nsswitch/winbindd_sid.o \
nsswitch/winbindd_misc.o \
nsswitch/winbindd_cm.o \
- nsswitch/winbindd_rpc.o
+ nsswitch/winbindd_rpc.o \
+ nsswitch/winbindd_ads.o
NECESSARY_BECAUSE_SAMBA_DEPENDENCIES_ARE_SO_BROKEN_OBJ = \
rpc_client/cli_netlogon.o rpc_client/cli_login.o \
#define UF_INTERDOMAIN_TRUST_ACCOUNT 0x0800
#define UF_WORKSTATION_TRUST_ACCOUNT 0x1000
#define UF_SERVER_TRUST_ACCOUNT 0x2000
+
+/* account types */
+#define ATYPE_NORMAL_GROUP 0x10000000
/*****************************************************************
Write a sid out into on-the-wire format.
*****************************************************************/
-
BOOL sid_linearize(char *outbuf, size_t len, DOM_SID *sid)
{
size_t i;
return True;
}
+/*****************************************************************
+ parse a on-the-wire SID to a DOM_SID
+*****************************************************************/
+BOOL sid_parse(char *inbuf, size_t len, DOM_SID *sid)
+{
+ int i;
+ if (len < 8) return False;
+ sid->sid_rev_num = CVAL(inbuf, 0);
+ sid->num_auths = CVAL(inbuf, 1);
+ memcpy(sid->id_auth, inbuf+2, 6);
+ if (len < 8 + sid->num_auths*4) return False;
+ for (i=0;i<sid->num_auths;i++) {
+ sid->sub_auths[i] = IVAL(inbuf, 8+i*4);
+ }
+ return True;
+}
+
/*****************************************************************
Compare two sids.
*****************************************************************/
void ads_dump(ADS_STRUCT *ads, void *res)
{
char *field;
- LDAPMessage *msg;
+ void *msg;
BerElement *b;
struct {
char *name;
{NULL, NULL}
};
- for (msg = ldap_first_entry(ads->ld, (LDAPMessage *)res);
- msg; msg = ldap_next_entry(ads->ld, msg)) {
- for (field = ldap_first_attribute(ads->ld, msg, &b);
+ for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
+ for (field = ldap_first_attribute(ads->ld, (LDAPMessage *)msg, &b);
field;
- field = ldap_next_attribute(ads->ld, msg, b)) {
+ field = ldap_next_attribute(ads->ld, (LDAPMessage *)msg, b)) {
struct berval **values;
int i;
- values = ldap_get_values_len(ads->ld, msg, field);
+ values = ldap_get_values_len(ads->ld, (LDAPMessage *)msg, field);
for (i=0; handlers[i].name; i++) {
if (StrCaseCmp(handlers[i].name, field) == 0) {
return ret;
}
+/*
+ pull the first entry from a ADS result
+*/
+void *ads_first_entry(ADS_STRUCT *ads, void *res)
+{
+ return (void *)ldap_first_entry(ads->ld, (LDAPMessage *)res);
+}
+
+/*
+ pull the next entry from a ADS result
+*/
+void *ads_next_entry(ADS_STRUCT *ads, void *res)
+{
+ return (void *)ldap_next_entry(ads->ld, (LDAPMessage *)res);
+}
+
+/*
+ pull a single string from a ADS result
+*/
+char *ads_pull_string(ADS_STRUCT *ads,
+ TALLOC_CTX *mem_ctx, void *msg, const char *field)
+{
+ char **values;
+ char *ret;
+
+ values = ldap_get_values(ads->ld, msg, field);
+
+ if (!values || !values[0]) return NULL;
+
+ ret = talloc_strdup(mem_ctx, values[0]);
+ ldap_value_free(values);
+ return ret;
+}
+
+/*
+ pull a single uint32 from a ADS result
+*/
+BOOL ads_pull_uint32(ADS_STRUCT *ads,
+ void *msg, const char *field, uint32 *v)
+{
+ char **values;
+
+ values = ldap_get_values(ads->ld, msg, field);
+
+ if (!values || !values[0]) return False;
+
+ *v = atoi(values[0]);
+ ldap_value_free(values);
+ return True;
+}
+
+/*
+ pull a single DOM_SID from a ADS result
+*/
+BOOL ads_pull_sid(ADS_STRUCT *ads,
+ void *msg, const char *field, DOM_SID *sid)
+{
+ struct berval **values;
+ BOOL ret;
+
+ values = ldap_get_values_len(ads->ld, msg, field);
+
+ if (!values || !values[0]) return False;
+
+ ret = sid_parse(values[0]->bv_val, values[0]->bv_len, sid);
+
+ ldap_value_free_len(values);
+ return ret;
+}
+
+
/* find the update serial number - this is the core of the ldap cache */
-BOOL ads_USN(ADS_STRUCT *ads, unsigned *usn)
+BOOL ads_USN(ADS_STRUCT *ads, uint32 *usn)
{
const char *attrs[] = {"highestCommittedUSN", NULL};
int rc;
rc = ldap_search_s(ads->ld, ads->bind_path,
LDAP_SCOPE_BASE, "(objectclass=*)", (char **)attrs, 0, (LDAPMessage **)&res);
if (rc || ads_count_replies(ads, res) != 1) return False;
- return False;
+ return ads_pull_uint32(ads, res, "highestCommittedUSN", usn);
}
+
+
#endif
--- /dev/null
+/*
+ Unix SMB/Netbios implementation.
+
+ Winbind ADS backend functions
+
+ Copyright (C) Andrew Tridgell 2001
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "winbindd.h"
+
+#ifdef HAVE_ADS
+
+/* Query display info for a realm. This is the basic user list fn */
+static NTSTATUS query_dispinfo(struct winbindd_domain *domain,
+ TALLOC_CTX *mem_ctx,
+ uint32 *start_ndx, uint32 *num_entries,
+ WINBIND_DISPINFO **info)
+{
+ ADS_STRUCT *ads;
+ const char *attrs[] = {"sAMAccountName", "name", "objectSid", "primaryGroupID",
+ "userAccountControl", NULL};
+ int rc, i, count;
+ void *res;
+ void *msg;
+
+ DEBUG(3,("ads: query_dispinfo\n"));
+
+ if ((*start_ndx) != 0) {
+ DEBUG(1,("ads backend start_ndx not implemented\n"));
+ return NT_STATUS_NOT_IMPLEMENTED;
+ }
+
+ ads = ads_init(NULL, NULL, NULL);
+ if (!ads) {
+ DEBUG(1,("ads_init failed\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ rc = ads_connect(ads);
+ if (rc) {
+ DEBUG(1,("query_dispinfo ads_connect: %s\n", ads_errstr(rc)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ rc = ads_search(ads, &res, "(objectclass=user)", attrs);
+ if (rc) {
+ DEBUG(1,("query_dispinfo ads_search: %s\n", ads_errstr(rc)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ count = ads_count_replies(ads, res);
+ if (count == 0) {
+ DEBUG(1,("query_dispinfo: No users found\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ (*info) = talloc(mem_ctx, count * sizeof(**info));
+ if (!*info) return NT_STATUS_NO_MEMORY;
+
+ i = 0;
+
+ for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
+ char *name, *gecos;
+ DOM_SID sid;
+ uint32 rid, group;
+ uint32 account_control;
+
+ if (!ads_pull_uint32(ads, msg, "userAccountControl",
+ &account_control) ||
+ !(account_control & UF_NORMAL_ACCOUNT)) continue;
+
+ name = ads_pull_string(ads, mem_ctx, msg, "sAMAccountName");
+ gecos = ads_pull_string(ads, mem_ctx, msg, "name");
+ if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
+ DEBUG(1,("No sid for %s !?\n", name));
+ continue;
+ }
+ if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
+ DEBUG(1,("No primary group for %s !?\n", name));
+ continue;
+ }
+
+ if (!sid_peek_rid(&sid, &rid)) {
+ DEBUG(1,("No rid for %s !?\n", name));
+ continue;
+ }
+
+ (*info)[i].acct_name = name;
+ (*info)[i].full_name = gecos;
+ (*info)[i].user_rid = rid;
+ (*info)[i].group_rid = group;
+ i++;
+ }
+
+ (*num_entries) = i;
+
+ ads_destroy(&ads);
+
+ return NT_STATUS_OK;
+}
+
+/* list all domain groups */
+static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
+ TALLOC_CTX *mem_ctx,
+ uint32 *start_ndx, uint32 *num_entries,
+ struct acct_info **info)
+{
+ ADS_STRUCT *ads;
+ const char *attrs[] = {"sAMAccountName", "name", "objectSid",
+ "sAMAccountType", NULL};
+ int rc, i, count;
+ void *res;
+ void *msg;
+
+ DEBUG(3,("ads: enum_dom_groups\n"));
+
+ if ((*start_ndx) != 0) {
+ DEBUG(1,("ads backend start_ndx not implemented\n"));
+ return NT_STATUS_NOT_IMPLEMENTED;
+ }
+
+ ads = ads_init(NULL, NULL, NULL);
+ if (!ads) {
+ DEBUG(1,("ads_init failed\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ rc = ads_connect(ads);
+ if (rc) {
+ DEBUG(1,("query_dispinfo ads_connect: %s\n", ads_errstr(rc)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ rc = ads_search(ads, &res, "(objectclass=group)", attrs);
+ if (rc) {
+ DEBUG(1,("query_dispinfo ads_search: %s\n", ads_errstr(rc)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ count = ads_count_replies(ads, res);
+ if (count == 0) {
+ DEBUG(1,("query_dispinfo: No users found\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ (*info) = talloc(mem_ctx, count * sizeof(**info));
+ if (!*info) return NT_STATUS_NO_MEMORY;
+
+ i = 0;
+
+ for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
+ char *name, *gecos;
+ DOM_SID sid;
+ uint32 rid;
+ uint32 account_type;
+
+ if (!ads_pull_uint32(ads, msg, "sAMAccountType",
+ &account_type) ||
+ !(account_type & ATYPE_NORMAL_GROUP)) continue;
+
+ name = ads_pull_string(ads, mem_ctx, msg, "sAMAccountName");
+ gecos = ads_pull_string(ads, mem_ctx, msg, "name");
+ if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
+ DEBUG(1,("No sid for %s !?\n", name));
+ continue;
+ }
+
+ if (!sid_peek_rid(&sid, &rid)) {
+ DEBUG(1,("No rid for %s !?\n", name));
+ continue;
+ }
+
+ fstrcpy((*info)[i].acct_name, name);
+ fstrcpy((*info)[i].acct_desc, gecos);
+ (*info)[i].rid = rid;
+ i++;
+ }
+
+ (*num_entries) = i;
+
+ ads_destroy(&ads);
+
+ return NT_STATUS_OK;
+}
+
+
+/* the rpc backend methods are exposed via this structure */
+struct winbindd_methods ads_methods = {
+ query_dispinfo,
+ enum_dom_groups
+};
+
+#endif
/* Query display info for a domain. This returns enough information plus a
bit extra to give an overview of domain users for the User Manager
application. */
-static NTSTATUS winbindd_query_dispinfo(struct winbindd_domain *domain,
- TALLOC_CTX *mem_ctx,
- uint32 *start_ndx, uint32 *num_entries,
- WINBIND_DISPINFO **info)
+static NTSTATUS query_dispinfo(struct winbindd_domain *domain,
+ TALLOC_CTX *mem_ctx,
+ uint32 *start_ndx, uint32 *num_entries,
+ WINBIND_DISPINFO **info)
{
CLI_POLICY_HND *hnd;
NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
}
/* list all domain groups */
-static NTSTATUS winbindd_enum_dom_groups(struct winbindd_domain *domain,
- TALLOC_CTX *mem_ctx,
- uint32 *start_ndx, uint32 *num_entries,
- struct acct_info **info)
+static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
+ TALLOC_CTX *mem_ctx,
+ uint32 *start_ndx, uint32 *num_entries,
+ struct acct_info **info)
{
uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED;
CLI_POLICY_HND *hnd;
/* the rpc backend methods are exposed via this structure */
struct winbindd_methods msrpc_methods = {
- winbindd_query_dispinfo,
- winbindd_enum_dom_groups
+ query_dispinfo,
+ enum_dom_groups
};
BOOL rv = False;
TALLOC_CTX *mem_ctx;
extern struct winbindd_methods msrpc_methods;
+ struct winbindd_methods *methods;
+
+ switch (lp_security()) {
+#ifdef HAVE_ADS
+ case SEC_ADS:
+ {
+ extern struct winbindd_methods ads_methods;
+ methods = &ads_methods;
+ break;
+ }
+#endif
+ default:
+ methods = &msrpc_methods;
+ }
DEBUG(1, ("getting trusted domain list\n"));
if (!NT_STATUS_IS_OK(result))
goto done;
- add_trusted_domain(lp_workgroup(), &domain_sid, &msrpc_methods);
+ add_trusted_domain(lp_workgroup(), &domain_sid, methods);
/* Enumerate list of trusted domains */
/* Add each domain to the trusted domain list */
for(i = 0; i < num_doms; i++)
- add_trusted_domain(domains[i], &sids[i], &msrpc_methods);
+ add_trusted_domain(domains[i], &sids[i], methods);
rv = True;
git.samba.org / samba.git / commitdiff