ldapconnection.cpp 233 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761476247634764476547664767476847694770477147724773477447754776477747784779478047814782478347844785478647874788478947904791479247934794479547964797479847994800480148024803480448054806480748084809481048114812481348144815481648174818481948204821482248234824482548264827482848294830483148324833483448354836483748384839484048414842484348444845484648474848484948504851485248534854485548564857485848594860486148624863486448654866486748684869487048714872487348744875487648774878487948804881488248834884488548864887488848894890489148924893489448954896489748984899490049014902490349044905490649074908490949104911491249134914491549164917491849194920492149224923492449254926492749284929493049314932493349344935493649374938493949404941494249434944494549464947494849494950495149524953495449554956495749584959496049614962496349644965496649674968496949704971497249734974497549764977497849794980498149824983498449854986498749884989499049914992499349944995499649974998499950005001500250035004500550065007500850095010501150125013501450155016501750185019502050215022502350245025502650275028502950305031503250335034503550365037503850395040504150425043504450455046504750485049505050515052505350545055505650575058505950605061506250635064506550665067506850695070507150725073507450755076507750785079508050815082508350845085508650875088508950905091509250935094509550965097509850995100510151025103510451055106510751085109511051115112511351145115511651175118511951205121512251235124512551265127512851295130513151325133513451355136513751385139514051415142514351445145514651475148514951505151515251535154515551565157515851595160516151625163516451655166516751685169517051715172517351745175517651775178517951805181518251835184518551865187518851895190519151925193519451955196519751985199520052015202520352045205520652075208520952105211521252135214521552165217521852195220522152225223522452255226522752285229523052315232523352345235523652375238523952405241524252435244524552465247524852495250525152525253525452555256525752585259526052615262526352645265526652675268526952705271527252735274527552765277527852795280528152825283528452855286528752885289529052915292529352945295529652975298529953005301530253035304530553065307530853095310531153125313531453155316531753185319532053215322532353245325532653275328532953305331533253335334533553365337533853395340534153425343534453455346534753485349535053515352535353545355535653575358535953605361536253635364536553665367536853695370537153725373537453755376537753785379538053815382538353845385538653875388538953905391539253935394539553965397539853995400540154025403540454055406540754085409541054115412541354145415541654175418541954205421542254235424542554265427542854295430543154325433543454355436543754385439544054415442544354445445544654475448544954505451545254535454545554565457545854595460546154625463546454655466546754685469547054715472547354745475547654775478547954805481548254835484548554865487548854895490549154925493549454955496549754985499550055015502550355045505550655075508550955105511551255135514551555165517551855195520552155225523552455255526552755285529553055315532553355345535553655375538553955405541554255435544554555465547554855495550555155525553555455555556555755585559556055615562556355645565556655675568556955705571557255735574557555765577557855795580558155825583558455855586558755885589559055915592559355945595559655975598559956005601560256035604560556065607560856095610561156125613561456155616561756185619562056215622562356245625562656275628562956305631563256335634563556365637563856395640564156425643564456455646564756485649565056515652565356545655565656575658565956605661566256635664566556665667566856695670567156725673567456755676567756785679568056815682568356845685568656875688568956905691569256935694569556965697569856995700570157025703570457055706570757085709571057115712571357145715571657175718571957205721572257235724572557265727572857295730573157325733573457355736573757385739574057415742574357445745574657475748574957505751575257535754575557565757575857595760576157625763576457655766576757685769577057715772577357745775577657775778577957805781578257835784578557865787578857895790579157925793579457955796579757985799580058015802580358045805580658075808580958105811581258135814581558165817581858195820582158225823582458255826582758285829583058315832583358345835583658375838583958405841584258435844584558465847584858495850585158525853585458555856585758585859586058615862586358645865586658675868586958705871587258735874587558765877587858795880588158825883588458855886588758885889589058915892589358945895589658975898589959005901590259035904590559065907590859095910591159125913591459155916591759185919592059215922592359245925592659275928592959305931593259335934593559365937593859395940594159425943594459455946594759485949595059515952595359545955595659575958595959605961596259635964596559665967596859695970597159725973597459755976597759785979598059815982598359845985598659875988598959905991599259935994599559965997599859996000600160026003600460056006600760086009601060116012601360146015601660176018601960206021602260236024602560266027602860296030603160326033603460356036603760386039604060416042604360446045604660476048604960506051605260536054605560566057605860596060606160626063606460656066606760686069607060716072607360746075607660776078607960806081608260836084608560866087608860896090609160926093609460956096609760986099610061016102610361046105610661076108610961106111611261136114611561166117611861196120612161226123612461256126612761286129613061316132613361346135613661376138613961406141614261436144614561466147614861496150615161526153615461556156615761586159616061616162616361646165616661676168616961706171617261736174617561766177617861796180618161826183618461856186618761886189619061916192619361946195619661976198619962006201620262036204620562066207620862096210621162126213621462156216621762186219622062216222622362246225622662276228622962306231623262336234623562366237623862396240624162426243624462456246624762486249625062516252625362546255625662576258625962606261626262636264626562666267626862696270627162726273627462756276627762786279628062816282628362846285628662876288628962906291629262936294629562966297629862996300630163026303630463056306630763086309631063116312631363146315631663176318631963206321632263236324632563266327632863296330633163326333633463356336633763386339634063416342634363446345634663476348634963506351635263536354635563566357635863596360636163626363636463656366636763686369637063716372637363746375637663776378637963806381638263836384638563866387638863896390639163926393639463956396639763986399640064016402640364046405640664076408640964106411641264136414641564166417641864196420642164226423642464256426642764286429643064316432643364346435643664376438643964406441644264436444644564466447644864496450645164526453645464556456645764586459646064616462646364646465646664676468646964706471647264736474647564766477647864796480648164826483
  1. /*##############################################################################
  2. HPCC SYSTEMS software Copyright (C) 2012 HPCC Systems®.
  3. Licensed under the Apache License, Version 2.0 (the "License");
  4. you may not use this file except in compliance with the License.
  5. You may obtain a copy of the License at
  6. http://www.apache.org/licenses/LICENSE-2.0
  7. Unless required by applicable law or agreed to in writing, software
  8. distributed under the License is distributed on an "AS IS" BASIS,
  9. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  10. See the License for the specific language governing permissions and
  11. limitations under the License.
  12. ############################################################################## */
  13. // LDAP prototypes use char* where they should be using const char *, resulting in lots of spurious warnings
  14. #pragma warning( disable : 4786 )
  15. #ifdef __GNUC__
  16. #pragma GCC diagnostic ignored "-Wwrite-strings"
  17. #endif
  18. #include "permissions.ipp"
  19. #include "aci.ipp"
  20. #include "ldapsecurity.ipp"
  21. #include "jsmartsock.hpp"
  22. #include "jrespool.tpp"
  23. #include "mpbase.hpp"
  24. #include "dautils.hpp"
  25. #include "dasds.hpp"
  26. #include <map>
  27. #include <string>
  28. #include <set>
  29. #ifdef _WIN32
  30. #include <lm.h>
  31. #define LdapRename ldap_rename_ext_s
  32. LDAPMessage* (*LdapFirstEntry)(LDAP*, LDAPMessage*) = &ldap_first_entry;
  33. LDAPMessage* (*LdapNextEntry)(LDAP* ld, LDAPMessage* entry) = &ldap_next_entry;
  34. #else
  35. #define LdapRename ldap_rename_s
  36. LDAPMessage* (__stdcall *LdapFirstEntry)(LDAP*, LDAPMessage*) = &ldap_first_message;
  37. LDAPMessage* (__stdcall *LdapNextEntry)(LDAP* ld, LDAPMessage* entry) = &ldap_next_message;
  38. #endif
  39. #define LDAPSEC_MAX_RETRIES 2
  40. #define LDAPSEC_RETRY_WAIT 3
  41. #ifdef _WIN32
  42. #define LDAP_NO_ATTRS "1.1"
  43. #endif
  44. #define PWD_NEVER_EXPIRES (__int64)0x8000000000000000
  45. #define UNK_PERM_VALUE (SecAccessFlags)-2 //used to initialize "default" permission, which we later try to deduce
  46. const char* UserFieldNames[] = { "@id", "@name", "@fullname", "@passwordexpiration", "@employeeid" };
  47. const char* getUserFieldNames(UserField field)
  48. {
  49. if (field < UFterm)
  50. return UserFieldNames[field];
  51. return NULL;
  52. }
  53. const char* GroupFieldNames[] = { "@name", "@groupOwner", "@desc" };
  54. const char* getGroupFieldNames(GroupField field)
  55. {
  56. if (field < GFterm)
  57. return GroupFieldNames[field];
  58. return NULL;
  59. }
  60. const char* ResourceFieldNames[] = { "@name", "@desc" };
  61. const char* getResourceFieldNames(ResourceField field)
  62. {
  63. if (field < RFterm)
  64. return ResourceFieldNames[field];
  65. return NULL;
  66. }
  67. const char* ResourcePermissionFieldNames[] = { "@name", "@type", "@allow", "@deny" };
  68. const char* getResourcePermissionFieldNames(ResourcePermissionField field)
  69. {
  70. if (field < RPFterm)
  71. return ResourcePermissionFieldNames[field];
  72. return NULL;
  73. }
  74. class CSecItemIterator: public CInterfaceOf<ISecItemIterator>
  75. {
  76. IArrayOf<IPropertyTree> attrs;
  77. unsigned index;
  78. public:
  79. CSecItemIterator(IArrayOf<IPropertyTree>& trees)
  80. {
  81. ForEachItemIn(t, trees)
  82. attrs.append(*LINK(&trees.item(t)));
  83. index = 0;
  84. }
  85. virtual ~CSecItemIterator()
  86. {
  87. attrs.kill();
  88. }
  89. bool first()
  90. {
  91. index = 0;
  92. return (attrs.ordinality()!=0);
  93. }
  94. bool next()
  95. {
  96. index++;
  97. return (index<attrs.ordinality());
  98. }
  99. bool isValid()
  100. {
  101. return (index<attrs.ordinality());
  102. }
  103. IPropertyTree & query()
  104. {
  105. return attrs.item(index);
  106. }
  107. };
  108. class CHostManager
  109. {
  110. private:
  111. StringArray m_hostArray;
  112. Mutex m_HMMutex;
  113. unsigned m_curHostIdx;
  114. bool m_populated;
  115. public:
  116. CHostManager()
  117. {
  118. m_populated = false;
  119. m_curHostIdx = 0;
  120. }
  121. void populateHosts(const char* addrlist)
  122. {
  123. if (m_populated)
  124. return;
  125. synchronized block(m_HMMutex);
  126. if (!m_populated)
  127. {
  128. char *copyFullText = strdup(addrlist);
  129. char *saveptr;
  130. char *ip = strtok_r(copyFullText, "|", &saveptr);
  131. while (ip != NULL)
  132. {
  133. if (isdigit(*ip))
  134. {
  135. char *dash = strrchr(ip, '-');
  136. if (dash)
  137. {
  138. *dash = 0;
  139. int last = atoi(dash+1);
  140. char *dot = strrchr(ip, '.');
  141. *dot = 0;
  142. int first = atoi(dot+1);
  143. for (int i = first; i <= last; i++)
  144. {
  145. StringBuffer t;
  146. t.append(ip).append('.').append(i);
  147. m_hostArray.append(t.str());
  148. }
  149. }
  150. else
  151. {
  152. m_hostArray.append(ip);
  153. }
  154. }
  155. else
  156. {
  157. m_hostArray.append(ip);
  158. }
  159. DBGLOG("Added ldap server %s", m_hostArray.item(m_hostArray.ordinality()-1));
  160. ip = strtok_r(NULL, "|", &saveptr);
  161. }
  162. free(copyFullText);
  163. if(m_hostArray.length() == 0)
  164. {
  165. throw MakeStringException(-1, "No valid ldap server address specified");
  166. }
  167. m_curHostIdx = 0;
  168. m_populated = true;
  169. }
  170. }
  171. int queryNumHosts()
  172. {
  173. return m_hostArray.ordinality();
  174. }
  175. const char * queryCurrentHost()
  176. {
  177. synchronized block(m_HMMutex);
  178. return m_hostArray.item(m_curHostIdx);
  179. }
  180. void blacklistHost(const char * blockedHost)
  181. {
  182. if (m_hostArray.ordinality() == 1)
  183. {
  184. DBGLOG("Cannot blacklist the only configured ldap server %s", m_hostArray.item(m_curHostIdx));
  185. return;
  186. }
  187. //If blockedHost is not already blacklisted, do so
  188. synchronized block(m_HMMutex);
  189. if (0 == strcmp(blockedHost, m_hostArray.item(m_curHostIdx)))
  190. {
  191. DBGLOG("Blacklisting ldap server %s", m_hostArray.item(m_curHostIdx));
  192. if (++m_curHostIdx == m_hostArray.ordinality())
  193. m_curHostIdx = 0;//start over at begin of host array
  194. }
  195. }
  196. } s_hostManager;
  197. inline bool LdapServerDown(int rc)
  198. {
  199. return rc==LDAP_SERVER_DOWN||rc==LDAP_UNAVAILABLE||rc==LDAP_TIMEOUT;
  200. }
  201. class CLdapConfig : implements ILdapConfig, public CInterface
  202. {
  203. private:
  204. LdapServerType m_serverType;
  205. StringAttr m_cfgServerType;//LDAP Server type name (ActiveDirectory, Fedora389, etc)
  206. Owned<IPropertyTree> m_cfg;
  207. int m_ldapport;
  208. int m_ldap_secure_port;
  209. StringBuffer m_protocol;
  210. StringBuffer m_basedn;
  211. StringBuffer m_domain;
  212. StringBuffer m_authmethod;
  213. StringBuffer m_user_basedn;
  214. StringBuffer m_group_basedn;
  215. StringBuffer m_resource_basedn;
  216. StringBuffer m_filescope_basedn;
  217. StringBuffer m_view_basedn;
  218. StringBuffer m_workunitscope_basedn;
  219. StringBuffer m_sudoers_basedn;
  220. StringBuffer m_template_name;
  221. StringBuffer m_sysuser;
  222. StringBuffer m_sysuser_commonname;
  223. StringBuffer m_sysuser_password;
  224. StringBuffer m_sysuser_basedn;
  225. bool m_sysuser_specified;
  226. StringBuffer m_sysuser_dn;
  227. int m_maxConnections;
  228. StringBuffer m_sdfieldname;
  229. int m_timeout;
  230. public:
  231. IMPLEMENT_IINTERFACE
  232. CLdapConfig(IPropertyTree* cfg)
  233. {
  234. int version = LDAP_VERSION3;
  235. ldap_set_option( NULL, LDAP_OPT_PROTOCOL_VERSION, &version);
  236. m_cfg.set(cfg);
  237. //Check for LDAP Server type in config
  238. m_serverType = LDAPSERVER_UNKNOWN;
  239. m_cfgServerType.set(cfg->queryProp(".//@serverType"));
  240. if (m_cfgServerType.length())
  241. {
  242. if (0 == stricmp(m_cfgServerType, "ActiveDirectory"))
  243. m_serverType = ACTIVE_DIRECTORY;
  244. else if (0 == stricmp(m_cfgServerType, "389DirectoryServer"))//uses iPlanet style ACI
  245. m_serverType = OPEN_LDAP;
  246. else if (0 == stricmp(m_cfgServerType, "OpenLDAP"))
  247. m_serverType = OPEN_LDAP;
  248. else if (0 == stricmp(m_cfgServerType, "Fedora389"))
  249. m_serverType = OPEN_LDAP;
  250. else if (0 == stricmp(m_cfgServerType, "iPlanet"))
  251. m_serverType = IPLANET;
  252. else
  253. throw MakeStringException(-1, "Unknown LDAP serverType '%s' specified",m_cfgServerType.get());
  254. }
  255. else
  256. {
  257. DBGLOG("LDAP serverType not specified, will try to deduce");
  258. }
  259. StringBuffer hostsbuf;
  260. cfg->getProp(".//@ldapAddress", hostsbuf);
  261. if(hostsbuf.length() == 0)
  262. {
  263. throw MakeStringException(-1, "ldapAddress not found in config");
  264. }
  265. s_hostManager.populateHosts(hostsbuf.str());
  266. cfg->getProp(".//@ldapProtocol", m_protocol);
  267. if(m_protocol.length() == 0)
  268. {
  269. m_protocol.append("ldap");
  270. }
  271. StringBuffer portbuf;
  272. cfg->getProp(".//@ldapPort", portbuf);
  273. if(portbuf.length() == 0)
  274. m_ldapport = 389;
  275. else
  276. m_ldapport = atoi(portbuf.str());
  277. portbuf.clear();
  278. cfg->getProp(".//@ldapSecurePort", portbuf);
  279. if(portbuf.length() == 0)
  280. m_ldap_secure_port = 636;
  281. else
  282. m_ldap_secure_port = atoi(portbuf.str());
  283. m_timeout = cfg->getPropInt(".//@ldapTimeoutSecs", LDAPTIMEOUT);
  284. int rc = LDAP_OTHER;
  285. StringBuffer hostbuf, dcbuf;
  286. const char * ldapDomain = cfg->queryProp(".//@ldapDomain");
  287. for (int numHosts=0; numHosts < getHostCount(); numHosts++)
  288. {
  289. getLdapHost(hostbuf);
  290. unsigned port = strieq("ldaps",m_protocol) ? m_ldap_secure_port : m_ldapport;
  291. StringBuffer sysUserDN, decPwd;
  292. {
  293. StringBuffer pwd;
  294. cfg->getProp(".//@systemPassword", pwd);
  295. if (pwd.isEmpty())
  296. throw MakeStringException(-1, "systemPassword is empty");
  297. decrypt(decPwd, pwd.str());
  298. StringBuffer sysUserCN;
  299. cfg->getProp(".//@systemCommonName", sysUserCN);
  300. if (sysUserCN.isEmpty())
  301. throw MakeStringException(-1, "systemCommonName is empty");
  302. StringBuffer sysBasedn;
  303. cfg->getProp(".//@systemBasedn", sysBasedn);
  304. if (sysBasedn.isEmpty())
  305. throw MakeStringException(-1, "systemBasedn is empty");
  306. //Guesstimate system user baseDN based on config settings. It will be used if anonymous bind fails
  307. sysUserDN.append("cn=").append(sysUserCN.str()).append(",").append(sysBasedn.str());
  308. }
  309. for(int retries = 0; retries <= LDAPSEC_MAX_RETRIES; retries++)
  310. {
  311. rc = LdapUtils::getServerInfo(hostbuf.str(), sysUserDN.str(), decPwd.str(), m_protocol, port, dcbuf, m_serverType, ldapDomain, m_timeout);
  312. if(!LdapServerDown(rc) || retries >= LDAPSEC_MAX_RETRIES)
  313. break;
  314. sleep(LDAPSEC_RETRY_WAIT);
  315. if(retries < LDAPSEC_MAX_RETRIES)
  316. {
  317. DBGLOG("Server %s temporarily unreachable, retrying...", hostbuf.str());
  318. }
  319. }
  320. if (rc != LDAP_SUCCESS)
  321. {
  322. blacklistHost(hostbuf);
  323. }
  324. else
  325. break;
  326. }
  327. if(rc != LDAP_SUCCESS)
  328. {
  329. throw MakeStringException(-1, "getServerInfo error - %s", ldap_err2string(rc));
  330. }
  331. const char* basedn = cfg->queryProp(".//@commonBasedn");
  332. if(basedn == NULL || *basedn == '\0')
  333. {
  334. basedn = dcbuf.str();
  335. }
  336. LdapUtils::cleanupDn(basedn, m_basedn);
  337. StringBuffer user_basedn;
  338. cfg->getProp(".//@usersBasedn", user_basedn);
  339. if(user_basedn.length() == 0)
  340. {
  341. throw MakeStringException(-1, "users basedn not found in config");
  342. }
  343. LdapUtils::normalizeDn(user_basedn.str(), m_basedn.str(), m_user_basedn);
  344. StringBuffer group_basedn;
  345. cfg->getProp(".//@groupsBasedn", group_basedn);
  346. if(group_basedn.length() == 0)
  347. {
  348. throw MakeStringException(-1, "groups basedn not found in config");
  349. }
  350. LdapUtils::normalizeDn(group_basedn.str(), m_basedn.str(), m_group_basedn);
  351. StringBuffer dnbuf;
  352. cfg->getProp(".//@modulesBasedn", dnbuf);
  353. if(dnbuf.length() == 0)
  354. cfg->getProp(".//@resourcesBasedn", dnbuf);
  355. if(dnbuf.length() > 0)
  356. LdapUtils::normalizeDn(dnbuf.str(), m_basedn.str(), m_resource_basedn);
  357. dnbuf.clear();
  358. cfg->getProp(".//@filesBasedn", dnbuf);
  359. if(dnbuf.length() > 0)
  360. LdapUtils::normalizeDn(dnbuf.str(), m_basedn.str(), m_filescope_basedn);
  361. dnbuf.clear();
  362. cfg->getProp(".//@viewsBasedn", dnbuf);
  363. if(dnbuf.length() == 0)
  364. dnbuf.append("ou=views,ou=ecl");//viewsBasedn will not exist in legacy environment files
  365. LdapUtils::normalizeDn(dnbuf.str(), m_basedn.str(), m_view_basedn);
  366. dnbuf.clear();
  367. cfg->getProp(".//@workunitsBasedn", dnbuf);
  368. if(dnbuf.length() > 0)
  369. LdapUtils::normalizeDn(dnbuf.str(), m_basedn.str(), m_workunitscope_basedn);
  370. if(m_resource_basedn.length() + m_filescope_basedn.length() + m_workunitscope_basedn.length() == 0)
  371. {
  372. throw MakeStringException(-1, "One of the following basedns need to be defined: modulesBasedn, resourcesBasedn, filesBasedn or workunitScopesBasedn.");
  373. }
  374. dnbuf.clear();
  375. cfg->getProp(".//@sudoersBasedn", dnbuf);
  376. if(dnbuf.length() == 0)
  377. dnbuf.append("ou=SUDOers");
  378. LdapUtils::normalizeDn(dnbuf.str(), m_basedn.str(), m_sudoers_basedn);
  379. cfg->getProp(".//@templateName", m_template_name);
  380. cfg->getProp(".//@authMethod", m_authmethod);
  381. cfg->getProp(".//@ldapDomain", m_domain);
  382. if(m_domain.length() == 0)
  383. {
  384. const char* dptr = strchr(m_basedn.str(), '=');
  385. if(dptr != NULL)
  386. {
  387. dptr++;
  388. while(*dptr != 0 && *dptr != ',')
  389. {
  390. char c = *dptr++;
  391. m_domain.append(c);
  392. }
  393. }
  394. }
  395. m_sysuser_specified = true;
  396. cfg->getProp(".//@systemUser", m_sysuser);
  397. if(m_sysuser.length() == 0)
  398. {
  399. m_sysuser_specified = false;
  400. }
  401. cfg->getProp(".//@systemCommonName", m_sysuser_commonname);
  402. if(m_sysuser_specified && (m_sysuser_commonname.length() == 0))
  403. {
  404. throw MakeStringException(-1, "SystemUser commonname is empty");
  405. }
  406. StringBuffer passbuf;
  407. cfg->getProp(".//@systemPassword", passbuf);
  408. decrypt(m_sysuser_password, passbuf.str());
  409. StringBuffer sysuser_basedn;
  410. cfg->getProp(".//@systemBasedn", sysuser_basedn);
  411. if(sysuser_basedn.length() == 0)
  412. {
  413. if(m_serverType == ACTIVE_DIRECTORY)
  414. LdapUtils::normalizeDn( "cn=Users", m_basedn.str(), m_sysuser_basedn);
  415. else if(m_serverType == IPLANET)
  416. m_sysuser_basedn.append("ou=administrators,ou=topologymanagement,o=netscaperoot");
  417. else if(m_serverType == OPEN_LDAP)
  418. m_sysuser_basedn.append(m_basedn.str());
  419. }
  420. else
  421. {
  422. if(m_serverType == ACTIVE_DIRECTORY)
  423. LdapUtils::normalizeDn(sysuser_basedn.str(), m_basedn.str(), m_sysuser_basedn);
  424. else
  425. m_sysuser_basedn.append(sysuser_basedn.str());
  426. }
  427. if(m_sysuser_specified)
  428. {
  429. if(m_serverType == IPLANET)
  430. m_sysuser_dn.append("uid=").append(m_sysuser.str()).append(",").append(m_sysuser_basedn.str());
  431. else if(m_serverType == ACTIVE_DIRECTORY)
  432. m_sysuser_dn.append("cn=").append(m_sysuser_commonname.str()).append(",").append(m_sysuser_basedn.str());
  433. else if(m_serverType == OPEN_LDAP)
  434. {
  435. if (0==strcmp("Directory Manager",m_sysuser_commonname.str()))
  436. m_sysuser_dn.append("cn=").append(m_sysuser_commonname.str()).append(",").append(m_sysuser_basedn.str());
  437. else
  438. m_sysuser_dn.append("uid=").append(m_sysuser_commonname.str()).append(",").append(m_sysuser_basedn.str()).append(",").append(m_basedn.str());
  439. }
  440. }
  441. m_maxConnections = cfg->getPropInt(".//@maxConnections", DEFAULT_LDAP_POOL_SIZE);
  442. if(m_maxConnections <= 0)
  443. m_maxConnections = DEFAULT_LDAP_POOL_SIZE;
  444. if(m_serverType == ACTIVE_DIRECTORY)
  445. m_sdfieldname.append("ntSecurityDescriptor");
  446. else if(m_serverType == IPLANET)
  447. m_sdfieldname.append("aci");
  448. else if(m_serverType == OPEN_LDAP)
  449. m_sdfieldname.append("aci");
  450. }
  451. virtual LdapServerType getServerType()
  452. {
  453. return m_serverType;
  454. }
  455. virtual const char * getCfgServerType() const
  456. {
  457. return m_cfgServerType.get();
  458. }
  459. virtual const char* getSdFieldName()
  460. {
  461. return m_sdfieldname.str();
  462. }
  463. virtual int getHostCount()
  464. {
  465. return s_hostManager.queryNumHosts();
  466. }
  467. virtual StringBuffer& getLdapHost(StringBuffer& hostbuf)
  468. {
  469. hostbuf.set(s_hostManager.queryCurrentHost());
  470. return hostbuf;
  471. }
  472. virtual void blacklistHost(const char * host)
  473. {
  474. s_hostManager.blacklistHost(host);
  475. }
  476. virtual void markDown(const char* ldaphost)
  477. {
  478. //SocketEndpoint ep(ldaphost, 0);
  479. //m_ldaphosts->setStatus(ep, false);
  480. }
  481. virtual int getLdapPort()
  482. {
  483. return m_ldapport;
  484. }
  485. virtual int getLdapSecurePort()
  486. {
  487. return m_ldap_secure_port;
  488. }
  489. virtual const char* getProtocol()
  490. {
  491. return m_protocol.str();
  492. }
  493. virtual const char* getBasedn()
  494. {
  495. return m_basedn.str();
  496. }
  497. virtual const char* getDomain()
  498. {
  499. return m_domain.str();
  500. }
  501. virtual const char* getAuthMethod()
  502. {
  503. return m_authmethod.str();
  504. }
  505. virtual const char* getUserBasedn()
  506. {
  507. return m_user_basedn.str();
  508. }
  509. virtual const char* getGroupBasedn()
  510. {
  511. return m_group_basedn.str();
  512. }
  513. virtual const char* getViewBasedn()
  514. {
  515. return m_view_basedn.str();
  516. }
  517. virtual const char* getResourceBasedn(SecResourceType rtype)
  518. {
  519. if(rtype == RT_DEFAULT || rtype == RT_MODULE || rtype == RT_SERVICE)
  520. return m_resource_basedn.str();
  521. else if(rtype == RT_FILE_SCOPE)
  522. return m_filescope_basedn.str();
  523. else if(rtype == RT_VIEW_SCOPE)
  524. return m_view_basedn.str();
  525. else if(rtype == RT_WORKUNIT_SCOPE)
  526. return m_workunitscope_basedn.str();
  527. else if(rtype == RT_SUDOERS)
  528. return m_sudoers_basedn.str();
  529. else
  530. return m_resource_basedn.str();
  531. }
  532. virtual const char* getTemplateName()
  533. {
  534. return m_template_name.str();
  535. }
  536. virtual const char* getSysUser()
  537. {
  538. return m_sysuser.str();
  539. }
  540. virtual const char* getSysUserDn()
  541. {
  542. return m_sysuser_dn.str();
  543. }
  544. virtual const char* getSysUserCommonName()
  545. {
  546. return m_sysuser_commonname.str();
  547. }
  548. virtual const char* getSysUserPassword()
  549. {
  550. return m_sysuser_password.str();
  551. }
  552. virtual const char* getSysUserBasedn()
  553. {
  554. return m_sysuser_basedn.str();
  555. }
  556. virtual bool sysuserSpecified()
  557. {
  558. return m_sysuser_specified;
  559. }
  560. virtual int getMaxConnections()
  561. {
  562. return m_maxConnections;
  563. }
  564. // For now, only sets default resourcebasedn, since it's only used by ESP services
  565. virtual void setResourceBasedn(const char* rbasedn, SecResourceType rtype)
  566. {
  567. if(rbasedn == NULL || rbasedn[0] == '\0')
  568. return;
  569. if(rtype == RT_DEFAULT || rtype == RT_MODULE || rtype == RT_SERVICE)
  570. {
  571. LdapUtils::normalizeDn(rbasedn, m_basedn.str(), m_resource_basedn);
  572. }
  573. else if(rtype == RT_FILE_SCOPE)
  574. {
  575. LdapUtils::normalizeDn(rbasedn, m_basedn.str(), m_filescope_basedn);
  576. }
  577. else if(rtype == RT_VIEW_SCOPE)
  578. {
  579. LdapUtils::normalizeDn(rbasedn, m_basedn.str(), m_view_basedn);
  580. }
  581. else if(rtype == RT_WORKUNIT_SCOPE)
  582. {
  583. LdapUtils::normalizeDn(rbasedn, m_basedn.str(), m_workunitscope_basedn);
  584. }
  585. else
  586. {
  587. LdapUtils::normalizeDn(rbasedn, m_basedn.str(), m_resource_basedn);
  588. }
  589. }
  590. virtual void getDefaultSysUserBasedn(StringBuffer& sysuser_basedn)
  591. {
  592. if(m_serverType == ACTIVE_DIRECTORY)
  593. LdapUtils::normalizeDn( "cn=Users", m_basedn.str(), sysuser_basedn);
  594. else if(m_serverType == IPLANET)
  595. sysuser_basedn.append("ou=administrators,ou=topologymanagement,o=netscaperoot");
  596. }
  597. virtual int getLdapTimeout()
  598. {
  599. return m_timeout;
  600. }
  601. };
  602. class CLdapConnection : implements ILdapConnection, public CInterface
  603. {
  604. private:
  605. LDAP *m_ld;
  606. Owned<CLdapConfig> m_ldapconfig;
  607. time_t m_lastaccesstime;
  608. bool m_connected;
  609. bool m_useSSL;
  610. public:
  611. IMPLEMENT_IINTERFACE
  612. CLdapConnection(CLdapConfig* ldapconfig)
  613. {
  614. m_ldapconfig.setown(LINK(ldapconfig));
  615. m_ld = NULL;
  616. m_connected = false;
  617. m_lastaccesstime = 0;
  618. m_useSSL = false;
  619. }
  620. ~CLdapConnection()
  621. {
  622. if(m_ld != NULL)
  623. {
  624. LDAP_UNBIND(m_ld);
  625. }
  626. }
  627. private:
  628. virtual int connect(const char* ldapserver, const char* protocol)
  629. {
  630. if(!ldapserver || *ldapserver == '\0')
  631. return -1;
  632. m_ld = LdapUtils::LdapInit(protocol, ldapserver, m_ldapconfig->getLdapPort(), m_ldapconfig->getLdapSecurePort());
  633. int rc = LDAP_SUCCESS;
  634. if(m_ldapconfig->sysuserSpecified())
  635. rc = LdapUtils::LdapBind(m_ld, m_ldapconfig->getLdapTimeout(), m_ldapconfig->getDomain(), m_ldapconfig->getSysUser(), m_ldapconfig->getSysUserPassword(), m_ldapconfig->getSysUserDn(), m_ldapconfig->getServerType(), m_ldapconfig->getAuthMethod());
  636. else
  637. rc = LdapUtils::LdapBind(m_ld, m_ldapconfig->getLdapTimeout(), m_ldapconfig->getDomain(), NULL, NULL, NULL, m_ldapconfig->getServerType(), m_ldapconfig->getAuthMethod());
  638. if(rc == LDAP_SUCCESS)
  639. {
  640. time(&m_lastaccesstime);
  641. m_connected = true;
  642. const char * ldap = NULL;
  643. switch (m_ldapconfig->getServerType())
  644. {
  645. case ACTIVE_DIRECTORY:
  646. ldap = "Active Directory";
  647. break;
  648. case OPEN_LDAP:
  649. ldap = "OpenLDAP";
  650. break;
  651. case IPLANET:
  652. ldap = "iplanet";
  653. break;
  654. default:
  655. ldap = "unknown";
  656. break;
  657. }
  658. DBGLOG("Connected to '%s' LdapServer %s using protocol %s", ldap, ldapserver, protocol);
  659. }
  660. else
  661. {
  662. DBGLOG("LDAP: sysuser bind failed - %s", ldap_err2string(rc));
  663. LDAP_UNBIND(m_ld);
  664. m_ld = NULL;
  665. }
  666. return rc;
  667. }
  668. public:
  669. virtual bool connect(bool force_ssl = false)
  670. {
  671. const char* proto;
  672. if(force_ssl)
  673. {
  674. proto = "ldaps";
  675. m_useSSL = true;
  676. }
  677. else
  678. {
  679. proto = m_ldapconfig->getProtocol();//get configured protocol, LDAP or LDAPS
  680. m_useSSL = (0 == stricmp(proto, "ldaps") ? true : false);
  681. }
  682. int rc = LDAP_SERVER_DOWN;//assume bad things
  683. StringBuffer hostbuf;
  684. for (int numHosts=0; numHosts < m_ldapconfig->getHostCount(); numHosts++)
  685. {
  686. m_ldapconfig->getLdapHost(hostbuf);
  687. for(int retries = 0; retries <= LDAPSEC_MAX_RETRIES; retries++)
  688. {
  689. rc = connect(hostbuf.str(), proto);
  690. if(!LdapServerDown(rc) || retries > LDAPSEC_MAX_RETRIES)
  691. break;
  692. sleep(LDAPSEC_RETRY_WAIT);
  693. if(retries < LDAPSEC_MAX_RETRIES)
  694. DBGLOG("Server temporarily unreachable, retrying ...");
  695. }
  696. if(rc == LDAP_SERVER_DOWN)
  697. {
  698. StringBuffer dc;
  699. LdapUtils::getDcName(m_ldapconfig->getDomain(), dc);
  700. if(dc.length() > 0)
  701. {
  702. WARNLOG("Using automatically obtained LDAP Server %s", dc.str());
  703. rc = connect(dc.str(), proto);
  704. }
  705. }
  706. if (rc != LDAP_SUCCESS)
  707. {
  708. m_ldapconfig->blacklistHost(hostbuf);
  709. }
  710. else
  711. break;
  712. }
  713. if(rc == LDAP_SUCCESS)
  714. return true;
  715. else
  716. return false;
  717. }
  718. virtual LDAP* getLd()
  719. {
  720. return m_ld;
  721. }
  722. virtual bool validate()
  723. {
  724. time_t now;
  725. time(&now);
  726. if(!m_connected)
  727. return connect();
  728. else if(now - m_lastaccesstime <= 300)
  729. return true;
  730. else
  731. {
  732. LDAPMessage* msg = NULL;
  733. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  734. int err = ldap_search_ext_s(m_ld, NULL, LDAP_SCOPE_BASE, "objectClass=*", NULL, 0, NULL, NULL, &timeOut, 1, &msg);
  735. if(msg != NULL)
  736. ldap_msgfree(msg);
  737. if(err != LDAP_SUCCESS)
  738. {
  739. if(m_ld != NULL)
  740. {
  741. LDAP_UNBIND(m_ld);
  742. m_ld = NULL;
  743. m_connected = false;
  744. }
  745. DBGLOG("cached connection invalid (%s), creating a new connection", ldap_err2string(err));
  746. return connect(m_useSSL);//reconnect stale connection, using original protocol
  747. }
  748. else
  749. {
  750. time(&m_lastaccesstime);
  751. }
  752. }
  753. return true;
  754. }
  755. };
  756. class CLdapConnectionPool : implements ILdapConnectionPool, public CInterface
  757. {
  758. private:
  759. int m_maxsize;
  760. int m_currentsize;
  761. IArrayOf<ILdapConnection> m_connections;
  762. Monitor m_monitor;
  763. Owned<CLdapConfig> m_ldapconfig;
  764. public:
  765. IMPLEMENT_IINTERFACE
  766. CLdapConnectionPool(CLdapConfig* ldapconfig)
  767. {
  768. m_ldapconfig.setown(LINK(ldapconfig));
  769. m_maxsize = m_ldapconfig->getMaxConnections();
  770. m_currentsize = 0;
  771. // Set LDAP version to 3
  772. int version = LDAP_VERSION3;
  773. ldap_set_option( NULL, LDAP_OPT_PROTOCOL_VERSION, &version);
  774. }
  775. virtual ILdapConnection* getConnection()
  776. {
  777. synchronized block(m_monitor);
  778. ForEachItemIn(x, m_connections)
  779. {
  780. CLdapConnection* curcon = (CLdapConnection*)&(m_connections.item(x));
  781. if(curcon != NULL && !curcon->IsShared())
  782. {
  783. //PrintLog("Reusing an LDAP connection");
  784. if(curcon->validate())
  785. return LINK(curcon);
  786. else
  787. throw MakeStringException(-1, "Connecting/authenticating to ldap server in re-validation failed");
  788. }
  789. }
  790. //PrintLog("Creating new connection");
  791. CLdapConnection* newcon = new CLdapConnection(m_ldapconfig.get());
  792. if(newcon != NULL)
  793. {
  794. if(!newcon->connect())
  795. {
  796. throw MakeStringException(-1, "Connecting/authenticating to ldap server failed");
  797. }
  798. if(m_currentsize <= m_maxsize)
  799. {
  800. m_connections.append(*newcon);
  801. m_currentsize++;
  802. return LINK(newcon);
  803. }
  804. else
  805. {
  806. return newcon;
  807. }
  808. }
  809. else
  810. {
  811. throw MakeStringException(-1, "Failed to create new ldap connection");
  812. }
  813. }
  814. virtual ILdapConnection* getSSLConnection()
  815. {
  816. CLdapConnection* newcon = new CLdapConnection(m_ldapconfig.get());
  817. if(newcon != NULL)
  818. {
  819. if(!newcon->connect(true))
  820. {
  821. throw MakeStringException(-1, "Connecting/authenticating to ldap server via ldaps failed");
  822. }
  823. return newcon;
  824. }
  825. else
  826. {
  827. throw MakeStringException(-1, "Failed to create new ldap connection");
  828. }
  829. }
  830. };
  831. #define LDAP_CONNECTION_TIMEOUT INFINITE
  832. //------------ New Connection Pool Implementation ------------//
  833. class CLdapConnectionManager : implements IResourceFactory<CLdapConnection>, public CInterface
  834. {
  835. Owned<CLdapConfig> m_ldapconfig;
  836. public:
  837. IMPLEMENT_IINTERFACE;
  838. CLdapConnectionManager(CLdapConfig* ldapconfig)
  839. {
  840. m_ldapconfig.setown(LINK(ldapconfig));
  841. }
  842. CLdapConnection* createResource()
  843. {
  844. CLdapConnection* newcon = new CLdapConnection(m_ldapconfig.get());
  845. if(newcon != NULL)
  846. {
  847. if(!newcon->connect())
  848. {
  849. throw MakeStringException(-1, "Connecting/authenticating to ldap server failed");
  850. }
  851. return newcon;
  852. }
  853. else
  854. {
  855. throw MakeStringException(-1, "Failed to create new ldap connection");
  856. }
  857. }
  858. };
  859. class CLdapConnectionPool2 : implements ILdapConnectionPool, public CInterface
  860. {
  861. private:
  862. int m_maxsize;
  863. Owned<CLdapConfig> m_ldapconfig;
  864. Owned<CResourcePool<CLdapConnection> > m_connections;
  865. public:
  866. IMPLEMENT_IINTERFACE
  867. CLdapConnectionPool2(CLdapConfig* ldapconfig)
  868. {
  869. m_ldapconfig.setown(LINK(ldapconfig));
  870. m_maxsize = m_ldapconfig->getMaxConnections();
  871. // Set LDAP version to 3
  872. int version = LDAP_VERSION3;
  873. ldap_set_option( NULL, LDAP_OPT_PROTOCOL_VERSION, &version);
  874. m_connections.setown(new CResourcePool<CLdapConnection>);
  875. Owned<CLdapConnectionManager> poolMgr = new CLdapConnectionManager(ldapconfig);
  876. m_connections->init(m_maxsize, poolMgr.get());
  877. }
  878. virtual ILdapConnection* getConnection()
  879. {
  880. Owned<CLdapConnection> con;
  881. try
  882. {
  883. con.setown(m_connections->get(LDAP_CONNECTION_TIMEOUT));
  884. }
  885. catch(IException* e)
  886. {
  887. StringBuffer emsg;
  888. e->errorMessage(emsg);
  889. DBGLOG("getConnection exception - %s", emsg.str());
  890. e->Release();
  891. }
  892. catch(...)
  893. {
  894. DBGLOG("getConnection unknown exception");
  895. }
  896. if(con.get())
  897. {
  898. if(con->validate())
  899. return con.getLink();
  900. else
  901. throw MakeStringException(-1, "Connecting/authenticating to ldap server in re-validation failed");
  902. }
  903. else
  904. throw MakeStringException(-1, "Failed to get an LDAP Connection.");
  905. }
  906. virtual ILdapConnection* getSSLConnection()
  907. {
  908. CLdapConnection* newcon = new CLdapConnection(m_ldapconfig.get());
  909. if(newcon != NULL)
  910. {
  911. if(!newcon->connect(true))
  912. {
  913. throw MakeStringException(-1, "Connecting/authenticating to ldap server via ldaps failed");
  914. }
  915. return newcon;
  916. }
  917. else
  918. {
  919. throw MakeStringException(-1, "Failed to create new ldap connection");
  920. }
  921. }
  922. };
  923. struct ltstr
  924. {
  925. bool operator()(const char* s1, const char* s2) const { return strcmp(s1, s2) < 0; }
  926. };
  927. //--------------------------------------------
  928. // This helper class ensures memory allocate by calls
  929. // to ldap_first_attribute/ldap_next_attribute gets freed
  930. //--------------------------------------------
  931. class CLDAPGetAttributesWrapper
  932. {
  933. private:
  934. LDAP * ld;
  935. LDAPMessage * entry;
  936. BerElement * elem;
  937. char * attribute;
  938. public:
  939. CLDAPGetAttributesWrapper(LDAP * _ld, LDAPMessage * _entry)
  940. : ld(_ld), entry(_entry)
  941. {
  942. elem = NULL;
  943. attribute = NULL;
  944. }
  945. ~CLDAPGetAttributesWrapper()
  946. {
  947. if (attribute)
  948. ldap_memfree(attribute);
  949. if (elem)
  950. ber_free(elem, 0);
  951. }
  952. inline char * getFirst()
  953. {
  954. return attribute = ldap_first_attribute(ld, entry, &elem);
  955. }
  956. inline char * getNext()
  957. {
  958. if (attribute)
  959. ldap_memfree(attribute);
  960. return attribute = ldap_next_attribute(ld, entry, elem);
  961. }
  962. };
  963. class CLDAPMessage
  964. {
  965. public:
  966. LDAPMessage *msg;
  967. CLDAPMessage() { msg = NULL; }
  968. ~CLDAPMessage() { ldapMsgFree(); }
  969. inline void ldapMsgFree() { if (msg) { ldap_msgfree(msg); msg = NULL;} }
  970. inline operator LDAPMessage *() const { return msg; }
  971. };
  972. //------------------------------------------------------
  973. // class CPagedLDAPSearch
  974. //
  975. // Performs a "paged" LDAP search, which allows for
  976. // searching when there are over 1000 matching entries. Also
  977. // works when there are less than 1000, but not as efficient as
  978. // simply calling ldap_search_ext_s()
  979. //------------------------------------------------------
  980. #define MAX_ENTRIES 1000
  981. class CPagedLDAPSearch
  982. {
  983. private:
  984. LDAP * m_pLdapConn;
  985. char * m_pszDN;
  986. unsigned long m_scope;
  987. char * m_pszFilter;
  988. char * * m_pszAttrs;
  989. bool m_morePages;
  990. struct berval * m_pCookie;
  991. LDAPMessage * m_pPageEntry;
  992. LDAPMessage * m_pPageBlock;
  993. int m_timeout;
  994. //local helper class, ensures ldap Page Control memory freed
  995. class CPageControlMemWrapper
  996. {
  997. LDAPControl * m_pageControl;
  998. LDAPControl ** m_returnedCtrls;
  999. public:
  1000. CPageControlMemWrapper() { m_pageControl = NULL; m_returnedCtrls = NULL; }
  1001. void setPageControl(LDAPControl * _pageCtrl) { m_pageControl = _pageCtrl; }
  1002. void setRetControls(LDAPControl ** _retCtrls) { m_returnedCtrls = _retCtrls; }
  1003. virtual ~CPageControlMemWrapper()
  1004. {
  1005. if (m_pageControl)
  1006. ldap_control_free(m_pageControl);
  1007. if (m_returnedCtrls)
  1008. ldap_controls_free(m_returnedCtrls);
  1009. }
  1010. };
  1011. //---------------------------------------------------
  1012. // Request next page of search results
  1013. //---------------------------------------------------
  1014. bool requestNextPage()
  1015. {
  1016. if (!m_morePages)
  1017. return false;
  1018. CPageControlMemWrapper pageCtrlMem;
  1019. TIMEVAL timeOut = {m_timeout,0};
  1020. try
  1021. {
  1022. #ifdef LDAP_API_FEATURE_PAGED_RESULTS
  1023. LDAPControl * pageControl = NULL;
  1024. int rc = ldap_create_page_control(m_pLdapConn, MAX_ENTRIES, m_pCookie, false, &pageControl);//cookie gets set on first call to ldap_parse_page_control()
  1025. if (rc != LDAP_SUCCESS)
  1026. {
  1027. int err = GetLastError();
  1028. throw MakeStringException(-1, "ldap_create_page_control failed with 0x%x (%s)",err, ldap_err2string( err ));
  1029. }
  1030. pageCtrlMem.setPageControl(pageControl);
  1031. LDAPControl * svrCtrls[] = { pageControl, NULL };
  1032. if (m_pPageBlock)
  1033. ldap_msgfree(m_pPageBlock);
  1034. rc = ldap_search_ext_s(m_pLdapConn, m_pszDN, m_scope, m_pszFilter, m_pszAttrs, 0, svrCtrls, NULL, &timeOut, 0, &m_pPageBlock);
  1035. if (rc != LDAP_SUCCESS)
  1036. {
  1037. int err = GetLastError();
  1038. if (err && rc != LDAP_PARTIAL_RESULTS)//389DirectoryServer sometimes returns rc, but GetLastError returns 0. In this scenario continuing the query succeeds
  1039. {
  1040. if (m_pCookie)
  1041. {
  1042. ber_bvfree(m_pCookie);
  1043. m_pCookie = NULL;
  1044. }
  1045. throw MakeStringException(-1, "ldap_search_ext_s failed with 0x%x (%s)",err, ldap_err2string( err ));
  1046. }
  1047. }
  1048. unsigned long l_errcode;
  1049. LDAPControl ** returnedCtrls = NULL;
  1050. #ifdef _WIN32
  1051. rc = ldap_parse_result(m_pLdapConn, m_pPageBlock, &l_errcode, NULL, NULL, NULL, &returnedCtrls, false);
  1052. #else
  1053. rc = ldap_parse_result(m_pLdapConn, m_pPageBlock, (int*)&l_errcode, NULL, NULL, NULL, &returnedCtrls, false);
  1054. #endif
  1055. if (m_pCookie)
  1056. {
  1057. ber_bvfree(m_pCookie);
  1058. m_pCookie = NULL;
  1059. }
  1060. if (rc != LDAP_SUCCESS)
  1061. {
  1062. int err = GetLastError();
  1063. if (err)
  1064. {
  1065. throw MakeStringException(-1, "ldap_parse_result failed with 0x%x (%s)",err, ldap_err2string( err ));
  1066. }
  1067. else
  1068. {
  1069. DBGLOG("ldap_parse_result returned unexpected rc=%x, err=%x, ignoring",rc,err);
  1070. }
  1071. }
  1072. pageCtrlMem.setRetControls(returnedCtrls);
  1073. unsigned long totCount;
  1074. #ifdef _WIN32
  1075. rc = ldap_parse_page_control(m_pLdapConn, returnedCtrls, &totCount, &m_pCookie);//sets cookie for next call to ldap_create_page_control()
  1076. #else
  1077. rc = ldap_parse_page_control(m_pLdapConn, returnedCtrls, (int*)&totCount, &m_pCookie);//sets cookie for next call to ldap_create_page_control()
  1078. #endif
  1079. if (rc != LDAP_SUCCESS)
  1080. {
  1081. int err = GetLastError();
  1082. if (err)
  1083. {
  1084. throw MakeStringException(-1, "ldap_parse_page_control failed with 0x%x (%s)",err, ldap_err2string( err ));
  1085. }
  1086. else
  1087. {
  1088. DBGLOG("ldap_parse_page_control returned unexpected rc=%x, err=%x, ignoring",rc,err);
  1089. }
  1090. }
  1091. if (!(m_pCookie && m_pCookie->bv_val != NULL && (strlen(m_pCookie->bv_val) > 0)))
  1092. m_morePages = false;
  1093. #else
  1094. int rc = ldap_search_ext_s(m_pLdapConn, m_pszDN, m_scope, m_pszFilter, m_pszAttrs, 0, NULL, NULL, &timeOut, 0, &m_pPageBlock);
  1095. m_morePages = false;
  1096. if (rc != LDAP_SUCCESS)
  1097. {
  1098. throw MakeStringException(-1, "ldap_search_ext_s failed with 0x%x (%s)",rc, ldap_err2string( rc ));
  1099. }
  1100. #endif
  1101. }
  1102. catch(IException* e)
  1103. {
  1104. StringBuffer emsg;
  1105. e->errorMessage(emsg);
  1106. throw MakeStringException(-1, "LDAP Paged Search - %s", emsg.str());
  1107. }
  1108. catch(...)
  1109. {
  1110. throw MakeStringException(-1, "Unknown Exception calling LDAP Paged Search");
  1111. }
  1112. return true;
  1113. }
  1114. public:
  1115. CPagedLDAPSearch(LDAP* _pLdapConn, int _timeout, char * _pszDN, unsigned long _scope, char * _pszFilter, char * _pszAttrs[])
  1116. {
  1117. m_pLdapConn =_pLdapConn;
  1118. m_pszDN = _pszDN;
  1119. m_timeout = _timeout;
  1120. m_scope = _scope;
  1121. m_pszFilter = _pszFilter;
  1122. m_pszAttrs = _pszAttrs;
  1123. m_pCookie = NULL;
  1124. m_morePages = true;
  1125. m_pPageEntry = NULL;
  1126. m_pPageBlock = NULL;
  1127. }
  1128. virtual ~CPagedLDAPSearch()
  1129. {
  1130. if (m_pPageBlock)
  1131. ldap_msgfree(m_pPageBlock);
  1132. if (m_pCookie)
  1133. ber_bvfree(m_pCookie);
  1134. }
  1135. //---------------------------------------------------
  1136. // Returns the count of the matching DN/filter/scope entries
  1137. //---------------------------------------------------
  1138. unsigned countEntries()
  1139. {
  1140. unsigned count = 0;
  1141. while (requestNextPage())
  1142. count += ldap_count_entries(m_pLdapConn, m_pPageBlock);
  1143. return count;
  1144. }
  1145. //---------------------------------------------------
  1146. // Get the first/next entry
  1147. // Returns NULL when no more
  1148. //---------------------------------------------------
  1149. LDAPMessage * getFirstEntry()
  1150. {
  1151. if (!requestNextPage())
  1152. {
  1153. m_morePages = false;
  1154. return NULL;
  1155. }
  1156. return getNextEntry();
  1157. }
  1158. LDAPMessage * getNextEntry()
  1159. {
  1160. if (!m_pPageEntry)
  1161. m_pPageEntry = LdapFirstEntry(m_pLdapConn, m_pPageBlock);
  1162. else
  1163. m_pPageEntry = LdapNextEntry(m_pLdapConn, m_pPageEntry);
  1164. if (!m_pPageEntry)
  1165. {
  1166. if (!requestNextPage())
  1167. return NULL;
  1168. m_pPageEntry = LdapFirstEntry(m_pLdapConn, m_pPageBlock);
  1169. }
  1170. return m_pPageEntry;
  1171. }
  1172. };
  1173. static CriticalSection mpaCrit;
  1174. static __int64 getMaxPwdAge(Owned<ILdapConnectionPool> _conns, const char * _baseDN, int _timeout)
  1175. {
  1176. static time_t lastPwdAgeCheck = 0;
  1177. static __int64 maxPwdAge = PWD_NEVER_EXPIRES;
  1178. #define HOURLY ((time_t)(60*60*1000))
  1179. CriticalBlock block(mpaCrit);
  1180. if (lastPwdAgeCheck != 0 && (((msTick() - lastPwdAgeCheck) < HOURLY)))//in case it was retrieved whilst this thread blocked
  1181. return maxPwdAge;
  1182. DBGLOG("Retrieving LDAP 'maxPwdAge'");
  1183. char* attrs[] = {"maxPwdAge", NULL};
  1184. CLDAPMessage searchResult;
  1185. TIMEVAL timeOut = {_timeout,0};
  1186. Owned<ILdapConnection> lconn = _conns->getConnection();
  1187. LDAP* sys_ld = ((CLdapConnection*)lconn.get())->getLd();
  1188. int result = ldap_search_ext_s(sys_ld, (char*)_baseDN, LDAP_SCOPE_BASE, NULL,
  1189. attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg);
  1190. if(result != LDAP_SUCCESS)
  1191. {
  1192. DBGLOG("ldap_search_ext_s error: %s, when searching maxPwdAge", ldap_err2string( result ));
  1193. return 0;
  1194. }
  1195. unsigned entries = ldap_count_entries(sys_ld, searchResult);
  1196. if(entries == 0)
  1197. {
  1198. DBGLOG("ldap_search_ext_s error: Could not find maxPwdAge");
  1199. return 0;
  1200. }
  1201. maxPwdAge = 0;
  1202. CLDAPGetValuesLenWrapper vals(sys_ld, searchResult.msg, "maxPwdAge");
  1203. if (vals.hasValues())
  1204. {
  1205. const char *val = vals.queryCharValue(0);
  1206. if (val && *val)
  1207. {
  1208. if (*val == '-')
  1209. ++val;
  1210. for (int x=0; val[x]; x++)
  1211. maxPwdAge = maxPwdAge * 10 + ( (int)val[x] - '0');
  1212. }
  1213. }
  1214. else
  1215. maxPwdAge = PWD_NEVER_EXPIRES;
  1216. lastPwdAgeCheck = msTick();
  1217. return maxPwdAge;
  1218. }
  1219. static CriticalSection lcCrit;
  1220. class CLdapClient : implements ILdapClient, public CInterface
  1221. {
  1222. private:
  1223. Owned<ILdapConnectionPool> m_connections;
  1224. IPermissionProcessor* m_pp;
  1225. //int m_defaultFileScopePermission;
  1226. //int m_defaultWorkunitScopePermission;
  1227. Owned<CLdapConfig> m_ldapconfig;
  1228. StringBuffer m_pwscheme;
  1229. bool m_domainPwdsNeverExpire;//no domain policy for password expiration
  1230. public:
  1231. IMPLEMENT_IINTERFACE
  1232. CLdapClient(IPropertyTree* cfg)
  1233. {
  1234. m_ldapconfig.setown(new CLdapConfig(cfg));
  1235. if(cfg && cfg->getPropBool("@useRealConnectionPool", false))
  1236. m_connections.setown(new CLdapConnectionPool2(m_ldapconfig.get()));
  1237. else
  1238. m_connections.setown(new CLdapConnectionPool(m_ldapconfig.get()));
  1239. m_pp = NULL;
  1240. //m_defaultFileScopePermission = -2;
  1241. //m_defaultWorkunitScopePermission = -2;
  1242. m_domainPwdsNeverExpire = false;
  1243. }
  1244. virtual void init(IPermissionProcessor* pp)
  1245. {
  1246. m_pp = pp;
  1247. static bool createdOU = false;
  1248. CriticalBlock block(lcCrit);
  1249. if (!createdOU)
  1250. {
  1251. if(m_ldapconfig->getServerType() == OPEN_LDAP)
  1252. {
  1253. try
  1254. {
  1255. addDC(m_ldapconfig->getBasedn());
  1256. }
  1257. catch(...)
  1258. {
  1259. }
  1260. try
  1261. {
  1262. addGroup("Directory Administrators", NULL, NULL, m_ldapconfig->getBasedn());
  1263. }
  1264. catch(...)
  1265. {
  1266. }
  1267. }
  1268. //Create base LDAP OU tree. Specify PT_DEFAULT to ensure each OU
  1269. //grants access to both Administrators and to Authenticated Users
  1270. createLdapBasedn(NULL, m_ldapconfig->getResourceBasedn(RT_DEFAULT), PT_DEFAULT);
  1271. createLdapBasedn(NULL, m_ldapconfig->getResourceBasedn(RT_FILE_SCOPE), PT_DEFAULT);
  1272. createLdapBasedn(NULL, m_ldapconfig->getResourceBasedn(RT_VIEW_SCOPE), PT_DEFAULT);
  1273. createLdapBasedn(NULL, m_ldapconfig->getResourceBasedn(RT_WORKUNIT_SCOPE), PT_DEFAULT);
  1274. createLdapBasedn(NULL, m_ldapconfig->getResourceBasedn(RT_SUDOERS), PT_DEFAULT);
  1275. createLdapBasedn(NULL, m_ldapconfig->getUserBasedn(), PT_DEFAULT);
  1276. createLdapBasedn(NULL, m_ldapconfig->getGroupBasedn(), PT_DEFAULT);
  1277. createdOU = true;
  1278. }
  1279. }
  1280. virtual LdapServerType getServerType()
  1281. {
  1282. return m_ldapconfig->getServerType();
  1283. }
  1284. virtual ILdapConfig* getLdapConfig()
  1285. {
  1286. return m_ldapconfig.get();
  1287. }
  1288. virtual void setResourceBasedn(const char* rbasedn, SecResourceType rtype)
  1289. {
  1290. m_ldapconfig->setResourceBasedn(rbasedn, rtype);
  1291. createLdapBasedn(NULL, m_ldapconfig->getResourceBasedn(rtype), PT_DEFAULT);
  1292. }
  1293. void calcPWExpiry(CDateTime &dt, unsigned len, char * val)
  1294. {
  1295. __int64 time = 0;
  1296. for (unsigned x=0; x < len; x++)
  1297. time = time * 10 + ( (int)val[x] - '0');
  1298. time += getMaxPwdAge(m_connections,(char*)m_ldapconfig->getBasedn(), m_ldapconfig->getLdapTimeout());
  1299. dt.setFromFILETIME(time);
  1300. dt.adjustTime(dt.queryUtcToLocalDelta());
  1301. }
  1302. virtual bool authenticate(ISecUser& user)
  1303. {
  1304. {
  1305. char *attribute;
  1306. user.setAuthenticateStatus(AS_UNEXPECTED_ERROR);//assume the worst
  1307. const char* username = user.getName();
  1308. const char* password = user.credentials().getPassword();
  1309. if(!username || !*username || !password || !*password)
  1310. {
  1311. DBGLOG("CLdapClient::authenticate username/password must be provided");
  1312. return false;
  1313. }
  1314. if (getMaxPwdAge(m_connections,(char*)m_ldapconfig->getBasedn(), m_ldapconfig->getLdapTimeout()) != PWD_NEVER_EXPIRES)
  1315. m_domainPwdsNeverExpire = false;
  1316. else
  1317. m_domainPwdsNeverExpire = true;
  1318. StringBuffer filter;
  1319. // Retrieve user's dn with system connection
  1320. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  1321. filter.append("sAMAccountName=");
  1322. else
  1323. filter.append("uid=");
  1324. filter.append(username);
  1325. char* attrs[] = {"cn", "userAccountControl", "pwdLastSet", "givenName", "sn", "employeeId", "distinguishedName",NULL};
  1326. Owned<ILdapConnection> lconn = m_connections->getConnection();
  1327. LDAP* sys_ld = ((CLdapConnection*)lconn.get())->getLd();
  1328. CLDAPMessage searchResult;
  1329. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  1330. int result = ldap_search_ext_s(sys_ld,
  1331. (char*)m_ldapconfig->getUserBasedn(), //distinguished name of the entry at which to start the search
  1332. LDAP_SCOPE_SUBTREE,
  1333. (char*)filter.str(), //search filter
  1334. attrs,
  1335. 0, //attribute types and values are to be returned, nonzero if only types are required
  1336. NULL,
  1337. NULL,
  1338. &timeOut,
  1339. LDAP_NO_LIMIT,
  1340. &searchResult.msg);
  1341. if(result != LDAP_SUCCESS)
  1342. {
  1343. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( result ), filter.str(), m_ldapconfig->getUserBasedn());
  1344. return false;
  1345. }
  1346. unsigned entries = ldap_count_entries(sys_ld, searchResult);
  1347. if(entries == 0)
  1348. {
  1349. searchResult.ldapMsgFree();
  1350. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  1351. result = ldap_search_ext_s(sys_ld, (char*)m_ldapconfig->getSysUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg);
  1352. if(result != LDAP_SUCCESS)
  1353. {
  1354. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( result ), filter.str(), m_ldapconfig->getSysUserBasedn());
  1355. user.setAuthenticateStatus(AS_INVALID_CREDENTIALS);
  1356. return false;
  1357. }
  1358. entries = ldap_count_entries(sys_ld, searchResult);
  1359. if(entries == 0)
  1360. {
  1361. DBGLOG("LDAP: User %s not found", username);
  1362. user.setAuthenticateStatus(AS_INVALID_CREDENTIALS);
  1363. return false;
  1364. }
  1365. }
  1366. LDAPMessage *entry = LdapFirstEntry(sys_ld, searchResult);
  1367. if(entry == NULL)
  1368. {
  1369. DBGLOG("LDAP: Can't find entry for user %s", username);
  1370. return false;
  1371. }
  1372. bool accountPwdNeverExpires = false;
  1373. CLDAPGetAttributesWrapper atts(sys_ld, searchResult);
  1374. for ( attribute = atts.getFirst();
  1375. attribute != NULL;
  1376. attribute = atts.getNext())
  1377. {
  1378. if(stricmp(attribute, "cn") == 0)
  1379. {
  1380. CLDAPGetValuesLenWrapper vals(sys_ld, entry, attribute);
  1381. if (vals.hasValues())
  1382. user.setFullName(vals.queryCharValue(0));
  1383. }
  1384. else if((stricmp(attribute, "givenName") == 0))
  1385. {
  1386. CLDAPGetValuesLenWrapper vals(sys_ld, entry, attribute);
  1387. if (vals.hasValues())
  1388. user.setFirstName(vals.queryCharValue(0));
  1389. }
  1390. else if((stricmp(attribute, "sn") == 0))
  1391. {
  1392. CLDAPGetValuesLenWrapper vals(sys_ld, entry, attribute);
  1393. if (vals.hasValues())
  1394. user.setLastName(vals.queryCharValue(0));
  1395. }
  1396. else if((stricmp(attribute, "userAccountControl") == 0))
  1397. {
  1398. //UF_DONT_EXPIRE_PASSWD 0x10000
  1399. CLDAPGetValuesLenWrapper vals(sys_ld, entry, attribute);
  1400. if (vals.hasValues())
  1401. if (atoi((char*)vals.queryCharValue(0)) & 0x10000)//this can be true at the account level, even if domain policy requires password
  1402. accountPwdNeverExpires = true;
  1403. }
  1404. else if((stricmp(attribute, "pwdLastSet") == 0))
  1405. {
  1406. /*pwdLastSet is the date and time that the password for this account was last changed. This
  1407. value is stored as a large integer that represents the number of 100 nanosecond intervals
  1408. since January 1, 1601 (UTC), also known as a FILETIME value. If this value is set
  1409. to 0 and the User-Account-Control attribute does not contain the UF_DONT_EXPIRE_PASSWD
  1410. flag, then the user must set the password at the next logon.
  1411. */
  1412. CLDAPGetValuesLenWrapper valsLen(sys_ld, entry, attribute);
  1413. if (valsLen.hasValues())
  1414. {
  1415. CDateTime expiry;
  1416. if (!m_domainPwdsNeverExpire && !accountPwdNeverExpires)
  1417. {
  1418. char * val = (char*)valsLen.queryCharValue(0);
  1419. calcPWExpiry(expiry, (unsigned)strlen(val), val);
  1420. }
  1421. else
  1422. {
  1423. expiry.clear();
  1424. DBGLOG("LDAP: Password never expires for user %s", username);
  1425. }
  1426. user.setPasswordExpiration(expiry);
  1427. }
  1428. }
  1429. else if(stricmp(attribute, "employeeId") == 0)
  1430. {
  1431. CLDAPGetValuesLenWrapper vals(sys_ld, entry, attribute);
  1432. if (vals.hasValues())
  1433. user.setEmployeeID(vals.queryCharValue(0));
  1434. }
  1435. else if(stricmp(attribute, "distinguishedName") == 0)
  1436. {
  1437. CLDAPGetValuesLenWrapper vals(sys_ld, entry, attribute);
  1438. if (vals.hasValues())
  1439. user.setDistinguishedName(vals.queryCharValue(0));
  1440. }
  1441. }
  1442. char *userdn = ldap_get_dn(sys_ld, entry);
  1443. if(userdn == NULL || strlen(userdn) == 0)
  1444. {
  1445. DBGLOG("LDAP: dn not found for user %s", username);
  1446. return false;
  1447. }
  1448. StringBuffer userdnbuf;
  1449. userdnbuf.append(userdn);
  1450. ldap_memfree(userdn);
  1451. StringBuffer hostbuf;
  1452. m_ldapconfig->getLdapHost(hostbuf);
  1453. int rc = LDAP_SERVER_DOWN;
  1454. char *ldap_errstring=NULL;
  1455. for(int retries = 0; retries <= LDAPSEC_MAX_RETRIES; retries++)
  1456. {
  1457. DBGLOG("LdapBind for user %s (retries=%d).", username, retries);
  1458. {
  1459. LDAP* user_ld = LdapUtils::LdapInit(m_ldapconfig->getProtocol(), hostbuf.str(), m_ldapconfig->getLdapPort(), m_ldapconfig->getLdapSecurePort());
  1460. rc = LdapUtils::LdapBind(user_ld, m_ldapconfig->getLdapTimeout(), m_ldapconfig->getDomain(), username, password, userdnbuf.str(), m_ldapconfig->getServerType(), m_ldapconfig->getAuthMethod());
  1461. if(rc != LDAP_SUCCESS)
  1462. ldap_get_option(user_ld, LDAP_OPT_ERROR_STRING, &ldap_errstring);
  1463. LDAP_UNBIND(user_ld);
  1464. }
  1465. DBGLOG("finished LdapBind for user %s, rc=%d", username, rc);
  1466. if(!LdapServerDown(rc) || retries > LDAPSEC_MAX_RETRIES)
  1467. break;
  1468. sleep(LDAPSEC_RETRY_WAIT);
  1469. if(retries < LDAPSEC_MAX_RETRIES)
  1470. DBGLOG("Server temporarily unreachable, retrying ...");
  1471. // Retrying next ldap sever, might be the same server
  1472. m_ldapconfig->getLdapHost(hostbuf);
  1473. }
  1474. if(rc == LDAP_SERVER_DOWN)
  1475. {
  1476. StringBuffer dc;
  1477. LdapUtils::getDcName(NULL, dc);
  1478. if(dc.length() > 0)
  1479. {
  1480. WARNLOG("Using automatically obtained LDAP Server %s", dc.str());
  1481. LDAP* user_ld = LdapUtils::LdapInit(m_ldapconfig->getProtocol(), dc.str(), m_ldapconfig->getLdapPort(), m_ldapconfig->getLdapSecurePort());
  1482. rc = LdapUtils::LdapBind(user_ld, m_ldapconfig->getLdapTimeout(), m_ldapconfig->getDomain(), username, password, userdnbuf.str(), m_ldapconfig->getServerType(), m_ldapconfig->getAuthMethod());
  1483. if(rc != LDAP_SUCCESS)
  1484. ldap_get_option(user_ld, LDAP_OPT_ERROR_STRING, &ldap_errstring);
  1485. LDAP_UNBIND(user_ld);
  1486. }
  1487. }
  1488. if(rc != LDAP_SUCCESS)
  1489. {
  1490. if (ldap_errstring && *ldap_errstring && strstr(ldap_errstring, " data "))//if extended error strings are available (they are not in windows clients)
  1491. {
  1492. #ifdef _DEBUG
  1493. DBGLOG("LDAPBIND ERR: RC=%d, - '%s'", rc, ldap_errstring);
  1494. #endif
  1495. if (strstr(ldap_errstring, "data 532"))//80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 532, v1db0.
  1496. {
  1497. DBGLOG("LDAP: Password Expired(1) for user %s", username);
  1498. user.setAuthenticateStatus(AS_PASSWORD_VALID_BUT_EXPIRED);
  1499. }
  1500. else if (strstr(ldap_errstring, "data 773"))//User must reset password "80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 773, v1db1'
  1501. {
  1502. DBGLOG("LDAP: User %s Must Reset Password", username);
  1503. user.setAuthenticateStatus(AS_PASSWORD_VALID_BUT_EXPIRED);
  1504. }
  1505. else
  1506. {
  1507. DBGLOG("LDAP: Authentication(1) for user %s failed - %s", username, ldap_err2string(rc));
  1508. user.setAuthenticateStatus(AS_INVALID_CREDENTIALS);
  1509. }
  1510. }
  1511. else
  1512. {
  1513. //This path is typical if running ESP on Windows. We have no way
  1514. //to determine if password entered is valid but expired
  1515. if (user.getPasswordDaysRemaining() == scPasswordExpired)
  1516. {
  1517. DBGLOG("LDAP: Password Expired(2) for user %s", username);
  1518. user.setAuthenticateStatus(AS_PASSWORD_EXPIRED);
  1519. }
  1520. else
  1521. {
  1522. DBGLOG("LDAP: Authentication(2) for user %s failed - %s", username, ldap_err2string(rc));
  1523. user.setAuthenticateStatus(AS_INVALID_CREDENTIALS);
  1524. }
  1525. }
  1526. return false;
  1527. }
  1528. user.setAuthenticateStatus(AS_AUTHENTICATED);
  1529. }
  1530. //Always retrieve user info(SID, UID, fullname, etc) for Active Directory, when the user first logs in.
  1531. if((m_ldapconfig->getServerType() == ACTIVE_DIRECTORY) && (m_pp != NULL))
  1532. m_pp->retrieveUserInfo(user);
  1533. return true;
  1534. };
  1535. virtual bool authorize(SecResourceType rtype, ISecUser& user, IArrayOf<ISecResource>& resources, const char * resName = nullptr)
  1536. {
  1537. bool ok = false;
  1538. const char* basedn = m_ldapconfig->getResourceBasedn(rtype);
  1539. if(basedn == NULL || *basedn == '\0')
  1540. {
  1541. DBGLOG("corresponding basedn is not defined for authorize");
  1542. return false;
  1543. }
  1544. const char* username = user.getName();
  1545. if(!username || !*username)
  1546. {
  1547. DBGLOG("CLdapClient::authorize username must be specified");
  1548. return false;
  1549. }
  1550. const char* sysuser = m_ldapconfig->getSysUser();
  1551. if(sysuser && *sysuser && (strcmp(username, sysuser) == 0))
  1552. {
  1553. ForEachItemIn(x, resources)
  1554. {
  1555. ISecResource* res = &resources.item(x);
  1556. if(!res)
  1557. continue;
  1558. if(rtype == RT_MODULE)
  1559. {
  1560. StringBuffer filter;
  1561. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  1562. filter.append("name=");
  1563. else
  1564. filter.append("ou=");
  1565. filter.append(res->getName());
  1566. int count = countEntries(m_ldapconfig->getResourceBasedn(rtype), (char*)filter.str(), 10);
  1567. if(count != 0)
  1568. res->setAccessFlags(SecAccess_Full);
  1569. else
  1570. res->setAccessFlags(SecAccess_Unavailable);
  1571. }
  1572. else
  1573. res->setAccessFlags(SecAccess_Full);
  1574. }
  1575. return true;
  1576. }
  1577. if(rtype == RT_FILE_SCOPE)
  1578. {
  1579. SecAccessFlags defaultFileScopePermission = queryDefaultPermission(user);
  1580. IArrayOf<ISecResource> non_emptylist;
  1581. ForEachItemIn(x, resources)
  1582. {
  1583. ISecResource& res = resources.item(x);
  1584. const char* res_name = res.getName();
  1585. if(res_name == NULL || *res_name == '\0')
  1586. res.setAccessFlags(defaultFileScopePermission); //res.setAccessFlags(m_defaultFileScopePermission);
  1587. else
  1588. non_emptylist.append(*LINK(&res));
  1589. }
  1590. ok = authorizeScope(user, non_emptylist, basedn);
  1591. //if(ok && m_defaultFileScopePermission != -2)
  1592. if(ok && defaultFileScopePermission != UNK_PERM_VALUE)
  1593. {
  1594. ForEachItemIn(x, non_emptylist)
  1595. {
  1596. ISecResource& res = non_emptylist.item(x);
  1597. if(res.getAccessFlags() == -1)
  1598. res.setAccessFlags(defaultFileScopePermission); //res.setAccessFlags(m_defaultFileScopePermission);
  1599. }
  1600. }
  1601. return ok;
  1602. }
  1603. else if(rtype == RT_WORKUNIT_SCOPE)
  1604. {
  1605. SecAccessFlags defaultWorkunitScopePermission = UNK_PERM_VALUE;//init to invalid SecAccessFlags value
  1606. //if(m_defaultWorkunitScopePermission == -2)
  1607. {
  1608. const char* basebasedn = strchr(basedn, ',') + 1;
  1609. StringBuffer baseresource;
  1610. baseresource.append(basebasedn-basedn-4, basedn+3);
  1611. IArrayOf<ISecResource> base_resources;
  1612. base_resources.append(*(new CLdapSecResource(baseresource.str())));
  1613. bool baseok = authorizeScope(user, base_resources, basebasedn);
  1614. if(baseok)
  1615. {
  1616. defaultWorkunitScopePermission = base_resources.item(0).getAccessFlags();//replace UNK_PERM_VALUE with a valid flag
  1617. }
  1618. }
  1619. IArrayOf<ISecResource> non_emptylist;
  1620. ForEachItemIn(x, resources)
  1621. {
  1622. ISecResource& res = resources.item(x);
  1623. const char* res_name = res.getName();
  1624. if(res_name == NULL || *res_name == '\0')
  1625. res.setAccessFlags(defaultWorkunitScopePermission);
  1626. else
  1627. non_emptylist.append(*LINK(&res));
  1628. }
  1629. ok = authorizeScope(user, non_emptylist, basedn);
  1630. if(ok && defaultWorkunitScopePermission != UNK_PERM_VALUE)//if default perm is known, use it
  1631. {
  1632. ForEachItemIn(x, non_emptylist)
  1633. {
  1634. ISecResource& res = non_emptylist.item(x);
  1635. if(res.getAccessFlags() == -1)
  1636. res.setAccessFlags(defaultWorkunitScopePermission);
  1637. }
  1638. }
  1639. return ok;
  1640. }
  1641. else if (rtype == RT_VIEW_SCOPE)
  1642. {
  1643. SecAccessFlags defPerm = queryDefaultPermission(user); //default perm to be applied when no lfn or column provided
  1644. //Get view lfn/col mappings for this view
  1645. assertex(resources.ordinality() > 0);
  1646. assertex(resName && *resName != '\0');
  1647. StringArray viewFiles;
  1648. StringArray viewColumns;
  1649. queryViewColumns(resName, viewFiles, viewColumns);
  1650. unsigned numViewMembers = viewFiles.ordinality();
  1651. assertex(numViewMembers == viewColumns.ordinality());
  1652. StringAttr lfn;
  1653. StringAttr col;
  1654. unsigned fails = 0;
  1655. ForEachItemIn(idx, resources) //Iterate over all resources in list
  1656. {
  1657. ISecResource& res = resources.item(idx);
  1658. assertex(RT_VIEW_SCOPE == res.getResourceType());
  1659. lfn.set(res.getParameter("file"));
  1660. col.set(res.getParameter("column"));
  1661. #ifdef _DEBUG
  1662. DBGLOG("Checking '%s' RT_VIEW_SCOPE for lfn %s, col %s", resName, lfn.str(), col.str());
  1663. #endif
  1664. if (lfn.isEmpty() || col.isEmpty())
  1665. res.setAccessFlags(defPerm);
  1666. else
  1667. {
  1668. //Check LDAP
  1669. res.setAccessFlags(SecAccess_None);
  1670. ++fails;
  1671. for (unsigned vIdx = 0; vIdx < numViewMembers; vIdx++)
  1672. {
  1673. if (0 == stricmp(lfn.str(), viewFiles.item(vIdx)) &&
  1674. 0 == stricmp(col.str(), viewColumns.item(vIdx)))
  1675. {
  1676. res.setAccessFlags(SecAccess_Full);
  1677. --fails;
  1678. break;
  1679. }
  1680. }
  1681. }
  1682. }
  1683. return fails == 0 ? true : false;
  1684. }
  1685. else
  1686. {
  1687. IArrayOf<CSecurityDescriptor> sdlist;
  1688. ForEachItemIn(x, resources)
  1689. {
  1690. ISecResource& res = resources.item(x);
  1691. const char* resourcename = res.getName();
  1692. CSecurityDescriptor* sd = new CSecurityDescriptor(resourcename);
  1693. sdlist.append(*sd);
  1694. }
  1695. getSecurityDescriptors(rtype, sdlist);
  1696. if(m_pp != NULL)
  1697. ok = m_pp->getPermissions(user, sdlist, resources);
  1698. return ok;
  1699. }
  1700. }
  1701. // Returns true if all resources are correctly added, otherwise returns false.
  1702. virtual bool addResources(SecResourceType rtype, ISecUser& user, IArrayOf<ISecResource>& resources, SecPermissionType ptype, const char* basedn)
  1703. {
  1704. bool ret = true;
  1705. for(unsigned i = 0; i < resources.length(); i++)
  1706. {
  1707. ISecResource* resource = &resources.item(i);
  1708. if(resource != NULL)
  1709. {
  1710. bool oneret = addResource(rtype, user, resource, ptype, basedn);
  1711. ret = ret && oneret;
  1712. }
  1713. }
  1714. return ret;
  1715. }
  1716. virtual bool getUserInfo(ISecUser& user, const char* infotype)
  1717. {
  1718. char *attribute;
  1719. LDAPMessage *message;
  1720. const char* username = user.getName();
  1721. if(username == NULL || strlen(username) == 0)
  1722. {
  1723. DBGLOG("LDAP: getUserInfo : username is empty");
  1724. return false;
  1725. }
  1726. if(infotype && stricmp(infotype, "sudoers") == 0)
  1727. {
  1728. CLdapSecUser* ldapuser = dynamic_cast<CLdapSecUser*>(&user);
  1729. if (ldapuser == nullptr)
  1730. {
  1731. throw MakeStringException(-1, "Unable to cast user %s to CLdapSecUser", username);
  1732. }
  1733. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  1734. Owned<ILdapConnection> lconn = m_connections->getConnection();
  1735. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  1736. StringBuffer filter("sudoUser=");
  1737. filter.append(username);
  1738. char *attrs[] = {"sudoHost", "sudoCommand", "sudoOption", NULL};
  1739. const char* basedn = m_ldapconfig->getResourceBasedn(RT_SUDOERS);
  1740. CLDAPMessage searchResult;
  1741. int rc = ldap_search_ext_s(ld, (char*)basedn, LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg);
  1742. if ( rc != LDAP_SUCCESS )
  1743. {
  1744. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), basedn);
  1745. ldapuser->setSudoersEnabled(false);
  1746. ldapuser->setInSudoers(false);
  1747. return false;
  1748. }
  1749. ldapuser->setSudoersEnabled(true);
  1750. unsigned entries = ldap_count_entries(ld, searchResult);
  1751. if(entries == 0)
  1752. {
  1753. ldapuser->setInSudoers(false);
  1754. return true;
  1755. }
  1756. message = LdapFirstEntry(ld, searchResult);
  1757. if(message == NULL)
  1758. {
  1759. ldapuser->setInSudoers(false);
  1760. return true;
  1761. }
  1762. ldapuser->setInSudoers(true);
  1763. CLDAPGetAttributesWrapper atts(ld, searchResult);
  1764. for ( attribute = atts.getFirst();
  1765. attribute != NULL;
  1766. attribute = atts.getNext())
  1767. {
  1768. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  1769. if (vals.hasValues())
  1770. {
  1771. if(stricmp(attribute, "sudoHost") == 0)
  1772. ldapuser->setSudoHost(vals.queryCharValue(0));
  1773. else if(stricmp(attribute, "sudoCommand") == 0)
  1774. ldapuser->setSudoCommand(vals.queryCharValue(0));
  1775. else if(stricmp(attribute, "sudoOption") == 0)
  1776. ldapuser->setSudoOption(vals.queryCharValue(0));
  1777. }
  1778. }
  1779. return true;
  1780. }
  1781. else
  1782. {
  1783. StringBuffer filter;
  1784. const char* basedn = m_ldapconfig->getUserBasedn();
  1785. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  1786. {
  1787. filter.append("sAMAccountName=");
  1788. }
  1789. else
  1790. {
  1791. filter.append("uid=");
  1792. if(stricmp(username, m_ldapconfig->getSysUser()) == 0)
  1793. basedn = m_ldapconfig->getSysUserBasedn();
  1794. }
  1795. filter.append(user.getName());
  1796. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  1797. Owned<ILdapConnection> lconn = m_connections->getConnection();
  1798. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  1799. char *attrs[] = {"cn", "givenName", "sn", "gidnumber", "uidnumber", "homedirectory", "loginshell", "objectClass", "employeeId", "distinguishedName", "userAccountControl", "pwdLastSet", NULL};
  1800. CLDAPMessage searchResult;
  1801. int rc = ldap_search_ext_s(ld, (char*)basedn, LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  1802. if ( rc != LDAP_SUCCESS )
  1803. {
  1804. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), basedn);
  1805. return false;
  1806. }
  1807. bool accountPwdNeverExpires = false;
  1808. ((CLdapSecUser*)&user)->setPosixenabled(false);
  1809. // Go through the search results by checking message types
  1810. for(message = LdapFirstEntry( ld, searchResult); message != NULL; message = ldap_next_entry(ld, message))
  1811. {
  1812. CLDAPGetAttributesWrapper atts(ld, searchResult);
  1813. for ( attribute = atts.getFirst();
  1814. attribute != NULL;
  1815. attribute = atts.getNext())
  1816. {
  1817. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  1818. if (vals.hasValues())
  1819. {
  1820. if(stricmp(attribute, "cn") == 0)
  1821. user.setFullName(vals.queryCharValue(0));
  1822. else if(stricmp(attribute, "givenName") == 0)
  1823. user.setFirstName(vals.queryCharValue(0));
  1824. else if(stricmp(attribute, "sn") == 0)
  1825. user.setLastName(vals.queryCharValue(0));
  1826. else if(stricmp(attribute, "gidnumber") == 0)
  1827. ((CLdapSecUser*)&user)->setGidnumber(vals.queryCharValue(0));
  1828. else if(stricmp(attribute, "uidnumber") == 0)
  1829. ((CLdapSecUser*)&user)->setUidnumber(vals.queryCharValue(0));
  1830. else if(stricmp(attribute, "homedirectory") == 0)
  1831. ((CLdapSecUser*)&user)->setHomedirectory(vals.queryCharValue(0));
  1832. else if(stricmp(attribute, "loginshell") == 0)
  1833. ((CLdapSecUser*)&user)->setLoginshell(vals.queryCharValue(0));
  1834. else if(stricmp(attribute, "distinguishedName") == 0)
  1835. ((CLdapSecUser*)&user)->setDistinguishedName(vals.queryCharValue(0));
  1836. else if((stricmp(attribute, "userAccountControl") == 0))
  1837. {
  1838. //UF_DONT_EXPIRE_PASSWD 0x10000
  1839. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  1840. if (vals.hasValues())
  1841. if (atoi((char*)vals.queryCharValue(0)) & 0x10000)//this can be true at the account level, even if domain policy requires password
  1842. accountPwdNeverExpires = true;
  1843. }
  1844. else if(stricmp(attribute, "pwdLastSet") == 0)
  1845. {
  1846. CLDAPGetValuesLenWrapper valsLen(ld, message, attribute);
  1847. if (!m_domainPwdsNeverExpire && !accountPwdNeverExpires && valsLen.hasValues())
  1848. {
  1849. CDateTime expiry;
  1850. char * val = (char*)valsLen.queryCharValue(0);
  1851. calcPWExpiry(expiry, (unsigned)strlen(val), val);
  1852. ((CLdapSecUser*)&user)->setPasswordExpiration(expiry);
  1853. }
  1854. }
  1855. else if(stricmp(attribute, "objectClass") == 0)
  1856. {
  1857. int valind = 0;
  1858. while(vals.queryCharValue(valind))
  1859. {
  1860. if(stricmp(vals.queryCharValue(valind), "posixAccount") == 0)
  1861. {
  1862. ((CLdapSecUser*)&user)->setPosixenabled(true);
  1863. break;
  1864. }
  1865. valind++;
  1866. }
  1867. }
  1868. else if(stricmp(attribute, "employeeId") == 0)
  1869. user.setEmployeeID(vals.queryCharValue(0));
  1870. }
  1871. }
  1872. }
  1873. return true;
  1874. }
  1875. }
  1876. ISecUser* lookupUser(unsigned uid)
  1877. {
  1878. StringBuffer sysuser;
  1879. sysuser.append(m_ldapconfig->getSysUser());
  1880. if(sysuser.length() == 0)
  1881. {
  1882. #ifdef _WIN32
  1883. char uname[128];
  1884. unsigned long len = 128;
  1885. int rc = GetUserName(uname, &len);
  1886. if(rc != 0)
  1887. sysuser.append(len, uname);
  1888. else
  1889. throw MakeStringException(-1, "Error getting current user's username, error code = %d", rc);
  1890. #else
  1891. throw MakeStringException(-1, "systemUser not found in config");
  1892. #endif
  1893. }
  1894. MemoryBuffer usersidbuf;
  1895. StringBuffer usersidstr;
  1896. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  1897. {
  1898. if(m_pp != NULL)
  1899. m_pp->lookupSid(sysuser.str(), usersidbuf);
  1900. if(usersidbuf.length() == 0)
  1901. {
  1902. throw MakeStringException(-1, "system user %s's SID not found", sysuser.str());
  1903. }
  1904. int sidlen = usersidbuf.length();
  1905. char* uidbuf = (char*)&uid;
  1906. for(int i = 0; i < 4; i++)
  1907. {
  1908. usersidbuf.writeDirect(sidlen -4 + i, 1, (uidbuf + 3 - i));
  1909. }
  1910. LdapUtils::bin2str(usersidbuf, usersidstr);
  1911. }
  1912. else
  1913. {
  1914. usersidbuf.append(uid);
  1915. }
  1916. char *attribute;
  1917. LDAPMessage *message;
  1918. StringBuffer filter;
  1919. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  1920. {
  1921. filter.append("objectSid=").append(usersidstr.str());
  1922. }
  1923. else
  1924. {
  1925. filter.appendf("entryid=%d", uid);
  1926. }
  1927. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  1928. Owned<ILdapConnection> lconn = m_connections->getConnection();
  1929. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  1930. char* act_fieldname;
  1931. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  1932. {
  1933. act_fieldname = "sAMAccountName";
  1934. }
  1935. else
  1936. {
  1937. act_fieldname = "uid";
  1938. }
  1939. char *attrs[] = {"cn", act_fieldname, NULL};
  1940. CLDAPMessage searchResult;
  1941. int rc = ldap_search_ext_s(ld, (char*)m_ldapconfig->getUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  1942. if ( rc != LDAP_SUCCESS )
  1943. {
  1944. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getUserBasedn());
  1945. return NULL;
  1946. }
  1947. if(ldap_count_entries(ld, searchResult) < 1)
  1948. {
  1949. DBGLOG("No entries are found for user with uid %0X", uid);
  1950. return NULL;
  1951. }
  1952. CLdapSecUser* ldapuser = new CLdapSecUser("", "");
  1953. // Go through the search results by checking message types
  1954. for(message = LdapFirstEntry( ld, searchResult); message != NULL; message = ldap_next_entry(ld, message))
  1955. {
  1956. CLDAPGetAttributesWrapper atts(ld, searchResult);
  1957. for ( attribute = atts.getFirst();
  1958. attribute != NULL;
  1959. attribute = atts.getNext())
  1960. {
  1961. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  1962. if (vals.hasValues())
  1963. {
  1964. if(stricmp(attribute, "cn") == 0)
  1965. ldapuser->setFullName(vals.queryCharValue(0));
  1966. else if(stricmp(attribute, act_fieldname) == 0)
  1967. ldapuser->setName(vals.queryCharValue(0));
  1968. }
  1969. }
  1970. }
  1971. ldapuser->setUserID(uid);
  1972. ldapuser->setUserSid(usersidbuf.length(), usersidbuf.toByteArray());
  1973. // Since we've got the SID for the user, cache it for later uses.
  1974. MemoryBuffer mb;
  1975. if(m_pp != NULL)
  1976. {
  1977. m_pp->getCachedSid(ldapuser->getName(), mb);
  1978. if(mb.length() == 0)
  1979. {
  1980. m_pp->cacheSid(ldapuser->getName(), usersidbuf.length(), usersidbuf.toByteArray());
  1981. }
  1982. }
  1983. return ldapuser;
  1984. }
  1985. bool lookupAccount(MemoryBuffer& sidbuf, StringBuffer& account_name, ACT_TYPE& act_type)
  1986. {
  1987. char *attribute;
  1988. LDAPMessage *message;
  1989. char* act_fieldname;
  1990. StringBuffer filter;
  1991. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  1992. {
  1993. act_fieldname = "sAMAccountName";
  1994. StringBuffer usersidstr;
  1995. LdapUtils::bin2str(sidbuf, usersidstr);
  1996. filter.append("objectSid=").append(usersidstr.str());
  1997. }
  1998. else
  1999. {
  2000. unsigned* uid = (unsigned*)sidbuf.toByteArray();
  2001. filter.appendf("entryid=%d", *uid);
  2002. act_fieldname = "uid";
  2003. }
  2004. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  2005. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2006. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2007. char *attrs[] = {"cn", act_fieldname, "objectClass", NULL};
  2008. CLDAPMessage searchResult;
  2009. int rc = ldap_search_ext_s(ld, (char*)m_ldapconfig->getUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  2010. if ( rc != LDAP_SUCCESS )
  2011. {
  2012. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getUserBasedn());
  2013. return false;
  2014. }
  2015. if(ldap_count_entries(ld, searchResult) < 1)
  2016. {
  2017. searchResult.ldapMsgFree();
  2018. ldap_search_ext_s(ld, (char*)m_ldapconfig->getGroupBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  2019. if(ldap_count_entries(ld, searchResult) < 1)
  2020. {
  2021. searchResult.ldapMsgFree();
  2022. ldap_search_ext_s(ld, (char*)m_ldapconfig->getSysUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  2023. if(ldap_count_entries(ld, searchResult) < 1)
  2024. {
  2025. DBGLOG("CLdapClient::lookupAccount No entries found");
  2026. return false;
  2027. }
  2028. }
  2029. }
  2030. StringBuffer act_name;
  2031. StringBuffer cnbuf;
  2032. // Go through the search results by checking message types
  2033. for(message = LdapFirstEntry( ld, searchResult); message != NULL; message = ldap_next_entry(ld, message))
  2034. {
  2035. CLDAPGetAttributesWrapper atts(ld, searchResult);
  2036. for ( attribute = atts.getFirst();
  2037. attribute != NULL;
  2038. attribute = atts.getNext())
  2039. {
  2040. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  2041. if (vals.hasValues())
  2042. {
  2043. if(stricmp(attribute, act_fieldname) == 0)
  2044. act_name.clear().append(vals.queryCharValue(0));
  2045. else if(stricmp(attribute, "cn") == 0)
  2046. cnbuf.clear().append(vals.queryCharValue(0));
  2047. else if(stricmp(attribute, "objectClass") == 0)
  2048. {
  2049. int i = 0;
  2050. while(vals.queryCharValue(i) != NULL)
  2051. {
  2052. if(stricmp(vals.queryCharValue(i), "person") == 0)
  2053. act_type = USER_ACT;
  2054. else if(stricmp(vals.queryCharValue(i), "group") == 0)
  2055. act_type = GROUP_ACT;
  2056. i++;
  2057. }
  2058. }
  2059. }
  2060. }
  2061. }
  2062. if(act_type == USER_ACT)
  2063. account_name.append(act_name.str());
  2064. else
  2065. account_name.append(cnbuf.str());
  2066. return true;
  2067. }
  2068. virtual void lookupSid(const char* basedn, const char* filter, MemoryBuffer& act_sid)
  2069. {
  2070. char *attribute;
  2071. LDAPMessage *message;
  2072. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  2073. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2074. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2075. char* fieldname;
  2076. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2077. fieldname = "objectSid";
  2078. else
  2079. fieldname = "entryid";
  2080. char *attrs[] = {fieldname, NULL};
  2081. CLDAPMessage searchResult;
  2082. int rc = ldap_search_ext_s(ld, (char*)basedn, LDAP_SCOPE_SUBTREE, (char*)filter, attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  2083. if ( rc != LDAP_SUCCESS )
  2084. {
  2085. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter, basedn);
  2086. return;
  2087. }
  2088. message = LdapFirstEntry( ld, searchResult);
  2089. if(message != NULL)
  2090. {
  2091. CLDAPGetAttributesWrapper atts(ld, searchResult);
  2092. for ( attribute = atts.getFirst();
  2093. attribute != NULL;
  2094. attribute = atts.getNext())
  2095. {
  2096. if(0 == stricmp(attribute, fieldname))
  2097. {
  2098. CLDAPGetValuesLenWrapper valsLen(ld, message, attribute);
  2099. if (valsLen.hasValues())
  2100. {
  2101. struct berval* val = valsLen.queryBValues()[0];
  2102. if(val != NULL)
  2103. {
  2104. int len = val->bv_len;
  2105. act_sid.append(val->bv_len, val->bv_val);
  2106. }
  2107. }
  2108. break;
  2109. }
  2110. }
  2111. }
  2112. }
  2113. virtual void lookupSid(const char* act_name, MemoryBuffer& act_sid, ACT_TYPE act_type)
  2114. {
  2115. StringBuffer filter;
  2116. const char* basedn;
  2117. if(act_type == USER_ACT)
  2118. {
  2119. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2120. filter.append("sAMAccountName=").append(act_name);
  2121. else
  2122. filter.append("uid=").append(act_name);
  2123. basedn = m_ldapconfig->getUserBasedn();
  2124. lookupSid(basedn, filter.str(), act_sid);
  2125. if(act_sid.length() == 0)
  2126. {
  2127. StringBuffer basebuf;
  2128. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2129. basebuf.append("cn=Users,").append(m_ldapconfig->getBasedn());
  2130. else if(stricmp(act_name, m_ldapconfig->getSysUser()) == 0)
  2131. basebuf.append(m_ldapconfig->getSysUserBasedn());
  2132. else
  2133. basebuf.append("ou=People,").append(m_ldapconfig->getBasedn());
  2134. lookupSid(basebuf.str(), filter.str(), act_sid);
  2135. }
  2136. }
  2137. else
  2138. {
  2139. filter.append("cn=").append(act_name);
  2140. basedn = m_ldapconfig->getGroupBasedn();
  2141. lookupSid(basedn, filter.str(), act_sid);
  2142. if(act_sid.length() == 0)
  2143. {
  2144. StringBuffer basebuf;
  2145. basebuf.append("cn=Users,").append(m_ldapconfig->getBasedn());
  2146. lookupSid(basebuf.str(), filter.str(), act_sid);
  2147. if(act_sid.length() == 0)
  2148. {
  2149. basebuf.clear();
  2150. basebuf.append("cn=Builtin,").append(m_ldapconfig->getBasedn());
  2151. lookupSid(basebuf.str(), filter.str(), act_sid);
  2152. }
  2153. }
  2154. }
  2155. }
  2156. virtual void setPermissionProcessor(IPermissionProcessor* pp)
  2157. {
  2158. m_pp = pp;
  2159. }
  2160. virtual bool retrieveUsers(IUserArray& users)
  2161. {
  2162. return retrieveUsers("", users);
  2163. }
  2164. virtual bool retrieveUsers(const char* searchstr, IUserArray& users)
  2165. {
  2166. char *attribute;
  2167. LDAPMessage *message;
  2168. StringBuffer filter;
  2169. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2170. filter.append("objectClass=User");
  2171. else
  2172. filter.append("objectClass=inetorgperson");
  2173. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  2174. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2175. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2176. char* act_fieldname;
  2177. char* sid_fieldname;
  2178. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2179. {
  2180. act_fieldname = "sAMAccountName";
  2181. sid_fieldname = "objectSid";
  2182. }
  2183. else
  2184. {
  2185. act_fieldname = "uid";
  2186. sid_fieldname = "entryid";
  2187. }
  2188. if(searchstr && *searchstr && strcmp(searchstr, "*") != 0)
  2189. {
  2190. filter.insert(0, "(&(");
  2191. filter.appendf(")(|(%s=*%s*)(%s=*%s*)(%s=*%s*)))", act_fieldname, searchstr, "givenName", searchstr, "sn", searchstr);
  2192. }
  2193. char *attrs[] = {act_fieldname, sid_fieldname, "cn", "userAccountControl", "pwdLastSet", "employeeId", NULL};
  2194. CPagedLDAPSearch pagedSrch(ld, m_ldapconfig->getLdapTimeout(), (char*)m_ldapconfig->getUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs);
  2195. for (message = pagedSrch.getFirstEntry(); message; message = pagedSrch.getNextEntry())
  2196. {
  2197. bool accountPwdNeverExpires = false;
  2198. Owned<ISecUser> user = new CLdapSecUser("", "");
  2199. // Go through the search results by checking message types
  2200. CLDAPGetAttributesWrapper atts(ld, message);
  2201. for ( attribute = atts.getFirst();
  2202. attribute != NULL;
  2203. attribute = atts.getNext())
  2204. {
  2205. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  2206. if (!vals.hasValues())
  2207. continue;
  2208. if(stricmp(attribute, "cn") == 0)
  2209. {
  2210. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  2211. if (vals.hasValues())
  2212. user->setFullName(vals.queryCharValue(0));
  2213. }
  2214. else if (stricmp(attribute, "userAccountControl") == 0)
  2215. {
  2216. //UF_DONT_EXPIRE_PASSWD 0x10000
  2217. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  2218. if (vals.hasValues())
  2219. if (atoi((char*)vals.queryCharValue(0)) & 0x10000)//this can be true at the account level, even if domain policy requires password
  2220. accountPwdNeverExpires = true;
  2221. }
  2222. else if(stricmp(attribute, "pwdLastSet") == 0)
  2223. {
  2224. CDateTime expiry;
  2225. if (!m_domainPwdsNeverExpire && !accountPwdNeverExpires)
  2226. {
  2227. CLDAPGetValuesLenWrapper valsLen(ld, message, attribute);
  2228. if (valsLen.hasValues())
  2229. {
  2230. struct berval* val = valsLen.queryBValues()[0];
  2231. calcPWExpiry(expiry, (unsigned)val->bv_len, val->bv_val);
  2232. }
  2233. }
  2234. else
  2235. expiry.clear();
  2236. user->setPasswordExpiration(expiry);
  2237. }
  2238. else if(stricmp(attribute, act_fieldname) == 0)
  2239. {
  2240. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  2241. if (vals.hasValues())
  2242. user->setName(vals.queryCharValue(0));
  2243. }
  2244. else if(stricmp(attribute, sid_fieldname) == 0)
  2245. {
  2246. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2247. {
  2248. CLDAPGetValuesLenWrapper valsLen(ld, message, attribute);
  2249. if (valsLen.hasValues())
  2250. {
  2251. struct berval* val = valsLen.queryBValues()[0];
  2252. if(val != NULL)
  2253. {
  2254. unsigned uid = val->bv_val[val->bv_len - 4];
  2255. int i;
  2256. for(i = 3; i > 0; i--)
  2257. {
  2258. uid = (uid << 8) + val->bv_val[val->bv_len - i];
  2259. }
  2260. ((CLdapSecUser*)user.get())->setUserID(uid);
  2261. }
  2262. }
  2263. }
  2264. else
  2265. {
  2266. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  2267. if (vals.hasValues())
  2268. ((CLdapSecUser*)user.get())->setUserID(atoi(vals.queryCharValue(0)));
  2269. }
  2270. }
  2271. else if(stricmp(attribute, "employeeId") == 0)
  2272. {
  2273. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  2274. if (vals.hasValues())
  2275. user->setEmployeeID(vals.queryCharValue(0));
  2276. }
  2277. }
  2278. if (user->getName() && *user->getName())
  2279. users.append(*LINK(user.get()));
  2280. }
  2281. return true;
  2282. }
  2283. virtual IPropertyTreeIterator* getUserIterator(const char* userName)
  2284. {
  2285. IUserArray users;
  2286. retrieveUsers(userName, users);
  2287. Owned<IPropertyTree> usersTree = createPTree("Users");
  2288. ForEachItemIn(i, users)
  2289. addUserTree(users.item(i), usersTree);
  2290. return usersTree->getElements("*");
  2291. }
  2292. void addUserTree(ISecUser& usr, IPropertyTree* users)
  2293. {
  2294. const char* usrName = usr.getName();
  2295. if(!usrName || !*usrName)
  2296. {
  2297. DBGLOG("CLdapClient::addUserTree username must be provided");
  2298. return;
  2299. }
  2300. const char* fullName = usr.getFullName();
  2301. StringBuffer sb;
  2302. switch (usr.getPasswordDaysRemaining())//-1 if expired, -2 if never expires
  2303. {
  2304. case scPasswordExpired:
  2305. sb.set("Expired");
  2306. break;
  2307. case scPasswordNeverExpires:
  2308. sb.set("Never");
  2309. break;
  2310. default:
  2311. CDateTime dt;
  2312. usr.getPasswordExpiration(dt);
  2313. dt.getDateString(sb);
  2314. break;
  2315. }
  2316. Owned<IPTree> userTree = createPTree("User");
  2317. userTree->addProp(getUserFieldNames(UFName), usrName);
  2318. if (fullName && *fullName)
  2319. userTree->addProp(getUserFieldNames(UFFullName), fullName);
  2320. userTree->addPropInt(getUserFieldNames(UFUserID), usr.getUserID());
  2321. userTree->addProp(getUserFieldNames(UFPasswordExpiration), sb.str());
  2322. userTree->addProp(getUserFieldNames(UFEmployeeID), usr.getEmployeeID());
  2323. users->addPropTree("User", userTree.getClear());
  2324. }
  2325. ISecItemIterator* getUsersSorted(const char* userName, UserField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize, unsigned* total, __int64* cacheHint)
  2326. {
  2327. class CElementsPager : public CSimpleInterface, implements IElementsPager
  2328. {
  2329. ILdapClient* ldapClient;
  2330. StringAttr userName;
  2331. StringAttr sortOrder;
  2332. public:
  2333. IMPLEMENT_IINTERFACE_USING(CSimpleInterface);
  2334. CElementsPager(ILdapClient* _ldapClient, const char* _userName, const char*_sortOrder)
  2335. : ldapClient(_ldapClient), userName(_userName), sortOrder(_sortOrder) { };
  2336. virtual IRemoteConnection* getElements(IArrayOf<IPropertyTree>& elements)
  2337. {
  2338. StringArray unknownAttributes;
  2339. Owned<IPropertyTreeIterator> iter = ldapClient->getUserIterator(userName.get());
  2340. sortElements(iter, sortOrder.get(), NULL, NULL, unknownAttributes, elements);
  2341. return NULL;
  2342. }
  2343. virtual bool allMatchingElementsReceived() { return true; }//For now, ldap always returns all of matched users.
  2344. };
  2345. StringBuffer so;
  2346. if (sortOrder)
  2347. {
  2348. for (unsigned i=0;sortOrder[i]!=UFterm;i++)
  2349. {
  2350. if (so.length())
  2351. so.append(',');
  2352. int fmt = sortOrder[i];
  2353. if (fmt&UFreverse)
  2354. so.append('-');
  2355. if (fmt&UFnocase)
  2356. so.append('?');
  2357. if (fmt&UFnumeric)
  2358. so.append('#');
  2359. so.append(getUserFieldNames((UserField) (fmt&0xff)));
  2360. }
  2361. }
  2362. IArrayOf<IPropertyTree> results;
  2363. Owned<IElementsPager> elementsPager = new CElementsPager(this, userName, so.length()?so.str():NULL);
  2364. Owned<IRemoteConnection> conn=getElementsPaged(elementsPager, pageStartFrom, pageSize, NULL, "", cacheHint, results, total, NULL, false);
  2365. return new CSecItemIterator(results);
  2366. }
  2367. virtual bool userInGroup(const char* userdn, const char* groupdn)
  2368. {
  2369. const char* fldname;
  2370. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2371. fldname = "member";
  2372. else
  2373. fldname = "uniquemember";
  2374. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2375. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2376. int rc = LDAP_COMPARE_EXT_S(ld, (const char*)groupdn, (const char*)fldname, (const char*)userdn,0,0,0);
  2377. #ifndef _WIN32
  2378. if (rc == -3)//389DirectoryServer always seems to return -3
  2379. rc = ldap_compare_s(ld, groupdn, fldname, userdn);
  2380. #endif
  2381. if(rc == LDAP_COMPARE_TRUE)
  2382. return true;
  2383. else
  2384. return false;
  2385. }
  2386. // Update user's firstname, lastname (plus displayname for active directory).
  2387. virtual bool updateUser(const char* type, ISecUser& user)
  2388. {
  2389. const char* username = user.getName();
  2390. if(!username || !*username)
  2391. {
  2392. DBGLOG("CLdapClient::updateUser username must be provided");
  2393. return false;
  2394. }
  2395. StringBuffer userdn;
  2396. getUserDN(username, userdn);
  2397. int rc = LDAP_SUCCESS;
  2398. if(!type || !*type || stricmp(type, "names") == 0)
  2399. {
  2400. StringBuffer cnbuf;
  2401. const char* fname = user.getFirstName();
  2402. const char* lname = user.getLastName();
  2403. if(fname && *fname && lname && *lname)
  2404. {
  2405. cnbuf.append(fname).append(" ").append(lname);
  2406. }
  2407. else
  2408. throw MakeStringException(-1, "Please specify both firstname and lastname");
  2409. char *gn_values[] = { (char*)fname, NULL };
  2410. LDAPMod gn_attr = {
  2411. LDAP_MOD_REPLACE,
  2412. "givenName",
  2413. gn_values
  2414. };
  2415. char *sn_values[] = { (char*)lname, NULL };
  2416. LDAPMod sn_attr = {
  2417. LDAP_MOD_REPLACE,
  2418. "sn",
  2419. sn_values
  2420. };
  2421. char *cn_values[] = {(char*)cnbuf.str(), NULL };
  2422. LDAPMod cn_attr =
  2423. {
  2424. LDAP_MOD_REPLACE,
  2425. "cn",
  2426. cn_values
  2427. };
  2428. char *dispname_values[] = {(char*)cnbuf.str(), NULL };
  2429. LDAPMod dispname_attr =
  2430. {
  2431. LDAP_MOD_REPLACE,
  2432. "displayName",
  2433. dispname_values
  2434. };
  2435. const char * emplID = user.getEmployeeID();
  2436. char *employeeID_values[] = {(emplID && *emplID) ? (char*)emplID : nullptr, nullptr };
  2437. LDAPMod employeeID_attr =
  2438. {
  2439. LDAP_MOD_REPLACE,
  2440. "employeeId",
  2441. employeeID_values
  2442. };
  2443. LDAPMod *attrs[5];
  2444. int ind = 0;
  2445. attrs[ind++] = &gn_attr;
  2446. attrs[ind++] = &sn_attr;
  2447. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2448. {
  2449. attrs[ind++] = &dispname_attr;
  2450. }
  2451. else
  2452. {
  2453. attrs[ind++] = &cn_attr;
  2454. }
  2455. attrs[ind++] = &employeeID_attr;
  2456. attrs[ind] = NULL;
  2457. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2458. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2459. rc = ldap_modify_ext_s(ld, (char*)userdn.str(), attrs, NULL, NULL);
  2460. if (rc == LDAP_SUCCESS && m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2461. {
  2462. StringBuffer newrdn("cn=");
  2463. newrdn.append(cnbuf.str());
  2464. rc = LdapRename(ld, (char*)userdn.str(), (char*)newrdn.str(), NULL, true, NULL, NULL);
  2465. }
  2466. }
  2467. else if(stricmp(type, "posixenable") == 0)
  2468. {
  2469. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2470. throw MakeStringException(-1, "posixAccount isn't applicable to Active Directory");
  2471. CLdapSecUser* ldapuser = dynamic_cast<CLdapSecUser*>(&user);
  2472. if (ldapuser == nullptr)
  2473. {
  2474. throw MakeStringException(-1, "Unable to cast user %s to CLdapSecUser", username);
  2475. }
  2476. char* oc_values[] = {"posixAccount", NULL};
  2477. LDAPMod oc_attr = {
  2478. LDAP_MOD_ADD,
  2479. "objectclass",
  2480. oc_values
  2481. };
  2482. char* oc1_values[] = {"shadowAccount", NULL};
  2483. LDAPMod oc1_attr = {
  2484. LDAP_MOD_ADD,
  2485. "objectclass",
  2486. oc1_values
  2487. };
  2488. char *gidnum_values[] = { (char*)ldapuser->getGidnumber(), NULL };
  2489. LDAPMod gidnum_attr = {
  2490. LDAP_MOD_REPLACE,
  2491. "gidnumber",
  2492. gidnum_values
  2493. };
  2494. char *uidnum_values[] = { (char*)ldapuser->getUidnumber(), NULL };
  2495. LDAPMod uidnum_attr = {
  2496. LDAP_MOD_REPLACE,
  2497. "uidnumber",
  2498. uidnum_values
  2499. };
  2500. char *homedir_values[] = {(char*)ldapuser->getHomedirectory(), NULL };
  2501. LDAPMod homedir_attr =
  2502. {
  2503. LDAP_MOD_REPLACE,
  2504. "homedirectory",
  2505. homedir_values
  2506. };
  2507. char *loginshell_values[] = {(char*)ldapuser->getLoginshell(), NULL };
  2508. LDAPMod loginshell_attr =
  2509. {
  2510. LDAP_MOD_REPLACE,
  2511. "loginshell",
  2512. loginshell_values
  2513. };
  2514. LDAPMod *attrs[7];
  2515. int ind = 0;
  2516. attrs[ind++] = &gidnum_attr;
  2517. attrs[ind++] = &uidnum_attr;
  2518. attrs[ind++] = &homedir_attr;
  2519. attrs[ind++] = &loginshell_attr;
  2520. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2521. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2522. int compresult = LDAP_COMPARE_EXT_S(ld, (const char*)userdn.str(), (const char*)"objectclass", (const char*)"posixAccount",0,0,0);
  2523. #ifndef _WIN32
  2524. if (compresult == -3)//389DirectoryServer always seems to return -3
  2525. compresult = ldap_compare_s(ld, userdn.str(), "objectclass", "posixAccount");
  2526. #endif
  2527. if(compresult != LDAP_COMPARE_TRUE)
  2528. attrs[ind++] = &oc_attr;
  2529. compresult = LDAP_COMPARE_EXT_S(ld, (const char*)userdn.str(), (const char*)"objectclass", (const char*)"shadowAccount",0,0,0);
  2530. #ifndef _WIN32
  2531. if (compresult == -3)//389DirectoryServer always seems to return -3
  2532. compresult = ldap_compare_s(ld, userdn.str(), "objectclass", "shadowAccount");
  2533. #endif
  2534. if(compresult != LDAP_COMPARE_TRUE)
  2535. attrs[ind++] = &oc1_attr;
  2536. attrs[ind] = NULL;
  2537. rc = ldap_modify_ext_s(ld, (char*)userdn.str(), attrs, NULL, NULL);
  2538. }
  2539. else if(stricmp(type, "posixdisable") == 0)
  2540. {
  2541. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  2542. throw MakeStringException(-1, "posixAccount isn't applicable to Active Directory");
  2543. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2544. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2545. int compresult = LDAP_COMPARE_EXT_S(ld, (const char*)userdn.str(), (const char*)"objectclass", (const char*)"posixAccount",0,0,0);
  2546. #ifndef _WIN32
  2547. if (compresult == -3)//389DirectoryServer always seems to return -3
  2548. compresult = ldap_compare_s(ld, userdn.str(), "objectclass", "posixAccount");
  2549. #endif
  2550. if(compresult != LDAP_COMPARE_TRUE)
  2551. {
  2552. rc = LDAP_SUCCESS;
  2553. }
  2554. else
  2555. {
  2556. char* oc_values[] = {"posixAccount", NULL};
  2557. LDAPMod oc_attr = {
  2558. LDAP_MOD_DELETE,
  2559. "objectclass",
  2560. oc_values
  2561. };
  2562. char* oc1_values[] = {"shadowAccount", NULL};
  2563. LDAPMod oc1_attr = {
  2564. LDAP_MOD_DELETE,
  2565. "objectclass",
  2566. oc1_values
  2567. };
  2568. char *gidnum_values[] = { NULL };
  2569. LDAPMod gidnum_attr = {
  2570. LDAP_MOD_DELETE,
  2571. "gidnumber",
  2572. gidnum_values
  2573. };
  2574. char *uidnum_values[] = {NULL };
  2575. LDAPMod uidnum_attr = {
  2576. LDAP_MOD_DELETE,
  2577. "uidnumber",
  2578. uidnum_values
  2579. };
  2580. char *homedir_values[] = { NULL };
  2581. LDAPMod homedir_attr =
  2582. {
  2583. LDAP_MOD_DELETE,
  2584. "homedirectory",
  2585. homedir_values
  2586. };
  2587. char *loginshell_values[] = { NULL };
  2588. LDAPMod loginshell_attr =
  2589. {
  2590. LDAP_MOD_DELETE,
  2591. "loginshell",
  2592. loginshell_values
  2593. };
  2594. LDAPMod *attrs[7];
  2595. int ind = 0;
  2596. attrs[ind++] = &gidnum_attr;
  2597. attrs[ind++] = &uidnum_attr;
  2598. attrs[ind++] = &homedir_attr;
  2599. attrs[ind++] = &loginshell_attr;
  2600. attrs[ind++] = &oc_attr;
  2601. attrs[ind++] = &oc1_attr;
  2602. attrs[ind] = NULL;
  2603. rc = ldap_modify_ext_s(ld, (char*)userdn.str(), attrs, NULL, NULL);
  2604. }
  2605. }
  2606. else if(stricmp(type, "sudoersadd") == 0)
  2607. {
  2608. CLdapSecUser* ldapuser = dynamic_cast<CLdapSecUser*>(&user);
  2609. if (ldapuser == nullptr)
  2610. {
  2611. throw MakeStringException(-1, "Unable to cast user %s to CLdapSecUser", username);
  2612. }
  2613. char *cn_values[] = {(char*)username, NULL };
  2614. LDAPMod cn_attr =
  2615. {
  2616. LDAP_MOD_ADD,
  2617. "cn",
  2618. cn_values
  2619. };
  2620. char *oc_values[] = {"sudoRole", NULL };
  2621. LDAPMod oc_attr =
  2622. {
  2623. LDAP_MOD_ADD,
  2624. "objectClass",
  2625. oc_values
  2626. };
  2627. char *user_values[] = {(char*)username, NULL };
  2628. LDAPMod user_attr =
  2629. {
  2630. LDAP_MOD_ADD,
  2631. "sudoUser",
  2632. user_values
  2633. };
  2634. char* sudoHost = (char*)ldapuser->getSudoHost();
  2635. char* sudoCommand = (char*)ldapuser->getSudoCommand();
  2636. char* sudoOption = (char*)ldapuser->getSudoOption();
  2637. char *host_values[] = {sudoHost, NULL };
  2638. LDAPMod host_attr =
  2639. {
  2640. LDAP_MOD_ADD,
  2641. "sudoHost",
  2642. host_values
  2643. };
  2644. char *cmd_values[] = {sudoCommand, NULL };
  2645. LDAPMod cmd_attr =
  2646. {
  2647. LDAP_MOD_ADD,
  2648. "sudoCommand",
  2649. cmd_values
  2650. };
  2651. char *option_values[] = {sudoOption, NULL };
  2652. LDAPMod option_attr =
  2653. {
  2654. LDAP_MOD_ADD,
  2655. "sudoOption",
  2656. option_values
  2657. };
  2658. LDAPMod *attrs[8];
  2659. int ind = 0;
  2660. attrs[ind++] = &cn_attr;
  2661. attrs[ind++] = &oc_attr;
  2662. attrs[ind++] = &user_attr;
  2663. if(sudoHost && *sudoHost)
  2664. attrs[ind++] = &host_attr;
  2665. if(sudoCommand && *sudoCommand)
  2666. attrs[ind++] = &cmd_attr;
  2667. if(sudoOption && *sudoOption)
  2668. attrs[ind++] = &option_attr;
  2669. attrs[ind] = NULL;
  2670. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2671. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2672. StringBuffer dn;
  2673. dn.append("cn=").append(username).append(",").append(m_ldapconfig->getResourceBasedn(RT_SUDOERS));
  2674. int rc = ldap_add_ext_s(ld, (char*)dn.str(), attrs, NULL, NULL);
  2675. if ( rc != LDAP_SUCCESS )
  2676. {
  2677. if(rc == LDAP_ALREADY_EXISTS)
  2678. {
  2679. throw MakeStringException(-1, "can't add %s to sudoers, an LDAP object with this name already exists", username);
  2680. }
  2681. else
  2682. {
  2683. DBGLOG("error adding %s to sudoers: %s", username, ldap_err2string( rc ));
  2684. throw MakeStringException(-1, "error adding %s to sudoers: %s", username, ldap_err2string( rc ));
  2685. }
  2686. }
  2687. }
  2688. else if(stricmp(type, "sudoersdelete") == 0)
  2689. {
  2690. StringBuffer dn;
  2691. dn.append("cn=").append(username).append(",").append(m_ldapconfig->getResourceBasedn(RT_SUDOERS));
  2692. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2693. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2694. int rc = ldap_delete_ext_s(ld, (char*)dn.str(), NULL, NULL);
  2695. if ( rc != LDAP_SUCCESS )
  2696. {
  2697. throw MakeStringException(-1, "Error deleting user %s from sudoers: %s", username, ldap_err2string(rc));
  2698. }
  2699. }
  2700. else if(stricmp(type, "sudoersupdate") == 0)
  2701. {
  2702. CLdapSecUser* ldapuser = dynamic_cast<CLdapSecUser*>(&user);
  2703. if (ldapuser == nullptr)
  2704. {
  2705. throw MakeStringException(-1, "Unable to cast user %s to CLdapSecUser", username);
  2706. }
  2707. char* sudoHost = (char*)ldapuser->getSudoHost();
  2708. char* sudoCommand = (char*)ldapuser->getSudoCommand();
  2709. char* sudoOption = (char*)ldapuser->getSudoOption();
  2710. char *host_values[] = {(sudoHost&&*sudoHost)?sudoHost:NULL, NULL };
  2711. LDAPMod host_attr =
  2712. {
  2713. LDAP_MOD_REPLACE,
  2714. "sudoHost",
  2715. host_values
  2716. };
  2717. char *cmd_values[] = {(sudoCommand&&*sudoCommand)?sudoCommand:NULL, NULL };
  2718. LDAPMod cmd_attr =
  2719. {
  2720. LDAP_MOD_REPLACE,
  2721. "sudoCommand",
  2722. cmd_values
  2723. };
  2724. char *option_values[] = {(sudoOption&&*sudoOption)?sudoOption:NULL, NULL };
  2725. LDAPMod option_attr =
  2726. {
  2727. LDAP_MOD_REPLACE,
  2728. "sudoOption",
  2729. option_values
  2730. };
  2731. LDAPMod *attrs[4];
  2732. int ind = 0;
  2733. attrs[ind++] = &host_attr;
  2734. attrs[ind++] = &cmd_attr;
  2735. attrs[ind++] = &option_attr;
  2736. attrs[ind] = NULL;
  2737. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2738. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2739. StringBuffer dn;
  2740. dn.append("cn=").append(username).append(",").append(m_ldapconfig->getResourceBasedn(RT_SUDOERS));
  2741. int rc = ldap_modify_ext_s(ld, (char*)dn.str(), attrs, NULL, NULL);
  2742. if ( rc != LDAP_SUCCESS )
  2743. {
  2744. DBGLOG("error modifying sudoers for user %s: %s", username, ldap_err2string( rc ));
  2745. throw MakeStringException(-1, "error modifying sudoers for user %s: %s", username, ldap_err2string( rc ));
  2746. }
  2747. }
  2748. if (rc == LDAP_SUCCESS )
  2749. DBGLOG("User %s successfully updated", username);
  2750. else
  2751. throw MakeStringException(-1, "Error updating user %s - %s", username, ldap_err2string( rc ));
  2752. return true;
  2753. }
  2754. virtual bool changePasswordSSL(const char* username, const char* newPassword)
  2755. {
  2756. Owned<ILdapConnection> lconn;
  2757. try
  2758. {
  2759. lconn.setown(m_connections->getSSLConnection());
  2760. }
  2761. catch(IException*)
  2762. {
  2763. throw MakeStringException(-1, "Failed to set user %s's password because of not being able to create an SSL connection to the ldap server. To set an Active Directory user's password from Linux, you need to enable SSL on the Active Directory ldap server", username);
  2764. }
  2765. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2766. char *attribute, **values = NULL;
  2767. LDAPMessage *message;
  2768. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  2769. StringBuffer filter;
  2770. filter.append("sAMAccountName=").append(username);
  2771. char *attrs[] = {"distinguishedName", NULL};
  2772. CLDAPMessage searchResult;
  2773. int rc = ldap_search_ext_s(ld, (char*)m_ldapconfig->getUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  2774. if ( rc != LDAP_SUCCESS )
  2775. {
  2776. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getUserBasedn());
  2777. return false;
  2778. }
  2779. StringBuffer userdn;
  2780. message = LdapFirstEntry( ld, searchResult);
  2781. if(message != NULL)
  2782. {
  2783. CLDAPGetAttributesWrapper atts(ld, searchResult);
  2784. for ( attribute = atts.getFirst();
  2785. attribute != NULL;
  2786. attribute = atts.getNext())
  2787. {
  2788. if(0 == stricmp(attribute, "distinguishedName"))
  2789. {
  2790. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  2791. if (vals.hasValues())
  2792. userdn.set(vals.queryCharValue(0));
  2793. break;
  2794. }
  2795. }
  2796. }
  2797. if(userdn.length() == 0)
  2798. {
  2799. throw MakeStringException(-1, "can't find dn for user %s", username);
  2800. }
  2801. LDAPMod modPassword;
  2802. LDAPMod *modEntry[2];
  2803. struct berval pwdBerVal;
  2804. struct berval *pwd_attr[2];
  2805. unsigned short pszPasswordWithQuotes[1024];
  2806. modEntry[0] = &modPassword;
  2807. modEntry[1] = NULL;
  2808. modPassword.mod_op = LDAP_MOD_REPLACE | LDAP_MOD_BVALUES;
  2809. modPassword.mod_type = "unicodePwd";
  2810. modPassword.mod_vals.modv_bvals = pwd_attr;
  2811. pwd_attr[0] = &pwdBerVal;
  2812. pwd_attr[1]= NULL;
  2813. StringBuffer quotedPasswd("\"");
  2814. quotedPasswd.append(newPassword).append("\"");
  2815. ConvertCToW(pszPasswordWithQuotes, quotedPasswd);
  2816. pwdBerVal.bv_len = quotedPasswd.length() * sizeof(unsigned short);
  2817. pwdBerVal.bv_val = (char*)pszPasswordWithQuotes;
  2818. rc = ldap_modify_ext_s(ld, (char*)userdn.str(), modEntry, NULL, NULL);
  2819. if (rc == LDAP_SUCCESS )
  2820. DBGLOG("User %s's password has been changed successfully", username);
  2821. else
  2822. {
  2823. StringBuffer errmsg;
  2824. errmsg.appendf("Error setting password for %s - (%d) %s.", username, rc, ldap_err2string( rc ));
  2825. if(rc == LDAP_UNWILLING_TO_PERFORM)
  2826. errmsg.append(" The ldap server refused to change the password. Usually this is because your new password doesn't satisfy the domain policy.");
  2827. throw MakeStringExceptionDirect(-1, errmsg.str());
  2828. }
  2829. return true;
  2830. }
  2831. virtual bool queryPasswordStatus(ISecUser& user, const char* password)
  2832. {
  2833. char *ldap_errstring = NULL;
  2834. const char * username = user.getName();
  2835. StringBuffer userdn;
  2836. getUserDN(user.getName(), userdn);
  2837. StringBuffer hostbuf;
  2838. m_ldapconfig->getLdapHost(hostbuf);
  2839. LDAP* user_ld = LdapUtils::LdapInit(m_ldapconfig->getProtocol(), hostbuf.str(), m_ldapconfig->getLdapPort(), m_ldapconfig->getLdapSecurePort());
  2840. int rc = LdapUtils::LdapBind(user_ld, m_ldapconfig->getLdapTimeout(),m_ldapconfig->getDomain(), username, password, userdn, m_ldapconfig->getServerType(), m_ldapconfig->getAuthMethod());
  2841. if(rc != LDAP_SUCCESS)
  2842. ldap_get_option(user_ld, LDAP_OPT_ERROR_STRING, &ldap_errstring);
  2843. LDAP_UNBIND(user_ld);
  2844. //Error string ""80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 532, v1db0."
  2845. //is returned if pw valid but expired
  2846. if(rc == LDAP_SUCCESS || strstr(ldap_errstring, "data 532") || strstr(ldap_errstring, "data 773"))//
  2847. return true;
  2848. else
  2849. return false;
  2850. }
  2851. virtual bool updateUserPassword(ISecUser& user, const char* newPassword, const char* currPassword)
  2852. {
  2853. const char* username = user.getName();
  2854. if(!username || !*username)
  2855. {
  2856. DBGLOG("CLdapClient::updateUserPassword username must be provided");
  2857. return false;
  2858. }
  2859. if (currPassword)
  2860. {
  2861. //User will not be authenticated if their password was expired,
  2862. //so check here that they provided a valid one in the "change
  2863. //password" form (use the one they type, not the one in the secuser)
  2864. bool validated = queryPasswordStatus(user, currPassword);
  2865. if (!validated)
  2866. throw MakeStringException(-1, "Password not changed, invalid credentials");
  2867. }
  2868. return updateUserPassword(username, newPassword);
  2869. }
  2870. virtual bool updateUserPassword(const char* username, const char* newPassword)
  2871. {
  2872. if(!username || !*username)
  2873. {
  2874. DBGLOG("CLdapClient::updateUserPassword username must be provided");
  2875. return false;
  2876. }
  2877. const char* sysuser = m_ldapconfig->getSysUser();
  2878. if(sysuser && *sysuser && strcmp(username, sysuser) == 0)
  2879. throw MakeStringException(-1, "You can't change password of the system user.");
  2880. LdapServerType servertype = m_ldapconfig->getServerType();
  2881. bool ret = true;
  2882. if(servertype == ACTIVE_DIRECTORY)
  2883. {
  2884. #ifdef _WIN32
  2885. DWORD nStatus = 0;
  2886. // The application has to run on the same domain as ldap host, and under an administrative user.
  2887. USER_INFO_1003 usriSetPassword;
  2888. StringBuffer fullserver("\\\\");
  2889. StringBuffer server;
  2890. m_ldapconfig->getLdapHost(server);
  2891. fullserver.append(server.str());
  2892. LPWSTR whost = (LPWSTR)alloca((fullserver.length() +1) * sizeof(WCHAR));
  2893. ConvertCToW((unsigned short *)whost, fullserver.str());
  2894. LPWSTR wusername = (LPWSTR)alloca((strlen(username) + 1) * sizeof(WCHAR));
  2895. ConvertCToW((unsigned short *)wusername, username);
  2896. LPWSTR wnewpasswd = (LPWSTR)alloca((strlen(newPassword) + 1) * sizeof(WCHAR));
  2897. ConvertCToW((unsigned short *)wnewpasswd, newPassword);
  2898. usriSetPassword.usri1003_password = wnewpasswd;
  2899. nStatus = NetUserSetInfo(whost, wusername, 1003, (LPBYTE)&usriSetPassword, NULL);
  2900. if (nStatus == NERR_Success)
  2901. {
  2902. DBGLOG("User %s's password has been changed successfully", username);
  2903. return true;
  2904. }
  2905. else
  2906. {
  2907. StringBuffer errcode, errmsg;
  2908. if(nStatus == ERROR_ACCESS_DENIED)
  2909. {
  2910. errcode.append("ERROR_ACCESS_DENIED");
  2911. errmsg.append("The user does not have access to the requested information.");
  2912. }
  2913. else if(nStatus == ERROR_INVALID_PASSWORD)
  2914. {
  2915. errcode.append("ERROR_INVALID_PASSWORD");
  2916. errmsg.append("The user has entered an invalid password.");
  2917. }
  2918. else if(nStatus == NERR_InvalidComputer)
  2919. {
  2920. errcode.append("NERR_InvalidComputer");
  2921. errmsg.append("The computer name is invalid.");
  2922. }
  2923. else if(nStatus == NERR_NotPrimary)
  2924. {
  2925. errcode.append("NERR_NotPrimary");
  2926. errmsg.append("The operation is allowed only on the primary domain controller of the domain.");
  2927. }
  2928. else if(nStatus == NERR_UserNotFound)
  2929. {
  2930. errcode.append("NERR_UserNotFound");
  2931. errmsg.append("The user name could not be found.");
  2932. }
  2933. else if(nStatus == NERR_PasswordTooShort)
  2934. {
  2935. errcode.append("NERR_PasswordTooShort");
  2936. errmsg.append("The password is shorter than required. ");
  2937. }
  2938. else if(nStatus == ERROR_LOGON_FAILURE)
  2939. {
  2940. errcode.append("ERROR_LOGON_FAILURE");
  2941. errmsg.append("To be able to reset password this way, esp has to run under an administrative user on the same domain as the active directory. ");
  2942. }
  2943. else
  2944. {
  2945. errcode.appendf("%d", nStatus);
  2946. errmsg.append("");
  2947. }
  2948. // For certain errors just return, other errors try changePasswordSSL.
  2949. if(nStatus == ERROR_INVALID_PASSWORD || nStatus == NERR_UserNotFound || nStatus == NERR_PasswordTooShort)
  2950. throw MakeStringException(-1, "An error has occurred while setting password with NetUserSetInfo for %s: %s - %s\n", username, errcode.str(), errmsg.str());
  2951. else
  2952. DBGLOG("An error has occurred while setting password with NetUserSetInfo for %s: %s - %s\n", username, errcode.str(), errmsg.str());
  2953. }
  2954. DBGLOG("Trying changePasswordSSL to change password over regular SSL connection.");
  2955. #endif
  2956. changePasswordSSL(username, newPassword);
  2957. }
  2958. else
  2959. {
  2960. StringBuffer filter;
  2961. filter.append("uid=").append(username);
  2962. char **values = NULL;
  2963. LDAPMessage *message;
  2964. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  2965. Owned<ILdapConnection> lconn = m_connections->getConnection();
  2966. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  2967. char *attrs[] = {LDAP_NO_ATTRS, NULL};
  2968. CLDAPMessage searchResult;
  2969. int rc = ldap_search_ext_s(ld, (char*)m_ldapconfig->getUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  2970. if ( rc != LDAP_SUCCESS )
  2971. {
  2972. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getUserBasedn());
  2973. return false;
  2974. }
  2975. StringBuffer userdn;
  2976. message = LdapFirstEntry( ld, searchResult);
  2977. if(message != NULL)
  2978. {
  2979. char *p = ldap_get_dn(ld, message);
  2980. userdn.append(p);
  2981. ldap_memfree(p);
  2982. }
  2983. char* passwdvalue[] = { (char*)newPassword, NULL };
  2984. LDAPMod pmod =
  2985. {
  2986. LDAP_MOD_REPLACE,
  2987. "userpassword",
  2988. passwdvalue
  2989. };
  2990. LDAPMod* pmods[] = {&pmod, NULL};
  2991. rc = ldap_modify_ext_s(ld, (char*)userdn.str(), pmods, NULL, NULL);
  2992. if (rc == LDAP_SUCCESS )
  2993. DBGLOG("User %s's password has been changed successfully", username);
  2994. else
  2995. {
  2996. StringBuffer errmsg;
  2997. errmsg.appendf("Error changing password for %s - (%d) %s.", username, rc, ldap_err2string( rc ));
  2998. if(rc == LDAP_UNWILLING_TO_PERFORM)
  2999. errmsg.append(" The ldap server refused to execute the password change action, one of the reasons might be that the new password you entered doesn't satisfy the policy requirement.");
  3000. throw MakeStringExceptionDirect(-1, errmsg.str());
  3001. }
  3002. }
  3003. return true;
  3004. }
  3005. virtual bool getResources(SecResourceType rtype, const char * basedn, const char* prefix, IArrayOf<ISecResource>& resources)
  3006. {
  3007. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3008. return getResources( ((CLdapConnection*)lconn.get())->getLd(), rtype, basedn, prefix, resources);
  3009. }
  3010. virtual bool getResources(LDAP* ld, SecResourceType rtype, const char * basedn, const char* prefix, IArrayOf<ISecResource>& resources)
  3011. {
  3012. char *attribute;
  3013. LDAPMessage *message;
  3014. StringBuffer basednbuf;
  3015. LdapUtils::normalizeDn(basedn, m_ldapconfig->getBasedn(), basednbuf);
  3016. StringBuffer filter("objectClass=*");
  3017. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  3018. const char* fldname;
  3019. LdapServerType servertype = m_ldapconfig->getServerType();
  3020. if(servertype == ACTIVE_DIRECTORY && (rtype == RT_DEFAULT || rtype == RT_MODULE || rtype == RT_SERVICE))
  3021. fldname = "name";
  3022. else
  3023. fldname = "ou";
  3024. char *attrs[] = {(char*)fldname, "description", NULL};
  3025. CPagedLDAPSearch pagedSrch(ld, m_ldapconfig->getLdapTimeout(), (char*)basednbuf.str(), LDAP_SCOPE_ONELEVEL, (char*)filter.str(), attrs);
  3026. for (message = pagedSrch.getFirstEntry(); message; message = pagedSrch.getNextEntry())
  3027. {
  3028. // Go through the search results by checking message types
  3029. CLDAPGetAttributesWrapper atts(ld, message);
  3030. for ( attribute = atts.getFirst();
  3031. attribute != NULL;
  3032. attribute = atts.getNext())
  3033. {
  3034. StringBuffer descbuf;
  3035. StringBuffer curname;
  3036. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  3037. if (vals.hasValues())
  3038. {
  3039. const char* val = vals.queryCharValue(0);
  3040. if(val != NULL)
  3041. {
  3042. if(stricmp(attribute, fldname) == 0)
  3043. {
  3044. curname.append(val);
  3045. }
  3046. else if(stricmp(attribute, "description") == 0)
  3047. {
  3048. descbuf.append(val);
  3049. }
  3050. }
  3051. }
  3052. if(curname.length() == 0)
  3053. continue;
  3054. StringBuffer resourcename;
  3055. if(prefix != NULL && *prefix != '\0')
  3056. resourcename.append(prefix);
  3057. resourcename.append(curname.str());
  3058. CLdapSecResource* resource = new CLdapSecResource(resourcename.str());
  3059. resource->setDescription(descbuf.str());
  3060. resources.append(*resource);
  3061. if(rtype == RT_FILE_SCOPE || rtype == RT_WORKUNIT_SCOPE)
  3062. {
  3063. StringBuffer nextbasedn;
  3064. nextbasedn.append("ou=").append(curname.str()).append(",").append(basedn);
  3065. StringBuffer nextprefix;
  3066. if(prefix != NULL && *prefix != '\0')
  3067. nextprefix.append(prefix);
  3068. nextprefix.append(curname.str()).append("::");
  3069. getResources(ld, rtype, nextbasedn.str(), nextprefix.str(), resources);
  3070. }
  3071. }
  3072. }
  3073. return true;
  3074. }
  3075. virtual bool getResourcesEx(SecResourceType rtype, const char * basedn, const char* prefix, const char* searchstr, IArrayOf<ISecResource>& resources)
  3076. {
  3077. char *attribute;
  3078. LDAPMessage *message;
  3079. StringBuffer basednbuf;
  3080. LdapUtils::normalizeDn(basedn, m_ldapconfig->getBasedn(), basednbuf);
  3081. StringBuffer filter("objectClass=*");
  3082. if(searchstr && *searchstr && strcmp(searchstr, "*") != 0)
  3083. {
  3084. filter.insert(0, "(&(");
  3085. filter.appendf(")(|(%s=*%s*)))", "uNCName", searchstr);
  3086. }
  3087. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  3088. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3089. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  3090. const char* fldname;
  3091. LdapServerType servertype = m_ldapconfig->getServerType();
  3092. if(servertype == ACTIVE_DIRECTORY && (rtype == RT_DEFAULT || rtype == RT_MODULE || rtype == RT_SERVICE))
  3093. fldname = "name";
  3094. else
  3095. fldname = "ou";
  3096. char *attrs[] = {(char*)fldname, "description", NULL};
  3097. CPagedLDAPSearch pagedSrch(ld, m_ldapconfig->getLdapTimeout(), (char*)basednbuf.str(), LDAP_SCOPE_ONELEVEL, (char*)filter.str(), attrs);
  3098. for (message = pagedSrch.getFirstEntry(); message; message = pagedSrch.getNextEntry())
  3099. {
  3100. // Go through the search results by checking message types
  3101. StringBuffer descbuf;
  3102. StringBuffer curname;
  3103. CLDAPGetAttributesWrapper atts(ld, message);
  3104. for ( attribute = atts.getFirst();
  3105. attribute != NULL;
  3106. attribute = atts.getNext())
  3107. {
  3108. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  3109. if (vals.hasValues())
  3110. {
  3111. const char * val = vals.queryCharValue(0);
  3112. if(val != NULL)
  3113. {
  3114. if(stricmp(attribute, fldname) == 0)
  3115. {
  3116. curname.append(val);
  3117. }
  3118. else if(stricmp(attribute, "description") == 0)
  3119. {
  3120. descbuf.append(val);
  3121. }
  3122. }
  3123. }
  3124. }
  3125. if(curname.length() == 0)
  3126. continue;
  3127. StringBuffer resourcename;
  3128. if(prefix != NULL && *prefix != '\0')
  3129. resourcename.append(prefix);
  3130. resourcename.append(curname.str());
  3131. CLdapSecResource* resource = new CLdapSecResource(resourcename.str());
  3132. resource->setDescription(descbuf.str());
  3133. resources.append(*resource);
  3134. if(rtype == RT_FILE_SCOPE || rtype == RT_WORKUNIT_SCOPE)
  3135. {
  3136. StringBuffer nextbasedn;
  3137. nextbasedn.append("ou=").append(curname.str()).append(",").append(basedn);
  3138. StringBuffer nextprefix;
  3139. if(prefix != NULL && *prefix != '\0')
  3140. nextprefix.append(prefix);
  3141. nextprefix.append(curname.str()).append("::");
  3142. getResources(ld, rtype, nextbasedn.str(), nextprefix.str(), resources);
  3143. }
  3144. }
  3145. return true;
  3146. }
  3147. virtual IPropertyTreeIterator* getResourceIterator(SecResourceType rtype, const char * basedn,
  3148. const char* prefix, const char* resourceName, unsigned extraNameFilter)
  3149. {
  3150. IArrayOf<ISecResource> resources;
  3151. getResourcesEx(rtype, basedn, prefix, resourceName, resources);
  3152. Owned<IPTree> resourceTree = createPTree("Resources");
  3153. ForEachItemIn(i, resources)
  3154. {
  3155. ISecResource& resource = resources.item(i);
  3156. const char* resourceName = resource.getName();
  3157. if (!resourceName || !*resourceName)
  3158. continue;
  3159. if (checkResourceNameExtraFilter(rtype, resourceName, extraNameFilter))
  3160. addResourceTree(resourceName, resource.getDescription(), resourceTree);
  3161. }
  3162. return resourceTree->getElements("*");
  3163. }
  3164. bool checkResourceNameExtraFilter(SecResourceType rtype, const char* name, unsigned extraNameFilter)
  3165. {
  3166. if((rtype == RT_FILE_SCOPE) && (extraNameFilter & RF_RT_FILE_SCOPE_FILE) && strieq(name, "file"))
  3167. return false;
  3168. if((rtype == RT_MODULE) && (extraNameFilter & RF_RT_MODULE_NO_REPOSITORY) && strnicmp(name, "repository.", 11))
  3169. return false;
  3170. return true;
  3171. }
  3172. void addResourceTree(const char* name, const char* desc, IPropertyTree* elements)
  3173. {
  3174. if (!name || !*name)
  3175. {
  3176. DBGLOG("CLdapClient::addResourceTree resource name must be provided");
  3177. return;
  3178. }
  3179. Owned<IPTree> element = createPTree();
  3180. element->addProp(getResourceFieldNames(RFName), name);
  3181. if (desc && *desc)
  3182. element->addProp(getResourceFieldNames(RFDesc), desc);
  3183. elements->addPropTree("Resource", element.getClear());
  3184. }
  3185. ISecItemIterator* getResourcesSorted(SecResourceType rtype, const char * basedn, const char* resourceName, unsigned extraNameFilter,
  3186. ResourceField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize, unsigned* total, __int64* cacheHint)
  3187. {
  3188. class CElementsPager : public CSimpleInterface, implements IElementsPager
  3189. {
  3190. ILdapClient* ldapClient;
  3191. StringAttr sortOrder, basedn, resourceName;
  3192. SecResourceType rtype;
  3193. unsigned extraNameFilter;
  3194. public:
  3195. IMPLEMENT_IINTERFACE_USING(CSimpleInterface);
  3196. CElementsPager(ILdapClient* _ldapClient, SecResourceType _rtype, const char * _basedn, const char* _resourceName,
  3197. unsigned _extraNameFilter, const char*_sortOrder) : ldapClient(_ldapClient), rtype(_rtype), basedn(_basedn),
  3198. resourceName(_resourceName), extraNameFilter(_extraNameFilter), sortOrder(_sortOrder) { };
  3199. virtual IRemoteConnection* getElements(IArrayOf<IPropertyTree>& elements)
  3200. {
  3201. StringArray unknownAttributes;
  3202. Owned<IPropertyTreeIterator> iter = ldapClient->getResourceIterator(rtype, basedn.get(), "", resourceName.get(), extraNameFilter);
  3203. sortElements(iter, sortOrder.get(), NULL, NULL, unknownAttributes, elements);
  3204. return NULL;
  3205. }
  3206. virtual bool allMatchingElementsReceived() { return true; }//For now, ldap always returns all of matched users.
  3207. };
  3208. StringBuffer so;
  3209. if (sortOrder)
  3210. {
  3211. for (unsigned i=0;sortOrder[i]!=RFterm;i++)
  3212. {
  3213. if (so.length())
  3214. so.append(',');
  3215. int fmt = sortOrder[i];
  3216. if (fmt&UFreverse)
  3217. so.append('-');
  3218. if (fmt&UFnocase)
  3219. so.append('?');
  3220. if (fmt&UFnumeric)
  3221. so.append('#');
  3222. so.append(getUserFieldNames((UserField) (fmt&0xff)));
  3223. }
  3224. }
  3225. IArrayOf<IPropertyTree> results;
  3226. Owned<IElementsPager> elementsPager = new CElementsPager(this, rtype, basedn, resourceName, extraNameFilter, so.length()?so.str():NULL);
  3227. Owned<IRemoteConnection> conn=getElementsPaged(elementsPager, pageStartFrom, pageSize, NULL, "", cacheHint, results, total, NULL, false);
  3228. return new CSecItemIterator(results);
  3229. }
  3230. virtual bool getPermissionsArray(const char* basedn, SecResourceType rtype, const char* name, IArrayOf<CPermission>& permissions)
  3231. {
  3232. StringBuffer basednbuf;
  3233. LdapUtils::normalizeDn(basedn, m_ldapconfig->getBasedn(), basednbuf);
  3234. Owned<CSecurityDescriptor> sd = new CSecurityDescriptor(name);
  3235. IArrayOf<CSecurityDescriptor> sdlist;
  3236. sdlist.append(*LINK(sd));
  3237. if(rtype == RT_FILE_SCOPE || rtype == RT_WORKUNIT_SCOPE)
  3238. getSecurityDescriptorsScope(sdlist, basednbuf.str());
  3239. else
  3240. getSecurityDescriptors(sdlist, basednbuf.str());
  3241. m_pp->getPermissionsArray(sd.get(), permissions);
  3242. return true;
  3243. }
  3244. SecResourceType str2RType(const char* rtstr)
  3245. {
  3246. if(isEmptyString(rtstr))
  3247. return RT_DEFAULT;
  3248. else if(strieq(rtstr, "module"))
  3249. return RT_MODULE;
  3250. else if(strieq(rtstr, "service"))
  3251. return RT_SERVICE;
  3252. else if(strieq(rtstr, "file"))
  3253. return RT_FILE_SCOPE;
  3254. else if(strieq(rtstr, "workunit"))
  3255. return RT_WORKUNIT_SCOPE;
  3256. else
  3257. return RT_DEFAULT;
  3258. }
  3259. void addPermissionTree(CPermission& permission, enum ACCOUNT_TYPE_REQ accountType, IPropertyTree* permissionTree)
  3260. {
  3261. const char* accountName = permission.getAccount_name();
  3262. if(isEmptyString(accountName))
  3263. return;
  3264. ACT_TYPE type = permission.getAccount_type();
  3265. if ((accountType != REQ_ANY_ACT) && (type != (ACT_TYPE) accountType))
  3266. return;
  3267. Owned<IPTree> permissionNode = createPTree();
  3268. permissionNode->setProp(getResourcePermissionFieldNames(RPFName), accountName);
  3269. permissionNode->setPropInt(getResourcePermissionFieldNames(RPFType), type);
  3270. permissionNode->setPropInt(getResourcePermissionFieldNames(RPFAllow), permission.getAllows());
  3271. permissionNode->setPropInt(getResourcePermissionFieldNames(RPFDeny), permission.getDenies());
  3272. permissionTree->addPropTree("Permission", permissionNode.getClear());
  3273. }
  3274. virtual IPropertyTreeIterator* getResourcePermissionIterator(const char* name, enum ACCOUNT_TYPE_REQ accountType, const char* baseDN,
  3275. const char* rtype, const char* prefix)
  3276. {
  3277. StringBuffer namebuf(name);
  3278. SecResourceType type = str2RType(rtype);
  3279. if((type == RT_MODULE) && !strieq(name, "repository") && (strnicmp(name, "repository.", 11) != 0))
  3280. namebuf.insert(0, "repository.");
  3281. if(prefix && *prefix)
  3282. namebuf.insert(0, prefix);
  3283. IArrayOf<CPermission> permissions;
  3284. getPermissionsArray(baseDN, type, namebuf.str(), permissions);
  3285. Owned<IPropertyTree> permissionTree = createPTree("Permissions");
  3286. ForEachItemIn(i, permissions)
  3287. addPermissionTree(permissions.item(i), accountType, permissionTree);
  3288. return permissionTree->getElements("*");
  3289. }
  3290. ISecItemIterator* getResourcePermissionsSorted(const char* name, enum ACCOUNT_TYPE_REQ accountType, const char* baseDN, const char* rtype,
  3291. const char* prefix, ResourcePermissionField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize,
  3292. unsigned* total, __int64* cacheHint)
  3293. {
  3294. class CElementsPager : public CSimpleInterface, implements IElementsPager
  3295. {
  3296. ILdapClient* ldapClient;
  3297. StringAttr sortOrder, name, baseDN, rtype, prefix;
  3298. enum ACCOUNT_TYPE_REQ accountType;
  3299. public:
  3300. IMPLEMENT_IINTERFACE_USING(CSimpleInterface);
  3301. CElementsPager(ILdapClient* _ldapClient, const char* _name, enum ACCOUNT_TYPE_REQ _accountType, const char* _baseDN,
  3302. const char* _rtype, const char* _prefix, const char*_sortOrder) : ldapClient(_ldapClient), name(_name),
  3303. accountType(_accountType), baseDN(_baseDN), rtype(_rtype), prefix(_prefix), sortOrder(_sortOrder) { };
  3304. virtual IRemoteConnection* getElements(IArrayOf<IPropertyTree>& elements)
  3305. {
  3306. StringArray unknownAttributes;
  3307. Owned<IPropertyTreeIterator> iter = ldapClient->getResourcePermissionIterator(name.get(), accountType, baseDN.get(), rtype.get(), prefix.get());
  3308. sortElements(iter, sortOrder.get(), NULL, NULL, unknownAttributes, elements);
  3309. return NULL;
  3310. }
  3311. virtual bool allMatchingElementsReceived() { return true; }//For now, ldap always returns all of matched users.
  3312. };
  3313. StringBuffer so;
  3314. if (sortOrder)
  3315. {
  3316. for (unsigned i=0; sortOrder[i]!=RPFterm; i++)
  3317. {
  3318. if (so.length())
  3319. so.append(',');
  3320. int fmt = sortOrder[i];
  3321. if (fmt&RPFreverse)
  3322. so.append('-');
  3323. if (fmt&RPFnocase)
  3324. so.append('?');
  3325. if (fmt&RPFnumeric)
  3326. so.append('#');
  3327. so.append(getResourcePermissionFieldNames((ResourcePermissionField) (fmt&0xff)));
  3328. }
  3329. }
  3330. IArrayOf<IPropertyTree> results;
  3331. Owned<IElementsPager> elementsPager = new CElementsPager(this, name, accountType, baseDN, rtype, prefix, so.length()?so.str():NULL);
  3332. Owned<IRemoteConnection> conn=getElementsPaged(elementsPager, pageStartFrom, pageSize, NULL, "", cacheHint, results, total, NULL, false);
  3333. return new CSecItemIterator(results);
  3334. }
  3335. virtual void getAllGroups(StringArray & groups, StringArray & managedBy, StringArray & descriptions, const char * baseDN=nullptr)
  3336. {
  3337. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  3338. {
  3339. groups.append("Authenticated Users");
  3340. managedBy.append("");
  3341. descriptions.append("");
  3342. groups.append("Administrators");
  3343. managedBy.append("");
  3344. descriptions.append("");
  3345. }
  3346. else
  3347. {
  3348. groups.append("Directory Administrators");
  3349. managedBy.append("");
  3350. descriptions.append("");
  3351. }
  3352. char *attribute;
  3353. LDAPMessage *message;
  3354. StringBuffer filter;
  3355. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  3356. filter.append("objectClass=group");
  3357. else
  3358. filter.append("objectClass=groupofuniquenames");
  3359. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  3360. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3361. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  3362. char *attrs[] = {"cn", "managedBy", "description", NULL};
  3363. CPagedLDAPSearch pagedSrch(ld, m_ldapconfig->getLdapTimeout(), baseDN==nullptr ? (char*)m_ldapconfig->getGroupBasedn() : (char*)baseDN, LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs);
  3364. for (message = pagedSrch.getFirstEntry(); message; message = pagedSrch.getNextEntry())
  3365. {
  3366. // Go through the search results by checking message types
  3367. CLDAPGetAttributesWrapper atts(ld, message);
  3368. for ( attribute = atts.getFirst();
  3369. attribute != NULL;
  3370. attribute = atts.getNext())
  3371. {
  3372. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  3373. if (!vals.hasValues())
  3374. continue;
  3375. if(stricmp(attribute, "cn") == 0)
  3376. {
  3377. groups.append(vals.queryCharValue(0));
  3378. managedBy.append("");
  3379. descriptions.append("");
  3380. }
  3381. else if(stricmp(attribute, "managedBy") == 0)
  3382. managedBy.replace(vals.queryCharValue(0), groups.length() - 1);
  3383. else if(stricmp(attribute, "description") == 0)
  3384. descriptions.replace(vals.queryCharValue(0), groups.length() - 1);
  3385. }
  3386. }
  3387. }
  3388. virtual IPropertyTreeIterator* getGroupIterator()
  3389. {
  3390. StringArray groupNames, managedBy, descriptions;
  3391. getAllGroups(groupNames, managedBy, descriptions);
  3392. Owned<IPTree> groups = createPTree("Groups");
  3393. ForEachItemIn(i, groupNames)
  3394. addGroupTree(groupNames.item(i), managedBy.item(i), descriptions.item(i), groups);
  3395. return groups->getElements("*");
  3396. }
  3397. void addGroupTree(const char* name, const char* manageBy, const char* desc, IPropertyTree* groups)
  3398. {
  3399. if (!name || !*name)
  3400. {
  3401. DBGLOG("CLdapClient::addGroupTree groupname must be provided");
  3402. return;
  3403. }
  3404. Owned<IPTree> group = createPTree();
  3405. group->addProp(getGroupFieldNames(GFName), name);
  3406. if (manageBy && *manageBy)
  3407. group->addProp(getGroupFieldNames(GFManagedBy), manageBy);
  3408. if (desc && *desc)
  3409. group->addProp(getGroupFieldNames(GFDesc), desc);
  3410. groups->addPropTree("Group", group.getClear());
  3411. }
  3412. ISecItemIterator* getGroupsSorted(GroupField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize, unsigned* total, __int64* cacheHint)
  3413. {
  3414. class CElementsPager : public CSimpleInterface, implements IElementsPager
  3415. {
  3416. ILdapClient* ldapClient;
  3417. StringAttr sortOrder;
  3418. public:
  3419. IMPLEMENT_IINTERFACE_USING(CSimpleInterface);
  3420. CElementsPager(ILdapClient* _ldapClient, const char*_sortOrder)
  3421. : ldapClient(_ldapClient), sortOrder(_sortOrder) { };
  3422. virtual IRemoteConnection* getElements(IArrayOf<IPropertyTree>& elements)
  3423. {
  3424. StringArray unknownAttributes;
  3425. Owned<IPropertyTreeIterator> iter = ldapClient->getGroupIterator();
  3426. sortElements(iter, sortOrder.get(), NULL, NULL, unknownAttributes, elements);
  3427. return NULL;
  3428. }
  3429. virtual bool allMatchingElementsReceived() { return true; }//For now, ldap always returns all of matched users.
  3430. };
  3431. StringBuffer so;
  3432. if (sortOrder)
  3433. {
  3434. for (unsigned i=0;sortOrder[i]!=GFterm;i++)
  3435. {
  3436. if (so.length())
  3437. so.append(',');
  3438. int fmt = sortOrder[i];
  3439. if (fmt&UFreverse)
  3440. so.append('-');
  3441. if (fmt&UFnocase)
  3442. so.append('?');
  3443. if (fmt&UFnumeric)
  3444. so.append('#');
  3445. so.append(getUserFieldNames((UserField) (fmt&0xff)));
  3446. }
  3447. }
  3448. IArrayOf<IPropertyTree> results;
  3449. Owned<IElementsPager> elementsPager = new CElementsPager(this, so.length()?so.str():NULL);
  3450. Owned<IRemoteConnection> conn=getElementsPaged(elementsPager, pageStartFrom, pageSize, NULL, "", cacheHint, results, total, NULL, false);
  3451. return new CSecItemIterator(results);
  3452. }
  3453. virtual bool changePermission(CPermissionAction& action)
  3454. {
  3455. StringBuffer basednbuf;
  3456. LdapUtils::normalizeDn(action.m_basedn.str(), m_ldapconfig->getBasedn(), basednbuf);
  3457. Owned<CSecurityDescriptor> sd = new CSecurityDescriptor(action.m_rname.str());
  3458. IArrayOf<CSecurityDescriptor> sdlist;
  3459. sdlist.append(*LINK(sd));
  3460. if(action.m_rtype == RT_FILE_SCOPE || action.m_rtype == RT_WORKUNIT_SCOPE)
  3461. getSecurityDescriptorsScope(sdlist, basednbuf.str());
  3462. else
  3463. getSecurityDescriptors(sdlist, basednbuf.str());
  3464. if(m_ldapconfig->getServerType() != ACTIVE_DIRECTORY)
  3465. {
  3466. StringBuffer act_dn;
  3467. if(action.m_account_type == GROUP_ACT)
  3468. getGroupDN(action.m_account_name.str(), act_dn);
  3469. else
  3470. getUserDN(action.m_account_name.str(), act_dn);
  3471. action.m_account_name.clear().append(act_dn.str());
  3472. }
  3473. Owned<CSecurityDescriptor> newsd = m_pp->changePermission(sd.get(), action);
  3474. StringBuffer normdnbuf;
  3475. LdapServerType servertype = m_ldapconfig->getServerType();
  3476. name2dn(action.m_rtype, action.m_rname.str(), action.m_basedn.str(), normdnbuf);
  3477. char *empty_values[] = { NULL };
  3478. int numberOfSegs = m_pp->sdSegments(newsd.get());
  3479. LDAPMod *attrs[2];
  3480. LDAPMod sd_attr;
  3481. if(newsd->getDescriptor().length() > 0)
  3482. {
  3483. struct berval** sd_values = (struct berval**)alloca(sizeof(struct berval*)*(numberOfSegs+1));
  3484. MemoryBuffer& sdbuf = newsd->getDescriptor();
  3485. // Active Directory acutally has only one segment.
  3486. if(servertype == ACTIVE_DIRECTORY)
  3487. {
  3488. struct berval* sd_val = (struct berval*)alloca(sizeof(struct berval));
  3489. sd_val->bv_len = sdbuf.length();
  3490. sd_val->bv_val = (char*)sdbuf.toByteArray();
  3491. sd_values[0] = sd_val;
  3492. sd_values[1] = NULL;
  3493. sd_attr.mod_type = "nTSecurityDescriptor";
  3494. }
  3495. else
  3496. {
  3497. const char* bbptr = sdbuf.toByteArray();
  3498. const char* bptr = sdbuf.toByteArray();
  3499. int sdbuflen = sdbuf.length();
  3500. int segind;
  3501. for(segind = 0; segind < numberOfSegs; segind++)
  3502. {
  3503. if(bptr - bbptr >= sdbuflen)
  3504. break;
  3505. while(*bptr == '\0' && (bptr - bbptr) < sdbuflen)
  3506. bptr++;
  3507. const char* eptr = bptr;
  3508. while(*eptr != '\0' && (eptr - bbptr) < sdbuflen)
  3509. eptr++;
  3510. struct berval* sd_val = (struct berval*)alloca(sizeof(struct berval));
  3511. sd_val->bv_len = eptr - bptr;
  3512. sd_val->bv_val = (char*)bptr;
  3513. sd_values[segind] = sd_val;
  3514. bptr = eptr + 1;
  3515. }
  3516. sd_values[segind] = NULL;
  3517. sd_attr.mod_type = (char*)m_ldapconfig->getSdFieldName();
  3518. }
  3519. sd_attr.mod_op = LDAP_MOD_REPLACE | LDAP_MOD_BVALUES;
  3520. sd_attr.mod_vals.modv_bvals = sd_values;
  3521. attrs[0] = &sd_attr;
  3522. }
  3523. else
  3524. {
  3525. if(m_ldapconfig->getServerType() == OPEN_LDAP)
  3526. throw MakeStringException(-1, "removing all permissions for openldap is currently not supported");
  3527. sd_attr.mod_op = LDAP_MOD_DELETE;
  3528. sd_attr.mod_type = (char*)m_ldapconfig->getSdFieldName();
  3529. sd_attr.mod_vals.modv_strvals = empty_values;
  3530. attrs[0] = &sd_attr;
  3531. }
  3532. attrs[1] = NULL;
  3533. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3534. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  3535. int rc = ldap_modify_ext_s(ld, (char*)normdnbuf.str(), attrs, NULL, NULL);
  3536. if ( rc != LDAP_SUCCESS )
  3537. {
  3538. throw MakeStringException(-1, "ldap_modify_ext_s error: %d %s", rc, ldap_err2string( rc ));
  3539. }
  3540. return true;
  3541. }
  3542. virtual void getGroups(const char *user, StringArray& groups)
  3543. {
  3544. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  3545. {
  3546. char *attribute;
  3547. LDAPMessage *message;
  3548. if(user == NULL || strlen(user) == 0)
  3549. {
  3550. DBGLOG("CLdapClient::getGroups username must be provided");
  3551. return;
  3552. }
  3553. StringBuffer filter("sAMAccountName=");
  3554. filter.append(user);
  3555. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  3556. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3557. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  3558. char *attrs[] = {"memberOf", NULL};
  3559. CLDAPMessage searchResult;
  3560. int rc = ldap_search_ext_s(ld, (char*)m_ldapconfig->getUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  3561. if ( rc != LDAP_SUCCESS )
  3562. {
  3563. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getUserBasedn());
  3564. return;
  3565. }
  3566. unsigned entries = ldap_count_entries(ld, searchResult);
  3567. if(entries == 0)
  3568. {
  3569. searchResult.ldapMsgFree();
  3570. rc = ldap_search_ext_s(ld, (char*)m_ldapconfig->getSysUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  3571. if ( rc != LDAP_SUCCESS )
  3572. {
  3573. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getSysUserBasedn());
  3574. return;
  3575. }
  3576. }
  3577. // Go through the search results by checking message types
  3578. for(message = LdapFirstEntry( ld, searchResult); message != NULL; message = ldap_next_entry(ld, message))
  3579. {
  3580. CLDAPGetAttributesWrapper atts(ld, searchResult);
  3581. for ( attribute = atts.getFirst();
  3582. attribute != NULL;
  3583. attribute = atts.getNext())
  3584. {
  3585. if(0 == stricmp(attribute, "memberOf"))
  3586. {
  3587. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  3588. if (vals.hasValues())
  3589. {
  3590. for (int i = 0; vals.queryBValues()[ i ] != NULL; i++ )
  3591. {
  3592. const char* val = vals.queryCharValue(i);
  3593. char* comma = strchr((char*)val, ',');
  3594. StringBuffer groupname;
  3595. groupname.append(comma - val -3, val+3);
  3596. groups.append(groupname.str());
  3597. }
  3598. }
  3599. }
  3600. }
  3601. }
  3602. }
  3603. else
  3604. {
  3605. StringArray allgroups;
  3606. StringArray allgroupManagedBy;
  3607. StringArray allgroupDescription;
  3608. getAllGroups(allgroups, allgroupManagedBy, allgroupDescription);
  3609. for(unsigned i = 0; i < allgroups.length(); i++)
  3610. {
  3611. const char* grp = allgroups.item(i);
  3612. StringBuffer grpdn, usrdn;
  3613. getUserDN(user, usrdn);
  3614. getGroupDN(grp, grpdn);
  3615. if(userInGroup(usrdn.str(), grpdn.str()))
  3616. {
  3617. groups.append(grp);
  3618. }
  3619. }
  3620. }
  3621. }
  3622. virtual void changeUserGroup(const char* action, const char* username, const char* groupname, const char * groupDN=nullptr)
  3623. {
  3624. StringBuffer userdn, groupdn;
  3625. getUserDN(username, userdn);
  3626. getGroupDN(groupname, groupdn, groupDN);
  3627. // Not needed for Active Directory
  3628. // changeUserMemberOf(action, userdn.str(), groupdn.str());
  3629. changeGroupMember(action, groupdn.str(), userdn.str());
  3630. }
  3631. virtual bool deleteUser(ISecUser* user)
  3632. {
  3633. if(user == NULL)
  3634. {
  3635. DBGLOG("CLdapClient::deleteUser ISecUser must be provided");
  3636. return false;
  3637. }
  3638. const char* username = user->getName();
  3639. if(username == NULL || *username == '\0')
  3640. {
  3641. DBGLOG("CLdapClient::deleteUser username must be provided");
  3642. return false;
  3643. }
  3644. StringBuffer userdn;
  3645. getUserDN(username, userdn);
  3646. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3647. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  3648. int rc = ldap_delete_ext_s(ld, (char*)userdn.str(), NULL, NULL);
  3649. if ( rc != LDAP_SUCCESS )
  3650. {
  3651. throw MakeStringException(-1, "error deleting user %s: %s", username, ldap_err2string(rc));
  3652. }
  3653. StringArray grps;
  3654. getGroups(username, grps);
  3655. ForEachItemIn(x, grps)
  3656. {
  3657. const char* grp = grps.item(x);
  3658. if(!grp || !*grp)
  3659. continue;
  3660. changeUserGroup("delete", username, grp);
  3661. }
  3662. //Remove tempfile scope for this user
  3663. StringBuffer resName(queryDfsXmlBranchName(DXB_Internal));
  3664. resName.append("::").append(username);
  3665. deleteResource(RT_FILE_SCOPE, resName.str(), m_ldapconfig->getResourceBasedn(RT_FILE_SCOPE));
  3666. return true;
  3667. }
  3668. virtual void addGroup(const char* groupname, const char * groupOwner, const char * groupDesc)
  3669. {
  3670. if(groupname == NULL || *groupname == '\0')
  3671. throw MakeStringException(-1, "Can't add group, groupname is empty");
  3672. addGroup(groupname, groupOwner, groupDesc, m_ldapconfig->getGroupBasedn());
  3673. }
  3674. virtual void addGroup(const char* groupname, const char * groupOwner, const char * groupDesc, const char* basedn)
  3675. {
  3676. if(groupname == NULL || *groupname == '\0')
  3677. {
  3678. DBGLOG("CLdapClient::addGroup groupname must be provided");
  3679. return;
  3680. }
  3681. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  3682. {
  3683. if(stricmp(groupname, "Administrators") == 0)
  3684. throw MakeStringException(-1, "Can't add group %s, it's reserved by the system.", groupname);
  3685. }
  3686. else
  3687. {
  3688. if(stricmp(groupname, "Directory Administrators") == 0)
  3689. throw MakeStringException(-1, "Can't add group %s, it's reserved by the system.", groupname);
  3690. }
  3691. StringBuffer dn;
  3692. dn.append("cn=").append(groupname).append(",").append(basedn);
  3693. char* oc_name;
  3694. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  3695. {
  3696. oc_name = "group";
  3697. }
  3698. else
  3699. {
  3700. oc_name = "groupofuniquenames";
  3701. }
  3702. char *cn_values[] = {(char*)groupname, NULL };
  3703. LDAPMod cn_attr =
  3704. {
  3705. LDAP_MOD_ADD,
  3706. "cn",
  3707. cn_values
  3708. };
  3709. char *oc_values[] = {oc_name, NULL };
  3710. LDAPMod oc_attr =
  3711. {
  3712. LDAP_MOD_ADD,
  3713. "objectClass",
  3714. oc_values
  3715. };
  3716. char *member_values[] = {"", NULL};
  3717. LDAPMod member_attr =
  3718. {
  3719. LDAP_MOD_ADD,
  3720. "uniqueMember",
  3721. member_values
  3722. };
  3723. char *owner_values[] = {(char*)groupOwner, NULL};
  3724. LDAPMod owner_attr =
  3725. {
  3726. LDAP_MOD_ADD,
  3727. "managedBy",
  3728. owner_values
  3729. };
  3730. char *desc_values[] = {(char*)groupDesc, NULL};
  3731. LDAPMod desc_attr =
  3732. {
  3733. LDAP_MOD_ADD,
  3734. "description",
  3735. desc_values
  3736. };
  3737. LDAPMod *attrs[6];
  3738. int ind = 0;
  3739. attrs[ind++] = &cn_attr;
  3740. attrs[ind++] = &oc_attr;
  3741. if (groupOwner && *groupOwner)
  3742. attrs[ind++] = &owner_attr;
  3743. if (groupDesc && *groupDesc)
  3744. attrs[ind++] = &desc_attr;
  3745. attrs[ind] = NULL;
  3746. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3747. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  3748. int rc = ldap_add_ext_s(ld, (char*)dn.str(), attrs, NULL, NULL);
  3749. if ( rc == LDAP_INVALID_SYNTAX && m_ldapconfig->getServerType() == OPEN_LDAP)//Fedora389 does not 'seem' to need this, openLDAP does
  3750. {
  3751. attrs[ind++] = &member_attr;
  3752. attrs[ind] = NULL;
  3753. rc = ldap_add_ext_s(ld, (char*)dn.str(), attrs, NULL, NULL);
  3754. }
  3755. if ( rc != LDAP_SUCCESS)
  3756. {
  3757. if(rc == LDAP_ALREADY_EXISTS)
  3758. {
  3759. throw MakeStringException(-1, "can't add group %s, an LDAP object with this name already exists", groupname);
  3760. }
  3761. else
  3762. {
  3763. DBGLOG("error addGroup %s, ldap_add_ext_s error: %s", groupname, ldap_err2string( rc ));
  3764. throw MakeStringException(-1, "error addGroup %s, ldap_add_ext_s error: %s", groupname, ldap_err2string( rc ));
  3765. }
  3766. }
  3767. }
  3768. virtual void deleteGroup(const char* groupname, const char * groupsDN=nullptr)
  3769. {
  3770. if(groupname == NULL || *groupname == '\0')
  3771. throw MakeStringException(-1, "group name can't be empty");
  3772. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  3773. {
  3774. if(stricmp(groupname, "Administrators") == 0 || stricmp(groupname, "Authenticated Users") == 0)
  3775. throw MakeStringException(-1, "you can't delete Authenticated Users or Administrators group");
  3776. }
  3777. else
  3778. {
  3779. if(stricmp(groupname, "Directory Administrators") == 0)
  3780. throw MakeStringException(-1, "you can't delete Directory Administrators group");
  3781. }
  3782. StringBuffer dn;
  3783. getGroupDN(groupname, dn, groupsDN);
  3784. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3785. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  3786. int rc = ldap_delete_ext_s(ld, (char*)dn.str(), NULL, NULL);
  3787. if ( rc != LDAP_SUCCESS )
  3788. {
  3789. throw MakeStringException(-1, "error deleting group %s: %s", groupname, ldap_err2string(rc));
  3790. }
  3791. }
  3792. virtual void getGroupMembers(const char* groupname, StringArray & users, const char * groupsDN=nullptr)
  3793. {
  3794. char *attribute;
  3795. LDAPMessage *message;
  3796. if(groupname == NULL || strlen(groupname) == 0)
  3797. throw MakeStringException(-1, "group name can't be empty");
  3798. StringBuffer grpdn;
  3799. getGroupDN(groupname, grpdn, groupsDN);
  3800. StringBuffer filter;
  3801. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  3802. {
  3803. filter.append("distinguishedName=").append(grpdn.str());
  3804. }
  3805. else if(m_ldapconfig->getServerType() == IPLANET)
  3806. {
  3807. filter.append("entrydn=").append(grpdn.str());
  3808. }
  3809. else if(m_ldapconfig->getServerType() == OPEN_LDAP)
  3810. {
  3811. filter.append("cn=").append(groupname);
  3812. }
  3813. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  3814. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3815. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  3816. const char* memfieldname;
  3817. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  3818. {
  3819. memfieldname = "member";
  3820. }
  3821. else
  3822. {
  3823. memfieldname = "uniquemember";
  3824. }
  3825. char *attrs[] = {(char*)memfieldname, NULL};
  3826. StringBuffer groupbasedn;
  3827. getGroupBaseDN(groupname, groupbasedn, groupsDN);
  3828. CPagedLDAPSearch pagedSrch(ld, m_ldapconfig->getLdapTimeout(), (char*)groupbasedn.str(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs);
  3829. for (message = pagedSrch.getFirstEntry(); message; message = pagedSrch.getNextEntry())
  3830. {
  3831. // Go through the search results by checking message types
  3832. CLDAPGetAttributesWrapper atts(ld, message);
  3833. for ( attribute = atts.getFirst();
  3834. attribute != NULL;
  3835. attribute = atts.getNext())
  3836. {
  3837. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  3838. if (vals.hasValues())
  3839. {
  3840. for (int i = 0; vals.queryBValues()[ i ] != NULL; i++ )
  3841. {
  3842. const char* val = vals.queryCharValue(i);
  3843. StringBuffer uid;
  3844. getUidFromDN(ld, val, uid);
  3845. if(uid.length() > 0)
  3846. users.append(uid.str());
  3847. }
  3848. }
  3849. }
  3850. }
  3851. }
  3852. virtual IPropertyTreeIterator* getGroupMemberIterator(const char* groupName)
  3853. {
  3854. StringArray users;
  3855. getGroupMembers(groupName, users);
  3856. Owned<IPropertyTree> usersTree = createPTree("Users");
  3857. ForEachItemIn(i, users)
  3858. {
  3859. const char* usrName = users.item(i);
  3860. if (!usrName || !*usrName)
  3861. continue;
  3862. IUserArray usersInBaseDN;
  3863. retrieveUsers(usrName, usersInBaseDN);
  3864. ForEachItemIn(x, usersInBaseDN)
  3865. {
  3866. ISecUser& usr = usersInBaseDN.item(x);
  3867. const char* usrName0 = usr.getName();
  3868. if(usrName0 && strieq(usrName, usrName0))
  3869. {
  3870. //BUG#41536: The users in the Administrators group are all the users on the whole
  3871. //active directory, while the users in the users list are only the users who are
  3872. //under the "usersBasedn" of this environment. So, we should only return the users
  3873. //who are in the usersBasedn.
  3874. addUserTree(usr, usersTree);
  3875. break;
  3876. }
  3877. }
  3878. }
  3879. return usersTree->getElements("*");
  3880. }
  3881. ISecItemIterator* getGroupMembersSorted(const char* groupName, UserField* sortOrder, const unsigned pageStartFrom, const unsigned pageSize,
  3882. unsigned* total, __int64* cacheHint)
  3883. {
  3884. class CElementsPager : public CSimpleInterface, implements IElementsPager
  3885. {
  3886. ILdapClient* ldapClient;
  3887. StringAttr sortOrder, groupName;
  3888. public:
  3889. IMPLEMENT_IINTERFACE_USING(CSimpleInterface);
  3890. CElementsPager(ILdapClient* _ldapClient, const char*_groupName, const char*_sortOrder)
  3891. : ldapClient(_ldapClient), groupName(_groupName), sortOrder(_sortOrder) { };
  3892. virtual IRemoteConnection* getElements(IArrayOf<IPropertyTree>& elements)
  3893. {
  3894. StringArray unknownAttributes;
  3895. Owned<IPropertyTreeIterator> iter = ldapClient->getGroupMemberIterator(groupName.str());
  3896. sortElements(iter, sortOrder.get(), NULL, NULL, unknownAttributes, elements);
  3897. return NULL;
  3898. }
  3899. virtual bool allMatchingElementsReceived() { return true; }//For now, ldap always returns all of matched users.
  3900. };
  3901. StringBuffer so;
  3902. if (sortOrder)
  3903. {
  3904. for (unsigned i=0;sortOrder[i]!=UFterm;i++)
  3905. {
  3906. if (so.length())
  3907. so.append(',');
  3908. int fmt = sortOrder[i];
  3909. if (fmt&UFreverse)
  3910. so.append('-');
  3911. if (fmt&UFnocase)
  3912. so.append('?');
  3913. if (fmt&UFnumeric)
  3914. so.append('#');
  3915. so.append(getUserFieldNames((UserField) (fmt&0xff)));
  3916. }
  3917. }
  3918. IArrayOf<IPropertyTree> results;
  3919. Owned<IElementsPager> elementsPager = new CElementsPager(this, groupName, so.length()?so.str():NULL);
  3920. Owned<IRemoteConnection> conn=getElementsPaged(elementsPager, pageStartFrom, pageSize, NULL, "", cacheHint, results, total, NULL, false);
  3921. return new CSecItemIterator(results);
  3922. }
  3923. virtual void deleteResource(SecResourceType rtype, const char* name, const char* basedn)
  3924. {
  3925. if(basedn == NULL || *basedn == '\0')
  3926. basedn = m_ldapconfig->getResourceBasedn(rtype);
  3927. StringBuffer dn;
  3928. name2dn(rtype, name, basedn, dn);
  3929. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3930. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  3931. int rc = ldap_delete_ext_s(ld, (char*)dn.str(), NULL, NULL);
  3932. if ( rc != LDAP_SUCCESS )
  3933. {
  3934. DBGLOG("error deleting %s: %s", dn.str(), ldap_err2string(rc));
  3935. //throw MakeStringException(-1, "error deleting %s: %s", dn.str(), ldap_err2string(rc));
  3936. }
  3937. }
  3938. virtual void renameResource(SecResourceType rtype, const char* oldname, const char* newname, const char* basedn)
  3939. {
  3940. if(oldname == NULL || *oldname == '\0' || newname == NULL || *newname == '\0')
  3941. throw MakeStringException(-1, "please specfiy old and new names");
  3942. if(basedn == NULL || *basedn == '\0')
  3943. basedn = m_ldapconfig->getResourceBasedn(rtype);
  3944. StringBuffer olddn, newrdn;
  3945. name2dn(rtype, oldname, basedn, olddn);
  3946. name2rdn(rtype, newname, newrdn);
  3947. Owned<ILdapConnection> lconn = m_connections->getConnection();
  3948. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  3949. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY && (rtype == RT_DEFAULT || rtype == RT_MODULE || rtype == RT_SERVICE))
  3950. {
  3951. char* uncname_values[] = {(char*)newname, NULL};
  3952. LDAPMod uncname_attr =
  3953. {
  3954. LDAP_MOD_REPLACE,
  3955. "uNCName",
  3956. uncname_values
  3957. };
  3958. LDAPMod *attrs[2];
  3959. attrs[0] = &uncname_attr;
  3960. attrs[1] = NULL;
  3961. int rc = ldap_modify_ext_s(ld, (char*)olddn.str(), attrs, NULL, NULL);
  3962. if (rc != LDAP_SUCCESS )
  3963. {
  3964. DBGLOG("Error changing unc %s to %s - %s", oldname, newname, ldap_err2string( rc ));
  3965. //throw MakeStringException(-1, "Error changing unc %s to %s - %s", oldname, newname, ldap_err2string( rc ));
  3966. }
  3967. }
  3968. #ifdef _WIN32
  3969. int rc = ldap_rename_ext_s(ld, (char*)olddn.str(), (char*)newrdn.str(), NULL, true, NULL, NULL);
  3970. #else
  3971. int rc = ldap_rename_s(ld, (char*)olddn.str(), (char*)newrdn.str(), NULL, true, NULL, NULL);
  3972. #endif
  3973. if (rc != LDAP_SUCCESS )
  3974. {
  3975. DBGLOG("Error renaming %s to %s - %s", oldname, newname, ldap_err2string( rc ));
  3976. //throw MakeStringException(-1, "Error renaming %s to %s - %s", oldname, newname, ldap_err2string( rc ));
  3977. }
  3978. }
  3979. virtual void copyResource(SecResourceType rtype, const char* oldname, const char* newname, const char* basedn)
  3980. {
  3981. if(oldname == NULL || *oldname == '\0' || newname == NULL || *newname == '\0')
  3982. throw MakeStringException(-1, "please specfiy old and new names");
  3983. if(basedn == NULL || *basedn == '\0')
  3984. basedn = m_ldapconfig->getResourceBasedn(rtype);
  3985. Owned<CSecurityDescriptor> sd = new CSecurityDescriptor(oldname);
  3986. IArrayOf<CSecurityDescriptor> sdlist;
  3987. sdlist.append(*LINK(sd));
  3988. if(rtype == RT_FILE_SCOPE || rtype == RT_WORKUNIT_SCOPE)
  3989. getSecurityDescriptorsScope(sdlist, basedn);
  3990. else
  3991. getSecurityDescriptors(sdlist, basedn);
  3992. if(sd->getDescriptor().length() == 0)
  3993. throw MakeStringException(-1, "error copying %s to %s, %s doesn't exist", oldname, newname, oldname);
  3994. ISecUser* user = NULL;
  3995. CLdapSecResource resource(newname);
  3996. addResource(rtype, *user, &resource, PT_DEFAULT, basedn, sd.get(), false);
  3997. }
  3998. void normalizeDn(const char* dn, StringBuffer& ndn)
  3999. {
  4000. LdapUtils::normalizeDn(dn, m_ldapconfig->getBasedn(), ndn);
  4001. }
  4002. virtual bool isSuperUser(ISecUser* user)
  4003. {
  4004. if(user == NULL || user->getName() == NULL)
  4005. {
  4006. DBGLOG("CLdapClient::isSuperUser Populated ISecUser must be provided");
  4007. return false;
  4008. }
  4009. const char* username = user->getName();
  4010. const char* sysuser = m_ldapconfig->getSysUser();
  4011. if(sysuser != NULL && stricmp(sysuser, username) == 0)
  4012. return true;
  4013. StringBuffer userdn, admingrpdn;
  4014. getUserDN(username, userdn);
  4015. getAdminGroupDN(admingrpdn);
  4016. return userInGroup(userdn.str(), admingrpdn.str());
  4017. }
  4018. virtual ILdapConfig* queryConfig()
  4019. {
  4020. return m_ldapconfig.get();
  4021. }
  4022. virtual int countUsers(const char* searchstr, int limit)
  4023. {
  4024. StringBuffer filter;
  4025. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  4026. filter.append("objectClass=User");
  4027. else
  4028. filter.append("objectClass=inetorgperson");
  4029. if(searchstr && *searchstr && strcmp(searchstr, "*") != 0)
  4030. {
  4031. filter.insert(0, "(&(");
  4032. filter.appendf(")(|(%s=*%s*)(%s=*%s*)(%s=*%s*)))", (m_ldapconfig->getServerType()==ACTIVE_DIRECTORY)?"sAMAcccountName":"uid", searchstr, "givenName", searchstr, "sn", searchstr);
  4033. }
  4034. return countEntries(m_ldapconfig->getUserBasedn(), filter.str(), limit);
  4035. }
  4036. virtual int countResources(const char* basedn, const char* searchstr, int limit)
  4037. {
  4038. StringBuffer filter;
  4039. filter.append("objectClass=*");
  4040. if(searchstr && *searchstr && strcmp(searchstr, "*") != 0)
  4041. {
  4042. filter.insert(0, "(&(");
  4043. filter.appendf(")(|(%s=*%s*)))", "uNCName", searchstr);
  4044. }
  4045. return countEntries(basedn, filter.str(), limit);
  4046. }
  4047. virtual int countEntries(const char* basedn, const char* filter, int limit)
  4048. {
  4049. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  4050. Owned<ILdapConnection> lconn = m_connections->getConnection();
  4051. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  4052. char *attrs[] = { LDAP_NO_ATTRS, NULL };
  4053. CPagedLDAPSearch pagedSrch(ld, m_ldapconfig->getLdapTimeout(), (char*)basedn, LDAP_SCOPE_SUBTREE, (char*)filter, attrs);
  4054. int entries = pagedSrch.countEntries();
  4055. return entries;
  4056. }
  4057. virtual const char* getPasswordStorageScheme()
  4058. {
  4059. if(m_pwscheme.length() == 0)
  4060. {
  4061. if(m_ldapconfig->getServerType() == IPLANET)
  4062. {
  4063. Owned<ILdapConnection> lconn = m_connections->getConnection();
  4064. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  4065. char* pw_attrs[] = {"nsslapd-rootpwstoragescheme", NULL};
  4066. CLDAPMessage msg;
  4067. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  4068. int err = ldap_search_ext_s(ld, "cn=config", LDAP_SCOPE_BASE, "objectClass=*", pw_attrs, false, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &msg.msg);
  4069. if(err != LDAP_SUCCESS)
  4070. {
  4071. DBGLOG("ldap_search_ext_s error: %s", ldap_err2string( err ));
  4072. return NULL;
  4073. }
  4074. LDAPMessage* entry = LdapFirstEntry(ld, msg);
  4075. if(entry != NULL)
  4076. {
  4077. CLDAPGetValuesLenWrapper vals(ld, entry, "nsslapd-rootpwstoragescheme");
  4078. if (vals.hasValues())
  4079. m_pwscheme.append(vals.queryCharValue(0));
  4080. }
  4081. ldap_msgfree(msg);
  4082. }
  4083. }
  4084. if(m_pwscheme.length() == 0)
  4085. return NULL;
  4086. else
  4087. return m_pwscheme.str();
  4088. }
  4089. private:
  4090. virtual void addDC(const char* dc)
  4091. {
  4092. if(dc == NULL || *dc == '\0')
  4093. {
  4094. DBGLOG("CLdapClient::addDC dc must be provided");
  4095. return;
  4096. }
  4097. StringBuffer dcname;
  4098. LdapUtils::getName(dc, dcname);
  4099. char *dc_values[] = {(char*)dcname.str(), NULL };
  4100. LDAPMod dc_attr =
  4101. {
  4102. LDAP_MOD_ADD,
  4103. "dc",
  4104. dc_values
  4105. };
  4106. char *o_values[] = {(char*)dcname.str(), NULL };
  4107. LDAPMod o_attr =
  4108. {
  4109. LDAP_MOD_ADD,
  4110. "o",
  4111. o_values
  4112. };
  4113. char *oc_values[] = {"organization", "dcObject", NULL };
  4114. LDAPMod oc_attr =
  4115. {
  4116. LDAP_MOD_ADD,
  4117. "objectClass",
  4118. oc_values
  4119. };
  4120. LDAPMod *attrs[4];
  4121. attrs[0] = &oc_attr;
  4122. attrs[1] = &o_attr;
  4123. attrs[2] = &dc_attr;
  4124. attrs[3] = NULL;
  4125. Owned<ILdapConnection> lconn = m_connections->getConnection();
  4126. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  4127. int rc = ldap_add_ext_s(ld, (char*)dc, attrs, NULL, NULL);
  4128. if ( rc != LDAP_SUCCESS )
  4129. {
  4130. if(rc == LDAP_ALREADY_EXISTS)
  4131. {
  4132. throw MakeStringException(-1, "can't add dc %s, an LDAP object with this name already exists", dc);
  4133. }
  4134. else
  4135. {
  4136. DBGLOG("error addDC %s, ldap_add_ext_s error: 0x%0x %s", dc, rc, ldap_err2string( rc ));
  4137. throw MakeStringException(-1, "error addDC %s, ldap_add_ext_s error: %s", dc, ldap_err2string( rc ));
  4138. }
  4139. }
  4140. }
  4141. virtual void getUserDN(const char* username, StringBuffer& userdn)
  4142. {
  4143. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  4144. {
  4145. StringBuffer filter;
  4146. filter.append("sAMAccountName=");
  4147. filter.append(username);
  4148. char *attribute;
  4149. LDAPMessage *message;
  4150. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  4151. char *dn_fieldname;
  4152. dn_fieldname = "distinguishedName";
  4153. Owned<ILdapConnection> lconn = m_connections->getConnection();
  4154. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  4155. char *attrs[] = {dn_fieldname, NULL};
  4156. CLDAPMessage searchResult;
  4157. int rc = ldap_search_ext_s(ld, (char*)m_ldapconfig->getUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  4158. if ( rc != LDAP_SUCCESS )
  4159. {
  4160. throw MakeStringException(-1, "ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getUserBasedn());
  4161. }
  4162. unsigned entries = ldap_count_entries(ld, searchResult);
  4163. if(entries == 0)
  4164. {
  4165. searchResult.ldapMsgFree();
  4166. int rc = ldap_search_ext_s(ld, (char*)m_ldapconfig->getSysUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  4167. if ( rc != LDAP_SUCCESS )
  4168. {
  4169. throw MakeStringException(-1, "ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getSysUserBasedn());
  4170. }
  4171. }
  4172. message = LdapFirstEntry( ld, searchResult);
  4173. if(message != NULL)
  4174. {
  4175. CLDAPGetAttributesWrapper atts(ld, searchResult);
  4176. attribute = atts.getFirst();
  4177. if(attribute != NULL)
  4178. {
  4179. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  4180. if (vals.hasValues())
  4181. userdn.append(vals.queryCharValue(0));
  4182. }
  4183. }
  4184. if(userdn.length() == 0)
  4185. throw MakeStringException(-1, "user %s can't be found", username);
  4186. }
  4187. else
  4188. {
  4189. if(stricmp(username, "anyone") == 0)
  4190. userdn.append(username);
  4191. else
  4192. userdn.append("uid=").append(username).append(",").append(m_ldapconfig->getUserBasedn());
  4193. }
  4194. }
  4195. virtual void getUidFromDN(LDAP* ld, const char* dn, StringBuffer& uid)
  4196. {
  4197. if(dn == NULL || *dn == '\0')
  4198. {
  4199. DBGLOG("CLdapClient::getUidFromDN dn must be provided");
  4200. return;
  4201. }
  4202. if(m_ldapconfig->getServerType() != ACTIVE_DIRECTORY)
  4203. {
  4204. if (strncmp(dn,"uid=",4))//Fedora389 returns "cn=Directory Administrators"
  4205. return;
  4206. const char* comma = strchr(dn, ',');
  4207. // DN is in the format of "uid=uuu,ou=ooo,dc=dd"
  4208. uid.append(comma - dn - 4, dn + 4);
  4209. return;
  4210. }
  4211. StringBuffer filter;
  4212. filter.append("distinguishedName=").append(dn);
  4213. filter.replaceString("\\", "\\5c");//Replace special characters with valid UTF-8 string (see valueencoding rule in RFC 4515)
  4214. filter.replaceString("*", "\\2a");
  4215. filter.replaceString("(", "\\28");
  4216. filter.replaceString(")", "\\29");
  4217. char *attribute;
  4218. LDAPMessage *message;
  4219. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  4220. char *uid_fieldname = "sAMAccountName";
  4221. char *attrs[] = {uid_fieldname, NULL};
  4222. CLDAPMessage searchResult;
  4223. int rc = ldap_search_ext_s(ld, (char*)m_ldapconfig->getUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  4224. if ( rc != LDAP_SUCCESS )
  4225. {
  4226. throw MakeStringException(-1, "ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getUserBasedn());
  4227. }
  4228. message = LdapFirstEntry( ld, searchResult);
  4229. if(message != NULL)
  4230. {
  4231. CLDAPGetAttributesWrapper atts(ld, searchResult);
  4232. attribute = atts.getFirst();
  4233. if(attribute != NULL)
  4234. {
  4235. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  4236. if (vals.hasValues())
  4237. uid.append(vals.queryCharValue(0));
  4238. }
  4239. }
  4240. }
  4241. virtual void getGroupDN(const char* groupname, StringBuffer& groupdn, const char * groupBaseDN=nullptr)
  4242. {
  4243. if(groupname == NULL)
  4244. {
  4245. DBGLOG("CLdapClient::getGroupDN groupname must be provided");
  4246. return;
  4247. }
  4248. LdapServerType stype = m_ldapconfig->getServerType();
  4249. groupdn.append("cn=").append(groupname).append(",");
  4250. if(stype == ACTIVE_DIRECTORY && stricmp(groupname, "Administrators") == 0)
  4251. {
  4252. groupdn.append("cn=Builtin,").append(m_ldapconfig->getBasedn());
  4253. }
  4254. else if((stype == IPLANET || stype == OPEN_LDAP) && stricmp(groupname, "Directory Administrators") == 0)
  4255. {
  4256. groupdn.append(m_ldapconfig->getBasedn());
  4257. }
  4258. else
  4259. {
  4260. groupdn.append(groupBaseDN == nullptr ? m_ldapconfig->getGroupBasedn() : groupBaseDN);
  4261. }
  4262. }
  4263. virtual void getGroupBaseDN(const char* groupname, StringBuffer& groupbasedn, const char * groupBaseDN=nullptr)
  4264. {
  4265. if(groupname == NULL)
  4266. {
  4267. DBGLOG("CLdapClient::getGroupBaseDN groupname must be provided");
  4268. return;
  4269. }
  4270. LdapServerType stype = m_ldapconfig->getServerType();
  4271. if(stype == ACTIVE_DIRECTORY && stricmp(groupname, "Administrators") == 0)
  4272. {
  4273. groupbasedn.append("cn=Builtin,").append(m_ldapconfig->getBasedn());
  4274. }
  4275. else if((stype == IPLANET || stype == OPEN_LDAP) && stricmp(groupname, "Directory Administrators") == 0)
  4276. {
  4277. groupbasedn.append(m_ldapconfig->getBasedn());
  4278. }
  4279. else
  4280. {
  4281. groupbasedn.append(groupBaseDN==nullptr ? m_ldapconfig->getGroupBasedn() : groupBaseDN);
  4282. }
  4283. }
  4284. virtual void getAdminGroupDN(StringBuffer& groupdn)
  4285. {
  4286. LdapServerType stype = m_ldapconfig->getServerType();
  4287. if(stype == ACTIVE_DIRECTORY)
  4288. {
  4289. groupdn.append("cn=Administrators,cn=Builtin,").append(m_ldapconfig->getBasedn());
  4290. }
  4291. else if(stype == IPLANET)
  4292. {
  4293. groupdn.append("cn=Directory Administrators,").append(m_ldapconfig->getBasedn());
  4294. }
  4295. else if(stype == OPEN_LDAP)
  4296. {
  4297. groupdn.append("cn=Directory Administrators,").append(m_ldapconfig->getBasedn());
  4298. }
  4299. }
  4300. virtual void changeUserMemberOf(const char* action, const char* userdn, const char* groupdn)
  4301. {
  4302. char *grp_values[] = {(char*)groupdn, NULL};
  4303. LDAPMod grp_attr = {
  4304. (action != NULL && stricmp(action, "delete") == 0)?LDAP_MOD_DELETE:LDAP_MOD_ADD,
  4305. "memberOf",
  4306. grp_values
  4307. };
  4308. LDAPMod *grp_attrs[2];
  4309. grp_attrs[0] = &grp_attr;
  4310. grp_attrs[1] = NULL;
  4311. Owned<ILdapConnection> lconn = m_connections->getConnection();
  4312. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  4313. int rc = ldap_modify_ext_s(ld, (char*)userdn, grp_attrs, NULL, NULL);
  4314. if ( rc != LDAP_SUCCESS )
  4315. {
  4316. throw MakeStringException(-1, "error changing group for user %s, ldap_modify_ext_s error: %s", userdn, ldap_err2string( rc ));
  4317. }
  4318. }
  4319. virtual void changeGroupMember(const char* action, const char* groupdn, const char* userdn)
  4320. {
  4321. Owned<ILdapConnection> lconn = m_connections->getConnection();
  4322. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  4323. const char* memberfieldname;
  4324. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  4325. {
  4326. memberfieldname = "member";
  4327. }
  4328. else
  4329. {
  4330. memberfieldname = "uniquemember";
  4331. }
  4332. char *member_values[] = {(char*)userdn, NULL};
  4333. LDAPMod member_attr = {
  4334. (action != NULL && stricmp(action, "delete") == 0)?LDAP_MOD_DELETE:LDAP_MOD_ADD,
  4335. (char*)memberfieldname,
  4336. member_values
  4337. };
  4338. LDAPMod *member_attrs[2];
  4339. member_attrs[0] = &member_attr;
  4340. member_attrs[1] = NULL;
  4341. int rc = ldap_modify_ext_s(ld, (char*)groupdn, member_attrs, NULL, NULL);
  4342. if ( rc != LDAP_SUCCESS )
  4343. {
  4344. if (action != NULL && stricmp(action, "delete") == 0)
  4345. throw MakeStringException(-1, "Failed in deleting member from group: ldap_modify_ext_s error: %s; userdn: %s; groupdn: %s", ldap_err2string( rc ), userdn, groupdn);
  4346. else
  4347. throw MakeStringException(-1, "Failed in adding member to group, ldap_modify_ext_s error: %s; userdn: %s; groupdn: %s", ldap_err2string( rc ), userdn, groupdn);
  4348. }
  4349. }
  4350. void ConvertCToW(unsigned short* pszDest, const char * pszSrc)
  4351. {
  4352. unsigned i = 0;
  4353. for(i = 0; i < strlen(pszSrc); i++)
  4354. pszDest[i] = (unsigned short) pszSrc[i];
  4355. pszDest[i] = (unsigned short)'\0';
  4356. }
  4357. virtual bool authorizeScope(ISecUser& user, IArrayOf<ISecResource>& resources, const char* basedn)
  4358. {
  4359. IArrayOf<CSecurityDescriptor> sdlist;
  4360. std::set<const char*, ltstr> scopeset;
  4361. ForEachItemIn(x, resources)
  4362. {
  4363. ISecResource& res = resources.item(x);
  4364. const char* resourcename = res.getName();
  4365. if(resourcename == NULL || *resourcename == '\0')
  4366. continue;
  4367. // Add one extra Volume type SecurityDescriptor for each resource for ActiveDirectory.
  4368. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  4369. {
  4370. CSecurityDescriptor* sd = new CSecurityDescriptor(resourcename);
  4371. sd->setObjectClass("Volume");
  4372. sdlist.append(*sd);
  4373. }
  4374. scopeset.insert(resourcename);
  4375. int len = strlen(resourcename);
  4376. const char* curptr = resourcename + len - 1;
  4377. while(curptr > resourcename)
  4378. {
  4379. while(curptr > resourcename && *curptr != ':')
  4380. curptr--;
  4381. bool foundcolon=false;
  4382. while(curptr >resourcename && *curptr == ':')
  4383. {
  4384. curptr--;
  4385. foundcolon = true;
  4386. }
  4387. if(curptr > resourcename || foundcolon)
  4388. {
  4389. int curlen = curptr - resourcename + 1;
  4390. char* curscope = (char*)alloca(curlen + 1);
  4391. strncpy(curscope, resourcename, curlen);
  4392. curscope[curlen] = 0;
  4393. scopeset.insert(curscope);
  4394. }
  4395. }
  4396. }
  4397. if(scopeset.size() == 0)
  4398. return true;
  4399. std::set<const char*, ltstr>::iterator iter;
  4400. for(iter = scopeset.begin(); iter != scopeset.end(); iter++)
  4401. {
  4402. const char* curscope = *iter;
  4403. CSecurityDescriptor* sd = new CSecurityDescriptor(*iter);
  4404. sd->setObjectClass("organizationalUnit");
  4405. sdlist.append(*sd);
  4406. }
  4407. getSecurityDescriptorsScope(sdlist, basedn);
  4408. IArrayOf<CSecurityDescriptor> matched_sdlist;
  4409. ForEachItemIn(y, resources)
  4410. {
  4411. ISecResource& res = resources.item(y);
  4412. const char* rname = res.getName();
  4413. if(rname == NULL || *rname == '\0')
  4414. throw MakeStringException(-1, "resource name can't be empty inside authorizeScope");
  4415. CSecurityDescriptor* matchedsd = NULL;
  4416. ForEachItemIn(z, sdlist)
  4417. {
  4418. CSecurityDescriptor& sd = sdlist.item(z);
  4419. const char* sdname = sd.getName();
  4420. if(sdname == NULL || *sdname == '\0')
  4421. continue;
  4422. if(strncmp(sdname, rname, strlen(sdname)) == 0
  4423. && (matchedsd == NULL
  4424. || ((matchedsd->getDescriptor().length() == 0 && sd.getDescriptor().length() > 0)
  4425. || (sd.getDescriptor().length() > 0 && strlen(sdname) > strlen(matchedsd->getName())))))
  4426. matchedsd = &sd;
  4427. }
  4428. if(matchedsd != NULL)
  4429. matched_sdlist.append(*LINK(matchedsd));
  4430. else
  4431. matched_sdlist.append(*(new CSecurityDescriptor(rname)));
  4432. }
  4433. bool ok = false;
  4434. if(m_pp != NULL)
  4435. ok = m_pp->getPermissions(user, matched_sdlist, resources);
  4436. return ok;
  4437. }
  4438. virtual void getSecurityDescriptors(SecResourceType rtype, IArrayOf<CSecurityDescriptor>& sdlist)
  4439. {
  4440. int len = sdlist.length();
  4441. if(len == 0)
  4442. {
  4443. DBGLOG("CLdapClient::getSecurityDescriptors sdlist cannot be empty");
  4444. return;
  4445. }
  4446. const char* rbasedn = m_ldapconfig->getResourceBasedn(rtype);
  4447. if(rbasedn == NULL || *rbasedn == '\0')
  4448. {
  4449. DBGLOG("corresponding resource basedn is not defined");
  4450. return;
  4451. }
  4452. std::map<std::string, IArrayOf<CSecurityDescriptor>*> sdmap;
  4453. for(int i = 0; i < len; i++)
  4454. {
  4455. CSecurityDescriptor& sd = sdlist.item(i);
  4456. const char* relativeBasedn = sd.getRelativeBasedn();
  4457. StringBuffer basedn;
  4458. if(relativeBasedn != NULL)
  4459. basedn.append(relativeBasedn).append(",");
  4460. basedn.append(rbasedn);
  4461. std::map<std::string, IArrayOf<CSecurityDescriptor>*>::iterator sdit = sdmap.find(basedn.str());
  4462. if(sdit == sdmap.end())
  4463. {
  4464. IArrayOf<CSecurityDescriptor>* newlist = new IArrayOf<CSecurityDescriptor>;
  4465. newlist->append(*LINK(&sd));
  4466. sdmap[basedn.str()] = newlist;
  4467. }
  4468. else
  4469. {
  4470. (*sdit).second->append(*LINK(&sd));
  4471. }
  4472. }
  4473. for(std::map<std::string, IArrayOf<CSecurityDescriptor>*>::iterator cur = sdmap.begin(); cur != sdmap.end(); cur++)
  4474. {
  4475. getSecurityDescriptors(*((*cur).second), (*cur).first.c_str());
  4476. delete (*cur).second;
  4477. }
  4478. }
  4479. virtual void getSecurityDescriptors(IArrayOf<CSecurityDescriptor>& sdlist, const char* basedn)
  4480. {
  4481. char *attribute;
  4482. CLDAPGetValuesLenWrapper valsLen;
  4483. LDAPMessage *message;
  4484. int i;
  4485. const char *id_fieldname;
  4486. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  4487. {
  4488. id_fieldname = "name";
  4489. }
  4490. else
  4491. {
  4492. id_fieldname = "ou";
  4493. }
  4494. const char *des_fieldname = m_ldapconfig->getSdFieldName();
  4495. int len = sdlist.length();
  4496. if(len == 0)
  4497. {
  4498. DBGLOG("CLdapClient::getSecurityDescriptors2 sdlist cannot be empty");
  4499. return;
  4500. }
  4501. StringBuffer filter;
  4502. filter.append("(|");
  4503. for(i = 0; i < len; i++)
  4504. {
  4505. CSecurityDescriptor& sd = sdlist.item(i);
  4506. StringBuffer namebuf;
  4507. namebuf.append(sd.getName());
  4508. namebuf.trim();
  4509. if(namebuf.length() > 0)
  4510. {
  4511. filter.append("(").append(id_fieldname).append("=").append(namebuf.str()).append(")");;
  4512. }
  4513. }
  4514. filter.append(")");
  4515. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  4516. char* attrs[] = {(char*)id_fieldname, (char*)des_fieldname, NULL};
  4517. Owned<ILdapConnection> lconn = m_connections->getConnection();
  4518. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  4519. CLDAPMessage searchResult;
  4520. int rc = ldap_search_ext_s(ld, (char*)basedn, LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg ); /* returned results */
  4521. if ( rc != LDAP_SUCCESS )
  4522. {
  4523. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), basedn);
  4524. return;
  4525. }
  4526. // Go through the search results by checking message types
  4527. for(message = LdapFirstEntry(ld, searchResult); message != NULL; message = ldap_next_entry(ld, message))
  4528. {
  4529. StringBuffer resourcename;
  4530. CLDAPGetAttributesWrapper atts(ld, searchResult);
  4531. for ( attribute = atts.getFirst();
  4532. attribute != NULL;
  4533. attribute = atts.getNext())
  4534. {
  4535. if(stricmp(attribute, id_fieldname) == 0)
  4536. {
  4537. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  4538. if (vals.hasValues())
  4539. resourcename.append(vals.queryCharValue(0));
  4540. }
  4541. else if(stricmp(attribute, des_fieldname) == 0)
  4542. {
  4543. valsLen.retrieveBValues(ld, message, attribute);
  4544. }
  4545. }
  4546. for(i = 0; i < len; i++)
  4547. {
  4548. CSecurityDescriptor& sd = sdlist.item(i);
  4549. if(resourcename.length() > 0 && stricmp(resourcename.str(), sd.getName()) == 0)
  4550. {
  4551. if (valsLen.hasValues())
  4552. {
  4553. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  4554. {
  4555. struct berval* val = valsLen.queryBValues()[0];
  4556. if(val != NULL)
  4557. {
  4558. CSecurityDescriptor& sd = sdlist.item(i);
  4559. sd.setDescriptor(val->bv_len, val->bv_val);
  4560. }
  4561. }
  4562. else
  4563. {
  4564. MemoryBuffer allvals;
  4565. int valseq = 0;
  4566. struct berval* val = valsLen.queryBValues()[valseq++];
  4567. while(val != NULL)
  4568. {
  4569. if(val->bv_len > 0)
  4570. {
  4571. allvals.append(val->bv_len, val->bv_val);
  4572. allvals.append('\0'); // my separator between ACIs
  4573. }
  4574. val = valsLen.queryBValues()[valseq++];
  4575. }
  4576. if(allvals.length() > 0)
  4577. {
  4578. CSecurityDescriptor& sd = sdlist.item(i);
  4579. sd.setDescriptor(allvals.length(), (void*)allvals.toByteArray());
  4580. }
  4581. }
  4582. }
  4583. break;
  4584. }
  4585. }
  4586. }
  4587. }
  4588. virtual void getSecurityDescriptorsScope(IArrayOf<CSecurityDescriptor>& sdlist, const char* basedn)
  4589. {
  4590. char *attribute;
  4591. CLDAPGetValuesLenWrapper valsLen;
  4592. LDAPMessage *message;
  4593. int i;
  4594. int len = sdlist.length();
  4595. if(len == 0)
  4596. {
  4597. DBGLOG("CLdapClient::getSecurityDescriptorsScope sdlist cannot be empty");
  4598. return;
  4599. }
  4600. LdapServerType servertype = m_ldapconfig->getServerType();
  4601. char *sd_fieldname = (char*)m_ldapconfig->getSdFieldName();
  4602. StringBuffer filter;
  4603. filter.append("(|");
  4604. for(i = 0; i < len; i++)
  4605. {
  4606. CSecurityDescriptor& sd = sdlist.item(i);
  4607. StringBuffer namebuf;
  4608. namebuf.append(sd.getName());
  4609. namebuf.trim();
  4610. if(namebuf.length() > 0)
  4611. {
  4612. const char* resourcename = namebuf.str();
  4613. int len = namebuf.length();
  4614. const char* curptr = resourcename + len - 1;
  4615. StringBuffer dn, cn;
  4616. bool isleaf = true;
  4617. while(curptr > resourcename)
  4618. {
  4619. const char* lastptr = curptr;
  4620. while(curptr > resourcename && *curptr != ':')
  4621. curptr--;
  4622. int curlen;
  4623. const char* curscope;
  4624. if(*curptr == ':')
  4625. {
  4626. curlen = lastptr - curptr;
  4627. curscope = curptr + 1;
  4628. }
  4629. else
  4630. {
  4631. curlen = lastptr - curptr + 1;
  4632. curscope = curptr;
  4633. }
  4634. if(isleaf && (sd.getObjectClass() != NULL) && (stricmp(sd.getObjectClass(), "Volume") == 0))
  4635. {
  4636. cn.append(curlen, curscope);
  4637. dn.append("cn=").append(curlen, curscope).append(",");
  4638. }
  4639. else
  4640. {
  4641. cn.append(curlen, curscope);
  4642. dn.append("ou=").append(curlen, curscope).append(",");
  4643. }
  4644. isleaf = false;
  4645. if (curptr == resourcename) //handle a single char as the top scope, such as x::abc
  4646. break;
  4647. while(curptr >resourcename && *curptr == ':')
  4648. curptr--;
  4649. if (curptr == resourcename && *curptr != ':') //handle a single char as the top scope, such as x::abc
  4650. {
  4651. dn.append("ou=").append(1, curptr).append(",");
  4652. }
  4653. }
  4654. dn.append(basedn);
  4655. if(servertype == ACTIVE_DIRECTORY)
  4656. {
  4657. filter.append("(distinguishedName=").append(dn.str()).append(")");
  4658. }
  4659. else if(servertype == IPLANET)
  4660. {
  4661. filter.append("(entrydn=").append(dn.str()).append(")");
  4662. }
  4663. else if(servertype == OPEN_LDAP)
  4664. {
  4665. filter.append("(ou=").append(cn.str()).append(")");
  4666. }
  4667. sd.setDn(dn.str());
  4668. }
  4669. }
  4670. filter.append(")");
  4671. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  4672. char* attrs[] = {sd_fieldname, NULL};
  4673. Owned<ILdapConnection> lconn = m_connections->getConnection();
  4674. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  4675. CLDAPMessage searchResult;
  4676. int rc = ldap_search_ext_s(ld, (char*)basedn, LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg ); /* returned results */
  4677. if ( rc != LDAP_SUCCESS )
  4678. {
  4679. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), basedn);
  4680. return;
  4681. }
  4682. // Go through the search results by checking message types
  4683. for(message = LdapFirstEntry(ld, searchResult); message != NULL; message = ldap_next_entry(ld, message))
  4684. {
  4685. StringBuffer dn;
  4686. char *p = ldap_get_dn(ld, message);
  4687. dn.append(p);
  4688. ldap_memfree(p);
  4689. CLDAPGetAttributesWrapper atts(ld, searchResult);
  4690. for ( attribute = atts.getFirst();
  4691. attribute != NULL;
  4692. attribute = atts.getNext())
  4693. {
  4694. if(stricmp(attribute, sd_fieldname) == 0)
  4695. {
  4696. valsLen.retrieveBValues(ld, message, attribute);
  4697. }
  4698. }
  4699. for(i = 0; i < len; i++)
  4700. {
  4701. CSecurityDescriptor& sd = sdlist.item(i);
  4702. if(dn.length() > 0 && stricmp(dn.str(), sd.getDn()) == 0)
  4703. {
  4704. if (valsLen.hasValues())
  4705. {
  4706. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  4707. {
  4708. struct berval* val = valsLen.queryBValues()[0];
  4709. if(val != NULL)
  4710. {
  4711. CSecurityDescriptor& sd = sdlist.item(i);
  4712. sd.setDescriptor(val->bv_len, val->bv_val);
  4713. }
  4714. }
  4715. else
  4716. {
  4717. MemoryBuffer allvals;
  4718. int valseq = 0;
  4719. struct berval* val = valsLen.queryBValues()[valseq++];
  4720. while(val != NULL)
  4721. {
  4722. if(val->bv_len > 0)
  4723. {
  4724. allvals.append(val->bv_len, val->bv_val);
  4725. allvals.append('\0'); // my separator between ACIs
  4726. }
  4727. val = valsLen.queryBValues()[valseq++];
  4728. }
  4729. if(allvals.length() > 0)
  4730. {
  4731. CSecurityDescriptor& sd = sdlist.item(i);
  4732. sd.setDescriptor(allvals.length(), (void*)allvals.toByteArray());
  4733. }
  4734. }
  4735. }
  4736. break;
  4737. }
  4738. }
  4739. }
  4740. }
  4741. virtual const bool organizationalUnitExists(const char * ou) const
  4742. {
  4743. Owned<ILdapConnection> lconn = m_connections->getConnection();
  4744. LDAP* sys_ld = ((CLdapConnection*)lconn.get())->getLd();
  4745. char* attrs[] = {"ou", NULL};
  4746. CLDAPMessage searchResult;
  4747. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  4748. int rc = ldap_search_ext_s(sys_ld,const_cast <char*>(ou),LDAP_SCOPE_ONELEVEL,NULL,attrs,0,NULL,NULL,&timeOut,LDAP_NO_LIMIT,&searchResult.msg);
  4749. return rc == LDAP_SUCCESS;
  4750. }
  4751. virtual void createLdapBasedn(ISecUser* user, const char* basedn, SecPermissionType ptype)
  4752. {
  4753. if(basedn == NULL || basedn[0] == '\0')
  4754. {
  4755. DBGLOG("CLdapClient::createLdapBasedn basedn must be provided");
  4756. return;
  4757. }
  4758. const char* ptr = strstr(basedn, "ou=");
  4759. if(ptr == NULL)
  4760. {
  4761. DBGLOG("CLdapClient::createLdapBasedn OU= missing from basedn");
  4762. return;
  4763. }
  4764. ptr += 3;
  4765. StringBuffer oubuf;
  4766. const char* comma = strchr(ptr, ',');
  4767. if(comma == NULL)
  4768. {
  4769. oubuf.append(ptr);
  4770. ptr = NULL;
  4771. }
  4772. else
  4773. {
  4774. oubuf.append(comma - ptr, ptr);
  4775. ptr = comma + 1;
  4776. }
  4777. if (ptr && strstr(ptr,"ou=") && !organizationalUnitExists(ptr))
  4778. createLdapBasedn(user, ptr, ptype);
  4779. addOrganizationalUnit(user, oubuf.str(), ptr, ptype);
  4780. }
  4781. virtual bool addOrganizationalUnit(ISecUser* user, const char* name, const char* basedn, SecPermissionType ptype)
  4782. {
  4783. if(name == NULL || basedn == NULL)
  4784. {
  4785. DBGLOG("CLdapClient::addOrganizationalUnit OU name must be provided");
  4786. return false;
  4787. }
  4788. if(strchr(name, '/') != NULL || strchr(name, '=') != NULL)
  4789. {
  4790. DBGLOG("CLdapClient::addOrganizationalUnit Invalid characters in OU");
  4791. return false;
  4792. }
  4793. StringBuffer dn;
  4794. dn.append("ou=").append(name).append(",").append(basedn);
  4795. if (organizationalUnitExists(dn.str()))
  4796. return true;
  4797. char *ou_values[] = {(char*)name, NULL };
  4798. LDAPMod ou_attr =
  4799. {
  4800. LDAP_MOD_ADD,
  4801. "ou",
  4802. ou_values
  4803. };
  4804. char *name_values[] = {(char*)name, NULL };
  4805. LDAPMod name_attr =
  4806. {
  4807. LDAP_MOD_ADD,
  4808. "name",
  4809. name_values
  4810. };
  4811. char *oc_values[] = {"OrganizationalUnit", NULL };
  4812. LDAPMod oc_attr =
  4813. {
  4814. LDAP_MOD_ADD,
  4815. "objectClass",
  4816. oc_values
  4817. };
  4818. MemoryBuffer sdbuf;
  4819. Owned<CSecurityDescriptor> default_sd = NULL;
  4820. if(m_pp != NULL)
  4821. default_sd.setown(m_pp->createDefaultSD(user, name, ptype));
  4822. if(default_sd != NULL)
  4823. sdbuf.append(default_sd->getDescriptor());
  4824. LDAPMod *attrs[6];
  4825. int ind = 0;
  4826. attrs[ind++] = &ou_attr;
  4827. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  4828. {
  4829. attrs[ind++] = &name_attr;
  4830. }
  4831. attrs[ind++] = &oc_attr;
  4832. LDAPMod sd_attr;
  4833. struct berval sd_val;
  4834. sd_val.bv_len = sdbuf.length();
  4835. sd_val.bv_val = (char*)sdbuf.toByteArray();
  4836. struct berval* sd_values[] = {&sd_val, NULL};
  4837. sd_attr.mod_op = LDAP_MOD_ADD | LDAP_MOD_BVALUES;
  4838. sd_attr.mod_type = (char*)m_ldapconfig->getSdFieldName();
  4839. sd_attr.mod_vals.modv_bvals = sd_values;
  4840. if(sdbuf.length() > 0)
  4841. attrs[ind++] = &sd_attr;
  4842. attrs[ind] = NULL;
  4843. Owned<ILdapConnection> lconn = m_connections->getConnection();
  4844. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  4845. int rc = ldap_add_ext_s(ld, (char*)dn.str(), attrs, NULL, NULL);
  4846. if ( rc != LDAP_SUCCESS )
  4847. {
  4848. if(rc == LDAP_ALREADY_EXISTS)
  4849. {
  4850. WARNLOG("CLdapClient::addOrganizationalUnit LDAP object 'ou=%s,%s' already exists", name, basedn);
  4851. return false;
  4852. }
  4853. else
  4854. {
  4855. throw MakeStringException(-1, "ldap_add_ext_s error for ou=%s,%s: %d %s", name, basedn, rc, ldap_err2string( rc ));
  4856. }
  4857. }
  4858. return true;
  4859. }
  4860. virtual void name2dn(SecResourceType rtype, const char* resourcename, const char* basedn, StringBuffer& ldapname)
  4861. {
  4862. StringBuffer namebuf;
  4863. const char* bptr = resourcename;
  4864. const char* sep = strstr(resourcename, "::");
  4865. while(sep != NULL)
  4866. {
  4867. if(sep > bptr)
  4868. {
  4869. StringBuffer onebuf;
  4870. onebuf.append("ou=").append(sep-bptr, bptr).append(",");
  4871. namebuf.insert(0, onebuf.str());
  4872. }
  4873. bptr = sep + 2;
  4874. sep = strstr(bptr, "::");
  4875. }
  4876. if(*bptr != '\0')
  4877. {
  4878. StringBuffer onebuf;
  4879. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY && (rtype == RT_DEFAULT || rtype == RT_MODULE || rtype == RT_SERVICE))
  4880. onebuf.append("cn");
  4881. else
  4882. onebuf.append("ou");
  4883. onebuf.append("=").append(bptr).append(",");
  4884. namebuf.insert(0, onebuf.str());
  4885. }
  4886. namebuf.append(basedn);
  4887. LdapUtils::normalizeDn(namebuf.str(), m_ldapconfig->getBasedn(), ldapname);
  4888. }
  4889. virtual void name2rdn(SecResourceType rtype, const char* resourcename, StringBuffer& ldapname)
  4890. {
  4891. if(resourcename == NULL || *resourcename == '\0')
  4892. {
  4893. DBGLOG("CLdapClient::name2rdn resourcename must be provided");
  4894. return;
  4895. }
  4896. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY && (rtype == RT_DEFAULT || rtype == RT_MODULE || rtype == RT_SERVICE))
  4897. ldapname.append("cn=");
  4898. else
  4899. ldapname.append("ou=");
  4900. const char* prevptr = resourcename;
  4901. const char* nextptr = strstr(resourcename, "::");
  4902. while(nextptr != NULL)
  4903. {
  4904. prevptr = nextptr + 2;
  4905. nextptr = strstr(prevptr, "::");
  4906. }
  4907. if(*prevptr != '\0')
  4908. ldapname.append(prevptr);
  4909. }
  4910. virtual bool addResource(SecResourceType rtype, ISecUser& user, ISecResource* resource, SecPermissionType ptype, const char* basedn)
  4911. {
  4912. Owned<CSecurityDescriptor> template_sd = NULL;
  4913. const char* templatename = m_ldapconfig->getTemplateName();
  4914. if(templatename != NULL && *templatename != '\0')
  4915. {
  4916. IArrayOf<CSecurityDescriptor> sdlist;
  4917. template_sd.setown(new CSecurityDescriptor(templatename));
  4918. sdlist.append(*LINK(template_sd));
  4919. if(basedn && *basedn)
  4920. getSecurityDescriptors(sdlist, basedn);
  4921. else
  4922. getSecurityDescriptors(rtype, sdlist);
  4923. }
  4924. Owned<CSecurityDescriptor> default_sd = NULL;
  4925. if(template_sd != NULL && template_sd->getDescriptor().length() > 0)
  4926. {
  4927. MemoryBuffer template_sd_buf;
  4928. template_sd_buf.append(template_sd->getDescriptor());
  4929. if(m_pp != NULL)
  4930. default_sd.setown(m_pp->createDefaultSD(&user, resource, template_sd_buf));
  4931. }
  4932. else
  4933. {
  4934. if(m_pp != NULL)
  4935. default_sd.setown(m_pp->createDefaultSD(&user, resource, ptype));
  4936. }
  4937. return addResource(rtype, user, resource, ptype, basedn, default_sd.get());
  4938. }
  4939. virtual bool addResource(SecResourceType rtype, ISecUser& user, ISecResource* resource, SecPermissionType ptype, const char* basedn, CSecurityDescriptor* default_sd, bool lessException=true)
  4940. {
  4941. if(resource == NULL)
  4942. {
  4943. DBGLOG("CLdapClient::addResource can't add resource, ISecResource must be specified");
  4944. return true;
  4945. }
  4946. char* resourcename = (char*)resource->getName();
  4947. if(resourcename == NULL)
  4948. {
  4949. DBGLOG("CLdapClient::addResource can't add resource, empty resource name");
  4950. return false;
  4951. }
  4952. const char* rbasedn;
  4953. StringBuffer rbasednbuf;
  4954. if(basedn == NULL)
  4955. rbasedn = m_ldapconfig->getResourceBasedn(rtype);
  4956. else
  4957. {
  4958. LdapUtils::normalizeDn(basedn, m_ldapconfig->getBasedn(), rbasednbuf);
  4959. rbasedn = rbasednbuf.str();
  4960. }
  4961. if(rbasedn == NULL || *rbasedn == '\0')
  4962. {
  4963. DBGLOG("CLdapClient::addResource Can't add resource '%s', corresponding resource basedn is not defined",resourcename);
  4964. return false;
  4965. }
  4966. if(strchr(resourcename, '/') != NULL || strchr(resourcename, '=') != NULL)
  4967. {
  4968. DBGLOG("CLdapClient::addResource Can't add resource '%s', invalid characters specified",resourcename);
  4969. return false;
  4970. }
  4971. if(rtype == RT_FILE_SCOPE || rtype == RT_WORKUNIT_SCOPE)
  4972. {
  4973. StringBuffer extbuf;
  4974. name2dn(rtype, resourcename, rbasedn, extbuf);
  4975. createLdapBasedn(&user, extbuf.str(), ptype);
  4976. return true;
  4977. }
  4978. LdapServerType servertype = m_ldapconfig->getServerType();
  4979. char* description = (char*)((CLdapSecResource*)resource)->getDescription();
  4980. StringBuffer dn;
  4981. char *fieldname, *oc_name;
  4982. if(servertype == ACTIVE_DIRECTORY)
  4983. {
  4984. fieldname = "cn";
  4985. oc_name = "Volume";
  4986. }
  4987. else
  4988. {
  4989. fieldname = "ou";
  4990. oc_name = "OrganizationalUnit";
  4991. }
  4992. dn.append(fieldname).append("=").append(resourcename).append(",");
  4993. dn.append(rbasedn);
  4994. char *cn_values[] = {resourcename, NULL };
  4995. LDAPMod cn_attr =
  4996. {
  4997. LDAP_MOD_ADD,
  4998. fieldname,
  4999. cn_values
  5000. };
  5001. char *oc_values[] = {oc_name, NULL };
  5002. LDAPMod oc_attr =
  5003. {
  5004. LDAP_MOD_ADD,
  5005. "objectClass",
  5006. oc_values
  5007. };
  5008. char* uncname_values[] = {resourcename, NULL};
  5009. LDAPMod uncname_attr =
  5010. {
  5011. LDAP_MOD_ADD,
  5012. "uNCName",
  5013. uncname_values
  5014. };
  5015. StringBuffer descriptionbuf;
  5016. if(description && *description)
  5017. descriptionbuf.append(description);
  5018. else
  5019. descriptionbuf.appendf("Access to %s", resourcename);
  5020. char* description_values[] = {(char*)descriptionbuf.str(), NULL};
  5021. LDAPMod description_attr =
  5022. {
  5023. LDAP_MOD_ADD,
  5024. "description",
  5025. description_values
  5026. };
  5027. Owned<CSecurityDescriptor> template_sd = NULL;
  5028. const char* templatename = m_ldapconfig->getTemplateName();
  5029. if(templatename != NULL && *templatename != '\0')
  5030. {
  5031. IArrayOf<CSecurityDescriptor> sdlist;
  5032. template_sd.setown(new CSecurityDescriptor(templatename));
  5033. sdlist.append(*LINK(template_sd));
  5034. getSecurityDescriptors(rtype, sdlist);
  5035. }
  5036. int numberOfSegs = 0;
  5037. if(default_sd != NULL)
  5038. {
  5039. numberOfSegs = m_pp->sdSegments(default_sd);
  5040. }
  5041. LDAPMod **attrs = (LDAPMod**)(alloca((5+numberOfSegs)*sizeof(LDAPMod*)));
  5042. int ind = 0;
  5043. attrs[ind++] = &cn_attr;
  5044. attrs[ind++] = &oc_attr;
  5045. attrs[ind++] = &description_attr;
  5046. if(servertype == ACTIVE_DIRECTORY)
  5047. {
  5048. attrs[ind++] = &uncname_attr;
  5049. }
  5050. LDAPMod sd_attr;
  5051. if(default_sd != NULL)
  5052. {
  5053. struct berval** sd_values = (struct berval**)alloca(sizeof(struct berval*)*(numberOfSegs+1));
  5054. MemoryBuffer& sdbuf = default_sd->getDescriptor();
  5055. // Active Directory acutally has only one segment.
  5056. if(servertype == ACTIVE_DIRECTORY)
  5057. {
  5058. struct berval* sd_val = (struct berval*)alloca(sizeof(struct berval));
  5059. sd_val->bv_len = sdbuf.length();
  5060. sd_val->bv_val = (char*)sdbuf.toByteArray();
  5061. sd_values[0] = sd_val;
  5062. sd_values[1] = NULL;
  5063. sd_attr.mod_type = "ntSecurityDescriptor";
  5064. }
  5065. else
  5066. {
  5067. const char* bbptr = sdbuf.toByteArray();
  5068. const char* bptr = sdbuf.toByteArray();
  5069. int sdbuflen = sdbuf.length();
  5070. int segind;
  5071. for(segind = 0; segind < numberOfSegs; segind++)
  5072. {
  5073. if(bptr - bbptr >= sdbuflen)
  5074. break;
  5075. while(*bptr == '\0' && (bptr - bbptr) < sdbuflen)
  5076. bptr++;
  5077. const char* eptr = bptr;
  5078. while(*eptr != '\0' && (eptr - bbptr) < sdbuflen)
  5079. eptr++;
  5080. struct berval* sd_val = (struct berval*)alloca(sizeof(struct berval));
  5081. sd_val->bv_len = eptr - bptr;
  5082. sd_val->bv_val = (char*)bptr;
  5083. sd_values[segind] = sd_val;
  5084. bptr = eptr + 1;
  5085. }
  5086. sd_values[segind] = NULL;
  5087. sd_attr.mod_type = (char*)m_ldapconfig->getSdFieldName();
  5088. }
  5089. sd_attr.mod_op = LDAP_MOD_ADD | LDAP_MOD_BVALUES;
  5090. sd_attr.mod_vals.modv_bvals = sd_values;
  5091. attrs[ind++] = &sd_attr;
  5092. }
  5093. attrs[ind] = NULL;
  5094. Owned<ILdapConnection> lconn = m_connections->getConnection();
  5095. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  5096. int rc = ldap_add_ext_s(ld, (char*)dn.str(), attrs, NULL, NULL);
  5097. if ( rc != LDAP_SUCCESS )
  5098. {
  5099. if(rc == LDAP_ALREADY_EXISTS)
  5100. {
  5101. //WARNLOG("Can't insert %s to Ldap Server, an LDAP object with this name already exists", resourcename);
  5102. if(lessException)
  5103. {
  5104. DBGLOG("CLdapClient::addResource Can't add resource '%s', an LDAP object with this name already exists", resourcename);
  5105. return false;
  5106. }
  5107. else
  5108. throw MakeStringException(-1, "Can't insert %s, an LDAP object with this name already exists", resourcename);
  5109. }
  5110. else
  5111. {
  5112. throw MakeStringException(-1, "ldap_add_ext_s error for %s: %d %s", resourcename, rc, ldap_err2string( rc ));
  5113. }
  5114. }
  5115. return true;
  5116. }
  5117. virtual void enableUser(ISecUser* user, const char* dn, LDAP* ld)
  5118. {
  5119. const char* username = user->getName();
  5120. StringBuffer filter;
  5121. filter.append("sAMAccountName=").append(username);
  5122. char *attribute;
  5123. LDAPMessage *message;
  5124. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  5125. char *attrs[] = {"userAccountControl", NULL};
  5126. CLDAPMessage searchResult;
  5127. int rc = ldap_search_ext_s(ld, (char*)m_ldapconfig->getUserBasedn(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs, 0, NULL, NULL, &timeOut, LDAP_NO_LIMIT, &searchResult.msg );
  5128. if ( rc != LDAP_SUCCESS )
  5129. {
  5130. DBGLOG("ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getUserBasedn());
  5131. throw MakeStringException(-1, "ldap_search_ext_s error: %s, when searching %s under %s", ldap_err2string( rc ), filter.str(), m_ldapconfig->getUserBasedn());
  5132. }
  5133. StringBuffer act_ctrl;
  5134. message = LdapFirstEntry( ld, searchResult);
  5135. if(message != NULL)
  5136. {
  5137. CLDAPGetAttributesWrapper atts(ld, searchResult);
  5138. for ( attribute = atts.getFirst();
  5139. attribute != NULL;
  5140. attribute = atts.getNext())
  5141. {
  5142. if(0 == stricmp(attribute, "userAccountControl"))
  5143. {
  5144. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  5145. if (vals.hasValues())
  5146. {
  5147. act_ctrl.append(vals.queryCharValue(0));
  5148. break;
  5149. }
  5150. }
  5151. }
  5152. }
  5153. if(act_ctrl.length() == 0)
  5154. {
  5155. DBGLOG("enableUser: userAccountControl doesn't exist for user %s",username);
  5156. throw MakeStringException(-1, "enableUser: userAccountControl doesn't exist for user %s",username);
  5157. }
  5158. unsigned act_ctrl_val = atoi(act_ctrl.str());
  5159. // UF_ACCOUNTDISABLE 0x0002
  5160. act_ctrl_val &= 0xFFFFFFFD;
  5161. #ifdef _DONT_EXPIRE_PASSWORD
  5162. // UF_DONT_EXPIRE_PASSWD 0x10000
  5163. if (m_domainPwdsNeverExpire)
  5164. act_ctrl_val |= 0x10000;
  5165. #endif
  5166. StringBuffer new_act_ctrl;
  5167. new_act_ctrl.append(act_ctrl_val);
  5168. char *ctrl_values[] = {(char*)new_act_ctrl.str(), NULL};
  5169. LDAPMod ctrl_attr = {
  5170. LDAP_MOD_REPLACE,
  5171. "userAccountControl",
  5172. ctrl_values
  5173. };
  5174. LDAPMod *cattrs[2];
  5175. cattrs[0] = &ctrl_attr;
  5176. cattrs[1] = NULL;
  5177. rc = ldap_modify_ext_s(ld, (char*)dn, cattrs, NULL, NULL);
  5178. if ( rc != LDAP_SUCCESS )
  5179. {
  5180. throw MakeStringException(-1, "error enableUser %s, ldap_modify_ext_s error: %s", username, ldap_err2string( rc ));
  5181. }
  5182. // set the password.
  5183. Owned<ISecUser> tmpuser = new CLdapSecUser(user->getName(), "");
  5184. const char* passwd = user->credentials().getPassword();
  5185. if(passwd == NULL || *passwd == '\0')
  5186. passwd = "password";
  5187. if (!updateUserPassword(*tmpuser, passwd, NULL))
  5188. {
  5189. DBGLOG("Error updating password for %s",username);
  5190. throw MakeStringException(-1, "Error updating password for %s",username);
  5191. }
  5192. }
  5193. virtual bool addUser(ISecUser& user)
  5194. {
  5195. const char* username = user.getName();
  5196. if(username == NULL || *username == '\0')
  5197. {
  5198. DBGLOG("Can't add user, username not set");
  5199. throw MakeStringException(-1, "Can't add user, username not set");
  5200. }
  5201. const char* fname = user.getFirstName();
  5202. const char* lname = user.getLastName();
  5203. if((lname == NULL || *lname == '\0') && (fname == NULL || *fname == '\0' || m_ldapconfig->getServerType() == IPLANET))
  5204. lname = username;
  5205. const char* fullname = user.getFullName();
  5206. StringBuffer fullname_buf;
  5207. if(fullname == NULL || *fullname == '\0')
  5208. {
  5209. if(fname != NULL && *fname != '\0')
  5210. {
  5211. fullname_buf.append(fname);
  5212. if(lname != NULL && *lname != '\0')
  5213. fullname_buf.append(" ");
  5214. }
  5215. if(lname != NULL && *lname != '\0')
  5216. fullname_buf.append(lname);
  5217. if(fullname_buf.length() == 0)
  5218. {
  5219. fullname_buf.append(username);
  5220. }
  5221. fullname = fullname_buf.str();
  5222. }
  5223. const char* employeeID = user.getEmployeeID();
  5224. StringBuffer dn;
  5225. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  5226. {
  5227. dn.append("cn=").append(fullname).append(",");
  5228. }
  5229. else
  5230. {
  5231. dn.append("uid=").append(user.getName()).append(",");
  5232. }
  5233. dn.append(m_ldapconfig->getUserBasedn());
  5234. char* oc_name;
  5235. char* act_fieldname;
  5236. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  5237. {
  5238. oc_name = "User";
  5239. act_fieldname = "sAMAccountName";
  5240. }
  5241. else
  5242. {
  5243. oc_name = "inetorgperson";
  5244. act_fieldname = "uid";
  5245. }
  5246. char *cn_values[] = {(char*)fullname, NULL };
  5247. LDAPMod cn_attr =
  5248. {
  5249. LDAP_MOD_ADD,
  5250. "cn",
  5251. cn_values
  5252. };
  5253. char *oc_values[] = {oc_name, NULL};
  5254. LDAPMod oc_attr =
  5255. {
  5256. LDAP_MOD_ADD,
  5257. "objectClass",
  5258. oc_values
  5259. };
  5260. char *gn_values[] = { (char*)fname, NULL };
  5261. LDAPMod gn_attr = {
  5262. LDAP_MOD_ADD,
  5263. "givenName",
  5264. gn_values
  5265. };
  5266. char *sn_values[] = { (char*)lname, NULL };
  5267. LDAPMod sn_attr = {
  5268. LDAP_MOD_ADD,
  5269. "sn",
  5270. sn_values
  5271. };
  5272. char* actname_values[] = {(char*)username, NULL};
  5273. LDAPMod actname_attr =
  5274. {
  5275. LDAP_MOD_ADD,
  5276. act_fieldname,
  5277. actname_values
  5278. };
  5279. const char* passwd = user.credentials().getPassword();
  5280. if(passwd == NULL || *passwd == '\0')
  5281. passwd = "password";
  5282. char* passwd_values[] = {(char*)passwd, NULL};
  5283. LDAPMod passwd_attr =
  5284. {
  5285. LDAP_MOD_ADD,
  5286. "userpassword",
  5287. passwd_values
  5288. };
  5289. char *dispname_values[] = {(char*)fullname, NULL };
  5290. LDAPMod dispname_attr =
  5291. {
  5292. LDAP_MOD_ADD,
  5293. "displayName",
  5294. dispname_values
  5295. };
  5296. char* username_values[] = {(char*)username, NULL};
  5297. LDAPMod username_attr =
  5298. {
  5299. LDAP_MOD_ADD,
  5300. "userPrincipalName",
  5301. username_values
  5302. };
  5303. char* employeeID_values[] = {(char*)employeeID, NULL};
  5304. LDAPMod employeeID_attr =
  5305. {
  5306. LDAP_MOD_ADD,
  5307. "employeeId",
  5308. employeeID_values
  5309. };
  5310. LDAPMod *attrs[9];
  5311. int ind = 0;
  5312. attrs[ind++] = &cn_attr;
  5313. attrs[ind++] = &oc_attr;
  5314. if(fname != NULL && *fname != '\0')
  5315. attrs[ind++] = &gn_attr;
  5316. if(lname != NULL && *lname != '\0')
  5317. attrs[ind++] = &sn_attr;
  5318. attrs[ind++] = &actname_attr;
  5319. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  5320. {
  5321. attrs[ind++] = &username_attr;
  5322. attrs[ind++] = &dispname_attr;
  5323. if (employeeID && *employeeID)
  5324. attrs[ind++] = &employeeID_attr;
  5325. }
  5326. else
  5327. {
  5328. attrs[ind++] = &passwd_attr;
  5329. }
  5330. attrs[ind] = NULL;
  5331. Owned<ILdapConnection> lconn = m_connections->getConnection();
  5332. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  5333. int rc = ldap_add_ext_s(ld, (char*)dn.str(), attrs, NULL, NULL);
  5334. if ( rc != LDAP_SUCCESS )
  5335. {
  5336. if(rc == LDAP_ALREADY_EXISTS)
  5337. {
  5338. DBGLOG("Can't add user %s, an LDAP object with this name already exists", username);
  5339. throw MakeStringException(-1, "Can't add user %s, an LDAP object with this name already exists", username);
  5340. }
  5341. else
  5342. {
  5343. DBGLOG("Error addUser %s, ldap_add_ext_s error: %s", username, ldap_err2string( rc ));
  5344. throw MakeStringException(-1, "Error addUser %s, ldap_add_ext_s error: %s", username, ldap_err2string( rc ));
  5345. }
  5346. }
  5347. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  5348. {
  5349. try
  5350. {
  5351. enableUser(&user, dn.str(), ld);
  5352. }
  5353. catch(...)
  5354. {
  5355. deleteUser(&user);
  5356. throw;
  5357. }
  5358. }
  5359. //Add tempfile scope for this user (spill, paused and checkpoint
  5360. //will be created under this user specific scope)
  5361. StringBuffer resName(queryDfsXmlBranchName(DXB_Internal));
  5362. resName.append("::").append(username);
  5363. Owned<ISecResource> resource = new CLdapSecResource(resName.str());
  5364. if (!addResource(RT_FILE_SCOPE, user, resource, PT_ADMINISTRATORS_AND_USER, m_ldapconfig->getResourceBasedn(RT_FILE_SCOPE)))
  5365. {
  5366. throw MakeStringException(-1, "Error adding temp file scope %s",resName.str());
  5367. }
  5368. return true;
  5369. }
  5370. bool createUserScope(ISecUser& user)
  5371. {
  5372. //Add tempfile scope for given user (spill, paused and checkpoint
  5373. //files will be created under this user specific scope)
  5374. StringBuffer resName(queryDfsXmlBranchName(DXB_Internal));
  5375. resName.append("::").append(user.getName());
  5376. Owned<ISecResource> resource = new CLdapSecResource(resName.str());
  5377. return addResource(RT_FILE_SCOPE, user, resource, PT_ADMINISTRATORS_AND_USER, m_ldapconfig->getResourceBasedn(RT_FILE_SCOPE));
  5378. }
  5379. virtual aindex_t getManagedFileScopes(IArrayOf<ISecResource>& scopes)
  5380. {
  5381. getResourcesEx(RT_FILE_SCOPE, m_ldapconfig->getResourceBasedn(RT_FILE_SCOPE), NULL, NULL, scopes);
  5382. return scopes.length();
  5383. }
  5384. virtual SecAccessFlags queryDefaultPermission(ISecUser& user)
  5385. {
  5386. const char* basedn = m_ldapconfig->getResourceBasedn(RT_FILE_SCOPE);
  5387. if(basedn == NULL || *basedn == '\0')
  5388. {
  5389. DBGLOG("corresponding basedn is not defined");
  5390. return SecAccess_Unavailable;
  5391. }
  5392. const char* basebasedn = strchr(basedn, ',') + 1;
  5393. StringBuffer baseresource;
  5394. baseresource.append(basebasedn-basedn-4, basedn+3);
  5395. IArrayOf<ISecResource> base_resources;
  5396. base_resources.append(*new CLdapSecResource(baseresource.str()));
  5397. bool baseok = authorizeScope(user, base_resources, basebasedn);
  5398. if(baseok)
  5399. return base_resources.item(0).getAccessFlags();
  5400. else
  5401. return UNK_PERM_VALUE;
  5402. }
  5403. bool isReservedGroupName(const char * groupName)
  5404. {
  5405. if (stricmp(groupName, "Administrators") == 0 ||
  5406. stricmp(groupName, "Authenticated Users") == 0 ||
  5407. stricmp(groupName, "Directory Administrators") == 0)
  5408. {
  5409. return true;
  5410. }
  5411. return false;
  5412. }
  5413. //Data View related interfaces
  5414. void createView(const char * viewName, const char * viewDescription)
  5415. {
  5416. if(viewName == nullptr || *viewName == '\0')
  5417. throw MakeStringException(-1, "Can't add view, viewname is empty");
  5418. if (isReservedGroupName(viewName))
  5419. {
  5420. throw MakeStringException(-1, "Can't add view, '%s' is a reserved name", viewName);
  5421. }
  5422. addGroup(viewName, nullptr, nullptr, m_ldapconfig->getViewBasedn());//TODO Save description
  5423. }
  5424. void deleteView(const char * viewName)
  5425. {
  5426. if(viewName == nullptr || *viewName == '\0')
  5427. throw MakeStringException(-1, "Can't delete view, viewname is empty");
  5428. deleteGroup(viewName, (const char *)m_ldapconfig->getViewBasedn());
  5429. }
  5430. void queryAllViews(StringArray & viewNames, StringArray & viewDescriptions, StringArray & viewManagedBy)
  5431. {
  5432. StringArray names;
  5433. StringArray managedBy;
  5434. StringArray desc;
  5435. getAllGroups(names, managedBy, desc, (const char *)m_ldapconfig->getViewBasedn());
  5436. unsigned len = names.ordinality();
  5437. for(unsigned idx = 0; idx < len; idx++)
  5438. {
  5439. const char * pName = names.item(idx);
  5440. if (!isReservedGroupName(pName))
  5441. {
  5442. viewNames.append(pName);
  5443. viewDescriptions.append(desc.item(idx));
  5444. viewManagedBy.append(managedBy.item(idx));
  5445. }
  5446. }
  5447. }
  5448. bool userInView(const char * user, const char* viewName)
  5449. {
  5450. if(user == nullptr || *user == '\0')
  5451. throw MakeStringException(-1, "Can't check user in view, user name is empty");
  5452. if(viewName == nullptr || *viewName == '\0')
  5453. throw MakeStringException(-1, "Can't check user in view, viewName is empty");
  5454. try
  5455. {
  5456. StringBuffer userDN;
  5457. getUserDN(user, userDN);
  5458. VStringBuffer viewDN("CN=%s,%s",viewName, m_ldapconfig->getViewBasedn());
  5459. return userInGroup(userDN.str(), viewDN.str());
  5460. }
  5461. catch (IException* e)
  5462. {
  5463. #ifdef _DEBUG
  5464. StringBuffer emsg;
  5465. e->errorMessage(emsg);
  5466. DBGLOG("userInView(%s,%s) - %s", user, viewName, emsg.str());
  5467. #endif
  5468. e->Release();
  5469. return false;
  5470. }
  5471. }
  5472. void updateViewContents(const char * viewName, const char * content)
  5473. {
  5474. if(viewName == nullptr || *viewName == '\0')
  5475. throw MakeStringException(-1, "Can't updateViewContents, viewName is empty");
  5476. //Update LDAP description
  5477. char *desc_values[] = { (content && *content != '\0') ? (char*)content : (char*)"|", NULL };
  5478. LDAPMod desc_attr = {
  5479. LDAP_MOD_REPLACE,
  5480. "description",
  5481. desc_values
  5482. };
  5483. LDAPMod *attrs[2];
  5484. attrs[0] = &desc_attr;
  5485. attrs[1] = nullptr;
  5486. TIMEVAL timeOut = { m_ldapconfig->getLdapTimeout(), 0 };
  5487. Owned<ILdapConnection> lconn = m_connections->getConnection();
  5488. LDAP* ld = ((CLdapConnection*) lconn.get())->getLd();
  5489. StringBuffer dn;
  5490. dn.appendf("CN=%s,%s", viewName, (char*) m_ldapconfig->getViewBasedn());
  5491. unsigned rc = ldap_modify_ext_s(ld, (char*)dn.str(), attrs, nullptr, nullptr);
  5492. if (rc != LDAP_SUCCESS )
  5493. throw MakeStringException(-1, "Error updating view %s - %s", viewName, ldap_err2string( rc ));
  5494. }
  5495. void addViewColumns(const char * viewName, StringArray & files, StringArray & columns)
  5496. {
  5497. if(viewName == nullptr || *viewName == '\0')
  5498. throw MakeStringException(-1, "Can't addViewColumns, viewName is empty");
  5499. StringArray currFiles;
  5500. StringArray currCols;
  5501. queryViewColumns(viewName, currFiles, currCols);
  5502. unsigned vCount = currFiles.ordinality();
  5503. assertex(vCount == currCols.ordinality());
  5504. unsigned len = files.ordinality();
  5505. assertex(len == columns.ordinality());
  5506. bool changed = false;
  5507. for(unsigned idx = 0; idx < len; idx++)
  5508. {
  5509. bool isDup = false;
  5510. for (unsigned vIdx = 0; vIdx < vCount; vIdx++)//look for dups
  5511. {
  5512. if (0 == stricmp(files.item(idx), currFiles.item(vIdx)) &&
  5513. 0 == stricmp(columns.item(idx), currCols.item(vIdx)))
  5514. {
  5515. isDup = true;//skip duplicate entry
  5516. break;
  5517. }
  5518. }
  5519. if (!isDup)
  5520. {
  5521. currFiles.append(files.item(idx));
  5522. currCols.append(columns.item(idx));
  5523. changed = true;
  5524. }
  5525. }
  5526. if (!changed)
  5527. {
  5528. throw MakeStringException(-1, "Specified columns already exist in view");
  5529. }
  5530. ///build description buffer containing one or more ||lfn|col
  5531. StringBuffer description;
  5532. len = currFiles.ordinality();
  5533. for(unsigned idx = 0; idx < len; idx++)
  5534. {
  5535. description.appendf("||%s|%s",currFiles.item(idx), currCols.item(idx));//use illegal LFN character as separators
  5536. }
  5537. updateViewContents(viewName, description.str());
  5538. }
  5539. void removeViewColumns(const char * viewName, StringArray & files, StringArray & columns)
  5540. {
  5541. if(viewName == nullptr || *viewName == '\0')
  5542. throw MakeStringException(-1, "Can't removeViewColumns, viewName is empty");
  5543. StringArray currFiles;
  5544. StringArray currCols;
  5545. queryViewColumns(viewName, currFiles, currCols);
  5546. assertex(currFiles.ordinality() == currCols.ordinality());
  5547. unsigned len = files.ordinality();
  5548. assertex(len == columns.ordinality());
  5549. bool changed = false;
  5550. for(unsigned idx = 0; idx < len; idx++)//for all pairs to be removed
  5551. {
  5552. unsigned len2 = currFiles.ordinality();
  5553. for(unsigned idx2 = 0; idx2 < len2; idx2++)
  5554. {
  5555. if (0 == stricmp(files.item(idx), currFiles.item(idx2)) &&
  5556. 0 == stricmp(columns.item(idx), currCols.item(idx2)))
  5557. {
  5558. currFiles.remove(idx2);
  5559. currCols.remove(idx2);
  5560. changed = true;
  5561. break;
  5562. }
  5563. }
  5564. }
  5565. if (!changed)
  5566. {
  5567. throw MakeStringException(-1, "Specified columns do not exist in view");
  5568. }
  5569. ///build description buffer containing one or more ||lfn|col
  5570. StringBuffer description;
  5571. len = currFiles.ordinality();
  5572. for(unsigned idx = 0; idx < len; idx++)
  5573. {
  5574. description.appendf("||%s|%s",currFiles.item(idx), currCols.item(idx));//use illegal LFN character as separators
  5575. }
  5576. updateViewContents(viewName, description.str());
  5577. }
  5578. void queryViewColumns(const char * viewName, StringArray & files, StringArray & columns)
  5579. {
  5580. if(viewName == nullptr || *viewName == '\0')
  5581. throw MakeStringException(-1, "Can't queryViewColumns, viewName is empty");
  5582. StringBuffer filter;
  5583. if(m_ldapconfig->getServerType() == ACTIVE_DIRECTORY)
  5584. filter.append("objectClass=group");
  5585. else
  5586. filter.append("objectClass=groupofuniquenames");
  5587. TIMEVAL timeOut = {m_ldapconfig->getLdapTimeout(),0};
  5588. Owned<ILdapConnection> lconn = m_connections->getConnection();
  5589. LDAP* ld = ((CLdapConnection*)lconn.get())->getLd();
  5590. char *attrs[] = {"description", NULL};
  5591. StringBuffer dn;
  5592. dn.appendf("CN=%s,%s", viewName, (char*)m_ldapconfig->getViewBasedn() );
  5593. CPagedLDAPSearch pagedSrch(ld, m_ldapconfig->getLdapTimeout(), (char*)dn.str(), LDAP_SCOPE_SUBTREE, (char*)filter.str(), attrs);
  5594. int idx = 0;
  5595. LDAPMessage *message = pagedSrch.getFirstEntry();
  5596. if (message)
  5597. {
  5598. CLDAPGetAttributesWrapper atts(ld, message);
  5599. char * attribute = atts.getFirst();
  5600. if (attribute)
  5601. {
  5602. CLDAPGetValuesLenWrapper vals(ld, message, attribute);
  5603. if(vals.hasValues() && stricmp(attribute, "description") == 0)
  5604. {
  5605. StringBuffer sb(vals.queryCharValue(0));
  5606. if (!sb.isEmpty())
  5607. {
  5608. StringBuffer sbFile;
  5609. StringBuffer sbCol;
  5610. unsigned finger = 0;
  5611. unsigned len = sb.length();
  5612. while (finger < len)
  5613. {
  5614. while (finger < len && sb.charAt(finger) == '|')
  5615. finger++;//skip to lfn
  5616. sbFile.clear();
  5617. while (finger < len && sb.charAt(finger) != '|')
  5618. sbFile.append(sb.charAt(finger++));
  5619. while (finger < len && sb.charAt(finger) == '|')
  5620. finger++;//skip to column name
  5621. sbCol.clear();
  5622. while (finger < len && sb.charAt(finger) != '|')
  5623. sbCol.append(sb.charAt(finger++));
  5624. if (!sbFile.isEmpty() && !sbCol.isEmpty())
  5625. {
  5626. files.append(sbFile.str());
  5627. columns.append(sbCol.str());
  5628. }
  5629. }
  5630. }
  5631. }
  5632. }
  5633. }
  5634. }
  5635. void addViewMembers(const char * viewName, StringArray & viewUsers, StringArray & viewGroups)
  5636. {
  5637. if(viewName == nullptr || *viewName == '\0')
  5638. throw MakeStringException(-1, "Can't addViewMembers, viewName is empty");
  5639. unsigned len = viewUsers.ordinality();
  5640. for (unsigned idx = 0; idx < len; idx++)
  5641. {
  5642. changeUserGroup("add", viewUsers.item(idx), viewName, m_ldapconfig->getViewBasedn());
  5643. }
  5644. //TODO handle viewGroups
  5645. }
  5646. void removeViewMembers(const char * viewName, StringArray & viewUsers, StringArray & viewGroups)
  5647. {
  5648. if(viewName == nullptr || *viewName == '\0')
  5649. throw MakeStringException(-1, "Can't removeViewMembers, viewName is empty");
  5650. unsigned len = viewUsers.ordinality();
  5651. for (unsigned idx = 0; idx < len; idx++)
  5652. {
  5653. changeUserGroup("delete", viewUsers.item(idx), viewName, m_ldapconfig->getViewBasedn());
  5654. }
  5655. //TODO handle viewGroups
  5656. }
  5657. void queryViewMembers(const char * viewName, StringArray & viewUsers, StringArray & viewGroups)
  5658. {
  5659. if(viewName == nullptr || *viewName == '\0')
  5660. throw MakeStringException(-1, "Can't queryViewMembers, viewName is empty");
  5661. getGroupMembers(viewName, viewUsers, m_ldapconfig->getViewBasedn());
  5662. //TODO get viewGroups
  5663. }
  5664. };
  5665. #ifdef _WIN32
  5666. bool verifyServerCert(LDAP* ld, PCCERT_CONTEXT pServerCert)
  5667. {
  5668. return true;
  5669. }
  5670. #endif
  5671. ILdapClient* createLdapClient(IPropertyTree* cfg)
  5672. {
  5673. return new CLdapClient(cfg);
  5674. }