]> git.sur5r.net Git - openldap/blob - contrib/slapd-modules/adremap/adremap.c
Also remap explicitly requested attr names
[openldap] / contrib / slapd-modules / adremap / adremap.c
1 /* adremap.c - Case-folding and DN-value remapping for AD proxies */
2 /* $OpenLDAP$ */
3 /*
4  * Copyright 2015 Howard Chu <hyc@symas.com>.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted only as authorized by the OpenLDAP
9  * Public License.
10  *
11  * A copy of this license is available in the file LICENSE in the
12  * top-level directory of the distribution or, alternatively, at
13  * <http://www.OpenLDAP.org/license.html>.
14  */
15
16 #include "portable.h"
17
18 /*
19  * This file implements an overlay that performs two remapping functions
20  * to allow older POSIX clients to use Microsoft AD:
21  * 1: downcase the values of a configurable list of attributes
22  * 2: dereference some DN-valued attributes and convert to their simple names
23  *         e.g. generate memberUid based on member
24  */
25
26 #ifdef SLAPD_OVER_ADREMAP
27
28 #include <ldap.h>
29 #include "lutil.h"
30 #include "slap.h"
31 #include <ac/errno.h>
32 #include <ac/time.h>
33 #include <ac/string.h>
34 #include <ac/ctype.h>
35 #include "config.h"
36
37 typedef struct adremap_dnv {
38         struct adremap_dnv *ad_next;
39         AttributeDescription *ad_dnattr;        /* DN-valued attr to deref */
40         AttributeDescription *ad_deref;         /* target attr's value to retrieve */
41         AttributeDescription *ad_newattr;       /* New attr to collect new values */
42         ObjectClass *ad_group;          /* group objectclass on target */
43         ObjectClass *ad_mapgrp;         /* group objectclass to map */
44         ObjectClass *ad_refgrp;         /* objectclass of target DN */
45         struct berval ad_refbase;       /* base DN of target entries */
46 } adremap_dnv;
47 /* example: member uid memberUid */
48
49 typedef struct adremap_case {
50         struct adremap_case *ac_next;
51         AttributeDescription *ac_attr;
52 } adremap_case;
53
54 /* Per-instance configuration information */
55 typedef struct adremap_info {
56         adremap_case *ai_case;  /* attrs to downcase */
57         adremap_dnv *ai_dnv;    /* DN attrs to remap */
58 } adremap_info;
59
60 enum {
61         ADREMAP_CASE = 1,
62         ADREMAP_DNV
63 };
64
65 static ConfigDriver adremap_cf_case;
66 static ConfigDriver adremap_cf_dnv;
67
68 /* configuration attribute and objectclass */
69 static ConfigTable adremapcfg[] = {
70         { "adremap-downcase", "attrs", 2, 0, 0,
71           ARG_MAGIC|ADREMAP_CASE, adremap_cf_case,
72           "( OLcfgCtAt:6.1 "
73           "NAME 'olcADremapDowncase' "
74           "DESC 'List of attributes to casefold to lower case' "
75           "SYNTAX OMsDirectoryString )", NULL, NULL },
76         { "adremap-dnmap", "dnattr targetattr newattr remoteOC localOC targetOC baseDN", 8, 8, 0,
77           ARG_MAGIC|ADREMAP_DNV, adremap_cf_dnv,
78           "( OLcfgCtAt:6.2 "
79           "NAME 'olcADremapDNmap' "
80           "DESC 'DN attr to map, attr from target to use, attr to generate, objectclass of remote"
81            " group, objectclass mapped group, objectclass of target entry, base DN of target entry' "
82           "SYNTAX OMsDirectoryString )", NULL, NULL },
83         { NULL, NULL, 0, 0, 0, ARG_IGNORED }
84 };
85
86 static ConfigOCs adremapocs[] = {
87         { "( OLcfgCtOc:6.1 "
88           "NAME 'olcADremapConfig' "
89           "DESC 'AD remap configuration' "
90           "SUP olcOverlayConfig "
91           "MAY ( olcADremapDowncase $ olcADremapDNmap ) )",
92           Cft_Overlay, adremapcfg, NULL, NULL },
93         { NULL, 0, NULL }
94 };
95
96 static int
97 adremap_cf_case(ConfigArgs *c)
98 {
99         BackendDB *be = (BackendDB *)c->be;
100         slap_overinst *on = (slap_overinst *)c->bi;
101         adremap_info *ai = on->on_bi.bi_private;
102         adremap_case *ac, **a2;
103         int rc = ARG_BAD_CONF;
104
105         switch(c->op) {
106         case SLAP_CONFIG_EMIT:
107                 for (ac = ai->ai_case; ac; ac=ac->ac_next) {
108                         rc = value_add_one(&c->rvalue_vals, &ac->ac_attr->ad_cname);
109                         if (rc) break;
110                 }
111                 break;
112         case LDAP_MOD_DELETE:
113                 if (c->valx < 0) {
114                         for (ac = ai->ai_case; ac; ac=ai->ai_case) {
115                                 ai->ai_case = ac->ac_next;
116                                 ch_free(ac);
117                         }
118                 } else {
119                         int i;
120                         for (i=0, a2 = &ai->ai_case; i<c->valx; i++, a2 = &(*a2)->ac_next);
121                         ac = *a2;
122                         *a2 = ac->ac_next;
123                         ch_free(ac);
124                 }
125                 rc = 0;
126                 break;
127         default: {
128                 const char *text;
129                 adremap_case ad;
130                 ad.ac_attr = NULL;
131                 rc = slap_str2ad(c->argv[1], &ad.ac_attr, &text);
132                 if (rc) break;
133                 for (a2 = &ai->ai_case; *a2; a2 = &(*a2)->ac_next);
134                 ac = ch_malloc(sizeof(adremap_case));
135                 ac->ac_next = NULL;
136                 ac->ac_attr = ad.ac_attr;
137                 *a2 = ac;
138                 break;
139                 }
140         }
141         return rc;
142 }
143
144 static int
145 adremap_cf_dnv(ConfigArgs *c)
146 {
147         BackendDB *be = (BackendDB *)c->be;
148         slap_overinst *on = (slap_overinst *)c->bi;
149         adremap_info *ai = on->on_bi.bi_private;
150         adremap_dnv *ad, **a2;
151         int rc = ARG_BAD_CONF;
152
153         switch(c->op) {
154         case SLAP_CONFIG_EMIT:
155                 for (ad = ai->ai_dnv; ad; ad=ad->ad_next) {
156                         char *ptr;
157                         struct berval bv;
158                         bv.bv_len = ad->ad_dnattr->ad_cname.bv_len + ad->ad_deref->ad_cname.bv_len + ad->ad_newattr->ad_cname.bv_len + 2;
159                         bv.bv_len += ad->ad_group->soc_cname.bv_len + ad->ad_mapgrp->soc_cname.bv_len + ad->ad_refgrp->soc_cname.bv_len + 3;
160                         bv.bv_len += ad->ad_refbase.bv_len + 3;
161                         bv.bv_val = ch_malloc(bv.bv_len + 1);
162                         ptr = lutil_strcopy(bv.bv_val, ad->ad_dnattr->ad_cname.bv_val);
163                         *ptr++ = ' ';
164                         ptr = lutil_strcopy(ptr, ad->ad_deref->ad_cname.bv_val);
165                         *ptr++ = ' ';
166                         ptr = lutil_strcopy(ptr, ad->ad_newattr->ad_cname.bv_val);
167                         *ptr++ = ' ';
168                         ptr = lutil_strcopy(ptr, ad->ad_group->soc_cname.bv_val);
169                         *ptr++ = ' ';
170                         ptr = lutil_strcopy(ptr, ad->ad_mapgrp->soc_cname.bv_val);
171                         *ptr++ = ' ';
172                         ptr = lutil_strcopy(ptr, ad->ad_refgrp->soc_cname.bv_val);
173                         *ptr++ = ' ';
174                         *ptr++ = '"';
175                         ptr = lutil_strcopy(ptr, ad->ad_refbase.bv_val);
176                         *ptr++ = '"';
177                         *ptr = '\0';
178                         ber_bvarray_add(&c->rvalue_vals, &bv);
179                 }
180                 if (ai->ai_dnv) rc = 0;
181                 break;
182         case LDAP_MOD_DELETE:
183                 if (c->valx < 0) {
184                         for (ad = ai->ai_dnv; ad; ad=ai->ai_dnv) {
185                                 ai->ai_dnv = ad->ad_next;
186                                 ch_free(ad);
187                         }
188                 } else {
189                         int i;
190                         for (i=0, a2 = &ai->ai_dnv; i<c->valx; i++, a2 = &(*a2)->ad_next);
191                         ad = *a2;
192                         *a2 = ad->ad_next;
193                         ch_free(ad);
194                 }
195                 rc = 0;
196                 break;
197         default: {
198                 const char *text;
199                 adremap_dnv av = {0};
200                 struct berval dn;
201                 rc = slap_str2ad(c->argv[1], &av.ad_dnattr, &text);
202                 if (rc) break;
203                 if (av.ad_dnattr->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName) {
204                         rc = 1;
205                         snprintf(c->cr_msg, sizeof(c->cr_msg), "<%s> not a DN-valued attribute",
206                                 c->argv[0]);
207                         Debug(LDAP_DEBUG_ANY, "%s: %s(%s)\n", c->log, c->cr_msg, c->argv[1]);
208                         break;
209                 }
210                 rc = slap_str2ad(c->argv[2], &av.ad_deref, &text);
211                 if (rc) break;
212                 rc = slap_str2ad(c->argv[3], &av.ad_newattr, &text);
213                 if (rc) break;
214                 av.ad_group = oc_find(c->argv[4]);
215                 if (!av.ad_group) {
216                         rc = 1;
217                         break;
218                 }
219                 av.ad_mapgrp = oc_find(c->argv[5]);
220                 if (!av.ad_mapgrp) {
221                         rc = 1;
222                         break;
223                 }
224                 av.ad_refgrp = oc_find(c->argv[6]);
225                 if (!av.ad_refgrp) {
226                         rc = 1;
227                         break;
228                 }
229                 ber_str2bv(c->argv[7], 0, 0, &dn);
230                 rc = dnNormalize(0, NULL, NULL, &dn, &av.ad_refbase, NULL);
231                 if (rc) break;
232
233                 for (a2 = &ai->ai_dnv; *a2; a2 = &(*a2)->ad_next);
234                 ad = ch_malloc(sizeof(adremap_dnv));
235                 ad->ad_next = NULL;
236                 ad->ad_dnattr = av.ad_dnattr;
237                 ad->ad_deref = av.ad_deref;
238                 ad->ad_newattr = av.ad_newattr;
239                 ad->ad_group = av.ad_group;
240                 ad->ad_mapgrp = av.ad_mapgrp;
241                 ad->ad_refgrp = av.ad_refgrp;
242                 ad->ad_refbase = av.ad_refbase;
243                 *a2 = ad;
244                 break;
245                 }
246         }
247         return rc;
248 }
249
250 typedef struct adremap_ctx {
251         slap_overinst *on;
252         AttributeName an;
253         int an_swap;
254         int an_idx;
255 } adremap_ctx;
256
257 static int
258 adremap_search_resp(
259         Operation *op,
260         SlapReply *rs
261 )
262 {
263         adremap_ctx *ctx = op->o_callback->sc_private;
264         slap_overinst *on = ctx->on;
265         adremap_info *ai = on->on_bi.bi_private;
266         adremap_case *ac;
267         adremap_dnv *ad;
268         Attribute *a;
269         Entry *e;
270
271         if (rs->sr_type != REP_SEARCH)
272                 return SLAP_CB_CONTINUE;
273
274         if (ctx->an_swap) {
275                 ctx->an_swap = 0;
276                 rs->sr_attrs[ctx->an_idx] = ctx->an;
277         }
278         e = rs->sr_entry;
279         for (ac = ai->ai_case; ac; ac = ac->ac_next) {
280                 a = attr_find(e->e_attrs, ac->ac_attr);
281                 if (a) {
282                         int i, j;
283                         if (!(rs->sr_flags & REP_ENTRY_MODIFIABLE)) {
284                                 e = entry_dup(e);
285                                 rs_replace_entry(op, rs, on, e);
286                                 rs->sr_flags |= REP_ENTRY_MODIFIABLE|REP_ENTRY_MUSTBEFREED;
287                                 a = attr_find(e->e_attrs, ac->ac_attr);
288                         }
289                         for (i=0; i<a->a_numvals; i++) {
290                                 unsigned char *c = a->a_vals[i].bv_val;
291                                 for (j=0; j<a->a_vals[i].bv_len; j++)
292                                         if (isupper(c[j]))
293                                                 c[j] = tolower(c[j]);
294                         }
295                 }
296         }
297         for (ad = ai->ai_dnv; ad; ad = ad->ad_next) {
298                 a = attr_find(e->e_attrs, ad->ad_dnattr);
299                 if (a) {
300                         Entry *n;
301                         Attribute *dr;
302                         int i, rc;
303                         if (!(rs->sr_flags & REP_ENTRY_MODIFIABLE)) {
304                                 e = entry_dup(e);
305                                 rs_replace_entry(op, rs, on, e);
306                                 rs->sr_flags |= REP_ENTRY_MODIFIABLE|REP_ENTRY_MUSTBEFREED;
307                                 a = attr_find(e->e_attrs, ad->ad_dnattr);
308                         }
309                         for (i=0; i<a->a_numvals; i++) {
310                                 n = NULL;
311                                 rc = be_entry_get_rw(op, &a->a_nvals[i], NULL, ad->ad_deref, 0, &n);
312                                 if (!rc && n) {
313                                         dr = attr_find(n->e_attrs, ad->ad_deref);
314                                         if (dr)
315                                                 attr_merge_one(e, ad->ad_newattr, dr->a_vals, dr->a_nvals);
316                                         be_entry_release_r(op, n);
317                                 }
318                         }
319                 }
320         }
321         return SLAP_CB_CONTINUE;
322 }
323
324 static int adremap_refsearch(
325         Operation *op,
326         SlapReply *rs
327 )
328 {
329         if (rs->sr_type == REP_SEARCH) {
330                 slap_callback *sc = op->o_callback;
331                 struct berval *dn = sc->sc_private;
332                 ber_dupbv_x(dn, &rs->sr_entry->e_nname, op->o_tmpmemctx);
333                 return LDAP_SUCCESS;
334         }
335         return rs->sr_err;
336 }
337
338 static adremap_dnv *adremap_filter(
339         Operation *op,
340         adremap_info *ai
341 )
342 {
343         slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
344         Filter *f = op->ors_filter;
345         adremap_dnv *ad = NULL;
346
347         /* Do we need to munge the filter? First see if it's of
348          * the form (&(objectClass=<mapgrp>)...)
349          */
350         if (f->f_choice == LDAP_FILTER_AND && f->f_and &&
351                 f->f_and->f_choice == LDAP_FILTER_EQUALITY &&
352                 f->f_and->f_av_desc == slap_schema.si_ad_objectClass) {
353                 struct berval bv = f->f_and->f_av_value;
354                 for (ad = ai->ai_dnv; ad; ad = ad->ad_next) {
355                         if (!ber_bvstrcasecmp( &bv, &ad->ad_mapgrp->soc_cname )) {
356                         /* Now check to see if next element is (<newattr>=foo) */
357                                 Filter *fn = f->f_and->f_next;
358                                 if (fn && fn->f_choice == LDAP_FILTER_EQUALITY &&
359                                         fn->f_av_desc == ad->ad_newattr) {
360                                         Filter fr[3], *fnew;
361                                         AttributeAssertion aa[2] = {0};
362                                         Operation op2;
363                                         slap_callback cb = {0};
364                                         SlapReply rs = {REP_RESULT};
365                                         struct berval dn = BER_BVNULL;
366
367                                         /* It's a match, setup a search with filter
368                                          * (&(objectclass=<refgrp>)(<deref>=foo))
369                                          */
370                                         fr[0].f_choice = LDAP_FILTER_AND;
371                                         fr[0].f_and = &fr[1];
372                                         fr[0].f_next = NULL;
373
374                                         fr[1].f_choice = LDAP_FILTER_EQUALITY;
375                                         fr[1].f_ava = &aa[0];
376                                         fr[1].f_av_desc = slap_schema.si_ad_objectClass;
377                                         fr[1].f_av_value = ad->ad_refgrp->soc_cname;
378                                         fr[1].f_next = &fr[2];
379
380                                         fr[2].f_choice = LDAP_FILTER_EQUALITY;
381                                         fr[2].f_ava = &aa[1];
382                                         fr[2].f_av_desc = ad->ad_deref;
383                                         fr[2].f_av_value = fn->f_av_value;
384                                         fr[2].f_next = NULL;
385
386                                         /* Search with this filter to retrieve target DN */
387                                         op2 = *op;
388                                         op2.o_callback = &cb;
389                                         cb.sc_response = adremap_refsearch;
390                                         cb.sc_private = &dn;
391                                         op2.o_req_dn = ad->ad_refbase;
392                                         op2.o_req_ndn = ad->ad_refbase;
393                                         op2.ors_filter = fr;
394                                         filter2bv_x(op, fr, &op2.ors_filterstr);
395                                         op2.ors_deref = LDAP_DEREF_NEVER;
396                                         op2.ors_slimit = 1;
397                                         op2.ors_tlimit = SLAP_NO_LIMIT;
398                                         op2.ors_attrs = slap_anlist_no_attrs;
399                                         op2.ors_attrsonly = 1;
400                                         op2.o_no_schema_check = 1;
401                                         op2.o_bd->bd_info = (BackendInfo *)on->on_info;
402                                         op2.o_bd->be_search(&op2, &rs);
403                                         op2.o_bd->bd_info = (BackendInfo *)on;
404                                         op->o_tmpfree(op2.ors_filterstr.bv_val, op->o_tmpmemctx);
405
406                                         if (!dn.bv_len) {       /* no match was found */
407                                                 ad = NULL;
408                                                 break;
409                                         }
410
411                                         if (rs.sr_err) {        /* sizelimit exceeded, etc.: invalid name */
412                                                 op->o_tmpfree(dn.bv_val, op->o_tmpmemctx);
413                                                 ad = NULL;
414                                                 break;
415                                         }
416
417                                         /* Build a new filter of form
418                                          * (&(objectclass=<group>)(<dnattr>=foo-DN)...)
419                                          */
420                                         f = op->o_tmpalloc(sizeof(Filter), op->o_tmpmemctx);
421                                         f->f_choice = LDAP_FILTER_AND;
422                                         fnew = f;
423                                         f->f_next = NULL;
424
425                                         f->f_and = op->o_tmpalloc(sizeof(Filter), op->o_tmpmemctx);
426                                         f = f->f_and;
427                                         f->f_choice = LDAP_FILTER_EQUALITY;
428                                         f->f_ava = op->o_tmpcalloc(1, sizeof(AttributeAssertion), op->o_tmpmemctx);
429                                         f->f_av_desc = slap_schema.si_ad_objectClass;
430                                         ber_dupbv_x(&f->f_av_value, &ad->ad_group->soc_cname, op->o_tmpmemctx);
431
432                                         f->f_next = op->o_tmpalloc(sizeof(Filter), op->o_tmpmemctx);
433                                         f = f->f_next;
434                                         f->f_choice = LDAP_FILTER_EQUALITY;
435                                         f->f_ava = op->o_tmpcalloc(1, sizeof(AttributeAssertion), op->o_tmpmemctx);
436                                         f->f_av_desc = ad->ad_dnattr;
437                                         f->f_av_value = dn;
438                                         f->f_next = fn->f_next;
439
440                                         fn->f_next = NULL;
441                                         filter_free_x(op, op->ors_filter, 1);
442                                         op->o_tmpfree(op->ors_filterstr.bv_val, op->o_tmpmemctx);
443                                         op->ors_filter = fnew;
444                                         filter2bv_x(op, op->ors_filter, &op->ors_filterstr);
445                                         break;
446                                 }
447                         }
448                 }
449         }
450         return ad;
451 }
452
453 static int
454 adremap_search(
455         Operation *op,
456         SlapReply *rs
457 )
458 {
459         slap_overinst *on = (slap_overinst *)op->o_bd->bd_info;
460         adremap_info *ai = (adremap_info *) on->on_bi.bi_private;
461         adremap_ctx *ctx;
462         adremap_dnv *ad = NULL;
463         slap_callback *cb;
464
465         /* Is this our own internal search? Ignore it */
466         if (op->o_no_schema_check)
467                 return SLAP_CB_CONTINUE;
468
469         if (ai->ai_dnv)
470                 /* check for filter match, fallthru if none */
471                 ad = adremap_filter(op, ai);
472
473         cb = op->o_tmpcalloc(1, sizeof(slap_callback)+sizeof(adremap_ctx), op->o_tmpmemctx);
474         cb->sc_response = adremap_search_resp;
475         cb->sc_private = cb+1;
476         cb->sc_next = op->o_callback;
477         op->o_callback = cb;
478         ctx = cb->sc_private;
479         ctx->on = on;
480         if (ad) {       /* see if we need to remap a search attr */
481                 int i;
482                 for (i=0; op->ors_attrs[i].an_name.bv_val; i++) {
483                         if (op->ors_attrs[i].an_desc == ad->ad_newattr) {
484                                 ctx->an_swap = 1;
485                                 ctx->an_idx = i;
486                                 ctx->an = op->ors_attrs[i];
487                                 op->ors_attrs[i].an_desc = ad->ad_dnattr;
488                                 op->ors_attrs[i].an_name = ad->ad_dnattr->ad_cname;
489                                 break;
490                         }
491                 }
492         }
493         return SLAP_CB_CONTINUE;
494 }
495
496 static int
497 adremap_db_init(
498         BackendDB *be,
499         ConfigReply *cr
500 )
501 {
502         slap_overinst *on = (slap_overinst *) be->bd_info;
503
504         /* initialize private structure to store configuration */
505         on->on_bi.bi_private = ch_calloc( 1, sizeof(adremap_info) );
506
507         return 0;
508 }
509
510 static int
511 adremap_db_destroy(
512         BackendDB *be,
513         ConfigReply *cr
514 )
515 {
516         slap_overinst *on = (slap_overinst *) be->bd_info;
517         adremap_info *ai = (adremap_info *) on->on_bi.bi_private;
518         adremap_case *ac;
519         adremap_dnv *ad;
520
521         /* free config */
522         for (ac = ai->ai_case; ac; ac = ai->ai_case) {
523                 ai->ai_case = ac->ac_next;
524                 ch_free(ac);
525         }
526         for (ad = ai->ai_dnv; ad; ad = ai->ai_dnv) {
527                 ai->ai_dnv = ad->ad_next;
528                 ch_free(ad);
529         }
530         free( ai );
531
532         return 0;
533 }
534
535 static slap_overinst adremap;
536
537 int adremap_initialize()
538 {
539         int i, code;
540
541         adremap.on_bi.bi_type = "adremap";
542         adremap.on_bi.bi_db_init = adremap_db_init;
543         adremap.on_bi.bi_db_destroy = adremap_db_destroy;
544         adremap.on_bi.bi_op_search = adremap_search;
545
546         /* register configuration directives */
547         adremap.on_bi.bi_cf_ocs = adremapocs;
548         code = config_register_schema( adremapcfg, adremapocs );
549         if ( code ) return code;
550
551         return overlay_register( &adremap );
552 }
553
554 #if SLAPD_OVER_ADREMAP == SLAPD_MOD_DYNAMIC
555 int init_module(int argc, char *argv[]) {
556         return adremap_initialize();
557 }
558 #endif
559
560 #endif  /* defined(SLAPD_OVER_ADREMAP) */