|
|
/*++
SECPRINC.C
Code for setting security principal data in the DS-- specifically, the UPN, SPN, and AltSecurityIdentity
Copyright (C) 1998 Microsoft Corporation, all rights reserved.
Created, Jun 18, 1998 by DavidCHR.
CONTENTS: SetStringProperty FindUser SetUserData
--*/
#include "master.h"
#include "keytab.h"
#include <winldap.h>
#include <malloc.h>
#include "secprinc.h"
#include "delegtools.h"
extern BOOL /* delegation.c */LdapFindAttributeInMessageA( IN PLDAP pLdap, IN PLDAPMessage pMessage, IN LPSTR PropertyName, OUT OPTIONAL PULONG pcbData, OUT OPTIONAL PVOID *ppvData );
/*****************************************************************
NAME: ConnectToDsa
connects to the DSA, binds, and searches for the base DN. TAKES: nothing RETURNS: TRUE ( and a pLdap and wide-string baseDn ) on success FALSE and a stderr message on failure. CALLED BY: FREE WITH: BaseDN should be freed with free(), the ldap handle should be closed with ldap_unbind. *****************************************************************/
BOOLConnectToDsa( OUT PLDAP *ppLdap, OUT LPSTR *BaseDN ) { // free with free()
PLDAP pLdap; BOOL ret = FALSE; ULONG lderr;
pLdap = ldap_open( NULL, LDAP_PORT ); if ( pLdap ) {
lderr = ldap_bind_s( pLdap, NULL, NULL, LDAP_AUTH_SSPI );
if ( lderr == LDAP_SUCCESS ) {
LPSTR Context = "defaultNamingContext"; LPSTR Attributes[] = { Context, NULL }; PLDAPMessage pMessage, pEntry; LPSTR *pValue;
// now, guess the DSA Base:
lderr = ldap_search_sA( pLdap, NULL, LDAP_SCOPE_BASE, "objectClass=*", Attributes, FALSE, // just return attributes
&pMessage );
if ( lderr == LDAP_SUCCESS ) {
pEntry = ldap_first_entry( pLdap, pMessage );
if ( pEntry ) { pValue = ldap_get_valuesA( pLdap, pEntry, Context );
if ( pValue ) {
ULONG size;
size = ldap_count_valuesA( pValue );
if ( 1 == size ) { LPSTR dn; size = ( lstrlenA( *pValue ) +1 /*null*/) * sizeof( WCHAR );
dn = (LPSTR) malloc( size ); if ( dn ) {
memcpy( dn, *pValue, size ); *BaseDN = dn; *ppLdap = pLdap; ret = TRUE;
} else fprintf( stderr, "failed to malloc to duplicate \"%s\".\n", *pValue );
} else fprintf( stderr, "too many values (expected one, got %ld) for" " %s.\n", size, Context );
ldap_value_freeA( pValue );
} else fprintf( stderr, "ldap_get_values failed: 0x%x.\n", GetLastError() );
} else fprintf( stderr, "ldap_first_entry failed: 0x%x.\n", GetLastError() );
ldap_msgfree( pMessage );
} else fprintf( stderr, "ldap_search failed (0x%x). " "Couldn't search for base DN.\n", lderr );
if ( !ret ) ldap_unbind_s( pLdap );
} else fprintf( stderr, "Failed to bind to DSA: 0x%x.\n", lderr );
// there is no ldap_disconnect.
} else fprintf( stderr, "Failed to contact DSA: 0x%x.\n", GetLastError() );
return ret;
} /*++**************************************************************
NAME: SetStringProperty
sets the given property of the given object to the given string
MODIFIES: object's property value
TAKES: pLdap -- ldap connection handle Dn -- FQDN of the object whose property is munged PropertyName -- property to modify Property -- value to put in the property Operation -- set / add / delete, etc.
RETURNS: TRUE when the function succeeds. FALSE otherwise. LASTERROR: set
LOGGING: on failure CREATED: Jan 22, 1999 LOCKING: none CALLED BY: anyone FREE WITH: n/a -- no resources are returned **************************************************************--*/
BOOLSetStringProperty( IN PLDAP pLdap, IN LPSTR Dn, IN LPSTR PropertyName, IN LPSTR Property, IN ULONG Operation ) {
LPSTR Vals[] = { Property, NULL }; LDAPModA Mod = { Operation, PropertyName, Vals }; PLDAPModA Mods[] = { &Mod, NULL }; ULONG lderr;
lderr = ldap_modify_sA( pLdap, Dn, Mods );
if ( lderr == LDAP_SUCCESS ) {
return TRUE;
} else { fprintf( stderr, "Failed to set property \"%hs\" to \"%hs\" on Dn \"%hs\": " "0x%x.\n",
PropertyName, Property, Dn, lderr );
SetLastError( lderr );
} return FALSE; }
/*++**************************************************************
NAME: FindUser
searches the DS for the given user.
MODIFIES: pDn -- returned DN for that user. puacflags -- receives the user's AccountControl flags
TAKES: pLdap -- LDAP handle UserName -- user samaccountname for which to search
RETURNS: TRUE when the function succeeds. FALSE otherwise. LASTERROR: not explicitly set LOGGING: on failure CREATED: Jan 22, 1999 LOCKING: none CALLED BY: anyone FREE WITH: free the dn with ldap_memfree **************************************************************--*/
BOOLFindUser( IN PLDAP pLdap, IN LPSTR UserName, OUT PULONG puacFlags, OUT LPSTR *pDn ) {
LPSTR Query; BOOL ret = FALSE; LPSTR Attributes[] = { "userAccountControl", NULL }; // what attributes to fetch; none
PLDAPMessage pMessage = NULL; LPSTR StringUac;
Query = (LPSTR) malloc( lstrlenA( UserName ) + 100 ); // arbitrary
if ( Query ) {
wsprintfA( Query, "(& (objectClass=person) (samaccountname=%hs))", UserName );
if( LdapSearchForUniqueDnA( pLdap, Query, Attributes, pDn, &pMessage ) ) {
if ( LdapFindAttributeInMessageA( pLdap, pMessage, Attributes[ 0 ], NULL, // length doesn't matter
&StringUac ) ) {
*puacFlags = strtoul( StringUac, NULL, 0 );
} else {
/* Signal the caller that we don't know the uacflags. */ *puacFlags = 0;
}
ret = TRUE;
} else {
fprintf( stderr, "Failed to locate user \"%hs\".\n", Query );
}
if ( pMessage ) ldap_msgfree( pMessage ); free( Query );
} else {
fprintf( stderr, "allocation failed building query for LDAP search.\n" );
}
return ret;}
|
