/*
* adcli
*
* Copyright (C) 2013 Red Hat Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as
* published by the Free Software Foundation; either version 2.1 of
* the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
* MA 02110-1301 USA
*
* Author: Stef Walter <stefw@redhat.com>
*/
#include "config.h"
#include "adcli.h"
#include "adattrs.h"
#include "tools.h"
#include <assert.h>
#include <err.h>
#include <stdio.h>
typedef enum {
/* Have short equivalents */
opt_domain = 'D',
opt_domain_realm = 'R',
opt_domain_controller = 'S',
opt_login_user = 'U',
opt_login_ccache = 'C',
opt_domain_ou = 'O',
opt_prompt_password = 'W',
opt_verbose = 'v',
/* Don't have short equivalents */
opt_no_password,
opt_stdin_password,
opt_display_name,
opt_description,
opt_mail,
opt_unix_home,
opt_unix_uid,
opt_unix_gid,
opt_unix_shell,
opt_nis_domain,
} Option;
static adcli_tool_desc common_usages[] = {
{ opt_display_name, "display name" },
{ opt_description, "group description" },
{ opt_mail, "email address" },
{ opt_unix_home, "unix home directory" },
{ opt_unix_uid, "unix uid number" },
{ opt_unix_gid, "unix gid number" },
{ opt_unix_shell, "unix shell" },
{ opt_nis_domain, "NIS domain" },
{ opt_domain, "active directory domain name" },
{ opt_domain_realm, "kerberos realm for the domain" },
{ opt_domain_controller, "domain directory server to connect to" },
{ opt_login_ccache, "kerberos credential cache file which contains\n"
"ticket to used to connect to the domain" },
{ opt_login_user, "user (usually administrative) login name of\n"
"the account to log into the domain as" },
{ opt_domain_ou, "a LDAP DN representing an organizational unit in\n"
"which the user account should be placed." },
{ opt_no_password, "don't prompt for or read a password" },
{ opt_prompt_password, "prompt for a login password if necessary" },
{ opt_stdin_password, "read a login password from stdin (until EOF) if\n"
"necessary" },
{ opt_verbose, "show verbose progress and failure messages", },
{ 0 },
};
static void
parse_option (Option opt,
const char *optarg,
adcli_conn *conn)
{
static int no_password = 0;
static int prompt_password = 0;
static int stdin_password = 0;
switch (opt) {
case opt_login_ccache:
adcli_conn_set_login_ccache_name (conn, optarg);
return;
case opt_login_user:
adcli_conn_set_login_user (conn, optarg);
return;
case opt_domain:
adcli_conn_set_domain_name (conn, optarg);
return;
case opt_domain_realm:
adcli_conn_set_domain_realm (conn, optarg);
return;
case opt_domain_controller:
adcli_conn_set_domain_controller (conn, optarg);
return;
case opt_no_password:
if (stdin_password || prompt_password) {
errx (EUSAGE, "cannot use --no-password argument with %s",
stdin_password ? "--stdin-password" : "--prompt-password");
} else {
adcli_conn_set_password_func (conn, NULL, NULL, NULL);
no_password = 1;
}
return;
case opt_prompt_password:
if (stdin_password || no_password) {
errx (EUSAGE, "cannot use --prompt-password argument with %s",
stdin_password ? "--stdin-password" : "--no-password");
} else {
adcli_conn_set_password_func (conn, adcli_prompt_password_func, NULL, NULL);
prompt_password = 1;
}
return;
case opt_stdin_password:
if (prompt_password || no_password) {
errx (EUSAGE, "cannot use --stdin-password argument with %s",
prompt_password ? "--prompt-password" : "--no-password");
} else {
adcli_conn_set_password_func (conn, adcli_read_password_func, NULL, NULL);
stdin_password = 1;
}
return;
case opt_verbose:
return;
default:
assert (0 && "not reached");
break;
}
errx (EUSAGE, "failure to parse option '%c'", opt);
}
int
adcli_tool_user_create (adcli_conn *conn,
int argc,
char *argv[])
{
adcli_entry *entry;
adcli_result res;
adcli_attrs *attrs;
const char *ou = NULL;
int opt;
bool has_unix_attr = false;
bool has_nis_domain = false;
struct option options[] = {
{ "display-name", required_argument, NULL, opt_display_name },
{ "mail", required_argument, NULL, opt_mail },
{ "unix-home", required_argument, NULL, opt_unix_home },
{ "unix-uid", required_argument, NULL, opt_unix_uid },
{ "unix-gid", required_argument, NULL, opt_unix_gid },
{ "unix-shell", required_argument, NULL, opt_unix_shell },
{ "nis-domain", required_argument, NULL, opt_nis_domain },
{ "domain-ou", required_argument, NULL, opt_domain_ou },
{ "domain", required_argument, NULL, opt_domain },
{ "domain-realm", required_argument, NULL, opt_domain_realm },
{ "domain-controller", required_argument, NULL, opt_domain_controller },
{ "login-user", required_argument, NULL, opt_login_user },
{ "login-ccache", optional_argument, NULL, opt_login_ccache },
{ "no-password", no_argument, 0, opt_no_password },
{ "stdin-password", no_argument, 0, opt_stdin_password },
{ "prompt-password", no_argument, 0, opt_prompt_password },
{ "verbose", no_argument, NULL, opt_verbose },
{ "help", no_argument, NULL, 'h' },
{ 0 },
};
static adcli_tool_desc usages[] = {
{ 0, "usage: adcli create-user --domain=xxxx user" },
{ 0 },
};
attrs = adcli_attrs_new ();
while ((opt = adcli_tool_getopt (argc, argv, options)) != -1) {
switch (opt) {
case opt_display_name:
adcli_attrs_add (attrs, "displayName", optarg, NULL);
break;
case opt_mail:
adcli_attrs_add1 (attrs, "mail", optarg);
break;
case opt_unix_home:
adcli_attrs_add (attrs, "unixHomeDirectory", optarg, NULL);
has_unix_attr = true;
break;
case opt_unix_uid:
adcli_attrs_add (attrs, "uidNumber", optarg, NULL);
has_unix_attr = true;
break;
case opt_unix_gid:
adcli_attrs_add (attrs, "gidNumber", optarg, NULL);
has_unix_attr = true;
break;
case opt_unix_shell:
adcli_attrs_add (attrs, "loginShell", optarg, NULL);
has_unix_attr = true;
break;
case opt_nis_domain:
adcli_attrs_add (attrs, "msSFU30NisDomain", optarg, NULL);
has_nis_domain = true;
break;
case opt_domain_ou:
ou = optarg;
break;
case 'h':
case '?':
case ':':
adcli_tool_usage (options, usages);
adcli_tool_usage (options, common_usages);
adcli_attrs_free (attrs);
return opt == 'h' ? 0 : 2;
default:
parse_option ((Option)opt, optarg, conn);
break;
}
}
argc -= optind;
argv += optind;
if (argc != 1)
errx (2, "specify one user name to create");
entry = adcli_entry_new_user (conn, argv[0]);
if (entry == NULL)
errx (-1, "unexpected memory problems");
adcli_entry_set_domain_ou (entry, ou);
adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_USER_ACCOUNT);
res = adcli_conn_connect (conn);
if (res != ADCLI_SUCCESS) {
errx (-res, "couldn't connect to %s domain: %s",
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
if (has_unix_attr && !has_nis_domain) {
res = adcli_get_nis_domain (entry, attrs);
if (res != ADCLI_SUCCESS) {
adcli_entry_unref (entry);
adcli_attrs_free (attrs);
errx (-res, "couldn't get NIS domain");
}
}
res = adcli_entry_create (entry, attrs);
if (res != ADCLI_SUCCESS) {
errx (-res, "creating user %s in domain %s failed: %s",
adcli_entry_get_sam_name (entry),
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
adcli_entry_unref (entry);
adcli_attrs_free (attrs);
return 0;
}
int
adcli_tool_user_delete (adcli_conn *conn,
int argc,
char *argv[])
{
adcli_result res;
adcli_entry *entry;
int opt;
struct option options[] = {
{ "domain", required_argument, NULL, opt_domain },
{ "domain-realm", required_argument, NULL, opt_domain_realm },
{ "domain-controller", required_argument, NULL, opt_domain_controller },
{ "login-user", required_argument, NULL, opt_login_user },
{ "login-ccache", optional_argument, NULL, opt_login_ccache },
{ "no-password", no_argument, 0, opt_no_password },
{ "stdin-password", no_argument, 0, opt_stdin_password },
{ "prompt-password", no_argument, 0, opt_prompt_password },
{ "verbose", no_argument, NULL, opt_verbose },
{ "help", no_argument, NULL, 'h' },
{ 0 },
};
static adcli_tool_desc usages[] = {
{ 0, "usage: adcli delete-user --domain=xxxx user" },
{ 0 },
};
while ((opt = adcli_tool_getopt (argc, argv, options)) != -1) {
switch (opt) {
case 'h':
case '?':
case ':':
adcli_tool_usage (options, usages);
adcli_tool_usage (options, common_usages);
return opt == 'h' ? 0 : 2;
default:
parse_option ((Option)opt, optarg, conn);
break;
}
}
argc -= optind;
argv += optind;
if (argc != 1)
errx (2, "specify one user name to delete");
entry = adcli_entry_new_user (conn, argv[0]);
if (entry == NULL)
errx (-1, "unexpected memory problems");
adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_USER_ACCOUNT);
res = adcli_conn_connect (conn);
if (res != ADCLI_SUCCESS) {
errx (-res, "couldn't connect to %s domain: %s",
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
res = adcli_entry_delete (entry);
if (res != ADCLI_SUCCESS) {
errx (-res, "deleting user %s in domain %s failed: %s",
adcli_entry_get_sam_name (entry),
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
adcli_entry_unref (entry);
return 0;
}
int
adcli_tool_group_create (adcli_conn *conn,
int argc,
char *argv[])
{
adcli_entry *entry;
adcli_result res;
adcli_attrs *attrs;
const char *ou = NULL;
int opt;
struct option options[] = {
{ "description", required_argument, NULL, opt_description },
{ "domain", required_argument, NULL, opt_domain },
{ "domain-realm", required_argument, NULL, opt_domain_realm },
{ "domain-controller", required_argument, NULL, opt_domain_controller },
{ "domain-ou", required_argument, NULL, opt_domain_ou },
{ "login-user", required_argument, NULL, opt_login_user },
{ "login-ccache", optional_argument, NULL, opt_login_ccache },
{ "no-password", no_argument, 0, opt_no_password },
{ "stdin-password", no_argument, 0, opt_stdin_password },
{ "prompt-password", no_argument, 0, opt_prompt_password },
{ "verbose", no_argument, NULL, opt_verbose },
{ "help", no_argument, NULL, 'h' },
{ 0 },
};
static adcli_tool_desc usages[] = {
{ 0, "usage: adcli create-group --domain=xxxx group" },
{ 0 },
};
attrs = adcli_attrs_new ();
while ((opt = adcli_tool_getopt (argc, argv, options)) != -1) {
switch (opt) {
case opt_description:
adcli_attrs_add (attrs, "description", optarg, NULL);
break;
case opt_domain_ou:
ou = optarg;
break;
case 'h':
case '?':
case ':':
adcli_tool_usage (options, usages);
adcli_tool_usage (options, common_usages);
adcli_attrs_free (attrs);
return opt == 'h' ? 0 : 2;
default:
parse_option ((Option)opt, optarg, conn);
break;
}
}
argc -= optind;
argv += optind;
if (argc != 1)
errx (2, "specify one group to create");
entry = adcli_entry_new_group (conn, argv[0]);
if (entry == NULL)
errx (-1, "unexpected memory problems");
adcli_entry_set_domain_ou (entry, ou);
adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_USER_ACCOUNT);
res = adcli_conn_connect (conn);
if (res != ADCLI_SUCCESS) {
errx (-res, "couldn't connect to domain %s: %s",
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
res = adcli_entry_create (entry, attrs);
if (res != ADCLI_SUCCESS) {
errx (-res, "creating group %s in domain %s failed: %s",
adcli_entry_get_sam_name (entry),
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
adcli_entry_unref (entry);
adcli_attrs_free (attrs);
return 0;
}
int
adcli_tool_group_delete (adcli_conn *conn,
int argc,
char *argv[])
{
adcli_result res;
adcli_entry *entry;
int opt;
struct option options[] = {
{ "domain", required_argument, NULL, opt_domain },
{ "domain-realm", required_argument, NULL, opt_domain_realm },
{ "domain-controller", required_argument, NULL, opt_domain_controller },
{ "login-user", required_argument, NULL, opt_login_user },
{ "login-ccache", optional_argument, NULL, opt_login_ccache },
{ "no-password", no_argument, 0, opt_no_password },
{ "stdin-password", no_argument, 0, opt_stdin_password },
{ "prompt-password", no_argument, 0, opt_prompt_password },
{ "verbose", no_argument, NULL, opt_verbose },
{ "help", no_argument, NULL, 'h' },
{ 0 },
};
static adcli_tool_desc usages[] = {
{ 0, "usage: adcli delete-group --domain=xxxx group" },
{ 0 },
};
while ((opt = adcli_tool_getopt (argc, argv, options)) != -1) {
switch (opt) {
case 'h':
case '?':
case ':':
adcli_tool_usage (options, usages);
adcli_tool_usage (options, common_usages);
return opt == 'h' ? 0 : 2;
default:
parse_option ((Option)opt, optarg, conn);
break;
}
}
argc -= optind;
argv += optind;
if (argc != 1)
errx (2, "specify one group name to delete");
entry = adcli_entry_new_group (conn, argv[0]);
if (entry == NULL)
errx (-1, "unexpected memory problems");
adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_USER_ACCOUNT);
res = adcli_conn_connect (conn);
if (res != ADCLI_SUCCESS) {
errx (-res, "couldn't connect to %s domain: %s",
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
res = adcli_entry_delete (entry);
if (res != ADCLI_SUCCESS) {
errx (-res, "deleting group %s in domain %s failed: %s",
adcli_entry_get_sam_name (entry),
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
adcli_entry_unref (entry);
return 0;
}
static void
expand_user_dn_as_member (adcli_conn *conn,
adcli_attrs *attrs,
const char *user,
int adding)
{
adcli_entry *entry;
adcli_result res;
const char *dn;
entry = adcli_entry_new_user (conn, user);
res = adcli_entry_load (entry);
if (res != ADCLI_SUCCESS) {
errx (-res, "couldn't lookup user %s in domain %s: %s",
user, adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
dn = adcli_entry_get_dn (entry);
if (dn == NULL) {
errx (-ADCLI_ERR_CONFIG,
"couldn't found user %s in domain %s",
user, adcli_conn_get_domain_name (conn));
}
if (adding)
adcli_attrs_add1 (attrs, "member", dn);
else
adcli_attrs_delete1 (attrs, "member", dn);
adcli_entry_unref (entry);
}
int
adcli_tool_member_add (adcli_conn *conn,
int argc,
char *argv[])
{
adcli_result res;
adcli_entry *entry;
adcli_attrs *attrs;
int opt;
int i;
struct option options[] = {
{ "domain", required_argument, NULL, opt_domain },
{ "domain-realm", required_argument, NULL, opt_domain_realm },
{ "domain-controller", required_argument, NULL, opt_domain_controller },
{ "login-user", required_argument, NULL, opt_login_user },
{ "login-ccache", optional_argument, NULL, opt_login_ccache },
{ "no-password", no_argument, 0, opt_no_password },
{ "stdin-password", no_argument, 0, opt_stdin_password },
{ "prompt-password", no_argument, 0, opt_prompt_password },
{ "verbose", no_argument, NULL, opt_verbose },
{ "help", no_argument, NULL, 'h' },
{ 0 },
};
static adcli_tool_desc usages[] = {
{ 0, "usage: adcli add-member --domain=xxxx group user ..." },
{ 0 },
};
while ((opt = adcli_tool_getopt (argc, argv, options)) != -1) {
switch (opt) {
case 'h':
case '?':
case ':':
adcli_tool_usage (options, usages);
adcli_tool_usage (options, common_usages);
return opt == 'h' ? 0 : 2;
default:
parse_option ((Option)opt, optarg, conn);
break;
}
}
argc -= optind;
argv += optind;
if (argc < 2)
errx (2, "specify a group name and a user to add");
entry = adcli_entry_new_group (conn, argv[0]);
if (entry == NULL)
errx (-1, "unexpected memory problems");
adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_USER_ACCOUNT);
res = adcli_conn_connect (conn);
if (res != ADCLI_SUCCESS) {
errx (-res, "couldn't connect to %s domain: %s",
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
attrs = adcli_attrs_new ();
for (i = 1; i < argc; i++)
expand_user_dn_as_member (conn, attrs, argv[i], 1);
res = adcli_entry_modify (entry, attrs);
if (res != ADCLI_SUCCESS) {
errx (-res, "adding member(s) to group %s in domain %s failed: %s",
adcli_entry_get_sam_name (entry),
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
adcli_attrs_free (attrs);
adcli_entry_unref (entry);
return 0;
}
int
adcli_tool_member_remove (adcli_conn *conn,
int argc,
char *argv[])
{
adcli_result res;
adcli_entry *entry;
adcli_attrs *attrs;
int opt;
int i;
struct option options[] = {
{ "domain", required_argument, NULL, opt_domain },
{ "domain-realm", required_argument, NULL, opt_domain_realm },
{ "domain-controller", required_argument, NULL, opt_domain_controller },
{ "login-user", required_argument, NULL, opt_login_user },
{ "login-ccache", optional_argument, NULL, opt_login_ccache },
{ "no-password", no_argument, 0, opt_no_password },
{ "stdin-password", no_argument, 0, opt_stdin_password },
{ "prompt-password", no_argument, 0, opt_prompt_password },
{ "verbose", no_argument, NULL, opt_verbose },
{ "help", no_argument, NULL, 'h' },
{ 0 },
};
static adcli_tool_desc usages[] = {
{ 0, "usage: adcli remove-member --domain=xxxx group user ..." },
{ 0 },
};
while ((opt = adcli_tool_getopt (argc, argv, options)) != -1) {
switch (opt) {
case 'h':
case '?':
case ':':
adcli_tool_usage (options, usages);
adcli_tool_usage (options, common_usages);
return opt == 'h' ? 0 : 2;
default:
parse_option ((Option)opt, optarg, conn);
break;
}
}
argc -= optind;
argv += optind;
if (argc < 2)
errx (2, "specify a group name and a user to remove");
entry = adcli_entry_new_group (conn, argv[0]);
if (entry == NULL)
errx (-1, "unexpected memory problems");
adcli_conn_set_allowed_login_types (conn, ADCLI_LOGIN_USER_ACCOUNT);
res = adcli_conn_connect (conn);
if (res != ADCLI_SUCCESS) {
errx (-res, "couldn't connect to %s domain: %s",
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
attrs = adcli_attrs_new ();
for (i = 1; i < argc; i++)
expand_user_dn_as_member (conn, attrs, argv[i], 0);
res = adcli_entry_modify (entry, attrs);
if (res != ADCLI_SUCCESS) {
errx (-res, "adding member(s) to group %s in domain %s failed: %s",
adcli_entry_get_sam_name (entry),
adcli_conn_get_domain_name (conn),
adcli_get_last_error ());
}
adcli_attrs_free (attrs);
adcli_entry_unref (entry);
return 0;
}