2 Unix SMB/CIFS implementation.
4 Winbind ADS backend functions
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
8 Copyright (C) Gerald (Jerry) Carter 2004
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "../librpc/gen_ndr/cli_netlogon.h"
31 #define DBGC_CLASS DBGC_WINBIND
33 extern struct winbindd_methods reconnect_methods;
36 return our ads connections structure for a domain. We keep the connection
37 open to make things faster
39 static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain)
44 struct sockaddr_storage dc_ss;
46 DEBUG(10,("ads_cached_connection\n"));
48 if (domain->private_data) {
51 time_t now = time(NULL);
53 /* check for a valid structure */
54 ads = (ADS_STRUCT *)domain->private_data;
56 expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
58 DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
59 (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
61 if ( ads->config.realm && (expire > now)) {
64 /* we own this ADS_STRUCT so make sure it goes away */
65 DEBUG(7,("Deleting expired krb5 credential cache\n"));
68 ads_kdestroy("MEMORY:winbind_ccache");
69 domain->private_data = NULL;
73 /* we don't want this to affect the users ccache */
74 setenv("KRB5CCNAME", "MEMORY:winbind_ccache", 1);
76 ads = ads_init(domain->alt_name, domain->name, NULL);
78 DEBUG(1,("ads_init for domain %s failed\n", domain->name));
82 /* the machine acct password might have change - fetch it every time */
84 SAFE_FREE(ads->auth.password);
85 SAFE_FREE(ads->auth.realm);
89 if ( !pdb_get_trusteddom_pw( domain->name, &ads->auth.password, NULL, NULL ) ) {
93 ads->auth.realm = SMB_STRDUP( ads->server.realm );
94 strupper_m( ads->auth.realm );
97 struct winbindd_domain *our_domain = domain;
99 ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
101 /* always give preference to the alt_name in our
102 primary domain if possible */
104 if ( !domain->primary )
105 our_domain = find_our_domain();
107 if ( our_domain->alt_name[0] != '\0' ) {
108 ads->auth.realm = SMB_STRDUP( our_domain->alt_name );
109 strupper_m( ads->auth.realm );
112 ads->auth.realm = SMB_STRDUP( lp_realm() );
115 ads->auth.renewable = WINBINDD_PAM_AUTH_KRB5_RENEW_TIME;
117 /* Setup the server affinity cache. We don't reaally care
118 about the name. Just setup affinity and the KRB5_CONFIG
121 get_dc_name( ads->server.workgroup, ads->server.realm, dc_name, &dc_ss );
123 status = ads_connect(ads);
124 if (!ADS_ERR_OK(status) || !ads->config.realm) {
125 DEBUG(1,("ads_connect for domain %s failed: %s\n",
126 domain->name, ads_errstr(status)));
129 /* if we get ECONNREFUSED then it might be a NT4
130 server, fall back to MSRPC */
131 if (status.error_type == ENUM_ADS_ERROR_SYSTEM &&
132 status.err.rc == ECONNREFUSED) {
133 /* 'reconnect_methods' is the MS-RPC backend. */
134 DEBUG(1,("Trying MSRPC methods\n"));
135 domain->backend = &reconnect_methods;
140 /* set the flag that says we don't own the memory even
141 though we do so that ads_destroy() won't destroy the
142 structure we pass back by reference */
144 ads->is_mine = False;
146 domain->private_data = (void *)ads;
151 /* Query display info for a realm. This is the basic user list fn */
152 static NTSTATUS query_user_list(struct winbindd_domain *domain,
155 struct wbint_userinfo **info)
157 ADS_STRUCT *ads = NULL;
158 const char *attrs[] = { "*", NULL };
161 LDAPMessage *res = NULL;
162 LDAPMessage *msg = NULL;
163 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
167 DEBUG(3,("ads: query_user_list\n"));
169 if ( !winbindd_can_contact_domain( domain ) ) {
170 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
175 ads = ads_cached_connection(domain);
178 domain->last_status = NT_STATUS_SERVER_DISABLED;
182 rc = ads_search_retry(ads, &res, "(objectCategory=user)", attrs);
183 if (!ADS_ERR_OK(rc) || !res) {
184 DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
188 count = ads_count_replies(ads, res);
190 DEBUG(1,("query_user_list: No users found\n"));
194 (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct wbint_userinfo, count);
196 status = NT_STATUS_NO_MEMORY;
202 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
204 const char *gecos = NULL;
205 const char *homedir = NULL;
206 const char *shell = NULL;
210 gid_t primary_gid = (gid_t)-1;
212 if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype) ||
213 ds_atype_map(atype) != SID_NAME_USER) {
214 DEBUG(1,("Not a user account? atype=0x%x\n", atype));
218 name = ads_pull_username(ads, mem_ctx, msg);
220 if ( ads_pull_sid( ads, msg, "objectSid", &user_sid ) ) {
221 status = nss_get_info_cached( domain, &user_sid, mem_ctx,
222 ads, msg, &homedir, &shell, &gecos,
227 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
230 if (!ads_pull_sid(ads, msg, "objectSid",
231 &(*info)[i].user_sid)) {
232 DEBUG(1,("No sid for %s !?\n", name));
235 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
236 DEBUG(1,("No primary group for %s !?\n", name));
240 (*info)[i].acct_name = name;
241 (*info)[i].full_name = gecos;
242 (*info)[i].homedir = homedir;
243 (*info)[i].shell = shell;
244 (*info)[i].primary_gid = primary_gid;
245 sid_compose(&(*info)[i].group_sid, &domain->sid, group);
250 status = NT_STATUS_OK;
252 DEBUG(3,("ads query_user_list gave %d entries\n", (*num_entries)));
256 ads_msgfree(ads, res);
261 /* list all domain groups */
262 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
265 struct acct_info **info)
267 ADS_STRUCT *ads = NULL;
268 const char *attrs[] = {"userPrincipalName", "sAMAccountName",
269 "name", "objectSid", NULL};
272 LDAPMessage *res = NULL;
273 LDAPMessage *msg = NULL;
274 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
276 bool enum_dom_local_groups = False;
280 DEBUG(3,("ads: enum_dom_groups\n"));
282 if ( !winbindd_can_contact_domain( domain ) ) {
283 DEBUG(10,("enum_dom_groups: No incoming trust for domain %s\n",
288 /* only grab domain local groups for our domain */
289 if ( domain->active_directory && strequal(lp_realm(), domain->alt_name) ) {
290 enum_dom_local_groups = True;
293 /* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o
296 * According to Section 5.1(4) of RFC 2251 if a value of a type is it's
297 * default value, it MUST be absent. In case of extensible matching the
298 * "dnattr" boolean defaults to FALSE and so it must be only be present
301 * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a
302 * filter using bitwise matching rule then the buggy AD fails to decode
303 * the extensible match. As a workaround set it to TRUE and thereby add
304 * the dnAttributes "dn" field to cope with those older AD versions.
305 * It should not harm and won't put any additional load on the AD since
306 * none of the dn components have a bitmask-attribute.
308 * Thanks to Ralf Haferkamp for input and testing - Guenther */
310 filter = talloc_asprintf(mem_ctx, "(&(objectCategory=group)(&(groupType:dn:%s:=%d)(!(groupType:dn:%s:=%d))))",
311 ADS_LDAP_MATCHING_RULE_BIT_AND, GROUP_TYPE_SECURITY_ENABLED,
312 ADS_LDAP_MATCHING_RULE_BIT_AND,
313 enum_dom_local_groups ? GROUP_TYPE_BUILTIN_LOCAL_GROUP : GROUP_TYPE_RESOURCE_GROUP);
315 if (filter == NULL) {
316 status = NT_STATUS_NO_MEMORY;
320 ads = ads_cached_connection(domain);
323 domain->last_status = NT_STATUS_SERVER_DISABLED;
327 rc = ads_search_retry(ads, &res, filter, attrs);
328 if (!ADS_ERR_OK(rc) || !res) {
329 DEBUG(1,("enum_dom_groups ads_search: %s\n", ads_errstr(rc)));
333 count = ads_count_replies(ads, res);
335 DEBUG(1,("enum_dom_groups: No groups found\n"));
339 (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct acct_info, count);
341 status = NT_STATUS_NO_MEMORY;
347 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
352 name = ads_pull_username(ads, mem_ctx, msg);
353 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
354 if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
355 DEBUG(1,("No sid for %s !?\n", name));
359 if (!sid_peek_check_rid(&domain->sid, &sid, &rid)) {
360 DEBUG(1,("No rid for %s !?\n", name));
364 fstrcpy((*info)[i].acct_name, name);
365 fstrcpy((*info)[i].acct_desc, gecos);
366 (*info)[i].rid = rid;
372 status = NT_STATUS_OK;
374 DEBUG(3,("ads enum_dom_groups gave %d entries\n", (*num_entries)));
378 ads_msgfree(ads, res);
383 /* list all domain local groups */
384 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
387 struct acct_info **info)
390 * This is a stub function only as we returned the domain
391 * local groups in enum_dom_groups() if the domain->native field
392 * was true. This is a simple performance optimization when
395 * if we ever need to enumerate domain local groups separately,
396 * then this optimization in enum_dom_groups() will need
404 /* convert a single name to a sid in a domain - use rpc methods */
405 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
407 const char *domain_name,
411 enum lsa_SidType *type)
413 return reconnect_methods.name_to_sid(domain, mem_ctx,
414 domain_name, name, flags,
418 /* convert a domain SID to a user or group name - use rpc methods */
419 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
424 enum lsa_SidType *type)
426 return reconnect_methods.sid_to_name(domain, mem_ctx, sid,
427 domain_name, name, type);
430 /* convert a list of rids to names - use rpc methods */
431 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
438 enum lsa_SidType **types)
440 return reconnect_methods.rids_to_names(domain, mem_ctx, sid,
442 domain_name, names, types);
445 /* If you are looking for "dn_lookup": Yes, it used to be here!
446 * It has gone now since it was a major speed bottleneck in
447 * lookup_groupmem (its only use). It has been replaced by
448 * an rpc lookup sids call... R.I.P. */
450 /* Lookup user information from a rid */
451 static NTSTATUS query_user(struct winbindd_domain *domain,
454 struct wbint_userinfo *info)
456 ADS_STRUCT *ads = NULL;
457 const char *attrs[] = { "*", NULL };
460 LDAPMessage *msg = NULL;
464 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
465 struct netr_SamInfo3 *user = NULL;
468 DEBUG(3,("ads: query_user\n"));
470 info->homedir = NULL;
472 info->primary_gid = (gid_t)-1;
474 /* try netsamlogon cache first */
476 if ( (user = netsamlogon_cache_get( mem_ctx, sid )) != NULL )
478 DEBUG(5,("query_user: Cache lookup succeeded for %s\n",
479 sid_string_dbg(sid)));
481 sid_compose(&info->user_sid, &domain->sid, user->base.rid);
482 sid_compose(&info->group_sid, &domain->sid, user->base.primary_gid);
484 info->acct_name = talloc_strdup(mem_ctx, user->base.account_name.string);
485 info->full_name = talloc_strdup(mem_ctx, user->base.full_name.string);
487 nss_get_info_cached( domain, sid, mem_ctx, NULL, NULL,
488 &info->homedir, &info->shell, &info->full_name,
490 info->primary_gid = gid;
497 if ( !winbindd_can_contact_domain(domain)) {
498 DEBUG(8,("query_user: No incoming trust from domain %s\n",
501 /* We still need to generate some basic information
502 about the user even if we cannot contact the
503 domain. Most of this stuff we can deduce. */
505 sid_copy( &info->user_sid, sid );
507 /* Assume "Domain Users" for the primary group */
509 sid_compose(&info->group_sid, &domain->sid, DOMAIN_GROUP_RID_USERS );
511 /* Try to fill in what the nss_info backend can do */
513 nss_get_info_cached( domain, sid, mem_ctx, NULL, NULL,
514 &info->homedir, &info->shell, &info->full_name,
516 info->primary_gid = gid;
518 status = NT_STATUS_OK;
522 /* no cache...do the query */
524 if ( (ads = ads_cached_connection(domain)) == NULL ) {
525 domain->last_status = NT_STATUS_SERVER_DISABLED;
529 sidstr = sid_binstring(talloc_tos(), sid);
530 if (asprintf(&ldap_exp, "(objectSid=%s)", sidstr) == -1) {
531 status = NT_STATUS_NO_MEMORY;
534 rc = ads_search_retry(ads, &msg, ldap_exp, attrs);
537 if (!ADS_ERR_OK(rc) || !msg) {
538 DEBUG(1,("query_user(sid=%s) ads_search: %s\n",
539 sid_string_dbg(sid), ads_errstr(rc)));
543 count = ads_count_replies(ads, msg);
545 DEBUG(1,("query_user(sid=%s): Not found\n",
546 sid_string_dbg(sid)));
550 info->acct_name = ads_pull_username(ads, mem_ctx, msg);
552 nss_get_info_cached( domain, sid, mem_ctx, ads, msg,
553 &info->homedir, &info->shell, &info->full_name,
555 info->primary_gid = gid;
557 if (info->full_name == NULL) {
558 info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
561 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
562 DEBUG(1,("No primary group for %s !?\n",
563 sid_string_dbg(sid)));
567 sid_copy(&info->user_sid, sid);
568 sid_compose(&info->group_sid, &domain->sid, group_rid);
570 status = NT_STATUS_OK;
572 DEBUG(3,("ads query_user gave %s\n", info->acct_name));
575 ads_msgfree(ads, msg);
580 /* Lookup groups a user is a member of - alternate method, for when
581 tokenGroups are not available. */
582 static NTSTATUS lookup_usergroups_member(struct winbindd_domain *domain,
585 DOM_SID *primary_group,
586 size_t *p_num_groups, DOM_SID **user_sids)
589 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
591 LDAPMessage *res = NULL;
592 LDAPMessage *msg = NULL;
595 const char *group_attrs[] = {"objectSid", NULL};
597 size_t num_groups = 0;
599 DEBUG(3,("ads: lookup_usergroups_member\n"));
601 if ( !winbindd_can_contact_domain( domain ) ) {
602 DEBUG(10,("lookup_usergroups_members: No incoming trust for domain %s\n",
607 ads = ads_cached_connection(domain);
610 domain->last_status = NT_STATUS_SERVER_DISABLED;
614 if (!(escaped_dn = escape_ldap_string(talloc_tos(), user_dn))) {
615 status = NT_STATUS_NO_MEMORY;
619 ldap_exp = talloc_asprintf(mem_ctx,
620 "(&(member=%s)(objectCategory=group)(groupType:dn:%s:=%d))",
622 ADS_LDAP_MATCHING_RULE_BIT_AND,
623 GROUP_TYPE_SECURITY_ENABLED);
625 DEBUG(1,("lookup_usergroups(dn=%s) asprintf failed!\n", user_dn));
626 TALLOC_FREE(escaped_dn);
627 status = NT_STATUS_NO_MEMORY;
631 TALLOC_FREE(escaped_dn);
633 rc = ads_search_retry(ads, &res, ldap_exp, group_attrs);
635 if (!ADS_ERR_OK(rc) || !res) {
636 DEBUG(1,("lookup_usergroups ads_search member=%s: %s\n", user_dn, ads_errstr(rc)));
637 return ads_ntstatus(rc);
640 count = ads_count_replies(ads, res);
645 /* always add the primary group to the sid array */
646 status = add_sid_to_array(mem_ctx, primary_group, user_sids,
648 if (!NT_STATUS_IS_OK(status)) {
653 for (msg = ads_first_entry(ads, res); msg;
654 msg = ads_next_entry(ads, msg)) {
657 if (!ads_pull_sid(ads, msg, "objectSid", &group_sid)) {
658 DEBUG(1,("No sid for this group ?!?\n"));
662 /* ignore Builtin groups from ADS - Guenther */
663 if (sid_check_is_in_builtin(&group_sid)) {
667 status = add_sid_to_array(mem_ctx, &group_sid,
668 user_sids, &num_groups);
669 if (!NT_STATUS_IS_OK(status)) {
676 *p_num_groups = num_groups;
677 status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
679 DEBUG(3,("ads lookup_usergroups (member) succeeded for dn=%s\n", user_dn));
682 ads_msgfree(ads, res);
687 /* Lookup groups a user is a member of - alternate method, for when
688 tokenGroups are not available. */
689 static NTSTATUS lookup_usergroups_memberof(struct winbindd_domain *domain,
692 DOM_SID *primary_group,
693 size_t *p_num_groups,
697 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
699 const char *attrs[] = {"memberOf", NULL};
700 size_t num_groups = 0;
701 DOM_SID *group_sids = NULL;
703 char **strings = NULL;
704 size_t num_strings = 0, num_sids = 0;
707 DEBUG(3,("ads: lookup_usergroups_memberof\n"));
709 if ( !winbindd_can_contact_domain( domain ) ) {
710 DEBUG(10,("lookup_usergroups_memberof: No incoming trust for "
711 "domain %s\n", domain->name));
715 ads = ads_cached_connection(domain);
718 domain->last_status = NT_STATUS_SERVER_DISABLED;
719 return NT_STATUS_UNSUCCESSFUL;
722 rc = ads_search_retry_extended_dn_ranged(ads, mem_ctx, user_dn, attrs,
723 ADS_EXTENDED_DN_HEX_STRING,
724 &strings, &num_strings);
726 if (!ADS_ERR_OK(rc)) {
727 DEBUG(1,("lookup_usergroups_memberof ads_search "
728 "member=%s: %s\n", user_dn, ads_errstr(rc)));
729 return ads_ntstatus(rc);
735 /* always add the primary group to the sid array */
736 status = add_sid_to_array(mem_ctx, primary_group, user_sids,
738 if (!NT_STATUS_IS_OK(status)) {
742 group_sids = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_strings + 1);
744 status = NT_STATUS_NO_MEMORY;
748 for (i=0; i<num_strings; i++) {
749 rc = ads_get_sid_from_extended_dn(mem_ctx, strings[i],
750 ADS_EXTENDED_DN_HEX_STRING,
752 if (!ADS_ERR_OK(rc)) {
753 /* ignore members without SIDs */
754 if (NT_STATUS_EQUAL(ads_ntstatus(rc),
755 NT_STATUS_NOT_FOUND)) {
759 status = ads_ntstatus(rc);
767 DEBUG(1,("No memberOf for this user?!?\n"));
768 status = NT_STATUS_NO_MEMORY;
772 for (i=0; i<num_sids; i++) {
774 /* ignore Builtin groups from ADS - Guenther */
775 if (sid_check_is_in_builtin(&group_sids[i])) {
779 status = add_sid_to_array(mem_ctx, &group_sids[i], user_sids,
781 if (!NT_STATUS_IS_OK(status)) {
787 *p_num_groups = num_groups;
788 status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
790 DEBUG(3,("ads lookup_usergroups (memberof) succeeded for dn=%s\n",
794 TALLOC_FREE(strings);
795 TALLOC_FREE(group_sids);
801 /* Lookup groups a user is a member of. */
802 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
805 uint32 *p_num_groups, DOM_SID **user_sids)
807 ADS_STRUCT *ads = NULL;
808 const char *attrs[] = {"tokenGroups", "primaryGroupID", NULL};
811 LDAPMessage *msg = NULL;
812 char *user_dn = NULL;
815 DOM_SID primary_group;
816 uint32 primary_group_rid;
817 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
818 size_t num_groups = 0;
820 DEBUG(3,("ads: lookup_usergroups\n"));
823 status = lookup_usergroups_cached(domain, mem_ctx, sid,
824 p_num_groups, user_sids);
825 if (NT_STATUS_IS_OK(status)) {
829 if ( !winbindd_can_contact_domain( domain ) ) {
830 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
833 /* Tell the cache manager not to remember this one */
835 return NT_STATUS_SYNCHRONIZATION_REQUIRED;
838 ads = ads_cached_connection(domain);
841 domain->last_status = NT_STATUS_SERVER_DISABLED;
842 status = NT_STATUS_SERVER_DISABLED;
846 rc = ads_search_retry_sid(ads, &msg, sid, attrs);
848 if (!ADS_ERR_OK(rc)) {
849 status = ads_ntstatus(rc);
850 DEBUG(1, ("lookup_usergroups(sid=%s) ads_search tokenGroups: "
851 "%s\n", sid_string_dbg(sid), ads_errstr(rc)));
855 count = ads_count_replies(ads, msg);
857 status = NT_STATUS_UNSUCCESSFUL;
858 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: "
859 "invalid number of results (count=%d)\n",
860 sid_string_dbg(sid), count));
865 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n",
866 sid_string_dbg(sid)));
867 status = NT_STATUS_UNSUCCESSFUL;
871 user_dn = ads_get_dn(ads, mem_ctx, msg);
872 if (user_dn == NULL) {
873 status = NT_STATUS_NO_MEMORY;
877 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
878 DEBUG(1,("%s: No primary group for sid=%s !?\n",
879 domain->name, sid_string_dbg(sid)));
883 sid_copy(&primary_group, &domain->sid);
884 sid_append_rid(&primary_group, primary_group_rid);
886 count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids);
888 /* there must always be at least one group in the token,
889 unless we are talking to a buggy Win2k server */
891 /* actually this only happens when the machine account has no read
892 * permissions on the tokenGroup attribute - gd */
898 /* lookup what groups this user is a member of by DN search on
901 status = lookup_usergroups_memberof(domain, mem_ctx, user_dn,
903 &num_groups, user_sids);
904 *p_num_groups = (uint32)num_groups;
905 if (NT_STATUS_IS_OK(status)) {
909 /* lookup what groups this user is a member of by DN search on
912 status = lookup_usergroups_member(domain, mem_ctx, user_dn,
914 &num_groups, user_sids);
915 *p_num_groups = (uint32)num_groups;
922 status = add_sid_to_array(mem_ctx, &primary_group, user_sids,
924 if (!NT_STATUS_IS_OK(status)) {
928 for (i=0;i<count;i++) {
930 /* ignore Builtin groups from ADS - Guenther */
931 if (sid_check_is_in_builtin(&sids[i])) {
935 status = add_sid_to_array_unique(mem_ctx, &sids[i],
936 user_sids, &num_groups);
937 if (!NT_STATUS_IS_OK(status)) {
942 *p_num_groups = (uint32)num_groups;
943 status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
945 DEBUG(3,("ads lookup_usergroups (tokenGroups) succeeded for sid=%s\n",
946 sid_string_dbg(sid)));
948 TALLOC_FREE(user_dn);
949 ads_msgfree(ads, msg);
953 /* Lookup aliases a user is member of - use rpc methods */
954 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
956 uint32 num_sids, const DOM_SID *sids,
957 uint32 *num_aliases, uint32 **alias_rids)
959 return reconnect_methods.lookup_useraliases(domain, mem_ctx,
966 find the members of a group, given a group rid and domain
968 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
970 const DOM_SID *group_sid,
971 enum lsa_SidType type,
973 DOM_SID **sid_mem, char ***names,
977 ADS_STRUCT *ads = NULL;
979 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
981 char **members = NULL;
983 size_t num_members = 0;
985 DOM_SID *sid_mem_nocache = NULL;
986 char **names_nocache = NULL;
987 enum lsa_SidType *name_types_nocache = NULL;
988 char **domains_nocache = NULL; /* only needed for rpccli_lsa_lookup_sids */
989 uint32 num_nocache = 0;
990 TALLOC_CTX *tmp_ctx = NULL;
992 DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name,
993 sid_string_dbg(group_sid)));
997 tmp_ctx = talloc_new(mem_ctx);
999 DEBUG(1, ("ads: lookup_groupmem: talloc failed\n"));
1000 status = NT_STATUS_NO_MEMORY;
1004 if ( !winbindd_can_contact_domain( domain ) ) {
1005 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
1007 return NT_STATUS_OK;
1010 ads = ads_cached_connection(domain);
1013 domain->last_status = NT_STATUS_SERVER_DISABLED;
1017 if ((sidbinstr = sid_binstring(talloc_tos(), group_sid)) == NULL) {
1018 status = NT_STATUS_NO_MEMORY;
1022 /* search for all members of the group */
1023 ldap_exp = talloc_asprintf(tmp_ctx, "(objectSid=%s)", sidbinstr);
1024 TALLOC_FREE(sidbinstr);
1025 if (ldap_exp == NULL) {
1026 DEBUG(1, ("ads: lookup_groupmem: talloc_asprintf for ldap_exp failed!\n"));
1027 status = NT_STATUS_NO_MEMORY;
1031 args.control = ADS_EXTENDED_DN_OID;
1032 args.val = ADS_EXTENDED_DN_HEX_STRING;
1033 args.critical = True;
1035 rc = ads_ranged_search(ads, tmp_ctx, LDAP_SCOPE_SUBTREE, ads->config.bind_path,
1036 ldap_exp, &args, "member", &members, &num_members);
1038 if (!ADS_ERR_OK(rc)) {
1039 DEBUG(0,("ads_ranged_search failed with: %s\n", ads_errstr(rc)));
1040 status = NT_STATUS_UNSUCCESSFUL;
1044 DEBUG(10, ("ads lookup_groupmem: got %d sids via extended dn call\n", (int)num_members));
1046 /* Now that we have a list of sids, we need to get the
1047 * lists of names and name_types belonging to these sids.
1048 * even though conceptually not quite clean, we use the
1049 * RPC call lsa_lookup_sids for this since it can handle a
1050 * list of sids. ldap calls can just resolve one sid at a time.
1052 * At this stage, the sids are still hidden in the exetended dn
1053 * member output format. We actually do a little better than
1054 * stated above: In extracting the sids from the member strings,
1055 * we try to resolve as many sids as possible from the
1056 * cache. Only the rest is passed to the lsa_lookup_sids call. */
1059 (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
1060 (*names) = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_members);
1061 (*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
1062 (sid_mem_nocache) = TALLOC_ZERO_ARRAY(tmp_ctx, DOM_SID, num_members);
1064 if ((members == NULL) || (*sid_mem == NULL) ||
1065 (*names == NULL) || (*name_types == NULL) ||
1066 (sid_mem_nocache == NULL))
1068 DEBUG(1, ("ads: lookup_groupmem: talloc failed\n"));
1069 status = NT_STATUS_NO_MEMORY;
1076 (*name_types) = NULL;
1079 for (i=0; i<num_members; i++) {
1080 enum lsa_SidType name_type;
1081 char *name, *domain_name;
1084 rc = ads_get_sid_from_extended_dn(tmp_ctx, members[i], args.val,
1086 if (!ADS_ERR_OK(rc)) {
1087 if (NT_STATUS_EQUAL(ads_ntstatus(rc),
1088 NT_STATUS_NOT_FOUND)) {
1089 /* Group members can be objects, like Exchange
1090 * Public Folders, that don't have a SID. Skip
1095 status = ads_ntstatus(rc);
1099 if (lookup_cached_sid(mem_ctx, &sid, &domain_name, &name,
1101 DEBUG(10,("ads: lookup_groupmem: got sid %s from "
1102 "cache\n", sid_string_dbg(&sid)));
1103 sid_copy(&(*sid_mem)[*num_names], &sid);
1104 (*names)[*num_names] = fill_domain_username_talloc(
1110 (*name_types)[*num_names] = name_type;
1114 DEBUG(10, ("ads: lookup_groupmem: sid %s not found in "
1115 "cache\n", sid_string_dbg(&sid)));
1116 sid_copy(&(sid_mem_nocache)[num_nocache], &sid);
1121 DEBUG(10, ("ads: lookup_groupmem: %d sids found in cache, "
1122 "%d left for lsa_lookupsids\n", *num_names, num_nocache));
1124 /* handle sids not resolved from cache by lsa_lookup_sids */
1125 if (num_nocache > 0) {
1127 status = winbindd_lookup_sids(tmp_ctx,
1133 &name_types_nocache);
1135 if (!(NT_STATUS_IS_OK(status) ||
1136 NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED) ||
1137 NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)))
1139 DEBUG(1, ("lsa_lookupsids call failed with %s "
1140 "- retrying...\n", nt_errstr(status)));
1142 status = winbindd_lookup_sids(tmp_ctx,
1148 &name_types_nocache);
1151 if (NT_STATUS_IS_OK(status) ||
1152 NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED))
1154 /* Copy the entries over from the "_nocache" arrays
1155 * to the result arrays, skipping the gaps the
1156 * lookup_sids call left. */
1157 for (i=0; i < num_nocache; i++) {
1158 if (((names_nocache)[i] != NULL) &&
1159 ((name_types_nocache)[i] != SID_NAME_UNKNOWN))
1161 sid_copy(&(*sid_mem)[*num_names],
1162 &sid_mem_nocache[i]);
1163 (*names)[*num_names] =
1164 fill_domain_username_talloc(
1169 (*name_types)[*num_names] = name_types_nocache[i];
1174 else if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1175 DEBUG(10, ("lookup_groupmem: lsa_lookup_sids could "
1176 "not map any SIDs at all.\n"));
1177 /* Don't handle this as an error here.
1178 * There is nothing left to do with respect to the
1179 * overall result... */
1181 else if (!NT_STATUS_IS_OK(status)) {
1182 DEBUG(10, ("lookup_groupmem: Error looking up %d "
1183 "sids via rpc_lsa_lookup_sids: %s\n",
1184 (int)num_members, nt_errstr(status)));
1189 status = NT_STATUS_OK;
1190 DEBUG(3,("ads lookup_groupmem for sid=%s succeeded\n",
1191 sid_string_dbg(group_sid)));
1195 TALLOC_FREE(tmp_ctx);
1200 /* find the sequence number for a domain */
1201 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
1203 ADS_STRUCT *ads = NULL;
1206 DEBUG(3,("ads: fetch sequence_number for %s\n", domain->name));
1208 if ( !winbindd_can_contact_domain( domain ) ) {
1209 DEBUG(10,("sequence: No incoming trust for domain %s\n",
1212 return NT_STATUS_OK;
1215 *seq = DOM_SEQUENCE_NONE;
1217 ads = ads_cached_connection(domain);
1220 domain->last_status = NT_STATUS_SERVER_DISABLED;
1221 return NT_STATUS_UNSUCCESSFUL;
1224 rc = ads_USN(ads, seq);
1226 if (!ADS_ERR_OK(rc)) {
1228 /* its a dead connection, destroy it */
1230 if (domain->private_data) {
1231 ads = (ADS_STRUCT *)domain->private_data;
1232 ads->is_mine = True;
1234 ads_kdestroy("MEMORY:winbind_ccache");
1235 domain->private_data = NULL;
1238 return ads_ntstatus(rc);
1241 /* find the lockout policy of a domain - use rpc methods */
1242 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
1243 TALLOC_CTX *mem_ctx,
1244 struct samr_DomInfo12 *policy)
1246 return reconnect_methods.lockout_policy(domain, mem_ctx, policy);
1249 /* find the password policy of a domain - use rpc methods */
1250 static NTSTATUS password_policy(struct winbindd_domain *domain,
1251 TALLOC_CTX *mem_ctx,
1252 struct samr_DomInfo1 *policy)
1254 return reconnect_methods.password_policy(domain, mem_ctx, policy);
1257 /* get a list of trusted domains */
1258 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
1259 TALLOC_CTX *mem_ctx,
1260 struct netr_DomainTrustList *trusts)
1262 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1265 struct rpc_pipe_client *cli;
1268 DEBUG(3,("ads: trusted_domains\n"));
1270 ZERO_STRUCTP(trusts);
1272 /* If this is our primary domain or a root in our forest,
1273 query for all trusts. If not, then just look for domain
1274 trusts in the target forest */
1276 if (domain->primary || domain_is_forest_root(domain)) {
1277 flags = NETR_TRUST_FLAG_OUTBOUND |
1278 NETR_TRUST_FLAG_INBOUND |
1279 NETR_TRUST_FLAG_IN_FOREST;
1281 flags = NETR_TRUST_FLAG_IN_FOREST;
1284 result = cm_connect_netlogon(domain, &cli);
1286 if (!NT_STATUS_IS_OK(result)) {
1287 DEBUG(5, ("trusted_domains: Could not open a connection to %s "
1288 "for PIPE_NETLOGON (%s)\n",
1289 domain->name, nt_errstr(result)));
1290 return NT_STATUS_UNSUCCESSFUL;
1293 result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1298 if (!NT_STATUS_IS_OK(result)) {
1301 if (trusts->count == 0) {
1302 return NT_STATUS_OK;
1305 /* Copy across names and sids */
1308 for (i = 0; i < trusts->count; i++) {
1309 struct netr_DomainTrust *trust = &trusts->array[i];
1310 struct winbindd_domain d;
1315 * drop external trusts if this is not our primary
1316 * domain. This means that the returned number of
1317 * domains may be less that the ones actually trusted
1321 if ((trust->trust_attributes
1322 == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) &&
1325 DEBUG(10,("trusted_domains: Skipping external trusted "
1326 "domain %s because it is outside of our "
1328 trust->netbios_name));
1332 /* add to the trusted domain cache */
1334 fstrcpy(d.name, trust->netbios_name);
1335 fstrcpy(d.alt_name, trust->dns_name);
1337 sid_copy(&d.sid, trust->sid);
1339 sid_copy(&d.sid, &global_sid_NULL);
1342 if ( domain->primary ) {
1343 DEBUG(10,("trusted_domains(ads): Searching "
1344 "trusted domain list of %s and storing "
1345 "trust flags for domain %s\n",
1346 domain->name, d.alt_name));
1348 d.domain_flags = trust->trust_flags;
1349 d.domain_type = trust->trust_type;
1350 d.domain_trust_attribs = trust->trust_attributes;
1352 wcache_tdc_add_domain( &d );
1354 } else if (domain_is_forest_root(domain)) {
1355 /* Check if we already have this record. If
1356 * we are following our forest root that is not
1357 * our primary domain, we want to keep trust
1358 * flags from the perspective of our primary
1359 * domain not our forest root. */
1360 struct winbindd_tdc_domain *exist = NULL;
1362 exist = wcache_tdc_fetch_domain(
1363 talloc_tos(), trust->netbios_name);
1365 DEBUG(10,("trusted_domains(ads): Searching "
1366 "trusted domain list of %s and "
1367 "storing trust flags for domain "
1368 "%s\n", domain->name, d.alt_name));
1369 d.domain_flags = trust->trust_flags;
1370 d.domain_type = trust->trust_type;
1371 d.domain_trust_attribs =
1372 trust->trust_attributes;
1374 wcache_tdc_add_domain( &d );
1379 /* This gets a little tricky. If we are
1380 following a transitive forest trust, then
1381 innerit the flags, type, and attribs from
1382 the domain we queried to make sure we don't
1383 record the view of the trust from the wrong
1384 side. Always view it from the side of our
1385 primary domain. --jerry */
1386 struct winbindd_tdc_domain *parent = NULL;
1388 DEBUG(10,("trusted_domains(ads): Searching "
1389 "trusted domain list of %s and inheriting "
1390 "trust flags for domain %s\n",
1391 domain->name, d.alt_name));
1393 parent = wcache_tdc_fetch_domain(talloc_tos(),
1396 d.domain_flags = parent->trust_flags;
1397 d.domain_type = parent->trust_type;
1398 d.domain_trust_attribs = parent->trust_attribs;
1400 d.domain_flags = domain->domain_flags;
1401 d.domain_type = domain->domain_type;
1402 d.domain_trust_attribs =
1403 domain->domain_trust_attribs;
1405 TALLOC_FREE(parent);
1407 wcache_tdc_add_domain( &d );
1414 /* the ADS backend methods are exposed via this structure */
1415 struct winbindd_methods ads_methods = {