2 Unix SMB/CIFS implementation.
4 Copyright (C) Simo Sorce 2003
5 Copyright (C) Jeremy Allison 2006
6 Copyright (C) Michael Adam 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.*/
23 #include "winbindd_proto.h"
25 #include "idmap_cache.h"
26 #include "../libcli/security/security.h"
29 #define DBGC_CLASS DBGC_IDMAP
31 /*****************************************************************
32 Returns the SID mapped to the given UID.
33 If mapping is not possible returns an error.
34 *****************************************************************/
36 NTSTATUS idmap_uid_to_sid(const char *domname, struct dom_sid *sid, uid_t uid)
42 DEBUG(10,("idmap_uid_to_sid: uid = [%lu], domain = '%s'\n",
43 (unsigned long)uid, domname?domname:"NULL"));
45 if (winbindd_use_idmap_cache()
46 && idmap_cache_find_uid2sid(uid, sid, &expired)) {
47 DEBUG(10, ("idmap_cache_find_uid2sid found %u%s\n",
49 expired ? " (expired)": ""));
50 if (expired && idmap_is_online()) {
51 DEBUG(10, ("revalidating expired entry\n"));
54 if (is_null_sid(sid)) {
55 DEBUG(10, ("Returning negative cache entry\n"));
56 return NT_STATUS_NONE_MAPPED;
58 DEBUG(10, ("Returning positive cache entry\n"));
64 map.xid.type = ID_TYPE_UID;
67 ret = idmap_backends_unixid_to_sid(domname, &map);
68 if ( ! NT_STATUS_IS_OK(ret)) {
69 DEBUG(10, ("error mapping uid [%lu]\n", (unsigned long)uid));
73 if (map.status != ID_MAPPED) {
74 if (winbindd_use_idmap_cache()) {
75 struct dom_sid null_sid;
76 ZERO_STRUCT(null_sid);
77 idmap_cache_set_sid2uid(&null_sid, uid);
79 DEBUG(10, ("uid [%lu] not mapped\n", (unsigned long)uid));
80 return NT_STATUS_NONE_MAPPED;
83 if (winbindd_use_idmap_cache()) {
84 idmap_cache_set_sid2uid(sid, uid);
90 /*****************************************************************
91 Returns SID mapped to the given GID.
92 If mapping is not possible returns an error.
93 *****************************************************************/
95 NTSTATUS idmap_gid_to_sid(const char *domname, struct dom_sid *sid, gid_t gid)
101 DEBUG(10,("idmap_gid_to_sid: gid = [%lu], domain = '%s'\n",
102 (unsigned long)gid, domname?domname:"NULL"));
104 if (winbindd_use_idmap_cache()
105 && idmap_cache_find_gid2sid(gid, sid, &expired)) {
106 DEBUG(10, ("idmap_cache_find_gid2sid found %u%s\n",
108 expired ? " (expired)": ""));
109 if (expired && idmap_is_online()) {
110 DEBUG(10, ("revalidating expired entry\n"));
113 if (is_null_sid(sid)) {
114 DEBUG(10, ("Returning negative cache entry\n"));
115 return NT_STATUS_NONE_MAPPED;
117 DEBUG(10, ("Returning positive cache entry\n"));
123 map.xid.type = ID_TYPE_GID;
126 ret = idmap_backends_unixid_to_sid(domname, &map);
127 if ( ! NT_STATUS_IS_OK(ret)) {
128 DEBUG(10, ("error mapping gid [%lu]\n", (unsigned long)gid));
132 if (map.status != ID_MAPPED) {
133 if (winbindd_use_idmap_cache()) {
134 struct dom_sid null_sid;
135 ZERO_STRUCT(null_sid);
136 idmap_cache_set_sid2gid(&null_sid, gid);
138 DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid));
139 return NT_STATUS_NONE_MAPPED;
142 if (winbindd_use_idmap_cache()) {
143 idmap_cache_set_sid2gid(sid, gid);
149 /*****************************************************************
150 Returns the UID mapped to the given SID.
151 If mapping is not possible or SID maps to a GID returns an error.
152 *****************************************************************/
154 NTSTATUS idmap_sid_to_uid(const char *dom_name, struct dom_sid *sid, uid_t *uid)
160 DEBUG(10,("idmap_sid_to_uid: sid = [%s], domain = '%s'\n",
161 sid_string_dbg(sid), dom_name));
163 if (winbindd_use_idmap_cache()
164 && idmap_cache_find_sid2uid(sid, uid, &expired)) {
165 DEBUG(10, ("idmap_cache_find_sid2uid found %d%s\n",
166 (int)(*uid), expired ? " (expired)": ""));
167 if (expired && idmap_is_online()) {
168 DEBUG(10, ("revalidating expired entry\n"));
172 DEBUG(10, ("Returning negative cache entry\n"));
173 return NT_STATUS_NONE_MAPPED;
175 DEBUG(10, ("Returning positive cache entry\n"));
181 map.xid.type = ID_TYPE_UID;
183 ret = idmap_backends_sid_to_unixid(dom_name, &map);
185 if (!NT_STATUS_IS_OK(ret)) {
186 DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
188 if (winbindd_use_idmap_cache()) {
189 idmap_cache_set_sid2uid(sid, -1);
194 if (map.status != ID_MAPPED) {
195 DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid)));
196 if (winbindd_use_idmap_cache()) {
197 idmap_cache_set_sid2uid(sid, -1);
199 return NT_STATUS_NONE_MAPPED;
202 if (map.xid.type != ID_TYPE_UID) {
203 DEBUG(10, ("sid [%s] not mapped to a uid "
209 if (winbindd_use_idmap_cache()) {
210 idmap_cache_set_sid2uid(sid, -1);
212 return NT_STATUS_NONE_MAPPED;
215 *uid = (uid_t)map.xid.id;
216 if (winbindd_use_idmap_cache()) {
217 idmap_cache_set_sid2uid(sid, *uid);
222 /*****************************************************************
223 Returns the GID mapped to the given SID.
224 If mapping is not possible or SID maps to a UID returns an error.
225 *****************************************************************/
227 NTSTATUS idmap_sid_to_gid(const char *domname, struct dom_sid *sid, gid_t *gid)
233 DEBUG(10,("idmap_sid_to_gid: sid = [%s], domain = '%s'\n",
234 sid_string_dbg(sid), domname));
236 if (winbindd_use_idmap_cache()
237 && idmap_cache_find_sid2gid(sid, gid, &expired)) {
238 DEBUG(10, ("idmap_cache_find_sid2gid found %d%s\n",
239 (int)(*gid), expired ? " (expired)": ""));
240 if (expired && idmap_is_online()) {
241 DEBUG(10, ("revalidating expired entry\n"));
245 DEBUG(10, ("Returning negative cache entry\n"));
246 return NT_STATUS_NONE_MAPPED;
248 DEBUG(10, ("Returning positive cache entry\n"));
254 map.xid.type = ID_TYPE_GID;
256 ret = idmap_backends_sid_to_unixid(domname, &map);
258 if (!NT_STATUS_IS_OK(ret)) {
259 DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
261 if (winbindd_use_idmap_cache()) {
262 idmap_cache_set_sid2gid(sid, -1);
267 if (map.status != ID_MAPPED) {
268 DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid)));
269 if (winbindd_use_idmap_cache()) {
270 idmap_cache_set_sid2gid(sid, -1);
272 return NT_STATUS_NONE_MAPPED;
275 if (map.xid.type != ID_TYPE_GID) {
276 DEBUG(10, ("sid [%s] not mapped to a gid "
282 if (winbindd_use_idmap_cache()) {
283 idmap_cache_set_sid2gid(sid, -1);
285 return NT_STATUS_NONE_MAPPED;
289 if (winbindd_use_idmap_cache()) {
290 idmap_cache_set_sid2gid(sid, *gid);
296 * check whether a given unix id is inside the filter range of an idmap domain
298 bool idmap_unix_id_is_in_range(uint32_t id, struct idmap_domain *dom)
301 /* 0 is not an allowed unix id for id mapping */
305 if ((dom->low_id && (id < dom->low_id)) ||
306 (dom->high_id && (id > dom->high_id)))