1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #ifndef _ADUTILS_H 28 #define _ADUTILS_H 29 30 #ifdef __cplusplus 31 extern "C" { 32 #endif 33 34 /* 35 * Processes name2sid & sid2name lookups for a given user or computer 36 * from an AD Difrectory server using GSSAPI authentication 37 */ 38 39 #include <stdio.h> 40 #include <stdlib.h> 41 #include <unistd.h> 42 #include <lber.h> 43 #include <ldap.h> 44 #include <sasl/sasl.h> 45 #include <string.h> 46 #include <ctype.h> 47 #include <sys/types.h> 48 #include <time.h> 49 #include <thread.h> 50 #include <synch.h> 51 #include <rpcsvc/idmap_prot.h> 52 #include "libadutils.h" 53 #include <sys/idmap.h> 54 55 /* 56 * idmapd interfaces stolen? from other idmapd code? 57 */ 58 59 /* 60 * Eventually these should be an enum here, but instead we share a 61 * namespace with other things in idmapd. 62 */ 63 #define _IDMAP_T_OTHER 0 64 #define _IDMAP_T_UNDEF -1 65 #define _IDMAP_T_USER -1004 66 #define _IDMAP_T_GROUP -1005 67 #define _IDMAP_T_DOMAIN -1006 68 #define _IDMAP_T_COMPUTER -1007 69 70 typedef uint32_t rid_t; 71 72 typedef struct idmap_query_state idmap_query_state_t; 73 74 int idmap_add_ds(adutils_ad_t *ad, const char *host, int port); 75 76 77 /* 78 * Batch lookups 79 * 80 * Start a batch, add queries to the batch one by one (the output 81 * pointers should all differ, so that a query's results don't clobber 82 * any other's), end the batch to wait for replies for all outstanding 83 * queries. The output parameters of each query are initialized to NULL 84 * or -1 as appropriate. 85 * 86 * LDAP searches are sent one by one without waiting (i.e., blocking) 87 * for replies. Replies are handled as soon as they are available. 88 * Missing replies are waited for only when idmap_lookup_batch_end() is 89 * called. 90 * 91 * If an add1 function returns != 0 then abort the batch by calling 92 * idmap_lookup_batch_end(), but note that some queries may have been 93 * answered, so check the result code of each query. 94 */ 95 96 /* Start a batch of lookups */ 97 idmap_retcode idmap_lookup_batch_start(adutils_ad_t *ad, int nqueries, 98 idmap_query_state_t **state); 99 100 /* End a batch and release its idmap_query_state_t object */ 101 idmap_retcode idmap_lookup_batch_end(idmap_query_state_t **state); 102 103 /* Abandon a batch and release its idmap_query_state_t object */ 104 void idmap_lookup_release_batch(idmap_query_state_t **state); 105 106 /* 107 * Add a name->SID lookup 108 * 109 * - 'dname' is optional; if NULL or empty string then 'name' has to be 110 * a user/group name qualified wih a domainname (e.g., foo@domain), 111 * else the 'name' must not be qualified and the domainname must be 112 * passed in 'dname'. 113 * 114 * - if 'rid' is NULL then the output SID string will include the last 115 * RID, else it won't and the last RID value will be stored in *rid. 116 * 117 * The caller must free() *sid. 118 */ 119 idmap_retcode idmap_name2sid_batch_add1(idmap_query_state_t *state, 120 const char *name, const char *dname, int eunixtype, 121 char **dn, char **attr, char **value, char **canonname, 122 char **sid, rid_t *rid, int *sid_type, char **unixname, 123 idmap_retcode *rc); 124 /* 125 * Add a SID->name lookup 126 * 127 * - 'rid' is optional; if NULL then 'sid' is expected to have the 128 * user/group RID present, else 'sid' is expected not to have it, and 129 * *rid will be used to qualify the given 'sid' 130 * 131 * - 'dname' is optional; if NULL then the fully qualified user/group 132 * name will be stored in *name, else the domain name will be stored in 133 * *dname and the user/group name will be stored in *name without a 134 * domain qualifier. 135 * 136 * The caller must free() *name and *dname (if present). 137 */ 138 idmap_retcode idmap_sid2name_batch_add1(idmap_query_state_t *state, 139 const char *sid, const rid_t *rid, int eunixtype, 140 char **dn, char **attr, char **value, char **name, 141 char **dname, int *sid_type, char **unixname, 142 idmap_retcode *rc); 143 144 /* 145 * Add a unixname->SID lookup 146 */ 147 idmap_retcode idmap_unixname2sid_batch_add1(idmap_query_state_t *state, 148 const char *unixname, int is_user, int is_wuser, 149 char **dn, char **attr, char **value, char **sid, rid_t *rid, 150 char **name, char **dname, int *sid_type, idmap_retcode *rc); 151 152 /* 153 * Set unixname attribute names for the batch for AD-based name mapping 154 */ 155 void idmap_lookup_batch_set_unixattr(idmap_query_state_t *state, 156 const char *unixuser_attr, const char *unixgroup_attr); 157 158 #ifdef __cplusplus 159 } 160 #endif 161 162 #endif /* _ADUTILS_H */ 163