diff options
| -rw-r--r-- | ipa-client/Makefile.am | 6 | ||||
| -rw-r--r-- | ipa-client/configure.ac | 67 | ||||
| -rw-r--r-- | ipa-client/ipa-getkeytab.c | 24 | ||||
| -rw-r--r-- | ipa-server/configure.ac | 81 | ||||
| -rw-r--r-- | ipa-server/ipa-kpasswd/ipa_kpasswd.c | 30 | ||||
| -rw-r--r-- | ipa-server/ipa-slapi-plugins/dna/Makefile.am | 1 | ||||
| -rw-r--r-- | ipa-server/ipa-slapi-plugins/ipa-memberof/Makefile.am | 1 | ||||
| -rw-r--r-- | ipa-server/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am | 1 |
8 files changed, 109 insertions, 102 deletions
diff --git a/ipa-client/Makefile.am b/ipa-client/Makefile.am index 3379eea8c..639dbb813 100644 --- a/ipa-client/Makefile.am +++ b/ipa-client/Makefile.am @@ -13,7 +13,8 @@ INCLUDES = \ -DLIBEXECDIR=\""$(libexecdir)"\" \ -DDATADIR=\""$(datadir)"\" \ $(KRB5_CFLAGS) \ - $(LDAP_CFLAGS) \ + $(OPENLDAP_CFLAGS) \ + $(MOZLDAP_CFLAGS) \ $(SASL_CFLAGS) \ $(POPT_CFLAGS) \ $(WARN_CFLAGS) \ @@ -29,7 +30,8 @@ ipa_getkeytab_SOURCES = \ ipa_getkeytab_LDADD = \ $(KRB5_LIBS) \ - $(LDAP_LIBS) \ + $(OPENLDAP_LIBS) \ + $(MOZLDAP_LIBS) \ $(SASL_LIBS) \ $(POPT_LIBS) \ $(NULL) diff --git a/ipa-client/configure.ac b/ipa-client/configure.ac index 5718f8fe0..c9dbdfae3 100644 --- a/ipa-client/configure.ac +++ b/ipa-client/configure.ac @@ -82,42 +82,47 @@ fi AC_SUBST(KRB5_LIBS) dnl --------------------------------------------------------------------------- -dnl - Check for LDAP +dnl - Check for Mozilla LDAP or OpenLDAP SDK dnl --------------------------------------------------------------------------- -LDAP_LIBS= -AC_CHECK_HEADER(ldap.h) -AC_CHECK_HEADER(lber.h) - -AC_CHECK_LIB(ldap, ldap_search, with_ldap=yes) -dnl Check for other libraries we need to link with to get the main routines. -test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes], , -llber) } -test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes with_ldap_krb=yes], , -llber -lkrb) } -test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes with_ldap_krb=yes with_ldap_des=yes], , -llber -lkrb -ldes) } -dnl Recently, we need -lber even though the main routines are elsewhere, -dnl because otherwise be get link errors w.r.t. ber_pvt_opt_on. So just -dnl check for that (it's a variable not a fun but that doesn't seem to -dnl matter in these checks) and stick in -lber if so. Can't hurt (even to -dnl stick it in always shouldn't hurt, I don't think) ... #### Someone who -dnl #### understands LDAP needs to fix this properly. -test "$with_ldap_lber" != "yes" && { AC_CHECK_LIB(lber, ber_pvt_opt_on, with_ldap_lber=yes) } - -if test "$with_ldap" = "yes"; then - if test "$with_ldap_des" = "yes" ; then - LDAP_LIBS="${LDAP_LIBS} -ldes" - fi - if test "$with_ldap_krb" = "yes" ; then - LDAP_LIBS="${LDAP_LIBS} -lkrb" - fi - if test "$with_ldap_lber" = "yes" ; then - LDAP_LIBS="${LDAP_LIBS} -llber" - fi - LDAP_LIBS="${LDAP_LIBS} -lldap" +AC_ARG_WITH(openldap, [ --with-openldap Use OpenLDAP]) + +if test x$with_openldap = xyes; then + AC_CHECK_LIB(ldap, ldap_search, with_ldap=yes) + dnl Check for other libraries we need to link with to get the main routines. + test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes], , -llber) } + test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes with_ldap_krb=yes], , -llber -lkrb) } + test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes with_ldap_krb=yes with_ldap_des=yes], , -llber -lkrb -ldes) } + dnl Recently, we need -lber even though the main routines are elsewhere, + dnl because otherwise be get link errors w.r.t. ber_pvt_opt_on. So just + dnl check for that (it's a variable not a fun but that doesn't seem to + dnl matter in these checks) and stick in -lber if so. Can't hurt (even to + dnl stick it in always shouldn't hurt, I don't think) ... #### Someone who + dnl #### understands LDAP needs to fix this properly. + test "$with_ldap_lber" != "yes" && { AC_CHECK_LIB(lber, ber_pvt_opt_on, with_ldap_lber=yes) } + + if test "$with_ldap" = "yes"; then + if test "$with_ldap_des" = "yes" ; then + OPENLDAP_LIBS="${OPENLDAP_LIBS} -ldes" + fi + if test "$with_ldap_krb" = "yes" ; then + OPENLDAP_LIBS="${OPENLDAP_LIBS} -lkrb" + fi + if test "$with_ldap_lber" = "yes" ; then + OPENLDAP_LIBS="${OPENLDAP_LIBS} -llber" + fi + OPENLDAP_LIBS="${OPENLDAP_LIBS} -lldap" + else + AC_MSG_ERROR([OpenLDAP not found]) + fi + + AC_SUBST(OPENLDAP_LIBS) else - AC_MSG_ERROR([LDAP not found]) + PKG_CHECK_MODULES(MOZLDAP, mozldap > 6) + MOZLDAP_CFLAGS="${MOZLDAP_CFLAGS} -DWITH_MOZLDAP" + AC_SUBST(MOZLDAP_CFLAGS) fi -AC_SUBST(LDAP_LIBS) dnl --------------------------------------------------------------------------- dnl - Check for POPT diff --git a/ipa-client/ipa-getkeytab.c b/ipa-client/ipa-getkeytab.c index 28859a7f6..96426509a 100644 --- a/ipa-client/ipa-getkeytab.c +++ b/ipa-client/ipa-getkeytab.c @@ -31,7 +31,11 @@ #include <errno.h> #include <time.h> #include <krb5.h> +#ifdef WITH_MOZLDAP +#include <mozldap/ldap.h> +#else #include <ldap.h> +#endif #include <sasl/sasl.h> #include <popt.h> @@ -275,7 +279,6 @@ static int ldap_set_keytab(const char *servername, BerElement *ctrl = NULL; BerElement *sctrl = NULL; struct berval *control = NULL; - char *ldap_uri = NULL; struct berval **ncvals; char *ldap_base = NULL; char *retoid = NULL; @@ -306,23 +309,16 @@ static int ldap_set_keytab(const char *servername, goto error_out; } - /* connect to ldap server */ - ret = asprintf(&ldap_uri, "ldap://%s:389", servername); - if (ret == -1) { - fprintf(stderr, "Unable to determine server URI!\n"); - goto error_out; - } - /* TODO: support referrals ? */ - ret = ldap_initialize(&ld, ldap_uri); - if(ret != LDAP_SUCCESS) { + ld = ldap_init(servername, 389); + if(ld == NULL) { fprintf(stderr, "Unable to initialize ldap library!\n"); goto error_out; } version = LDAP_VERSION3; ret = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version); - if (ret != LDAP_OPT_SUCCESS) { + if (ret != LDAP_SUCCESS) { fprintf(stderr, "Unable to set ldap options!\n"); goto error_out; } @@ -427,8 +423,7 @@ static int ldap_set_keytab(const char *servername, ber_free(sctrl, 1); ldap_controls_free(srvctrl); ldap_msgfree(res); - ldap_unbind_ext_s(ld, NULL, NULL); - free(ldap_uri); + ldap_unbind_ext(ld, NULL, NULL); return kvno; error_out: @@ -436,8 +431,7 @@ error_out: if (srvctrl) ldap_controls_free(srvctrl); if (err) ldap_memfree(err); if (res) ldap_msgfree(res); - if (ld) ldap_unbind_ext_s(ld, NULL, NULL); - if (ldap_uri) free(ldap_uri); + if (ld) ldap_unbind_ext(ld, NULL, NULL); if (control) ber_bvfree(control); if (encs) free(encs); return 0; diff --git a/ipa-server/configure.ac b/ipa-server/configure.ac index 8c610a860..a749098dc 100644 --- a/ipa-server/configure.ac +++ b/ipa-server/configure.ac @@ -87,48 +87,55 @@ fi AC_SUBST(KRB5_LIBS) dnl --------------------------------------------------------------------------- -dnl - Check for LDAP +dnl - Check for Mozilla LDAP or OpenLDAP SDK dnl --------------------------------------------------------------------------- -LDAP_LIBS= -AC_CHECK_HEADER(ldap.h) -AC_CHECK_HEADER(lber.h) - -AC_CHECK_LIB(ldap, ldap_search, with_ldap=yes) -dnl Check for other libraries we need to link with to get the main routines. -test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes], , -llber) } -test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes with_ldap_krb=yes], , -llber -lkrb) } -test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes with_ldap_krb=yes with_ldap_des=yes], , -llber -lkrb -ldes) } -dnl Recently, we need -lber even though the main routines are elsewhere, -dnl because otherwise be get link errors w.r.t. ber_pvt_opt_on. So just -dnl check for that (it's a variable not a fun but that doesn't seem to -dnl matter in these checks) and stick in -lber if so. Can't hurt (even to -dnl stick it in always shouldn't hurt, I don't think) ... #### Someone who -dnl #### understands LDAP needs to fix this properly. -test "$with_ldap_lber" != "yes" && { AC_CHECK_LIB(lber, ber_pvt_opt_on, with_ldap_lber=yes) } - -if test "$with_ldap" = "yes"; then - if test "$with_ldap_des" = "yes" ; then - LDAP_LIBS="${LDAP_LIBS} -ldes" - fi - if test "$with_ldap_krb" = "yes" ; then - LDAP_LIBS="${LDAP_LIBS} -lkrb" - fi - if test "$with_ldap_lber" = "yes" ; then - LDAP_LIBS="${LDAP_LIBS} -llber" - fi - LDAP_LIBS="${LDAP_LIBS} -lldap" -else - AC_MSG_ERROR([LDAP not found]) -fi +AC_ARG_WITH(openldap, [ --with-openldap Use OpenLDAP]) -AC_SUBST(LDAP_LIBS) +dnl The mozldap libraries are always needed because ipa-slapi-plugins/dna/ +dnl will not build against OpenLDAP. +PKG_CHECK_MODULES(MOZLDAP, mozldap > 6) -dnl --------------------------------------------------------------------------- -dnl - Check for Mozilla LDAP SDK -dnl --------------------------------------------------------------------------- +if test x$with_openldap = xyes; then + AC_CHECK_LIB(ldap, ldap_search, with_ldap=yes) + dnl Check for other libraries we need to link with to get the main routines. + test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes], , -llber) } + test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes with_ldap_krb=yes], , -llber -lkrb) } + test "$with_ldap" != "yes" && { AC_CHECK_LIB(ldap, ldap_open, [with_ldap=yes with_ldap_lber=yes with_ldap_krb=yes with_ldap_des=yes], , -llber -lkrb -ldes) } + dnl Recently, we need -lber even though the main routines are elsewhere, + dnl because otherwise be get link errors w.r.t. ber_pvt_opt_on. So just + dnl check for that (it's a variable not a fun but that doesn't seem to + dnl matter in these checks) and stick in -lber if so. Can't hurt (even to + dnl stick it in always shouldn't hurt, I don't think) ... #### Someone who + dnl #### understands LDAP needs to fix this properly. + test "$with_ldap_lber" != "yes" && { AC_CHECK_LIB(lber, ber_pvt_opt_on, with_ldap_lber=yes) } + + if test "$with_ldap" = "yes"; then + if test "$with_ldap_des" = "yes" ; then + LDAP_LIBS="${LDAP_LIBS} -ldes" + fi + if test "$with_ldap_krb" = "yes" ; then + LDAP_LIBS="${LDAP_LIBS} -lkrb" + fi + if test "$with_ldap_lber" = "yes" ; then + LDAP_LIBS="${LDAP_LIBS} -llber" + fi + LDAP_LIBS="${LDAP_LIBS} -lldap" + else + AC_MSG_ERROR([OpenLDAP not found]) + fi + + AC_SUBST(LDAP_LIBS) + + LDAP_CFLAGS="${LDAP_CFLAGS} -DWITH_OPENLDAP" + AC_SUBST(LDAP_CFLAGS) +else + LDAP_LIBS="${MOZLDAP_LIBS}" + AC_SUBST(LDAP_LIBS) -PKG_CHECK_MODULES(MOZLDAP, mozldap > 6) + LDAP_CFLAGS="${LDAP_CFLAGS} -DWITH_MOZLDAP" + AC_SUBST(LDAP_CFLAGS) +fi dnl --------------------------------------------------------------------------- dnl - Check for OpenSSL Crypto library diff --git a/ipa-server/ipa-kpasswd/ipa_kpasswd.c b/ipa-server/ipa-kpasswd/ipa_kpasswd.c index 898cffa47..5782367a0 100644 --- a/ipa-server/ipa-kpasswd/ipa_kpasswd.c +++ b/ipa-server/ipa-kpasswd/ipa_kpasswd.c @@ -39,13 +39,23 @@ #include <arpa/inet.h> #include <time.h> #include <krb5.h> +#ifdef WITH_MOZLDAP +#include <mozldap/ldap.h> +#else #include <ldap.h> +#endif #include <sasl/sasl.h> #define DEFAULT_KEYTAB "FILE:/var/kerberos/krb5kdc/kpasswd.keytab" #define TMP_TEMPLATE "/var/cache/ipa/kpasswd/krb5_cc.XXXXXX" #define KPASSWD_PORT 464 +#ifdef WITH_MOZLDAP +/* From OpenLDAP's ldap.h */ +#define LDAP_TAG_EXOP_MODIFY_PASSWD_ID ((ber_tag_t) 0x80U) +#define LDAP_TAG_EXOP_MODIFY_PASSWD_NEW ((ber_tag_t) 0x82U) +#endif + /* blacklist entries are released only BLCAKLIST_TIMEOUT seconds * after the children performing the noperation has finished. * this is to avoid races */ @@ -310,7 +320,6 @@ int ldap_pwd_change(char *client_name, char *realm_name, krb5_data pwd, char **e struct berval control; struct berval newpw; char hostname[1024]; - char *ldap_uri = NULL; struct berval **ncvals; char *ldap_base = NULL; char *filter; @@ -367,17 +376,10 @@ int ldap_pwd_change(char *client_name, char *realm_name, krb5_data pwd, char **e goto done; } - ret = asprintf(&ldap_uri, "ldap://%s:389", hostname); - if (ret == -1) { - syslog(LOG_ERR, "Out of memory!"); - ret = KRB5_KPASSWD_HARDERROR; - goto done; - } - /* connect to ldap server */ /* TODO: support referrals ? */ - ret = ldap_initialize(&ld, ldap_uri); - if(ret != LDAP_SUCCESS) { + ld = ldap_init(hostname, 389); + if(ld == NULL) { syslog(LOG_ERR, "Unable to connect to ldap server"); ret = KRB5_KPASSWD_HARDERROR; goto done; @@ -385,7 +387,7 @@ int ldap_pwd_change(char *client_name, char *realm_name, krb5_data pwd, char **e version = LDAP_VERSION3; ret = ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &version); - if (ret != LDAP_OPT_SUCCESS) { + if (ret != LDAP_SUCCESS) { syslog(LOG_ERR, "Unable to set ldap protocol version"); ret = KRB5_KPASSWD_HARDERROR; goto done; @@ -480,11 +482,12 @@ int ldap_pwd_change(char *client_name, char *realm_name, krb5_data pwd, char **e ret = KRB5_KPASSWD_HARDERROR; goto done; } + ber_printf(ctrl, "{tstON}", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, userdn, LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, &newpw); - ret = ber_flatten2(ctrl, &control, 0); + ret = ber_flatten(ctrl, &control); if (ret < 0) { syslog(LOG_ERR, "ber flattening failed!"); ret = KRB5_KPASSWD_HARDERROR; @@ -645,8 +648,7 @@ done: if (exterr1) free(exterr1); if (exterr2) free(exterr2); if (userdn) free(userdn); - if (ld) ldap_unbind_ext_s(ld, NULL, NULL); - if (ldap_uri) free(ldap_uri); + if (ld) ldap_unbind_ext(ld, NULL, NULL); if (tmp_file) { unlink(tmp_file); free(tmp_file); diff --git a/ipa-server/ipa-slapi-plugins/dna/Makefile.am b/ipa-server/ipa-slapi-plugins/dna/Makefile.am index 57a99764b..4a54b8d5d 100644 --- a/ipa-server/ipa-slapi-plugins/dna/Makefile.am +++ b/ipa-server/ipa-slapi-plugins/dna/Makefile.am @@ -9,7 +9,6 @@ INCLUDES = \ -DLIBEXECDIR=\""$(libexecdir)"\" \ -DDATADIR=\""$(datadir)"\" \ $(MOZLDAP_CFLAGS) \ - $(LDAP_CFLAGS) \ $(KRB5_CFLAGS) \ $(WARN_CFLAGS) \ $(NULL) diff --git a/ipa-server/ipa-slapi-plugins/ipa-memberof/Makefile.am b/ipa-server/ipa-slapi-plugins/ipa-memberof/Makefile.am index 54ddd538a..cf084aae0 100644 --- a/ipa-server/ipa-slapi-plugins/ipa-memberof/Makefile.am +++ b/ipa-server/ipa-slapi-plugins/ipa-memberof/Makefile.am @@ -9,7 +9,6 @@ INCLUDES = \ -DLIBEXECDIR=\""$(libexecdir)"\" \ -DDATADIR=\""$(datadir)"\" \ $(MOZLDAP_CFLAGS) \ - $(LDAP_CFLAGS) \ $(KRB5_CFLAGS) \ $(WARN_CFLAGS) \ $(NULL) diff --git a/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am b/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am index fea48fdd7..540646f06 100644 --- a/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am +++ b/ipa-server/ipa-slapi-plugins/ipa-pwd-extop/Makefile.am @@ -9,7 +9,6 @@ INCLUDES = \ -DLIBEXECDIR=\""$(libexecdir)"\" \ -DDATADIR=\""$(datadir)"\" \ $(MOZLDAP_CFLAGS) \ - $(LDAP_CFLAGS) \ $(KRB5_CFLAGS) \ $(SSL_CFLAGS) \ $(WARN_CFLAGS) \ |