From 2a695dfe09cafeee3a648d3b969c364f8d3f494f Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Tue, 27 Oct 2020 14:49:55 +0100
Subject: [PATCH 09/10] enroll: allow fqdn for locate_computer_account

Make it possible to find existing manages service account by the
fully-qualified name.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1854112
---
 library/adenroll.c | 45 +++++++++++++++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 14 deletions(-)

diff --git a/library/adenroll.c b/library/adenroll.c
index 05bb085..98cd5fa 100644
--- a/library/adenroll.c
+++ b/library/adenroll.c
@@ -990,10 +990,11 @@ delete_computer_account (adcli_enroll *enroll,
 static adcli_result
 locate_computer_account (adcli_enroll *enroll,
                          LDAP *ldap,
+                         bool use_fqdn,
                          LDAPMessage **rresults,
                          LDAPMessage **rentry)
 {
-	char *attrs[] = { "objectClass", NULL };
+	char *attrs[] = { "objectClass", "CN", NULL };
 	LDAPMessage *results = NULL;
 	LDAPMessage *entry = NULL;
 	const char *base;
@@ -1003,12 +1004,22 @@ locate_computer_account (adcli_enroll *enroll,
 	int ret = 0;
 
 	/* If we don't yet know our computer dn, then try and find it */
-	value = _adcli_ldap_escape_filter (enroll->computer_sam);
-	return_unexpected_if_fail (value != NULL);
-	if (asprintf (&filter, "(&(objectClass=%s)(sAMAccountName=%s))",
-	              enroll->is_service ? "msDS-ManagedServiceAccount" : "computer",
-	              value) < 0)
-		return_unexpected_if_reached ();
+	if (use_fqdn) {
+		return_unexpected_if_fail (enroll->host_fqdn != NULL);
+		value = _adcli_ldap_escape_filter (enroll->host_fqdn);
+		return_unexpected_if_fail (value != NULL);
+		if (asprintf (&filter, "(&(objectClass=%s)(dNSHostName=%s))",
+		              enroll->is_service ? "msDS-ManagedServiceAccount" : "computer",
+		              value) < 0)
+			return_unexpected_if_reached ();
+	} else {
+		value = _adcli_ldap_escape_filter (enroll->computer_sam);
+		return_unexpected_if_fail (value != NULL);
+		if (asprintf (&filter, "(&(objectClass=%s)(sAMAccountName=%s))",
+		              enroll->is_service ? "msDS-ManagedServiceAccount" : "computer",
+		              value) < 0)
+			return_unexpected_if_reached ();
+	}
 	free (value);
 
 	base = adcli_conn_get_default_naming_context (enroll->conn);
@@ -1031,21 +1042,26 @@ locate_computer_account (adcli_enroll *enroll,
 			enroll->computer_dn = strdup (dn);
 			return_unexpected_if_fail (enroll->computer_dn != NULL);
 			_adcli_info ("Found %s account for %s at: %s",
-			             s_or_c (enroll), enroll->computer_sam, dn);
+			             s_or_c (enroll),
+			             use_fqdn ? enroll->host_fqdn
+			                      : enroll->computer_sam, dn);
 			ldap_memfree (dn);
 
 		} else {
 			ldap_msgfree (results);
 			results = NULL;
 			_adcli_info ("A %s account for %s does not exist",
-			             s_or_c (enroll), enroll->computer_sam);
+			             s_or_c (enroll),
+			             use_fqdn ? enroll->host_fqdn
+			                      : enroll->computer_sam);
 		}
 
 	} else {
 		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,
 		                                   "Couldn't lookup %s account: %s",
 		                                   s_or_c (enroll),
-		                                   enroll->computer_sam);
+		                                   use_fqdn ? enroll->host_fqdn
+		                                            :enroll->computer_sam);
 	}
 
 	if (rresults)
@@ -1120,7 +1136,8 @@ locate_or_create_computer_account (adcli_enroll *enroll,
 
 	/* Try to find the computer account */
 	if (!enroll->computer_dn) {
-		res = locate_computer_account (enroll, ldap, &results, &entry);
+		res = locate_computer_account (enroll, ldap, false,
+		                               &results, &entry);
 		if (res != ADCLI_SUCCESS)
 			return res;
 		searched = 1;
@@ -2395,7 +2412,7 @@ adcli_enroll_read_computer_account (adcli_enroll *enroll,
 
 	/* Find the computer dn */
 	if (!enroll->computer_dn) {
-		res = locate_computer_account (enroll, ldap, NULL, NULL);
+		res = locate_computer_account (enroll, ldap, false, NULL, NULL);
 		if (res != ADCLI_SUCCESS)
 			return res;
 		if (!enroll->computer_dn) {
@@ -2508,7 +2525,7 @@ adcli_enroll_delete (adcli_enroll *enroll,
 
 	/* Find the computer dn */
 	if (!enroll->computer_dn) {
-		res = locate_computer_account (enroll, ldap, NULL, NULL);
+		res = locate_computer_account (enroll, ldap, false, NULL, NULL);
 		if (res != ADCLI_SUCCESS)
 			return res;
 		if (!enroll->computer_dn) {
@@ -2552,7 +2569,7 @@ adcli_enroll_password (adcli_enroll *enroll,
 
 	/* Find the computer dn */
 	if (!enroll->computer_dn) {
-		res = locate_computer_account (enroll, ldap, NULL, NULL);
+		res = locate_computer_account (enroll, ldap, false, NULL, NULL);
 		if (res != ADCLI_SUCCESS)
 			return res;
 		if (!enroll->computer_dn) {
-- 
2.28.0