2 Unix SMB/CIFS implementation.
4 Copyright (C) Simo Sorce 2003
5 Copyright (C) Jeremy Allison 2006
6 Copyright (C) Michael Adam 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.*/
23 #include "winbindd_proto.h"
25 #include "idmap_cache.h"
26 #include "../libcli/security/security.h"
29 #define DBGC_CLASS DBGC_IDMAP
31 /*****************************************************************
32 Returns the SID mapped to the given UID.
33 If mapping is not possible returns an error.
34 *****************************************************************/
36 NTSTATUS idmap_uid_to_sid(const char *domname, struct dom_sid *sid, uid_t uid)
42 DEBUG(10,("idmap_uid_to_sid: uid = [%lu], domain = '%s'\n",
43 (unsigned long)uid, domname?domname:"NULL"));
45 if (winbindd_use_idmap_cache()
46 && idmap_cache_find_uid2sid(uid, sid, &expired)) {
47 DEBUG(10, ("idmap_cache_find_uid2sid found %u%s\n",
49 expired ? " (expired)": ""));
50 if (expired && idmap_is_online()) {
51 DEBUG(10, ("revalidating expired entry\n"));
54 if (is_null_sid(sid)) {
55 DEBUG(10, ("Returning negative cache entry\n"));
56 return NT_STATUS_NONE_MAPPED;
58 DEBUG(10, ("Returning positive cache entry\n"));
65 map.xid.type = ID_TYPE_UID;
68 ret = idmap_backends_unixid_to_sid(domname, &map);
69 if ( ! NT_STATUS_IS_OK(ret)) {
70 DEBUG(10, ("error mapping uid [%lu]\n", (unsigned long)uid));
74 if (map.status != ID_MAPPED) {
75 if (winbindd_use_idmap_cache()) {
76 struct dom_sid null_sid;
78 id.type = ID_TYPE_UID;
80 ZERO_STRUCT(null_sid);
81 idmap_cache_set_sid2unixid(&null_sid, &id);
83 DEBUG(10, ("uid [%lu] not mapped\n", (unsigned long)uid));
84 return NT_STATUS_NONE_MAPPED;
87 if (winbindd_use_idmap_cache()) {
88 idmap_cache_set_sid2unixid(sid, &map.xid);
94 /*****************************************************************
95 Returns SID mapped to the given GID.
96 If mapping is not possible returns an error.
97 *****************************************************************/
99 NTSTATUS idmap_gid_to_sid(const char *domname, struct dom_sid *sid, gid_t gid)
105 DEBUG(10,("idmap_gid_to_sid: gid = [%lu], domain = '%s'\n",
106 (unsigned long)gid, domname?domname:"NULL"));
108 if (winbindd_use_idmap_cache()
109 && idmap_cache_find_gid2sid(gid, sid, &expired)) {
110 DEBUG(10, ("idmap_cache_find_gid2sid found %u%s\n",
112 expired ? " (expired)": ""));
113 if (expired && idmap_is_online()) {
114 DEBUG(10, ("revalidating expired entry\n"));
117 if (is_null_sid(sid)) {
118 DEBUG(10, ("Returning negative cache entry\n"));
119 return NT_STATUS_NONE_MAPPED;
121 DEBUG(10, ("Returning positive cache entry\n"));
128 map.xid.type = ID_TYPE_GID;
131 ret = idmap_backends_unixid_to_sid(domname, &map);
132 if ( ! NT_STATUS_IS_OK(ret)) {
133 DEBUG(10, ("error mapping gid [%lu]\n", (unsigned long)gid));
137 if (map.status != ID_MAPPED) {
138 if (winbindd_use_idmap_cache()) {
139 struct dom_sid null_sid;
141 id.type = ID_TYPE_GID;
143 ZERO_STRUCT(null_sid);
144 idmap_cache_set_sid2unixid(&null_sid, &id);
146 DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid));
147 return NT_STATUS_NONE_MAPPED;
150 if (winbindd_use_idmap_cache()) {
151 idmap_cache_set_sid2unixid(sid, &map.xid);
158 * check whether a given unix id is inside the filter range of an idmap domain
160 bool idmap_unix_id_is_in_range(uint32_t id, struct idmap_domain *dom)
163 /* 0 is not an allowed unix id for id mapping */
167 if ((dom->low_id && (id < dom->low_id)) ||
168 (dom->high_id && (id > dom->high_id)))
177 * Helper for unixids_to_sids: find entry by id in mapping array,
178 * search up to IDMAP_AD_MAX_IDS entries
180 struct id_map *idmap_find_map_by_id(struct id_map **maps, enum id_type type,
185 for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
186 if (maps[i] == NULL) { /* end of the run */
189 if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
198 * Helper for sids_to_unix_ids: find entry by SID in mapping array,
199 * search up to IDMAP_AD_MAX_IDS entries
201 struct id_map *idmap_find_map_by_sid(struct id_map **maps, struct dom_sid *sid)
205 for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
206 if (maps[i] == NULL) { /* end of the run */
209 if (dom_sid_equal(maps[i]->sid, sid)) {