forked from gentilkiwi/mimikatz
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathWinldap.h
3285 lines (2616 loc) · 102 KB
/
Winldap.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*++
Copyright (c) 1996-1999 Microsoft Corporation
Module Name:
winldap.h LDAP client 32 API header file
Abstract:
This module is the header file for the 32 bit LDAP client API for
Windows NT and Windows 95. This API is based on RFC 1823 with some
enhancements for LDAP v3.
Notes about Unicode support :
If you have UNICODE defined at compile time, you'll pull in the unicode
versions of the calls. Note that your executable may then not work with
other implementations of the LDAP API that don't support Unicode. If
UNICODE is not defined, then we define the LDAP calls without the trailing
'A' (as in ldap_bind rather than ldap_bindA) so that your app may work
with other implementations that don't support Unicode.
The import library has all three forms of the call present... ldap_bindW,
ldap_bindA, and ldap_bind. ldap_bindA simply calls ldap_bind. ldap_bind
simply converts the arguments to unicode and calls ldap_bindW. The
reason this is done is because we have to put UTF-8 on the wire, so if
we converted from Unicode to single byte, we'd loose information. Since
all core processing is done in Unicode, nothing is lost.
Updates :
11/01/96 Modified for new API RFC draft.
Environments :
Win32 user mode
--*/
//
// Only pull in this header file once... controlled by LDAP_CLIENT_DEFINED
// variable.
//
#ifndef LDAP_CLIENT_DEFINED
#define LDAP_CLIENT_DEFINED
#if _MSC_VER > 1000
#pragma once
#endif
#ifdef __cplusplus
extern "C" {
#endif
#ifndef BASETYPES
#include <windef.h>
#endif
#ifndef _SCHNLSP_H_
#include <schnlsp.h>
#endif
#if !defined(_WINLDAP_)
#define WINLDAPAPI DECLSPEC_IMPORT
#else
//#define WINLDAPAPI __declspec(dllexport)
#define WINLDAPAPI
#endif
#ifndef LDAPAPI
#define LDAPAPI __cdecl
#endif
//
// The #define LDAP_UNICODE controls if we map the undecorated calls to
// their unicode counterparts or just leave them defined as the normal
// single byte entry points.
//
// If you want to write a UNICODE enabled application, you'd normally
// just have UNICODE defined and then we'll default to using all LDAP
// Unicode calls.
//
#ifndef LDAP_UNICODE
#ifdef UNICODE
#define LDAP_UNICODE 1
#else
#define LDAP_UNICODE 0
#endif
#endif
//
// Global constants
//
#define LDAP_PORT 389
#define LDAP_SSL_PORT 636
#define LDAP_GC_PORT 3268
#define LDAP_SSL_GC_PORT 3269
//
// The default version of the API is 2. If required, the user MUST set the
// version to 3 using the LDAP_OPT_VERSION option.
//
#define LDAP_VERSION1 1
#define LDAP_VERSION2 2
#define LDAP_VERSION3 3
#define LDAP_VERSION LDAP_VERSION2
//
// All tags are CCFTTTTT.
// CC Tag Class 00 = universal
// 01 = application wide
// 10 = context specific
// 11 = private use
//
// F Form 0 primitive
// 1 constructed
//
// TTTTT Tag Number
//
//
// LDAP v2 & v3 commands.
//
#define LDAP_BIND_CMD 0x60L // application + constructed
#define LDAP_UNBIND_CMD 0x42L // application + primitive
#define LDAP_SEARCH_CMD 0x63L // application + constructed
#define LDAP_MODIFY_CMD 0x66L // application + constructed
#define LDAP_ADD_CMD 0x68L // application + constructed
#define LDAP_DELETE_CMD 0x4aL // application + primitive
#define LDAP_MODRDN_CMD 0x6cL // application + constructed
#define LDAP_COMPARE_CMD 0x6eL // application + constructed
#define LDAP_ABANDON_CMD 0x50L // application + primitive
#define LDAP_SESSION_CMD 0x71L // not in base LDAP protocol
#define LDAP_EXTENDED_CMD 0x77L // application + constructed
//
// Responses/Results for LDAP v2 & v3
//
#define LDAP_RES_BIND 0x61L // application + constructed
#define LDAP_RES_SEARCH_ENTRY 0x64L // application + constructed
#define LDAP_RES_SEARCH_RESULT 0x65L // application + constructed
#define LDAP_RES_MODIFY 0x67L // application + constructed
#define LDAP_RES_ADD 0x69L // application + constructed
#define LDAP_RES_DELETE 0x6bL // application + constructed
#define LDAP_RES_MODRDN 0x6dL // application + constructed
#define LDAP_RES_COMPARE 0x6fL // application + constructed
#define LDAP_RES_SESSION 0x72L // not in base LDAP protocol
#define LDAP_RES_REFERRAL 0x73L // application + constructed
#define LDAP_RES_EXTENDED 0x78L // application + constructed
#define LDAP_RES_ANY (-1L)
#define LDAP_INVALID_CMD 0xff
#define LDAP_INVALID_RES 0xff
//
// We'll make the error codes compatible with reference implementation
//
typedef enum {
LDAP_SUCCESS = 0x00,
LDAP_OPERATIONS_ERROR = 0x01,
LDAP_PROTOCOL_ERROR = 0x02,
LDAP_TIMELIMIT_EXCEEDED = 0x03,
LDAP_SIZELIMIT_EXCEEDED = 0x04,
LDAP_COMPARE_FALSE = 0x05,
LDAP_COMPARE_TRUE = 0x06,
LDAP_AUTH_METHOD_NOT_SUPPORTED = 0x07,
LDAP_STRONG_AUTH_REQUIRED = 0x08,
LDAP_REFERRAL_V2 = 0x09,
LDAP_PARTIAL_RESULTS = 0x09,
LDAP_REFERRAL = 0x0a,
LDAP_ADMIN_LIMIT_EXCEEDED = 0x0b,
LDAP_UNAVAILABLE_CRIT_EXTENSION = 0x0c,
LDAP_CONFIDENTIALITY_REQUIRED = 0x0d,
LDAP_SASL_BIND_IN_PROGRESS = 0x0e,
LDAP_NO_SUCH_ATTRIBUTE = 0x10,
LDAP_UNDEFINED_TYPE = 0x11,
LDAP_INAPPROPRIATE_MATCHING = 0x12,
LDAP_CONSTRAINT_VIOLATION = 0x13,
LDAP_ATTRIBUTE_OR_VALUE_EXISTS = 0x14,
LDAP_INVALID_SYNTAX = 0x15,
LDAP_NO_SUCH_OBJECT = 0x20,
LDAP_ALIAS_PROBLEM = 0x21,
LDAP_INVALID_DN_SYNTAX = 0x22,
LDAP_IS_LEAF = 0x23,
LDAP_ALIAS_DEREF_PROBLEM = 0x24,
LDAP_INAPPROPRIATE_AUTH = 0x30,
LDAP_INVALID_CREDENTIALS = 0x31,
LDAP_INSUFFICIENT_RIGHTS = 0x32,
LDAP_BUSY = 0x33,
LDAP_UNAVAILABLE = 0x34,
LDAP_UNWILLING_TO_PERFORM = 0x35,
LDAP_LOOP_DETECT = 0x36,
LDAP_SORT_CONTROL_MISSING = 0x3C,
LDAP_OFFSET_RANGE_ERROR = 0x3D,
LDAP_NAMING_VIOLATION = 0x40,
LDAP_OBJECT_CLASS_VIOLATION = 0x41,
LDAP_NOT_ALLOWED_ON_NONLEAF = 0x42,
LDAP_NOT_ALLOWED_ON_RDN = 0x43,
LDAP_ALREADY_EXISTS = 0x44,
LDAP_NO_OBJECT_CLASS_MODS = 0x45,
LDAP_RESULTS_TOO_LARGE = 0x46,
LDAP_AFFECTS_MULTIPLE_DSAS = 0x47,
LDAP_VIRTUAL_LIST_VIEW_ERROR = 0x4c,
LDAP_OTHER = 0x50,
LDAP_SERVER_DOWN = 0x51,
LDAP_LOCAL_ERROR = 0x52,
LDAP_ENCODING_ERROR = 0x53,
LDAP_DECODING_ERROR = 0x54,
LDAP_TIMEOUT = 0x55,
LDAP_AUTH_UNKNOWN = 0x56,
LDAP_FILTER_ERROR = 0x57,
LDAP_USER_CANCELLED = 0x58,
LDAP_PARAM_ERROR = 0x59,
LDAP_NO_MEMORY = 0x5a,
LDAP_CONNECT_ERROR = 0x5b,
LDAP_NOT_SUPPORTED = 0x5c,
LDAP_NO_RESULTS_RETURNED = 0x5e,
LDAP_CONTROL_NOT_FOUND = 0x5d,
LDAP_MORE_RESULTS_TO_RETURN = 0x5f,
LDAP_CLIENT_LOOP = 0x60,
LDAP_REFERRAL_LIMIT_EXCEEDED = 0x61
} LDAP_RETCODE;
//
// Bind methods. We support the following methods :
//
// Simple Clear text password... try not to use as it's not secure.
//
// MSN MSN (Microsoft Network) authentication. This package
// may bring up UI to prompt the user for MSN credentials.
//
// DPA Normandy authentication... new MSN authentication. Same
// usage as MSN.
//
// NTLM NT domain authentication. Use NULL credentials and
// we'll try to use default logged in user credentials.
//
// Sicily Negotiate with the server for any of: MSN, DPA, NTLM
// Should be used for LDAPv2 servers only.
//
// Negotiate Use GSSAPI Negotiate package to negotiate security
// package of either Kerberos v5 or NTLM (or any other
// package the client and server negotiate). Pass in
// NULL credentials to specify default logged in user.
// If Negotiate package is not installed on server or
// client, this will fall back to Sicily negotiation.
//
// For all bind methods except for Simple, you may pass in a
// SEC_WINNT_AUTH_IDENTITY_W (defined in rpcdce.h) or the newer
// SEC_WINNT_AUTH_IDENTITY_EXW (defined in secext.h) to specify alternate
// credentials.
//
// All bind methods other than simple are synchronous only calls.
// Calling the asynchronous bind call for any of these messages will
// return LDAP_PARAM_ERROR.
//
// Using any other method besides simple will cause WLDAP32 to pull in
// the SSPI security DLLs (SECURITY.DLL etc).
//
// On non-Simple methods, if you specify NULL credentials, we'll attempt to use
// the default logged in user.
//
#define LDAP_AUTH_SIMPLE 0x80L
#define LDAP_AUTH_SASL 0x83L // don't use... should go away
#define LDAP_AUTH_OTHERKIND 0x86L
// The SICILY type covers package negotiation to MSN servers.
// Each of the supported types can also be specified without
// doing the package negotiation, assuming the caller knows
// what the server supports.
#define LDAP_AUTH_SICILY (LDAP_AUTH_OTHERKIND | 0x0200)
#define LDAP_AUTH_MSN (LDAP_AUTH_OTHERKIND | 0x0800)
#define LDAP_AUTH_NTLM (LDAP_AUTH_OTHERKIND | 0x1000)
#define LDAP_AUTH_DPA (LDAP_AUTH_OTHERKIND | 0x2000)
// This will cause the client to use the GSSAPI negotiation
// package to determine the most appropriate authentication type.
// This type should be used when talking to NT5.
#define LDAP_AUTH_NEGOTIATE (LDAP_AUTH_OTHERKIND | 0x0400)
// backward compatible #define for older constant name.
#define LDAP_AUTH_SSPI LDAP_AUTH_NEGOTIATE
//
// uses the DIGEST-MD5 mechanism.
//
#define LDAP_AUTH_DIGEST (LDAP_AUTH_OTHERKIND | 0x4000)
// The external auth mechanism is used upon setting up an SSL/TLS connection
// to denote that the server must use the client cert credentials presented
// at the outset of the SSL/TLS connection.
#define LDAP_AUTH_EXTERNAL (LDAP_AUTH_OTHERKIND | 0x0020)
//
// Client applications typically don't have to encode/decode LDAP filters,
// but if they do, we define the operators here.
//
// Filter types.
#define LDAP_FILTER_AND 0xa0 // context specific + constructed - SET OF Filters.
#define LDAP_FILTER_OR 0xa1 // context specific + constructed - SET OF Filters.
#define LDAP_FILTER_NOT 0xa2 // context specific + constructed - Filter
#define LDAP_FILTER_EQUALITY 0xa3 // context specific + constructed - AttributeValueAssertion.
#define LDAP_FILTER_SUBSTRINGS 0xa4 // context specific + constructed - SubstringFilter
#define LDAP_FILTER_GE 0xa5 // context specific + constructed - AttributeValueAssertion.
#define LDAP_FILTER_LE 0xa6 // context specific + constructed - AttributeValueAssertion.
#define LDAP_FILTER_PRESENT 0x87 // context specific + primitive - AttributeType.
#define LDAP_FILTER_APPROX 0xa8 // context specific + constructed - AttributeValueAssertion.
#define LDAP_FILTER_EXTENSIBLE 0xa9 // context specific + constructed - MatchingRuleAssertion.
// Substring filter types
#define LDAP_SUBSTRING_INITIAL 0x80L // class context specific
#define LDAP_SUBSTRING_ANY 0x81L // class context specific
#define LDAP_SUBSTRING_FINAL 0x82L // class context specific
//
// Possible values for ld_deref field.
// "Never" - never deref aliases. return only the alias.
// "Searching" - only deref aliases when searching, not when locating
// the base object of a search.
// "Finding" - dereference the alias when locating the base object but
// not during a search.
// "Always" - always dereference aliases.
//
#define LDAP_DEREF_NEVER 0
#define LDAP_DEREF_SEARCHING 1
#define LDAP_DEREF_FINDING 2
#define LDAP_DEREF_ALWAYS 3
// Special values for ld_sizelimit :
#define LDAP_NO_LIMIT 0
// Flags for ld_options field :
#define LDAP_OPT_DNS 0x00000001 // utilize DN & DNS
#define LDAP_OPT_CHASE_REFERRALS 0x00000002 // chase referrals
#define LDAP_OPT_RETURN_REFS 0x00000004 // return referrals to calling app
//
// LDAP structure per connection
//
#if !defined(_WIN64)
#pragma pack(push, 4)
#endif
typedef struct ldap {
struct {
UINT_PTR sb_sd;
UCHAR Reserved1[(10*sizeof(ULONG))+1];
ULONG_PTR sb_naddr; // notzero implies CLDAP available
UCHAR Reserved2[(6*sizeof(ULONG))];
} ld_sb;
//
// Following parameters MAY match up to reference implementation of LDAP
//
PCHAR ld_host;
ULONG ld_version;
UCHAR ld_lberoptions;
//
// Safe to assume that these parameters are in same location as
// reference implementation of LDAP API.
//
ULONG ld_deref;
ULONG ld_timelimit;
ULONG ld_sizelimit;
ULONG ld_errno;
PCHAR ld_matched;
PCHAR ld_error;
ULONG ld_msgid;
UCHAR Reserved3[(6*sizeof(ULONG))+1];
//
// Following parameters may match up to reference implementation of LDAP API.
//
ULONG ld_cldaptries;
ULONG ld_cldaptimeout;
ULONG ld_refhoplimit;
ULONG ld_options;
} LDAP, * PLDAP;
//
// Our timeval structure is a bit different from the reference implementation
// since Win32 defines a _timeval structure that is different from the LDAP
// one.
//
typedef struct l_timeval {
LONG tv_sec;
LONG tv_usec;
} LDAP_TIMEVAL, * PLDAP_TIMEVAL;
//
// The berval structure is used to pass in any arbitrary octet string. It
// is useful for attributes that cannot be represented using a null
// terminated string.
//
typedef struct berval {
ULONG bv_len;
PCHAR bv_val;
} LDAP_BERVAL, * PLDAP_BERVAL, BERVAL, * PBERVAL, BerValue;
//
// The following structure has to be compatible with reference implementation.
//
typedef struct ldapmsg {
ULONG lm_msgid; // message number for given connection
ULONG lm_msgtype; // message type of the form LDAP_RES_xxx
PVOID lm_ber; // ber form of message
struct ldapmsg *lm_chain; // pointer to next result value
struct ldapmsg *lm_next; // pointer to next message
ULONG lm_time;
//
// new fields below not in reference implementation
//
PLDAP Connection; // connection from which we received response
PVOID Request; // owning request (opaque structure)
ULONG lm_returncode; // server's return code
USHORT lm_referral; // index of referral within ref table
BOOLEAN lm_chased; // has referral been chased already?
BOOLEAN lm_eom; // is this the last entry for this message?
BOOLEAN ConnectionReferenced; // is the Connection still valid?
} LDAPMessage, *PLDAPMessage;
//
// Controls... there are three types :
//
// 1) those passed to the server
// 2) those passed to the client and handled by the client API
// 3) those returned by the server
//
typedef struct ldapcontrolA {
PCHAR ldctl_oid;
struct berval ldctl_value;
BOOLEAN ldctl_iscritical;
} LDAPControlA, *PLDAPControlA;
typedef struct ldapcontrolW {
PWCHAR ldctl_oid;
struct berval ldctl_value;
BOOLEAN ldctl_iscritical;
} LDAPControlW, *PLDAPControlW;
#if LDAP_UNICODE
#define LDAPControl LDAPControlW
#define PLDAPControl PLDAPControlW
#else
#define LDAPControl LDAPControlA
#define PLDAPControl PLDAPControlA
#endif
//
// Client controls section : these are the client controls that wldap32.dll
// supports.
//
// If you specify LDAP_CONTROL_REFERRALS in a control, the value field should
// point to a ULONG of the following flags :
//
// LDAP_CHASE_SUBORDINATE_REFERRALS
// LDAP_CHASE_EXTERNAL_REFERRALS
//
#define LDAP_CONTROL_REFERRALS_W L"1.2.840.113556.1.4.616"
#define LDAP_CONTROL_REFERRALS "1.2.840.113556.1.4.616"
//
// Values required for Modification command These are options for the
// mod_op field of LDAPMod structure
//
#define LDAP_MOD_ADD 0x00
#define LDAP_MOD_DELETE 0x01
#define LDAP_MOD_REPLACE 0x02
#define LDAP_MOD_BVALUES 0x80 // AND in this flag if berval structure used
typedef struct ldapmodW {
ULONG mod_op;
PWCHAR mod_type;
union {
PWCHAR *modv_strvals;
struct berval **modv_bvals;
} mod_vals;
} LDAPModW, *PLDAPModW;
typedef struct ldapmodA {
ULONG mod_op;
PCHAR mod_type;
union {
PCHAR *modv_strvals;
struct berval **modv_bvals;
} mod_vals;
} LDAPModA, *PLDAPModA;
#if LDAP_UNICODE
#define LDAPMod LDAPModW
#define PLDAPMod PLDAPModW
#else
#define LDAPMod LDAPModA
#define PLDAPMod PLDAPModA
#endif
#if !defined(_WIN64)
#pragma pack(pop)
#endif
//
// macros compatible with reference implementation...
//
#define LDAP_IS_CLDAP( ld ) ( (ld)->ld_sb.sb_naddr > 0 )
#define mod_values mod_vals.modv_strvals
#define mod_bvalues mod_vals.modv_bvals
#define NAME_ERROR(n) ((n & 0xf0) == 0x20)
//
// function definitions for LDAP API
//
//
// Create a connection block to an LDAP server. HostName can be NULL, in
// which case we'll try to go off and find the "default" LDAP server.
//
// Note that if we have to go off and find the default server, we'll pull
// in NETAPI32.DLL and ADVAPI32.DLL.
//
// If it returns NULL, an error occurred. Pick up error code with
// GetLastError().
//
// ldap_open actually opens the connection at the time of the call,
// whereas ldap_init only opens the connection when an operation is performed
// that requires it.
//
// multi-thread: ldap_open*, ldap_init*, and ldap_sslinit* calls are safe.
//
WINLDAPAPI LDAP * LDAPAPI ldap_openW( __in const PWCHAR HostName, ULONG PortNumber );
WINLDAPAPI LDAP * LDAPAPI ldap_openA( __in const PCHAR HostName, ULONG PortNumber );
WINLDAPAPI LDAP * LDAPAPI ldap_initW( __in const PWCHAR HostName, ULONG PortNumber );
WINLDAPAPI LDAP * LDAPAPI ldap_initA( __in const PCHAR HostName, ULONG PortNumber );
WINLDAPAPI LDAP * LDAPAPI ldap_sslinitW( __in PWCHAR HostName, ULONG PortNumber, int secure );
WINLDAPAPI LDAP * LDAPAPI ldap_sslinitA( __in PCHAR HostName, ULONG PortNumber, int secure );
//
// when calling ldap_init, you can call ldap_connect explicitly to have the
// library contact the server. This is useful for checking for server
// availability. This call is not required however, since the other functions
// will call it internally if it hasn't already been called.
//
WINLDAPAPI ULONG LDAPAPI ldap_connect( LDAP *ld,
struct l_timeval *timeout
);
#if LDAP_UNICODE
#define ldap_open ldap_openW
#define ldap_init ldap_initW
#define ldap_sslinit ldap_sslinitW
#else
WINLDAPAPI LDAP * LDAPAPI ldap_open( __in PCHAR HostName, ULONG PortNumber );
WINLDAPAPI LDAP * LDAPAPI ldap_init( __in PCHAR HostName, ULONG PortNumber );
WINLDAPAPI LDAP * LDAPAPI ldap_sslinit( __in PCHAR HostName, ULONG PortNumber, int secure );
#endif
//
// This is similar to ldap_open except it creates a connection block for
// UDP based Connectionless LDAP services. No TCP session is maintained.
//
// If it returns NULL, an error occurred. Pick up error code with
// GetLastError().
//
// multi-thread: cldap_open* calls are safe.
//
WINLDAPAPI LDAP * LDAPAPI cldap_openW( __in PWCHAR HostName, ULONG PortNumber );
WINLDAPAPI LDAP * LDAPAPI cldap_openA( __in PCHAR HostName, ULONG PortNumber );
#if LDAP_UNICODE
#define cldap_open cldap_openW
#else
WINLDAPAPI LDAP * LDAPAPI cldap_open( __in PCHAR HostName, ULONG PortNumber );
#endif
//
// Call unbind when you're done with the connection, it will free all
// resources associated with the connection.
//
// There is no ldap_close... use ldap_unbind even if you haven't called
// ldap_bind on the connection.
//
// multi-thread: ldap_unbind* calls are safe EXCEPT don't use the LDAP *
// stucture after it's been freed.
//
WINLDAPAPI ULONG LDAPAPI ldap_unbind( LDAP *ld );
WINLDAPAPI ULONG LDAPAPI ldap_unbind_s( LDAP *ld ); // calls ldap_unbind
//
// Calls to get and set options on connection blocks... use them rather
// than modifying the LDAP block directly.
//
//
// multi-thread: ldap_get_option is safe
// multi-thread: ldap_set_option is not safe in that it affects the
// connection as a whole. beware if threads share connections.
WINLDAPAPI ULONG LDAPAPI ldap_get_option( LDAP *ld, int option, void *outvalue );
WINLDAPAPI ULONG LDAPAPI ldap_get_optionW( LDAP *ld, int option, void *outvalue );
WINLDAPAPI ULONG LDAPAPI ldap_set_option( LDAP *ld, int option, const void *invalue );
WINLDAPAPI ULONG LDAPAPI ldap_set_optionW( LDAP *ld, int option, const void *invalue );
#if LDAP_UNICODE
#define ldap_get_option ldap_get_optionW
#define ldap_set_option ldap_set_optionW
#endif
//
// These are the values to pass to ldap_get/set_option :
//
#define LDAP_OPT_API_INFO 0x00
#define LDAP_OPT_DESC 0x01
#define LDAP_OPT_DEREF 0x02
#define LDAP_OPT_SIZELIMIT 0x03
#define LDAP_OPT_TIMELIMIT 0x04
#define LDAP_OPT_THREAD_FN_PTRS 0x05
#define LDAP_OPT_REBIND_FN 0x06
#define LDAP_OPT_REBIND_ARG 0x07
#define LDAP_OPT_REFERRALS 0x08
#define LDAP_OPT_RESTART 0x09
#define LDAP_OPT_SSL 0x0a
#define LDAP_OPT_IO_FN_PTRS 0x0b
#define LDAP_OPT_CACHE_FN_PTRS 0x0d
#define LDAP_OPT_CACHE_STRATEGY 0x0e
#define LDAP_OPT_CACHE_ENABLE 0x0f
#define LDAP_OPT_REFERRAL_HOP_LIMIT 0x10
#define LDAP_OPT_PROTOCOL_VERSION 0x11 // known by two names.
#define LDAP_OPT_VERSION 0x11
#define LDAP_OPT_API_FEATURE_INFO 0x15
//
// These are new ones that we've defined, not in current RFC draft.
//
#define LDAP_OPT_HOST_NAME 0x30
#define LDAP_OPT_ERROR_NUMBER 0x31
#define LDAP_OPT_ERROR_STRING 0x32
#define LDAP_OPT_SERVER_ERROR 0x33
#define LDAP_OPT_SERVER_EXT_ERROR 0x34
#define LDAP_OPT_HOST_REACHABLE 0x3E
//
// These options control the keep-alive logic. Keep alives are sent as
// ICMP ping messages (which currently don't go through firewalls).
//
// There are three values that control how this works :
// PING_KEEP_ALIVE : min number of seconds since we last received a response
// from the server before we send a keep-alive ping
// PING_WAIT_TIME : number of milliseconds we wait for the response to
// come back when we send a ping
// PING_LIMIT : number of unanswered pings we send before we close the
// connection.
//
// To disable the keep-alive logic, set any of the values (PING_KEEP_ALIVE,
// PING_LIMIT, or PING_WAIT_TIME) to zero.
//
// The current default/min/max for these values are as follows :
//
// PING_KEEP_ALIVE : 120/5/maxInt seconds (may also be zero)
// PING_WAIT_TIME : 2000/10/60000 milliseconds (may also be zero)
// PING_LIMIT : 4/0/maxInt
//
#define LDAP_OPT_PING_KEEP_ALIVE 0x36
#define LDAP_OPT_PING_WAIT_TIME 0x37
#define LDAP_OPT_PING_LIMIT 0x38
//
// These won't be in the RFC. Only use these if you're going to be dependent
// on our implementation.
//
#define LDAP_OPT_DNSDOMAIN_NAME 0x3B // return DNS name of domain
#define LDAP_OPT_GETDSNAME_FLAGS 0x3D // flags for DsGetDcName
#define LDAP_OPT_PROMPT_CREDENTIALS 0x3F // prompt for creds? currently
// only for DPA & NTLM if no creds
// are loaded
#define LDAP_OPT_AUTO_RECONNECT 0x91 // enable/disable autoreconnect
#define LDAP_OPT_SSPI_FLAGS 0x92 // flags to pass to InitSecurityContext
//
// To retrieve information on an secure connection, a pointer to a
// SecPkgContext_connectionInfo structure (defined in schannel.h) must be
// passed in. On success, it is filled with relevent security information.
//
#define LDAP_OPT_SSL_INFO 0x93
// backward compatible #define for older constant name.
#define LDAP_OPT_TLS LDAP_OPT_SSL
#define LDAP_OPT_TLS_INFO LDAP_OPT_SSL_INFO
//
// Turing on either the sign or the encrypt option prior to binding using
// LDAP_AUTH_NEGOTIATE will result in the ensuing LDAP session to be signed
// or encrypted using Kerberos. Note that these options can't be used with SSL.
//
#define LDAP_OPT_SIGN 0x95
#define LDAP_OPT_ENCRYPT 0x96
//
// The user can set a preferred SASL method prior to binding using LDAP_AUTH_NEGOTIATE
// We will try to use this mechanism while binding. One example is "GSSAPI".
//
#define LDAP_OPT_SASL_METHOD 0x97
//
// Setting this option to LDAP_OPT_ON will instruct the library to only perform an
// A-Record DNS lookup on the supplied host string. This option is OFF by default.
//
#define LDAP_OPT_AREC_EXCLUSIVE 0x98
//
// Retrieve the security context associated with the connection.
//
#define LDAP_OPT_SECURITY_CONTEXT 0x99
//
// Enable/Disable the built-in RootDSE cache. This option is ON by default.
//
#define LDAP_OPT_ROOTDSE_CACHE 0x9a
//
// Turns on TCP keep-alives. This is separate from the ICMP ping keep-alive
// mechanism (discussed above), and enables the keep-alive mechanism built into
// the TCP protocol. This has no effect when using connectionless (UDP) LDAP.
// This option is OFF by default.
//
#define LDAP_OPT_TCP_KEEPALIVE 0x40
//
// Turns on support for fast concurrent binds (extended operation
// 1.2.840.113556.1.4.1781). This option can be set only on a fresh
// (never bound/authenticated) connection. Setting this option will
// (1) switch the client into a mode where it supports simultaneous
// simple binds on the connection, and (2) sends the extended operation
// to the server to switch it into fast bind mode. Only simple binds
// are supported in this mode.
//
#define LDAP_OPT_FAST_CONCURRENT_BIND 0x41
#define LDAP_OPT_SEND_TIMEOUT 0x42
//
// Flags to control the behavior of Schannel
//
#define LDAP_OPT_SCH_FLAGS 0x43
//
// List of local interface addresses (IPv4 or IPv6) that will be used for
// socket bind when establishing a connecting.
//
#define LDAP_OPT_SOCKET_BIND_ADDRESSES 0x44
//
// End of Microsoft only options
//
#define LDAP_OPT_ON ((void *) 1)
#define LDAP_OPT_OFF ((void *) 0)
//
// For chasing referrals, we extend this a bit for LDAP_OPT_REFERRALS. If
// the value is not LDAP_OPT_ON or LDAP_OPT_OFF, we'll treat them as the
// following :
//
// LDAP_CHASE_SUBORDINATE_REFERRALS : chase subordinate referrals (or
// references) returned in a v3 search
// LDAP_CHASE_EXTERNAL_REFERRALS : chase external referrals. These are
// returned possibly on any operation except bind.
//
// If you OR these flags together, it's equivalent to setting referrals to
// LDAP_OPT_ON.
//
#define LDAP_CHASE_SUBORDINATE_REFERRALS 0x00000020
#define LDAP_CHASE_EXTERNAL_REFERRALS 0x00000040
//
// Bind is required as the first operation to v2 servers, not so for v3
// servers. See above description of authentication methods.
//
// multi-thread: bind calls are not safe in that it affects the
// connection as a whole. beware if threads share connections
// and try to mulithread binds with other operations.
WINLDAPAPI ULONG LDAPAPI ldap_simple_bindW( LDAP *ld, __in_opt PWCHAR dn, __in_opt PWCHAR passwd );
WINLDAPAPI ULONG LDAPAPI ldap_simple_bindA( LDAP *ld, __in_opt PCHAR dn, __in_opt PCHAR passwd );
WINLDAPAPI ULONG LDAPAPI ldap_simple_bind_sW( LDAP *ld, __in_opt PWCHAR dn, __in_opt PWCHAR passwd );
WINLDAPAPI ULONG LDAPAPI ldap_simple_bind_sA( LDAP *ld, __in_opt PCHAR dn, __in_opt PCHAR passwd );
WINLDAPAPI ULONG LDAPAPI ldap_bindW( LDAP *ld, __in_opt PWCHAR dn, __in_opt PWCHAR cred, ULONG method );
WINLDAPAPI ULONG LDAPAPI ldap_bindA( LDAP *ld, __in_opt PCHAR dn, __in_opt PCHAR cred, ULONG method );
WINLDAPAPI ULONG LDAPAPI ldap_bind_sW( LDAP *ld, __in_opt PWCHAR dn, __in_opt PWCHAR cred, ULONG method );
WINLDAPAPI ULONG LDAPAPI ldap_bind_sA( LDAP *ld, __in_opt PCHAR dn, __in_opt PCHAR cred, ULONG method );
//
// The following functions can be used to pass in any arbitrary credentials
// to the server. The application must be ready to interpret the response
// sent back from the server.
//
WINLDAPAPI INT LDAPAPI ldap_sasl_bindA(
LDAP *ExternalHandle,
__in const PCHAR DistName,
__in const PCHAR AuthMechanism,
const BERVAL *cred,
PLDAPControlA *ServerCtrls,
PLDAPControlA *ClientCtrls,
int *MessageNumber
);
WINLDAPAPI INT LDAPAPI ldap_sasl_bindW(
LDAP *ExternalHandle,
__in const PWCHAR DistName,
__in const PWCHAR AuthMechanism,
const BERVAL *cred,
PLDAPControlW *ServerCtrls,
PLDAPControlW *ClientCtrls,
int *MessageNumber
);
WINLDAPAPI INT LDAPAPI ldap_sasl_bind_sA(
LDAP *ExternalHandle,
__in const PCHAR DistName,
__in const PCHAR AuthMechanism,
const BERVAL *cred,
PLDAPControlA *ServerCtrls,
PLDAPControlA *ClientCtrls,
PBERVAL *ServerData
);
WINLDAPAPI INT LDAPAPI ldap_sasl_bind_sW(
LDAP *ExternalHandle,
__in const PWCHAR DistName,
__in const PWCHAR AuthMechanism,
const BERVAL *cred,
PLDAPControlW *ServerCtrls,
PLDAPControlW *ClientCtrls,
PBERVAL *ServerData
);
#if LDAP_UNICODE
#define ldap_simple_bind ldap_simple_bindW
#define ldap_simple_bind_s ldap_simple_bind_sW
#define ldap_bind ldap_bindW
#define ldap_bind_s ldap_bind_sW
#define ldap_sasl_bind ldap_sasl_bindW
#define ldap_sasl_bind_s ldap_sasl_bind_sW
#else
WINLDAPAPI ULONG LDAPAPI ldap_simple_bind( LDAP *ld, __in_opt const PCHAR dn, __in_opt const PCHAR passwd );
WINLDAPAPI ULONG LDAPAPI ldap_simple_bind_s( LDAP *ld, __in_opt const PCHAR dn, __in_opt const PCHAR passwd );
WINLDAPAPI ULONG LDAPAPI ldap_bind( LDAP *ld, __in_opt const PCHAR dn, __in_opt const PCHAR cred, ULONG method );
WINLDAPAPI ULONG LDAPAPI ldap_bind_s( LDAP *ld, __in_opt const PCHAR dn, __in_opt const PCHAR cred, ULONG method );
#define ldap_sasl_bind ldap_sasl_bindA
#define ldap_sasl_bind_s ldap_sasl_bind_sA
#endif
//
// Synchronous and asynch search routines.
//
// filter follows RFC 1960 with the addition that '(' ')' '*' ' ' '\' and
// '\0' are all escaped with '\'
//
// Scope of search. This corresponds to the "scope" parameter on search
#define LDAP_SCOPE_BASE 0x00
#define LDAP_SCOPE_ONELEVEL 0x01
#define LDAP_SCOPE_SUBTREE 0x02
//
// multi-thread: ldap_search calls are not safe in that the message number
// is returned rather than the return code. You have to look
// at the connection block in an error case and the return code
// may be overwritten by another thread inbetween.
//
// Use ldap_search_ext instead, as these are thread safe.
//
// ldap_search_s and ldap_search_ext* calls are thread safe.
//
WINLDAPAPI ULONG LDAPAPI ldap_searchW(
LDAP *ld,
__in const PWCHAR base, // distinguished name or ""
ULONG scope, // LDAP_SCOPE_xxxx
__in const PWCHAR filter,
__in PWCHAR attrs[], // pointer to an array of PCHAR attribute names
ULONG attrsonly // boolean on whether to only return attr names
);
WINLDAPAPI ULONG LDAPAPI ldap_searchA(
LDAP *ld,
__in const PCHAR base, // distinguished name or ""
ULONG scope, // LDAP_SCOPE_xxxx
__in const PCHAR filter,