sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-14 19:24:43 +03:00
Code
samba-mirror/source3/include/ads.h

163 lines
3.9 KiB
C
Raw Normal View History

r17970: Add missing include-guards around ads.h and ads_cldap.h. Remove all reference to "Default-First-Site-Name" and treat it like any other site. Jeremy. (This used to be commit 5ae3564d6844f44a6943b2028917bd457371af1e)
2006-08-31 16:26:32 +00:00
#ifndef _INCLUDE_ADS_H_
#define _INCLUDE_ADS_H_
forgot this file (This used to be commit 1dd255b06d4c8669d839a387d4c63ff3475ab1ab)
2001-11-20 11:32:16 +00:00
/*
header for ads (active directory) library routines
basically this is a wrapper around ldap
*/
s3-includes: no need to globally include libads/ads_status.h. Guenther
2011-05-06 12:54:59 +02:00
#include "libads/ads_status.h"
s3-build: stop including ldap and lber headers everywhere in the code. Instead use new header smb_ldap.h where all LDAP API related things are handled, while smbldap.h only deals with our smbldap_X() API. Guenther Autobuild-User: Günther Deschner <gd@samba.org> Autobuild-Date: Wed Mar 16 10:54:51 CET 2011 on sn-devel-104
2011-02-24 11:56:08 +01:00
#include "smb_ldap.h"
r23922: implement input buffer handling for the SASL read wrapper metze (This used to be commit 7d8518ebd9470062b499b7074a940e14520e99f2)
2007-07-17 10:13:53 +00:00
struct ads_struct;
struct ads_saslwrap_ops {
const char *name;
r23926: implement output buffer handling for the SASL write wrapper metze (This used to be commit 65ce6fa21adec704b3cde30c57001e5620f048e4)
2007-07-17 11:14:42 +00:00
ADS_STATUS (*wrap)(struct ads_struct *, uint8 *buf, uint32 len);
r23922: implement input buffer handling for the SASL read wrapper metze (This used to be commit 7d8518ebd9470062b499b7074a940e14520e99f2)
2007-07-17 10:13:53 +00:00
ADS_STATUS (*unwrap)(struct ads_struct *);
r23946: add support for NTLMSSP sign and seal NOTE: windows servers are broken with sign only... metze (This used to be commit 408bb2e6e2171196a2bd314db181d9b124e931a1)
2007-07-18 08:15:42 +00:00
void (*disconnect)(struct ads_struct *);
r23922: implement input buffer handling for the SASL read wrapper metze (This used to be commit 7d8518ebd9470062b499b7074a940e14520e99f2)
2007-07-17 10:13:53 +00:00
};
r23945: add infrastructure to select plain, sign or seal LDAP connection metze (This used to be commit 2075c05b3d8baa7d6d8510cd962471a5781740a6)
2007-07-18 07:45:16 +00:00
enum ads_saslwrap_type {
ADS_SASLWRAP_TYPE_PLAIN = 1,
ADS_SASLWRAP_TYPE_SIGN = 2,
ADS_SASLWRAP_TYPE_SEAL = 4
r24039: remove unused global variable... metze (This used to be commit 05fce8815f2f08f71522ba326224185dcecd62ae)
2007-07-25 08:09:34 +00:00
};
r23945: add infrastructure to select plain, sign or seal LDAP connection metze (This used to be commit 2075c05b3d8baa7d6d8510cd962471a5781740a6)
2007-07-18 07:45:16 +00:00
r23922: implement input buffer handling for the SASL read wrapper metze (This used to be commit 7d8518ebd9470062b499b7074a940e14520e99f2)
2007-07-17 10:13:53 +00:00
typedef struct ads_struct {
bug 1195: add flag to ADS_STRUCT so we know who owns the main structure's memory (not the members though) (This used to be commit 4449e0e251190b741f51348819669453f0758f36)
2004-03-22 22:49:40 +00:00
int is_mine; /* do I own this structure's memory? */
s3: Fix some nonempty blank lines
2011-09-12 17:19:27 +02:00
sync 3.0 branch with head (This used to be commit 3928578b52cfc949be5e0ef444fce1558d75f290)
2002-08-17 17:00:51 +00:00
/* info needed to find the server */
struct {
char *realm;
char *workgroup;
char *ldap_server;
libads: Add API call to connect to a global catalog server. Extends ads_connect() to a new call ads_connect_gc() which connects on port 3268 rather than port 389. Also makes ads_try_connect() static and only used internally to ldap.c (This used to be commit f4c37dbe2c986fb7bfe510cdff3b4a9fbc06d079)
2008-06-27 10:22:39 -04:00
int foreign; /* set to 1 if connecting to a foreign
* realm */
bool gc; /* Is this a global catalog server? */
sync 3.0 branch with head (This used to be commit 3928578b52cfc949be5e0ef444fce1558d75f290)
2002-08-17 17:00:51 +00:00
} server;
/* info needed to authenticate */
struct {
char *realm;
char *password;
char *user_name;
char *kdc_server;
sync'ing up for 3.0alpha20 release (This used to be commit 65e7b5273bb58802bf0c389b77f7fcae0a1f6139)
2002-09-25 15:19:00 +00:00
unsigned flags;
int time_offset;
r21240: Fix longstanding Bug #4009. For the winbind cached ADS LDAP connection handling (ads_cached_connection()) we were (incorrectly) assuming that the service ticket lifetime equaled the tgt lifetime. For setups where the service ticket just lives 10 minutes, we were leaving hundreds of LDAP connections in CLOSE_WAIT state, until we fail to service entirely with "Too many open files". Also sequence_number() in winbindd_ads.c needs to delete the cached LDAP connection after the ads_do_search_retry() has failed to submit the search request (although the bind succeeded (returning an expired service ticket that we cannot delete from the memory cred cache - this will get fixed later)). Guenther (This used to be commit 7e1a84b7226fb8dcd5d34c64a3478a6d886a9a91)
2007-02-08 17:02:39 +00:00
time_t tgt_expire;
time_t tgs_expire;
r13316: Let the carnage begin.... Sync with trunk as off r13315 (This used to be commit 17e63ac4ed8325c0d44fe62b2442449f3298559f)
2006-02-03 22:19:41 +00:00
time_t renewable;
sync 3.0 branch with head (This used to be commit 3928578b52cfc949be5e0ef444fce1558d75f290)
2002-08-17 17:00:51 +00:00
} auth;
/* info derived from the servers config */
struct {
r17943: The horror, the horror. Add KDC site support by writing out a custom krb5.conf file containing the KDC I need. This may suck.... Needs some testing :-). Jeremy. (This used to be commit d500e1f96d92dfcc6292c448d1b399195f762d89)
2006-08-31 01:20:21 +00:00
uint32 flags; /* cldap flags identifying the services. */
sync 3.0 branch with head (This used to be commit 3928578b52cfc949be5e0ef444fce1558d75f290)
2002-08-17 17:00:51 +00:00
char *realm;
char *bind_path;
char *ldap_server_name;
r17945: Store the server and client sitenames in the ADS struct so we can see when they match - only create the ugly krb5 hack when they do. Jeremy. (This used to be commit 9be4ecf24b6b5dacf4c2891bddb072fa7543753f)
2006-08-31 04:14:08 +00:00
char *server_site_name;
char *client_site_name;
sync'ing up for 3.0alpha20 release (This used to be commit 65e7b5273bb58802bf0c389b77f7fcae0a1f6139)
2002-09-25 15:19:00 +00:00
time_t current_time;
r23838: Allow to store schema and config path in ADS_STRUCT config. Guenther (This used to be commit 1d5b08326fa72bd3423b377a4e6243466e778622)
2007-07-11 13:32:57 +00:00
char *schema_path;
char *config_path;
sync 3.0 branch with head (This used to be commit 3928578b52cfc949be5e0ef444fce1558d75f290)
2002-08-17 17:00:51 +00:00
} config;
r23888: move elements belonging to the current ldap connection to a substructure. metze (This used to be commit 00909194a6c1ed193dfdb296f50f58a53450583c)
2007-07-16 11:08:00 +00:00
/* info about the current LDAP connection */
r23896: hopefully fix the build on most systems metze (This used to be commit d5512da62a6ae38321709611b04f419cc6c3b190)
2007-07-16 15:31:01 +00:00
#ifdef HAVE_LDAP
r23888: move elements belonging to the current ldap connection to a substructure. metze (This used to be commit 00909194a6c1ed193dfdb296f50f58a53450583c)
2007-07-16 11:08:00 +00:00
struct {
LDAP *ld;
This is a large patch (sorry). Migrate from struct in_addr to struct sockaddr_storage in most places that matter (ie. not the nmbd and NetBIOS lookups). This passes make test on an IPv4 box, but I'll have to do more work/testing on IPv6 enabled boxes. This should now give us a framework for testing and finishing the IPv6 migration. It's at the state where someone with a working IPv6 setup should (theorecically) be able to type : smbclient //ipv6-address/share and have it work. Jeremy. (This used to be commit 98e154c3125d5732c37a72d74b0eb5cd7b6155fd)
2007-10-24 14:16:54 -07:00
struct sockaddr_storage ss; /* the ip of the active connection, if any */
s3/libads: use monotonic clock for ldap connection timeouts
2010-09-07 02:15:09 +02:00
time_t last_attempt; /* last attempt to reconnect, monotonic clock */
r23888: move elements belonging to the current ldap connection to a substructure. metze (This used to be commit 00909194a6c1ed193dfdb296f50f58a53450583c)
2007-07-16 11:08:00 +00:00
int port;
r23893: add dummy callbacks for LDAP SASL wrapping, they're not used yet... metze (This used to be commit a3b97cdce719d9d5e82f26096c0e8c3a86ff3965)
2007-07-16 14:35:33 +00:00
r23945: add infrastructure to select plain, sign or seal LDAP connection metze (This used to be commit 2075c05b3d8baa7d6d8510cd962471a5781740a6)
2007-07-18 07:45:16 +00:00
enum ads_saslwrap_type wrap_type;
r23898: rename HAVE_ADS_SASL_WRAPPING -> HAVE_LDAP_SASL_WRAPPING metze (This used to be commit 873eaff8febb50f00f9dac64c57b2a22c16f4f9b)
2007-07-16 16:08:24 +00:00
#ifdef HAVE_LDAP_SASL_WRAPPING
r23893: add dummy callbacks for LDAP SASL wrapping, they're not used yet... metze (This used to be commit a3b97cdce719d9d5e82f26096c0e8c3a86ff3965)
2007-07-16 14:35:33 +00:00
Sockbuf_IO_Desc *sbiod; /* lowlevel state for LDAP wrapping */
r23945: add infrastructure to select plain, sign or seal LDAP connection metze (This used to be commit 2075c05b3d8baa7d6d8510cd962471a5781740a6)
2007-07-18 07:45:16 +00:00
#endif /* HAVE_LDAP_SASL_WRAPPING */
r23922: implement input buffer handling for the SASL read wrapper metze (This used to be commit 7d8518ebd9470062b499b7074a940e14520e99f2)
2007-07-17 10:13:53 +00:00
TALLOC_CTX *mem_ctx;
const struct ads_saslwrap_ops *wrap_ops;
void *wrap_private_data;
struct {
uint32 ofs;
uint32 needed;
uint32 left;
r24131: - make it more clear what the different min and max fields mean - with the "GSSAPI" sasl mech the plain, sign or seal negotiation is independed from the req_flags and ret_flags - verify the server supports the wrapping type we want - better handling on negotiated buffer sizes metze (This used to be commit d0ec7323870ca16b28d458ff5f7dacce278b7d54)
2007-08-02 17:41:47 +00:00
#define ADS_SASL_WRAPPING_IN_MAX_WRAPPED 0x0FFFFFFF
uint32 max_wrapped;
uint32 min_wrapped;
r23922: implement input buffer handling for the SASL read wrapper metze (This used to be commit 7d8518ebd9470062b499b7074a940e14520e99f2)
2007-07-17 10:13:53 +00:00
uint32 size;
uint8 *buf;
} in;
struct {
uint32 ofs;
uint32 left;
r24131: - make it more clear what the different min and max fields mean - with the "GSSAPI" sasl mech the plain, sign or seal negotiation is independed from the req_flags and ret_flags - verify the server supports the wrapping type we want - better handling on negotiated buffer sizes metze (This used to be commit d0ec7323870ca16b28d458ff5f7dacce278b7d54)
2007-08-02 17:41:47 +00:00
#define ADS_SASL_WRAPPING_OUT_MAX_WRAPPED 0x00A00000
uint32 max_unwrapped;
r23926: implement output buffer handling for the SASL write wrapper metze (This used to be commit 65ce6fa21adec704b3cde30c57001e5620f048e4)
2007-07-17 11:14:42 +00:00
uint32 sig_size;
r23922: implement input buffer handling for the SASL read wrapper metze (This used to be commit 7d8518ebd9470062b499b7074a940e14520e99f2)
2007-07-17 10:13:53 +00:00
uint32 size;
uint8 *buf;
} out;
r23888: move elements belonging to the current ldap connection to a substructure. metze (This used to be commit 00909194a6c1ed193dfdb296f50f58a53450583c)
2007-07-16 11:08:00 +00:00
} ldap;
r23898: rename HAVE_ADS_SASL_WRAPPING -> HAVE_LDAP_SASL_WRAPPING metze (This used to be commit 873eaff8febb50f00f9dac64c57b2a22c16f4f9b)
2007-07-16 16:08:24 +00:00
#endif /* HAVE_LDAP */
r20986: Commit the prototype of the nss_info plugin interface. This allows a provider to supply the homedirectory, etc... attributes for a user without requiring support in core winbindd code. The idmap_ad.c module has been modified to provide the idmap 'ad' library as well as the rfc2307 and sfu "winbind nss info" support. The SID/id mapping is working in idmap_ad but the nss_info still has a few quirks that I'm in the process of resolving. (This used to be commit aaec0115e2c96935499052d9a637a20c6445986e)
2007-01-24 01:48:08 +00:00
} ADS_STRUCT;
r7994: This adds support in Winbindd's "security = ads"-mode to retrieve the POSIX homedirectory and the loginshell from Active Directory's "Services for Unix". Enable it with: winbind sfu support = yes User-Accounts without SFU-Unix-Attributes will be assigned template-based Shells and Homedirs as before. Note that it doesn't matter which version of Services for Unix you use (2.0, 2.2, 3.0 or 3.5). Samba should detect the correct attributes (msSFULoginShell, msSFU30LoginShell, etc.) automatically. If you also want to share the same uid/gid-space as SFU then also use PADL's ad-idmap-Plugin: idmap backend = ad When using the idmap-plugin only those accounts will appear in Name Service Switch that have those UNIX-attributes which avoids potential uid/gid-space clashes between SFU-ids and automatically assigned idmap-ids. Guenther (This used to be commit 28b59699425b1c954d191fc0e3bd357e4a4e4cd8)
2005-06-29 14:03:53 +00:00
Add ability to extend ads modification list on the fly. Added ADS_MODLIST type. (This used to be commit 3f7ba70615008d74a145a94aa087cae08efab343)
2002-02-11 15:48:34 +00:00
#ifdef HAVE_ADS
typedef LDAPMod **ADS_MODLIST;
#else
typedef void **ADS_MODLIST;
#endif
added timeouts and retries to ldap operations (This used to be commit 4f004eb54d66b6f811cb2f4791da6c70d77f87c2)
2001-12-05 09:19:25 +00:00
/* time between reconnect attempts */
#define ADS_RECONNECT_TIME 5
Add ads ldap server controls (This used to be commit 9126f008ef542b80f0040f621aa28478be5c80a0)
2002-04-10 13:25:40 +00:00
/* ldap control oids */
r7994: This adds support in Winbindd's "security = ads"-mode to retrieve the POSIX homedirectory and the loginshell from Active Directory's "Services for Unix". Enable it with: winbind sfu support = yes User-Accounts without SFU-Unix-Attributes will be assigned template-based Shells and Homedirs as before. Note that it doesn't matter which version of Services for Unix you use (2.0, 2.2, 3.0 or 3.5). Samba should detect the correct attributes (msSFULoginShell, msSFU30LoginShell, etc.) automatically. If you also want to share the same uid/gid-space as SFU then also use PADL's ad-idmap-Plugin: idmap backend = ad When using the idmap-plugin only those accounts will appear in Name Service Switch that have those UNIX-attributes which avoids potential uid/gid-space clashes between SFU-ids and automatically assigned idmap-ids. Guenther (This used to be commit 28b59699425b1c954d191fc0e3bd357e4a4e4cd8)
2005-06-29 14:03:53 +00:00
#define ADS_PAGE_CTL_OID "1.2.840.113556.1.4.319"
#define ADS_NO_REFERRALS_OID "1.2.840.113556.1.4.1339"
#define ADS_SERVER_SORT_OID "1.2.840.113556.1.4.473"
#define ADS_PERMIT_MODIFY_OID "1.2.840.113556.1.4.1413"
r13316: Let the carnage begin.... Sync with trunk as off r13315 (This used to be commit 17e63ac4ed8325c0d44fe62b2442449f3298559f)
2006-02-03 22:19:41 +00:00
#define ADS_ASQ_OID "1.2.840.113556.1.4.1504"
r15698: An attempt to make the winbind lookup_usergroups() call in security=ads more scalable: The most efficient way is to use the "tokenGroups" attribute which gives the nested group membership. As this attribute can not always be retrieved when binding with the machine account (the only garanteed way to get the tokenGroups I could find is when the machine account is a member of the "Pre Win2k Access" builtin group). Our current fallback when "tokenGroups" failed is looking for all groups where the userdn was in the "member" attribute. This behaves not very well in very large AD domains. The patch first tries the "memberOf" attribute on the user's dn in that case and directly retrieves the group's sids by using the LDAP Extended DN control from the user's object. The way to pass down the control to the ldap search call is rather painfull and probably will be rearranged later on. Successfully tested on win2k sp0, win2k sp4, wink3 sp1 and win2k3 r2. Guenther (This used to be commit 7d766b5505e4099ef7dd4e88bb000ebe38d71bd0)
2006-05-18 19:34:25 +00:00
#define ADS_EXTENDED_DN_OID "1.2.840.113556.1.4.529"
r23607: Add legacy support for Services for Unix (SFU) 2.0. Guenther (This used to be commit 11b390309b9677805e5b68f3a1b780658ae85137)
2007-06-26 09:15:37 +00:00
#define ADS_SD_FLAGS_OID "1.2.840.113556.1.4.801"
r7994: This adds support in Winbindd's "security = ads"-mode to retrieve the POSIX homedirectory and the loginshell from Active Directory's "Services for Unix". Enable it with: winbind sfu support = yes User-Accounts without SFU-Unix-Attributes will be assigned template-based Shells and Homedirs as before. Note that it doesn't matter which version of Services for Unix you use (2.0, 2.2, 3.0 or 3.5). Samba should detect the correct attributes (msSFULoginShell, msSFU30LoginShell, etc.) automatically. If you also want to share the same uid/gid-space as SFU then also use PADL's ad-idmap-Plugin: idmap backend = ad When using the idmap-plugin only those accounts will appear in Name Service Switch that have those UNIX-attributes which avoids potential uid/gid-space clashes between SFU-ids and automatically assigned idmap-ids. Guenther (This used to be commit 28b59699425b1c954d191fc0e3bd357e4a4e4cd8)
2005-06-29 14:03:53 +00:00
r11242: use LDAP bitwise machting rule when searching for groups in ADS. This avoids that each time a full-group-dump is requested from ADS; the bitwise match allows to only query those groups we are interested in. The ADS LDAP server changed to RFC compliant behaviour when decoding the ldap filter with extensible match in the latest SPs (fixes). From the patch: /* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o * rollup-fixes: * * According to Section 5.1(4) of RFC 2251 if a value of a type is it's * default value, it MUST be absent. In case of extensible matching the * "dnattr" boolean defaults to FALSE and so it must be only be present * when set to TRUE. * * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a * filter using bitwise matching rule then a buggy AD fails to decode * the extensible match. As a workaround set it to TRUE and thereby add * the dnAttributes "dn" field to cope with those older AD versions. * It should not harm and won't put any additional load on the AD since * none of the dn components have a bitmask-attribute. * * Thanks to Ralf Haferkamp for input and testing */ Guenther (This used to be commit db38ed6be607d08515920d46fb8a12f8cb4ddd6e)
2005-10-21 12:50:39 +00:00
/* ldap bitwise searches */
#define ADS_LDAP_MATCHING_RULE_BIT_AND "1.2.840.113556.1.4.803"
#define ADS_LDAP_MATCHING_RULE_BIT_OR "1.2.840.113556.1.4.804"
sync 3.0 branch with head (This used to be commit 3928578b52cfc949be5e0ef444fce1558d75f290)
2002-08-17 17:00:51 +00:00
#define ADS_PINGS 0x0000FFFF /* Ping response */
sync'ing up for 3.0alpha20 release (This used to be commit 65e7b5273bb58802bf0c389b77f7fcae0a1f6139)
2002-09-25 15:19:00 +00:00
/* ads auth control flags */
libads: add ADS_AUTH_USER_CREDS to avoid magic overwriting of usernames. Guenther (This used to be commit b5aaf5aa0f280f69e05b613271c96473a79b812e)
2008-06-24 12:11:06 +02:00
#define ADS_AUTH_DISABLE_KERBEROS 0x0001
#define ADS_AUTH_NO_BIND 0x0002
#define ADS_AUTH_ANON_BIND 0x0004
#define ADS_AUTH_SIMPLE_BIND 0x0008
#define ADS_AUTH_ALLOW_NTLMSSP 0x0010
#define ADS_AUTH_SASL_SIGN 0x0020
#define ADS_AUTH_SASL_SEAL 0x0040
#define ADS_AUTH_SASL_FORCE 0x0080
#define ADS_AUTH_USER_CREDS 0x0100
Merge from HEAD client-side authentication changes: - new kerberos code, allowing the account to change it's own password without special SD settings required - NTLMSSP client code, now seperated from cliconnect.c - NTLMv2 client code - SMB signing fixes Andrew Bartlett (This used to be commit 837680ca517982f2e5944730581a83012d4181ae)
2003-02-24 02:55:00 +00:00
r15698: An attempt to make the winbind lookup_usergroups() call in security=ads more scalable: The most efficient way is to use the "tokenGroups" attribute which gives the nested group membership. As this attribute can not always be retrieved when binding with the machine account (the only garanteed way to get the tokenGroups I could find is when the machine account is a member of the "Pre Win2k Access" builtin group). Our current fallback when "tokenGroups" failed is looking for all groups where the userdn was in the "member" attribute. This behaves not very well in very large AD domains. The patch first tries the "memberOf" attribute on the user's dn in that case and directly retrieves the group's sids by using the LDAP Extended DN control from the user's object. The way to pass down the control to the ldap search call is rather painfull and probably will be rearranged later on. Successfully tested on win2k sp0, win2k sp4, wink3 sp1 and win2k3 r2. Guenther (This used to be commit 7d766b5505e4099ef7dd4e88bb000ebe38d71bd0)
2006-05-18 19:34:25 +00:00
enum ads_extended_dn_flags {
ADS_EXTENDED_DN_HEX_STRING = 0,
ADS_EXTENDED_DN_STRING = 1 /* not supported on win2k */
};
/* this is probably not very well suited to pass other controls generically but
* is good enough for the extended dn control where it is only used for atm */
typedef struct {
const char *control;
int val;
int critical;
} ads_control;
r23826: Fix gpo security filtering by matching the security descriptor ace's for the extended apply group policy right. Guenther (This used to be commit d832014a6fef657f484412372b5d09047552b183)
2007-07-11 09:39:08 +00:00
s3: avoid global include of ads.h. Guenther
2010-07-02 00:32:52 +02:00
#include "libads/ads_proto.h"
#ifdef HAVE_LDAP
#include "libads/ads_ldap_protos.h"
#endif
#include "libads/kerberos_proto.h"
r24804: As a temporary workaround, also try to guess the server's principal in the "not_defined_in_RFC4178@please_ignore" case to make at least LDAP SASL binds succeed with windows server 2008. Guenther (This used to be commit f5b3de4d3069eaa750240e3422bac5cb169b6c0a)
2007-08-30 15:39:51 +00:00
r22841: Add comment to endif statement. (This used to be commit 1351207626ee0f99aef93326ef96bf69651bf472)
2007-05-14 09:50:39 +00:00
#endif /* _INCLUDE_ADS_H_ */
Copy Permalink