17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
545916cd2Sjpk  * Common Development and Distribution License (the "License").
645916cd2Sjpk  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate /*
229f2fd570SJulian Pullen  * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
23695ef821SGordon Ross  * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
247c478bd9Sstevel@tonic-gate  */
257c478bd9Sstevel@tonic-gate 
267c478bd9Sstevel@tonic-gate 
277c478bd9Sstevel@tonic-gate #ifndef	_NS_SLDAP_H
287c478bd9Sstevel@tonic-gate #define	_NS_SLDAP_H
297c478bd9Sstevel@tonic-gate 
307c478bd9Sstevel@tonic-gate #ifdef __cplusplus
317c478bd9Sstevel@tonic-gate extern "C" {
327c478bd9Sstevel@tonic-gate #endif
337c478bd9Sstevel@tonic-gate 
347c478bd9Sstevel@tonic-gate #include <stdio.h>
357c478bd9Sstevel@tonic-gate #include <sys/types.h>
367c478bd9Sstevel@tonic-gate #include <lber.h>
377c478bd9Sstevel@tonic-gate #include <ldap.h>
387c478bd9Sstevel@tonic-gate 
397c478bd9Sstevel@tonic-gate /*
407c478bd9Sstevel@tonic-gate  * Version
417c478bd9Sstevel@tonic-gate  */
427c478bd9Sstevel@tonic-gate #define	NS_LDAP_VERSION		NS_LDAP_VERSION_2
437c478bd9Sstevel@tonic-gate #define	NS_LDAP_VERSION_1	"1.0"
447c478bd9Sstevel@tonic-gate #define	NS_LDAP_VERSION_2	"2.0"
457c478bd9Sstevel@tonic-gate 
467c478bd9Sstevel@tonic-gate /*
477c478bd9Sstevel@tonic-gate  * Flags
487c478bd9Sstevel@tonic-gate  */
497c478bd9Sstevel@tonic-gate #define	NS_LDAP_HARD		  0x001
507c478bd9Sstevel@tonic-gate #define	NS_LDAP_ALL_RES		  0x002
517c478bd9Sstevel@tonic-gate 
527c478bd9Sstevel@tonic-gate /* Search Referral Option */
537c478bd9Sstevel@tonic-gate typedef enum SearchRef {
547c478bd9Sstevel@tonic-gate 	NS_LDAP_FOLLOWREF	= 0x004,
557c478bd9Sstevel@tonic-gate 	NS_LDAP_NOREF		= 0x008
567c478bd9Sstevel@tonic-gate } SearchRef_t;
577c478bd9Sstevel@tonic-gate 
587c478bd9Sstevel@tonic-gate typedef enum ScopeType {
597c478bd9Sstevel@tonic-gate 	NS_LDAP_SCOPE_BASE	= 0x010,
607c478bd9Sstevel@tonic-gate 	NS_LDAP_SCOPE_ONELEVEL	= 0x020,
617c478bd9Sstevel@tonic-gate 	NS_LDAP_SCOPE_SUBTREE	= 0x040
627c478bd9Sstevel@tonic-gate } ScopeType_t;
637c478bd9Sstevel@tonic-gate 
647c478bd9Sstevel@tonic-gate /*
657c478bd9Sstevel@tonic-gate  * BE VERY CAREFUL. DO NOT USE FLAG NS_LDAP_KEEP_CONN UNLESS YOU MUST
667c478bd9Sstevel@tonic-gate  * IN libsldap.so.1 THERE IS NO CONNECTION GARBAGE COLLECTION AND IF
677c478bd9Sstevel@tonic-gate  * THIS FLAG GETS USED THERE MIGHT BE A CONNECTION LEAK. CURRENTLY THIS
687c478bd9Sstevel@tonic-gate  * IS ONLY SUPPORTED FOR LIST AND INTENDED FOR APPLICATIONS LIKE AUTOMOUNTER
697c478bd9Sstevel@tonic-gate  */
707c478bd9Sstevel@tonic-gate 
717c478bd9Sstevel@tonic-gate #define	NS_LDAP_KEEP_CONN	  0x080
727c478bd9Sstevel@tonic-gate #define	NS_LDAP_NEW_CONN	  0x400
737c478bd9Sstevel@tonic-gate #define	NS_LDAP_NOMAP		  0x800
747c478bd9Sstevel@tonic-gate 
757c478bd9Sstevel@tonic-gate #define	NS_LDAP_PAGE_CTRL	  0x1000
767c478bd9Sstevel@tonic-gate #define	NS_LDAP_NO_PAGE_CTRL	  0x0000
777c478bd9Sstevel@tonic-gate 
78f5c3c7a7Ssdussud /*
79f5c3c7a7Ssdussud  * NS_LDAP_NOT_CVT_DN is needed when attribute mapping is used
80f5c3c7a7Ssdussud  * to retrieve the DN in LDAP and DN is not to be converted when
81f5c3c7a7Ssdussud  * being passed back to the application. See __ns_ldap_uid2dn()
82f5c3c7a7Ssdussud  * and __ns_ldap_host2dn() for such usage.
83f5c3c7a7Ssdussud  */
84f5c3c7a7Ssdussud #define	NS_LDAP_NOT_CVT_DN	0x2000
85f5c3c7a7Ssdussud 
86dd1104fbSMichen Chang /*
87dd1104fbSMichen Chang  * NS_LDAP_UPDATE_SHADOW is for a privileged caller of the
88dd1104fbSMichen Chang  * __ns_ldap_repAttr() to update the shadow database on the
89dd1104fbSMichen Chang  * LDAP server.
90dd1104fbSMichen Chang  */
91dd1104fbSMichen Chang #define	NS_LDAP_UPDATE_SHADOW	0x4000
92dd1104fbSMichen Chang 
93b57459abSJulian Pullen /*
94b57459abSJulian Pullen  * NS_LDAP_READ_SHADOW is for a privileged caller of __ns_ldap_list()
95b57459abSJulian Pullen  * and __ns_ldap_firstEntry() to read the shadow database on the
96b57459abSJulian Pullen  * LDAP server.
97b57459abSJulian Pullen  */
98b57459abSJulian Pullen #define	NS_LDAP_READ_SHADOW	0x8000
99b57459abSJulian Pullen 
1007c478bd9Sstevel@tonic-gate /*
1017c478bd9Sstevel@tonic-gate  * Authentication Information
1027c478bd9Sstevel@tonic-gate  */
1037c478bd9Sstevel@tonic-gate typedef enum CredLevel {
1047c478bd9Sstevel@tonic-gate 	NS_LDAP_CRED_ANON	= 0,
1057c478bd9Sstevel@tonic-gate 	NS_LDAP_CRED_PROXY	= 1,
106cb5caa98Sdjl 	NS_LDAP_CRED_SELF	= 2
1077c478bd9Sstevel@tonic-gate } CredLevel_t;
1087c478bd9Sstevel@tonic-gate 
1097c478bd9Sstevel@tonic-gate typedef enum AuthType {
1107c478bd9Sstevel@tonic-gate 	NS_LDAP_AUTH_NONE	= 0,
1117c478bd9Sstevel@tonic-gate 	NS_LDAP_AUTH_SIMPLE	= 1,
1127c478bd9Sstevel@tonic-gate 	NS_LDAP_AUTH_SASL	= 2,
1137c478bd9Sstevel@tonic-gate 	NS_LDAP_AUTH_TLS	= 3,	/* implied SASL usage */
1147c478bd9Sstevel@tonic-gate 	NS_LDAP_AUTH_ATLS	= 4	/* implied SASL usage */
1157c478bd9Sstevel@tonic-gate } AuthType_t;
1167c478bd9Sstevel@tonic-gate 
1177c478bd9Sstevel@tonic-gate typedef enum TlsType {
1187c478bd9Sstevel@tonic-gate 	NS_LDAP_TLS_NONE	= 0,
1197c478bd9Sstevel@tonic-gate 	NS_LDAP_TLS_SIMPLE	= 1,
1207c478bd9Sstevel@tonic-gate 	NS_LDAP_TLS_SASL	= 2
1217c478bd9Sstevel@tonic-gate } TlsType_t;
1227c478bd9Sstevel@tonic-gate 
1237c478bd9Sstevel@tonic-gate typedef enum SaslMech {
1247c478bd9Sstevel@tonic-gate 	NS_LDAP_SASL_NONE	= 0,	/* No SASL mechanism */
1257c478bd9Sstevel@tonic-gate 	NS_LDAP_SASL_CRAM_MD5	= 1,
1267c478bd9Sstevel@tonic-gate 	NS_LDAP_SASL_DIGEST_MD5	= 2,
1277c478bd9Sstevel@tonic-gate 	NS_LDAP_SASL_EXTERNAL	= 3,	/* currently not supported */
128cb5caa98Sdjl 	NS_LDAP_SASL_GSSAPI	= 4,
1297c478bd9Sstevel@tonic-gate 	NS_LDAP_SASL_SPNEGO	= 5	/* currently not supported */
1307c478bd9Sstevel@tonic-gate } SaslMech_t;
1317c478bd9Sstevel@tonic-gate 
1327c478bd9Sstevel@tonic-gate typedef enum SaslOpt {
1337c478bd9Sstevel@tonic-gate 	NS_LDAP_SASLOPT_NONE	= 0,
134cb5caa98Sdjl 	NS_LDAP_SASLOPT_INT	= 1,
135cb5caa98Sdjl 	NS_LDAP_SASLOPT_PRIV	= 2
1367c478bd9Sstevel@tonic-gate } SaslOpt_t;
1377c478bd9Sstevel@tonic-gate 
1387c478bd9Sstevel@tonic-gate typedef enum PrefOnly {
1397c478bd9Sstevel@tonic-gate 	NS_LDAP_PREF_FALSE	= 0,
1407c478bd9Sstevel@tonic-gate 	NS_LDAP_PREF_TRUE	= 1
1417c478bd9Sstevel@tonic-gate } PrefOnly_t;
1427c478bd9Sstevel@tonic-gate 
143dd1104fbSMichen Chang typedef enum enableShadowUpdate {
144dd1104fbSMichen Chang 	NS_LDAP_ENABLE_SHADOW_UPDATE_FALSE	= 0,
145dd1104fbSMichen Chang 	NS_LDAP_ENABLE_SHADOW_UPDATE_TRUE	= 1
146dd1104fbSMichen Chang } enableShadowUpdate_t;
147dd1104fbSMichen Chang 
1487c478bd9Sstevel@tonic-gate typedef struct UnixCred {
1497c478bd9Sstevel@tonic-gate 	char	*userID;	/* Unix ID number */
1507c478bd9Sstevel@tonic-gate 	char	*passwd;	/* password */
1517c478bd9Sstevel@tonic-gate } UnixCred_t;
1527c478bd9Sstevel@tonic-gate 
1537c478bd9Sstevel@tonic-gate typedef struct CertCred {
1547c478bd9Sstevel@tonic-gate 	char	*path;		/* certificate path */
1557c478bd9Sstevel@tonic-gate 	char	*passwd;	/* password */
1567c478bd9Sstevel@tonic-gate 	char	*nickname;	/* nickname */
1577c478bd9Sstevel@tonic-gate } CertCred_t;
1587c478bd9Sstevel@tonic-gate 
1597c478bd9Sstevel@tonic-gate typedef struct ns_auth {
1607c478bd9Sstevel@tonic-gate 	AuthType_t	type;
1617c478bd9Sstevel@tonic-gate 	TlsType_t	tlstype;
1627c478bd9Sstevel@tonic-gate 	SaslMech_t	saslmech;
1637c478bd9Sstevel@tonic-gate 	SaslOpt_t	saslopt;
1647c478bd9Sstevel@tonic-gate } ns_auth_t;
1657c478bd9Sstevel@tonic-gate 
1667c478bd9Sstevel@tonic-gate typedef struct ns_cred {
1677c478bd9Sstevel@tonic-gate 	ns_auth_t	auth;
1687c478bd9Sstevel@tonic-gate 	char		*hostcertpath;
1697c478bd9Sstevel@tonic-gate 	union {
1707c478bd9Sstevel@tonic-gate 		UnixCred_t	unix_cred;
1717c478bd9Sstevel@tonic-gate 		CertCred_t	cert_cred;
1727c478bd9Sstevel@tonic-gate 	} cred;
1737c478bd9Sstevel@tonic-gate } ns_cred_t;
1747c478bd9Sstevel@tonic-gate 
1757c478bd9Sstevel@tonic-gate 
1767c478bd9Sstevel@tonic-gate typedef struct LineBuf {
1777c478bd9Sstevel@tonic-gate 	char *str;
1787c478bd9Sstevel@tonic-gate 	int len;
1797c478bd9Sstevel@tonic-gate 	int alloc;
1807c478bd9Sstevel@tonic-gate } LineBuf;
1817c478bd9Sstevel@tonic-gate 
1827c478bd9Sstevel@tonic-gate /*
1837c478bd9Sstevel@tonic-gate  * Configuration Information
1847c478bd9Sstevel@tonic-gate  */
1857c478bd9Sstevel@tonic-gate 
1867c478bd9Sstevel@tonic-gate typedef enum {
1877c478bd9Sstevel@tonic-gate 	NS_LDAP_FILE_VERSION_P		= 0,
1887c478bd9Sstevel@tonic-gate 	NS_LDAP_BINDDN_P		= 1,
1897c478bd9Sstevel@tonic-gate 	NS_LDAP_BINDPASSWD_P		= 2,
1907c478bd9Sstevel@tonic-gate 	NS_LDAP_SERVERS_P		= 3,
1917c478bd9Sstevel@tonic-gate 	NS_LDAP_SEARCH_BASEDN_P		= 4,
1927c478bd9Sstevel@tonic-gate 	NS_LDAP_AUTH_P			= 5,
1937c478bd9Sstevel@tonic-gate /*
1947c478bd9Sstevel@tonic-gate  * NS_LDAP_TRANSPORT_SEC_P is only left in for backward compatibility
1957c478bd9Sstevel@tonic-gate  * with version 1 clients and their configuration files.  The only
1967c478bd9Sstevel@tonic-gate  * supported value is NS_LDAP_SEC_NONE.  No application should be
1977c478bd9Sstevel@tonic-gate  * using this parameter type (either through getParam or setParam.
1987c478bd9Sstevel@tonic-gate  */
1997c478bd9Sstevel@tonic-gate 	NS_LDAP_TRANSPORT_SEC_P		= 6,
2007c478bd9Sstevel@tonic-gate 	NS_LDAP_SEARCH_REF_P		= 7,
2017c478bd9Sstevel@tonic-gate 	NS_LDAP_DOMAIN_P		= 8,
2027c478bd9Sstevel@tonic-gate 	NS_LDAP_EXP_P			= 9,
2037c478bd9Sstevel@tonic-gate 	NS_LDAP_CERT_PATH_P		= 10,
2047c478bd9Sstevel@tonic-gate 	NS_LDAP_CERT_PASS_P		= 11,
2057c478bd9Sstevel@tonic-gate 	NS_LDAP_SEARCH_DN_P		= 12,
2067c478bd9Sstevel@tonic-gate 	NS_LDAP_SEARCH_SCOPE_P		= 13,
2077c478bd9Sstevel@tonic-gate 	NS_LDAP_SEARCH_TIME_P		= 14,
2087c478bd9Sstevel@tonic-gate 	NS_LDAP_SERVER_PREF_P		= 15,
2097c478bd9Sstevel@tonic-gate 	NS_LDAP_PREF_ONLY_P		= 16,
2107c478bd9Sstevel@tonic-gate 	NS_LDAP_CACHETTL_P		= 17,
2117c478bd9Sstevel@tonic-gate 	NS_LDAP_PROFILE_P		= 18,
2127c478bd9Sstevel@tonic-gate 	NS_LDAP_CREDENTIAL_LEVEL_P	= 19,
2137c478bd9Sstevel@tonic-gate 	NS_LDAP_SERVICE_SEARCH_DESC_P	= 20,
2147c478bd9Sstevel@tonic-gate 	NS_LDAP_BIND_TIME_P		= 21,
2157c478bd9Sstevel@tonic-gate 	NS_LDAP_ATTRIBUTEMAP_P		= 22,
2167c478bd9Sstevel@tonic-gate 	NS_LDAP_OBJECTCLASSMAP_P	= 23,
2177c478bd9Sstevel@tonic-gate 	NS_LDAP_CERT_NICKNAME_P		= 24,
2187c478bd9Sstevel@tonic-gate 	NS_LDAP_SERVICE_AUTH_METHOD_P	= 25,
2197c478bd9Sstevel@tonic-gate 	NS_LDAP_SERVICE_CRED_LEVEL_P	= 26,
2207c478bd9Sstevel@tonic-gate 	NS_LDAP_HOST_CERTPATH_P		= 27,
221dd1104fbSMichen Chang 	NS_LDAP_ENABLE_SHADOW_UPDATE_P	= 28,
222dd1104fbSMichen Chang 	NS_LDAP_ADMIN_BINDDN_P		= 29,
223dd1104fbSMichen Chang 	NS_LDAP_ADMIN_BINDPASSWD_P	= 30,
2247c478bd9Sstevel@tonic-gate /*
2257c478bd9Sstevel@tonic-gate  * The following entry (max ParamIndexType) is an internal
2267c478bd9Sstevel@tonic-gate  * placeholder.  It must be the last (and highest value)
2277c478bd9Sstevel@tonic-gate  * entry in this eNum.  Please update accordingly.
2287c478bd9Sstevel@tonic-gate  */
229dd1104fbSMichen Chang 	NS_LDAP_MAX_PIT_P		= 31
2307c478bd9Sstevel@tonic-gate 
2317c478bd9Sstevel@tonic-gate } ParamIndexType;
2327c478bd9Sstevel@tonic-gate 
233cb5caa98Sdjl /*
234cb5caa98Sdjl  * NONE - No self / SASL/GSSAPI configured
235cb5caa98Sdjl  * ONLY - Only self / SASL/GSSAPI configured
236cb5caa98Sdjl  * MIXED - self / SASL/GSSAPI is mixed with other types of configuration
237cb5caa98Sdjl  */
238cb5caa98Sdjl typedef enum {
239cb5caa98Sdjl 	NS_LDAP_SELF_GSSAPI_CONFIG_NONE = 0,
240cb5caa98Sdjl 	NS_LDAP_SELF_GSSAPI_CONFIG_ONLY = 1,
241cb5caa98Sdjl 	NS_LDAP_SELF_GSSAPI_CONFIG_MIXED = 2
242cb5caa98Sdjl } ns_ldap_self_gssapi_config_t;
243cb5caa98Sdjl 
2447c478bd9Sstevel@tonic-gate /*
2457c478bd9Sstevel@tonic-gate  * __ns_ldap_*() return codes
2467c478bd9Sstevel@tonic-gate  */
2477c478bd9Sstevel@tonic-gate typedef enum {
2487c478bd9Sstevel@tonic-gate 	NS_LDAP_SUCCESS		= 0, /* success, no info in errorp */
2497c478bd9Sstevel@tonic-gate 	NS_LDAP_OP_FAILED	= 1, /* failed operation, no info in errorp */
2507c478bd9Sstevel@tonic-gate 	NS_LDAP_NOTFOUND	= 2, /* entry not found, no info in errorp */
2517c478bd9Sstevel@tonic-gate 	NS_LDAP_MEMORY		= 3, /* memory failure, no info in errorp */
2527c478bd9Sstevel@tonic-gate 	NS_LDAP_CONFIG		= 4, /* config problem, detail in errorp */
2537c478bd9Sstevel@tonic-gate 	NS_LDAP_PARTIAL		= 5, /* partial result, detail in errorp */
2547c478bd9Sstevel@tonic-gate 	NS_LDAP_INTERNAL	= 7, /* LDAP error, detail in errorp */
2557c478bd9Sstevel@tonic-gate 	NS_LDAP_INVALID_PARAM	= 8, /* LDAP error, no info in errorp */
2567c478bd9Sstevel@tonic-gate 	NS_LDAP_SUCCESS_WITH_INFO
2577c478bd9Sstevel@tonic-gate 				= 9  /* success, with info in errorp */
2587c478bd9Sstevel@tonic-gate } ns_ldap_return_code;
2597c478bd9Sstevel@tonic-gate 
2607c478bd9Sstevel@tonic-gate /*
2617c478bd9Sstevel@tonic-gate  * Detailed error code for NS_LDAP_CONFIG
2627c478bd9Sstevel@tonic-gate  */
2637c478bd9Sstevel@tonic-gate typedef enum {
2647c478bd9Sstevel@tonic-gate 	NS_CONFIG_SYNTAX	= 0,	/* syntax error */
2657c478bd9Sstevel@tonic-gate 	NS_CONFIG_NODEFAULT	= 1,	/* no default value */
2667c478bd9Sstevel@tonic-gate 	NS_CONFIG_NOTLOADED	= 2,	/* configuration not loaded */
2677c478bd9Sstevel@tonic-gate 	NS_CONFIG_NOTALLOW	= 3,	/* operation requested not allowed */
2687c478bd9Sstevel@tonic-gate 	NS_CONFIG_FILE		= 4,	/* configuration file problem */
2697c478bd9Sstevel@tonic-gate 	NS_CONFIG_CACHEMGR	= 5	/* error with door to ldap_cachemgr */
2707c478bd9Sstevel@tonic-gate } ns_ldap_config_return_code;
2717c478bd9Sstevel@tonic-gate 
2727c478bd9Sstevel@tonic-gate /*
2737c478bd9Sstevel@tonic-gate  * Detailed error code for NS_LDAP_PARTIAL
2747c478bd9Sstevel@tonic-gate  */
2757c478bd9Sstevel@tonic-gate typedef enum {
2767c478bd9Sstevel@tonic-gate 	NS_PARTIAL_TIMEOUT	= 0,	/* partial results due to timeout */
2777c478bd9Sstevel@tonic-gate 	NS_PARTIAL_OTHER	= 1	/* error encountered */
2787c478bd9Sstevel@tonic-gate } ns_ldap_partial_return_code;
2797c478bd9Sstevel@tonic-gate 
2807c478bd9Sstevel@tonic-gate /*
2817c478bd9Sstevel@tonic-gate  * For use by __ns_ldap_addTypedEntry() for publickey serivicetype
2827c478bd9Sstevel@tonic-gate  */
2837c478bd9Sstevel@tonic-gate typedef enum {
2847c478bd9Sstevel@tonic-gate 	NS_HOSTCRED_FALSE = 0,
2857c478bd9Sstevel@tonic-gate 	NS_HOSTCRED_TRUE  = 1
2867c478bd9Sstevel@tonic-gate } hostcred_t;
2877c478bd9Sstevel@tonic-gate 
2887c478bd9Sstevel@tonic-gate /*
2897c478bd9Sstevel@tonic-gate  * Detailed password status
2907c478bd9Sstevel@tonic-gate  */
2917c478bd9Sstevel@tonic-gate typedef enum {
2927c478bd9Sstevel@tonic-gate 	NS_PASSWD_GOOD			= 0,	/* password is good */
2937c478bd9Sstevel@tonic-gate 	NS_PASSWD_ABOUT_TO_EXPIRE	= 1,	/* password is good but */
2947c478bd9Sstevel@tonic-gate 						/* about to expire */
2957c478bd9Sstevel@tonic-gate 	NS_PASSWD_CHANGE_NEEDED		= 2,	/* good but need to be */
2967c478bd9Sstevel@tonic-gate 						/* changed immediately */
2977c478bd9Sstevel@tonic-gate 	NS_PASSWD_EXPIRED		= 3,	/* password expired */
2987c478bd9Sstevel@tonic-gate 	NS_PASSWD_RETRY_EXCEEDED	= 4,	/* exceed retry limit; */
2997c478bd9Sstevel@tonic-gate 						/* account is locked */
3007c478bd9Sstevel@tonic-gate 	NS_PASSWD_CHANGE_NOT_ALLOWED	= 5,	/* can only be changed */
3017c478bd9Sstevel@tonic-gate 						/* by the administrator */
3027c478bd9Sstevel@tonic-gate 	NS_PASSWD_INVALID_SYNTAX	= 6,	/* can not be changed: */
3037c478bd9Sstevel@tonic-gate 						/* new password has */
3047c478bd9Sstevel@tonic-gate 						/* invalid syntax -- */
305c31b4830SSerge Dussud 						/* trivial password: same */
306c31b4830SSerge Dussud 						/* value as attr, cn, sn, */
307c31b4830SSerge Dussud 						/* uid, etc. */
308c31b4830SSerge Dussud 						/* or strong password */
309c31b4830SSerge Dussud 						/* policies check */
3107c478bd9Sstevel@tonic-gate 	NS_PASSWD_TOO_SHORT		= 7,	/* can not be changed: */
3117c478bd9Sstevel@tonic-gate 						/* new password has */
3127c478bd9Sstevel@tonic-gate 						/* less chars than */
3137c478bd9Sstevel@tonic-gate 						/* required */
3147c478bd9Sstevel@tonic-gate 	NS_PASSWD_IN_HISTORY		= 8,	/* can not be changed: */
3157c478bd9Sstevel@tonic-gate 						/* reuse old password  */
3167c478bd9Sstevel@tonic-gate 	NS_PASSWD_WITHIN_MIN_AGE	= 9 	/* can not be changed: */
3177c478bd9Sstevel@tonic-gate 						/* within minimum age  */
3187c478bd9Sstevel@tonic-gate } ns_ldap_passwd_status_t;
3197c478bd9Sstevel@tonic-gate 
3207c478bd9Sstevel@tonic-gate /*
3217c478bd9Sstevel@tonic-gate  * Password management information structure
32247789246Svv  *
32347789246Svv  * This structure is different from AcctUsableResponse_t structure in
32447789246Svv  * that this structure holds result of users account mgmt information when
32547789246Svv  * an ldap bind is done with user name and user password.
3267c478bd9Sstevel@tonic-gate  */
3277c478bd9Sstevel@tonic-gate typedef struct ns_ldap_passwd_mgmt {
3287c478bd9Sstevel@tonic-gate 	ns_ldap_passwd_status_t
3297c478bd9Sstevel@tonic-gate 		status;			/* password status */
3307c478bd9Sstevel@tonic-gate 	int	sec_until_expired;	/* seconds until expired, */
3317c478bd9Sstevel@tonic-gate 					/* valid if status is */
3327c478bd9Sstevel@tonic-gate 					/* NS_PASSWD_ABOUT_TO_EXPIRE */
3337c478bd9Sstevel@tonic-gate } ns_ldap_passwd_mgmt_t;
3347c478bd9Sstevel@tonic-gate 
33547789246Svv /*
33647789246Svv  * LDAP V3 control flag for account management - Used for account management
33747789246Svv  * when no password is provided
33847789246Svv  */
33947789246Svv #define	NS_LDAP_ACCOUNT_USABLE_CONTROL	"1.3.6.1.4.1.42.2.27.9.5.8"
34047789246Svv 
34147789246Svv /*
34247789246Svv  * Structure for holding the response returned by server for
34347789246Svv  * NS_LDAP_ACCOUNT_USABLE_CONTROL control when account is not available.
34447789246Svv  */
34547789246Svv typedef struct AcctUsableMoreInfo {
34647789246Svv 	int inactive;
34747789246Svv 	int reset;
34847789246Svv 	int expired;
34947789246Svv 	int rem_grace;
35047789246Svv 	int sec_b4_unlock;
35147789246Svv } AcctUsableMoreInfo_t;
35247789246Svv 
35347789246Svv /*
35447789246Svv  * Structure used to hold the response from the server for
35547789246Svv  * NS_LDAP_ACCOUNT_USABLE_CONTROL control. The ASN1 notation is as below:
35647789246Svv  *
35747789246Svv  * ACCOUNT_USABLE_RESPONSE::= CHOICE {
35847789246Svv  * is_available		[0] INTEGER, seconds before expiration
35947789246Svv  * is_not_available	[1] More_info
36047789246Svv  * }
36147789246Svv  *
36247789246Svv  * More_info::= SEQUENCE {
36347789246Svv  * inactive		[0] BOOLEAN DEFAULT FALSE,
36447789246Svv  * reset		[1] BOOLEAN DEFAULT FALSE,
36547789246Svv  * expired		[2] BOOLEAN DEFAULT FALSE,
36647789246Svv  * remaining_grace	[3] INTEGER OPTIONAL,
36747789246Svv  * seconds_before_unlock[4] INTEGER OPTIONAL
36847789246Svv  * }
36947789246Svv  *
37047789246Svv  * This structure is different from ns_ldap_passwd_mgmt_t structure in
37147789246Svv  * that this structure holds result of users account mgmt information when
37247789246Svv  * pam_ldap doesn't have the users password and proxy agent is used for
37347789246Svv  * obtaining the account management information.
37447789246Svv  */
37547789246Svv typedef struct AcctUsableResponse {
37647789246Svv 	int choice;
37747789246Svv 	union {
37847789246Svv 		int seconds_before_expiry;
37947789246Svv 		AcctUsableMoreInfo_t more_info;
38047789246Svv 	} AcctUsableResp;
38147789246Svv } AcctUsableResponse_t;
3827c478bd9Sstevel@tonic-gate 
3837c478bd9Sstevel@tonic-gate /*
3847c478bd9Sstevel@tonic-gate  * Simplified LDAP Naming API result structure
3857c478bd9Sstevel@tonic-gate  */
3867c478bd9Sstevel@tonic-gate typedef struct ns_ldap_error {
3877c478bd9Sstevel@tonic-gate 	int	status;				/* LDAP error code */
3887c478bd9Sstevel@tonic-gate 	char	*message;			/* LDAP error message */
3897c478bd9Sstevel@tonic-gate 	ns_ldap_passwd_mgmt_t	pwd_mgmt;	/* LDAP password */
3907c478bd9Sstevel@tonic-gate 						/* management info */
3917c478bd9Sstevel@tonic-gate } ns_ldap_error_t;
3927c478bd9Sstevel@tonic-gate 
3937c478bd9Sstevel@tonic-gate typedef struct	 ns_ldap_attr {
3947c478bd9Sstevel@tonic-gate 	char	*attrname;			/* attribute name */
3957c478bd9Sstevel@tonic-gate 	uint_t	value_count;
3967c478bd9Sstevel@tonic-gate 	char	**attrvalue;			/* attribute values */
3977c478bd9Sstevel@tonic-gate } ns_ldap_attr_t;
3987c478bd9Sstevel@tonic-gate 
3997c478bd9Sstevel@tonic-gate typedef struct ns_ldap_entry {
4007c478bd9Sstevel@tonic-gate 	uint_t		attr_count;		/* number of attributes */
4017c478bd9Sstevel@tonic-gate 	ns_ldap_attr_t	**attr_pair;		/* attributes pairs */
4027c478bd9Sstevel@tonic-gate 	struct ns_ldap_entry *next;		/* next entry */
4037c478bd9Sstevel@tonic-gate } ns_ldap_entry_t;
4047c478bd9Sstevel@tonic-gate 
4057c478bd9Sstevel@tonic-gate typedef struct ns_ldap_result {
4067c478bd9Sstevel@tonic-gate 	uint_t	entries_count;		/* number of entries */
4077c478bd9Sstevel@tonic-gate 	ns_ldap_entry_t	*entry;		/* data */
4087c478bd9Sstevel@tonic-gate } ns_ldap_result_t;
4097c478bd9Sstevel@tonic-gate 
4107c478bd9Sstevel@tonic-gate /*
4117c478bd9Sstevel@tonic-gate  * structures for the conversion routines used by typedAddEntry()
4127c478bd9Sstevel@tonic-gate  */
4137c478bd9Sstevel@tonic-gate 
4147c478bd9Sstevel@tonic-gate typedef struct _ns_netgroups {
4157c478bd9Sstevel@tonic-gate 	char  *name;
4167c478bd9Sstevel@tonic-gate 	char  **triplet;
4177c478bd9Sstevel@tonic-gate 	char  **netgroup;
4187c478bd9Sstevel@tonic-gate } _ns_netgroups_t;
4197c478bd9Sstevel@tonic-gate 
4207c478bd9Sstevel@tonic-gate typedef struct _ns_netmasks {
4217c478bd9Sstevel@tonic-gate 	char *netnumber;
4227c478bd9Sstevel@tonic-gate 	char *netmask;
4237c478bd9Sstevel@tonic-gate } _ns_netmasks_t;
4247c478bd9Sstevel@tonic-gate 
4257c478bd9Sstevel@tonic-gate typedef struct _ns_bootp {
4267c478bd9Sstevel@tonic-gate 	char *name;
4277c478bd9Sstevel@tonic-gate 	char **param;
4287c478bd9Sstevel@tonic-gate } _ns_bootp_t;
4297c478bd9Sstevel@tonic-gate 
4307c478bd9Sstevel@tonic-gate typedef struct _ns_ethers {
4317c478bd9Sstevel@tonic-gate 	char *name;
4327c478bd9Sstevel@tonic-gate 	char *ether;
4337c478bd9Sstevel@tonic-gate } _ns_ethers_t;
4347c478bd9Sstevel@tonic-gate 
4357c478bd9Sstevel@tonic-gate typedef struct _ns_pubkey {
4367c478bd9Sstevel@tonic-gate 	char *name;
4377c478bd9Sstevel@tonic-gate 	hostcred_t hostcred;
4387c478bd9Sstevel@tonic-gate 	char *pubkey;
4397c478bd9Sstevel@tonic-gate 	char *privkey;
4407c478bd9Sstevel@tonic-gate } _ns_pubkey_t;
4417c478bd9Sstevel@tonic-gate 
4427c478bd9Sstevel@tonic-gate typedef struct _ns_alias {
4437c478bd9Sstevel@tonic-gate 	char *alias;
4447c478bd9Sstevel@tonic-gate 	char **member;
4457c478bd9Sstevel@tonic-gate } _ns_alias_t;
4467c478bd9Sstevel@tonic-gate 
4477c478bd9Sstevel@tonic-gate typedef struct _ns_automount {
4487c478bd9Sstevel@tonic-gate 	char *mapname;
4497c478bd9Sstevel@tonic-gate 	char *key;
4507c478bd9Sstevel@tonic-gate 	char *value;
4517c478bd9Sstevel@tonic-gate } _ns_automount_t;
4527c478bd9Sstevel@tonic-gate 
4537c478bd9Sstevel@tonic-gate /*
4547c478bd9Sstevel@tonic-gate  * return values for the callback function in __ns_ldap_list()
4557c478bd9Sstevel@tonic-gate  */
4567c478bd9Sstevel@tonic-gate #define	NS_LDAP_CB_NEXT	0	/* get the next entry */
4577c478bd9Sstevel@tonic-gate #define	NS_LDAP_CB_DONE	1	/* done */
4587c478bd9Sstevel@tonic-gate 
4597c478bd9Sstevel@tonic-gate /*
4607c478bd9Sstevel@tonic-gate  * Input values for the type specified in __ns_ldap_addTypedEntry()
4617c478bd9Sstevel@tonic-gate  * and __ns_ldap_delTypedEntry()
4627c478bd9Sstevel@tonic-gate  */
4637c478bd9Sstevel@tonic-gate 
4647c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_PASSWD	"passwd"
4657c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_GROUP	"group"
4667c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_HOSTS	"hosts"
4677c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_IPNODES	"ipnodes"
4687c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_PROFILE	"prof_attr"
4697c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_RPC	"rpc"
4707c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_PROTOCOLS	"protocols"
4717c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_NETWORKS	"networks"
4727c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_NETGROUP	"netgroup"
4737c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_ALIASES	"aliases"
4747c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_SERVICES	"services"
4757c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_ETHERS	"ethers"
4767c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_SHADOW	"shadow"
4777c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_NETMASKS	"netmasks"
4787c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_AUTHATTR	"auth_attr"
4797c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_EXECATTR	"exec_attr"
4807c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_USERATTR	"user_attr"
4817c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_PROJECT	"project"
4827c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_PUBLICKEY	"publickey"
4837c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_AUUSER	"audit_user"
4847c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_BOOTPARAMS "bootparams"
4857c478bd9Sstevel@tonic-gate #define	NS_LDAP_TYPE_AUTOMOUNT  "auto_"
48645916cd2Sjpk #define	NS_LDAP_TYPE_TNRHDB	"tnrhdb"
48745916cd2Sjpk #define	NS_LDAP_TYPE_TNRHTP	"tnrhtp"
4887c478bd9Sstevel@tonic-gate 
4897c478bd9Sstevel@tonic-gate /*
4907c478bd9Sstevel@tonic-gate  * service descriptor/attribute mapping structure
4917c478bd9Sstevel@tonic-gate  */
4927c478bd9Sstevel@tonic-gate 
4937c478bd9Sstevel@tonic-gate typedef struct ns_ldap_search_desc {
4947c478bd9Sstevel@tonic-gate 	char		*basedn;	/* search base dn */
4957c478bd9Sstevel@tonic-gate 	ScopeType_t	scope;		/* search scope */
4967c478bd9Sstevel@tonic-gate 	char		*filter;	/* search filter */
4977c478bd9Sstevel@tonic-gate } ns_ldap_search_desc_t;
4987c478bd9Sstevel@tonic-gate 
4997c478bd9Sstevel@tonic-gate typedef struct ns_ldap_attribute_map {
5007c478bd9Sstevel@tonic-gate 	char		*origAttr;	/* original attribute */
5017c478bd9Sstevel@tonic-gate 	char		**mappedAttr;	/* mapped attribute(s) */
5027c478bd9Sstevel@tonic-gate } ns_ldap_attribute_map_t;
5037c478bd9Sstevel@tonic-gate 
5047c478bd9Sstevel@tonic-gate typedef struct ns_ldap_objectclass_map {
5057c478bd9Sstevel@tonic-gate 	char		*origOC;	/* original objectclass */
5067c478bd9Sstevel@tonic-gate 	char		*mappedOC;	/* mapped objectclass */
5077c478bd9Sstevel@tonic-gate } ns_ldap_objectclass_map_t;
5087c478bd9Sstevel@tonic-gate 
509dd1104fbSMichen Chang /*
510dd1104fbSMichen Chang  * Value of the userPassword attribute representing NO Unix password
511dd1104fbSMichen Chang  */
512dd1104fbSMichen Chang #define	NS_LDAP_NO_UNIX_PASSWORD	"<NO UNIX PASSWORD>"
513dd1104fbSMichen Chang 
514479ac375Sdm /* Opaque handle for batch API */
515479ac375Sdm typedef struct ns_ldap_list_batch ns_ldap_list_batch_t;
516479ac375Sdm 
517e1dd0a2fSth /*
518e1dd0a2fSth  * The type of standalone configuration specified by a client application.
519e1dd0a2fSth  * The meaning of the requests is as follows:
520e1dd0a2fSth  *
521e1dd0a2fSth  * NS_CACHEMGR:    libsldap will request all the configuration via door_call(3C)
522e1dd0a2fSth  *                 to ldap_cachemgr.
523e1dd0a2fSth  * NS_LDAP_SERVER: the consumer application has specified a directory server
524e1dd0a2fSth  *                 to communicate to.
525e1dd0a2fSth  * NS_PREDEFINED:  reserved for internal use
526e1dd0a2fSth  */
527e1dd0a2fSth typedef enum {
528e1dd0a2fSth 	NS_CACHEMGR = 0,
529e1dd0a2fSth 	NS_LDAP_SERVER
530e1dd0a2fSth } ns_standalone_request_type_t;
531e1dd0a2fSth 
532e1dd0a2fSth /*
533e1dd0a2fSth  * This structure describes an LDAP server specified by a client application.
534e1dd0a2fSth  */
535e1dd0a2fSth typedef struct ns_dir_server {
536e1dd0a2fSth 	char *server;			/* A directory server's IP */
537e1dd0a2fSth 	uint16_t port;			/* A directory server's port. */
538e1dd0a2fSth 					/* Default value is 389 */
539e1dd0a2fSth 	char *domainName;		/* A domain name being served */
540e1dd0a2fSth 					/* by the specified server. */
541e1dd0a2fSth 					/* Default value is the local */
542e1dd0a2fSth 					/* domain's name */
543e1dd0a2fSth 	char *profileName;		/* A DUAProfile's name. */
544e1dd0a2fSth 					/* Default value is 'default' */
545e1dd0a2fSth 	ns_auth_t *auth;		/* Authentication information used */
546e1dd0a2fSth 					/* during subsequent connections */
547e1dd0a2fSth 	char *cred;			/* A credential level to be used */
548e1dd0a2fSth 					/* along with the authentication info */
549e1dd0a2fSth 	char *host_cert_path;		/* A path to the certificate database */
550e1dd0a2fSth 					/* Default is '/vat/ldap' */
551e1dd0a2fSth 	char *bind_dn;			/* A bind DN to be used during */
552e1dd0a2fSth 					/* subsequent LDAP Bind requests */
553e1dd0a2fSth 	char *bind_passwd;		/* A bind password to be used during */
554e1dd0a2fSth 					/* subsequent LDAP Bind requests */
555e1dd0a2fSth } ns_dir_server_t;
556e1dd0a2fSth 
557e1dd0a2fSth /*
558e1dd0a2fSth  * This structure contains information describing an LDAP server.
559e1dd0a2fSth  */
560e1dd0a2fSth typedef struct ns_standalone_conf {
561e1dd0a2fSth 	union {
562e1dd0a2fSth 		ns_dir_server_t server;
563e1dd0a2fSth 		void *predefined_conf;	/* Reserved for internal use */
564e1dd0a2fSth 	} ds_profile;			/* A type of the configuration */
565e1dd0a2fSth 
566e1dd0a2fSth #define	SA_SERVER	ds_profile.server.server
567e1dd0a2fSth #define	SA_PORT		ds_profile.server.port
568e1dd0a2fSth #define	SA_DOMAIN	ds_profile.server.domainName
569e1dd0a2fSth #define	SA_PROFILE_NAME	ds_profile.server.profileName
570e1dd0a2fSth #define	SA_AUTH		ds_profile.server.auth
571e1dd0a2fSth #define	SA_CRED		ds_profile.server.cred
572e1dd0a2fSth #define	SA_CERT_PATH	ds_profile.server.host_cert_path
573e1dd0a2fSth #define	SA_BIND_DN	ds_profile.server.bind_dn
574e1dd0a2fSth #define	SA_BIND_PWD	ds_profile.server.bind_passwd
575e1dd0a2fSth 
576e1dd0a2fSth 	ns_standalone_request_type_t type;
577e1dd0a2fSth } ns_standalone_conf_t;
578e1dd0a2fSth 
579e1dd0a2fSth /*
580e1dd0a2fSth  * This function "informs" libsldap that a client application has specified
581e1dd0a2fSth  * a directory to use. The function obtains a DUAProfile, credentials,
582e1dd0a2fSth  * and naming context. During all further operations on behalf
583e1dd0a2fSth  * of the application requested a standalone schema libsldap will use
584e1dd0a2fSth  * the information obtained by __ns_ldap_initStandalone() instead of
585*bbf21555SRichard Lowe  * door_call(3C)ing ldap_cachemgr(8).
586e1dd0a2fSth  *
587e1dd0a2fSth  * conf
588e1dd0a2fSth  * 	A structure describing where and in which way to obtain all the
589e1dd0a2fSth  * 	configuration describing how to communicate to a choosen LDAP directory.
590e1dd0a2fSth  *
591e1dd0a2fSth  * errorp
592e1dd0a2fSth  * 	An error object describing an error occured.
593e1dd0a2fSth  */
594e1dd0a2fSth ns_ldap_return_code __ns_ldap_initStandalone(
595e1dd0a2fSth 	const ns_standalone_conf_t *conf,
596e1dd0a2fSth 	ns_ldap_error_t	**errorp);
597e1dd0a2fSth 
598e1dd0a2fSth /*
599e1dd0a2fSth  * This function obtains the directory's base DN and a DUAProfile
600e1dd0a2fSth  * from a specified server.
601e1dd0a2fSth  *
602e1dd0a2fSth  * server
603e1dd0a2fSth  * 	Specifies the selected directory sever.
604e1dd0a2fSth  *
605e1dd0a2fSth  * cred
606e1dd0a2fSth  * 	Contains an authentication information and credential required to
607e1dd0a2fSth  * 	establish a connection.
608e1dd0a2fSth  *
609e1dd0a2fSth  * config
610e1dd0a2fSth  * 	If not NULL, a new configuration basing on a DUAProfile specified in the
611e1dd0a2fSth  * 	server parameter will be create and returned.
612e1dd0a2fSth  *
613e1dd0a2fSth  * baseDN
614e1dd0a2fSth  * 	If not NULL, the directory's base DN will be returned.
615e1dd0a2fSth  *
616e1dd0a2fSth  * error
617e1dd0a2fSth  * 	Describes an error, if any.
618e1dd0a2fSth  */
619e1dd0a2fSth ns_ldap_return_code __ns_ldap_getConnectionInfoFromDUA(
620e1dd0a2fSth 	const ns_dir_server_t *server,
621e1dd0a2fSth 	const ns_cred_t *cred,
622e1dd0a2fSth 	char **config,	char **baseDN,
623e1dd0a2fSth 	ns_ldap_error_t **error);
624e1dd0a2fSth 
625e1dd0a2fSth #define	SA_PROHIBIT_FALLBACK 0
626e1dd0a2fSth #define	SA_ALLOW_FALLBACK 1
627e1dd0a2fSth 
628e1dd0a2fSth #define	DONT_SAVE_NSCONF 0
629e1dd0a2fSth #define	SAVE_NSCONF 1
630e1dd0a2fSth 
631e1dd0a2fSth /*
632e1dd0a2fSth  * This function obtains the root DSE from a specified server.
633e1dd0a2fSth  *
634e1dd0a2fSth  * server_addr
635e1dd0a2fSth  * 	An adress of a server to be connected to.
636e1dd0a2fSth  *
637e1dd0a2fSth  * rootDSE
638e1dd0a2fSth  * 	A buffer containing the root DSE in the ldap_cachmgr door call format.
639e1dd0a2fSth  *
640e1dd0a2fSth  * errorp
641e1dd0a2fSth  * 	Describes an error, if any.
642e1dd0a2fSth  *
643e1dd0a2fSth  * anon_fallback
644e1dd0a2fSth  * 	If set to 1 and establishing a connection fails, __s_api_getRootDSE()
645e1dd0a2fSth  * 	will try once again using anonymous credentials.
646e1dd0a2fSth  */
647e1dd0a2fSth ns_ldap_return_code __ns_ldap_getRootDSE(
648e1dd0a2fSth 	const char *server_addr,
649e1dd0a2fSth 	char **rootDSE,
650e1dd0a2fSth 	ns_ldap_error_t **errorp,
651e1dd0a2fSth 	int anon_fallback);
652e1dd0a2fSth 
653e1dd0a2fSth /*
654e1dd0a2fSth  * This function iterates through the list of the configured LDAP servers
655e1dd0a2fSth  * and "pings" those which are marked as removed or if any error occurred
656e1dd0a2fSth  * during the previous receiving of the server's root DSE. If the
657e1dd0a2fSth  * function is able to reach such a server and get its root DSE, it
658e1dd0a2fSth  * marks the server as on-line. Otherwise, the server's status is set
659e1dd0a2fSth  * to "Error".
660e1dd0a2fSth  * For each server the function tries to connect to, it fires up
661e1dd0a2fSth  * a separate thread and then waits until all the threads finish.
662e1dd0a2fSth  * The function returns NS_LDAP_INTERNAL if the Standalone mode was not
663e1dd0a2fSth  * initialized or was canceled prior to an invocation of
664e1dd0a2fSth  * __ns_ldap_pingOfflineServers().
665e1dd0a2fSth  */
666e1dd0a2fSth ns_ldap_return_code __ns_ldap_pingOfflineServers(void);
667e1dd0a2fSth 
668e1dd0a2fSth /*
669e1dd0a2fSth  * This function cancels the Standalone mode and destroys the list of root DSEs.
670e1dd0a2fSth  */
671e1dd0a2fSth void __ns_ldap_cancelStandalone(void);
672e1dd0a2fSth /*
673e1dd0a2fSth  * This function initializes an ns_auth_t structure provided by a caller
674e1dd0a2fSth  * according to a specified authentication mechanism.
675e1dd0a2fSth  */
676e1dd0a2fSth ns_ldap_return_code __ns_ldap_initAuth(const char *auth_mech,
677e1dd0a2fSth 	ns_auth_t *auth,
678e1dd0a2fSth 	ns_ldap_error_t **errorp);
679e1dd0a2fSth 
6807c478bd9Sstevel@tonic-gate /*
6817c478bd9Sstevel@tonic-gate  * Simplified LDAP Naming APIs
6827c478bd9Sstevel@tonic-gate  */
6837c478bd9Sstevel@tonic-gate int __ns_ldap_list(
6847c478bd9Sstevel@tonic-gate 	const char *service,
6857c478bd9Sstevel@tonic-gate 	const char *filter,
6867c478bd9Sstevel@tonic-gate 	int (*init_filter_cb)(const ns_ldap_search_desc_t *desc,
6877c478bd9Sstevel@tonic-gate 			char **realfilter, const void *userdata),
6887c478bd9Sstevel@tonic-gate 	const char * const *attribute,
6897c478bd9Sstevel@tonic-gate 	const ns_cred_t *cred,
6907c478bd9Sstevel@tonic-gate 	const int flags,
6917c478bd9Sstevel@tonic-gate 	ns_ldap_result_t ** result,
6927c478bd9Sstevel@tonic-gate 	ns_ldap_error_t ** errorp,
6937c478bd9Sstevel@tonic-gate 	int (*callback)(const ns_ldap_entry_t *entry, const void *userdata),
6947c478bd9Sstevel@tonic-gate 	const void *userdata);
6957c478bd9Sstevel@tonic-gate 
6969f2fd570SJulian Pullen 
6979f2fd570SJulian Pullen int __ns_ldap_list_sort(
6989f2fd570SJulian Pullen 	const char *service,
6999f2fd570SJulian Pullen 	const char *filter,
7009f2fd570SJulian Pullen 	const char *sortattr,
7019f2fd570SJulian Pullen 	int (*init_filter_cb)(const ns_ldap_search_desc_t *desc,
7029f2fd570SJulian Pullen 			char **realfilter, const void *userdata),
7039f2fd570SJulian Pullen 	const char * const *attribute,
7049f2fd570SJulian Pullen 	const ns_cred_t *cred,
7059f2fd570SJulian Pullen 	const int flags,
7069f2fd570SJulian Pullen 	ns_ldap_result_t ** result,
7079f2fd570SJulian Pullen 	ns_ldap_error_t ** errorp,
7089f2fd570SJulian Pullen 	int (*callback)(const ns_ldap_entry_t *entry, const void *userdata),
7099f2fd570SJulian Pullen 	const void *userdata);
7109f2fd570SJulian Pullen 
711479ac375Sdm int __ns_ldap_list_batch_start(
712479ac375Sdm 	ns_ldap_list_batch_t **batch);
713479ac375Sdm 
714479ac375Sdm int __ns_ldap_list_batch_add(
715479ac375Sdm 	ns_ldap_list_batch_t *batch,
716479ac375Sdm 	const char *service,
717479ac375Sdm 	const char *filter,
718479ac375Sdm 	int (*init_filter_cb)(const ns_ldap_search_desc_t *desc,
719479ac375Sdm 			char **realfilter, const void *userdata),
720479ac375Sdm 	const char * const *attribute,
721479ac375Sdm 	const ns_cred_t *cred,
722479ac375Sdm 	const int flags,
723479ac375Sdm 	ns_ldap_result_t ** result,
724479ac375Sdm 	ns_ldap_error_t ** errorp,
725479ac375Sdm 	int *rcp,
726479ac375Sdm 	int (*callback)(const ns_ldap_entry_t *entry, const void *userdata),
727479ac375Sdm 	const void *userdata);
728479ac375Sdm 
729479ac375Sdm int __ns_ldap_list_batch_end(
730479ac375Sdm 	ns_ldap_list_batch_t *batch);
731479ac375Sdm 
732479ac375Sdm void __ns_ldap_list_batch_release(
733479ac375Sdm 	ns_ldap_list_batch_t *batch);
734479ac375Sdm 
7357c478bd9Sstevel@tonic-gate int  __ns_ldap_addAttr(
7367c478bd9Sstevel@tonic-gate 	const char *service,
7377c478bd9Sstevel@tonic-gate 	const char *dn,
7387c478bd9Sstevel@tonic-gate 	const ns_ldap_attr_t * const *attr,
7397c478bd9Sstevel@tonic-gate 	const ns_cred_t *cred,
7407c478bd9Sstevel@tonic-gate 	const int flags,
7417c478bd9Sstevel@tonic-gate 	ns_ldap_error_t **errorp);
7427c478bd9Sstevel@tonic-gate 
7437c478bd9Sstevel@tonic-gate int __ns_ldap_delAttr(
7447c478bd9Sstevel@tonic-gate 	const char *service,
7457c478bd9Sstevel@tonic-gate 	const char *dn,
7467c478bd9Sstevel@tonic-gate 	const ns_ldap_attr_t * const *attr,
7477c478bd9Sstevel@tonic-gate 	const ns_cred_t *cred,
7487c478bd9Sstevel@tonic-gate 	const int flags,
7497c478bd9Sstevel@tonic-gate 	ns_ldap_error_t **errorp);
7507c478bd9Sstevel@tonic-gate 
7517c478bd9Sstevel@tonic-gate int  __ns_ldap_repAttr(
7527c478bd9Sstevel@tonic-gate 	const char *service,
7537c478bd9Sstevel@tonic-gate 	const char *dn,
7547c478bd9Sstevel@tonic-gate 	const ns_ldap_attr_t * const *attr,
7557c478bd9Sstevel@tonic-gate 	const ns_cred_t *cred,
7567c478bd9Sstevel@tonic-gate 	const int flags,
7577c478bd9Sstevel@tonic-gate 	ns_ldap_error_t **errorp);
7587c478bd9Sstevel@tonic-gate 
7597c478bd9Sstevel@tonic-gate int  __ns_ldap_addEntry(
7607c478bd9Sstevel@tonic-gate 	const char *service,
7617c478bd9Sstevel@tonic-gate 	const char *dn,
7627c478bd9Sstevel@tonic-gate 	const ns_ldap_entry_t *entry,
7637c478bd9Sstevel@tonic-gate 	const ns_cred_t *cred,
7647c478bd9Sstevel@tonic-gate 	const int flags,
7657c478bd9Sstevel@tonic-gate 	ns_ldap_error_t **errorp);
7667c478bd9Sstevel@tonic-gate 
7677c478bd9Sstevel@tonic-gate int  __ns_ldap_addTypedEntry(
7687c478bd9Sstevel@tonic-gate 	const char *servicetype,
7697c478bd9Sstevel@tonic-gate 	const char *basedn,
7707c478bd9Sstevel@tonic-gate 	const void *data,
7717c478bd9Sstevel@tonic-gate 	const int  create,
7727c478bd9Sstevel@tonic-gate 	const ns_cred_t *cred,
7737c478bd9Sstevel@tonic-gate 	const int flags,
7747c478bd9Sstevel@tonic-gate 	ns_ldap_error_t **errorp);