r614: Clean out the POSIX assumptions from the Samba4 auth subsystem.

This removes the code that tried to lookup posix groups, as well as
the code that was tied to the SAM_ACCOUNT.

This should make auth_ldb much easier to write :-)

Andrew Bartlett

diff --git a/source/auth/auth.c b/source/auth/auth.c
index 720b8149bda2f6f4be90f8f7f8b3f39553c2f596..83446721e6b96d26918ea2e9e8b24420ce3a3549 100644 (file)
--- a/source/auth/auth.c
+++ b/source/auth/auth.c
@@ -231,12 +231,6 @@ static NTSTATUS check_ntlm_password(const struct auth_context *auth_context,
                }
        }
 
-       /* This is one of the few places the *relies* (rather than just sets defaults
-          on the value of lp_security().  This needs to change.  A new paramater 
-          perhaps? */
-       if (lp_security() >= SEC_SERVER)
-               smb_user_control(user_info, *server_info, nt_status);
-
        if (NT_STATUS_IS_OK(nt_status)) {
                if (NT_STATUS_IS_OK(nt_status)) {
                        DEBUG((*server_info)->guest ? 5 : 2, 

diff --git a/source/auth/auth.h b/source/auth/auth.h
index 22738ffc2cb9dd3075b7f2be706e9ff988e4f082..bf6e1b77e16f850026ffb042828a72cabf0550d2 100644 (file)
--- a/source/auth/auth.h
+++ b/source/auth/auth.h
@@ -66,10 +66,6 @@ typedef struct auth_serversupplied_info
 {
        BOOL guest;
        
-       /* This groups info is needed for when we become_user() for this uid */
-       int n_groups;
-       gid_t *groups;
-       
        /* NT group information taken from the info3 structure */
        
        NT_USER_TOKEN *ptok;
@@ -77,11 +73,6 @@ typedef struct auth_serversupplied_info
        DATA_BLOB user_session_key;
        DATA_BLOB lm_session_key;
        
-       uint32 sam_fill_level;  /* How far is this structure filled? */
-       
-       SAM_ACCOUNT *sam_account;
-       
-       void *pam_handle;
 } auth_serversupplied_info;
 
 struct auth_context {

diff --git a/source/auth/auth_util.c b/source/auth/auth_util.c
index db10514c7e86e1622faee12c30f219a4c76303b7..7bb8c8a5585e233300258aefe1e18f9d8b8061a4 100644 (file)
--- a/source/auth/auth_util.c
+++ b/source/auth/auth_util.c
@@ -31,54 +31,6 @@ extern DOM_SID global_sid_Network;
 extern DOM_SID global_sid_Builtin_Guests;
 extern DOM_SID global_sid_Authenticated_Users;
 
-
-/****************************************************************************
- Create a UNIX user on demand.
-****************************************************************************/
-
-static int smb_create_user(const char *domain, const char *unix_username, const char *homedir)
-{
-       pstring add_script;
-       int ret;
-
-       pstrcpy(add_script, lp_adduser_script());
-       if (! *add_script)
-               return -1;
-       all_string_sub(add_script, "%u", unix_username, sizeof(pstring));
-       if (domain)
-               all_string_sub(add_script, "%D", domain, sizeof(pstring));
-       if (homedir)
-               all_string_sub(add_script, "%H", homedir, sizeof(pstring));
-       ret = smbrun(add_script,NULL);
-       DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
-       return ret;
-}
-
-/****************************************************************************
- Add and Delete UNIX users on demand, based on NTSTATUS codes.
-****************************************************************************/
-
-void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status)
-{
-       struct passwd *pwd=NULL;
-
-       if (NT_STATUS_IS_OK(nt_status)) {
-
-               if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) {
-                       
-                       /*
-                        * User validated ok against Domain controller.
-                        * If the admin wants us to try and create a UNIX
-                        * user on the fly, do so.
-                        */
-                       
-                       if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) {
-                               smb_create_user(user_info->domain.str, user_info->internal_username.str, NULL);
-                       }
-               }
-       }
-}
-
 /****************************************************************************
  Create a SAM_ACCOUNT - either by looking in the pdb, or by faking it up from
  unix info.
@@ -623,87 +575,6 @@ struct nt_user_token *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *
        return token;
 }
 
-/******************************************************************************
- * this function returns the groups (SIDs) of the local SAM the user is in.
- * If this samba server is a DC of the domain the user belongs to, it returns 
- * both domain groups and local / builtin groups. If the user is in a trusted
- * domain, or samba is a member server of a domain, then this function returns
- * local and builtin groups the user is a member of. 
- *
- * currently this is a hack, as there is no sam implementation that is capable
- * of groups.
- ******************************************************************************/
-
-static NTSTATUS get_user_groups_from_local_sam(SAM_ACCOUNT *sampass,
-                                              int *n_groups, DOM_SID **groups, gid_t **unix_groups)
-{
-       uid_t             uid;
-       gid_t             gid;
-       int               n_unix_groups;
-       int               i;
-       struct passwd    *usr;  
-
-       *n_groups = 0;
-       *groups   = NULL;
-
-       if (!IS_SAM_UNIX_USER(sampass)) {
-               DEBUG(1, ("user %s does not have a unix identity!\n", pdb_get_username(sampass)));
-               return NT_STATUS_NO_SUCH_USER;
-       }
-
-       uid = pdb_get_uid(sampass);
-       gid = pdb_get_gid(sampass);
-       
-       n_unix_groups = groups_max();
-       if ((*unix_groups = malloc( sizeof(gid_t) * n_unix_groups ) ) == NULL) {
-               DEBUG(0, ("get_user_groups_from_local_sam: Out of memory allocating unix group list\n"));
-               passwd_free(&usr);
-               return NT_STATUS_NO_MEMORY;
-       }
-       
-       if (sys_getgrouplist(pdb_get_username(sampass), gid, *unix_groups, &n_unix_groups) == -1) {
-               gid_t *groups_tmp;
-               groups_tmp = Realloc(*unix_groups, sizeof(gid_t) * n_unix_groups);
-               if (!groups_tmp) {
-                       SAFE_FREE(*unix_groups);
-                       passwd_free(&usr);
-                       return NT_STATUS_NO_MEMORY;
-               }
-               *unix_groups = groups_tmp;
-
-               if (sys_getgrouplist(pdb_get_username(sampass), gid, *unix_groups, &n_unix_groups) == -1) {
-                       DEBUG(0, ("get_user_groups_from_local_sam: failed to get the unix group list\n"));
-                       SAFE_FREE(*unix_groups);
-                       passwd_free(&usr);
-                       return NT_STATUS_NO_SUCH_USER; /* what should this return value be? */
-               }
-       }
-
-       debug_unix_user_token(DBGC_CLASS, 5, uid, gid, n_unix_groups, *unix_groups);
-       
-       if (n_unix_groups > 0) {
-               *groups   = malloc(sizeof(DOM_SID) * n_unix_groups);
-               if (!*groups) {
-                       DEBUG(0, ("get_user_group_from_local_sam: malloc() failed for DOM_SID list!\n"));
-                       SAFE_FREE(*unix_groups);
-                       return NT_STATUS_NO_MEMORY;
-               }
-       }
-
-       *n_groups = n_unix_groups;
-
-       for (i = 0; i < *n_groups; i++) {
-               if (!gid_to_sid(&(*groups)[i], (*unix_groups)[i])) {
-                       DEBUG(1, ("get_user_groups_from_local_sam: failed to convert gid %ld to a sid!\n", (long int)(*unix_groups)[i+1]));
-                       SAFE_FREE(*groups);
-                       SAFE_FREE(*unix_groups);
-                       return NT_STATUS_NO_SUCH_USER;
-               }
-       }
-                    
-       return NT_STATUS_OK;
-}
-
 /***************************************************************************
  Make a user_info struct
 ***************************************************************************/
@@ -717,9 +588,6 @@ static NTSTATUS make_server_info(auth_serversupplied_info **server_info, SAM_ACC
        }
        ZERO_STRUCTP(*server_info);
 
-       (*server_info)->sam_fill_level = SAM_FILL_ALL;
-       (*server_info)->sam_account    = sampass;
-
        return NT_STATUS_OK;
 }
 
@@ -733,9 +601,6 @@ NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
        NTSTATUS nt_status = NT_STATUS_OK;
        const DOM_SID *user_sid = pdb_get_user_sid(sampass);
        const DOM_SID *group_sid = pdb_get_group_sid(sampass);
-       int       n_groupSIDs = 0;
-       DOM_SID  *groupSIDs   = NULL;
-       gid_t    *unix_groups = NULL;
        NT_USER_TOKEN *token;
        BOOL is_guest;
        uint32 rid;
@@ -744,38 +609,19 @@ NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
                return nt_status;
        }
        
-       if (!NT_STATUS_IS_OK(nt_status 
-                            = get_user_groups_from_local_sam(sampass, 
-               &n_groupSIDs, &groupSIDs, &unix_groups)))
-       {
-               DEBUG(4,("get_user_groups_from_local_sam failed\n"));
-               free_server_info(server_info);
-               return nt_status;
-       }
-       
        is_guest = (sid_peek_rid(user_sid, &rid) && rid == DOMAIN_USER_RID_GUEST);
 
        if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token(user_sid, group_sid,
-                                                             n_groupSIDs, groupSIDs, is_guest, 
+                                                             0, NULL, is_guest, 
                                                              &token)))
        {
                DEBUG(4,("create_nt_user_token failed\n"));
-               SAFE_FREE(groupSIDs);
-               SAFE_FREE(unix_groups);
                free_server_info(server_info);
                return nt_status;
        }
-       
-       SAFE_FREE(groupSIDs);
-
-       (*server_info)->n_groups = n_groupSIDs;
-       (*server_info)->groups = unix_groups;
 
        (*server_info)->ptok = token;
        
-       DEBUG(5,("make_server_info_sam: made server info for user %s\n",
-                pdb_get_username((*server_info)->sam_account)));
-
        return nt_status;
 }
 
@@ -866,11 +712,9 @@ void free_server_info(auth_serversupplied_info **server_info)
 {
        DEBUG(5,("attempting to free (and zero) a server_info structure\n"));
        if (*server_info != NULL) {
-               pdb_free_sam(&(*server_info)->sam_account);
 
                /* call pam_end here, unless we know we are keeping it */
                delete_nt_token( &(*server_info)->ptok );
-               SAFE_FREE((*server_info)->groups);
                ZERO_STRUCT(**server_info);
        }
        SAFE_FREE(*server_info);

diff --git a/source/include/smb.h b/source/include/smb.h
index 6982a0dae04c1e5c7d4ab96286ddc1292c75ee8e..7988a500fa0804159a765a21e0881df6d3f4394a 100644 (file)
--- a/source/include/smb.h
+++ b/source/include/smb.h
@@ -1079,21 +1079,9 @@ typedef struct user_struct
 {
        struct user_struct *next, *prev;
        uint16 vuid; /* Tag for this entry. */
-       uid_t uid; /* uid of a validated user */
-       gid_t gid; /* gid of a validated user */
 
-       userdom_struct user;
-       char *homedir;
-       char *unix_homedir;
-       char *logon_script;
-       
        BOOL guest;
 
-       /* following groups stuff added by ih */
-       /* This groups info is needed for when we become_user() for this uid */
-       int n_groups;
-       gid_t *groups;
-
        NT_USER_TOKEN *nt_user_token;
 
        DATA_BLOB session_key;

diff --git a/source/smb_server/password.c b/source/smb_server/password.c
index 196556819ed45de0db2a5e46684080e85e1d32d1..61987518b876db8a86d9000a2d1305ed382208bb 100644 (file)
--- a/source/smb_server/password.c
+++ b/source/smb_server/password.c
@@ -56,10 +56,6 @@ void invalidate_vuid(struct server_context *smb, uint16 vuid)
        if (vuser == NULL)
                return;
        
-       SAFE_FREE(vuser->homedir);
-       SAFE_FREE(vuser->unix_homedir);
-       SAFE_FREE(vuser->logon_script);
-       
        data_blob_free(&vuser->session_key);
 
        session_yield(vuser);
@@ -72,7 +68,6 @@ void invalidate_vuid(struct server_context *smb, uint16 vuid)
           from the vuid 'owner' of connections */
        /* REWRITE: conn_clear_vuid_cache(smb, vuid); */
 
-       SAFE_FREE(vuser->groups);
        delete_nt_token(&vuser->nt_user_token);
        SAFE_FREE(vuser);
        smb->users.num_validated_vuids--;
@@ -141,73 +136,17 @@ int register_vuid(struct server_context *smb,
 
        vuser->vuid = smb->users.next_vuid;
 
-       /* the next functions should be done by a SID mapping system (SMS) as
-        * the new real sam db won't have reference to unix uids or gids
-        */
-       if (!IS_SAM_UNIX_USER(server_info->sam_account)) {
-               DEBUG(0,("Attempted session setup with invalid user.  No uid/gid in SAM_ACCOUNT\n"));
-               free(vuser);
-               free_server_info(&server_info);
-               return UID_FIELD_INVALID;
-       }
-       
-       vuser->uid = pdb_get_uid(server_info->sam_account);
-       vuser->gid = pdb_get_gid(server_info->sam_account);
-       
-       vuser->n_groups = server_info->n_groups;
-       if (vuser->n_groups) {
-               if (!(vuser->groups = memdup(server_info->groups, sizeof(gid_t) * vuser->n_groups))) {
-                       DEBUG(0,("register_vuid: failed to memdup vuser->groups\n"));
-                       free(vuser);
-                       free_server_info(&server_info);
-                       return UID_FIELD_INVALID;
-               }
-       }
-
        vuser->guest = server_info->guest;
-       fstrcpy(vuser->user.unix_name, pdb_get_username(server_info->sam_account)); 
-
-       /* This is a potentially untrusted username */
-       alpha_strcpy(vuser->user.smb_name, smb_name, ". _-$", sizeof(vuser->user.smb_name));
-
-       fstrcpy(vuser->user.domain, pdb_get_domain(server_info->sam_account));
-       fstrcpy(vuser->user.full_name, pdb_get_fullname(server_info->sam_account));
-
-       {
-               /* Keep the homedir handy */
-               const char *homedir = pdb_get_homedir(server_info->sam_account);
-               const char *unix_homedir = pdb_get_unix_homedir(server_info->sam_account);
-               const char *logon_script = pdb_get_logon_script(server_info->sam_account);
-               if (homedir) {
-                       vuser->homedir = smb_xstrdup(homedir);
-               }
-
-               if (unix_homedir) {
-                       vuser->unix_homedir = smb_xstrdup(unix_homedir);
-               }
-
-               if (logon_script) {
-                       vuser->logon_script = smb_xstrdup(logon_script);
-               }
-       }
 
        vuser->session_key = *session_key;
 
-       DEBUG(10,("register_vuid: (%u,%u) %s %s %s guest=%d\n", 
-                 (unsigned int)vuser->uid, 
-                 (unsigned int)vuser->gid,
-                 vuser->user.unix_name, vuser->user.smb_name, vuser->user.domain, vuser->guest ));
-
-       DEBUG(3, ("User name: %s\tReal name: %s\n",vuser->user.unix_name,vuser->user.full_name));       
+       DEBUG(10,("register_vuid: guest=%d\n", vuser->guest ));
 
        if (server_info->ptok) {
                vuser->nt_user_token = dup_nt_token(server_info->ptok);
        } else {
                DEBUG(1, ("server_info does not contain a user_token - cannot continue\n"));
                free_server_info(&server_info);
-               SAFE_FREE(vuser->homedir);
-               SAFE_FREE(vuser->unix_homedir);
-               SAFE_FREE(vuser->logon_script);
 
                SAFE_FREE(vuser);
                return UID_FIELD_INVALID;
@@ -216,8 +155,6 @@ int register_vuid(struct server_context *smb,
        /* use this to keep tabs on all our info from the authentication */
        vuser->server_info = server_info;
 
-       DEBUG(3,("UNIX uid %d is UNIX user %s, and will be vuid %u\n",(int)vuser->uid,vuser->user.unix_name, vuser->vuid));
-
        smb->users.next_vuid++;
        smb->users.num_validated_vuids++;
 
@@ -229,15 +166,6 @@ int register_vuid(struct server_context *smb,
                return -1;
        }
 
-       /* Register a home dir service for this user */
-       if ((!vuser->guest) && vuser->unix_homedir && *(vuser->unix_homedir)) {
-               DEBUG(3, ("Adding/updating homes service for user '%s' using home direcotry: '%s'\n", 
-                         vuser->user.unix_name, vuser->unix_homedir));
-               vuser->homes_snum = add_home_service(vuser->user.unix_name, vuser->user.unix_name, vuser->unix_homedir);          
-       } else {
-               vuser->homes_snum = -1;
-       }
-       
        return vuser->vuid;
 }