citadel/ldap.c

   1 // These functions implement the portions of AUTHMODE_LDAP and AUTHMODE_LDAP_AD which
   2 // actually speak to the LDAP server.
   3 //
   4 // Copyright (c) 2011-2022 by the citadel.org development team.
   5 //
   6 // This program is open source software; you can redistribute it and/or modify
   7 // it under the terms of the GNU General Public License, version 3.
   8 //
   9 // This program is distributed in the hope that it will be useful,
  10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 // GNU General Public License for more details.
  13
  14 int ctdl_require_ldap_version = 3;
  15
  16 #define _GNU_SOURCE             // Needed to suppress warning about vasprintf() when running on Linux/Linux
  17 #include <stdio.h>
  18 #include <libcitadel.h>
  19 #include "citserver.h"
  20 #include "citadel_ldap.h"
  21 #include "ctdl_module.h"
  22 #include "user_ops.h"
  23 #include "internet_addressing.h"
  24 #include "config.h"
  25 #include <ldap.h>
  26
  27
  28 // Utility function, supply a search result and get back the fullname (display name, common name, etc) from the first result
  29 void derive_fullname_from_ldap_result(char *fullname, int fullname_size, LDAP *ldserver, LDAPMessage *search_result) {
  30         struct berval **values;
  31
  32         if (fullname == NULL) return;
  33         if (search_result == NULL) return;
  34         if (ldserver == NULL) return;
  35
  36         if (CtdlGetConfigInt("c_auth_mode") == AUTHMODE_LDAP_AD) {
  37                 values = ldap_get_values_len(ldserver, search_result, "displayName");
  38                 if (values) {
  39                         if (ldap_count_values_len(values) > 0) {
  40                                 safestrncpy(fullname, values[0]->bv_val, fullname_size);
  41                                 syslog(LOG_DEBUG, "ldap: displayName = %s", fullname);
  42                         }
  43                         ldap_value_free_len(values);
  44                 }
  45         }
  46         else {
  47                 values = ldap_get_values_len(ldserver, search_result, "cn");
  48                 if (values) {
  49                         if (ldap_count_values_len(values) > 0) {
  50                                 safestrncpy(fullname, values[0]->bv_val, fullname_size);
  51                                 syslog(LOG_DEBUG, "ldap: cn = %s", fullname);
  52                         }
  53                         ldap_value_free_len(values);
  54                 }
  55         }
  56 }
  57
  58
  59 // Utility function, supply a search result and get back the uid from the first result
  60 uid_t derive_uid_from_ldap(LDAP *ldserver, LDAPMessage *entry) {
  61         struct berval **values;
  62         uid_t uid = (-1);
  63
  64         if (CtdlGetConfigInt("c_auth_mode") == AUTHMODE_LDAP_AD) {
  65                 values = ldap_get_values_len(ldserver, entry, "objectGUID");    // AD schema: uid hashed from objectGUID
  66                 if (values) {
  67                         if (ldap_count_values_len(values) > 0) {
  68                                 uid = abs(HashLittle(values[0]->bv_val, values[0]->bv_len));
  69                         }
  70                         ldap_value_free_len(values);
  71                 }
  72         }
  73         else {
  74                 values = ldap_get_values_len(ldserver, entry, "uidNumber");             // POSIX schema: uid = uidNumber
  75                 if (values) {
  76                         if (ldap_count_values_len(values) > 0) {
  77                                 uid = atoi(values[0]->bv_val);
  78                         }
  79                         ldap_value_free_len(values);
  80                 }
  81         }
  82
  83         syslog(LOG_DEBUG, "ldap: uid = %d", uid);
  84         return(uid);
  85 }
  86
  87
  88 // Wrapper function for ldap_initialize() that consistently fills in the correct fields
  89 int ctdl_ldap_initialize(LDAP **ld) {
  90
  91         char server_url[256];
  92         int ret;
  93
  94         snprintf(server_url, sizeof server_url, "ldap://%s:%d", CtdlGetConfigStr("c_ldap_host"), CtdlGetConfigInt("c_ldap_port"));
  95         ret = ldap_initialize(ld, server_url);
  96         if (ret != LDAP_SUCCESS) {
  97                 syslog(LOG_ERR, "ldap: could not connect to %s : %m", server_url);
  98                 *ld = NULL;
  99                 return(errno);
 100         }
 101
 102         return(ret);
 103 }
 104
 105
 106 // Bind to the LDAP server and return a working handle
 107 LDAP *ctdl_ldap_bind(void) {
 108         LDAP *ldserver = NULL;
 109         int i;
 110
 111         if (ctdl_ldap_initialize(&ldserver) != LDAP_SUCCESS) {
 112                 return(NULL);
 113         }
 114
 115         ldap_set_option(ldserver, LDAP_OPT_PROTOCOL_VERSION, &ctdl_require_ldap_version);
 116         ldap_set_option(ldserver, LDAP_OPT_REFERRALS, (void *)LDAP_OPT_OFF);
 117
 118         striplt(CtdlGetConfigStr("c_ldap_bind_dn"));
 119         striplt(CtdlGetConfigStr("c_ldap_bind_pw"));
 120         i = ldap_simple_bind_s(ldserver,
 121                 (!IsEmptyStr(CtdlGetConfigStr("c_ldap_bind_dn")) ? CtdlGetConfigStr("c_ldap_bind_dn") : NULL),
 122                 (!IsEmptyStr(CtdlGetConfigStr("c_ldap_bind_pw")) ? CtdlGetConfigStr("c_ldap_bind_pw") : NULL)
 123         );
 124         if (i != LDAP_SUCCESS) {
 125                 syslog(LOG_ERR, "ldap: Cannot bind: %s (%d)", ldap_err2string(i), i);
 126                 return(NULL);
 127         }
 128
 129         return(ldserver);
 130 }
 131
 132
 133 // Look up a user in the directory to see if this is an account that can be authenticated
 134 int CtdlTryUserLDAP(char *username, char *found_dn, int found_dn_size, char *fullname, int fullname_size, uid_t *uid) {
 135         LDAP *ldserver = NULL;
 136         LDAPMessage *search_result = NULL;
 137         LDAPMessage *entry = NULL;
 138         char searchstring[1024];
 139         struct timeval tv;
 140         char *user_dn = NULL;
 141
 142         ldserver = ctdl_ldap_bind();
 143         if (!ldserver) return(-1);
 144
 145         if (fullname) safestrncpy(fullname, username, fullname_size);
 146         tv.tv_sec = 10;
 147         tv.tv_usec = 0;
 148
 149         if (CtdlGetConfigInt("c_auth_mode") == AUTHMODE_LDAP_AD) {
 150                 snprintf(searchstring, sizeof(searchstring), "(sAMAccountName=%s)", username);
 151         }
 152         else {
 153                 snprintf(searchstring, sizeof(searchstring), "(&(objectclass=posixAccount)(cn=%s))", username);
 154                 // snprintf(searchstring, sizeof(searchstring), "(&(objectclass=posixAccount)(uid=%s))", username);
 155         }
 156
 157         syslog(LOG_DEBUG, "ldap: search: %s", searchstring);
 158         syslog(LOG_DEBUG, "ldap: search results: %s", ldap_err2string(ldap_search_ext_s(
 159                 ldserver,                                       // ld
 160                 CtdlGetConfigStr("c_ldap_base_dn"),             // base
 161                 LDAP_SCOPE_SUBTREE,                             // scope
 162                 searchstring,                                   // filter
 163                 NULL,                                           // attrs (all attributes)
 164                 0,                                              // attrsonly (attrs + values)
 165                 NULL,                                           // serverctrls (none)
 166                 NULL,                                           // clientctrls (none)
 167                 &tv,                                            // timeout
 168                 1,                                              // sizelimit (1 result max)
 169                 &search_result                                  // res
 170         )));
 171
 172         // Ignore the return value of ldap_search_ext_s().  Sometimes it returns an error even when
 173         // the search succeeds.  Instead, we check to see whether search_result is still NULL.
 174         if (search_result == NULL) {
 175                 syslog(LOG_DEBUG, "ldap: zero search results were returned");
 176                 ldap_unbind(ldserver);
 177                 return(2);
 178         }
 179
 180         // At this point we've got at least one result from our query.  If there are multiple
 181         // results, we still only look at the first one.
 182         entry = ldap_first_entry(ldserver, search_result);
 183         if (entry) {
 184
 185                 user_dn = ldap_get_dn(ldserver, entry);
 186                 if (user_dn) {
 187                         syslog(LOG_DEBUG, "ldap: dn = %s", user_dn);
 188                 }
 189
 190                 derive_fullname_from_ldap_result(fullname, fullname_size, ldserver, search_result);
 191                 *uid = derive_uid_from_ldap(ldserver, search_result);
 192         }
 193
 194         // free the results
 195         ldap_msgfree(search_result);
 196
 197         // unbind so we can go back in as the authenticating user
 198         ldap_unbind(ldserver);
 199
 200         if (!user_dn) {
 201                 syslog(LOG_DEBUG, "ldap: No such user was found.");
 202                 return(4);
 203         }
 204
 205         if (found_dn) safestrncpy(found_dn, user_dn, found_dn_size);
 206         ldap_memfree(user_dn);
 207         return(0);
 208 }
 209
 210
 211 int CtdlTryPasswordLDAP(char *user_dn, const char *password) {
 212         LDAP *ldserver = NULL;
 213         int i = (-1);
 214
 215         if (IsEmptyStr(password)) {
 216                 syslog(LOG_DEBUG, "ldap: empty passwords are not permitted");
 217                 return(1);
 218         }
 219
 220         syslog(LOG_DEBUG, "ldap: trying to bind as %s", user_dn);
 221         i = ctdl_ldap_initialize(&ldserver);
 222         if (i == LDAP_SUCCESS) {
 223                 ldap_set_option(ldserver, LDAP_OPT_PROTOCOL_VERSION, &ctdl_require_ldap_version);
 224                 i = ldap_simple_bind_s(ldserver, user_dn, password);
 225                 if (i == LDAP_SUCCESS) {
 226                         syslog(LOG_DEBUG, "ldap: bind succeeded");
 227                 }
 228                 else {
 229                         syslog(LOG_DEBUG, "ldap: Cannot bind: %s (%d)", ldap_err2string(i), i);
 230                 }
 231                 ldap_set_option(ldserver, LDAP_OPT_REFERRALS, (void *)LDAP_OPT_OFF);
 232                 ldap_unbind(ldserver);
 233         }
 234
 235         if (i == LDAP_SUCCESS) {
 236                 return(0);
 237         }
 238
 239         return(1);
 240 }
 241
 242
 243 // set multiple properties
 244 // returns nonzero only if property changed.
 245 int vcard_set_props_iff_different(struct vCard *v, char *propname, int numvals, char **vals) {
 246         int i;
 247         char *oldval = "";
 248         for (i=0; i<numvals; i++) {
 249                 oldval = vcard_get_prop(v, propname, 0, i, 0);
 250                 if (oldval == NULL) break;
 251                 if (strcmp(vals[i],oldval)) break;
 252         }
 253         if (i != numvals) {
 254                 syslog(LOG_DEBUG, "ldap: vcard property %s, element %d of %d changed from %s to %s", propname, i, numvals, oldval, vals[i]);
 255                 for (i=0; i<numvals; i++) {
 256                         vcard_set_prop(v,propname,vals[i],(i==0) ? 0 : 1);
 257                 }
 258                 return 1;
 259         }
 260         return 0;
 261 }
 262
 263
 264 // set one property
 265 // returns nonzero only if property changed.
 266 int vcard_set_one_prop_iff_different(struct vCard *v,char *propname, char *newfmt, ...) {
 267         va_list args;
 268         char *newvalue;
 269         int did_change = 0;
 270         va_start(args,newfmt);
 271         if (vasprintf(&newvalue, newfmt, args) < 0) {
 272                 syslog(LOG_ERR, "ldap: out of memory");
 273                 return 0;
 274         }
 275         did_change = vcard_set_props_iff_different(v, propname, 1, &newvalue);
 276         va_end(args);
 277         free(newvalue);
 278         return did_change;
 279 }
 280
 281
 282 // Learn LDAP attributes and stuff them into the vCard.
 283 // Returns nonzero if we changed anything.
 284 int Ctdl_LDAP_to_vCard(char *ldap_dn, struct vCard *v) {
 285         int changed_something = 0;
 286         LDAP *ldserver = NULL;
 287         struct timeval tv;
 288         LDAPMessage *search_result = NULL;
 289         LDAPMessage *entry = NULL;
 290         struct berval **givenName;
 291         struct berval **sn;
 292         struct berval **cn;
 293         struct berval **initials;
 294         struct berval **o;
 295         struct berval **street;
 296         struct berval **l;
 297         struct berval **st;
 298         struct berval **postalCode;
 299         struct berval **telephoneNumber;
 300         struct berval **mobile;
 301         struct berval **homePhone;
 302         struct berval **facsimileTelephoneNumber;
 303         struct berval **mail;
 304         struct berval **uid;
 305         struct berval **homeDirectory;
 306         struct berval **uidNumber;
 307         struct berval **loginShell;
 308         struct berval **gidNumber;
 309         struct berval **c;
 310         struct berval **title;
 311         struct berval **uuid;
 312         char *attrs[] = { "*","+",NULL};
 313
 314         if (!ldap_dn) return(0);
 315         if (!v) return(0);
 316
 317         ldserver = ctdl_ldap_bind();
 318         if (!ldserver) return(-1);
 319
 320         tv.tv_sec = 10;
 321         tv.tv_usec = 0;
 322
 323         syslog(LOG_DEBUG, "ldap: search: %s", ldap_dn);
 324         syslog(LOG_DEBUG, "ldap: search results: %s", ldap_err2string(ldap_search_ext_s(
 325                 ldserver,                               // ld
 326                 ldap_dn,                                // base
 327                 LDAP_SCOPE_SUBTREE,                     // scope
 328                 NULL,                                   // filter
 329                 attrs,                                  // attrs (all attributes)
 330                 0,                                      // attrsonly (attrs + values)
 331                 NULL,                                   // serverctrls (none)
 332                 NULL,                                   // clientctrls (none)
 333                 &tv,                                    // timeout
 334                 1,                                      // sizelimit (1 result max)
 335                 &search_result                          // res
 336         )));
 337
 338         // Ignore the return value of ldap_search_ext_s().  Sometimes it returns an error even when
 339         // the search succeeds.  Instead, we check to see whether search_result is still NULL.
 340         if (search_result == NULL) {
 341                 syslog(LOG_DEBUG, "ldap: zero search results were returned");
 342                 ldap_unbind(ldserver);
 343                 return(0);
 344         }
 345
 346         // At this point we've got at least one result from our query.  If there are multiple
 347         // results, we still only look at the first one.
 348         entry = ldap_first_entry(ldserver, search_result);
 349         if (entry) {
 350                 syslog(LOG_DEBUG, "ldap: search got user details for vcard.");
 351                 givenName                       = ldap_get_values_len(ldserver, search_result, "givenName");
 352                 sn                              = ldap_get_values_len(ldserver, search_result, "sn");
 353                 cn                              = ldap_get_values_len(ldserver, search_result, "cn");
 354                 initials                        = ldap_get_values_len(ldserver, search_result, "initials");
 355                 title                           = ldap_get_values_len(ldserver, search_result, "title");
 356                 o                               = ldap_get_values_len(ldserver, search_result, "o");
 357                 street                          = ldap_get_values_len(ldserver, search_result, "street");
 358                 l                               = ldap_get_values_len(ldserver, search_result, "l");
 359                 st                              = ldap_get_values_len(ldserver, search_result, "st");
 360                 postalCode                      = ldap_get_values_len(ldserver, search_result, "postalCode");
 361                 telephoneNumber                 = ldap_get_values_len(ldserver, search_result, "telephoneNumber");
 362                 mobile                          = ldap_get_values_len(ldserver, search_result, "mobile");
 363                 homePhone                       = ldap_get_values_len(ldserver, search_result, "homePhone");
 364                 facsimileTelephoneNumber        = ldap_get_values_len(ldserver, search_result, "facsimileTelephoneNumber");
 365                 mail                            = ldap_get_values_len(ldserver, search_result, "mail");
 366                 uid                             = ldap_get_values_len(ldserver, search_result, "uid");
 367                 homeDirectory                   = ldap_get_values_len(ldserver, search_result, "homeDirectory");
 368                 uidNumber                       = ldap_get_values_len(ldserver, search_result, "uidNumber");
 369                 loginShell                      = ldap_get_values_len(ldserver, search_result, "loginShell");
 370                 gidNumber                       = ldap_get_values_len(ldserver, search_result, "gidNumber");
 371                 c                               = ldap_get_values_len(ldserver, search_result, "c");
 372                 uuid                            = ldap_get_values_len(ldserver, search_result, "entryUUID");
 373
 374                 if (street && l && st && postalCode && c) changed_something |= vcard_set_one_prop_iff_different(v,"adr",";;%s;%s;%s;%s;%s",street[0]->bv_val,l[0]->bv_val,st[0]->bv_val,postalCode[0]->bv_val,c[0]->bv_val);
 375                 if (telephoneNumber) changed_something |= vcard_set_one_prop_iff_different(v,"tel;work","%s",telephoneNumber[0]->bv_val);
 376                 if (facsimileTelephoneNumber) changed_something |= vcard_set_one_prop_iff_different(v,"tel;fax","%s",facsimileTelephoneNumber[0]->bv_val);
 377                 if (mobile) changed_something |= vcard_set_one_prop_iff_different(v,"tel;cell","%s",mobile[0]->bv_val);
 378                 if (homePhone) changed_something |= vcard_set_one_prop_iff_different(v,"tel;home","%s",homePhone[0]->bv_val);
 379                 if (givenName && sn) {
 380                         if (initials) {
 381                                 changed_something |= vcard_set_one_prop_iff_different(v,"n","%s;%s;%s",sn[0]->bv_val,givenName[0]->bv_val,initials[0]->bv_val);
 382                         }
 383                         else {
 384                                 changed_something |= vcard_set_one_prop_iff_different(v,"n","%s;%s",sn[0]->bv_val,givenName[0]->bv_val);
 385                         }
 386                 }
 387
 388                 // FIXME we need a new way to do this.
 389                 //if (mail) {
 390                         //changed_something |= vcard_set_props_iff_different(v,"email;internet",ldap_count_values_len(mail),mail);
 391                 //}
 392
 393                 if (uuid) changed_something |= vcard_set_one_prop_iff_different(v,"X-uuid","%s",uuid[0]->bv_val);
 394                 if (o) changed_something |= vcard_set_one_prop_iff_different(v,"org","%s",o[0]->bv_val);
 395                 if (cn) changed_something |= vcard_set_one_prop_iff_different(v,"fn","%s",cn[0]->bv_val);
 396                 if (title) changed_something |= vcard_set_one_prop_iff_different(v,"title","%s",title[0]->bv_val);
 397
 398                 if (givenName)                  ldap_value_free_len(givenName);
 399                 if (initials)                   ldap_value_free_len(initials);
 400                 if (sn)                         ldap_value_free_len(sn);
 401                 if (cn)                         ldap_value_free_len(cn);
 402                 if (o)                          ldap_value_free_len(o);
 403                 if (street)                     ldap_value_free_len(street);
 404                 if (l)                          ldap_value_free_len(l);
 405                 if (st)                         ldap_value_free_len(st);
 406                 if (postalCode)                 ldap_value_free_len(postalCode);
 407                 if (telephoneNumber)            ldap_value_free_len(telephoneNumber);
 408                 if (mobile)                     ldap_value_free_len(mobile);
 409                 if (homePhone)                  ldap_value_free_len(homePhone);
 410                 if (facsimileTelephoneNumber)   ldap_value_free_len(facsimileTelephoneNumber);
 411                 if (mail)                       ldap_value_free_len(mail);
 412                 if (uid)                        ldap_value_free_len(uid);
 413                 if (homeDirectory)              ldap_value_free_len(homeDirectory);
 414                 if (uidNumber)                  ldap_value_free_len(uidNumber);
 415                 if (loginShell)                 ldap_value_free_len(loginShell);
 416                 if (gidNumber)                  ldap_value_free_len(gidNumber);
 417                 if (c)                          ldap_value_free_len(c);
 418                 if (title)                      ldap_value_free_len(title);
 419                 if (uuid)                       ldap_value_free_len(uuid);
 420         }
 421         // free the results
 422         ldap_msgfree(search_result);
 423
 424         // unbind so we can go back in as the authenticating user
 425         ldap_unbind(ldserver);
 426         return(changed_something);      // tell the caller whether we made any changes
 427 }
 428
 429
 430 // Extract a user's Internet email addresses from LDAP.
 431 // Returns zero if we got a valid set of addresses; nonzero for error.
 432 int extract_email_addresses_from_ldap(char *ldap_dn, char *emailaddrs) {
 433         LDAP *ldserver = NULL;
 434         struct timeval tv;
 435         LDAPMessage *search_result = NULL;
 436         LDAPMessage *entry = NULL;
 437         struct berval **mail;
 438         char *attrs[] = { "*","+",NULL };
 439
 440         if (!ldap_dn) return(1);
 441         if (!emailaddrs) return(1);
 442
 443         ldserver = ctdl_ldap_bind();
 444         if (!ldserver) return(-1);
 445
 446         tv.tv_sec = 10;
 447         tv.tv_usec = 0;
 448
 449         syslog(LOG_DEBUG, "ldap: search: %s", ldap_dn);
 450         syslog(LOG_DEBUG, "ldap: search results: %s", ldap_err2string(ldap_search_ext_s(
 451                 ldserver,                               // ld
 452                 ldap_dn,                                // base
 453                 LDAP_SCOPE_SUBTREE,                     // scope
 454                 NULL,                                   // filter
 455                 attrs,                                  // attrs (all attributes)
 456                 0,                                      // attrsonly (attrs + values)
 457                 NULL,                                   // serverctrls (none)
 458                 NULL,                                   // clientctrls (none)
 459                 &tv,                                    // timeout
 460                 1,                                      // sizelimit (1 result max)
 461                 &search_result                          // res
 462         )));
 463
 464         // Ignore the return value of ldap_search_ext_s().  Sometimes it returns an error even when
 465         // the search succeeds.  Instead, we check to see whether search_result is still NULL.
 466         if (search_result == NULL) {
 467                 syslog(LOG_DEBUG, "ldap: zero search results were returned");
 468                 ldap_unbind(ldserver);
 469                 return(4);
 470         }
 471
 472         // At this point we've got at least one result from our query.
 473         // If there are multiple results, we still only look at the first one.
 474         emailaddrs[0] = 0;                                                              // clear out any previous results
 475         entry = ldap_first_entry(ldserver, search_result);
 476         if (entry) {
 477                 syslog(LOG_DEBUG, "ldap: search got user details");
 478                 mail = ldap_get_values_len(ldserver, search_result, "mail");
 479                 if (mail) {
 480                         int q;
 481                         for (q=0; q<ldap_count_values_len(mail); ++q) {
 482                                 if (IsDirectory(mail[q]->bv_val, 0)) {
 483                                         if ((strlen(emailaddrs) + mail[q]->bv_len + 2) > 512) {
 484                                                 syslog(LOG_ERR, "ldap: can't fit all email addresses into user record");
 485                                         }
 486                                         else {
 487                                                 if (!IsEmptyStr(emailaddrs)) {
 488                                                         strcat(emailaddrs, "|");
 489                                                 }
 490                                                 strcat(emailaddrs, mail[q]->bv_val);
 491                                         }
 492                                 }
 493                         }
 494                 }
 495         }
 496
 497         // free the results
 498         ldap_msgfree(search_result);
 499
 500         // unbind so we can go back in as the authenticating user
 501         ldap_unbind(ldserver);
 502         return(0);
 503 }
 504
 505
 506 // Scan LDAP for users and populate Citadel's user database with everyone
 507 void CtdlSynchronizeUsersFromLDAP(void) {
 508         LDAP *ldserver = NULL;
 509         LDAPMessage *search_result = NULL;
 510         LDAPMessage *entry = NULL;
 511         char *user_dn = NULL;
 512         char searchstring[1024];
 513         struct timeval tv;
 514
 515         if ((CtdlGetConfigInt("c_auth_mode") != AUTHMODE_LDAP) && (CtdlGetConfigInt("c_auth_mode") != AUTHMODE_LDAP_AD)) {
 516                 return;                                         // not running LDAP
 517         }
 518
 519         syslog(LOG_INFO, "ldap: synchronizing Citadel user database from LDAP");
 520
 521         ldserver = ctdl_ldap_bind();
 522         if (!ldserver) return;
 523
 524         tv.tv_sec = 10;
 525         tv.tv_usec = 0;
 526
 527         if (CtdlGetConfigInt("c_auth_mode") == AUTHMODE_LDAP_AD) {
 528                         snprintf(searchstring, sizeof(searchstring), "(&(objectClass=user)(objectClass=person)(!(objectClass=computer)))");
 529         }
 530         else {
 531                         snprintf(searchstring, sizeof(searchstring), "(objectClass=inetOrgPerson)");
 532         }
 533
 534         syslog(LOG_DEBUG, "ldap: search: %s", searchstring);
 535         syslog(LOG_DEBUG, "ldap: search results: %s", ldap_err2string(ldap_search_ext_s(
 536                 ldserver,                                       // ld
 537                 CtdlGetConfigStr("c_ldap_base_dn"),             // base
 538                 LDAP_SCOPE_SUBTREE,                             // scope
 539                 searchstring,                                   // filter
 540                 NULL,                                           // attrs (all attributes)
 541                 0,                                              // attrsonly (attrs + values)
 542                 NULL,                                           // serverctrls (none)
 543                 NULL,                                           // clientctrls (none)
 544                 &tv,                                            // timeout
 545                 INT_MAX,                                        // sizelimit (max)
 546                 &search_result                                  // result
 547         )));
 548
 549         // Ignore the return value of ldap_search_ext_s().  Sometimes it returns an error even when
 550         // the search succeeds.  Instead, we check to see whether search_result is still NULL.
 551         if (search_result == NULL) {
 552                 syslog(LOG_DEBUG, "ldap: zero search results were returned");
 553                 ldap_unbind(ldserver);
 554                 return;
 555         }
 556
 557         syslog(LOG_DEBUG, "ldap: %d entries returned", ldap_count_entries(ldserver, search_result));
 558         for (entry=ldap_first_entry(ldserver, search_result); entry!=NULL; entry=ldap_next_entry(ldserver, entry)) {
 559                 TRACE;
 560                 user_dn = ldap_get_dn(ldserver, entry);
 561                 if (user_dn) {
 562                         syslog(LOG_DEBUG, "ldap: found %s", user_dn);
 563
 564                         int fullname_size = 256;
 565                         char fullname[256] = { 0 } ;
 566                         uid_t uid = (-1);
 567                         char new_emailaddrs[512] = { 0 } ;
 568
 569                         uid = derive_uid_from_ldap(ldserver, entry);
 570                         derive_fullname_from_ldap_result(fullname, fullname_size, ldserver, entry);
 571                         syslog(LOG_DEBUG, "ldap: display name: <%s> , uid = <%d>", fullname, uid);
 572
 573                         // now create or update the user
 574                         int found_user;
 575                         struct ctdluser usbuf;
 576
 577                         found_user = getuserbyuid(&usbuf, uid);
 578                         if (found_user != 0) {
 579                                 create_user(fullname, CREATE_USER_DO_NOT_BECOME_USER, uid);
 580                                 found_user = getuserbyuid(&usbuf, uid);
 581                                 strcpy(fullname, usbuf.fullname);
 582                         }
 583
 584                         if (found_user == 0) {          // user record exists
 585                                                         // now update the account email addresses if necessary
 586                                 if (CtdlGetConfigInt("c_ldap_sync_email_addrs") > 0) {
 587                                         if (extract_email_addresses_from_ldap(user_dn, new_emailaddrs) == 0) {
 588                                                 if (strcmp(usbuf.emailaddrs, new_emailaddrs)) {                         // update only if changed
 589                                                         CtdlSetEmailAddressesForUser(usbuf.fullname, new_emailaddrs);
 590                                                 }
 591                                         }
 592                                 }
 593                         }
 594                         ldap_memfree(user_dn);
 595                 }
 596                 TRACE;
 597         }
 598
 599         // free the results
 600         ldap_msgfree(search_result);
 601
 602         // unbind so we can go back in as the authenticating user
 603         ldap_unbind(ldserver);
 604 }