s3-includes: only include system/filesys.h when needed.
[ira/wip.git] / source3 / utils / net_idmap.c
index dd16c4b02d937f31bde97441f41f56845c49571e..79f69f24a13fd33ffdeb02c3d81995279b5508e0 100644 (file)
-/* 
-   Samba Unix/Linux SMB client library 
-   Distributed SMB/CIFS Server Management Utility 
+/*
+   Samba Unix/Linux SMB client library
+   Distributed SMB/CIFS Server Management Utility
    Copyright (C) 2003 Andrew Bartlett (abartlet@samba.org)
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
 
+#define FOO(x) (x)
 #include "includes.h"
+#include "system/filesys.h"
 #include "utils/net.h"
+#include "secrets.h"
+#include "idmap.h"
+#include "dbwrap.h"
+#include "../libcli/security/security.h"
 
 #define ALLOC_CHECK(mem) do { \
        if (!mem) { \
-               d_fprintf(stderr, "Out of memory!\n"); \
+               d_fprintf(stderr, _("Out of memory!\n")); \
                talloc_free(ctx); \
                return -1; \
        } } while(0)
 
 /***********************************************************
- Dump the current idmap
+ Helper function for net_idmap_dump. Dump one entry.
  **********************************************************/
-static int net_idmap_dump(int argc, const char **argv)
+static int net_idmap_dump_one_entry(struct db_record *rec,
+                                   void *unused)
 {
-       TALLOC_CTX *ctx;
-       char *filename;
-
-       if (argc != 1) {
-               return net_help_idmap(argc, argv);
+       if (strcmp((char *)rec->key.dptr, "USER HWM") == 0) {
+               printf(_("USER HWM %d\n"), IVAL(rec->value.dptr,0));
+               return 0;
        }
 
-       if (! winbind_ping()) {
-               d_fprintf(stderr, "To use net idmap Winbindd must be running.\n");
-               return -1;
+       if (strcmp((char *)rec->key.dptr, "GROUP HWM") == 0) {
+               printf(_("GROUP HWM %d\n"), IVAL(rec->value.dptr,0));
+               return 0;
        }
 
-       ctx = talloc_new(NULL);
-       ALLOC_CHECK(ctx);
+       if (strncmp((char *)rec->key.dptr, "S-", 2) != 0)
+               return 0;
 
-       filename = talloc_strdup(ctx, argv[0]);
-       ALLOC_CHECK(filename);
-
-       /* filename must be absolute */
-       if (*filename != '/') {
-               char path[4096];
-               
-               filename = getcwd(path, 4095);
-               if ( ! filename) {
-                       d_fprintf(stderr, "Failed to obtain full output file path");
-                       talloc_free(ctx);
-                       return -1;
+       printf("%s %s\n", rec->value.dptr, rec->key.dptr);
+       return 0;
+}
+
+static const char* net_idmap_dbfile(struct net_context *c)
+{
+       const char* dbfile = NULL;
+
+       if (c->opt_db != NULL) {
+               dbfile = talloc_strdup(talloc_tos(), c->opt_db);
+               if (dbfile == NULL) {
+                       d_fprintf(stderr, _("Out of memory!\n"));
+               }
+       } else if (strequal(lp_idmap_backend(), "tdb")) {
+               dbfile = state_path("winbindd_idmap.tdb");
+               if (dbfile == NULL) {
+                       d_fprintf(stderr, _("Out of memory!\n"));
+               }
+       } else if (strequal(lp_idmap_backend(), "tdb2")) {
+               dbfile = lp_parm_talloc_string(-1, "tdb", "idmap2.tdb", NULL);
+               if (dbfile == NULL) {
+                       dbfile = talloc_asprintf(talloc_tos(), "%s/idmap2.tdb",
+                                                lp_private_dir());
+               }
+               if (dbfile == NULL) {
+                       d_fprintf(stderr, _("Out of memory!\n"));
+               }
+       } else {
+               char* backend = talloc_strdup(talloc_tos(), lp_idmap_backend());
+               char* args = strchr(backend, ':');
+               if (args != NULL) {
+                       *args = '\0';
                }
 
-               filename = talloc_asprintf(ctx, "%s/%s", path, argv[0]);
-               ALLOC_CHECK(filename);
+               d_printf(_("Sorry, 'idmap backend = %s' is currently not supported\n"),
+                        backend);
+
+               talloc_free(backend);
        }
 
-       if ( ! winbind_idmap_dump_maps(ctx, filename)) {
-               d_fprintf(stderr, "Failed to obtain idmap data from winbindd\n");
-               talloc_free(ctx);
-               return -1;
+       return dbfile;
+}
+
+/***********************************************************
+ Dump the current idmap
+ **********************************************************/
+static int net_idmap_dump(struct net_context *c, int argc, const char **argv)
+{
+       struct db_context *db;
+       TALLOC_CTX *mem_ctx;
+       const char* dbfile;
+       int ret = -1;
+
+       if ( argc > 1  || c->display_usage) {
+               d_printf("%s\n%s",
+                        _("Usage:"),
+                        _("net idmap dump [[--db=]<inputfile>]\n"
+                          "  Dump current ID mapping.\n"
+                          "    inputfile\tTDB file to read mappings from.\n"));
+               return c->display_usage?0:-1;
        }
 
-       talloc_free(ctx);
-       return 0;
+       mem_ctx = talloc_stackframe();
+
+       dbfile = (argc > 0) ? argv[0] : net_idmap_dbfile(c);
+       if (dbfile == NULL) {
+               goto done;
+       }
+       d_fprintf(stderr, _("dumping id mapping from %s\n"), dbfile);
+
+       db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDONLY, 0);
+       if (db == NULL) {
+               d_fprintf(stderr, _("Could not open idmap db (%s): %s\n"),
+                         dbfile, strerror(errno));
+               goto done;
+       }
+
+       db->traverse_read(db, net_idmap_dump_one_entry, NULL);
+       ret = 0;
+
+done:
+       talloc_free(mem_ctx);
+       return ret;
 }
 
 /***********************************************************
  Write entries from stdin to current local idmap
  **********************************************************/
 
-static int net_idmap_restore(int argc, const char **argv)
+static int net_idmap_store_id_mapping(struct db_context *db,
+                                     enum id_type type,
+                                     unsigned long idval,
+                                     const char *sid_string)
 {
-       TALLOC_CTX *ctx;
-       FILE *input;
+       NTSTATUS status;
+       char *idstr = NULL;
+
+       switch(type) {
+       case ID_TYPE_UID:
+               idstr = talloc_asprintf(talloc_tos(), "UID %lu", idval);
+               break;
+       case ID_TYPE_GID:
+               idstr = talloc_asprintf(talloc_tos(), "GID %lu", idval);
+               break;
+       default:
+               d_fprintf(stderr, "Invalid id mapping type: %d\n", type);
+               return -1;
+       }
 
-       if (! winbind_ping()) {
-               d_fprintf(stderr, "To use net idmap Winbindd must be running.\n");
+       status = dbwrap_store_bystring(db, idstr,
+                                      string_term_tdb_data(sid_string),
+                                      TDB_REPLACE);
+       if (!NT_STATUS_IS_OK(status)) {
+               d_fprintf(stderr, "Error storing ID -> SID: "
+                        "%s\n", nt_errstr(status));
+               talloc_free(idstr);
+               return -1;
+       }
+       status = dbwrap_store_bystring(db, sid_string,
+                                      string_term_tdb_data(idstr),
+                                      TDB_REPLACE);
+       if (!NT_STATUS_IS_OK(status)) {
+               d_fprintf(stderr, "Error storing SID -> ID: "
+                        "%s\n", nt_errstr(status));
+               talloc_free(idstr);
                return -1;
        }
 
-       ctx = talloc_new(NULL);
-       ALLOC_CHECK(ctx);
+       return 0;
+}
+
+static int net_idmap_restore(struct net_context *c, int argc, const char **argv)
+{
+       TALLOC_CTX *mem_ctx;
+       FILE *input = NULL;
+       struct db_context *db;
+       const char *dbfile = NULL;
+       int ret = 0;
+
+       if (c->display_usage) {
+               d_printf("%s\n%s",
+                        _("Usage:"),
+                        _("net idmap restore [--db=<TDB>] [<inputfile>]\n"
+                          "  Restore ID mappings from file\n"
+                          "    TDB\tFile to store ID mappings to."
+                          "    inputfile\tFile to load ID mappings from. If not "
+                          "given, load data from stdin.\n"));
+               return 0;
+       }
+
+       mem_ctx = talloc_stackframe();
+
+       dbfile = net_idmap_dbfile(c);
+
+       if (dbfile == NULL) {
+               ret = -1;
+               goto done;
+       }
+
+       d_fprintf(stderr, _("restoring id mapping to %s\n"), dbfile);
 
        if (argc == 1) {
                input = fopen(argv[0], "r");
+               if (input == NULL) {
+                       d_fprintf(stderr, _("Could not open input file (%s): %s\n"),
+                                 argv[0], strerror(errno));
+                       ret = -1;
+                       goto done;
+               }
        } else {
                input = stdin;
        }
 
+       db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0644);
+       if (db == NULL) {
+               d_fprintf(stderr, _("Could not open idmap db (%s): %s\n"),
+                         dbfile, strerror(errno));
+               ret = -1;
+               goto done;
+       }
+
+       if (db->transaction_start(db) != 0) {
+               d_fprintf(stderr, _("Failed to start transaction.\n"));
+               ret = -1;
+               goto done;
+       }
+
        while (!feof(input)) {
                char line[128], sid_string[128];
                int len;
-               DOM_SID sid;
-               struct id_map map;
                unsigned long idval;
 
                if (fgets(line, 127, input) == NULL)
@@ -113,79 +252,216 @@ static int net_idmap_restore(int argc, const char **argv)
                if ( (len > 0) && (line[len-1] == '\n') )
                        line[len-1] = '\0';
 
-               if (sscanf(line, "GID %lu %128s", &idval, sid_string) == 2) {
-                       map.xid.type = ID_TYPE_GID;
-                       map.xid.id = idval;
-               } else if (sscanf(line, "UID %lu %128s", &idval, sid_string) == 2) {
-                       map.xid.type = ID_TYPE_UID;
-                       map.xid.id = idval;
+               if (sscanf(line, "GID %lu %128s", &idval, sid_string) == 2)
+               {
+                       ret = net_idmap_store_id_mapping(db, ID_TYPE_GID,
+                                                        idval, sid_string);
+                       if (ret != 0) {
+                               break;
+                       }
+               } else if (sscanf(line, "UID %lu %128s", &idval, sid_string) == 2)
+               {
+                       ret = net_idmap_store_id_mapping(db, ID_TYPE_UID,
+                                                        idval, sid_string);
+                       if (ret != 0) {
+                               break;
+                       }
                } else if (sscanf(line, "USER HWM %lu", &idval) == 1) {
-                       /* set uid hwm */
-                       if (! winbind_set_uid_hwm(idval)) {
-                               d_fprintf(stderr, "Could not set USER HWM\n");
+                       ret = dbwrap_store_int32(db, "USER HWM", idval);
+                       if (ret != 0) {
+                               d_fprintf(stderr, _("Could not store USER HWM.\n"));
+                               break;
                        }
-                       continue;
                } else if (sscanf(line, "GROUP HWM %lu", &idval) == 1) {
-                       /* set gid hwm */
-                       if (! winbind_set_gid_hwm(idval)) {
-                               d_fprintf(stderr, "Could not set GROUP HWM\n");
+                       ret = dbwrap_store_int32(db, "GROUP HWM", idval);
+                       if (ret != 0) {
+                               d_fprintf(stderr,
+                                         _("Could not store GROUP HWM.\n"));
+                               break;
                        }
-                       continue;
                } else {
-                       d_fprintf(stderr, "ignoring invalid line [%s]\n", line);
+                       d_fprintf(stderr, _("ignoring invalid line [%s]\n"),
+                                 line);
                        continue;
                }
+       }
 
-               if (!string_to_sid(&sid, sid_string)) {
-                       d_fprintf(stderr, "ignoring invalid sid [%s]\n", sid_string);
-                       continue;
+       if (ret == 0) {
+               if(db->transaction_commit(db) != 0) {
+                       d_fprintf(stderr, _("Failed to commit transaction.\n"));
+                       ret = -1;
                }
-               map.sid = &sid;
-
-               if (!winbind_set_mapping(&map)) {
-                       d_fprintf(stderr, "Could not set mapping of %s %lu to sid %s\n",
-                                (map.xid.type == ID_TYPE_GID) ? "GID" : "UID",
-                                (unsigned long)map.xid.id, sid_string_static(map.sid));
-                       continue;
+       } else {
+               if (db->transaction_cancel(db) != 0) {
+                       d_fprintf(stderr, _("Failed to cancel transaction.\n"));
                }
-                        
        }
 
-       if (input != stdin) {
+done:
+       if ((input != NULL) && (input != stdin)) {
                fclose(input);
        }
 
-       talloc_free(ctx);
-       return 0;
+       talloc_free(mem_ctx);
+       return ret;
+}
+
+static
+NTSTATUS dbwrap_delete_mapping(struct db_context *db, TDB_DATA key1, bool force)
+{
+       TALLOC_CTX* mem_ctx = talloc_tos();
+       struct db_record *rec1=NULL, *rec2=NULL;
+       TDB_DATA key2;
+       bool is_valid_mapping;
+       NTSTATUS status = NT_STATUS_OK;
+
+       rec1 = db->fetch_locked(db, mem_ctx, key1);
+       if (rec1 == NULL) {
+               DEBUG(1, ("failed to fetch: %.*s\n", (int)key1.dsize, key1.dptr));
+               status = NT_STATUS_NO_MEMORY;
+               goto done;
+       }
+       key2 = rec1->value;
+       if (key2.dptr == NULL) {
+               DEBUG(1, ("could not find %.*s\n", (int)key1.dsize, key1.dptr));
+               status = NT_STATUS_NOT_FOUND;
+               goto done;
+       }
+
+       DEBUG(2, ("mapping: %.*s -> %.*s\n",
+                 (int)key1.dsize, key1.dptr, (int)key2.dsize, key2.dptr));
+
+       rec2 = db->fetch_locked(db, mem_ctx, key2);
+       if (rec2 == NULL) {
+               DEBUG(1, ("failed to fetch: %.*s\n", (int)key2.dsize, key2.dptr));
+               status = NT_STATUS_NO_MEMORY;
+               goto done;
+       }
+
+       is_valid_mapping = tdb_data_equal(key1, rec2->value);
+
+       if (!is_valid_mapping) {
+               DEBUG(1, ("invalid mapping: %.*s -> %.*s -> %.*s\n",
+                         (int)key1.dsize, key1.dptr, (int)key2.dsize, key2.dptr,
+                         (int)rec2->value.dsize, rec2->value.dptr ));
+               if ( !force ) {
+                       status = NT_STATUS_FILE_INVALID;
+                       goto done;
+               }
+       }
+
+       status = rec1->delete_rec(rec1);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(1, ("failed to delete: %.*s\n", (int)key1.dsize, key1.dptr));
+               goto done;
+       }
+
+       if (is_valid_mapping) {
+               status = rec2->delete_rec(rec2);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DEBUG(1, ("failed to delete: %.*s\n", (int)key2.dsize, key2.dptr));
+               }
+       }
+done:
+       TALLOC_FREE(rec1);
+       TALLOC_FREE(rec2);
+       return status;
+}
+
+static
+NTSTATUS delete_mapping_action(struct db_context *db, void* data)
+{
+       return dbwrap_delete_mapping(db, *(TDB_DATA*)data, false);
+}
+static
+NTSTATUS delete_mapping_action_force(struct db_context *db, void* data)
+{
+       return dbwrap_delete_mapping(db, *(TDB_DATA*)data, true);
 }
 
 /***********************************************************
  Delete a SID mapping from a winbindd_idmap.tdb
  **********************************************************/
-static int net_idmap_delete(int argc, const char **argv)
+static bool delete_args_ok(int argc, const char **argv)
 {
-       d_printf("Not Implemented yet\n");
-       return -1;
+       if (argc != 1)
+               return false;
+       if (strncmp(argv[0], "S-", 2) == 0)
+               return true;
+       if (strncmp(argv[0], "GID ", 4) == 0)
+               return true;
+       if (strncmp(argv[0], "UID ", 4) == 0)
+               return true;
+       return false;
 }
 
-static int net_idmap_set(int argc, const char **argv)
+static int net_idmap_delete(struct net_context *c, int argc, const char **argv)
 {
-       d_printf("Not Implemented yet\n");
+       int ret = -1;
+       struct db_context *db;
+       TALLOC_CTX *mem_ctx;
+       TDB_DATA key;
+       NTSTATUS status;
+       const char* dbfile;
+
+       if ( !delete_args_ok(argc,argv) || c->display_usage) {
+               d_printf("%s\n%s",
+                        _("Usage:"),
+                        _("net idmap delete [-f] [--db=<TDB>] <ID>\n"
+                          "  Delete mapping of ID from TDB.\n"
+                          "    -f\tforce\n"
+                          "    TDB\tidmap database\n"
+                          "    ID\tSID|GID|UID\n"));
+               return c->display_usage ? 0 : -1;
+       }
+
+       mem_ctx = talloc_stackframe();
+
+       dbfile = net_idmap_dbfile(c);
+       if (dbfile == NULL) {
+               goto done;
+       }
+       d_fprintf(stderr, _("deleting id mapping from %s\n"), dbfile);
+
+       db = db_open(mem_ctx, dbfile, 0, TDB_DEFAULT, O_RDWR, 0);
+       if (db == NULL) {
+               d_fprintf(stderr, _("Could not open idmap db (%s): %s\n"),
+                         dbfile, strerror(errno));
+               goto done;
+       }
+
+       key = string_term_tdb_data(argv[0]);
+
+       status = dbwrap_trans_do(db, (c->opt_force
+                                     ? delete_mapping_action_force
+                                     : delete_mapping_action),  &key);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               d_fprintf(stderr, _("could not delete mapping: %s\n"),
+                         nt_errstr(status));
+               goto done;
+       }
+       ret = 0;
+done:
+       talloc_free(mem_ctx);
+       return ret;
+}
+
+static int net_idmap_set(struct net_context *c, int argc, const char **argv)
+{
+       d_printf("%s\n", _("Not implemented yet"));
        return -1;
 }
-BOOL idmap_store_secret(const char *backend, bool alloc,
-                       const char *domain, const char *identity,
-                       const char *secret)
+static bool idmap_store_secret(const char *backend,
+                              const char *domain,
+                              const char *identity,
+                              const char *secret)
 {
        char *tmp;
        int r;
-       BOOL ret;
+       bool ret;
 
-       if (alloc) {
-               r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
-       } else {
-               r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
-       }
+       r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
 
        if (r < 0) return false;
 
@@ -197,7 +473,7 @@ BOOL idmap_store_secret(const char *backend, bool alloc,
 }
 
 
-static int net_idmap_secret(int argc, const char **argv)
+static int net_idmap_secret(struct net_context *c, int argc, const char **argv)
 {
        TALLOC_CTX *ctx;
        const char *secret;
@@ -205,10 +481,16 @@ static int net_idmap_secret(int argc, const char **argv)
        char *domain;
        char *backend;
        char *opt = NULL;
-       BOOL ret;
-
-       if (argc != 2) {
-               return net_help_idmap(argc, argv);
+       bool ret;
+
+       if (argc != 2 || c->display_usage) {
+               d_printf("%s\n%s",
+                        _("Usage:\n"),
+                        _("net idmap secret <DOMAIN> <secret>\n"
+                          "  Set the secret for the specified domain\n"
+                          "    DOMAIN\tDomain to set secret for.\n"
+                          "    secret\tNew secret to set.\n"));
+               return c->display_usage?0:-1;
        }
 
        secret = argv[1];
@@ -216,89 +498,165 @@ static int net_idmap_secret(int argc, const char **argv)
        ctx = talloc_new(NULL);
        ALLOC_CHECK(ctx);
 
-       if (strcmp(argv[0], "alloc") == 0) {
-               domain = NULL;
-               backend = lp_idmap_alloc_backend();
-       } else {
-               domain = talloc_strdup(ctx, argv[0]);
-               ALLOC_CHECK(domain);
+       domain = talloc_strdup(ctx, argv[0]);
+       ALLOC_CHECK(domain);
 
-               opt = talloc_asprintf(ctx, "idmap config %s", domain);
-               ALLOC_CHECK(opt);
+       opt = talloc_asprintf(ctx, "idmap config %s", domain);
+       ALLOC_CHECK(opt);
 
-               backend = talloc_strdup(ctx, lp_parm_const_string(-1, opt, "backend", "tdb"));
-               ALLOC_CHECK(backend);
-       }
+       backend = talloc_strdup(ctx, lp_parm_const_string(-1, opt, "backend", "tdb"));
+       ALLOC_CHECK(backend);
 
        if ( ( ! backend) || ( ! strequal(backend, "ldap"))) {
-               d_fprintf(stderr, "The only currently supported backend is LDAP\n");
+               d_fprintf(stderr,
+                         _("The only currently supported backend is LDAP\n"));
                talloc_free(ctx);
                return -1;
        }
 
-       if (domain) {
-
-               dn = lp_parm_const_string(-1, opt, "ldap_user_dn", NULL);
-               if ( ! dn) {
-                       d_fprintf(stderr, "Missing ldap_user_dn option for domain %s\n", domain);
-                       talloc_free(ctx);
-                       return -1;
-               }
-
-               ret = idmap_store_secret("ldap", false, domain, dn, secret);
-       } else {
-               dn = lp_parm_const_string(-1, "idmap alloc config", "ldap_user_dn", NULL);
-               if ( ! dn) {
-                       d_fprintf(stderr, "Missing ldap_user_dn option for alloc backend\n");
-                       talloc_free(ctx);
-                       return -1;
-               }
-
-               ret = idmap_store_secret("ldap", true, NULL, dn, secret);
+       dn = lp_parm_const_string(-1, opt, "ldap_user_dn", NULL);
+       if ( ! dn) {
+               d_fprintf(stderr,
+                         _("Missing ldap_user_dn option for domain %s\n"),
+                         domain);
+               talloc_free(ctx);
+               return -1;
        }
 
+       ret = idmap_store_secret("ldap", domain, dn, secret);
+
        if ( ! ret) {
-               d_fprintf(stderr, "Failed to store secret\n");
+               d_fprintf(stderr, _("Failed to store secret\n"));
                talloc_free(ctx);
                return -1;
        }
 
-       d_printf("Secret stored\n");
+       d_printf(_("Secret stored\n"));
        return 0;
 }
 
-int net_help_idmap(int argc, const char **argv)
+static int net_idmap_aclmapset(struct net_context *c, int argc, const char **argv)
 {
-       d_printf("net idmap dump <outputfile>\n"\
-                "    Dump current id mapping\n");
+       TALLOC_CTX *mem_ctx;
+       int result = -1;
+       struct dom_sid src_sid, dst_sid;
+       char *src, *dst;
+       struct db_context *db;
+       struct db_record *rec;
+       NTSTATUS status;
+
+       if (argc != 3 || c->display_usage) {
+               d_fprintf(stderr, "%s net idmap aclmapset <tdb> "
+                         "<src-sid> <dst-sid>\n", _("Usage:"));
+               return -1;
+       }
 
-       d_printf("net idmap restore\n"\
-                "    Restore entries from stdin\n");
+       if (!(mem_ctx = talloc_init("net idmap aclmapset"))) {
+               d_fprintf(stderr, _("talloc_init failed\n"));
+               return -1;
+       }
 
-       /* Deliberately *not* document net idmap delete */
+       if (!(db = db_open(mem_ctx, argv[0], 0, TDB_DEFAULT,
+                          O_RDWR|O_CREAT, 0600))) {
+               d_fprintf(stderr, _("db_open failed: %s\n"), strerror(errno));
+               goto fail;
+       }
 
-       d_printf("net idmap secret <DOMAIN>|alloc <secret>\n"\
-                "    Set the secret for the specified DOMAIN (or the alloc module)\n");
+       if (!string_to_sid(&src_sid, argv[1])) {
+               d_fprintf(stderr, _("%s is not a valid sid\n"), argv[1]);
+               goto fail;
+       }
 
-       return -1;
+       if (!string_to_sid(&dst_sid, argv[2])) {
+               d_fprintf(stderr, _("%s is not a valid sid\n"), argv[2]);
+               goto fail;
+       }
+
+       if (!(src = sid_string_talloc(mem_ctx, &src_sid))
+           || !(dst = sid_string_talloc(mem_ctx, &dst_sid))) {
+               d_fprintf(stderr, _("talloc_strdup failed\n"));
+               goto fail;
+       }
+
+       if (!(rec = db->fetch_locked(
+                     db, mem_ctx, string_term_tdb_data(src)))) {
+               d_fprintf(stderr, _("could not fetch db record\n"));
+               goto fail;
+       }
+
+       status = rec->store(rec, string_term_tdb_data(dst), 0);
+       TALLOC_FREE(rec);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               d_fprintf(stderr, _("could not store record: %s\n"),
+                         nt_errstr(status));
+               goto fail;
+       }
+
+       result = 0;
+fail:
+       TALLOC_FREE(mem_ctx);
+       return result;
 }
 
 /***********************************************************
  Look at the current idmap
  **********************************************************/
-int net_idmap(int argc, const char **argv)
+int net_idmap(struct net_context *c, int argc, const char **argv)
 {
        struct functable func[] = {
-               {"dump", net_idmap_dump},
-               {"restore", net_idmap_restore},
-               {"setmap", net_idmap_set },
-               {"delete", net_idmap_delete},
-               {"secret", net_idmap_secret},
-               {"help", net_help_idmap},
-               {NULL, NULL}
+               {
+                       "dump",
+                       net_idmap_dump,
+                       NET_TRANSPORT_LOCAL,
+                       N_("Dump the current ID mappings"),
+                       N_("net idmap dump\n"
+                          "  Dump the current ID mappings")
+               },
+               {
+                       "restore",
+                       net_idmap_restore,
+                       NET_TRANSPORT_LOCAL,
+                       N_("Restore entries from stdin"),
+                       N_("net idmap restore\n"
+                          "  Restore entries from stdin")
+               },
+               {
+                       "setmap",
+                       net_idmap_set,
+                       NET_TRANSPORT_LOCAL,
+                       N_("Not implemented yet"),
+                       N_("net idmap setmap\n"
+                          "  Not implemented yet")
+               },
+               {
+                       "delete",
+                       net_idmap_delete,
+                       NET_TRANSPORT_LOCAL,
+                       N_("Delete ID mapping"),
+                       N_("net idmap delete <ID>\n"
+                          "  Delete ID mapping")
+               },
+               {
+                       "secret",
+                       net_idmap_secret,
+                       NET_TRANSPORT_LOCAL,
+                       N_("Set secret for specified domain"),
+                       N_("net idmap secret <DOMAIN> <secret>\n"
+                          "  Set secret for specified domain")
+               },
+               {
+                       "aclmapset",
+                       net_idmap_aclmapset,
+                       NET_TRANSPORT_LOCAL,
+                       N_("Set acl map"),
+                       N_("net idmap aclmapset\n"
+                          "  Set acl map")
+               },
+               {NULL, NULL, 0, NULL, NULL}
        };
 
-       return net_run_function(argc, argv, func, net_help_idmap);
+       return net_run_function(c, argc, argv, "net idmap", func);
 }