xref: /illumos-gate/usr/src/cmd/idmap/idmapd/adutils.h (revision 84decf41)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #ifndef _ADUTILS_H
28 #define	_ADUTILS_H
29 
30 #pragma ident	"%Z%%M%	%I%	%E% SMI"
31 
32 #ifdef __cplusplus
33 extern "C" {
34 #endif
35 
36 /*
37  * Processes name2sid & sid2name lookups for a given user or computer
38  * from an AD Difrectory server using GSSAPI authentication
39  */
40 
41 #include <stdio.h>
42 #include <stdlib.h>
43 #include <unistd.h>
44 #include <lber.h>
45 #include <ldap.h>
46 #include <sasl/sasl.h>
47 #include <string.h>
48 #include <ctype.h>
49 #include <sys/types.h>
50 #include <time.h>
51 #include <thread.h>
52 #include <synch.h>
53 #include "idmap_prot.h"
54 #include <sys/idmap.h>
55 
56 /*
57  * idmapd interfaces stolen? from other idmapd code?
58  */
59 
60 /*
61  * Eventually these should be an enum here, but instead we share a
62  * namespace with other things in idmapd.
63  */
64 #define	_IDMAP_T_OTHER		0
65 #define	_IDMAP_T_USER		-1004
66 #define	_IDMAP_T_GROUP		-1005
67 #define	_IDMAP_T_DOMAIN		-1006
68 #define	_IDMAP_T_COMPUTER	-1007
69 
70 #define	SID_MAX_SUB_AUTHORITIES	15
71 #define	MAXBINSID	(1 + 1 + 6 + (SID_MAX_SUB_AUTHORITIES * 4))
72 #define	MAXHEXBINSID	(MAXBINSID * 3)
73 
74 typedef uint32_t rid_t;
75 
76 /*
77  * We use the port numbers for normal LDAP and global catalog LDAP as
78  * the enum values for this enumeration.  Clever?  Silly?  You decide.
79  * Although we never actually use these enum values as port numbers and
80  * never will, so this is just cute.
81  */
82 typedef enum idmap_ad_partition {
83 	IDMAP_AD_DATA = 389,
84 	IDMAP_AD_GLOBAL_CATALOG = 3268
85 } idmap_ad_partition_t;
86 
87 typedef struct ad ad_t;
88 typedef struct idmap_query_state idmap_query_state_t;
89 
90 /*
91  * Idmap interfaces:
92  *
93  *  - an ad_t represents an AD partition
94  *  - a DS (hostname + port, if port != 0) can be added/removed from an ad_t
95  *  - and because libldap supports space-separated lists of servers, a
96  *  single hostname value can actually be a set of hostnames.
97  *  - an ad_t can be allocated, ref'ed and released; last release
98  *  releases resources
99  *
100  *  - lookups are batched; see below.
101  *
102  * See below.
103  */
104 
105 /* Allocate/release ad_t objects */
106 int idmap_ad_alloc(ad_t **new_ad, const char *default_domain,
107 		idmap_ad_partition_t part);
108 void idmap_ad_free(ad_t **ad);
109 
110 /* Add/remove a DS to/from an ad_t */
111 int idmap_add_ds(ad_t *ad, const char *host, int port);
112 void idmap_delete_ds(ad_t *ad, const char *host, int port);
113 
114 /*
115  * Batch lookups
116  *
117  * Start a batch, add queries to the batch one by one (the output
118  * pointers should all differ, so that a query's results don't clobber
119  * any other's), end the batch to wait for replies for all outstanding
120  * queries.  The output parameters of each query are initialized to NULL
121  * or -1 as appropriate.
122  *
123  * LDAP searches are sent one by one without waiting (i.e., blocking)
124  * for replies.  Replies are handled as soon as they are available.
125  * Missing replies are waited for only when idmap_lookup_batch_end() is
126  * called.
127  *
128  * If an add1 function returns != 0 then abort the batch by calling
129  * idmap_lookup_batch_end(), but note that some queries may have been
130  * answered, so check the result code of each query.
131  */
132 
133 /* Start a batch of lookups */
134 idmap_retcode idmap_lookup_batch_start(ad_t *ad, int nqueries,
135 		idmap_query_state_t **state);
136 
137 /* End a batch and release its idmap_query_state_t object */
138 idmap_retcode idmap_lookup_batch_end(idmap_query_state_t **state,
139 		struct timeval *timeout);
140 
141 /* Abandon a batch and release its idmap_query_state_t object */
142 void idmap_lookup_release_batch(idmap_query_state_t **state);
143 
144 /*
145  * Add a name->SID lookup
146  *
147  *  - 'dname' is optional; if NULL or empty string then 'name' has to be
148  *  a user/group name qualified wih a domainname (e.g., foo@domain),
149  *  else the 'name' must not be qualified and the domainname must be
150  *  passed in 'dname'.
151  *
152  *  - if 'rid' is NULL then the output SID string will include the last
153  *  RID, else it won't and the last RID value will be stored in *rid.
154  *
155  *  The caller must free() *sid.
156  */
157 idmap_retcode idmap_name2sid_batch_add1(idmap_query_state_t *state,
158 		const char *name, const char *dname,
159 		char **sid, rid_t *rid, int *sid_type, idmap_retcode *rc);
160 /*
161  * Add a SID->name lookup
162  *
163  *  - 'rid' is optional; if NULL then 'sid' is expected to have the
164  *  user/group RID present, else 'sid' is expected not to have it, and
165  *  *rid will be used to qualify the given 'sid'
166  *
167  *  - 'dname' is optional; if NULL then the fully qualified user/group
168  *  name will be stored in *name, else the domain name will be stored in
169  *  *dname and the user/group name will be stored in *name without a
170  *  domain qualifier.
171  *
172  *  The caller must free() *name and *dname (if present).
173  */
174 idmap_retcode idmap_sid2name_batch_add1(idmap_query_state_t *state,
175 		const char *sid, const rid_t *rid,
176 		char **name, char **dname, int *sid_type, idmap_retcode *rc);
177 
178 #ifdef __cplusplus
179 }
180 #endif
181 
182 #endif	/* _ADUTILS_H */
183