2 Unix SMB/CIFS implementation.
4 Winbind daemon - user related functions
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jeremy Allison 2001.
8 Copyright (C) Gerald (Jerry) Carter 2003.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 #define DBGC_CLASS DBGC_WINBIND
31 extern userdom_struct current_user_info;
33 static BOOL fillup_pw_field(const char *lp_template,
46 if (in && !strequal(in,"") && lp_security() == SEC_ADS && use_nss_info("sfu")) {
47 safe_strcpy(out, in, sizeof(fstring) - 1);
51 /* Home directory and shell - use template config parameters. The
52 defaults are /tmp for the home directory and /bin/false for
55 /* The substitution of %U and %D in the 'template homedir' is done
56 by alloc_sub_specified() below. */
58 templ = alloc_sub_specified(lp_template, username, domname, uid, gid);
63 safe_strcpy(out, templ, sizeof(fstring) - 1);
69 /* Fill a pwent structure with information we have obtained */
71 static BOOL winbindd_fill_pwent(char *dom_name, char *user_name,
72 DOM_SID *user_sid, DOM_SID *group_sid,
73 char *full_name, char *homedir, char *shell,
74 struct winbindd_pw *pw)
76 fstring output_username;
79 if (!pw || !dom_name || !user_name)
82 /* Resolve the uid number */
84 if (!NT_STATUS_IS_OK(idmap_sid_to_uid(user_sid, &pw->pw_uid, 0))) {
85 DEBUG(1, ("error getting user id for sid %s\n", sid_to_string(sid_string, user_sid)));
89 /* Resolve the gid number */
91 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(group_sid, &pw->pw_gid, 0))) {
92 DEBUG(1, ("error getting group id for sid %s\n", sid_to_string(sid_string, group_sid)));
96 strlower_m(user_name);
100 fill_domain_username(output_username, dom_name, user_name);
102 safe_strcpy(pw->pw_name, output_username, sizeof(pw->pw_name) - 1);
104 /* Full name (gecos) */
106 safe_strcpy(pw->pw_gecos, full_name, sizeof(pw->pw_gecos) - 1);
108 /* Home directory and shell - use template config parameters. The
109 defaults are /tmp for the home directory and /bin/false for
112 /* The substitution of %U and %D in the 'template homedir' is done
113 by alloc_sub_specified() below. */
115 fstrcpy(current_user_info.domain, dom_name);
117 if (!fillup_pw_field(lp_template_homedir(), user_name, dom_name,
118 pw->pw_uid, pw->pw_gid, homedir, pw->pw_dir))
121 if (!fillup_pw_field(lp_template_shell(), user_name, dom_name,
122 pw->pw_uid, pw->pw_gid, shell, pw->pw_shell))
125 /* Password - set to "*" as we can't generate anything useful here.
126 Authentication can be done using the pam_winbind module. */
128 safe_strcpy(pw->pw_passwd, "*", sizeof(pw->pw_passwd) - 1);
133 /* Wrapper for domain->methods->query_user, only on the parent->child pipe */
135 enum winbindd_result winbindd_dual_userinfo(struct winbindd_domain *domain,
136 struct winbindd_cli_state *state)
139 WINBIND_USERINFO user_info;
142 /* Ensure null termination */
143 state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
145 DEBUG(3, ("[%5lu]: lookupsid %s\n", (unsigned long)state->pid,
146 state->request.data.sid));
148 if (!string_to_sid(&sid, state->request.data.sid)) {
149 DEBUG(5, ("%s not a SID\n", state->request.data.sid));
150 return WINBINDD_ERROR;
153 status = domain->methods->query_user(domain, state->mem_ctx,
155 if (!NT_STATUS_IS_OK(status)) {
156 DEBUG(1, ("error getting user info for sid %s\n",
157 sid_string_static(&sid)));
158 return WINBINDD_ERROR;
161 fstrcpy(state->response.data.user_info.acct_name, user_info.acct_name);
162 fstrcpy(state->response.data.user_info.full_name, user_info.full_name);
163 fstrcpy(state->response.data.user_info.homedir, user_info.homedir);
164 fstrcpy(state->response.data.user_info.shell, user_info.shell);
165 if (!sid_peek_check_rid(&domain->sid, &user_info.group_sid,
166 &state->response.data.user_info.group_rid)) {
167 DEBUG(1, ("Could not extract group rid out of %s\n",
168 sid_string_static(&sid)));
169 return WINBINDD_ERROR;
175 struct getpwsid_state {
176 struct winbindd_cli_state *state;
177 struct winbindd_domain *domain;
188 static void getpwsid_queryuser_recv(void *private_data, BOOL success,
189 const char *acct_name,
190 const char *full_name,
194 static void getpwsid_sid2uid_recv(void *private_data, BOOL success, uid_t uid);
195 static void getpwsid_sid2gid_recv(void *private_data, BOOL success, gid_t gid);
197 static void winbindd_getpwsid(struct winbindd_cli_state *state,
200 struct getpwsid_state *s;
202 s = TALLOC_P(state->mem_ctx, struct getpwsid_state);
204 DEBUG(0, ("talloc failed\n"));
209 s->domain = find_domain_from_sid_noinit(sid);
210 if (s->domain == NULL) {
211 DEBUG(3, ("Could not find domain for sid %s\n",
212 sid_string_static(sid)));
216 sid_copy(&s->user_sid, sid);
218 query_user_async(s->state->mem_ctx, s->domain, sid,
219 getpwsid_queryuser_recv, s);
223 request_error(state);
226 static void getpwsid_queryuser_recv(void *private_data, BOOL success,
227 const char *acct_name,
228 const char *full_name,
234 struct getpwsid_state *s =
235 talloc_get_type_abort(private_data, struct getpwsid_state);
238 DEBUG(5, ("Could not query user %s\\%s\n", s->domain->name,
240 request_error(s->state);
244 fstrcpy( username, acct_name );
245 strlower_m( username );
246 s->username = talloc_strdup(s->state->mem_ctx, username);
247 s->fullname = talloc_strdup(s->state->mem_ctx, full_name);
248 s->homedir = talloc_strdup(s->state->mem_ctx, homedir);
249 s->shell = talloc_strdup(s->state->mem_ctx, shell);
250 sid_copy(&s->group_sid, &s->domain->sid);
251 sid_append_rid(&s->group_sid, group_rid);
253 winbindd_sid2uid_async(s->state->mem_ctx, &s->user_sid,
254 getpwsid_sid2uid_recv, s);
257 static void getpwsid_sid2uid_recv(void *private_data, BOOL success, uid_t uid)
259 struct getpwsid_state *s =
260 talloc_get_type_abort(private_data, struct getpwsid_state);
263 DEBUG(5, ("Could not query user's %s\\%s uid\n",
264 s->domain->name, s->username));
265 request_error(s->state);
270 winbindd_sid2gid_async(s->state->mem_ctx, &s->group_sid,
271 getpwsid_sid2gid_recv, s);
274 static void getpwsid_sid2gid_recv(void *private_data, BOOL success, gid_t gid)
276 struct getpwsid_state *s =
277 talloc_get_type_abort(private_data, struct getpwsid_state);
278 struct winbindd_pw *pw;
279 fstring output_username;
282 DEBUG(5, ("Could not query user's %s\\%s\n gid",
283 s->domain->name, s->username));
289 pw = &s->state->response.data.pw;
292 fill_domain_username(output_username, s->domain->name, s->username);
293 safe_strcpy(pw->pw_name, output_username, sizeof(pw->pw_name) - 1);
294 safe_strcpy(pw->pw_gecos, s->fullname, sizeof(pw->pw_gecos) - 1);
296 fstrcpy(current_user_info.domain, s->domain->name);
298 if (!fillup_pw_field(lp_template_homedir(), s->username, s->domain->name,
299 pw->pw_uid, pw->pw_gid, s->homedir, pw->pw_dir)) {
300 DEBUG(5, ("Could not compose homedir\n"));
304 if (!fillup_pw_field(lp_template_shell(), s->username, s->domain->name,
305 pw->pw_uid, pw->pw_gid, s->shell, pw->pw_shell)) {
306 DEBUG(5, ("Could not compose shell\n"));
310 /* Password - set to "*" as we can't generate anything useful here.
311 Authentication can be done using the pam_winbind module. */
313 safe_strcpy(pw->pw_passwd, "*", sizeof(pw->pw_passwd) - 1);
315 request_ok(s->state);
319 request_error(s->state);
322 /* Return a password structure from a username. */
324 static void getpwnam_name2sid_recv(void *private_data, BOOL success,
325 const DOM_SID *sid, enum SID_NAME_USE type);
327 void winbindd_getpwnam(struct winbindd_cli_state *state)
329 struct winbindd_domain *domain;
330 fstring domname, username;
332 /* Ensure null termination */
333 state->request.data.username[sizeof(state->request.data.username)-1]='\0';
335 DEBUG(3, ("[%5lu]: getpwnam %s\n", (unsigned long)state->pid,
336 state->request.data.username));
338 if (!parse_domain_user(state->request.data.username, domname,
340 DEBUG(5, ("Could not parse domain user: %s\n",
341 state->request.data.username));
342 request_error(state);
346 /* Get info for the domain */
348 domain = find_domain_from_name(domname);
350 if (domain == NULL) {
351 DEBUG(7, ("could not find domain entry for domain %s\n",
353 request_error(state);
357 if ( strequal(domname, lp_workgroup()) && lp_winbind_trusted_domains_only() ) {
358 DEBUG(7,("winbindd_getpwnam: My domain -- rejecting getpwnam() for %s\\%s.\n",
360 request_error(state);
364 /* Get rid and name type from name. The following costs 1 packet */
366 winbindd_lookupname_async(state->mem_ctx, domname, username,
367 getpwnam_name2sid_recv, state);
370 static void getpwnam_name2sid_recv(void *private_data, BOOL success,
371 const DOM_SID *sid, enum SID_NAME_USE type)
373 struct winbindd_cli_state *state = private_data;
376 DEBUG(5, ("Could not lookup name for user %s\n",
377 state->request.data.username));
378 request_error(state);
382 if ((type != SID_NAME_USER) && (type != SID_NAME_COMPUTER)) {
383 DEBUG(5, ("%s is not a user\n", state->request.data.username));
384 request_error(state);
388 winbindd_getpwsid(state, sid);
391 /* Return a password structure given a uid number */
393 void winbindd_getpwuid(struct winbindd_cli_state *state)
398 /* Bug out if the uid isn't in the winbind range */
400 if ((state->request.data.uid < server_state.uid_low ) ||
401 (state->request.data.uid > server_state.uid_high)) {
402 request_error(state);
406 DEBUG(3, ("[%5lu]: getpwuid %lu\n", (unsigned long)state->pid,
407 (unsigned long)state->request.data.uid));
409 status = idmap_uid_to_sid(&user_sid, state->request.data.uid,
410 ID_QUERY_ONLY | ID_CACHE_ONLY);
412 if (!NT_STATUS_IS_OK(status)) {
413 DEBUG(5, ("Could not find SID for uid %lu\n",
414 (unsigned long)state->request.data.uid));
415 request_error(state);
419 winbindd_getpwsid(state, &user_sid);
423 * set/get/endpwent functions
426 /* Rewind file pointer for ntdom passwd database */
428 static BOOL winbindd_setpwent_internal(struct winbindd_cli_state *state)
430 struct winbindd_domain *domain;
432 DEBUG(3, ("[%5lu]: setpwent\n", (unsigned long)state->pid));
434 /* Check user has enabled this */
436 if (!lp_winbind_enum_users()) {
440 /* Free old static data if it exists */
442 if (state->getpwent_state != NULL) {
443 free_getent_state(state->getpwent_state);
444 state->getpwent_state = NULL;
448 /* add any local users we have */
450 if ( (domain_state = (struct getent_state *)malloc(sizeof(struct getent_state))) == NULL )
453 ZERO_STRUCTP(domain_state);
455 /* Add to list of open domains */
457 DLIST_ADD(state->getpwent_state, domain_state);
460 /* Create sam pipes for each domain we know about */
462 for(domain = domain_list(); domain != NULL; domain = domain->next) {
463 struct getent_state *domain_state;
466 /* don't add our domaina if we are a PDC or if we
467 are a member of a Samba domain */
469 if ( (IS_DC || lp_winbind_trusted_domains_only())
470 && strequal(domain->name, lp_workgroup()) )
475 /* Create a state record for this domain */
477 if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL) {
478 DEBUG(0, ("malloc failed\n"));
482 ZERO_STRUCTP(domain_state);
484 fstrcpy(domain_state->domain_name, domain->name);
486 /* Add to list of open domains */
488 DLIST_ADD(state->getpwent_state, domain_state);
491 state->getpwent_initialized = True;
495 void winbindd_setpwent(struct winbindd_cli_state *state)
497 if (winbindd_setpwent_internal(state)) {
500 request_error(state);
504 /* Close file pointer to ntdom passwd database */
506 void winbindd_endpwent(struct winbindd_cli_state *state)
508 DEBUG(3, ("[%5lu]: endpwent\n", (unsigned long)state->pid));
510 free_getent_state(state->getpwent_state);
511 state->getpwent_initialized = False;
512 state->getpwent_state = NULL;
516 /* Get partial list of domain users for a domain. We fill in the sam_entries,
517 and num_sam_entries fields with domain user information. The dispinfo_ndx
518 field is incremented to the index of the next user to fetch. Return True if
519 some users were returned, False otherwise. */
521 static BOOL get_sam_user_entries(struct getent_state *ent, TALLOC_CTX *mem_ctx)
525 WINBIND_USERINFO *info;
526 struct getpwent_user *name_list = NULL;
528 struct winbindd_domain *domain;
529 struct winbindd_methods *methods;
532 if (ent->num_sam_entries)
535 if (!(domain = find_domain_from_name(ent->domain_name))) {
536 DEBUG(3, ("no such domain %s in get_sam_user_entries\n",
541 methods = domain->methods;
543 /* Free any existing user info */
545 SAFE_FREE(ent->sam_entries);
546 ent->num_sam_entries = 0;
548 /* Call query_user_list to get a list of usernames and user rids */
552 status = methods->query_user_list(domain, mem_ctx, &num_entries,
556 name_list = SMB_REALLOC_ARRAY(name_list, struct getpwent_user, ent->num_sam_entries + num_entries);
559 DEBUG(0,("get_sam_user_entries realloc failed.\n"));
564 for (i = 0; i < num_entries; i++) {
565 /* Store account name and gecos */
566 if (!info[i].acct_name) {
567 fstrcpy(name_list[ent->num_sam_entries + i].name, "");
569 fstrcpy(name_list[ent->num_sam_entries + i].name,
572 if (!info[i].full_name) {
573 fstrcpy(name_list[ent->num_sam_entries + i].gecos, "");
575 fstrcpy(name_list[ent->num_sam_entries + i].gecos,
578 if (!info[i].homedir) {
579 fstrcpy(name_list[ent->num_sam_entries + i].homedir, "");
581 fstrcpy(name_list[ent->num_sam_entries + i].homedir,
584 if (!info[i].shell) {
585 fstrcpy(name_list[ent->num_sam_entries + i].shell, "");
587 fstrcpy(name_list[ent->num_sam_entries + i].shell,
592 /* User and group ids */
593 sid_copy(&name_list[ent->num_sam_entries+i].user_sid,
595 sid_copy(&name_list[ent->num_sam_entries+i].group_sid,
599 ent->num_sam_entries += num_entries;
601 /* Fill in remaining fields */
603 ent->sam_entries = name_list;
604 ent->sam_entry_index = 0;
605 result = ent->num_sam_entries > 0;
612 /* Fetch next passwd entry from ntdom database */
614 #define MAX_GETPWENT_USERS 500
616 void winbindd_getpwent(struct winbindd_cli_state *state)
618 struct getent_state *ent;
619 struct winbindd_pw *user_list;
620 int num_users, user_list_ndx = 0, i;
622 DEBUG(3, ("[%5lu]: getpwent\n", (unsigned long)state->pid));
624 /* Check user has enabled this */
626 if (!lp_winbind_enum_users()) {
627 request_error(state);
631 /* Allocate space for returning a chunk of users */
633 num_users = MIN(MAX_GETPWENT_USERS, state->request.data.num_entries);
635 if ((state->response.extra_data = SMB_MALLOC_ARRAY(struct winbindd_pw, num_users)) == NULL) {
636 request_error(state);
640 memset(state->response.extra_data, 0, num_users *
641 sizeof(struct winbindd_pw));
643 user_list = (struct winbindd_pw *)state->response.extra_data;
645 if (!state->getpwent_initialized)
646 winbindd_setpwent_internal(state);
648 if (!(ent = state->getpwent_state)) {
649 request_error(state);
653 /* Start sending back users */
655 for (i = 0; i < num_users; i++) {
656 struct getpwent_user *name_list = NULL;
659 /* Do we need to fetch another chunk of users? */
661 if (ent->num_sam_entries == ent->sam_entry_index) {
664 !get_sam_user_entries(ent, state->mem_ctx)) {
665 struct getent_state *next_ent;
667 /* Free state information for this domain */
669 SAFE_FREE(ent->sam_entries);
671 next_ent = ent->next;
672 DLIST_REMOVE(state->getpwent_state, ent);
678 /* No more domains */
684 name_list = ent->sam_entries;
686 /* Lookup user info */
688 result = winbindd_fill_pwent(
690 name_list[ent->sam_entry_index].name,
691 &name_list[ent->sam_entry_index].user_sid,
692 &name_list[ent->sam_entry_index].group_sid,
693 name_list[ent->sam_entry_index].gecos,
694 name_list[ent->sam_entry_index].homedir,
695 name_list[ent->sam_entry_index].shell,
696 &user_list[user_list_ndx]);
698 ent->sam_entry_index++;
700 /* Add user to return list */
705 state->response.data.num_entries++;
706 state->response.length +=
707 sizeof(struct winbindd_pw);
710 DEBUG(1, ("could not lookup domain user %s\n",
711 name_list[ent->sam_entry_index].name));
716 if (user_list_ndx > 0)
719 request_error(state);
722 /* List domain users without mapping to unix ids */
724 void winbindd_list_users(struct winbindd_cli_state *state)
726 struct winbindd_domain *domain;
727 WINBIND_USERINFO *info;
728 const char *which_domain;
729 uint32 num_entries = 0, total_entries = 0;
730 char *extra_data = NULL;
731 int extra_data_len = 0;
732 enum winbindd_result rv = WINBINDD_ERROR;
734 DEBUG(3, ("[%5lu]: list users\n", (unsigned long)state->pid));
736 /* Ensure null termination */
737 state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';
738 which_domain = state->request.domain_name;
740 /* Enumerate over trusted domains */
742 for (domain = domain_list(); domain; domain = domain->next) {
744 struct winbindd_methods *methods;
747 /* if we have a domain name restricting the request and this
748 one in the list doesn't match, then just bypass the remainder
751 if ( *which_domain && !strequal(which_domain, domain->name) )
754 methods = domain->methods;
756 /* Query display info */
757 status = methods->query_user_list(domain, state->mem_ctx,
758 &num_entries, &info);
760 if (num_entries == 0)
763 /* Allocate some memory for extra data */
764 total_entries += num_entries;
766 extra_data = SMB_REALLOC(extra_data, sizeof(fstring) * total_entries);
769 DEBUG(0,("failed to enlarge buffer!\n"));
773 /* Pack user list into extra data fields */
775 for (i = 0; i < num_entries; i++) {
776 fstring acct_name, name;
778 if (!info[i].acct_name) {
779 fstrcpy(acct_name, "");
781 fstrcpy(acct_name, info[i].acct_name);
784 fill_domain_username(name, domain->name, acct_name);
786 /* Append to extra data */
787 memcpy(&extra_data[extra_data_len], name,
789 extra_data_len += strlen(name);
790 extra_data[extra_data_len++] = ',';
794 /* Assign extra_data fields in response structure */
797 extra_data[extra_data_len - 1] = '\0';
798 state->response.extra_data = extra_data;
799 state->response.length += extra_data_len;
802 /* No domains responded but that's still OK so don't return an
809 if (rv == WINBINDD_OK)
812 request_error(state);