s3:auth handle unix domain sids in samu
authorSimo Sorce <ssorce@redhat.com>
Fri, 28 May 2010 17:18:13 +0000 (13:18 -0400)
committerSimo Sorce <ssorce@redhat.com>
Mon, 31 May 2010 15:14:40 +0000 (11:14 -0400)
When we generate a user out of thin air we may end up adding sids
that are not part of the sam domain (unix domain sids).
Handle the case and preserve these sids as extra sids.

source3/auth/server_info.c
source3/include/auth.h

index f72cdbaae9a1cd36db2e0da6d1ab118e966d1ee9..3db3fe574155b669314f067097e8e2bcb64d0502 100644 (file)
@@ -215,37 +215,81 @@ NTSTATUS serverinfo_to_SamInfo6(struct auth_serversupplied_info *server_info,
        return NT_STATUS_OK;
 }
 
-static NTSTATUS sids_to_samr_RidWithAttributeArray(
-                               TALLOC_CTX *mem_ctx,
-                               struct samr_RidWithAttributeArray *groups,
-                               const struct dom_sid *domain_sid,
-                               const struct dom_sid *sids,
-                               size_t num_sids)
+static NTSTATUS append_netr_SidAttr(TALLOC_CTX *mem_ctx,
+                                   struct netr_SidAttr **sids,
+                                   uint32_t *count,
+                                   const struct dom_sid2 *asid,
+                                   uint32_t attributes)
+{
+       uint32_t t = *count;
+
+       *sids = talloc_realloc(mem_ctx, *sids, struct netr_SidAttr, t + 1);
+       if (*sids == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       (*sids)[t].sid = sid_dup_talloc(*sids, asid);
+       if ((*sids)[t].sid == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       (*sids)[t].attributes = attributes;
+       *count = t + 1;
+
+       return NT_STATUS_OK;
+}
+
+/* Fils the samr_RidWithAttributeArray with the provided sids.
+ * If it happens that we have additional groups that do not belong
+ * to the domain, add their sids as extra sids */
+static NTSTATUS group_sids_to_info3(struct netr_SamInfo3 *info3,
+                                   const struct dom_sid *sids,
+                                   size_t num_sids)
 {
+       uint32_t attributes = SE_GROUP_MANDATORY |
+                               SE_GROUP_ENABLED_BY_DEFAULT |
+                               SE_GROUP_ENABLED;
+       struct samr_RidWithAttributeArray *groups;
+       struct dom_sid *domain_sid;
        unsigned int i;
+       NTSTATUS status;
+       uint32_t rid;
        bool ok;
 
-       groups->rids = talloc_array(mem_ctx,
+       domain_sid = info3->base.domain_sid;
+       groups = &info3->base.groups;
+
+       groups->rids = talloc_array(info3,
                                    struct samr_RidWithAttribute, num_sids);
        if (!groups->rids) {
                return NT_STATUS_NO_MEMORY;
        }
 
        for (i = 0; i < num_sids; i++) {
-               ok = sid_peek_check_rid(domain_sid, &sids[i],
-                                       &groups->rids[i].rid);
-               if (!ok) continue;
+               ok = sid_peek_check_rid(domain_sid, &sids[i], &rid);
+               if (ok) {
+
+                       /* if it is the primary gid, skip it, we
+                        * obviously already have it */
+                       if (info3->base.primary_gid == rid) continue;
+
+                       /* store domain group rid */
+                       groups->rids[i].rid = rid;
+                       groups->rids[i].attributes = attributes;
+                       groups->count++;
+                       continue;
+               }
 
-               groups->rids[i].attributes = SE_GROUP_MANDATORY |
-                                            SE_GROUP_ENABLED_BY_DEFAULT |
-                                            SE_GROUP_ENABLED;
-               groups->count++;
+               /* if this wasn't a domain sid, add it as extra sid */
+               status = append_netr_SidAttr(info3, &info3->sids,
+                                            &info3->sidcount,
+                                            &sids[i], attributes);
+               if (!NT_STATUS_IS_OK(status)) {
+                       return status;
+               }
        }
 
        return NT_STATUS_OK;
 }
 
-
 #define RET_NOMEM(ptr) do { \
        if (!ptr) { \
                TALLOC_FREE(info3); \
@@ -265,9 +309,16 @@ NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
        size_t num_group_sids;
        const char *tmp;
        gid_t *gids;
+       bool unix_dom_user = false;
+       bool unix_dom_group = false;
        NTSTATUS status;
        bool ok;
 
+       info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
+       if (!info3) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
        user_sid = pdb_get_user_sid(samu);
        group_sid = pdb_get_group_sid(samu);
 
@@ -276,9 +327,84 @@ NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
                return NT_STATUS_UNSUCCESSFUL;
        }
 
-       info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
-       if (!info3) {
-               return NT_STATUS_NO_MEMORY;
+       ZERO_STRUCT(domain_sid);
+
+       /* check if this is a "Unix Users" domain user,
+        * we need to handle it in a special way if that's the case */
+       if (sid_compare_domain(user_sid, &global_sid_Unix_Users) == 0) {
+               unix_dom_user = true;
+
+               /* in info3 you can only set rids for the user and the
+                * primary group, and the domain sid must be that of
+                * the sam domain.
+                *
+                * Store a completely bogus value here.
+                * The real SID is stored in the extra sids.
+                * Other code will know to look there if (-1) is found
+                */
+
+               info3->base.rid = (uint32_t)(-1);
+
+               /* now append the unix domain user sid as an extra sid */
+               status = append_netr_SidAttr(info3, &info3->sids,
+                                            &info3->sidcount, user_sid,
+                                            SE_SAMBA_USER_SID);
+               if (!NT_STATUS_IS_OK(status)) {
+                       TALLOC_FREE(info3);
+                       return status;
+               }
+               DEBUG(10, ("Unix User found in struct samu. Rid marked as "
+                          "special and sid (%s) saved as extra sid (%d)\n",
+                          sid_string_dbg(user_sid), info3->sidcount));
+       } else {
+               sid_copy(&domain_sid, user_sid);
+               sid_split_rid(&domain_sid, &info3->base.rid);
+       }
+
+       if (is_null_sid(&domain_sid)) {
+               sid_copy(&domain_sid, get_global_sam_sid());
+       }
+
+       /* check if this is a "Unix Groups" domain group,
+        * if so we need special handling */
+       if (sid_compare_domain(group_sid, &global_sid_Unix_Groups) == 0) {
+               unix_dom_group = true;
+
+               /* in info3 you can only set rids for the user and the
+                * primary group, and the domain sid must be that of
+                * the sam domain.
+                *
+                * Store a completely bogus value here.
+                * The real SID is stored in the extra sids.
+                * Other code will know to look there if (-1) is found
+                */
+               info3->base.primary_gid = (uint32_t)(-1);
+
+               /* now append the unix domain group sid as an extra sid */
+               status = append_netr_SidAttr(info3, &info3->sids,
+                                            &info3->sidcount, group_sid,
+                                            SE_SAMBA_PGID_SID);
+               if (!NT_STATUS_IS_OK(status)) {
+                       TALLOC_FREE(info3);
+                       return status;
+               }
+               DEBUG(10, ("Unix Group found in struct samu. Rid marked as "
+                          "special and sid (%s) saved as extra sid (%d)\n",
+                          sid_string_dbg(group_sid), info3->sidcount));
+
+       } else {
+               ok = sid_peek_check_rid(&domain_sid, group_sid,
+                                       &info3->base.primary_gid);
+               if (!ok) {
+                       DEBUG(1, ("The primary group domain sid(%s) does not"
+                                 "match the domain sid(%s) for %s(%s)\n",
+                                 sid_string_dbg(group_sid),
+                                 sid_string_dbg(&domain_sid),
+                                 pdb_get_username(samu),
+                                 sid_string_dbg(user_sid)));
+                       TALLOC_FREE(info3);
+                       return NT_STATUS_UNSUCCESSFUL;
+               }
        }
 
        unix_to_nt_time(&info3->base.last_logon, pdb_get_logon_time(samu));
@@ -322,19 +448,6 @@ NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
        info3->base.logon_count = pdb_get_logon_count(samu);
        info3->base.bad_password_count = pdb_get_bad_password_count(samu);
 
-       sid_copy(&domain_sid, user_sid);
-       sid_split_rid(&domain_sid, &info3->base.rid);
-
-       ok = sid_peek_check_rid(&domain_sid, group_sid,
-                               &info3->base.primary_gid);
-       if (!ok) {
-               DEBUG(1, ("The primary group sid domain does not"
-                         "match user sid domain for user: %s\n",
-                         pdb_get_username(samu)));
-               TALLOC_FREE(info3);
-               return NT_STATUS_UNSUCCESSFUL;
-       }
-
        status = pdb_enum_group_memberships(mem_ctx, samu,
                                            &group_sids, &gids,
                                            &num_group_sids);
@@ -344,11 +457,7 @@ NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
                return status;
        }
 
-       status = sids_to_samr_RidWithAttributeArray(info3,
-                                                   &info3->base.groups,
-                                                   &domain_sid,
-                                                   group_sids,
-                                                   num_group_sids);
+       status = group_sids_to_info3(info3, group_sids, num_group_sids);
        if (!NT_STATUS_IS_OK(status)) {
                TALLOC_FREE(info3);
                return status;
index 69a91d29aa3de2a0c901460efffefa801350019e..e9dcaad421e38b5173db5eb9ad9e9eb9bb3542d3 100644 (file)
@@ -40,6 +40,14 @@ struct auth_usersupplied_info {
 
 };
 
+/* special bits used to identify non domain users
+ * the may be generated in a samba server
+ * These must not conflict with assigned values
+ * in samr_GroupAttrs
+ */
+#define SE_SAMBA_USER_SID ( 0x00100000 )
+#define SE_SAMBA_PGID_SID ( 0x00200000 )
+
 struct auth_serversupplied_info {
        bool guest;
        bool system;