Simplify LDAP KDB module container DN handling

Outside of krb5_ldap_read_krbcontainer_params and
krb5_ldap_create_krbcontainer, no fields of
krb5_ldap_krbcontainer_params were used except for the DN.  There was
code to create a krbTicketPolicyReference attribute (which would fail
because the schema doesn't allow that attribute, and was never
exercised because kdb5_ldap_util would never set the parameter) and to
read fields like max ticket life from the referenced ticket policy,
but those fields were never used.

Eliminate the structure and just store the container DN in
krb5_ldap_context.  Continue creating the container object when
creating a realm (by calling krb5_ldap_create_krbcontainer
unconditionally; it now exits successfully if the container already
exists), but don't ever read it.

diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
index 73b0d2f6445860fd6a42a5f0faec54890d1a894f..6ec711f55164740cea04ccc188593526f579e2c3 100644 (file)
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
@@ -63,9 +63,9 @@ init_ldap_realm(int argc, char *argv[])
         goto cleanup;
     }
 
-    if (ldap_context->krbcontainer == NULL) {
-        retval = krb5_ldap_read_krbcontainer_params (util_context,
-                                                     &(ldap_context->krbcontainer));
+    if (ldap_context->container_dn == NULL) {
+        retval = krb5_ldap_read_krbcontainer_dn(util_context,
+                                                &ldap_context->container_dn);
         if (retval != 0) {
             com_err(progname, retval,
                     _("while reading kerberos container information"));

diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
index a479c6e46a2f5e78c784a6b9682730c8138a1c83..1050fcd73ed5d84facf7e74e26a0d446b61064df 100644 (file)
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
@@ -467,70 +467,35 @@ kdb5_ldap_create(int argc, char *argv[])
     }
 
     /* read the kerberos container */
-    if ((retval=krb5_ldap_read_krbcontainer_params (util_context,
-                                                    &(ldap_context->krbcontainer))) == KRB5_KDB_NOENTRY) {
+    retval = krb5_ldap_read_krbcontainer_dn(util_context,
+                                            &ldap_context->container_dn);
+    if (retval) {
         /* Prompt the user for entering the DN of Kerberos container */
         char krb_location[MAX_KRB_CONTAINER_LEN];
-        krb5_ldap_krbcontainer_params kparams;
         int krb_location_len = 0;
-        memset(&kparams, 0, sizeof(kparams));
-
-        /* Read the kerberos container location from configuration file */
-        if (ldap_context->conf_section) {
-            if ((retval=profile_get_string(util_context->profile,
-                                           KDB_MODULE_SECTION, ldap_context->conf_section,
-                                           KRB5_CONF_LDAP_KERBEROS_CONTAINER_DN, NULL,
-                                           &kparams.DN)) != 0) {
-                goto cleanup;
+
+        printf(_("Enter DN of Kerberos container: "));
+        if (fgets(krb_location, MAX_KRB_CONTAINER_LEN, stdin) != NULL) {
+            /* Remove the newline character at the end */
+            krb_location_len = strlen(krb_location);
+            if ((krb_location[krb_location_len - 1] == '\n') ||
+                (krb_location[krb_location_len - 1] == '\r')) {
+                krb_location[krb_location_len - 1] = '\0';
+                krb_location_len--;
             }
-        }
-        if (kparams.DN == NULL) {
-            if ((retval=profile_get_string(util_context->profile,
-                                           KDB_MODULE_DEF_SECTION,
-                                           KRB5_CONF_LDAP_KERBEROS_CONTAINER_DN, NULL,
-                                           NULL, &kparams.DN)) != 0) {
+            ldap_context->container_dn = strdup(krb_location);
+            if (ldap_context->container_dn == NULL) {
+                retval = ENOMEM;
                 goto cleanup;
             }
         }
+    }
 
-        printf(_("\nKerberos container is missing. Creating now...\n"));
-        if (kparams.DN == NULL) {
-            printf(_("Enter DN of Kerberos container: "));
-            if (fgets(krb_location, MAX_KRB_CONTAINER_LEN, stdin) != NULL) {
-                /* Remove the newline character at the end */
-                krb_location_len = strlen(krb_location);
-                if ((krb_location[krb_location_len - 1] == '\n') ||
-                    (krb_location[krb_location_len - 1] == '\r')) {
-                    krb_location[krb_location_len - 1] = '\0';
-                    krb_location_len--;
-                }
-                /* If the user has not given any input, take the default location */
-                else if (krb_location[0] == '\0')
-                    kparams.DN = NULL;
-                else
-                    kparams.DN = krb_location;
-            } else
-                kparams.DN = NULL;
-        }
-
-        /* create the kerberos container */
-        retval = krb5_ldap_create_krbcontainer(util_context,
-                                               ((kparams.DN != NULL) ? &kparams : NULL));
-        if (retval)
-            goto cleanup;
-
-        retval = krb5_ldap_read_krbcontainer_params(util_context,
-                                                    &(ldap_context->krbcontainer));
-        if (retval) {
-            com_err(progname, retval,
-                    _("while reading kerberos container information"));
-            goto cleanup;
-        }
-    } else if (retval) {
-        com_err(progname, retval,
-                _("while reading kerberos container information"));
+    /* create the kerberos container if it doesn't exist */
+    retval = krb5_ldap_create_krbcontainer(util_context,
+                                           ldap_context->container_dn);
+    if (retval)
         goto cleanup;
-    }
 
     if ((retval = krb5_ldap_create_realm(util_context,
                                          /* global_params.realm, */ rparams, mask))) {
@@ -812,8 +777,9 @@ kdb5_ldap_modify(int argc, char *argv[])
         goto cleanup;
     }
 
-    if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
-                                                     &(ldap_context->krbcontainer)))) {
+    retval = krb5_ldap_read_krbcontainer_dn(util_context,
+                                            &ldap_context->container_dn);
+    if (retval) {
         com_err(progname, retval,
                 _("while reading Kerberos container information"));
         goto err_nomsg;
@@ -965,8 +931,9 @@ kdb5_ldap_view(int argc, char *argv[])
     }
 
     /* Read the kerberos container information */
-    if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
-                                                     &(ldap_context->krbcontainer))) != 0) {
+    retval = krb5_ldap_read_krbcontainer_dn(util_context,
+                                            &ldap_context->container_dn);
+    if (retval) {
         com_err(progname, retval,
                 _("while reading kerberos container information"));
         exit_status++;
@@ -1165,8 +1132,9 @@ kdb5_ldap_list(int argc, char *argv[])
     }
 
     /* Read the kerberos container information */
-    if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
-                                                     &(ldap_context->krbcontainer))) != 0) {
+    retval = krb5_ldap_read_krbcontainer_dn(util_context,
+                                            &ldap_context->container_dn);
+    if (retval) {
         com_err(progname, retval,
                 _("while reading kerberos container information"));
         exit_status++;
@@ -1175,24 +1143,17 @@ kdb5_ldap_list(int argc, char *argv[])
 
     retval = krb5_ldap_list_realm(util_context, &list);
     if (retval != 0) {
-        krb5_ldap_free_krbcontainer_params(ldap_context->krbcontainer);
-        ldap_context->krbcontainer = NULL;
         com_err(progname, retval, _("while listing realms"));
         exit_status++;
         return;
     }
     /* This is to handle the case of realm not present */
-    if (list == NULL) {
-        krb5_ldap_free_krbcontainer_params(ldap_context->krbcontainer);
-        ldap_context->krbcontainer = NULL;
+    if (list == NULL)
         return;
-    }
 
     for (plist = list; *plist != NULL; plist++) {
         printf("%s\n", *plist);
     }
-    krb5_ldap_free_krbcontainer_params(ldap_context->krbcontainer);
-    ldap_context->krbcontainer = NULL;
     krb5_free_list_entries(list);
     free(list);
 
@@ -1589,9 +1550,10 @@ kdb5_ldap_destroy(int argc, char *argv[])
         return;
     }
 
-    /* Read the kerberos container from the LDAP Server */
-    if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
-                                                     &(ldap_context->krbcontainer))) != 0) {
+    /* Read the kerberos container DN */
+    retval = krb5_ldap_read_krbcontainer_dn(util_context,
+                                            &ldap_context->container_dn);
+    if (retval) {
         com_err(progname, retval,
                 _("while reading kerberos container information"));
         exit_status++;

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
index b52d088ff693474113377586340f8dd88afc2ba1..a29b3326ecc67099b5e559cfda195c65e10b7f7c 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
@@ -113,7 +113,7 @@ krb5_ldap_read_startup_information(krb5_context context)
     int                  mask = 0;
 
     SETUP_CONTEXT();
-    if ((retval=krb5_ldap_read_krbcontainer_params(context, &(ldap_context->krbcontainer)))) {
+    if ((retval=krb5_ldap_read_krbcontainer_dn(context, &(ldap_context->container_dn)))) {
         prepend_err_str(context, _("Unable to read Kerberos container"),
                         retval, retval);
         goto cleanup;

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
index b40600780e7a378eacbab330dcee5b348bcf0c31..30d3a4aef4e218ae4027b78dfa179693800aee82 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
@@ -212,7 +212,7 @@ typedef struct _krb5_ldap_context {
     krb5_ldap_certificates        **certificates;
     krb5_ui_4                     cert_count; /* certificate count */
     k5_mutex_t                    hndl_lock;
-    krb5_ldap_krbcontainer_params *krbcontainer;
+    char                          *container_dn;
     krb5_ldap_realm_params        *lrparams;
     krb5_boolean                  disable_last_success;
     krb5_boolean                  disable_lockout;

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
index 5896724391b1f4f19cbe2b183273806a39e1d722..cd4b4ca355d48c9ae12395649ab0b4abcfac942a 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
@@ -334,8 +334,8 @@ krb5_ldap_free_ldap_context(krb5_ldap_context *ldap_context)
     if (ldap_context == NULL)
         return 0;
 
-    krb5_ldap_free_krbcontainer_params(ldap_context->krbcontainer);
-    ldap_context->krbcontainer = NULL;
+    free(ldap_context->container_dn);
+    ldap_context->container_dn = NULL;
 
     krb5_ldap_free_realm_params(ldap_context->lrparams);
     ldap_context->lrparams = NULL;

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
index 1dc4afcf78e7e05dcc779b655680c3571f9034a4..86282ea2b3c9d9ca7bbb825de599734200e305b7 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
@@ -59,7 +59,6 @@ krb5_ldap_create(krb5_context context, char *conf_section, char **db_args)
     krb5_ldap_context *ldap_context=NULL;
     krb5_boolean realm_obj_created = FALSE;
     krb5_boolean krbcontainer_obj_created = FALSE;
-    krb5_ldap_krbcontainer_params kparams = {0};
     int srv_cnt = 0;
     int mask = 0;
 
@@ -218,43 +217,15 @@ krb5_ldap_create(krb5_context context, char *conf_section, char **db_args)
     }
 
     /* read the kerberos container */
-    if ((status = krb5_ldap_read_krbcontainer_params(context,
-                                                     &(ldap_context->krbcontainer))) == KRB5_KDB_NOENTRY) {
-
-        /* Read the kerberos container location from configuration file */
-        if (ldap_context->conf_section) {
-            if ((status = profile_get_string(context->profile,
-                                             KDB_MODULE_SECTION, ldap_context->conf_section,
-                                             KRB5_CONF_LDAP_KERBEROS_CONTAINER_DN, NULL,
-                                             &kparams.DN)) != 0) {
-                goto cleanup;
-            }
-        }
-        if (kparams.DN == NULL) {
-            if ((status = profile_get_string(context->profile,
-                                             KDB_MODULE_DEF_SECTION,
-                                             KRB5_CONF_LDAP_KERBEROS_CONTAINER_DN, NULL,
-                                             NULL, &kparams.DN)) != 0) {
-                goto cleanup;
-            }
-        }
-
-        /* create the kerberos container */
-        status = krb5_ldap_create_krbcontainer(context,
-                                               ((kparams.DN != NULL) ? &kparams : NULL));
-        if (status)
-            goto cleanup;
-
-        krbcontainer_obj_created = TRUE;
-
-        status = krb5_ldap_read_krbcontainer_params(context,
-                                                    &(ldap_context->krbcontainer));
-        if (status)
-            goto cleanup;
+    status = krb5_ldap_read_krbcontainer_dn(context,
+                                            &ldap_context->container_dn);
+    if (status)
+        goto cleanup;
 
-    } else if (status) {
+    status = krb5_ldap_create_krbcontainer(context,
+                                           ldap_context->container_dn);
+    if (status)
         goto cleanup;
-    }
 
     rparams = (krb5_ldap_realm_params *) malloc(sizeof(krb5_ldap_realm_params));
     if (rparams == NULL) {
@@ -287,16 +258,12 @@ cleanup:
     if ((krbcontainer_obj_created) && (!realm_obj_created)) {
         int rc;
         rc = krb5_ldap_delete_krbcontainer(context,
-                                           ((kparams.DN != NULL) ? &kparams : NULL));
+                                           ldap_context->container_dn);
         krb5_set_error_message(context, rc,
                                _("could not complete roll-back, error "
                                  "deleting Kerberos Container"));
     }
 
-    /* should call krb5_ldap_free_krbcontainer_params() but can't */
-    if (kparams.DN != NULL)
-        krb5_xfree(kparams.DN);
-
     if (rparams)
         krb5_ldap_free_realm_params(rparams);
 

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c
index fabe633abb6899c513413b95bd7d9c2d13717dc4..e3b42f55a4d91727339930d8db6d985164ea5073 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c
@@ -32,67 +32,29 @@
 #include "kdb_ldap.h"
 #include "ldap_err.h"
 
-char    *policyrefattribute[] = {"krbTicketPolicyReference",NULL};
-char    *krbcontainerrefattr[] = {"krbContainerReference", NULL};
-
 /*
- *  Free the krb5_ldap_krbcontainer_params
- */
-
-void
-krb5_ldap_free_krbcontainer_params(krb5_ldap_krbcontainer_params *cparams)
-{
-    if (cparams == NULL)
-        return;
-
-    if (cparams->policyreference)
-        krb5_xfree(cparams->policyreference);
-
-    if (cparams->parent)
-        krb5_xfree(cparams->parent);
-
-    if (cparams->DN)
-        krb5_xfree(cparams->DN);
-
-    krb5_xfree(cparams);
-
-    return;
-}
-
-/*
- * Read the kerberos container. Kerberos container dn is read from the krb5.conf file.
- * In case of eDirectory, if the dn is not present in the conf file, refer Security Container
- * to fetch the dn information.
- *
- * Reading kerberos container includes reading the policyreference attribute and the policy
- * object to read the attributes associated with it.
+ * Read the kerberos container location from krb5.conf.
  */
 
 krb5_error_code
-krb5_ldap_read_krbcontainer_params(krb5_context context,
-                                   krb5_ldap_krbcontainer_params **cparamp)
-
+krb5_ldap_read_krbcontainer_dn(krb5_context context, char **container_dn)
 {
-    krb5_error_code                 st=0, tempst=0;
+    krb5_error_code                 st=0;
     LDAP                            *ld=NULL;
-    LDAPMessage                     *result=NULL, *ent=NULL;
-    krb5_ldap_krbcontainer_params   *cparams=NULL;
+    char                            *dn=NULL;
     kdb5_dal_handle                 *dal_handle=NULL;
     krb5_ldap_context               *ldap_context=NULL;
     krb5_ldap_server_handle         *ldap_server_handle=NULL;
 
+    *container_dn = NULL;
     SETUP_CONTEXT();
     GET_HANDLE();
 
-    cparams =(krb5_ldap_krbcontainer_params *) malloc(sizeof(krb5_ldap_krbcontainer_params));
-    CHECK_NULL(cparams);
-    memset(cparams, 0, sizeof(krb5_ldap_krbcontainer_params));
-
     /* read kerberos containter location from [dbmodules] section of krb5.conf file */
     if (ldap_context->conf_section) {
         if ((st=profile_get_string(context->profile, KDB_MODULE_SECTION, ldap_context->conf_section,
                                    KRB5_CONF_LDAP_KERBEROS_CONTAINER_DN, NULL,
-                                   &cparams->DN)) != 0) {
+                                   &dn)) != 0) {
             krb5_set_error_message(context, st,
                                    _("Error reading kerberos container "
                                      "location from krb5.conf"));
@@ -101,10 +63,10 @@ krb5_ldap_read_krbcontainer_params(krb5_context context,
     }
 
     /* read kerberos containter location from [dbdefaults] section of krb5.conf file */
-    if (cparams->DN == NULL) {
+    if (dn == NULL) {
         if ((st=profile_get_string(context->profile, KDB_MODULE_DEF_SECTION,
                                    KRB5_CONF_LDAP_KERBEROS_CONTAINER_DN, NULL,
-                                   NULL, &cparams->DN)) != 0) {
+                                   NULL, &dn)) != 0) {
             krb5_set_error_message(context, st,
                                    _("Error reading kerberos container "
                                      "location from krb5.conf"));
@@ -112,57 +74,16 @@ krb5_ldap_read_krbcontainer_params(krb5_context context,
         }
     }
 
-    if (cparams->DN == NULL) {
+    if (dn == NULL) {
         st = KRB5_KDB_SERVER_INTERNAL_ERR;
         krb5_set_error_message(context, st,
                                _("Kerberos container location not specified"));
         goto cleanup;
     }
 
-    /* NOTE: krbmaxtktlife, krbmaxrenewableage ... present on Kerberos Container is
-     * not read
-     */
-    LDAP_SEARCH_1(cparams->DN, LDAP_SCOPE_BASE, "(objectclass=krbContainer)", policyrefattribute, IGNORE_STATUS);
-    if (st != LDAP_SUCCESS && st != LDAP_NO_SUCH_OBJECT) {
-        st = set_ldap_error(context, st, OP_SEARCH);
-        goto cleanup;
-    }
-
-    if (st == LDAP_NO_SUCH_OBJECT) {
-        st = KRB5_KDB_NOENTRY;
-        goto cleanup;
-    }
-
-    if ((ent = ldap_first_entry(ld, result))) {
-        if ((st=krb5_ldap_get_string(ld, ent, "krbticketpolicyreference",
-                                     &(cparams->policyreference), NULL)) != 0)
-            goto cleanup;
-    }
-    ldap_msgfree(result);
-
-    if (cparams->policyreference != NULL) {
-        LDAP_SEARCH_1(cparams->policyreference, LDAP_SCOPE_BASE, NULL, policy_attributes, IGNORE_STATUS);
-        if (st != LDAP_SUCCESS && st!= LDAP_NO_SUCH_OBJECT) {
-            st = set_ldap_error(context, st, OP_SEARCH);
-            goto cleanup;
-        }
-        st = LDAP_SUCCESS; /* reset the return status in case it is LDAP_NO_SUCH_OBJECT */
-
-        ent=ldap_first_entry(ld, result);
-        if (ent != NULL) {
-            krb5_ldap_get_value(ld, ent, "krbmaxtktlife", &(cparams->max_life));
-            krb5_ldap_get_value(ld, ent, "krbmaxrenewableage", &(cparams->max_renewable_life));
-            krb5_ldap_get_value(ld, ent, "krbticketflags", &(cparams->tktflags));
-        }
-        ldap_msgfree(result);
-    }
-    *cparamp=cparams;
+    *container_dn = dn;
 
 cleanup:
-    if (st != 0) {
-        krb5_ldap_free_krbcontainer_params(cparams);
-        *cparamp=NULL;
-    }
     krb5_ldap_put_handle_to_pool(ldap_context, ldap_server_handle);
     return st;
 }

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.h b/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.h
index f1feb22d3ebb590579cf201dd3dfc6387e667635..549f8ce94b32cc13893ff7b0f1ad6d887433d1f3 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.h
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.h
@@ -35,28 +35,13 @@
 
 /* kerberos container structure */
 
-typedef struct _krb5_ldap_krbcontainer_params {
-    char            *parent;
-    char            *DN;
-    char            *policyreference;
-    krb5_int32      max_life;
-    krb5_int32      max_renewable_life;
-    krb5_int32      tktflags;
-} krb5_ldap_krbcontainer_params;
-
-void
-krb5_ldap_free_krbcontainer_params(krb5_ldap_krbcontainer_params *);
-
 krb5_error_code
-krb5_ldap_read_krbcontainer_params(krb5_context,
-                                   krb5_ldap_krbcontainer_params **);
+krb5_ldap_read_krbcontainer_dn(krb5_context, char **);
 
 krb5_error_code
-krb5_ldap_create_krbcontainer(krb5_context,
-                              const krb5_ldap_krbcontainer_params *);
+krb5_ldap_create_krbcontainer(krb5_context, const char *);
 
 krb5_error_code
-krb5_ldap_delete_krbcontainer(krb5_context,
-                              const krb5_ldap_krbcontainer_params *);
+krb5_ldap_delete_krbcontainer(krb5_context, const char *);
 
 #endif

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 00fbce18486c36eb62ee7dfb29244c3324829b95..1e671c7ed2779d22d17b12d7bbf41b3431b4f094 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -517,7 +517,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
     krb5_clear_error_message(context);
 
     SETUP_CONTEXT();
-    if (ldap_context->lrparams == NULL || ldap_context->krbcontainer == NULL)
+    if (ldap_context->lrparams == NULL || ldap_context->container_dn == NULL)
         return EINVAL;
 
     /* get ldap handle */

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
index 7e0d45689d2ab255d21d5fe46d3582f482402626..35daf5f6351392fb9b34cb528a140abb184b64d7 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
@@ -130,9 +130,9 @@ krb5_ldap_list_realm(krb5_context context, char ***realms)
     SETUP_CONTEXT ();
 
     /* get the kerberos container DN information */
-    if (ldap_context->krbcontainer == NULL) {
-        if ((st = krb5_ldap_read_krbcontainer_params(context,
-                                                     &(ldap_context->krbcontainer))) != 0)
+    if (ldap_context->container_dn == NULL) {
+        if ((st = krb5_ldap_read_krbcontainer_dn(context,
+                                                 &(ldap_context->container_dn))) != 0)
             goto cleanup;
     }
 
@@ -141,7 +141,7 @@ krb5_ldap_list_realm(krb5_context context, char ***realms)
 
     {
         char *cn[] = {"cn", NULL};
-        LDAP_SEARCH(ldap_context->krbcontainer->DN,
+        LDAP_SEARCH(ldap_context->container_dn,
                     LDAP_SCOPE_ONELEVEL,
                     "(objectclass=krbRealmContainer)",
                     cn);
@@ -359,7 +359,7 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
     SETUP_CONTEXT ();
 
     /* Check validity of arguments */
-    if (ldap_context->krbcontainer == NULL ||
+    if (ldap_context->container_dn == NULL ||
         rparams->tl_data == NULL ||
         rparams->tl_data->tl_data_contents == NULL ||
         ((mask & LDAP_REALM_SUBTREE) && rparams->subtree == NULL) ||
@@ -474,17 +474,14 @@ cleanup:
 
 
 /*
- * Create the Kerberos container in the Directory
+ * Create the Kerberos container in the Directory if it does not exist
  */
 
 krb5_error_code
-krb5_ldap_create_krbcontainer(krb5_context context,
-                              const
-                              krb5_ldap_krbcontainer_params *krbcontparams)
+krb5_ldap_create_krbcontainer(krb5_context context, const char *dn)
 {
     LDAP                        *ld=NULL;
-    char                        *strval[2]={NULL}, *kerberoscontdn=NULL, **rdns=NULL;
-    int                         pmask=0;
+    char                        *strval[2]={NULL}, **rdns=NULL;
     LDAPMod                     **mods = NULL;
     krb5_error_code             st=0;
     kdb5_dal_handle             *dal_handle=NULL;
@@ -496,9 +493,7 @@ krb5_ldap_create_krbcontainer(krb5_context context,
     /* get ldap handle */
     GET_HANDLE ();
 
-    if (krbcontparams != NULL && krbcontparams->DN != NULL) {
-        kerberoscontdn = krbcontparams->DN;
-    } else {
+    if (dn == NULL) {
         st = EINVAL;
         krb5_set_error_message(context, st,
                                _("Kerberos Container information is missing"));
@@ -510,7 +505,7 @@ krb5_ldap_create_krbcontainer(krb5_context context,
     if ((st=krb5_add_str_mem_ldap_mod(&mods, "objectclass", LDAP_MOD_ADD, strval)) != 0)
         goto cleanup;
 
-    rdns = ldap_explode_dn(kerberoscontdn, 1);
+    rdns = ldap_explode_dn(dn, 1);
     if (rdns == NULL) {
         st = EINVAL;
         krb5_set_error_message(context, st,
@@ -523,21 +518,11 @@ krb5_ldap_create_krbcontainer(krb5_context context,
     if ((st=krb5_add_str_mem_ldap_mod(&mods, "cn", LDAP_MOD_ADD, strval)) != 0)
         goto cleanup;
 
-    /* check if the policy reference value exists and is of krbticketpolicyreference object class */
-    if (krbcontparams && krbcontparams->policyreference) {
-        st = checkattributevalue(ld, krbcontparams->policyreference, "objectclass", policyclass,
-                                 &pmask);
-        CHECK_CLASS_VALIDITY(st, pmask, _("ticket policy object value: "));
-
-        strval[0] = krbcontparams->policyreference;
-        strval[1] = NULL;
-        if ((st=krb5_add_str_mem_ldap_mod(&mods, "krbticketpolicyreference", LDAP_MOD_ADD,
-                                          strval)) != 0)
-            goto cleanup;
-    }
-
     /* create the kerberos container */
-    if ((st = ldap_add_ext_s(ld, kerberoscontdn, mods, NULL, NULL)) != LDAP_SUCCESS) {
+    st = ldap_add_ext_s(ld, dn, mods, NULL, NULL);
+    if (st == LDAP_ALREADY_EXISTS)
+        st = LDAP_SUCCESS;
+    if (st != LDAP_SUCCESS) {
         int ost = st;
         st = translate_ldap_error (st, OP_ADD);
         krb5_set_error_message(context, st,
@@ -561,12 +546,9 @@ cleanup:
  */
 
 krb5_error_code
-krb5_ldap_delete_krbcontainer(krb5_context context,
-                              const
-                              krb5_ldap_krbcontainer_params *krbcontparams)
+krb5_ldap_delete_krbcontainer(krb5_context context, const char *dn)
 {
     LDAP                        *ld=NULL;
-    char                        *kerberoscontdn=NULL;
     krb5_error_code             st=0;
     kdb5_dal_handle             *dal_handle=NULL;
     krb5_ldap_context           *ldap_context=NULL;
@@ -577,9 +559,7 @@ krb5_ldap_delete_krbcontainer(krb5_context context,
     /* get ldap handle */
     GET_HANDLE ();
 
-    if (krbcontparams != NULL && krbcontparams->DN != NULL) {
-        kerberoscontdn = krbcontparams->DN;
-    } else {
+    if (dn == NULL) {
         st = EINVAL;
         krb5_set_error_message(context, st,
                                _("Kerberos Container information is missing"));
@@ -587,7 +567,7 @@ krb5_ldap_delete_krbcontainer(krb5_context context,
     }
 
     /* delete the kerberos container */
-    if ((st = ldap_delete_ext_s(ld, kerberoscontdn, NULL, NULL)) != LDAP_SUCCESS) {
+    if ((st = ldap_delete_ext_s(ld, dn, NULL, NULL)) != LDAP_SUCCESS) {
         int ost = st;
         st = translate_ldap_error (st, OP_ADD);
         krb5_set_error_message(context, st,
@@ -626,8 +606,7 @@ krb5_ldap_create_realm(krb5_context context, krb5_ldap_realm_params *rparams,
     SETUP_CONTEXT ();
 
     /* Check input validity ... */
-    if (ldap_context->krbcontainer == NULL ||
-        ldap_context->krbcontainer->DN == NULL ||
+    if (ldap_context->container_dn == NULL ||
         rparams == NULL ||
         rparams->realm_name == NULL ||
         ((mask & LDAP_REALM_SUBTREE) && rparams->subtree  == NULL) ||
@@ -638,19 +617,12 @@ krb5_ldap_create_realm(krb5_context context, krb5_ldap_realm_params *rparams,
         return st;
     }
 
-    if (ldap_context->krbcontainer == NULL) {
-        if ((st = krb5_ldap_read_krbcontainer_params(context,
-                                                     &(ldap_context->krbcontainer))) != 0)
-            goto cleanup;
-    }
-
     /* get ldap handle */
     GET_HANDLE ();
 
     realm_name = rparams->realm_name;
 
-    if (asprintf(&dn, "cn=%s,%s", realm_name,
-                 ldap_context->krbcontainer->DN) < 0)
+    if (asprintf(&dn, "cn=%s,%s", realm_name, ldap_context->container_dn) < 0)
         dn = NULL;
     CHECK_NULL(dn);
 
@@ -758,7 +730,7 @@ krb5_error_code
 krb5_ldap_read_realm_params(krb5_context context, char *lrealm,
                             krb5_ldap_realm_params **rlparamp, int *mask)
 {
-    char                   **values=NULL, *krbcontDN=NULL /*, *curr=NULL */;
+    char                   **values=NULL;
     krb5_error_code        st=0, tempst=0;
     LDAP                   *ld=NULL;
     LDAPMessage            *result=NULL,*ent=NULL;
@@ -771,19 +743,11 @@ krb5_ldap_read_realm_params(krb5_context context, char *lrealm,
     SETUP_CONTEXT ();
 
     /* validate the input parameter */
-    if (lrealm == NULL ||
-        ldap_context->krbcontainer == NULL ||
-        ldap_context->krbcontainer->DN == NULL) {
+    if (lrealm == NULL || ldap_context->container_dn == NULL) {
         st = EINVAL;
         goto cleanup;
     }
 
-    /* read kerberos container, if not read already */
-    if (ldap_context->krbcontainer == NULL) {
-        if ((st = krb5_ldap_read_krbcontainer_params(context,
-                                                     &(ldap_context->krbcontainer))) != 0)
-            goto cleanup;
-    }
     /* get ldap handle */
     GET_HANDLE ();
 
@@ -807,9 +771,8 @@ krb5_ldap_read_realm_params(krb5_context context, char *lrealm,
     /* set default values */
     rlparams->search_scope = LDAP_SCOPE_SUBTREE;
 
-    krbcontDN = ldap_context->krbcontainer->DN;
-
-    if (asprintf(&rlparams->realmdn, "cn=%s,%s", lrealm, krbcontDN) < 0) {
+    if (asprintf(&rlparams->realmdn, "cn=%s,%s", lrealm,
+                 ldap_context->container_dn) < 0) {
         rlparams->realmdn = NULL;
         st = ENOMEM;
         goto cleanup;

diff --git a/src/plugins/kdb/ldap/libkdb_ldap/libkdb_ldap.exports b/src/plugins/kdb/ldap/libkdb_ldap/libkdb_ldap.exports
index 1467f5184cea2fcbc2e0198fcf830264b94e1dc7..36bde5a4fee5d118bb864c86184306b34bd6ab9e 100644 (file)
--- a/src/plugins/kdb/ldap/libkdb_ldap/libkdb_ldap.exports
+++ b/src/plugins/kdb/ldap/libkdb_ldap/libkdb_ldap.exports
@@ -11,7 +11,7 @@ krb5_ldap_get_principal
 krb5_ldap_delete_principal
 krb5_ldap_free_principal
 krb5_ldap_iterate
-krb5_ldap_read_krbcontainer_params
+krb5_ldap_read_krbcontainer_dn
 krb5_ldap_list_realm
 krb5_ldap_read_realm_params
 krb5_ldap_free_realm_params
@@ -34,7 +34,6 @@ krb5_ldap_iterate_password_policy
 krb5_dbe_free_contents
 krb5_ldap_free_server_params
 krb5_ldap_free_server_context_params
-krb5_ldap_free_krbcontainer_params
 krb5_ldap_alloc
 krb5_ldap_free
 krb5_ldap_delete_realm_1