2 Unix SMB/CIFS implementation.
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003-2007
7 Copyright (C) Jeremy Allison 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #define DBGC_CLASS DBGC_IDMAP
31 struct idmap_backend {
33 struct idmap_methods *methods;
34 struct idmap_backend *prev, *next;
37 struct idmap_alloc_backend {
39 struct idmap_alloc_methods *methods;
40 struct idmap_alloc_backend *prev, *next;
43 struct idmap_cache_ctx;
45 struct idmap_alloc_context {
47 struct idmap_alloc_methods *methods;
51 static TALLOC_CTX *idmap_ctx = NULL;
52 static struct idmap_cache_ctx *idmap_cache;
54 static struct idmap_backend *backends = NULL;
55 static struct idmap_domain **idmap_domains = NULL;
56 static int num_domains = 0;
57 static int pdb_dom_num = -1;
58 static int def_dom_num = -1;
60 static struct idmap_alloc_backend *alloc_backends = NULL;
61 static struct idmap_alloc_context *idmap_alloc_ctx = NULL;
63 #define IDMAP_CHECK_RET(ret) do { \
64 if ( ! NT_STATUS_IS_OK(ret)) { \
65 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
68 #define IDMAP_REPORT_RET(ret) do { \
69 if ( ! NT_STATUS_IS_OK(ret)) { \
70 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
72 #define IDMAP_CHECK_ALLOC(mem) do { \
74 DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; \
78 static struct idmap_methods *get_methods(struct idmap_backend *be,
81 struct idmap_backend *b;
83 for (b = be; b; b = b->next) {
84 if (strequal(b->name, name)) {
92 static struct idmap_alloc_methods *get_alloc_methods(
93 struct idmap_alloc_backend *be,
96 struct idmap_alloc_backend *b;
98 for (b = be; b; b = b->next) {
99 if (strequal(b->name, name)) {
107 bool idmap_is_offline(void)
109 return ( lp_winbind_offline_logon() &&
110 get_global_winbindd_state_offline() );
113 /**********************************************************************
114 Allow a module to register itself as a method.
115 **********************************************************************/
117 NTSTATUS smb_register_idmap(int version, const char *name,
118 struct idmap_methods *methods)
120 struct idmap_methods *test;
121 struct idmap_backend *entry;
124 return NT_STATUS_INTERNAL_DB_ERROR;
127 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
128 DEBUG(0, ("Failed to register idmap module.\n"
129 "The module was compiled against "
130 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
131 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
132 "Please recompile against the current version "
134 version, SMB_IDMAP_INTERFACE_VERSION));
135 return NT_STATUS_OBJECT_TYPE_MISMATCH;
138 if (!name || !name[0] || !methods) {
139 DEBUG(0,("Called with NULL pointer or empty name!\n"));
140 return NT_STATUS_INVALID_PARAMETER;
143 test = get_methods(backends, name);
145 DEBUG(0,("Idmap module %s already registered!\n", name));
146 return NT_STATUS_OBJECT_NAME_COLLISION;
149 entry = talloc(idmap_ctx, struct idmap_backend);
151 DEBUG(0,("Out of memory!\n"));
153 return NT_STATUS_NO_MEMORY;
155 entry->name = talloc_strdup(idmap_ctx, name);
156 if ( ! entry->name) {
157 DEBUG(0,("Out of memory!\n"));
159 return NT_STATUS_NO_MEMORY;
161 entry->methods = methods;
163 DLIST_ADD(backends, entry);
164 DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
168 /**********************************************************************
169 Allow a module to register itself as a method.
170 **********************************************************************/
172 NTSTATUS smb_register_idmap_alloc(int version, const char *name,
173 struct idmap_alloc_methods *methods)
175 struct idmap_alloc_methods *test;
176 struct idmap_alloc_backend *entry;
179 return NT_STATUS_INTERNAL_DB_ERROR;
182 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
183 DEBUG(0, ("Failed to register idmap alloc module.\n"
184 "The module was compiled against "
185 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
186 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
187 "Please recompile against the current version "
189 version, SMB_IDMAP_INTERFACE_VERSION));
190 return NT_STATUS_OBJECT_TYPE_MISMATCH;
193 if (!name || !name[0] || !methods) {
194 DEBUG(0,("Called with NULL pointer or empty name!\n"));
195 return NT_STATUS_INVALID_PARAMETER;
198 test = get_alloc_methods(alloc_backends, name);
200 DEBUG(0,("idmap_alloc module %s already registered!\n", name));
201 return NT_STATUS_OBJECT_NAME_COLLISION;
204 entry = talloc(idmap_ctx, struct idmap_alloc_backend);
206 DEBUG(0,("Out of memory!\n"));
207 return NT_STATUS_NO_MEMORY;
209 entry->name = talloc_strdup(idmap_ctx, name);
210 if ( ! entry->name) {
211 DEBUG(0,("Out of memory!\n"));
212 return NT_STATUS_NO_MEMORY;
214 entry->methods = methods;
216 DLIST_ADD(alloc_backends, entry);
217 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name));
221 static int close_domain_destructor(struct idmap_domain *dom)
225 ret = dom->methods->close_fn(dom);
226 if (!NT_STATUS_IS_OK(ret)) {
227 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom->name));
233 /**************************************************************************
235 **************************************************************************/
237 NTSTATUS idmap_close(void)
239 /* close the alloc backend first before freeing idmap_ctx */
240 if (idmap_alloc_ctx) {
241 idmap_alloc_ctx->methods->close_fn();
242 idmap_alloc_ctx->methods = NULL;
244 alloc_backends = NULL;
246 /* this talloc_free call will fire the talloc destructors
247 * that will free all active backends resources */
248 TALLOC_FREE(idmap_ctx);
250 idmap_domains = NULL;
256 /****************************************************************************
257 ****************************************************************************/
259 NTSTATUS idmap_init_cache(void)
261 /* Always initialize the cache. We'll have to delay initialization
262 of backends if we are offline */
268 if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
269 return NT_STATUS_NO_MEMORY;
272 if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
273 return NT_STATUS_UNSUCCESSFUL;
279 /****************************************************************************
280 ****************************************************************************/
282 static NTSTATUS idmap_init(void)
285 static NTSTATUS idmap_init_status = NT_STATUS_UNSUCCESSFUL;
286 struct idmap_domain *dom;
287 char *compat_backend = NULL;
288 char *compat_params = NULL;
289 const char **dom_list = NULL;
290 const char *default_domain = NULL;
291 char *alloc_backend = NULL;
292 bool default_already_defined = False;
293 bool pri_dom_is_in_list = False;
297 ret = idmap_init_cache();
298 if (!NT_STATUS_IS_OK(ret))
301 if (NT_STATUS_IS_OK(idmap_init_status)) {
305 /* We can't reliably call intialization code here unless
306 we are online. But return NT_STATUS_OK so the upper
307 level code doesn't abort idmap lookups. */
309 if ( get_global_winbindd_state_offline() ) {
310 idmap_init_status = NT_STATUS_FILE_IS_OFFLINE;
316 dom_list = lp_idmap_domains();
318 if ( lp_idmap_backend() ) {
319 const char **compat_list = lp_idmap_backend();
321 const char *q = NULL;
324 DEBUG(0, ("WARNING: idmap backend and idmap domains are"
325 " mutually exclusive!\n"));
326 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
330 compat_backend = talloc_strdup(idmap_ctx, *compat_list);
332 /* strip any leading idmap_ prefix of */
333 if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
334 q = *compat_list += 6;
335 DEBUG(0, ("WARNING: idmap backend uses obsolete"
336 " and deprecated 'idmap_' prefix.\n"
337 "Please replace 'idmap_%s' by '%s' in"
338 " %s\n", q, q, get_dyn_CONFIGFILE()));
339 compat_backend = talloc_strdup(idmap_ctx, q);
341 compat_backend = talloc_strdup(idmap_ctx,
345 if (compat_backend == NULL ) {
346 ret = NT_STATUS_NO_MEMORY;
350 /* separate the backend and module arguments */
351 if ((p = strchr(compat_backend, ':')) != NULL) {
353 compat_params = p + 1;
356 } else if ( !dom_list ) {
357 /* Back compatible: without idmap domains and explicit
358 idmap backend. Taking default idmap backend: tdb */
361 compat_backend = talloc_strdup( idmap_ctx, "tdb");
362 compat_params = compat_backend;
366 /* generate a list with our main domain */
369 dl = talloc_array(idmap_ctx, const char *, 2);
371 ret = NT_STATUS_NO_MEMORY;
374 dl[0] = talloc_strdup(dl, lp_workgroup());
376 ret = NT_STATUS_NO_MEMORY;
384 default_domain = dl[0];
387 /***************************
388 * initialize idmap domains
390 DEBUG(1, ("Initializing idmap domains\n"));
392 for (i=0, num_domains=0; dom_list[i]; i++) {
393 const char *parm_backend;
396 /* ignore BUILTIN and local MACHINE domains */
397 if (strequal(dom_list[i], "BUILTIN")
398 || strequal(dom_list[i], get_global_sam_name()))
400 DEBUG(0,("idmap_init: Ignoring domain %s\n",
405 if ((dom_list[i] != default_domain) &&
406 strequal(dom_list[i], lp_workgroup())) {
407 pri_dom_is_in_list = True;
411 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
412 IDMAP_CHECK_ALLOC(dom);
414 dom->name = talloc_strdup(dom, dom_list[i]);
415 IDMAP_CHECK_ALLOC(dom->name);
417 config_option = talloc_asprintf(dom, "idmap config %s",
419 IDMAP_CHECK_ALLOC(config_option);
421 /* default or specific ? */
423 dom->default_domain = lp_parm_bool(-1, config_option,
426 if (dom->default_domain ||
427 (default_domain && strequal(dom_list[i], default_domain))) {
429 /* make sure this is set even when we match
431 dom->default_domain = True;
433 if (default_already_defined) {
434 DEBUG(1, ("ERROR: Multiple domains defined as"
436 ret = NT_STATUS_INVALID_PARAMETER;
440 default_already_defined = True;
444 dom->readonly = lp_parm_bool(-1, config_option,
447 /* find associated backend (default: tdb) */
449 parm_backend = talloc_strdup(idmap_ctx, compat_backend);
451 parm_backend = talloc_strdup(idmap_ctx,
452 lp_parm_const_string(
456 IDMAP_CHECK_ALLOC(parm_backend);
458 /* get the backend methods for this domain */
459 dom->methods = get_methods(backends, parm_backend);
461 if ( ! dom->methods) {
462 ret = smb_probe_module("idmap", parm_backend);
463 if (NT_STATUS_IS_OK(ret)) {
464 dom->methods = get_methods(backends,
468 if ( ! dom->methods) {
469 DEBUG(0, ("ERROR: Could not get methods for "
470 "backend %s\n", parm_backend));
471 ret = NT_STATUS_UNSUCCESSFUL;
475 /* check the set_mapping function exists otherwise mark the
476 * module as readonly */
477 if ( ! dom->methods->set_mapping) {
478 DEBUG(5, ("Forcing to readonly, as this module can't"
479 " store arbitrary mappings.\n"));
480 dom->readonly = True;
483 /* now that we have methods,
484 * set the destructor for this domain */
485 talloc_set_destructor(dom, close_domain_destructor);
488 dom->params = talloc_strdup(dom, compat_params);
489 IDMAP_CHECK_ALLOC(dom->params);
494 /* Finally instance a backend copy for this domain */
495 ret = dom->methods->init(dom);
496 if ( ! NT_STATUS_IS_OK(ret)) {
497 DEBUG(0, ("ERROR: Initialization failed for backend "
498 "%s (domain %s), deferred!\n",
499 parm_backend, dom->name));
501 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
502 struct idmap_domain *, i+1);
503 if ( ! idmap_domains) {
504 DEBUG(0, ("Out of memory!\n"));
505 ret = NT_STATUS_NO_MEMORY;
508 idmap_domains[num_domains] = dom;
510 /* save default domain position for future uses */
511 if (dom->default_domain) {
512 def_dom_num = num_domains;
515 /* Bump counter to next available slot */
519 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
520 dom->name, parm_backend,
521 dom->default_domain?"":"not ",
522 dom->readonly?"":"not "));
524 talloc_free(config_option);
527 /* on DCs we need to add idmap_tdb as the default backend if compat is
528 * defined (when the old implicit configuration is used)
529 * This is not done in the previous loop a on member server we exclude
530 * the local domain. But on a DC the local domain is the only domain
531 * available therefore we are left with no default domain */
532 if (((lp_server_role() == ROLE_DOMAIN_PDC) ||
533 (lp_server_role() == ROLE_DOMAIN_BDC)) &&
534 ((num_domains == 0) && (compat == 1))) {
536 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
537 IDMAP_CHECK_ALLOC(dom);
539 dom->name = talloc_strdup(dom, "__default__");
540 IDMAP_CHECK_ALLOC(dom->name);
542 dom->default_domain = True;
543 dom->readonly = False;
545 /* get the backend methods for this domain */
546 dom->methods = get_methods(backends, compat_backend);
548 if ( ! dom->methods) {
549 ret = smb_probe_module("idmap", compat_backend);
550 if (NT_STATUS_IS_OK(ret)) {
551 dom->methods = get_methods(backends,
555 if ( ! dom->methods) {
556 DEBUG(0, ("ERROR: Could not get methods for "
557 "backend %s\n", compat_backend));
558 ret = NT_STATUS_UNSUCCESSFUL;
562 /* now that we have methods,
563 * set the destructor for this domain */
564 talloc_set_destructor(dom, close_domain_destructor);
566 dom->params = talloc_strdup(dom, compat_params);
567 IDMAP_CHECK_ALLOC(dom->params);
569 /* Finally instance a backend copy for this domain */
570 ret = dom->methods->init(dom);
571 if ( ! NT_STATUS_IS_OK(ret)) {
572 DEBUG(0, ("ERROR: Initialization failed for backend "
573 "%s (domain %s), deferred!\n",
574 compat_backend, dom->name));
576 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
577 struct idmap_domain *, 2);
578 if ( ! idmap_domains) {
579 DEBUG(0, ("Out of memory!\n"));
580 ret = NT_STATUS_NO_MEMORY;
583 idmap_domains[num_domains] = dom;
585 def_dom_num = num_domains;
587 /* Bump counter to next available slot */
591 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
592 dom->name, compat_backend,
593 dom->default_domain?"":"not ",
594 dom->readonly?"":"not "));
597 /* automatically add idmap_nss backend if needed */
598 if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
599 ( ! pri_dom_is_in_list) &&
600 lp_winbind_trusted_domains_only()) {
602 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
603 IDMAP_CHECK_ALLOC(dom);
605 dom->name = talloc_strdup(dom, lp_workgroup());
606 IDMAP_CHECK_ALLOC(dom->name);
608 dom->default_domain = False;
609 dom->readonly = True;
611 /* get the backend methods for passdb */
612 dom->methods = get_methods(backends, "nss");
614 /* (the nss module is always statically linked) */
615 if ( ! dom->methods) {
616 DEBUG(0, ("ERROR: No methods for idmap_nss ?!\n"));
617 ret = NT_STATUS_UNSUCCESSFUL;
621 /* now that we have methods,
622 * set the destructor for this domain */
623 talloc_set_destructor(dom, close_domain_destructor);
626 dom->params = talloc_strdup(dom, compat_params);
627 IDMAP_CHECK_ALLOC(dom->params);
632 /* Finally instance a backend copy for this domain */
633 ret = dom->methods->init(dom);
634 if ( ! NT_STATUS_IS_OK(ret)) {
635 DEBUG(0, ("ERROR: Init. failed for idmap_nss ?!\n"));
636 ret = NT_STATUS_UNSUCCESSFUL;
640 idmap_domains = talloc_realloc(idmap_ctx,
642 struct idmap_domain *,
644 if ( ! idmap_domains) {
645 DEBUG(0, ("Out of memory!\n"));
646 ret = NT_STATUS_NO_MEMORY;
649 idmap_domains[num_domains] = dom;
651 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n",
657 /**** automatically add idmap_passdb backend ****/
658 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
659 IDMAP_CHECK_ALLOC(dom);
661 dom->name = talloc_strdup(dom, get_global_sam_name());
662 IDMAP_CHECK_ALLOC(dom->name);
664 dom->default_domain = False;
665 dom->readonly = True;
667 /* get the backend methods for passdb */
668 dom->methods = get_methods(backends, "passdb");
670 /* (the passdb module is always statically linked) */
671 if ( ! dom->methods) {
672 DEBUG(0, ("ERROR: No methods for idmap_passdb ?!\n"));
673 ret = NT_STATUS_UNSUCCESSFUL;
677 /* now that we have methods, set the destructor for this domain */
678 talloc_set_destructor(dom, close_domain_destructor);
681 dom->params = talloc_strdup(dom, compat_params);
682 IDMAP_CHECK_ALLOC(dom->params);
687 /* Finally instance a backend copy for this domain */
688 ret = dom->methods->init(dom);
689 if ( ! NT_STATUS_IS_OK(ret)) {
690 DEBUG(0, ("ERROR: Init. failed for idmap_passdb ?!\n"));
691 ret = NT_STATUS_UNSUCCESSFUL;
695 idmap_domains = talloc_realloc(idmap_ctx,
697 struct idmap_domain *,
699 if ( ! idmap_domains) {
700 DEBUG(0, ("Out of memory!\n"));
701 ret = NT_STATUS_NO_MEMORY;
704 idmap_domains[num_domains] = dom;
706 /* needed to handle special BUILTIN and wellknown SIDs cases */
707 pdb_dom_num = num_domains;
709 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n",
713 /**** finished adding idmap_passdb backend ****/
715 /* sort domains so that the default is the last one */
716 /* don't sort if no default domain defined */
717 if (def_dom_num != -1 && def_dom_num != num_domains-1) {
718 /* default is not last, move it */
719 struct idmap_domain *tmp;
721 if (pdb_dom_num > def_dom_num) {
724 } else if (pdb_dom_num == def_dom_num) { /* ?? */
725 pdb_dom_num = num_domains - 1;
728 tmp = idmap_domains[def_dom_num];
730 for (i = def_dom_num; i < num_domains-1; i++) {
731 idmap_domains[i] = idmap_domains[i+1];
733 idmap_domains[i] = tmp;
738 /* Initialize alloc module */
740 DEBUG(3, ("Initializing idmap alloc module\n"));
742 alloc_backend = NULL;
744 alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
746 char *ab = lp_idmap_alloc_backend();
748 if (ab && (ab[0] != '\0')) {
749 alloc_backend = talloc_strdup(idmap_ctx,
750 lp_idmap_alloc_backend());
754 if ( alloc_backend ) {
756 idmap_alloc_ctx = TALLOC_ZERO_P(idmap_ctx,
757 struct idmap_alloc_context);
758 IDMAP_CHECK_ALLOC(idmap_alloc_ctx);
760 idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends,
762 if ( ! idmap_alloc_ctx->methods) {
763 ret = smb_probe_module("idmap", alloc_backend);
764 if (NT_STATUS_IS_OK(ret)) {
765 idmap_alloc_ctx->methods =
766 get_alloc_methods(alloc_backends,
770 if (idmap_alloc_ctx->methods) {
773 idmap_alloc_ctx->params =
774 talloc_strdup(idmap_alloc_ctx,
776 IDMAP_CHECK_ALLOC(idmap_alloc_ctx->params);
778 idmap_alloc_ctx->params = NULL;
781 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
782 if ( ! NT_STATUS_IS_OK(ret)) {
783 DEBUG(0, ("ERROR: Initialization failed for "
784 "alloc backend %s, deferred!\n",
787 idmap_alloc_ctx->initialized = True;
790 DEBUG(2, ("idmap_init: Unable to get methods for "
791 "alloc backend %s\n",
793 /* certain compat backends are just readonly */
795 TALLOC_FREE(idmap_alloc_ctx);
798 ret = NT_STATUS_UNSUCCESSFUL;
803 /* cleanup temporary strings */
804 TALLOC_FREE( compat_backend );
806 idmap_init_status = NT_STATUS_OK;
811 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
817 static NTSTATUS idmap_alloc_init(void)
821 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
825 if ( ! idmap_alloc_ctx) {
826 return NT_STATUS_NOT_SUPPORTED;
829 if ( ! idmap_alloc_ctx->initialized) {
830 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
831 if ( ! NT_STATUS_IS_OK(ret)) {
832 DEBUG(0, ("ERROR: Initialization failed for alloc "
833 "backend, deferred!\n"));
836 idmap_alloc_ctx->initialized = True;
843 /**************************************************************************
844 idmap allocator interface functions
845 **************************************************************************/
847 NTSTATUS idmap_allocate_uid(struct unixid *id)
851 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
855 id->type = ID_TYPE_UID;
856 return idmap_alloc_ctx->methods->allocate_id(id);
859 NTSTATUS idmap_allocate_gid(struct unixid *id)
863 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
867 id->type = ID_TYPE_GID;
868 return idmap_alloc_ctx->methods->allocate_id(id);
871 NTSTATUS idmap_set_uid_hwm(struct unixid *id)
875 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
879 id->type = ID_TYPE_UID;
880 return idmap_alloc_ctx->methods->set_id_hwm(id);
883 NTSTATUS idmap_set_gid_hwm(struct unixid *id)
887 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
891 id->type = ID_TYPE_GID;
892 return idmap_alloc_ctx->methods->set_id_hwm(id);
895 /******************************************************************************
896 Lookup an idmap_domain give a full user or group SID
897 ******************************************************************************/
899 static struct idmap_domain* find_idmap_domain_from_sid( DOM_SID *account_sid )
903 struct winbindd_domain *domain = NULL;
906 /* 1. Handle BUILTIN or Special SIDs and prevent them from
907 falling into the default domain space (if we have a
908 configured passdb backend. */
910 if ( (pdb_dom_num != -1) &&
911 (sid_check_is_in_builtin(account_sid) ||
912 sid_check_is_in_wellknown_domain(account_sid) ||
913 sid_check_is_in_unix_groups(account_sid) ||
914 sid_check_is_in_unix_users(account_sid)) )
916 return idmap_domains[pdb_dom_num];
919 /* 2. Lookup the winbindd_domain from the account_sid */
921 sid_copy( &domain_sid, account_sid );
922 sid_split_rid( &domain_sid, &rid );
923 domain = find_domain_from_sid_noinit( &domain_sid );
925 for (i = 0; domain && i < num_domains; i++) {
926 if ( strequal( idmap_domains[i]->name, domain->name ) ) {
927 return idmap_domains[i];
931 /* 3. Fall back to the default domain */
933 if ( def_dom_num != -1 ) {
934 return idmap_domains[def_dom_num];
940 /******************************************************************************
941 Lookup an index given an idmap_domain pointer
942 ******************************************************************************/
944 static uint32 find_idmap_domain_index( struct idmap_domain *id_domain)
948 for (i = 0; i < num_domains; i++) {
949 if ( idmap_domains[i] == id_domain )
957 /*********************************************************
958 Check if creating a mapping is permitted for the domain
959 *********************************************************/
961 static NTSTATUS idmap_can_map(const struct id_map *map,
962 struct idmap_domain **ret_dom)
964 struct idmap_domain *dom;
966 /* Check we do not create mappings for our own local domain,
967 * or BUILTIN or special SIDs */
968 if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
969 sid_check_is_in_builtin(map->sid) ||
970 sid_check_is_in_wellknown_domain(map->sid) ||
971 sid_check_is_in_unix_users(map->sid) ||
972 sid_check_is_in_unix_groups(map->sid) )
974 DEBUG(10, ("We are not supposed to create mappings for our own "
975 "domains (local, builtin, specials)\n"));
976 return NT_STATUS_UNSUCCESSFUL;
979 /* Special check for trusted domain only = Yes */
980 if (lp_winbind_trusted_domains_only()) {
981 struct winbindd_domain *wdom = find_our_domain();
982 if (wdom && (sid_compare_domain(map->sid, &wdom->sid) == 0)) {
983 DEBUG(10, ("We are not supposed to create mappings for "
984 "our primary domain when <trusted domain "
986 DEBUGADD(10, ("Leave [%s] unmapped\n",
987 sid_string_dbg(map->sid)));
988 return NT_STATUS_UNSUCCESSFUL;
992 if ( (dom = find_idmap_domain_from_sid( map->sid )) == NULL ) {
993 /* huh, couldn't find a suitable domain,
994 * let's just leave it unmapped */
995 DEBUG(10, ("Could not find idmap backend for SID %s\n",
996 sid_string_dbg(map->sid)));
997 return NT_STATUS_NO_SUCH_DOMAIN;
1000 if (dom->readonly) {
1001 /* ouch the domain is read only,
1002 * let's just leave it unmapped */
1003 DEBUG(10, ("idmap backend for SID %s is READONLY!\n",
1004 sid_string_dbg(map->sid)));
1005 return NT_STATUS_UNSUCCESSFUL;
1009 return NT_STATUS_OK;
1012 static NTSTATUS idmap_new_mapping(TALLOC_CTX *ctx, struct id_map *map)
1015 struct idmap_domain *dom;
1017 /* If we are offline we cannot lookup SIDs, deny mapping */
1018 if (idmap_is_offline()) {
1019 return NT_STATUS_FILE_IS_OFFLINE;
1022 ret = idmap_can_map(map, &dom);
1023 if ( ! NT_STATUS_IS_OK(ret)) {
1024 return NT_STATUS_NONE_MAPPED;
1027 /* check if this is a valid SID and then map it */
1028 switch (map->xid.type) {
1030 ret = idmap_allocate_uid(&map->xid);
1031 if ( ! NT_STATUS_IS_OK(ret)) {
1032 /* can't allocate id, let's just leave it unmapped */
1033 DEBUG(2, ("uid allocation failed! "
1034 "Can't create mapping\n"));
1035 return NT_STATUS_NONE_MAPPED;
1039 ret = idmap_allocate_gid(&map->xid);
1040 if ( ! NT_STATUS_IS_OK(ret)) {
1041 /* can't allocate id, let's just leave it unmapped */
1042 DEBUG(2, ("gid allocation failed! "
1043 "Can't create mapping\n"));
1044 return NT_STATUS_NONE_MAPPED;
1048 /* invalid sid, let's just leave it unmapped */
1049 DEBUG(3,("idmap_new_mapping: Refusing to create a "
1050 "mapping for an unspecified ID type.\n"));
1051 return NT_STATUS_NONE_MAPPED;
1054 /* ok, got a new id, let's set a mapping */
1055 map->status = ID_MAPPED;
1057 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
1058 sid_string_dbg(map->sid),
1059 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
1060 (unsigned long)map->xid.id));
1061 ret = dom->methods->set_mapping(dom, map);
1063 if ( ! NT_STATUS_IS_OK(ret)) {
1064 /* something wrong here :-( */
1065 DEBUG(2, ("Failed to commit mapping\n!"));
1067 /* TODO: would it make sense to have an "unalloc_id function?" */
1069 return NT_STATUS_NONE_MAPPED;
1072 return NT_STATUS_OK;
1075 static NTSTATUS idmap_backends_set_mapping(const struct id_map *map)
1077 struct idmap_domain *dom;
1080 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
1081 sid_string_dbg(map->sid),
1082 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
1083 (unsigned long)map->xid.id));
1085 ret = idmap_can_map(map, &dom);
1086 if ( ! NT_STATUS_IS_OK(ret)) {
1090 DEBUG(10,("set_mapping for domain %s\n", dom->name ));
1092 return dom->methods->set_mapping(dom, map);
1095 static NTSTATUS idmap_backends_unixids_to_sids(struct id_map **ids)
1097 struct idmap_domain *dom;
1098 struct id_map **unmapped;
1099 struct id_map **_ids;
1104 if (!ids || !*ids) {
1105 DEBUG(1, ("Invalid list of maps\n"));
1106 return NT_STATUS_INVALID_PARAMETER;
1109 ctx = talloc_named_const(NULL, 0, "idmap_backends_unixids_to_sids ctx");
1111 DEBUG(0, ("Out of memory!\n"));
1112 return NT_STATUS_NO_MEMORY;
1115 DEBUG(10, ("Query backends to map ids->sids\n"));
1117 /* start from the default (the last one) and then if there are still
1118 * unmapped entries cycle through the others */
1123 for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
1125 dom = idmap_domains[n];
1127 DEBUG(10, ("Query sids from domain %s\n", dom->name));
1129 ret = dom->methods->unixids_to_sids(dom, _ids);
1130 IDMAP_REPORT_RET(ret);
1134 for (i = 0, u = 0; _ids[i]; i++) {
1135 if (_ids[i]->status != ID_MAPPED) {
1136 unmapped = talloc_realloc(ctx, unmapped,
1137 struct id_map *, u + 2);
1138 IDMAP_CHECK_ALLOC(unmapped);
1139 unmapped[u] = _ids[i];
1144 /* terminate the unmapped list */
1146 } else { /* no more entries, get out */
1155 /* there are still unmapped ids,
1156 * map them to the unix users/groups domains */
1157 /* except for expired entries,
1158 * these will be returned as valid (offline mode) */
1159 for (i = 0; unmapped[i]; i++) {
1160 if (unmapped[i]->status == ID_EXPIRED) continue;
1161 switch (unmapped[i]->xid.type) {
1163 uid_to_unix_users_sid(
1164 (uid_t)unmapped[i]->xid.id,
1166 unmapped[i]->status = ID_MAPPED;
1169 gid_to_unix_groups_sid(
1170 (gid_t)unmapped[i]->xid.id,
1172 unmapped[i]->status = ID_MAPPED;
1174 default: /* what?! */
1175 unmapped[i]->status = ID_UNKNOWN;
1188 static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
1190 struct id_map ***dom_ids;
1191 struct idmap_domain *dom;
1196 if ( (ctx = talloc_named_const(NULL, 0, "be_sids_to_ids")) == NULL ) {
1197 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1198 return NT_STATUS_NO_MEMORY;
1201 DEBUG(10, ("Query backends to map sids->ids\n"));
1203 /* split list per domain */
1204 if (num_domains == 0) {
1205 DEBUG(1, ("No domains available?\n"));
1206 return NT_STATUS_UNSUCCESSFUL;
1209 dom_ids = TALLOC_ZERO_ARRAY(ctx, struct id_map **, num_domains);
1210 IDMAP_CHECK_ALLOC(dom_ids);
1211 counters = TALLOC_ZERO_ARRAY(ctx, int, num_domains);
1212 IDMAP_CHECK_ALLOC(counters);
1214 /* partition the requests by domain */
1216 for (i = 0; ids[i]; i++) {
1219 if ((dom = find_idmap_domain_from_sid(ids[i]->sid)) == NULL) {
1220 /* no available idmap_domain. Move on */
1224 DEBUG(10,("SID %s is being handled by %s\n",
1225 sid_string_dbg(ids[i]->sid),
1226 dom ? dom->name : "none" ));
1228 idx = find_idmap_domain_index( dom );
1229 SMB_ASSERT( idx != -1 );
1231 dom_ids[idx] = talloc_realloc(ctx, dom_ids[idx],
1234 IDMAP_CHECK_ALLOC(dom_ids[idx]);
1236 dom_ids[idx][counters[idx]] = ids[i];
1238 dom_ids[idx][counters[idx]] = NULL;
1241 /* All the ids have been dispatched in the right queues.
1242 Let's cycle through the filled ones */
1244 for (i = 0; i < num_domains; i++) {
1246 dom = idmap_domains[i];
1247 DEBUG(10, ("Query ids from domain %s\n", dom->name));
1248 ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
1249 IDMAP_REPORT_RET(ret);
1253 /* ok all the backends have been contacted at this point */
1254 /* let's see if we have any unmapped SID left and act accordingly */
1256 for (i = 0; ids[i]; i++) {
1257 /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
1258 * was not able to confirm/deny (offline mode) */
1259 if (ids[i]->status == ID_UNKNOWN ||
1260 ids[i]->status == ID_UNMAPPED) {
1261 /* ok this is an unmapped one, see if we can map it */
1262 ret = idmap_new_mapping(ctx, ids[i]);
1263 if (NT_STATUS_IS_OK(ret)) {
1264 /* successfully mapped */
1265 ids[i]->status = ID_MAPPED;
1267 if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
1268 /* could not map it */
1269 ids[i]->status = ID_UNMAPPED;
1271 /* Something very bad happened down there
1272 * OR we are offline */
1273 ids[i]->status = ID_UNKNOWN;
1285 NTSTATUS idmap_backends_unixid_to_sid(struct id_map *id)
1287 struct id_map *maps[2];
1293 for (i = num_domains-1; i>=0; i--) {
1294 struct idmap_domain *dom = idmap_domains[i];
1297 DEBUG(10, ("Query sids from domain %s\n", dom->name));
1299 status = dom->methods->unixids_to_sids(dom, maps);
1300 if (NT_STATUS_IS_OK(status)) {
1301 return NT_STATUS_OK;
1305 return NT_STATUS_NONE_MAPPED;
1308 NTSTATUS idmap_backends_sid_to_unixid(struct id_map *id)
1310 struct idmap_domain *dom;
1311 struct id_map *maps[2];
1313 dom = find_idmap_domain_from_sid(id->sid);
1315 return NT_STATUS_NONE_MAPPED;
1321 return dom->methods->sids_to_unixids(dom, maps);
1324 /**************************************************************************
1325 idmap interface functions
1326 **************************************************************************/
1328 NTSTATUS idmap_unixids_to_sids(struct id_map **ids)
1332 struct id_map **bids;
1335 struct winbindd_domain *our_domain = find_our_domain();
1337 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1341 if (!ids || !*ids) {
1342 DEBUG(1, ("Invalid list of maps\n"));
1343 return NT_STATUS_INVALID_PARAMETER;
1346 ctx = talloc_named_const(NULL, 0, "idmap_unixids_to_sids ctx");
1348 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1349 return NT_STATUS_NO_MEMORY;
1352 /* no ids to be asked to the backends by default */
1356 for (i = 0; ids[i]; i++) {
1358 if ( ! ids[i]->sid) {
1359 DEBUG(1, ("invalid null SID in id_map array"));
1361 return NT_STATUS_INVALID_PARAMETER;
1364 ret = idmap_cache_map_id(idmap_cache, ids[i]);
1366 if (NT_STATUS_IS_OK(ret)) continue;
1369 /* alloc space for ids to be resolved by
1370 * backends (realloc ten by ten) */
1371 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1373 DEBUG(1, ("Out of memory!\n"));
1375 return NT_STATUS_NO_MEMORY;
1380 /* add this id to the ones to be retrieved
1381 * from the backends */
1385 /* check if we need to allocate new space
1386 * on the rids array */
1389 bids = talloc_realloc(ctx, bids, struct id_map *, bn);
1391 DEBUG(1, ("Out of memory!\n"));
1393 return NT_STATUS_NO_MEMORY;
1397 /* make sure the last element is NULL */
1401 /* let's see if there is any id mapping to be retrieved
1402 * from the backends */
1406 /* Only do query if we are online */
1407 online = !IS_DOMAIN_OFFLINE(our_domain);
1409 ret = idmap_backends_unixids_to_sids(bids);
1410 IDMAP_CHECK_RET(ret);
1413 /* update the cache */
1414 for (i = 0; i < bi; i++) {
1415 if (bids[i]->status == ID_MAPPED) {
1416 ret = idmap_cache_set(idmap_cache, bids[i]);
1417 } else if (bids[i]->status == ID_EXPIRED) {
1418 /* the cache returned an expired entry and the
1419 * backend was not able to clear the situation
1420 * (offline). This handles a previous
1421 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1422 * for disconnected mode, */
1423 bids[i]->status = ID_MAPPED;
1424 } else if (bids[i]->status == ID_UNKNOWN) {
1425 /* something bad here. We were not able to
1426 * handle this for some reason, mark it as
1427 * unmapped and hope next time things will
1429 bids[i]->status = ID_UNMAPPED;
1430 } else if (online) { /* unmapped */
1431 ret = idmap_cache_set_negative_id(idmap_cache,
1434 IDMAP_CHECK_RET(ret);
1444 NTSTATUS idmap_sids_to_unixids(struct id_map **ids)
1448 struct id_map **bids;
1451 struct winbindd_domain *our_domain = find_our_domain();
1453 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1457 if (!ids || !*ids) {
1458 DEBUG(1, ("Invalid list of maps\n"));
1459 return NT_STATUS_INVALID_PARAMETER;
1462 ctx = talloc_named_const(NULL, 0, "idmap_sids_to_unixids ctx");
1464 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1465 return NT_STATUS_NO_MEMORY;
1468 /* no ids to be asked to the backends by default */
1472 for (i = 0; ids[i]; i++) {
1474 if ( ! ids[i]->sid) {
1475 DEBUG(1, ("invalid null SID in id_map array\n"));
1477 return NT_STATUS_INVALID_PARAMETER;
1480 ret = idmap_cache_map_sid(idmap_cache, ids[i]);
1482 if (NT_STATUS_IS_OK(ret)) continue;
1485 /* alloc space for ids to be resolved
1486 by backends (realloc ten by ten) */
1487 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1489 DEBUG(1, ("Out of memory!\n"));
1491 return NT_STATUS_NO_MEMORY;
1496 /* add this id to the ones to be retrieved
1497 * from the backends */
1501 /* check if we need to allocate new space
1502 * on the ids array */
1505 bids = talloc_realloc(ctx, bids, struct id_map *, bn);
1507 DEBUG(1, ("Out of memory!\n"));
1509 return NT_STATUS_NO_MEMORY;
1513 /* make sure the last element is NULL */
1517 /* let's see if there is any id mapping to be retrieved
1518 * from the backends */
1522 /* Only do query if we are online */
1523 online = !IS_DOMAIN_OFFLINE(our_domain);
1525 ret = idmap_backends_sids_to_unixids(bids);
1526 IDMAP_CHECK_RET(ret);
1529 /* update the cache */
1530 for (i = 0; bids[i]; i++) {
1531 if (bids[i]->status == ID_MAPPED) {
1532 ret = idmap_cache_set(idmap_cache, bids[i]);
1533 } else if (bids[i]->status == ID_EXPIRED) {
1534 /* the cache returned an expired entry and the
1535 * backend was not able to clear the situation
1536 * (offline). This handles a previous
1537 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1538 * for disconnected mode, */
1539 bids[i]->status = ID_MAPPED;
1540 } else if (bids[i]->status == ID_UNKNOWN) {
1541 /* something bad here. We were not able to
1542 * handle this for some reason, mark it as
1543 * unmapped and hope next time things will
1545 bids[i]->status = ID_UNMAPPED;
1546 } else if (online) { /* unmapped */
1547 ret = idmap_cache_set_negative_sid(idmap_cache,
1550 IDMAP_CHECK_RET(ret);
1560 NTSTATUS idmap_set_mapping(const struct id_map *id)
1565 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1570 if ((id->sid == NULL) || (id->status != ID_MAPPED)) {
1571 DEBUG(1, ("NULL SID or unmapped entry\n"));
1572 return NT_STATUS_INVALID_PARAMETER;
1575 /* TODO: check uid/gid range ? */
1577 ctx = talloc_named_const(NULL, 0, "idmap_set_mapping ctx");
1579 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1580 return NT_STATUS_NO_MEMORY;
1583 /* set the new mapping */
1584 ret = idmap_backends_set_mapping(id);
1585 IDMAP_CHECK_RET(ret);
1587 /* set the mapping in the cache */
1588 ret = idmap_cache_set(idmap_cache, id);
1589 IDMAP_CHECK_RET(ret);
1596 char *idmap_fetch_secret(const char *backend, bool alloc,
1597 const char *domain, const char *identity)
1603 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
1605 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
1611 strupper_m(tmp); /* make sure the key is case insensitive */
1612 ret = secrets_fetch_generic(tmp, identity);