s3:idmap: remove unused method dump_data() from the idmap API
[amitay/samba.git] / source3 / winbindd / idmap_adex / idmap_adex.c
1 /*
2  * idmap_adex: Support for D Forests
3  *
4  * Copyright (C) Gerald (Jerry) Carter 2006-2008
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, write to the Free Software
18  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19  */
20
21 #include "includes.h"
22 #include "ads.h"
23 #include "idmap_adex.h"
24 #include "nss_info.h"
25 #include "secrets.h"
26
27 #undef DBGC_CLASS
28 #define DBGC_CLASS DBGC_IDMAP
29
30 #define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
31
32 NTSTATUS init_module(void);
33
34 /*
35  * IdMap backend
36  */
37
38 /********************************************************************
39  Basic init function responsible for determining our current mode
40  (standalone or using Centeris Cells).  This must return success or
41  it will be dropped from the idmap backend list.
42  *******************************************************************/
43
44 static NTSTATUS _idmap_adex_init(struct idmap_domain *dom,
45                                      const char *params)
46 {
47         ADS_STRUCT *ads = NULL;
48         ADS_STATUS status;
49         static NTSTATUS init_status = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
50         struct dom_sid domain_sid;
51         fstring dcname;
52         struct sockaddr_storage ip;
53         struct likewise_cell *lwcell;
54
55         if (NT_STATUS_IS_OK(init_status))
56                 return NT_STATUS_OK;
57
58         /* Silently fail if we are not a member server in security = ads */
59
60         if ((lp_server_role() != ROLE_DOMAIN_MEMBER) ||
61             (lp_security() != SEC_ADS)) {
62                 init_status = NT_STATUS_INVALID_SERVER_STATE;
63                 BAIL_ON_NTSTATUS_ERROR(init_status);
64         }
65
66         /* fetch our domain SID first */
67
68         if (!secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) {
69                 init_status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
70                 BAIL_ON_NTSTATUS_ERROR(init_status);
71         }
72
73         /* reuse the same ticket cache as winbindd */
74
75         setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
76
77         /* Establish a connection to a DC */
78
79         if ((ads = ads_init(lp_realm(), lp_workgroup(), NULL)) == NULL) {
80                 init_status = NT_STATUS_NO_MEMORY;
81                 BAIL_ON_NTSTATUS_ERROR(init_status);
82         }
83
84         ads->auth.password =
85             secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
86         ads->auth.realm = SMB_STRDUP(lp_realm());
87
88         /* get the DC name here to setup the server affinity cache and
89            local krb5.conf */
90
91         get_dc_name(lp_workgroup(), lp_realm(), dcname, &ip);
92
93         status = ads_connect(ads);
94         if (!ADS_ERR_OK(status)) {
95                 DEBUG(0, ("_idmap_adex_init: ads_connect() failed! (%s)\n",
96                           ads_errstr(status)));
97         }
98         init_status = ads_ntstatus(status);
99         BAIL_ON_NTSTATUS_ERROR(init_status);
100
101
102         /* Find out cell membership */
103
104         init_status = cell_locate_membership(ads);
105         if (!NT_STATUS_IS_OK(init_status)) {
106                 DEBUG(0,("LWI: Fail to locate cell membership (%s).",
107                          nt_errstr(init_status)));
108                 goto done;
109         }
110
111         /* Fill in the cell information */
112
113         lwcell = cell_list_head();
114
115         init_status = cell_lookup_settings(lwcell);
116         BAIL_ON_NTSTATUS_ERROR(init_status);
117
118         /* Miscellaneous setup.  E.g. set up the list of GC
119            servers and domain list for our forest (does not actually
120            connect). */
121
122         init_status = gc_init_list();
123         BAIL_ON_NTSTATUS_ERROR(init_status);
124
125         init_status = domain_init_list();
126         BAIL_ON_NTSTATUS_ERROR(init_status);
127
128 done:
129         if (!NT_STATUS_IS_OK(init_status)) {
130                 DEBUG(1,("Likewise initialization failed (%s)\n",
131                          nt_errstr(init_status)));
132         }
133
134         /* cleanup */
135
136         if (!NT_STATUS_IS_OK(init_status)) {
137                 cell_list_destroy();
138
139                 /* init_status stores the failure reason but we need to
140                    return success or else idmap_init() will drop us from the
141                    backend list */
142                 return NT_STATUS_OK;
143         }
144
145         init_status = NT_STATUS_OK;
146
147         return init_status;
148 }
149
150 /**********************************************************************
151  *********************************************************************/
152
153 static NTSTATUS _idmap_adex_get_sid_from_id(struct
154                                                 idmap_domain
155                                                 *dom, struct
156                                                 id_map
157                                                 **ids)
158 {
159         int i;
160         bool one_mapped = false;
161         bool all_mapped = true;
162         NTSTATUS nt_status;
163         struct likewise_cell *cell;
164
165         /* initialize the status to avoid suprise */
166         for (i = 0; ids[i]; i++) {
167                 ids[i]->status = ID_UNKNOWN;
168         }
169         
170         nt_status = _idmap_adex_init(dom, NULL);
171         if (!NT_STATUS_IS_OK(nt_status))
172                 return nt_status;
173
174         if ((cell = cell_list_head()) == NULL) {
175                 return NT_STATUS_INVALID_SERVER_STATE;
176         }
177
178         /* have to work through these one by one */
179         for (i = 0; ids[i]; i++) {
180                 NTSTATUS status;
181                 status = cell->provider->get_sid_from_id(ids[i]->sid,
182                                                          ids[i]->xid.id,
183                                                          ids[i]->xid.type);
184                 /* Fail if we cannot find any DC */
185                 if (NT_STATUS_EQUAL
186                     (status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
187                         return status;
188                 }
189
190                 if (!NT_STATUS_IS_OK(status)) {
191                         ids[i]->status = ID_UNMAPPED;
192                         all_mapped = false;
193                         continue;
194                 }
195
196                 ids[i]->status = ID_MAPPED;
197                 one_mapped = true;
198         }
199
200         return NT_STATUS_OK;
201 }
202
203 /**********************************************************************
204  *********************************************************************/
205
206 static NTSTATUS _idmap_adex_get_id_from_sid(struct
207                                                 idmap_domain
208                                                 *dom, struct
209                                                 id_map
210                                                 **ids)
211 {
212         int i;
213         bool one_mapped = false;
214         bool all_mapped = true;
215         NTSTATUS nt_status;
216         struct likewise_cell *cell;
217
218         /* initialize the status to avoid suprise */
219         for (i = 0; ids[i]; i++) {
220                 ids[i]->status = ID_UNKNOWN;
221         }
222         
223         nt_status = _idmap_adex_init(dom, NULL);
224         if (!NT_STATUS_IS_OK(nt_status))
225                 return nt_status;
226
227         if ((cell = cell_list_head()) == NULL) {
228                 return NT_STATUS_INVALID_SERVER_STATE;
229         }
230
231         /* have to work through these one by one */
232         for (i = 0; ids[i]; i++) {
233                 NTSTATUS status;
234                 status = cell->provider->get_id_from_sid(&ids[i]->xid.id,
235                                                          &ids[i]->xid.
236                                                          type, ids[i]->sid);
237                 /* Fail if we cannot find any DC */
238                 if (NT_STATUS_EQUAL
239                     (status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
240                         return status;
241                 }
242
243                 if (!NT_STATUS_IS_OK(status)) {
244                         ids[i]->status = ID_UNMAPPED;
245                         all_mapped = false;
246                         continue;
247                 }
248
249                 ids[i]->status = ID_MAPPED;
250                 one_mapped = true;
251         }
252
253         return NT_STATUS_OK;
254 }
255
256 /**********************************************************************
257  *********************************************************************/
258
259 static NTSTATUS _idmap_adex_set_mapping(struct
260                                             idmap_domain
261                                             *dom, const struct
262                                             id_map *map)
263 {
264         DEBUG(0, ("_idmap_adex_set_mapping: not implemented\n"));
265         return NT_STATUS_NOT_IMPLEMENTED;
266 }
267
268 /**********************************************************************
269  *********************************************************************/
270
271 static NTSTATUS _idmap_adex_close(struct idmap_domain
272                                       *dom)
273 {
274         /* FIXME!  need to do cleanup here */
275
276         return NT_STATUS_OK;
277 }
278
279 /*
280  * IdMap NSS plugin
281  */
282
283 /**********************************************************************
284  *********************************************************************/
285
286 static NTSTATUS _nss_adex_init(struct nss_domain_entry
287                                   *e)
288 {
289         return _idmap_adex_init(NULL, NULL);
290 }
291
292 /**********************************************************************
293  *********************************************************************/
294
295 static NTSTATUS _nss_adex_get_info(struct
296                                       nss_domain_entry *e,
297                                       const struct dom_sid * sid,
298                                       TALLOC_CTX * ctx,
299                                       ADS_STRUCT * ads,
300                                       LDAPMessage * msg,
301                                       const char **homedir,
302                                       const char **shell,
303                                       const char **gecos, gid_t * p_gid)
304 {
305         NTSTATUS nt_status;
306         struct likewise_cell *cell;
307
308         nt_status = _idmap_adex_init(NULL, NULL);
309         if (!NT_STATUS_IS_OK(nt_status))
310                 return nt_status;
311
312         if ((cell = cell_list_head()) == NULL) {
313                 return NT_STATUS_INVALID_SERVER_STATE;
314         }
315
316         return cell->provider->get_nss_info(sid, ctx, homedir,
317                                             shell, gecos, p_gid);
318 }
319
320 /**********************************************************************
321  *********************************************************************/
322
323 static NTSTATUS _nss_adex_map_to_alias(TALLOC_CTX * mem_ctx,
324                                        struct nss_domain_entry *e,
325                                        const char *name, char **alias)
326 {
327         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
328         struct likewise_cell *cell = NULL;
329
330         nt_status = _idmap_adex_init(NULL, NULL);
331         BAIL_ON_NTSTATUS_ERROR(nt_status);
332
333         if ((cell = cell_list_head()) == NULL) {
334                 nt_status = NT_STATUS_INVALID_SERVER_STATE;
335                 BAIL_ON_NTSTATUS_ERROR(nt_status);
336         }
337
338         nt_status = cell->provider->map_to_alias(mem_ctx, e->domain,
339                                                  name, alias);
340
341         /* go ahead and allow the cache mgr to mark this in
342            negative cache */
343
344         if (!NT_STATUS_IS_OK(nt_status))
345                 nt_status = NT_STATUS_NONE_MAPPED;
346
347 done:
348         return nt_status;
349 }
350
351 /**********************************************************************
352  *********************************************************************/
353
354 static NTSTATUS _nss_adex_map_from_alias(TALLOC_CTX * mem_ctx,
355                                          struct nss_domain_entry *e,
356                                          const char *alias, char **name)
357 {
358         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
359         struct likewise_cell *cell = NULL;
360
361         nt_status = _idmap_adex_init(NULL, NULL);
362         BAIL_ON_NTSTATUS_ERROR(nt_status);
363
364         if ((cell = cell_list_head()) == NULL) {
365                 nt_status = NT_STATUS_INVALID_SERVER_STATE;
366                 BAIL_ON_NTSTATUS_ERROR(nt_status);
367         }
368
369
370         nt_status = cell->provider->map_from_alias(mem_ctx, e->domain,
371                                                    alias, name);
372
373         /* go ahead and allow the cache mgr to mark this in
374            negative cache */
375
376         if (!NT_STATUS_IS_OK(nt_status))
377                 nt_status = NT_STATUS_NONE_MAPPED;
378
379 done:
380         return nt_status;
381 }
382
383 /**********************************************************************
384  *********************************************************************/
385
386 static NTSTATUS _nss_adex_close(void)
387 {
388         return NT_STATUS_NOT_IMPLEMENTED;
389 }
390
391 /**********************************************************************
392  *********************************************************************/
393
394 static struct idmap_methods adex_idmap_methods = {
395
396         .init             = _idmap_adex_init,
397         .unixids_to_sids  = _idmap_adex_get_sid_from_id,
398         .sids_to_unixids  = _idmap_adex_get_id_from_sid,
399         .set_mapping      = _idmap_adex_set_mapping,
400         .close_fn         = _idmap_adex_close
401 };
402 static struct nss_info_methods adex_nss_methods = {
403         .init           = _nss_adex_init,
404         .get_nss_info   = _nss_adex_get_info,
405         .map_to_alias   = _nss_adex_map_to_alias,
406         .map_from_alias = _nss_adex_map_from_alias,
407         .close_fn       = _nss_adex_close
408 };
409
410 /**********************************************************************
411  Register with the idmap and idmap_nss subsystems. We have to protect
412  against the idmap and nss_info interfaces being in a half-registered
413  state.
414  **********************************************************************/
415 NTSTATUS idmap_adex_init(void)
416 {
417         static NTSTATUS idmap_status = NT_STATUS_UNSUCCESSFUL;
418         static NTSTATUS nss_status = NT_STATUS_UNSUCCESSFUL;
419         if (!NT_STATUS_IS_OK(idmap_status)) {
420                 idmap_status =
421                     smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
422                                        "adex", &adex_idmap_methods);
423                 if (!NT_STATUS_IS_OK(idmap_status)) {
424                         DEBUG(0,
425                               ("idmap_centeris_init: Failed to register the adex"
426                                "idmap plugin.\n"));
427                         return idmap_status;
428                 }
429         }
430
431         if (!NT_STATUS_IS_OK(nss_status)) {
432                 nss_status =
433                     smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
434                                            "adex", &adex_nss_methods);
435                 if (!NT_STATUS_IS_OK(nss_status)) {
436                         DEBUG(0,
437                               ("idmap_adex_init: Failed to register the adex"
438                                "nss plugin.\n"));
439                         return nss_status;
440                 }
441         }
442
443         return NT_STATUS_OK;
444 }
445
446 static NTSTATUS nss_info_adex_init(void)
447 {
448         return idmap_adex_init();
449 }