usr/src/lib/passwdutil/ldap_attr.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright (c) 2016 by Delphix. All rights reserved.
 */

#include <stdio.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <macros.h>
#include <priv.h>

#include "ns_sldap.h"

#include <nss_dbdefs.h>
#include <nsswitch.h>

#include <pwd.h>
#include <shadow.h>
#include <syslog.h>

#include "passwdutil.h"

#include "utils.h"

#define	MAX_INT_LEN 11	/* 10+1 %d buflen for words/ints [not longs] */

#define	STRDUP_OR_RET(to, from) \
	if ((to = strdup(from)) == NULL) \
		return (PWU_NOMEM);

#define	STRDUP_OR_ERR(to, from, err) \
	if (((to) = strdup(from)) == NULL) \
		(err) = PWU_NOMEM;

#define	NUM_TO_STR(to, from) \
	{ \
		char nb[MAX_INT_LEN]; \
		if (snprintf(nb, MAX_INT_LEN, "%d", (from)) >= MAX_INT_LEN) \
			return (PWU_NOMEM); \
		STRDUP_OR_RET(to, nb); \
	}

#define	NEW_ATTR(p, i, attr, val) \
	{ \
		p[i] = new_attr(attr, (val)); \
		if (p[i] == NULL) \
			return (PWU_NOMEM); \
		i++; \
	}

int ldap_getattr(char *name, attrlist *item, pwu_repository_t *rep);
int ldap_getpwnam(char *name, attrlist *items, pwu_repository_t *rep,
    void **buf);
int ldap_update(attrlist *items, pwu_repository_t *rep, void *buf);
int ldap_putpwnam(char *name, char *oldpw, pwu_repository_t *rep, void *buf);
int ldap_user_to_authenticate(char *name, pwu_repository_t *rep,
	char **auth_user, int *privileged);

/*
 * ldap function pointer table, used by passwdutil_init to initialize
 * the global Repository-OPerations table "rops"
 */
struct repops ldap_repops = {
	NULL,	/* checkhistory */
	ldap_getattr,
	ldap_getpwnam,
	ldap_update,
	ldap_putpwnam,
	ldap_user_to_authenticate,
	NULL,	/* lock */
	NULL	/* unlock */
};

/*
 * structure used to keep state between get/update/put calls
 */
typedef struct {
	char *passwd;			/* encrypted password */
	struct passwd *pwd;
	ns_ldap_attr_t **pattrs;	/* passwd attrs */
	int npattrs;			/* max attrs */
	struct spwd *spwd;
	ns_ldap_attr_t **sattrs;	/* passwd attrs */
	int nsattrs;			/* max attrs */
	boolean_t shadow_update_enabled;	/* shadow update configured */
} ldapbuf_t;

/*
 * The following define's are taken from
 *	usr/src/lib/nsswitch/ldap/common/getpwnam.c
 */

/* passwd attributes filters */
#define	_PWD_CN			"cn"
#define	_PWD_UID		"uid"
#define	_PWD_USERPASSWORD	"userpassword"
#define	_PWD_UIDNUMBER		"uidnumber"
#define	_PWD_GIDNUMBER		"gidnumber"
#define	_PWD_GECOS		"gecos"
#define	_PWD_DESCRIPTION	"description"
#define	_PWD_HOMEDIRECTORY	"homedirectory"
#define	_PWD_LOGINSHELL		"loginshell"

#define	_PWD_MAX_ATTR		10	/* 9+NULL */

/* shadow attributes filters */
#define	_S_LASTCHANGE		"shadowlastchange"
#define	_S_MIN			"shadowmin"
#define	_S_MAX			"shadowmax"
#define	_S_WARNING		"shadowwarning"
#define	_S_INACTIVE		"shadowinactive"
#define	_S_EXPIRE		"shadowexpire"
#define	_S_FLAG			"shadowflag"

#define	_S_MAX_ATTR		8	/* 7+NULL */

/*
 * Frees up an ldapbuf_t
 */

static void
free_ldapbuf(ldapbuf_t *p)
{
	int i;

	if (p == NULL)
		return;
	if (p->passwd) {
		(void) memset(p->passwd, 0, strlen(p->passwd));
		free(p->passwd);
	}
	if (p->pwd)
		free_pwd(p->pwd);
	if (p->spwd)
		free_spwd(p->spwd);
	if (p->pattrs) {
		for (i = 0; i < p->npattrs; i++) {
			if (p->pattrs[i] != NULL) {
				free(p->pattrs[i]->attrvalue[0]);
				free(p->pattrs[i]);
			}
		}
		free(p->pattrs);
	}
	if (p->sattrs) {
		for (i = 0; i < p->nsattrs; i++) {
			if (p->sattrs[i] != NULL) {
				free(p->sattrs[i]->attrvalue[0]);
				free(p->sattrs[i]);
			}
		}
		free(p->sattrs);
	}
}

/*
 * int ldap_user_to_authenticate(user, rep, auth_user, privileged)
 *
 * If the Shadow Update functionality is enabled, then we check to
 * see if the caller has 0 as the euid or has all zone privs. If so,
 * the caller would be able to modify shadow(4) data stored on the
 * LDAP server. Otherwise, when LDAP Shadow Update is not enabled,
 * we can't determine whether the user is "privileged" in the LDAP
 * sense. The operation should be attempted and will succeed if the
 * user had privileges. For our purposes, we say that the user is
 * privileged if they are attempting to change another user's
 * password attributes.
 */
int
ldap_user_to_authenticate(char *user, pwu_repository_t *rep,
	char **auth_user, int *privileged)
{
	struct passwd *pw;
	uid_t uid;
	uid_t priviledged_uid;
	int res = PWU_SUCCESS;

	if (strcmp(user, "root") == 0)
		return (PWU_NOT_FOUND);

	if ((pw = getpwnam_from(user, rep, REP_LDAP)) == NULL)
		return (PWU_NOT_FOUND);

	uid = getuid();

	/*
	 * need equivalent of write access to /etc/shadow
	 * the privilege escalation model is euid == 0 || all zone privs
	 */
	if (__ns_ldap_is_shadow_update_enabled()) {
		boolean_t priv;

		priv = (geteuid() == 0);
		if (!priv) {
			priv_set_t *ps = priv_allocset();	/* caller */
			priv_set_t *zs;				/* zone */

			(void) getppriv(PRIV_EFFECTIVE, ps);
			zs = priv_str_to_set("zone", ",", NULL);
			priv = priv_isequalset(ps, zs);
			priv_freeset(ps);
			priv_freeset(zs);
		}
		/*
		 * priv can change anyone's password,
		 * only root isn't prompted.
		 */
		*privileged = 0;	/* for proper prompting */
		if (priv) {
			if (uid == 0) {
				*privileged = 1;
				*auth_user = NULL;
				return (res);
			} else if (uid == pw->pw_uid) {
				STRDUP_OR_ERR(*auth_user, user, res);
				return (res);
			}
		}

		return (PWU_DENIED);
	}

	if (uid == pw->pw_uid) {
		/* changing our own, not privileged */
		*privileged = 0;
		STRDUP_OR_RET(*auth_user, user);
	} else {
		char pwd_buf[1024];
		struct passwd pwr;

		*privileged = 1;
		/*
		 * specific case for root
		 * we want 'user' to be authenticated.
		 */
		if (uid == 0)  {
			priviledged_uid = pw->pw_uid;
		} else {
			priviledged_uid = uid;
		}
		if (getpwuid_r(priviledged_uid, &pwr, pwd_buf,
		    sizeof (pwd_buf)) != NULL) {
			STRDUP_OR_ERR(*auth_user, pwr.pw_name, res);
		} else {
			/* hmm. can't find name of current user...??? */

			if ((*auth_user = malloc(MAX_INT_LEN)) == NULL) {
				res = PWU_NOMEM;
			} else {
				(void) snprintf(*auth_user, MAX_INT_LEN, "%d",
				    (int)uid);
			}
		}
	}

	return (res);
}

/*
 * int ldap_getattr(name, item, rep)
 *
 * retrieve attributes specified in "item" for user "name".
 */
/*ARGSUSED*/
int
ldap_getattr(char *name, attrlist *items, pwu_repository_t *rep)
{
	attrlist *w;
	int res;
	ldapbuf_t *ldapbuf;
	struct passwd *pw = NULL;
	struct spwd *spw = NULL;

	res = ldap_getpwnam(name, items, rep, (void **)&ldapbuf);
	if (res != PWU_SUCCESS)
		return (res);

	pw = ldapbuf->pwd;
	spw = ldapbuf->spwd;

	for (w = items; res == PWU_SUCCESS && w != NULL; w = w->next) {
		switch (w->type) {
		case ATTR_NAME:
			STRDUP_OR_ERR(w->data.val_s, pw->pw_name, res);
			break;
		case ATTR_COMMENT:
			STRDUP_OR_ERR(w->data.val_s, pw->pw_comment, res);
			break;
		case ATTR_GECOS:
			STRDUP_OR_ERR(w->data.val_s, pw->pw_gecos, res);
			break;
		case ATTR_HOMEDIR:
			STRDUP_OR_ERR(w->data.val_s, pw->pw_dir, res);
			break;
		case ATTR_SHELL:
			STRDUP_OR_ERR(w->data.val_s, pw->pw_shell, res);
			break;
		case ATTR_PASSWD:
		case ATTR_PASSWD_SERVER_POLICY:
			STRDUP_OR_ERR(w->data.val_s, spw->sp_pwdp, res);
			break;
		case ATTR_AGE:
			STRDUP_OR_ERR(w->data.val_s, pw->pw_age, res);
			break;
		case ATTR_REP_NAME:
			STRDUP_OR_ERR(w->data.val_s, "ldap", res);
			break;

		/* integer values */
		case ATTR_UID:
			w->data.val_i = pw->pw_uid;
			break;
		case ATTR_GID:
			w->data.val_i = pw->pw_gid;
			break;
		case ATTR_LSTCHG:
			if (ldapbuf->shadow_update_enabled)
				w->data.val_i = spw->sp_lstchg;
			else
				w->data.val_i = -1;
			break;
		case ATTR_MIN:
			if (ldapbuf->shadow_update_enabled)
				w->data.val_i = spw->sp_min;
			else
				w->data.val_i = -1;
			break;
		case ATTR_MAX:
			if (ldapbuf->shadow_update_enabled)
				w->data.val_i = spw->sp_max;
			else
				w->data.val_i = -1;
			break;
		case ATTR_WARN:
			if (ldapbuf->shadow_update_enabled)
				w->data.val_i = spw->sp_warn;
			else
				w->data.val_i = -1;
			break;
		case ATTR_INACT:
			if (ldapbuf->shadow_update_enabled)
				w->data.val_i = spw->sp_inact;
			else
				w->data.val_i = -1;
			break;
		case ATTR_EXPIRE:
			if (ldapbuf->shadow_update_enabled)
				w->data.val_i = spw->sp_expire;
			else
				w->data.val_i = -1;
			break;
		case ATTR_FLAG:
			if (ldapbuf->shadow_update_enabled)
				w->data.val_i = spw->sp_flag;
			break;
		case ATTR_FAILED_LOGINS:
			w->data.val_i = spw->sp_flag & FAILCOUNT_MASK;
			break;
		default:
			break;
		}
	}

out:
	free_ldapbuf(ldapbuf);
	free(ldapbuf);
	return (res);
}

/*
 * int ldap_getpwnam(name, items, rep, buf)
 *
 * There is no need to get the old values from the ldap
 * server, as the update will update each item individually.
 * Therefore, we only allocate a buffer that will be used by
 * _update and _putpwnam to hold the attributes to update.
 *
 * Only when we're about to update a password, we need to retrieve
 * the old password since it contains salt-information.
 */
/*ARGSUSED*/
int
ldap_getpwnam(char *name, attrlist *items, pwu_repository_t *rep,
    void **buf)
{
	ldapbuf_t *ldapbuf;
	int res = PWU_NOMEM;

	/*
	 * [sp]attrs is treated as NULL terminated
	 */

	ldapbuf = calloc(1, sizeof (ldapbuf_t));
	if (ldapbuf == NULL)
		return (PWU_NOMEM);

	ldapbuf->pattrs = calloc(_PWD_MAX_ATTR, sizeof (ns_ldap_attr_t *));
	if (ldapbuf->pattrs == NULL)
		goto out;
	ldapbuf->npattrs = _PWD_MAX_ATTR;

	ldapbuf->sattrs = calloc(_S_MAX_ATTR, sizeof (ns_ldap_attr_t *));
	if (ldapbuf->sattrs == NULL)
		goto out;
	ldapbuf->nsattrs = _S_MAX_ATTR;

	res = dup_pw(&ldapbuf->pwd, getpwnam_from(name, rep, REP_LDAP));
	if (res != PWU_SUCCESS)
		goto out;

	res = dup_spw(&ldapbuf->spwd, getspnam_from(name, rep, REP_LDAP));
	if (res != PWU_SUCCESS)
		goto out;
	else {
		char *spw = ldapbuf->spwd->sp_pwdp;
		if (spw != NULL && *spw != '\0') {
			ldapbuf->passwd = strdup(spw);
			if (ldapbuf->passwd == NULL)
				goto out;
		} else
			ldapbuf->passwd = NULL;
	}

	/* remember if shadow update is enabled */
	ldapbuf->shadow_update_enabled = __ns_ldap_is_shadow_update_enabled();

	*buf = (void *)ldapbuf;
	return (PWU_SUCCESS);

out:
	free_ldapbuf(ldapbuf);
	free(ldapbuf);
	return (res);
}

/*
 * new_attr(name, value)
 *
 * create a new LDAP attribute to be sent to the server
 */
ns_ldap_attr_t *
new_attr(char *name, char *value)
{
	ns_ldap_attr_t *tmp;

	tmp = malloc(sizeof (*tmp));
	if (tmp != NULL) {
		tmp->attrname = name;
		tmp->attrvalue = (char **)calloc(2, sizeof (char *));
		if (tmp->attrvalue == NULL) {
			free(tmp);
			return (NULL);
		}
		tmp->attrvalue[0] = value;
		tmp->value_count = 1;
	}

	return (tmp);
}

/*
 * max_present(list)
 *
 * returns '1' if a ATTR_MAX with value != -1 is present. (in other words:
 * if password aging is to be turned on).
 */
static int
max_present(attrlist *list)
{
	while (list != NULL)
		if (list->type == ATTR_MAX && list->data.val_i != -1)
			return (1);
		else
			list = list->next;
	return (0);
}

/*
 * attr_addmod(attrs, idx, item, val)
 *
 * Adds or updates attribute 'item' in ldap_attrs list to value
 * update idx if item is added
 * return:  -1 - PWU_NOMEM/error, 0 - success
 */
static int
attr_addmod(ns_ldap_attr_t **attrs, int *idx, char *item, int value)
{
	char numbuf[MAX_INT_LEN], *strp;
	int i;

	/* stringize the value or abort */
	if (snprintf(numbuf, MAX_INT_LEN, "%d", value) >= MAX_INT_LEN)
		return (-1);

	/* check for existence and modify existing */
	for (i = 0; i < *idx; i++) {
		if (attrs[i] != NULL &&
		    strcmp(item, attrs[i]->attrname) == 0) {
			strp = strdup(numbuf);
			if (strp == NULL)
				return (-1);
			free(attrs[i]->attrvalue[0]);
			attrs[i]->attrvalue[0] = strp;
			return (0);
		}
	}
	/* else add */
	strp = strdup(numbuf);
	if (strp == NULL)
		return (-1);
	attrs[*idx] = new_attr(item, strp);
	if (attrs[*idx] == NULL)
		return (-1);
	(*idx)++;
	return (0);
}

/*
 * ldap_update(items, rep, buf)
 *
 * create LDAP attributes in 'buf' for each attribute in 'items'.
 */
/*ARGSUSED*/
int
ldap_update(attrlist *items, pwu_repository_t *rep, void *buf)
{
	attrlist *p;
	ldapbuf_t *ldapbuf = (ldapbuf_t *)buf;
	struct spwd *spw;
	ns_ldap_attr_t **pattrs = ldapbuf->pattrs;
	int pidx = 0;
	ns_ldap_attr_t **sattrs = ldapbuf->sattrs;
	int sidx = 0;
	char *pwd, *val;
	char *salt;
	size_t cryptlen;
	int len;
	int count;
	int rc = PWU_SUCCESS;
	int aging_needed = 0;
	int aging_set = 0;
	int disable_aging;

	spw = ldapbuf->spwd;

	/*
	 * if sp_max==0 and shadow update is enabled:
	 * disable passwd aging after updating the password
	 */
	disable_aging = (spw != NULL && spw->sp_max == 0 &&
	    ldapbuf->shadow_update_enabled);

	for (p = items; p != NULL; p = p->next) {
		switch (p->type) {
		case ATTR_PASSWD:
			/*
			 * There is a special case for ldap: if the
			 * password is to be deleted (-d to passwd),
			 * p->data.val_s will be NULL.
			 */
			if (p->data.val_s == NULL) {
				if (!ldapbuf->shadow_update_enabled)
					return (PWU_CHANGE_NOT_ALLOWED);
				cryptlen =
				    sizeof ("{crypt}" NS_LDAP_NO_UNIX_PASSWORD);
				val = malloc(cryptlen);
				if (val == NULL)
					return (PWU_NOMEM);
				(void) snprintf(val, cryptlen,
				"{crypt}" NS_LDAP_NO_UNIX_PASSWORD);
			} else { /* not deleting password */
				salt = crypt_gensalt(ldapbuf->passwd,
				    ldapbuf->pwd);

				if (salt == NULL) {
					if (errno == ENOMEM)
						return (PWU_NOMEM);

					/* algorithm problem? */
					syslog(LOG_AUTH | LOG_ALERT,
					    "passwdutil: crypt_gensalt "
					    "%m");
					return (PWU_UPDATE_FAILED);
				}

				pwd = crypt(p->data.val_s, salt);
				free(salt);
				cryptlen = strlen(pwd) + sizeof ("{crypt}");
				val = malloc(cryptlen);
				if (val == NULL)
					return (PWU_NOMEM);
				(void) snprintf(val, cryptlen,
				    "{crypt}%s", pwd);
			}

			/*
			 * If not managing passwordAccount,
			 * insert the new password in the
			 * passwd attr array and break.
			 */
			if (!ldapbuf->shadow_update_enabled) {
				NEW_ATTR(pattrs, pidx,
				    _PWD_USERPASSWORD, val);
				break;
			}

			/*
			 * Managing passwordAccount, insert the
			 * new password, along with lastChange and
			 * shadowFlag, in the shadow attr array.
			 */
			NEW_ATTR(sattrs, sidx, _PWD_USERPASSWORD, val);

			if (attr_addmod(sattrs, &sidx, _S_LASTCHANGE,
			    DAY_NOW_32) < 0)
				return (PWU_NOMEM);
			spw->sp_lstchg = DAY_NOW_32;

			if (attr_addmod(sattrs, &sidx, _S_FLAG,
			    spw->sp_flag & ~FAILCOUNT_MASK) < 0)
				return (PWU_NOMEM);
			spw->sp_flag &= ~FAILCOUNT_MASK; /* reset count */
			aging_needed = 1;
			break;
		case ATTR_PASSWD_SERVER_POLICY:
			/*
			 * For server policy, don't crypt the password,
			 * send the password as is to the server and
			 * let the LDAP server do its own password
			 * encryption
			 */
			STRDUP_OR_RET(val, p->data.val_s);

			NEW_ATTR(pattrs, pidx, _PWD_USERPASSWORD, val);
			break;
		case ATTR_COMMENT:
			/* XX correct? */
			NEW_ATTR(pattrs, pidx, _PWD_DESCRIPTION, p->data.val_s);
			break;
		case ATTR_GECOS:
			if (!ldapbuf->shadow_update_enabled) {
				NEW_ATTR(pattrs, pidx, _PWD_GECOS,
				    p->data.val_s);
			} else {
				NEW_ATTR(sattrs, sidx, _PWD_GECOS,
				    p->data.val_s);
			}
			break;
		case ATTR_HOMEDIR:
			if (!ldapbuf->shadow_update_enabled) {
				NEW_ATTR(pattrs, pidx, _PWD_HOMEDIRECTORY,
				    p->data.val_s);
			} else {
				NEW_ATTR(sattrs, sidx, _PWD_HOMEDIRECTORY,
				    p->data.val_s);
			}
			break;
		case ATTR_SHELL:
			if (!ldapbuf->shadow_update_enabled) {
				NEW_ATTR(pattrs, pidx, _PWD_LOGINSHELL,
				    p->data.val_s);
			} else {
				NEW_ATTR(sattrs, sidx, _PWD_LOGINSHELL,
				    p->data.val_s);
			}
			break;
		/* We don't update NAME, UID, GID */
		case ATTR_NAME:
		case ATTR_UID:
		case ATTR_GID:
		/* Unsupported item */
		case ATTR_AGE:
			break;
		case ATTR_LOCK_ACCOUNT:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			if (spw->sp_pwdp == NULL) {
				spw->sp_pwdp = LOCKSTRING;
			} else if ((strncmp(spw->sp_pwdp, LOCKSTRING,
			    sizeof (LOCKSTRING)-1) != 0) &&
			    (strcmp(spw->sp_pwdp, NOLOGINSTRING) != 0)) {
				len = sizeof (LOCKSTRING)-1 +
				    strlen(spw->sp_pwdp) + 1 +
				    sizeof ("{crypt}");
				pwd = malloc(len);
				if (pwd == NULL) {
					return (PWU_NOMEM);
				}
				(void) strlcpy(pwd, "{crypt}", len);
				(void) strlcat(pwd, LOCKSTRING, len);
				(void) strlcat(pwd, spw->sp_pwdp, len);
				free(spw->sp_pwdp);
				spw->sp_pwdp = pwd;
				NEW_ATTR(sattrs, sidx, _PWD_USERPASSWORD,
				    spw->sp_pwdp);
			}
			if (attr_addmod(sattrs, &sidx, _S_LASTCHANGE,
			    DAY_NOW_32) < 0)
				return (PWU_NOMEM);
			spw->sp_lstchg = DAY_NOW_32;
			break;

		case ATTR_UNLOCK_ACCOUNT:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			if (spw->sp_pwdp &&
			    strncmp(spw->sp_pwdp, LOCKSTRING,
			    sizeof (LOCKSTRING)-1) == 0) {
				len = (sizeof ("{crypt}") -
				    sizeof (LOCKSTRING)) +
				    strlen(spw->sp_pwdp) + 1;
				pwd = malloc(len);
				if (pwd == NULL) {
					return (PWU_NOMEM);
				}
				(void) strlcpy(pwd, "{crypt}", len);
				(void) strlcat(pwd, spw->sp_pwdp +
				    sizeof (LOCKSTRING)-1, len);
				free(spw->sp_pwdp);
				spw->sp_pwdp = pwd;

				NEW_ATTR(sattrs, sidx, _PWD_USERPASSWORD,
				    spw->sp_pwdp);
				if (attr_addmod(sattrs, &sidx, _S_LASTCHANGE,
				    DAY_NOW_32) < 0)
					return (PWU_NOMEM);
				spw->sp_lstchg = DAY_NOW_32;
			}
			break;

		case ATTR_NOLOGIN_ACCOUNT:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			free(spw->sp_pwdp);
			STRDUP_OR_RET(spw->sp_pwdp, "{crypt}" NOLOGINSTRING);
			NEW_ATTR(sattrs, sidx, _PWD_USERPASSWORD, spw->sp_pwdp);
			if (attr_addmod(sattrs, &sidx, _S_LASTCHANGE,
			    DAY_NOW_32) < 0)
				return (PWU_NOMEM);
			spw->sp_lstchg = DAY_NOW_32;
			break;

		case ATTR_EXPIRE_PASSWORD:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			NUM_TO_STR(val, 0);
			NEW_ATTR(sattrs, sidx, _S_LASTCHANGE, val);
			break;

		case ATTR_LSTCHG:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			NUM_TO_STR(val, p->data.val_i);
			NEW_ATTR(sattrs, sidx, _S_LASTCHANGE, val);
			break;

		case ATTR_MIN:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			if (spw->sp_max == -1 && p->data.val_i != -1 &&
			    max_present(p->next) == 0)
				return (PWU_AGING_DISABLED);
			NUM_TO_STR(val, p->data.val_i);
			NEW_ATTR(sattrs, sidx, _S_MIN, val);
			aging_set = 1;
			break;

		case ATTR_MAX:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			if (p->data.val_i == -1) {
				/* Turn off aging. Reset min and warn too */
				spw->sp_max = spw->sp_min = spw->sp_warn = -1;
				NUM_TO_STR(val, -1);
				NEW_ATTR(sattrs, sidx, _S_MIN, val);
				NUM_TO_STR(val, -1);
				NEW_ATTR(sattrs, sidx, _S_WARNING, val);
			} else {
				/* Turn account aging on */
				if (spw->sp_min == -1) {
					/*
					 * minage was not set with command-
					 * line option: set to zero
					 */
					spw->sp_min = 0;
					NUM_TO_STR(val, 0);
					NEW_ATTR(sattrs, sidx, _S_MIN,
					    val);
				}
				/*
				 * If aging was turned off, we update lstchg.
				 * We take care not to update lstchg if the
				 * user has no password, otherwise the user
				 * might not be required to provide a password
				 * the next time they log in.
				 *
				 * Also, if lstchg != -1 (i.e., not set)
				 * we keep the old value.
				 */
				if (spw->sp_max == -1 &&
				    spw->sp_pwdp != NULL && *spw->sp_pwdp &&
				    spw->sp_lstchg == -1) {
					if (attr_addmod(sattrs, &sidx,
					    _S_LASTCHANGE,
					    DAY_NOW_32) < 0)
						return (PWU_NOMEM);
					spw->sp_lstchg = DAY_NOW_32;
				}
			}
			NUM_TO_STR(val, p->data.val_i);
			NEW_ATTR(sattrs, sidx, _S_MAX, val);
			aging_set = 1;
			break;

		case ATTR_WARN:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			if (spw->sp_max == -1 &&
			    p->data.val_i != -1 && max_present(p->next) == 0)
				return (PWU_AGING_DISABLED);
			NUM_TO_STR(val, p->data.val_i);
			NEW_ATTR(sattrs, sidx, _S_WARNING, val);
			break;

		case ATTR_INACT:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			NUM_TO_STR(val, p->data.val_i);
			NEW_ATTR(sattrs, sidx, _S_INACTIVE, val);
			break;

		case ATTR_EXPIRE:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			NUM_TO_STR(val, p->data.val_i);
			NEW_ATTR(sattrs, sidx, _S_EXPIRE, val);
			break;

		case ATTR_FLAG:
			if (!ldapbuf->shadow_update_enabled)
				break;	/* not managing passwordAccount */
			NUM_TO_STR(val, p->data.val_i);
			NEW_ATTR(sattrs, sidx, _S_FLAG, val);
			break;
		case ATTR_INCR_FAILED_LOGINS:
			if (!ldapbuf->shadow_update_enabled) {
				rc = PWU_CHANGE_NOT_ALLOWED;
				break;	/* not managing passwordAccount */
			}
			count = (spw->sp_flag & FAILCOUNT_MASK) + 1;
			spw->sp_flag &= ~FAILCOUNT_MASK;
			spw->sp_flag |= min(FAILCOUNT_MASK, count);
			p->data.val_i = count;
			NUM_TO_STR(val, spw->sp_flag);
			NEW_ATTR(sattrs, sidx, _S_FLAG, val);
			break;
		case ATTR_RST_FAILED_LOGINS:
			if (!ldapbuf->shadow_update_enabled) {
				rc = PWU_CHANGE_NOT_ALLOWED;
				break;	/* not managing passwordAccount */
			}
			p->data.val_i = spw->sp_flag & FAILCOUNT_MASK;
			spw->sp_flag &= ~FAILCOUNT_MASK;
			NUM_TO_STR(val, spw->sp_flag);
			NEW_ATTR(sattrs, sidx, _S_FLAG, val);
			break;
		default:
			break;
		}
	}

	/*
	 * If the ldap client is configured with shadow update enabled,
	 * then what should the new aging values look like?
	 *
	 * There are a number of different conditions
	 *
	 *  a) aging is already configured: don't touch it
	 *
	 *  b) disable_aging is set: disable aging
	 *
	 *  c) aging is not configured: turn on default aging;
	 *
	 *  b) and c) of course only if aging_needed and !aging_set.
	 *  (i.e., password changed, and aging values not changed)
	 */

	if (ldapbuf->shadow_update_enabled && spw != NULL && spw->sp_max <= 0) {
		/* a) aging not yet configured */
		if (aging_needed && !aging_set) {
			if (disable_aging) {
				/* b) turn off aging */
				spw->sp_min = spw->sp_max = spw->sp_warn = -1;
				if (attr_addmod(sattrs, &sidx, _S_MIN, -1) < 0)
					return (PWU_NOMEM);
				if (attr_addmod(sattrs, &sidx, _S_MAX, -1) < 0)
					return (PWU_NOMEM);
				if (attr_addmod(sattrs, &sidx, _S_WARNING,
				    -1) < 0)
					return (PWU_NOMEM);
			} else {
				/* c) */
				turn_on_default_aging(spw);

				if (attr_addmod(sattrs, &sidx, _S_MIN,
				    spw->sp_min) < 0)
					return (PWU_NOMEM);
				if (attr_addmod(sattrs, &sidx, _S_MAX,
				    spw->sp_max) < 0)
					return (PWU_NOMEM);
				if (attr_addmod(sattrs, &sidx,
				    _S_WARNING, spw->sp_warn) < 0)
					return (PWU_NOMEM);
			}
		}
	}

	pattrs[pidx] = NULL;
	sattrs[sidx] = NULL;

	return (rc);
}

/*
 * ldap_to_pwu_code(error, pwd_status)
 *
 * translation from LDAP return values and PWU return values
 */
int
ldap_to_pwu_code(int error, int pwd_status)
{
	switch (error) {
	case NS_LDAP_SUCCESS:	return (PWU_SUCCESS);
	case NS_LDAP_OP_FAILED:	return (PWU_DENIED);
	case NS_LDAP_NOTFOUND:	return (PWU_NOT_FOUND);
	case NS_LDAP_MEMORY:	return (PWU_NOMEM);
	case NS_LDAP_CONFIG:	return (PWU_NOT_FOUND);
	case NS_LDAP_INTERNAL:
		switch (pwd_status) {
		case NS_PASSWD_EXPIRED:
			return (PWU_DENIED);
		case NS_PASSWD_CHANGE_NOT_ALLOWED:
			return (PWU_CHANGE_NOT_ALLOWED);
		case NS_PASSWD_TOO_SHORT:
			return (PWU_PWD_TOO_SHORT);
		case NS_PASSWD_INVALID_SYNTAX:
			return (PWU_PWD_INVALID);
		case NS_PASSWD_IN_HISTORY:
			return (PWU_PWD_IN_HISTORY);
		case NS_PASSWD_WITHIN_MIN_AGE:
			return (PWU_WITHIN_MIN_AGE);
		default:
			return (PWU_SYSTEM_ERROR);
		}
	default:		return (PWU_SYSTEM_ERROR);
	}
}

int
ldap_replaceattr(const char *dn, ns_ldap_attr_t **attrs, const char *binddn,
	const char *pwd, int *pwd_status, int flags)
{
	int		result = NS_LDAP_OP_FAILED;
	int		ldaprc;
	int		authstried = 0;
	char		**certpath = NULL;
	ns_auth_t	**app;
	ns_auth_t	**authpp = NULL;
	ns_auth_t	*authp = NULL;
	ns_cred_t	*credp;
	ns_ldap_error_t	*errorp = NULL;

	debug("%s: replace_ldapattr()", __FILE__);

	if ((credp = (ns_cred_t *)calloc(1, sizeof (ns_cred_t))) == NULL)
		return (NS_LDAP_MEMORY); /* map to PWU_NOMEM */

	/* for admin shadow update, dn and pwd will be set later in libsldap */
	if ((flags & NS_LDAP_UPDATE_SHADOW) == 0) {
		/* Fill in the user name and password */
		if (dn == NULL || pwd == NULL)
			goto out;
		credp->cred.unix_cred.userID = strdup(binddn);
		credp->cred.unix_cred.passwd = strdup(pwd);
	}

	/* get host certificate path, if one is configured */
	ldaprc = __ns_ldap_getParam(NS_LDAP_HOST_CERTPATH_P,
	    (void ***)&certpath, &errorp);
	if (ldaprc != NS_LDAP_SUCCESS)
		goto out;

	if (certpath && *certpath)
		credp->hostcertpath = *certpath;

	/* Load the service specific authentication method */
	ldaprc = __ns_ldap_getServiceAuthMethods("passwd-cmd", &authpp,
	    &errorp);

	if (ldaprc != NS_LDAP_SUCCESS)
		goto out;

	/*
	 * if authpp is null, there is no serviceAuthenticationMethod
	 * try default authenticationMethod
	 */
	if (authpp == NULL) {
		ldaprc = __ns_ldap_getParam(NS_LDAP_AUTH_P, (void ***)&authpp,
		    &errorp);
		if (ldaprc != NS_LDAP_SUCCESS)
			goto out;
	}

	/*
	 * if authpp is still null, then can not authenticate, syslog
	 * error message and return error
	 */
	if (authpp == NULL) {
		syslog(LOG_ERR,
		"passwdutil: no legal LDAP authentication method configured");
		result = NS_LDAP_OP_FAILED;
		goto out;
	}

	/*
	 * Walk the array and try all authentication methods in order except
	 * for "none".
	 */
	for (app = authpp; *app; app++) {
		authp = *app;
		/* what about disabling other mechanisms? "tls:sasl/EXTERNAL" */
		if (authp->type == NS_LDAP_AUTH_NONE)
			continue;
		authstried++;
		credp->auth.type = authp->type;
		credp->auth.tlstype = authp->tlstype;
		credp->auth.saslmech = authp->saslmech;
		credp->auth.saslopt = authp->saslopt;

		ldaprc = __ns_ldap_repAttr("shadow", dn,
		    (const ns_ldap_attr_t * const *)attrs,
		    credp, flags, &errorp);
		if (ldaprc == NS_LDAP_SUCCESS) {
			result = NS_LDAP_SUCCESS;
			goto out;
		}

		/*
		 * if change not allowed due to configuration, indicate so
		 * to the caller
		 */
		if (ldaprc == NS_LDAP_CONFIG &&
		    errorp->status == NS_CONFIG_NOTALLOW) {
			result = NS_LDAP_CONFIG;
			*pwd_status = NS_PASSWD_CHANGE_NOT_ALLOWED;
			goto out;
		}

		/*
		 * other errors might need to be added to this list, for
		 * the current supported mechanisms this is sufficient
		 */
		if ((ldaprc == NS_LDAP_INTERNAL) &&
		    (errorp->pwd_mgmt.status == NS_PASSWD_GOOD) &&
		    ((errorp->status == LDAP_INAPPROPRIATE_AUTH) ||
		    (errorp->status == LDAP_INVALID_CREDENTIALS))) {
			result = ldaprc;
			goto out;
		}

		/*
		 * If there is error related to password policy,
		 * return it to caller
		 */
		if ((ldaprc == NS_LDAP_INTERNAL) &&
		    errorp->pwd_mgmt.status != NS_PASSWD_GOOD) {
			*pwd_status = errorp->pwd_mgmt.status;
			result = ldaprc;
			goto out;
		} else
			*pwd_status = NS_PASSWD_GOOD;

		/* we don't really care about the error, just clean it up */
		if (errorp)
			(void) __ns_ldap_freeError(&errorp);
	}
	if (authstried == 0) {
		syslog(LOG_ERR,
		"passwdutil: no legal LDAP authentication method configured");
		result = NS_LDAP_CONFIG;
		goto out;
	}
	result = NS_LDAP_OP_FAILED; /* map to PWU_DENIED */

out:
	if (credp)
		(void) __ns_ldap_freeCred(&credp);

	if (authpp)
		(void) __ns_ldap_freeParam((void ***)&authpp);

	if (errorp)
		(void) __ns_ldap_freeError(&errorp);

	return (result);
}


/*
 * ldap_putpwnam(name, oldpw, rep, buf)
 *
 * update the LDAP server with the attributes contained in 'buf'.
 */
/*ARGSUSED*/
int
ldap_putpwnam(char *name, char *oldpw, pwu_repository_t *rep, void *buf)
{
	int res;
	char *dn;	/* dn of user whose attributes we are changing */
	char *binddn;	/* dn of user who is performing the change */
	ns_ldap_error_t *errorp;
	ldapbuf_t *ldapbuf = (ldapbuf_t *)buf;
	ns_ldap_attr_t **pattrs = ldapbuf->pattrs;
	ns_ldap_attr_t **sattrs = ldapbuf->sattrs;
	struct passwd *pw;
	int pwd_status;
	uid_t uid;

	if (strcmp(name, "root") == 0)
		return (PWU_NOT_FOUND);

	/*
	 * convert name of user whose attributes we are changing
	 * to a distinguished name
	 */
	res = __ns_ldap_uid2dn(name, &dn, NULL, &errorp);
	if (res != NS_LDAP_SUCCESS)
		goto out;

	/* update shadow via ldap_cachemgr if it is enabled */
	if (ldapbuf->shadow_update_enabled &&
	    sattrs != NULL && sattrs[0] != NULL) {
		/*
		 * flag NS_LDAP_UPDATE_SHADOW indicates the shadow update
		 * should be done via ldap_cachemgr
		 */
		res = ldap_replaceattr(dn, sattrs, NULL, NULL, &pwd_status,
		    NS_LDAP_UPDATE_SHADOW);
		goto out;
	}

	/*
	 * The LDAP server checks whether we are permitted to perform
	 * the requested change. We need to send the name of the user
	 * who is executing this piece of code, together with his
	 * current password to the server.
	 * If this is executed by a normal user changing his/her own
	 * password, this will simply be the OLD password that is to
	 * be changed.
	 * Specific case if the user who is executing this piece
	 * of code is root. We will then issue the LDAP request
	 * with the DN of the user we want to change the passwd of.
	 */

	/*
	 * create a dn for the user who is executing this code
	 */
	uid = getuid();
	if (uid == 0) {
		if ((pw = getpwnam_from(name, rep, REP_LDAP)) == NULL) {
			res = NS_LDAP_OP_FAILED;
			goto out;
		}
	} else if ((pw = getpwuid_from(uid, rep, REP_LDAP)) == NULL) {
		/*
		 * User executing this code is not known to the LDAP
		 * server. This operation is to be denied
		 */
		res = NS_LDAP_OP_FAILED;
		goto out;
	}

	res = __ns_ldap_uid2dn(pw->pw_name, &binddn, NULL, &errorp);
	if (res != NS_LDAP_SUCCESS)
		goto out;

	if (pattrs && pattrs[0] != NULL) {
		res = ldap_replaceattr(dn, pattrs, binddn, oldpw,
		    &pwd_status, 0);
	} else
		res = NS_LDAP_OP_FAILED;

out:
	free_ldapbuf(ldapbuf);
	free(dn);

	return (ldap_to_pwu_code(res, pwd_status));
}