU then also use PADL's ad-idmap-Plugin: idmap backend = ad When using the idmap-plugin only those accounts will appear in Name Service Switch that have those UNIX-attributes which avoids potential uid/gid-space clashes between SFU-ids and automatically assigned idmap-ids. Guenther (This used to be commit 28b59699425b1c954d191fc0e3bd357e4a4e4cd8)
2005-06-29 18:03:53 +04:00
r11242: use LDAP bitwise machting rule when searching for groups in ADS. This avoids that each time a full-group-dump is requested from ADS; the bitwise match allows to only query those groups we are interested in. The ADS LDAP server changed to RFC compliant behaviour when decoding the ldap filter with extensible match in the latest SPs (fixes). From the patch: /* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o * rollup-fixes: * * According to Section 5.1(4) of RFC 2251 if a value of a type is it's * default value, it MUST be absent. In case of extensible matching the * "dnattr" boolean defaults to FALSE and so it must be only be present * when set to TRUE. * * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a * filter using bitwise matching rule then a buggy AD fails to decode * the extensible match. As a workaround set it to TRUE and thereby add * the dnAttributes "dn" field to cope with those older AD versions. * It should not harm and won't put any additional load on the AD since * none of the dn components have a bitmask-attribute. * * Thanks to Ralf Haferkamp for input and testing */ Guenther (This used to be commit db38ed6be607d08515920d46fb8a12f8cb4ddd6e)
2005-10-21 16:50:39 +04:00
/* ldap bitwise searches */
#define ADS_LDAP_MATCHING_RULE_BIT_AND "1.2.840.113556.1.4.803"
#define ADS_LDAP_MATCHING_RULE_BIT_OR "1.2.840.113556.1.4.804"
sync 3.0 branch with head (This used to be commit 3928578b52cfc949be5e0ef444fce1558d75f290)
2002-08-17 21:00:51 +04:00
#define ADS_PINGS 0x0000FFFF /* Ping response */
r15698: An attempt to make the winbind lookup_usergroups() call in security=ads more scalable: The most efficient way is to use the "tokenGroups" attribute which gives the nested group membership. As this attribute can not always be retrieved when binding with the machine account (the only garanteed way to get the tokenGroups I could find is when the machine account is a member of the "Pre Win2k Access" builtin group). Our current fallback when "tokenGroups" failed is looking for all groups where the userdn was in the "member" attribute. This behaves not very well in very large AD domains. The patch first tries the "memberOf" attribute on the user's dn in that case and directly retrieves the group's sids by using the LDAP Extended DN control from the user's object. The way to pass down the control to the ldap search call is rather painfull and probably will be rearranged later on. Successfully tested on win2k sp0, win2k sp4, wink3 sp1 and win2k3 r2. Guenther (This used to be commit 7d766b5505e4099ef7dd4e88bb000ebe38d71bd0)
2006-05-18 23:34:25 +04:00
enum ads_extended_dn_flags {
ADS_EXTENDED_DN_HEX_STRING = 0,
ADS_EXTENDED_DN_STRING = 1 /* not supported on win2k */
};
/* this is probably not very well suited to pass other controls generically but
* is good enough for the extended dn control where it is only used for atm */
typedef struct {
const char *control;
int val;
int critical;
} ads_control;
r23826: Fix gpo security filtering by matching the security descriptor ace's for the extended apply group policy right. Guenther (This used to be commit d832014a6fef657f484412372b5d09047552b183)
2007-07-11 13:39:08 +04:00
s3: avoid global include of ads.h. Guenther
2010-07-02 02:32:52 +04:00
#include "libads/ads_proto.h"
#ifdef HAVE_LDAP
#include "libads/ads_ldap_protos.h"
#endif
#include "libads/kerberos_proto.h"
r24804: As a temporary workaround, also try to guess the server's principal in the "not_defined_in_RFC4178@please_ignore" case to make at least LDAP SASL binds succeed with windows server 2008. Guenther (This used to be commit f5b3de4d3069eaa750240e3422bac5cb169b6c0a)
2007-08-30 19:39:51 +04:00
s3-librpc: add ads.idl and convert ads_struct to talloc. Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-17 12:58:02 +03:00
#define ADS_TALLOC_CONST_FREE(PTR) do { talloc_free(discard_const(PTR)); PTR = NULL; } while (0);
r22841: Add comment to endif statement. (This used to be commit 1351207626ee0f99aef93326ef96bf69651bf472)
2007-05-14 13:50:39 +04:00
#endif /* _INCLUDE_ADS_H_ */
Copy Permalink