source3/passdb/pdb_interface.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Password and authentication handling
   4    Copyright (C) Andrew Bartlett                        2002
   5    Copyright (C) Jelmer Vernooij                        2002
   6    Copyright (C) Simo Sorce                             2003
   7    Copyright (C) Volker Lendecke                        2006
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_PASSDB
  27
  28 /* Cache of latest SAM lookup query */
  29
  30 static struct samu *csamuser = NULL;
  31
  32 static_decl_pdb;
  33
  34 static struct pdb_init_function_entry *backends = NULL;
  35
  36 static void lazy_initialize_passdb(void)
  37 {
  38         static bool initialized = False;
  39         if(initialized) {
  40                 return;
  41         }
  42         static_init_pdb;
  43         initialized = True;
  44 }
  45
  46 static bool lookup_global_sam_rid(TALLOC_CTX *mem_ctx, uint32 rid,
  47                                   const char **name,
  48                                   enum lsa_SidType *psid_name_use,
  49                                   union unid_t *unix_id);
  50
  51 NTSTATUS smb_register_passdb(int version, const char *name, pdb_init_function init)
  52 {
  53         struct pdb_init_function_entry *entry = backends;
  54
  55         if(version != PASSDB_INTERFACE_VERSION) {
  56                 DEBUG(0,("Can't register passdb backend!\n"
  57                          "You tried to register a passdb module with PASSDB_INTERFACE_VERSION %d, "
  58                          "while this version of samba uses version %d\n",
  59                          version,PASSDB_INTERFACE_VERSION));
  60                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
  61         }
  62
  63         if (!name || !init) {
  64                 return NT_STATUS_INVALID_PARAMETER;
  65         }
  66
  67         DEBUG(5,("Attempting to register passdb backend %s\n", name));
  68
  69         /* Check for duplicates */
  70         if (pdb_find_backend_entry(name)) {
  71                 DEBUG(0,("There already is a passdb backend registered with the name %s!\n", name));
  72                 return NT_STATUS_OBJECT_NAME_COLLISION;
  73         }
  74
  75         entry = SMB_XMALLOC_P(struct pdb_init_function_entry);
  76         entry->name = smb_xstrdup(name);
  77         entry->init = init;
  78
  79         DLIST_ADD(backends, entry);
  80         DEBUG(5,("Successfully added passdb backend '%s'\n", name));
  81         return NT_STATUS_OK;
  82 }
  83
  84 struct pdb_init_function_entry *pdb_find_backend_entry(const char *name)
  85 {
  86         struct pdb_init_function_entry *entry = backends;
  87
  88         while(entry) {
  89                 if (strcmp(entry->name, name)==0) return entry;
  90                 entry = entry->next;
  91         }
  92
  93         return NULL;
  94 }
  95
  96 /*
  97  * The event context for the passdb backend. I know this is a bad hack and yet
  98  * another static variable, but our pdb API is a global thing per
  99  * definition. The first use for this is the LDAP idle function, more might be
 100  * added later.
 101  *
 102  * I don't feel too bad about this static variable, it replaces the
 103  * smb_idle_event_list that used to exist in lib/module.c.  -- VL
 104  */
 105
 106 static struct event_context *pdb_event_ctx;
 107
 108 struct event_context *pdb_get_event_context(void)
 109 {
 110         return pdb_event_ctx;
 111 }
 112
 113 /******************************************************************
 114   Make a pdb_methods from scratch
 115  *******************************************************************/
 116
 117 NTSTATUS make_pdb_method_name(struct pdb_methods **methods, const char *selected)
 118 {
 119         char *module_name = smb_xstrdup(selected);
 120         char *module_location = NULL, *p;
 121         struct pdb_init_function_entry *entry;
 122         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 123
 124         lazy_initialize_passdb();
 125
 126         p = strchr(module_name, ':');
 127
 128         if (p) {
 129                 *p = 0;
 130                 module_location = p+1;
 131                 trim_char(module_location, ' ', ' ');
 132         }
 133
 134         trim_char(module_name, ' ', ' ');
 135
 136
 137         DEBUG(5,("Attempting to find an passdb backend to match %s (%s)\n", selected, module_name));
 138
 139         entry = pdb_find_backend_entry(module_name);
 140
 141         /* Try to find a module that contains this module */
 142         if (!entry) {
 143                 DEBUG(2,("No builtin backend found, trying to load plugin\n"));
 144                 if(NT_STATUS_IS_OK(smb_probe_module("pdb", module_name)) && !(entry = pdb_find_backend_entry(module_name))) {
 145                         DEBUG(0,("Plugin is available, but doesn't register passdb backend %s\n", module_name));
 146                         SAFE_FREE(module_name);
 147                         return NT_STATUS_UNSUCCESSFUL;
 148                 }
 149         }
 150
 151         /* No such backend found */
 152         if(!entry) {
 153                 DEBUG(0,("No builtin nor plugin backend for %s found\n", module_name));
 154                 SAFE_FREE(module_name);
 155                 return NT_STATUS_INVALID_PARAMETER;
 156         }
 157
 158         DEBUG(5,("Found pdb backend %s\n", module_name));
 159
 160         if ( !NT_STATUS_IS_OK( nt_status = entry->init(methods, module_location) ) ) {
 161                 DEBUG(0,("pdb backend %s did not correctly init (error was %s)\n",
 162                         selected, nt_errstr(nt_status)));
 163                 SAFE_FREE(module_name);
 164                 return nt_status;
 165         }
 166
 167         SAFE_FREE(module_name);
 168
 169         DEBUG(5,("pdb backend %s has a valid init\n", selected));
 170
 171         return nt_status;
 172 }
 173
 174 /******************************************************************
 175  Return an already initialised pdn_methods structure
 176 *******************************************************************/
 177
 178 static struct pdb_methods *pdb_get_methods_reload( bool reload )
 179 {
 180         static struct pdb_methods *pdb = NULL;
 181
 182         if ( pdb && reload ) {
 183                 pdb->free_private_data( &(pdb->private_data) );
 184                 if ( !NT_STATUS_IS_OK( make_pdb_method_name( &pdb, lp_passdb_backend() ) ) ) {
 185                         char *msg = NULL;
 186                         asprintf(&msg, "pdb_get_methods_reload: "
 187                                 "failed to get pdb methods for backend %s\n",
 188                                 lp_passdb_backend());
 189                         smb_panic(msg);
 190                 }
 191         }
 192
 193         if ( !pdb ) {
 194                 if ( !NT_STATUS_IS_OK( make_pdb_method_name( &pdb, lp_passdb_backend() ) ) ) {
 195                         char *msg = NULL;
 196                         asprintf(&msg, "pdb_get_methods_reload: "
 197                                 "failed to get pdb methods for backend %s\n",
 198                                 lp_passdb_backend());
 199                         smb_panic(msg);
 200                 }
 201         }
 202
 203         return pdb;
 204 }
 205
 206 static struct pdb_methods *pdb_get_methods(void)
 207 {
 208         return pdb_get_methods_reload(False);
 209 }
 210
 211 /******************************************************************
 212  Backward compatibility functions for the original passdb interface
 213 *******************************************************************/
 214
 215 bool pdb_setsampwent(bool update, uint16 acb_mask)
 216 {
 217         struct pdb_methods *pdb = pdb_get_methods();
 218         return NT_STATUS_IS_OK(pdb->setsampwent(pdb, update, acb_mask));
 219 }
 220
 221 void pdb_endsampwent(void)
 222 {
 223         struct pdb_methods *pdb = pdb_get_methods();
 224         pdb->endsampwent(pdb);
 225 }
 226
 227 bool pdb_getsampwent(struct samu *user)
 228 {
 229         struct pdb_methods *pdb = pdb_get_methods();
 230
 231         if ( !NT_STATUS_IS_OK(pdb->getsampwent(pdb, user) ) ) {
 232                 return False;
 233         }
 234
 235         return True;
 236 }
 237
 238 bool pdb_getsampwnam(struct samu *sam_acct, const char *username)
 239 {
 240         struct pdb_methods *pdb = pdb_get_methods();
 241
 242         if (!NT_STATUS_IS_OK(pdb->getsampwnam(pdb, sam_acct, username))) {
 243                 return False;
 244         }
 245
 246         if ( csamuser ) {
 247                 TALLOC_FREE(csamuser);
 248         }
 249
 250         csamuser = samu_new( NULL );
 251         if (!csamuser) {
 252                 return False;
 253         }
 254
 255         if (!pdb_copy_sam_account(csamuser, sam_acct)) {
 256                 TALLOC_FREE(csamuser);
 257                 return False;
 258         }
 259
 260         return True;
 261 }
 262
 263 /**********************************************************************
 264 **********************************************************************/
 265
 266 bool guest_user_info( struct samu *user )
 267 {
 268         struct passwd *pwd;
 269         NTSTATUS result;
 270         const char *guestname = lp_guestaccount();
 271
 272         if ( !(pwd = getpwnam_alloc( NULL, guestname ) ) ) {
 273                 DEBUG(0,("guest_user_info: Unable to locate guest account [%s]!\n",
 274                         guestname));
 275                 return False;
 276         }
 277
 278         result = samu_set_unix(user, pwd );
 279
 280         TALLOC_FREE( pwd );
 281
 282         return NT_STATUS_IS_OK( result );
 283 }
 284
 285 /**********************************************************************
 286 **********************************************************************/
 287
 288 bool pdb_getsampwsid(struct samu *sam_acct, const DOM_SID *sid)
 289 {
 290         struct pdb_methods *pdb = pdb_get_methods();
 291         uint32 rid;
 292
 293         /* hard code the Guest RID of 501 */
 294
 295         if ( !sid_peek_check_rid( get_global_sam_sid(), sid, &rid ) )
 296                 return False;
 297
 298         if ( rid == DOMAIN_USER_RID_GUEST ) {
 299                 DEBUG(6,("pdb_getsampwsid: Building guest account\n"));
 300                 return guest_user_info( sam_acct );
 301         }
 302
 303         /* check the cache first */
 304
 305         if ( csamuser && sid_equal(sid, pdb_get_user_sid(csamuser) ) )
 306                 return pdb_copy_sam_account(sam_acct, csamuser);
 307
 308         return NT_STATUS_IS_OK(pdb->getsampwsid(pdb, sam_acct, sid));
 309 }
 310
 311 static NTSTATUS pdb_default_create_user(struct pdb_methods *methods,
 312                                         TALLOC_CTX *tmp_ctx, const char *name,
 313                                         uint32 acb_info, uint32 *rid)
 314 {
 315         struct samu *sam_pass;
 316         NTSTATUS status;
 317         struct passwd *pwd;
 318
 319         if ((sam_pass = samu_new(tmp_ctx)) == NULL) {
 320                 return NT_STATUS_NO_MEMORY;
 321         }
 322
 323         if ( !(pwd = Get_Pwnam_alloc(tmp_ctx, name)) ) {
 324                 char *add_script = NULL;
 325                 int add_ret;
 326                 fstring name2;
 327
 328                 if ((acb_info & ACB_NORMAL) && name[strlen(name)-1] != '$') {
 329                         add_script = talloc_strdup(tmp_ctx,
 330                                         lp_adduser_script());
 331                 } else {
 332                         add_script = talloc_strdup(tmp_ctx,
 333                                         lp_addmachine_script());
 334                 }
 335
 336                 if (!add_script || add_script[0] == '\0') {
 337                         DEBUG(3, ("Could not find user %s and no add script "
 338                                   "defined\n", name));
 339                         return NT_STATUS_NO_SUCH_USER;
 340                 }
 341
 342                 /* lowercase the username before creating the Unix account for
 343                    compatibility with previous Samba releases */
 344                 fstrcpy( name2, name );
 345                 strlower_m( name2 );
 346                 add_script = talloc_all_string_sub(tmp_ctx,
 347                                         add_script,
 348                                         "%u",
 349                                         name2);
 350                 if (!add_script) {
 351                         return NT_STATUS_NO_MEMORY;
 352                 }
 353                 add_ret = smbrun(add_script,NULL);
 354                 DEBUG(add_ret ? 0 : 3, ("_samr_create_user: Running the command `%s' gave %d\n",
 355                                         add_script, add_ret));
 356                 if (add_ret == 0) {
 357                         smb_nscd_flush_user_cache();
 358                 }
 359
 360                 flush_pwnam_cache();
 361
 362                 pwd = Get_Pwnam_alloc(tmp_ctx, name);
 363         }
 364
 365         /* we have a valid SID coming out of this call */
 366
 367         status = samu_alloc_rid_unix( sam_pass, pwd );
 368
 369         TALLOC_FREE( pwd );
 370
 371         if (!NT_STATUS_IS_OK(status)) {
 372                 DEBUG(3, ("pdb_default_create_user: failed to create a new user structure: %s\n", nt_errstr(status)));
 373                 return status;
 374         }
 375
 376         if (!sid_peek_check_rid(get_global_sam_sid(),
 377                                 pdb_get_user_sid(sam_pass), rid)) {
 378                 DEBUG(0, ("Could not get RID of fresh user\n"));
 379                 return NT_STATUS_INTERNAL_ERROR;
 380         }
 381
 382         /* Use the username case specified in the original request */
 383
 384         pdb_set_username( sam_pass, name, PDB_SET );
 385
 386         /* Disable the account on creation, it does not have a reasonable password yet. */
 387
 388         acb_info |= ACB_DISABLED;
 389
 390         pdb_set_acct_ctrl(sam_pass, acb_info, PDB_CHANGED);
 391
 392         status = pdb_add_sam_account(sam_pass);
 393
 394         TALLOC_FREE(sam_pass);
 395
 396         return status;
 397 }
 398
 399 NTSTATUS pdb_create_user(TALLOC_CTX *mem_ctx, const char *name, uint32 flags,
 400                          uint32 *rid)
 401 {
 402         struct pdb_methods *pdb = pdb_get_methods();
 403         return pdb->create_user(pdb, mem_ctx, name, flags, rid);
 404 }
 405
 406 /****************************************************************************
 407  Delete a UNIX user on demand.
 408 ****************************************************************************/
 409
 410 static int smb_delete_user(const char *unix_user)
 411 {
 412         char *del_script = NULL;
 413         int ret;
 414
 415         /* safety check */
 416
 417         if ( strequal( unix_user, "root" ) ) {
 418                 DEBUG(0,("smb_delete_user: Refusing to delete local system root account!\n"));
 419                 return -1;
 420         }
 421
 422         del_script = talloc_strdup(talloc_tos(), lp_deluser_script());
 423         if (!del_script || !*del_script) {
 424                 return -1;
 425         }
 426         del_script = talloc_all_string_sub(talloc_tos(),
 427                                 del_script,
 428                                 "%u",
 429                                 unix_user);
 430         if (!del_script) {
 431                 return -1;
 432         }
 433         ret = smbrun(del_script,NULL);
 434         flush_pwnam_cache();
 435         if (ret == 0) {
 436                 smb_nscd_flush_user_cache();
 437         }
 438         DEBUG(ret ? 0 : 3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
 439
 440         return ret;
 441 }
 442
 443 static NTSTATUS pdb_default_delete_user(struct pdb_methods *methods,
 444                                         TALLOC_CTX *mem_ctx,
 445                                         struct samu *sam_acct)
 446 {
 447         NTSTATUS status;
 448         fstring username;
 449
 450         status = pdb_delete_sam_account(sam_acct);
 451         if (!NT_STATUS_IS_OK(status)) {
 452                 return status;
 453         }
 454
 455         /*
 456          * Now delete the unix side ....
 457          * note: we don't check if the delete really happened as the script is
 458          * not necessary present and maybe the sysadmin doesn't want to delete
 459          * the unix side
 460          */
 461
 462         /* always lower case the username before handing it off to
 463            external scripts */
 464
 465         fstrcpy( username, pdb_get_username(sam_acct) );
 466         strlower_m( username );
 467
 468         smb_delete_user( username );
 469
 470         return status;
 471 }
 472
 473 NTSTATUS pdb_delete_user(TALLOC_CTX *mem_ctx, struct samu *sam_acct)
 474 {
 475         struct pdb_methods *pdb = pdb_get_methods();
 476         uid_t uid = -1;
 477
 478         /* sanity check to make sure we don't delete root */
 479
 480         if ( !sid_to_uid( pdb_get_user_sid(sam_acct), &uid ) ) {
 481                 return NT_STATUS_NO_SUCH_USER;
 482         }
 483
 484         if ( uid == 0 ) {
 485                 return NT_STATUS_ACCESS_DENIED;
 486         }
 487
 488         return pdb->delete_user(pdb, mem_ctx, sam_acct);
 489 }
 490
 491 NTSTATUS pdb_add_sam_account(struct samu *sam_acct)
 492 {
 493         struct pdb_methods *pdb = pdb_get_methods();
 494         return pdb->add_sam_account(pdb, sam_acct);
 495 }
 496
 497 NTSTATUS pdb_update_sam_account(struct samu *sam_acct)
 498 {
 499         struct pdb_methods *pdb = pdb_get_methods();
 500
 501         if (csamuser != NULL) {
 502                 TALLOC_FREE(csamuser);
 503                 csamuser = NULL;
 504         }
 505
 506         return pdb->update_sam_account(pdb, sam_acct);
 507 }
 508
 509 NTSTATUS pdb_delete_sam_account(struct samu *sam_acct)
 510 {
 511         struct pdb_methods *pdb = pdb_get_methods();
 512
 513         if (csamuser != NULL) {
 514                 TALLOC_FREE(csamuser);
 515                 csamuser = NULL;
 516         }
 517
 518         return pdb->delete_sam_account(pdb, sam_acct);
 519 }
 520
 521 NTSTATUS pdb_rename_sam_account(struct samu *oldname, const char *newname)
 522 {
 523         struct pdb_methods *pdb = pdb_get_methods();
 524         uid_t uid;
 525         NTSTATUS status;
 526
 527         if (csamuser != NULL) {
 528                 TALLOC_FREE(csamuser);
 529                 csamuser = NULL;
 530         }
 531
 532         /* sanity check to make sure we don't rename root */
 533
 534         if ( !sid_to_uid( pdb_get_user_sid(oldname), &uid ) ) {
 535                 return NT_STATUS_NO_SUCH_USER;
 536         }
 537
 538         if ( uid == 0 ) {
 539                 return NT_STATUS_ACCESS_DENIED;
 540         }
 541
 542         status = pdb->rename_sam_account(pdb, oldname, newname);
 543
 544         /* always flush the cache here just to be safe */
 545         flush_pwnam_cache();
 546
 547         return status;
 548 }
 549
 550 NTSTATUS pdb_update_login_attempts(struct samu *sam_acct, bool success)
 551 {
 552         struct pdb_methods *pdb = pdb_get_methods();
 553         return pdb->update_login_attempts(pdb, sam_acct, success);
 554 }
 555
 556 bool pdb_getgrsid(GROUP_MAP *map, DOM_SID sid)
 557 {
 558         struct pdb_methods *pdb = pdb_get_methods();
 559         return NT_STATUS_IS_OK(pdb->getgrsid(pdb, map, sid));
 560 }
 561
 562 bool pdb_getgrgid(GROUP_MAP *map, gid_t gid)
 563 {
 564         struct pdb_methods *pdb = pdb_get_methods();
 565         return NT_STATUS_IS_OK(pdb->getgrgid(pdb, map, gid));
 566 }
 567
 568 bool pdb_getgrnam(GROUP_MAP *map, const char *name)
 569 {
 570         struct pdb_methods *pdb = pdb_get_methods();
 571         return NT_STATUS_IS_OK(pdb->getgrnam(pdb, map, name));
 572 }
 573
 574 static NTSTATUS pdb_default_create_dom_group(struct pdb_methods *methods,
 575                                              TALLOC_CTX *mem_ctx,
 576                                              const char *name,
 577                                              uint32 *rid)
 578 {
 579         DOM_SID group_sid;
 580         struct group *grp;
 581
 582         grp = getgrnam(name);
 583
 584         if (grp == NULL) {
 585                 gid_t gid;
 586
 587                 if (smb_create_group(name, &gid) != 0) {
 588                         return NT_STATUS_ACCESS_DENIED;
 589                 }
 590
 591                 grp = getgrgid(gid);
 592         }
 593
 594         if (grp == NULL) {
 595                 return NT_STATUS_ACCESS_DENIED;
 596         }
 597
 598         if (pdb_rid_algorithm()) {
 599                 *rid = algorithmic_pdb_gid_to_group_rid( grp->gr_gid );
 600         } else {
 601                 if (!pdb_new_rid(rid)) {
 602                         return NT_STATUS_ACCESS_DENIED;
 603                 }
 604         }
 605
 606         sid_compose(&group_sid, get_global_sam_sid(), *rid);
 607
 608         return add_initial_entry(grp->gr_gid, sid_string_static(&group_sid),
 609                                  SID_NAME_DOM_GRP, name, NULL);
 610 }
 611
 612 NTSTATUS pdb_create_dom_group(TALLOC_CTX *mem_ctx, const char *name,
 613                               uint32 *rid)
 614 {
 615         struct pdb_methods *pdb = pdb_get_methods();
 616         return pdb->create_dom_group(pdb, mem_ctx, name, rid);
 617 }
 618
 619 static NTSTATUS pdb_default_delete_dom_group(struct pdb_methods *methods,
 620                                              TALLOC_CTX *mem_ctx,
 621                                              uint32 rid)
 622 {
 623         DOM_SID group_sid;
 624         GROUP_MAP map;
 625         NTSTATUS status;
 626         struct group *grp;
 627         const char *grp_name;
 628
 629         sid_compose(&group_sid, get_global_sam_sid(), rid);
 630
 631         if (!get_domain_group_from_sid(group_sid, &map)) {
 632                 DEBUG(10, ("Could not find group for rid %d\n", rid));
 633                 return NT_STATUS_NO_SUCH_GROUP;
 634         }
 635
 636         /* We need the group name for the smb_delete_group later on */
 637
 638         if (map.gid == (gid_t)-1) {
 639                 return NT_STATUS_NO_SUCH_GROUP;
 640         }
 641
 642         grp = getgrgid(map.gid);
 643         if (grp == NULL) {
 644                 return NT_STATUS_NO_SUCH_GROUP;
 645         }
 646
 647         /* Copy the name, no idea what pdb_delete_group_mapping_entry does.. */
 648
 649         grp_name = talloc_strdup(mem_ctx, grp->gr_name);
 650         if (grp_name == NULL) {
 651                 return NT_STATUS_NO_MEMORY;
 652         }
 653
 654         status = pdb_delete_group_mapping_entry(group_sid);
 655
 656         if (!NT_STATUS_IS_OK(status)) {
 657                 return status;
 658         }
 659
 660         /* Don't check the result of smb_delete_group */
 661
 662         smb_delete_group(grp_name);
 663
 664         return NT_STATUS_OK;
 665 }
 666
 667 NTSTATUS pdb_delete_dom_group(TALLOC_CTX *mem_ctx, uint32 rid)
 668 {
 669         struct pdb_methods *pdb = pdb_get_methods();
 670         return pdb->delete_dom_group(pdb, mem_ctx, rid);
 671 }
 672
 673 NTSTATUS pdb_add_group_mapping_entry(GROUP_MAP *map)
 674 {
 675         struct pdb_methods *pdb = pdb_get_methods();
 676         return pdb->add_group_mapping_entry(pdb, map);
 677 }
 678
 679 NTSTATUS pdb_update_group_mapping_entry(GROUP_MAP *map)
 680 {
 681         struct pdb_methods *pdb = pdb_get_methods();
 682         return pdb->update_group_mapping_entry(pdb, map);
 683 }
 684
 685 NTSTATUS pdb_delete_group_mapping_entry(DOM_SID sid)
 686 {
 687         struct pdb_methods *pdb = pdb_get_methods();
 688         return pdb->delete_group_mapping_entry(pdb, sid);
 689 }
 690
 691 bool pdb_enum_group_mapping(const DOM_SID *sid, enum lsa_SidType sid_name_use, GROUP_MAP **pp_rmap,
 692                             size_t *p_num_entries, bool unix_only)
 693 {
 694         struct pdb_methods *pdb = pdb_get_methods();
 695         return NT_STATUS_IS_OK(pdb-> enum_group_mapping(pdb, sid, sid_name_use,
 696                 pp_rmap, p_num_entries, unix_only));
 697 }
 698
 699 NTSTATUS pdb_enum_group_members(TALLOC_CTX *mem_ctx,
 700                                 const DOM_SID *sid,
 701                                 uint32 **pp_member_rids,
 702                                 size_t *p_num_members)
 703 {
 704         struct pdb_methods *pdb = pdb_get_methods();
 705         NTSTATUS result;
 706
 707         result = pdb->enum_group_members(pdb, mem_ctx,
 708                         sid, pp_member_rids, p_num_members);
 709
 710         /* special check for rid 513 */
 711
 712         if ( !NT_STATUS_IS_OK( result ) ) {
 713                 uint32 rid;
 714
 715                 sid_peek_rid( sid, &rid );
 716
 717                 if ( rid == DOMAIN_GROUP_RID_USERS ) {
 718                         *p_num_members = 0;
 719                         *pp_member_rids = NULL;
 720
 721                         return NT_STATUS_OK;
 722                 }
 723         }
 724
 725         return result;
 726 }
 727
 728 NTSTATUS pdb_enum_group_memberships(TALLOC_CTX *mem_ctx, struct samu *user,
 729                                     DOM_SID **pp_sids, gid_t **pp_gids,
 730                                     size_t *p_num_groups)
 731 {
 732         struct pdb_methods *pdb = pdb_get_methods();
 733         return pdb->enum_group_memberships(
 734                 pdb, mem_ctx, user,
 735                 pp_sids, pp_gids, p_num_groups);
 736 }
 737
 738 static NTSTATUS pdb_default_set_unix_primary_group(struct pdb_methods *methods,
 739                                                    TALLOC_CTX *mem_ctx,
 740                                                    struct samu *sampass)
 741 {
 742         struct group *grp;
 743         gid_t gid;
 744
 745         if (!sid_to_gid(pdb_get_group_sid(sampass), &gid) ||
 746             (grp = getgrgid(gid)) == NULL) {
 747                 return NT_STATUS_INVALID_PRIMARY_GROUP;
 748         }
 749
 750         if (smb_set_primary_group(grp->gr_name,
 751                                   pdb_get_username(sampass)) != 0) {
 752                 return NT_STATUS_ACCESS_DENIED;
 753         }
 754
 755         return NT_STATUS_OK;
 756 }
 757
 758 NTSTATUS pdb_set_unix_primary_group(TALLOC_CTX *mem_ctx, struct samu *user)
 759 {
 760         struct pdb_methods *pdb = pdb_get_methods();
 761         return pdb->set_unix_primary_group(pdb, mem_ctx, user);
 762 }
 763
 764 /*
 765  * Helper function to see whether a user is in a group. We can't use
 766  * user_in_group_sid here because this creates dependencies only smbd can
 767  * fulfil.
 768  */
 769
 770 static bool pdb_user_in_group(TALLOC_CTX *mem_ctx, struct samu *account,
 771                               const DOM_SID *group_sid)
 772 {
 773         DOM_SID *sids;
 774         gid_t *gids;
 775         size_t i, num_groups;
 776
 777         if (!NT_STATUS_IS_OK(pdb_enum_group_memberships(mem_ctx, account,
 778                                                         &sids, &gids,
 779                                                         &num_groups))) {
 780                 return False;
 781         }
 782
 783         for (i=0; i<num_groups; i++) {
 784                 if (sid_equal(group_sid, &sids[i])) {
 785                         return True;
 786                 }
 787         }
 788         return False;
 789 }
 790
 791 static NTSTATUS pdb_default_add_groupmem(struct pdb_methods *methods,
 792                                          TALLOC_CTX *mem_ctx,
 793                                          uint32 group_rid,
 794                                          uint32 member_rid)
 795 {
 796         DOM_SID group_sid, member_sid;
 797         struct samu *account = NULL;
 798         GROUP_MAP map;
 799         struct group *grp;
 800         struct passwd *pwd;
 801         const char *group_name;
 802         uid_t uid;
 803
 804         sid_compose(&group_sid, get_global_sam_sid(), group_rid);
 805         sid_compose(&member_sid, get_global_sam_sid(), member_rid);
 806
 807         if (!get_domain_group_from_sid(group_sid, &map) ||
 808             (map.gid == (gid_t)-1) ||
 809             ((grp = getgrgid(map.gid)) == NULL)) {
 810                 return NT_STATUS_NO_SUCH_GROUP;
 811         }
 812
 813         group_name = talloc_strdup(mem_ctx, grp->gr_name);
 814         if (group_name == NULL) {
 815                 return NT_STATUS_NO_MEMORY;
 816         }
 817
 818         if ( !(account = samu_new( NULL )) ) {
 819                 return NT_STATUS_NO_MEMORY;
 820         }
 821
 822         if (!pdb_getsampwsid(account, &member_sid) ||
 823             !sid_to_uid(&member_sid, &uid) ||
 824             ((pwd = getpwuid_alloc(mem_ctx, uid)) == NULL)) {
 825                 return NT_STATUS_NO_SUCH_USER;
 826         }
 827
 828         if (pdb_user_in_group(mem_ctx, account, &group_sid)) {
 829                 return NT_STATUS_MEMBER_IN_GROUP;
 830         }
 831
 832         /*
 833          * ok, the group exist, the user exist, the user is not in the group,
 834          * we can (finally) add it to the group !
 835          */
 836
 837         smb_add_user_group(group_name, pwd->pw_name);
 838
 839         if (!pdb_user_in_group(mem_ctx, account, &group_sid)) {
 840                 return NT_STATUS_ACCESS_DENIED;
 841         }
 842
 843         return NT_STATUS_OK;
 844 }
 845
 846 NTSTATUS pdb_add_groupmem(TALLOC_CTX *mem_ctx, uint32 group_rid,
 847                           uint32 member_rid)
 848 {
 849         struct pdb_methods *pdb = pdb_get_methods();
 850         return pdb->add_groupmem(pdb, mem_ctx, group_rid, member_rid);
 851 }
 852
 853 static NTSTATUS pdb_default_del_groupmem(struct pdb_methods *methods,
 854                                          TALLOC_CTX *mem_ctx,
 855                                          uint32 group_rid,
 856                                          uint32 member_rid)
 857 {
 858         DOM_SID group_sid, member_sid;
 859         struct samu *account = NULL;
 860         GROUP_MAP map;
 861         struct group *grp;
 862         struct passwd *pwd;
 863         const char *group_name;
 864         uid_t uid;
 865
 866         sid_compose(&group_sid, get_global_sam_sid(), group_rid);
 867         sid_compose(&member_sid, get_global_sam_sid(), member_rid);
 868
 869         if (!get_domain_group_from_sid(group_sid, &map) ||
 870             (map.gid == (gid_t)-1) ||
 871             ((grp = getgrgid(map.gid)) == NULL)) {
 872                 return NT_STATUS_NO_SUCH_GROUP;
 873         }
 874
 875         group_name = talloc_strdup(mem_ctx, grp->gr_name);
 876         if (group_name == NULL) {
 877                 return NT_STATUS_NO_MEMORY;
 878         }
 879
 880         if ( !(account = samu_new( NULL )) ) {
 881                 return NT_STATUS_NO_MEMORY;
 882         }
 883
 884         if (!pdb_getsampwsid(account, &member_sid) ||
 885             !sid_to_uid(&member_sid, &uid) ||
 886             ((pwd = getpwuid_alloc(mem_ctx, uid)) == NULL)) {
 887                 return NT_STATUS_NO_SUCH_USER;
 888         }
 889
 890         if (!pdb_user_in_group(mem_ctx, account, &group_sid)) {
 891                 return NT_STATUS_MEMBER_NOT_IN_GROUP;
 892         }
 893
 894         /*
 895          * ok, the group exist, the user exist, the user is in the group,
 896          * we can (finally) delete it from the group!
 897          */
 898
 899         smb_delete_user_group(group_name, pwd->pw_name);
 900
 901         if (pdb_user_in_group(mem_ctx, account, &group_sid)) {
 902                 return NT_STATUS_ACCESS_DENIED;
 903         }
 904
 905         return NT_STATUS_OK;
 906 }
 907
 908 NTSTATUS pdb_del_groupmem(TALLOC_CTX *mem_ctx, uint32 group_rid,
 909                           uint32 member_rid)
 910 {
 911         struct pdb_methods *pdb = pdb_get_methods();
 912         return pdb->del_groupmem(pdb, mem_ctx, group_rid, member_rid);
 913 }
 914
 915 NTSTATUS pdb_create_alias(const char *name, uint32 *rid)
 916 {
 917         struct pdb_methods *pdb = pdb_get_methods();
 918         return pdb->create_alias(pdb, name, rid);
 919 }
 920
 921 NTSTATUS pdb_delete_alias(const DOM_SID *sid)
 922 {
 923         struct pdb_methods *pdb = pdb_get_methods();
 924         return pdb->delete_alias(pdb, sid);
 925 }
 926
 927 NTSTATUS pdb_get_aliasinfo(const DOM_SID *sid, struct acct_info *info)
 928 {
 929         struct pdb_methods *pdb = pdb_get_methods();
 930         return pdb->get_aliasinfo(pdb, sid, info);
 931 }
 932
 933 NTSTATUS pdb_set_aliasinfo(const DOM_SID *sid, struct acct_info *info)
 934 {
 935         struct pdb_methods *pdb = pdb_get_methods();
 936         return pdb->set_aliasinfo(pdb, sid, info);
 937 }
 938
 939 NTSTATUS pdb_add_aliasmem(const DOM_SID *alias, const DOM_SID *member)
 940 {
 941         struct pdb_methods *pdb = pdb_get_methods();
 942         return pdb->add_aliasmem(pdb, alias, member);
 943 }
 944
 945 NTSTATUS pdb_del_aliasmem(const DOM_SID *alias, const DOM_SID *member)
 946 {
 947         struct pdb_methods *pdb = pdb_get_methods();
 948         return pdb->del_aliasmem(pdb, alias, member);
 949 }
 950
 951 NTSTATUS pdb_enum_aliasmem(const DOM_SID *alias,
 952                            DOM_SID **pp_members, size_t *p_num_members)
 953 {
 954         struct pdb_methods *pdb = pdb_get_methods();
 955         return pdb->enum_aliasmem(pdb, alias, pp_members, p_num_members);
 956 }
 957
 958 NTSTATUS pdb_enum_alias_memberships(TALLOC_CTX *mem_ctx,
 959                                     const DOM_SID *domain_sid,
 960                                     const DOM_SID *members, size_t num_members,
 961                                     uint32 **pp_alias_rids,
 962                                     size_t *p_num_alias_rids)
 963 {
 964         struct pdb_methods *pdb = pdb_get_methods();
 965         return pdb->enum_alias_memberships(pdb, mem_ctx,
 966                                                        domain_sid,
 967                                                        members, num_members,
 968                                                        pp_alias_rids,
 969                                                        p_num_alias_rids);
 970 }
 971
 972 NTSTATUS pdb_lookup_rids(const DOM_SID *domain_sid,
 973                          int num_rids,
 974                          uint32 *rids,
 975                          const char **names,
 976                          enum lsa_SidType *attrs)
 977 {
 978         struct pdb_methods *pdb = pdb_get_methods();
 979         return pdb->lookup_rids(pdb, domain_sid, num_rids, rids, names, attrs);
 980 }
 981
 982 /*
 983  * NOTE: pdb_lookup_names is currently (2007-01-12) not used anywhere
 984  *       in the samba code.
 985  *       Unlike _lsa_lookup_sids and _samr_lookup_rids, which eventually
 986  *       also ask pdb_lookup_rids, thus looking up a bunch of rids at a time,
 987  *       the pdb_ calls _lsa_lookup_names and _samr_lookup_names come
 988  *       down to are pdb_getsampwnam and pdb_getgrnam instead of
 989  *       pdb_lookup_names.
 990  *       But in principle, it the call belongs to the API and might get
 991  *       used in this context some day.
 992  */
 993 #if 0
 994 NTSTATUS pdb_lookup_names(const DOM_SID *domain_sid,
 995                           int num_names,
 996                           const char **names,
 997                           uint32 *rids,
 998                           enum lsa_SidType *attrs)
 999 {
1000         struct pdb_methods *pdb = pdb_get_methods();
1001         return pdb->lookup_names(pdb, domain_sid, num_names, names, rids, attrs);
1002 }
1003 #endif
1004
1005 bool pdb_get_account_policy(int policy_index, uint32 *value)
1006 {
1007         struct pdb_methods *pdb = pdb_get_methods();
1008         NTSTATUS status;
1009
1010         become_root();
1011         status = pdb->get_account_policy(pdb, policy_index, value);
1012         unbecome_root();
1013
1014         return NT_STATUS_IS_OK(status);
1015 }
1016
1017 bool pdb_set_account_policy(int policy_index, uint32 value)
1018 {
1019         struct pdb_methods *pdb = pdb_get_methods();
1020         NTSTATUS status;
1021
1022         become_root();
1023         status = pdb->set_account_policy(pdb, policy_index, value);
1024         unbecome_root();
1025
1026         return NT_STATUS_IS_OK(status);
1027 }
1028
1029 bool pdb_get_seq_num(time_t *seq_num)
1030 {
1031         struct pdb_methods *pdb = pdb_get_methods();
1032         return NT_STATUS_IS_OK(pdb->get_seq_num(pdb, seq_num));
1033 }
1034
1035 bool pdb_uid_to_rid(uid_t uid, uint32 *rid)
1036 {
1037         struct pdb_methods *pdb = pdb_get_methods();
1038         return pdb->uid_to_rid(pdb, uid, rid);
1039 }
1040
1041 bool pdb_uid_to_sid(uid_t uid, DOM_SID *sid)
1042 {
1043         struct pdb_methods *pdb = pdb_get_methods();
1044         return pdb->uid_to_sid(pdb, uid, sid);
1045 }
1046
1047 bool pdb_gid_to_sid(gid_t gid, DOM_SID *sid)
1048 {
1049         struct pdb_methods *pdb = pdb_get_methods();
1050         return pdb->gid_to_sid(pdb, gid, sid);
1051 }
1052
1053 bool pdb_sid_to_id(const DOM_SID *sid, union unid_t *id,
1054                    enum lsa_SidType *type)
1055 {
1056         struct pdb_methods *pdb = pdb_get_methods();
1057         return pdb->sid_to_id(pdb, sid, id, type);
1058 }
1059
1060 bool pdb_rid_algorithm(void)
1061 {
1062         struct pdb_methods *pdb = pdb_get_methods();
1063         return pdb->rid_algorithm(pdb);
1064 }
1065
1066 /********************************************************************
1067  Allocate a new RID from the passdb backend.  Verify that it is free
1068  by calling lookup_global_sam_rid() to verify that the RID is not
1069  in use.  This handles servers that have existing users or groups
1070  with add RIDs (assigned from previous algorithmic mappings)
1071 ********************************************************************/
1072
1073 bool pdb_new_rid(uint32 *rid)
1074 {
1075         struct pdb_methods *pdb = pdb_get_methods();
1076         const char *name = NULL;
1077         enum lsa_SidType type;
1078         uint32 allocated_rid = 0;
1079         int i;
1080         TALLOC_CTX *ctx;
1081
1082         if (pdb_rid_algorithm()) {
1083                 DEBUG(0, ("Trying to allocate a RID when algorithmic RIDs "
1084                           "are active\n"));
1085                 return False;
1086         }
1087
1088         if (algorithmic_rid_base() != BASE_RID) {
1089                 DEBUG(0, ("'algorithmic rid base' is set but a passdb backend "
1090                           "without algorithmic RIDs is chosen.\n"));
1091                 DEBUGADD(0, ("Please map all used groups using 'net groupmap "
1092                              "add', set the maximum used RID using\n"));
1093                 DEBUGADD(0, ("'net setmaxrid' and remove the parameter\n"));
1094                 return False;
1095         }
1096
1097         if ( (ctx = talloc_init("pdb_new_rid")) == NULL ) {
1098                 DEBUG(0,("pdb_new_rid: Talloc initialization failure\n"));
1099                 return False;
1100         }
1101
1102         /* Attempt to get an unused RID (max tires is 250...yes that it is
1103            and arbitrary number I pulkled out of my head).   -- jerry */
1104
1105         for ( i=0; allocated_rid==0 && i<250; i++ ) {
1106                 /* get a new RID */
1107
1108                 if ( !pdb->new_rid(pdb, &allocated_rid) ) {
1109                         return False;
1110                 }
1111
1112                 /* validate that the RID is not in use */
1113
1114                 if ( lookup_global_sam_rid( ctx, allocated_rid, &name, &type, NULL ) ) {
1115                         allocated_rid = 0;
1116                 }
1117         }
1118
1119         TALLOC_FREE( ctx );
1120
1121         if ( allocated_rid == 0 ) {
1122                 DEBUG(0,("pdb_new_rid: Failed to find unused RID\n"));
1123                 return False;
1124         }
1125
1126         *rid = allocated_rid;
1127
1128         return True;
1129 }
1130
1131 /***************************************************************
1132   Initialize the static context (at smbd startup etc).
1133
1134   If uninitialised, context will auto-init on first use.
1135  ***************************************************************/
1136
1137 bool initialize_password_db(bool reload, struct event_context *event_ctx)
1138 {
1139         pdb_event_ctx = event_ctx;
1140         return (pdb_get_methods_reload(reload) != NULL);
1141 }
1142
1143
1144 /***************************************************************************
1145   Default implementations of some functions.
1146  ****************************************************************************/
1147
1148 static NTSTATUS pdb_default_getsampwnam (struct pdb_methods *methods, struct samu *user, const char *sname)
1149 {
1150         return NT_STATUS_NO_SUCH_USER;
1151 }
1152
1153 static NTSTATUS pdb_default_getsampwsid(struct pdb_methods *my_methods, struct samu * user, const DOM_SID *sid)
1154 {
1155         return NT_STATUS_NO_SUCH_USER;
1156 }
1157
1158 static NTSTATUS pdb_default_add_sam_account (struct pdb_methods *methods, struct samu *newpwd)
1159 {
1160         return NT_STATUS_NOT_IMPLEMENTED;
1161 }
1162
1163 static NTSTATUS pdb_default_update_sam_account (struct pdb_methods *methods, struct samu *newpwd)
1164 {
1165         return NT_STATUS_NOT_IMPLEMENTED;
1166 }
1167
1168 static NTSTATUS pdb_default_delete_sam_account (struct pdb_methods *methods, struct samu *pwd)
1169 {
1170         return NT_STATUS_NOT_IMPLEMENTED;
1171 }
1172
1173 static NTSTATUS pdb_default_rename_sam_account (struct pdb_methods *methods, struct samu *pwd, const char *newname)
1174 {
1175         return NT_STATUS_NOT_IMPLEMENTED;
1176 }
1177
1178 static NTSTATUS pdb_default_update_login_attempts (struct pdb_methods *methods, struct samu *newpwd, bool success)
1179 {
1180         return NT_STATUS_NOT_IMPLEMENTED;
1181 }
1182
1183 static NTSTATUS pdb_default_setsampwent(struct pdb_methods *methods, bool update, uint32 acb_mask)
1184 {
1185         return NT_STATUS_NOT_IMPLEMENTED;
1186 }
1187
1188 static NTSTATUS pdb_default_getsampwent(struct pdb_methods *methods, struct samu *user)
1189 {
1190         return NT_STATUS_NOT_IMPLEMENTED;
1191 }
1192
1193 static void pdb_default_endsampwent(struct pdb_methods *methods)
1194 {
1195         return; /* NT_STATUS_NOT_IMPLEMENTED; */
1196 }
1197
1198 static NTSTATUS pdb_default_get_account_policy(struct pdb_methods *methods, int policy_index, uint32 *value)
1199 {
1200         return account_policy_get(policy_index, value) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1201 }
1202
1203 static NTSTATUS pdb_default_set_account_policy(struct pdb_methods *methods, int policy_index, uint32 value)
1204 {
1205         return account_policy_set(policy_index, value) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1206 }
1207
1208 static NTSTATUS pdb_default_get_seq_num(struct pdb_methods *methods, time_t *seq_num)
1209 {
1210         *seq_num = time(NULL);
1211         return NT_STATUS_OK;
1212 }
1213
1214 static bool pdb_default_uid_to_sid(struct pdb_methods *methods, uid_t uid,
1215                                    DOM_SID *sid)
1216 {
1217         struct samu *sampw = NULL;
1218         struct passwd *unix_pw;
1219         bool ret;
1220
1221         unix_pw = sys_getpwuid( uid );
1222
1223         if ( !unix_pw ) {
1224                 DEBUG(4,("pdb_default_uid_to_rid: host has no idea of uid "
1225                          "%lu\n", (unsigned long)uid));
1226                 return False;
1227         }
1228
1229         if ( !(sampw = samu_new( NULL )) ) {
1230                 DEBUG(0,("pdb_default_uid_to_rid: samu_new() failed!\n"));
1231                 return False;
1232         }
1233
1234         become_root();
1235         ret = NT_STATUS_IS_OK(
1236                 methods->getsampwnam(methods, sampw, unix_pw->pw_name ));
1237         unbecome_root();
1238
1239         if (!ret) {
1240                 DEBUG(5, ("pdb_default_uid_to_rid: Did not find user "
1241                           "%s (%d)\n", unix_pw->pw_name, uid));
1242                 TALLOC_FREE(sampw);
1243                 return False;
1244         }
1245
1246         sid_copy(sid, pdb_get_user_sid(sampw));
1247
1248         TALLOC_FREE(sampw);
1249
1250         return True;
1251 }
1252
1253 static bool pdb_default_uid_to_rid(struct pdb_methods *methods, uid_t uid,
1254                                    uint32 *rid)
1255 {
1256         DOM_SID sid;
1257         bool ret;
1258
1259         ret = pdb_default_uid_to_sid(methods, uid, &sid);
1260         if (!ret) {
1261                 return ret;
1262         }
1263
1264         ret = sid_peek_check_rid(get_global_sam_sid(), &sid, rid);
1265
1266         if (!ret) {
1267                 DEBUG(1, ("Could not peek rid out of sid %s\n",
1268                           sid_string_static(&sid)));
1269         }
1270
1271         return ret;
1272 }
1273
1274 static bool pdb_default_gid_to_sid(struct pdb_methods *methods, gid_t gid,
1275                                    DOM_SID *sid)
1276 {
1277         GROUP_MAP map;
1278
1279         if (!NT_STATUS_IS_OK(methods->getgrgid(methods, &map, gid))) {
1280                 return False;
1281         }
1282
1283         sid_copy(sid, &map.sid);
1284         return True;
1285 }
1286
1287 static bool pdb_default_sid_to_id(struct pdb_methods *methods,
1288                                   const DOM_SID *sid,
1289                                   union unid_t *id, enum lsa_SidType *type)
1290 {
1291         TALLOC_CTX *mem_ctx;
1292         bool ret = False;
1293         const char *name;
1294         uint32 rid;
1295
1296         mem_ctx = talloc_new(NULL);
1297
1298         if (mem_ctx == NULL) {
1299                 DEBUG(0, ("talloc_new failed\n"));
1300                 return False;
1301         }
1302
1303         if (sid_peek_check_rid(get_global_sam_sid(), sid, &rid)) {
1304                 /* Here we might have users as well as groups and aliases */
1305                 ret = lookup_global_sam_rid(mem_ctx, rid, &name, type, id);
1306                 goto done;
1307         }
1308
1309         /* check for "Unix User" */
1310
1311         if ( sid_peek_check_rid(&global_sid_Unix_Users, sid, &rid) ) {
1312                 id->uid = rid;
1313                 *type = SID_NAME_USER;
1314                 ret = True;
1315                 goto done;
1316         }
1317
1318         /* check for "Unix Group" */
1319
1320         if ( sid_peek_check_rid(&global_sid_Unix_Groups, sid, &rid) ) {
1321                 id->gid = rid;
1322                 *type = SID_NAME_ALIAS;
1323                 ret = True;
1324                 goto done;
1325         }
1326
1327         /* BUILTIN */
1328
1329         if (sid_check_is_in_builtin(sid) ||
1330             sid_check_is_in_wellknown_domain(sid)) {
1331                 /* Here we only have aliases */
1332                 GROUP_MAP map;
1333                 if (!NT_STATUS_IS_OK(methods->getgrsid(methods, &map, *sid))) {
1334                         DEBUG(10, ("Could not find map for sid %s\n",
1335                                    sid_string_static(sid)));
1336                         goto done;
1337                 }
1338                 if ((map.sid_name_use != SID_NAME_ALIAS) &&
1339                     (map.sid_name_use != SID_NAME_WKN_GRP)) {
1340                         DEBUG(10, ("Map for sid %s is a %s, expected an "
1341                                    "alias\n", sid_string_static(sid),
1342                                    sid_type_lookup(map.sid_name_use)));
1343                         goto done;
1344                 }
1345
1346                 id->gid = map.gid;
1347                 *type = SID_NAME_ALIAS;
1348                 ret = True;
1349                 goto done;
1350         }
1351
1352         DEBUG(5, ("Sid %s is neither ours, a Unix SID, nor builtin\n",
1353                   sid_string_static(sid)));
1354
1355  done:
1356
1357         TALLOC_FREE(mem_ctx);
1358         return ret;
1359 }
1360
1361 static bool add_uid_to_array_unique(TALLOC_CTX *mem_ctx,
1362                                     uid_t uid, uid_t **pp_uids, size_t *p_num)
1363 {
1364         size_t i;
1365
1366         for (i=0; i<*p_num; i++) {
1367                 if ((*pp_uids)[i] == uid)
1368                         return True;
1369         }
1370
1371         *pp_uids = TALLOC_REALLOC_ARRAY(mem_ctx, *pp_uids, uid_t, *p_num+1);
1372
1373         if (*pp_uids == NULL)
1374                 return False;
1375
1376         (*pp_uids)[*p_num] = uid;
1377         *p_num += 1;
1378         return True;
1379 }
1380
1381 static bool get_memberuids(TALLOC_CTX *mem_ctx, gid_t gid, uid_t **pp_uids, size_t *p_num)
1382 {
1383         struct group *grp;
1384         char **gr;
1385         struct passwd *pwd;
1386         bool winbind_env;
1387         bool ret = False;
1388
1389         *pp_uids = NULL;
1390         *p_num = 0;
1391
1392         /* We only look at our own sam, so don't care about imported stuff */
1393         winbind_env = winbind_env_set();
1394         winbind_off();
1395
1396         if ((grp = getgrgid(gid)) == NULL) {
1397                 /* allow winbindd lookups, but only if they weren't already disabled */
1398                 goto done;
1399         }
1400
1401         /* Primary group members */
1402         setpwent();
1403         while ((pwd = getpwent()) != NULL) {
1404                 if (pwd->pw_gid == gid) {
1405                         if (!add_uid_to_array_unique(mem_ctx, pwd->pw_uid,
1406                                                 pp_uids, p_num)) {
1407                                 goto done;
1408                         }
1409                 }
1410         }
1411         endpwent();
1412
1413         /* Secondary group members */
1414         for (gr = grp->gr_mem; (*gr != NULL) && ((*gr)[0] != '\0'); gr += 1) {
1415                 struct passwd *pw = getpwnam(*gr);
1416
1417                 if (pw == NULL)
1418                         continue;
1419                 if (!add_uid_to_array_unique(mem_ctx, pw->pw_uid, pp_uids, p_num)) {
1420                         goto done;
1421                 }
1422         }
1423
1424         ret = True;
1425
1426   done:
1427
1428         /* allow winbindd lookups, but only if they weren't already disabled */
1429         if (!winbind_env) {
1430                 winbind_on();
1431         }
1432
1433         return ret;
1434 }
1435
1436 static NTSTATUS pdb_default_enum_group_members(struct pdb_methods *methods,
1437                                                TALLOC_CTX *mem_ctx,
1438                                                const DOM_SID *group,
1439                                                uint32 **pp_member_rids,
1440                                                size_t *p_num_members)
1441 {
1442         gid_t gid;
1443         uid_t *uids;
1444         size_t i, num_uids;
1445
1446         *pp_member_rids = NULL;
1447         *p_num_members = 0;
1448
1449         if (!sid_to_gid(group, &gid))
1450                 return NT_STATUS_NO_SUCH_GROUP;
1451
1452         if(!get_memberuids(mem_ctx, gid, &uids, &num_uids))
1453                 return NT_STATUS_NO_SUCH_GROUP;
1454
1455         if (num_uids == 0)
1456                 return NT_STATUS_OK;
1457
1458         *pp_member_rids = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_uids);
1459
1460         for (i=0; i<num_uids; i++) {
1461                 DOM_SID sid;
1462
1463                 uid_to_sid(&sid, uids[i]);
1464
1465                 if (!sid_check_is_in_our_domain(&sid)) {
1466                         DEBUG(5, ("Inconsistent SAM -- group member uid not "
1467                                   "in our domain\n"));
1468                         continue;
1469                 }
1470
1471                 sid_peek_rid(&sid, &(*pp_member_rids)[*p_num_members]);
1472                 *p_num_members += 1;
1473         }
1474
1475         return NT_STATUS_OK;
1476 }
1477
1478 static NTSTATUS pdb_default_enum_group_memberships(struct pdb_methods *methods,
1479                                                    TALLOC_CTX *mem_ctx,
1480                                                    struct samu *user,
1481                                                    DOM_SID **pp_sids,
1482                                                    gid_t **pp_gids,
1483                                                    size_t *p_num_groups)
1484 {
1485         size_t i;
1486         gid_t gid;
1487         struct passwd *pw;
1488         const char *username = pdb_get_username(user);
1489
1490
1491         /* Ignore the primary group SID.  Honor the real Unix primary group.
1492            The primary group SID is only of real use to Windows clients */
1493
1494         if ( !(pw = getpwnam_alloc(mem_ctx, username)) ) {
1495                 return NT_STATUS_NO_SUCH_USER;
1496         }
1497
1498         gid = pw->pw_gid;
1499
1500         TALLOC_FREE( pw );
1501
1502         if (!getgroups_unix_user(mem_ctx, username, gid, pp_gids, p_num_groups)) {
1503                 return NT_STATUS_NO_SUCH_USER;
1504         }
1505
1506         if (*p_num_groups == 0) {
1507                 smb_panic("primary group missing");
1508         }
1509
1510         *pp_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, *p_num_groups);
1511
1512         if (*pp_sids == NULL) {
1513                 TALLOC_FREE(*pp_gids);
1514                 return NT_STATUS_NO_MEMORY;
1515         }
1516
1517         for (i=0; i<*p_num_groups; i++) {
1518                 gid_to_sid(&(*pp_sids)[i], (*pp_gids)[i]);
1519         }
1520
1521         return NT_STATUS_OK;
1522 }
1523
1524 /*******************************************************************
1525  Look up a rid in the SAM we're responsible for (i.e. passdb)
1526  ********************************************************************/
1527
1528 static bool lookup_global_sam_rid(TALLOC_CTX *mem_ctx, uint32 rid,
1529                                   const char **name,
1530                                   enum lsa_SidType *psid_name_use,
1531                                   union unid_t *unix_id)
1532 {
1533         struct samu *sam_account = NULL;
1534         GROUP_MAP map;
1535         bool ret;
1536         DOM_SID sid;
1537
1538         *psid_name_use = SID_NAME_UNKNOWN;
1539
1540         DEBUG(5,("lookup_global_sam_rid: looking up RID %u.\n",
1541                  (unsigned int)rid));
1542
1543         sid_copy(&sid, get_global_sam_sid());
1544         sid_append_rid(&sid, rid);
1545
1546         /* see if the passdb can help us with the name of the user */
1547
1548         if ( !(sam_account = samu_new( NULL )) ) {
1549                 return False;
1550         }
1551
1552         /* BEING ROOT BLLOCK */
1553         become_root();
1554         if (pdb_getsampwsid(sam_account, &sid)) {
1555                 struct passwd *pw;
1556
1557                 unbecome_root();                /* -----> EXIT BECOME_ROOT() */
1558                 *name = talloc_strdup(mem_ctx, pdb_get_username(sam_account));
1559                 if (!*name) {
1560                         TALLOC_FREE(sam_account);
1561                         return False;
1562                 }
1563
1564                 *psid_name_use = SID_NAME_USER;
1565
1566                 TALLOC_FREE(sam_account);
1567
1568                 if (unix_id == NULL) {
1569                         return True;
1570                 }
1571
1572                 pw = Get_Pwnam(*name);
1573                 if (pw == NULL) {
1574                         return False;
1575                 }
1576                 unix_id->uid = pw->pw_uid;
1577                 return True;
1578         }
1579         TALLOC_FREE(sam_account);
1580
1581         ret = pdb_getgrsid(&map, sid);
1582         unbecome_root();
1583         /* END BECOME_ROOT BLOCK */
1584
1585         /* do not resolve SIDs to a name unless there is a valid
1586            gid associated with it */
1587
1588         if ( ret && (map.gid != (gid_t)-1) ) {
1589                 *name = talloc_strdup(mem_ctx, map.nt_name);
1590                 *psid_name_use = map.sid_name_use;
1591
1592                 if ( unix_id ) {
1593                         unix_id->gid = map.gid;
1594                 }
1595
1596                 return True;
1597         }
1598
1599         /* Windows will always map RID 513 to something.  On a non-domain
1600            controller, this gets mapped to SERVER\None. */
1601
1602         if ( unix_id ) {
1603                 DEBUG(5, ("Can't find a unix id for an unmapped group\n"));
1604                 return False;
1605         }
1606
1607         if ( rid == DOMAIN_GROUP_RID_USERS ) {
1608                 *name = talloc_strdup(mem_ctx, "None" );
1609                 *psid_name_use = SID_NAME_DOM_GRP;
1610
1611                 return True;
1612         }
1613
1614         return False;
1615 }
1616
1617 static NTSTATUS pdb_default_lookup_rids(struct pdb_methods *methods,
1618                                         const DOM_SID *domain_sid,
1619                                         int num_rids,
1620                                         uint32 *rids,
1621                                         const char **names,
1622                                         enum lsa_SidType *attrs)
1623 {
1624         int i;
1625         NTSTATUS result;
1626         bool have_mapped = False;
1627         bool have_unmapped = False;
1628
1629         if (sid_check_is_builtin(domain_sid)) {
1630
1631                 for (i=0; i<num_rids; i++) {
1632                         const char *name;
1633
1634                         if (lookup_builtin_rid(names, rids[i], &name)) {
1635                                 attrs[i] = SID_NAME_ALIAS;
1636                                 names[i] = name;
1637                                 DEBUG(5,("lookup_rids: %s:%d\n",
1638                                          names[i], attrs[i]));
1639                                 have_mapped = True;
1640                         } else {
1641                                 have_unmapped = True;
1642                                 attrs[i] = SID_NAME_UNKNOWN;
1643                         }
1644                 }
1645                 goto done;
1646         }
1647
1648         /* Should not happen, but better check once too many */
1649         if (!sid_check_is_domain(domain_sid)) {
1650                 return NT_STATUS_INVALID_HANDLE;
1651         }
1652
1653         for (i = 0; i < num_rids; i++) {
1654                 const char *name;
1655
1656                 if (lookup_global_sam_rid(names, rids[i], &name, &attrs[i],
1657                                           NULL)) {
1658                         if (name == NULL) {
1659                                 return NT_STATUS_NO_MEMORY;
1660                         }
1661                         names[i] = name;
1662                         DEBUG(5,("lookup_rids: %s:%d\n", names[i], attrs[i]));
1663                         have_mapped = True;
1664                 } else {
1665                         have_unmapped = True;
1666                         attrs[i] = SID_NAME_UNKNOWN;
1667                 }
1668         }
1669
1670  done:
1671
1672         result = NT_STATUS_NONE_MAPPED;
1673
1674         if (have_mapped)
1675                 result = have_unmapped ? STATUS_SOME_UNMAPPED : NT_STATUS_OK;
1676
1677         return result;
1678 }
1679
1680 #if 0
1681 static NTSTATUS pdb_default_lookup_names(struct pdb_methods *methods,
1682                                          const DOM_SID *domain_sid,
1683                                          int num_names,
1684                                          const char **names,
1685                                          uint32 *rids,
1686                                          enum lsa_SidType *attrs)
1687 {
1688         int i;
1689         NTSTATUS result;
1690         bool have_mapped = False;
1691         bool have_unmapped = False;
1692
1693         if (sid_check_is_builtin(domain_sid)) {
1694
1695                 for (i=0; i<num_names; i++) {
1696                         uint32 rid;
1697
1698                         if (lookup_builtin_name(names[i], &rid)) {
1699                                 attrs[i] = SID_NAME_ALIAS;
1700                                 rids[i] = rid;
1701                                 DEBUG(5,("lookup_rids: %s:%d\n",
1702                                          names[i], attrs[i]));
1703                                 have_mapped = True;
1704                         } else {
1705                                 have_unmapped = True;
1706                                 attrs[i] = SID_NAME_UNKNOWN;
1707                         }
1708                 }
1709                 goto done;
1710         }
1711
1712         /* Should not happen, but better check once too many */
1713         if (!sid_check_is_domain(domain_sid)) {
1714                 return NT_STATUS_INVALID_HANDLE;
1715         }
1716
1717         for (i = 0; i < num_names; i++) {
1718                 if (lookup_global_sam_name(names[i], 0, &rids[i], &attrs[i])) {
1719                         DEBUG(5,("lookup_names: %s-> %d:%d\n", names[i],
1720                                  rids[i], attrs[i]));
1721                         have_mapped = True;
1722                 } else {
1723                         have_unmapped = True;
1724                         attrs[i] = SID_NAME_UNKNOWN;
1725                 }
1726         }
1727
1728  done:
1729
1730         result = NT_STATUS_NONE_MAPPED;
1731
1732         if (have_mapped)
1733                 result = have_unmapped ? STATUS_SOME_UNMAPPED : NT_STATUS_OK;
1734
1735         return result;
1736 }
1737 #endif
1738
1739 static struct pdb_search *pdb_search_init(enum pdb_search_type type)
1740 {
1741         TALLOC_CTX *mem_ctx;
1742         struct pdb_search *result;
1743
1744         mem_ctx = talloc_init("pdb_search");
1745         if (mem_ctx == NULL) {
1746                 DEBUG(0, ("talloc_init failed\n"));
1747                 return NULL;
1748         }
1749
1750         result = TALLOC_P(mem_ctx, struct pdb_search);
1751         if (result == NULL) {
1752                 DEBUG(0, ("talloc failed\n"));
1753                 return NULL;
1754         }
1755
1756         result->mem_ctx = mem_ctx;
1757         result->type = type;
1758         result->cache = NULL;
1759         result->num_entries = 0;
1760         result->cache_size = 0;
1761         result->search_ended = False;
1762
1763         /* Segfault appropriately if not initialized */
1764         result->next_entry = NULL;
1765         result->search_end = NULL;
1766
1767         return result;
1768 }
1769
1770 static void fill_displayentry(TALLOC_CTX *mem_ctx, uint32 rid,
1771                               uint16 acct_flags,
1772                               const char *account_name,
1773                               const char *fullname,
1774                               const char *description,
1775                               struct samr_displayentry *entry)
1776 {
1777         entry->rid = rid;
1778         entry->acct_flags = acct_flags;
1779
1780         if (account_name != NULL)
1781                 entry->account_name = talloc_strdup(mem_ctx, account_name);
1782         else
1783                 entry->account_name = "";
1784
1785         if (fullname != NULL)
1786                 entry->fullname = talloc_strdup(mem_ctx, fullname);
1787         else
1788                 entry->fullname = "";
1789
1790         if (description != NULL)
1791                 entry->description = talloc_strdup(mem_ctx, description);
1792         else
1793                 entry->description = "";
1794 }
1795
1796 static bool user_search_in_progress = False;
1797 struct user_search {
1798         uint16 acct_flags;
1799 };
1800
1801 static bool next_entry_users(struct pdb_search *s,
1802                              struct samr_displayentry *entry)
1803 {
1804         struct user_search *state = (struct user_search *)s->private_data;
1805         struct samu *user = NULL;
1806
1807  next:
1808         if ( !(user = samu_new( NULL )) ) {
1809                 DEBUG(0, ("next_entry_users: samu_new() failed!\n"));
1810                 return False;
1811         }
1812
1813         if (!pdb_getsampwent(user)) {
1814                 TALLOC_FREE(user);
1815                 return False;
1816         }
1817
1818         if ((state->acct_flags != 0) &&
1819             ((pdb_get_acct_ctrl(user) & state->acct_flags) == 0)) {
1820                 TALLOC_FREE(user);
1821                 goto next;
1822         }
1823
1824         fill_displayentry(s->mem_ctx, pdb_get_user_rid(user),
1825                           pdb_get_acct_ctrl(user), pdb_get_username(user),
1826                           pdb_get_fullname(user), pdb_get_acct_desc(user),
1827                           entry);
1828
1829         TALLOC_FREE(user);
1830         return True;
1831 }
1832
1833 static void search_end_users(struct pdb_search *search)
1834 {
1835         pdb_endsampwent();
1836         user_search_in_progress = False;
1837 }
1838
1839 static bool pdb_default_search_users(struct pdb_methods *methods,
1840                                      struct pdb_search *search,
1841                                      uint32 acct_flags)
1842 {
1843         struct user_search *state;
1844
1845         if (user_search_in_progress) {
1846                 DEBUG(1, ("user search in progress\n"));
1847                 return False;
1848         }
1849
1850         if (!pdb_setsampwent(False, acct_flags)) {
1851                 DEBUG(5, ("Could not start search\n"));
1852                 return False;
1853         }
1854
1855         user_search_in_progress = True;
1856
1857         state = TALLOC_P(search->mem_ctx, struct user_search);
1858         if (state == NULL) {
1859                 DEBUG(0, ("talloc failed\n"));
1860                 return False;
1861         }
1862
1863         state->acct_flags = acct_flags;
1864
1865         search->private_data = state;
1866         search->next_entry = next_entry_users;
1867         search->search_end = search_end_users;
1868         return True;
1869 }
1870
1871 struct group_search {
1872         GROUP_MAP *groups;
1873         size_t num_groups, current_group;
1874 };
1875
1876 static bool next_entry_groups(struct pdb_search *s,
1877                               struct samr_displayentry *entry)
1878 {
1879         struct group_search *state = (struct group_search *)s->private_data;
1880         uint32 rid;
1881         GROUP_MAP *map = &state->groups[state->current_group];
1882
1883         if (state->current_group == state->num_groups)
1884                 return False;
1885
1886         sid_peek_rid(&map->sid, &rid);
1887
1888         fill_displayentry(s->mem_ctx, rid, 0, map->nt_name, NULL, map->comment,
1889                           entry);
1890
1891         state->current_group += 1;
1892         return True;
1893 }
1894
1895 static void search_end_groups(struct pdb_search *search)
1896 {
1897         struct group_search *state =
1898                 (struct group_search *)search->private_data;
1899         SAFE_FREE(state->groups);
1900 }
1901
1902 static bool pdb_search_grouptype(struct pdb_search *search,
1903                                  const DOM_SID *sid, enum lsa_SidType type)
1904 {
1905         struct group_search *state;
1906
1907         state = TALLOC_P(search->mem_ctx, struct group_search);
1908         if (state == NULL) {
1909                 DEBUG(0, ("talloc failed\n"));
1910                 return False;
1911         }
1912
1913         if (!pdb_enum_group_mapping(sid, type, &state->groups, &state->num_groups,
1914                                     True)) {
1915                 DEBUG(0, ("Could not enum groups\n"));
1916                 return False;
1917         }
1918
1919         state->current_group = 0;
1920         search->private_data = state;
1921         search->next_entry = next_entry_groups;
1922         search->search_end = search_end_groups;
1923         return True;
1924 }
1925
1926 static bool pdb_default_search_groups(struct pdb_methods *methods,
1927                                       struct pdb_search *search)
1928 {
1929         return pdb_search_grouptype(search, get_global_sam_sid(), SID_NAME_DOM_GRP);
1930 }
1931
1932 static bool pdb_default_search_aliases(struct pdb_methods *methods,
1933                                        struct pdb_search *search,
1934                                        const DOM_SID *sid)
1935 {
1936
1937         return pdb_search_grouptype(search, sid, SID_NAME_ALIAS);
1938 }
1939
1940 static struct samr_displayentry *pdb_search_getentry(struct pdb_search *search,
1941                                                      uint32 idx)
1942 {
1943         if (idx < search->num_entries)
1944                 return &search->cache[idx];
1945
1946         if (search->search_ended)
1947                 return NULL;
1948
1949         while (idx >= search->num_entries) {
1950                 struct samr_displayentry entry;
1951
1952                 if (!search->next_entry(search, &entry)) {
1953                         search->search_end(search);
1954                         search->search_ended = True;
1955                         break;
1956                 }
1957
1958                 ADD_TO_LARGE_ARRAY(search->mem_ctx, struct samr_displayentry,
1959                                    entry, &search->cache, &search->num_entries,
1960                                    &search->cache_size);
1961         }
1962
1963         return (search->num_entries > idx) ? &search->cache[idx] : NULL;
1964 }
1965
1966 struct pdb_search *pdb_search_users(uint32 acct_flags)
1967 {
1968         struct pdb_methods *pdb = pdb_get_methods();
1969         struct pdb_search *result;
1970
1971         result = pdb_search_init(PDB_USER_SEARCH);
1972         if (result == NULL) {
1973                 return NULL;
1974         }
1975
1976         if (!pdb->search_users(pdb, result, acct_flags)) {
1977                 talloc_destroy(result->mem_ctx);
1978                 return NULL;
1979         }
1980         return result;
1981 }
1982
1983 struct pdb_search *pdb_search_groups(void)
1984 {
1985         struct pdb_methods *pdb = pdb_get_methods();
1986         struct pdb_search *result;
1987
1988         result = pdb_search_init(PDB_GROUP_SEARCH);
1989         if (result == NULL) {
1990                  return NULL;
1991         }
1992
1993         if (!pdb->search_groups(pdb, result)) {
1994                 talloc_destroy(result->mem_ctx);
1995                 return NULL;
1996         }
1997         return result;
1998 }
1999
2000 struct pdb_search *pdb_search_aliases(const DOM_SID *sid)
2001 {
2002         struct pdb_methods *pdb = pdb_get_methods();
2003         struct pdb_search *result;
2004
2005         if (pdb == NULL) return NULL;
2006
2007         result = pdb_search_init(PDB_ALIAS_SEARCH);
2008         if (result == NULL) return NULL;
2009
2010         if (!pdb->search_aliases(pdb, result, sid)) {
2011                 talloc_destroy(result->mem_ctx);
2012                 return NULL;
2013         }
2014         return result;
2015 }
2016
2017 uint32 pdb_search_entries(struct pdb_search *search,
2018                           uint32 start_idx, uint32 max_entries,
2019                           struct samr_displayentry **result)
2020 {
2021         struct samr_displayentry *end_entry;
2022         uint32 end_idx = start_idx+max_entries-1;
2023
2024         /* The first entry needs to be searched after the last. Otherwise the
2025          * first entry might have moved due to a realloc during the search for
2026          * the last entry. */
2027
2028         end_entry = pdb_search_getentry(search, end_idx);
2029         *result = pdb_search_getentry(search, start_idx);
2030
2031         if (end_entry != NULL)
2032                 return max_entries;
2033
2034         if (start_idx >= search->num_entries)
2035                 return 0;
2036
2037         return search->num_entries - start_idx;
2038 }
2039
2040 void pdb_search_destroy(struct pdb_search *search)
2041 {
2042         if (search == NULL)
2043                 return;
2044
2045         if (!search->search_ended)
2046                 search->search_end(search);
2047
2048         talloc_destroy(search->mem_ctx);
2049 }
2050
2051 /*******************************************************************
2052  trustodm methods
2053  *******************************************************************/
2054
2055 bool pdb_get_trusteddom_pw(const char *domain, char** pwd, DOM_SID *sid,
2056                            time_t *pass_last_set_time)
2057 {
2058         struct pdb_methods *pdb = pdb_get_methods();
2059         return pdb->get_trusteddom_pw(pdb, domain, pwd, sid,
2060                         pass_last_set_time);
2061 }
2062
2063 bool pdb_set_trusteddom_pw(const char* domain, const char* pwd,
2064                            const DOM_SID *sid)
2065 {
2066         struct pdb_methods *pdb = pdb_get_methods();
2067         return pdb->set_trusteddom_pw(pdb, domain, pwd, sid);
2068 }
2069
2070 bool pdb_del_trusteddom_pw(const char *domain)
2071 {
2072         struct pdb_methods *pdb = pdb_get_methods();
2073         return pdb->del_trusteddom_pw(pdb, domain);
2074 }
2075
2076 NTSTATUS pdb_enum_trusteddoms(TALLOC_CTX *mem_ctx, uint32 *num_domains,
2077                               struct trustdom_info ***domains)
2078 {
2079         struct pdb_methods *pdb = pdb_get_methods();
2080         return pdb->enum_trusteddoms(pdb, mem_ctx, num_domains, domains);
2081 }
2082
2083 /*******************************************************************
2084  the defaults for trustdom methods:
2085  these simply call the original passdb/secrets.c actions,
2086  to be replaced by pdb_ldap.
2087  *******************************************************************/
2088
2089 static bool pdb_default_get_trusteddom_pw(struct pdb_methods *methods,
2090                                           const char *domain,
2091                                           char** pwd,
2092                                           DOM_SID *sid,
2093                                           time_t *pass_last_set_time)
2094 {
2095         return secrets_fetch_trusted_domain_password(domain, pwd,
2096                                 sid, pass_last_set_time);
2097
2098 }
2099
2100 static bool pdb_default_set_trusteddom_pw(struct pdb_methods *methods,
2101                                           const char* domain,
2102                                           const char* pwd,
2103                                           const DOM_SID *sid)
2104 {
2105         return secrets_store_trusted_domain_password(domain, pwd, sid);
2106 }
2107
2108 static bool pdb_default_del_trusteddom_pw(struct pdb_methods *methods,
2109                                           const char *domain)
2110 {
2111         return trusted_domain_password_delete(domain);
2112 }
2113
2114 static NTSTATUS pdb_default_enum_trusteddoms(struct pdb_methods *methods,
2115                                              TALLOC_CTX *mem_ctx,
2116                                              uint32 *num_domains,
2117                                              struct trustdom_info ***domains)
2118 {
2119         return secrets_trusted_domains(mem_ctx, num_domains, domains);
2120 }
2121
2122 /*******************************************************************
2123  Create a pdb_methods structure and initialize it with the default
2124  operations.  In this way a passdb module can simply implement
2125  the functionality it cares about.  However, normally this is done
2126  in groups of related functions.
2127 *******************************************************************/
2128
2129 NTSTATUS make_pdb_method( struct pdb_methods **methods )
2130 {
2131         /* allocate memory for the structure as its own talloc CTX */
2132
2133         if ( !(*methods = TALLOC_ZERO_P(NULL, struct pdb_methods) ) ) {
2134                 return NT_STATUS_NO_MEMORY;
2135         }
2136
2137         (*methods)->setsampwent = pdb_default_setsampwent;
2138         (*methods)->endsampwent = pdb_default_endsampwent;
2139         (*methods)->getsampwent = pdb_default_getsampwent;
2140         (*methods)->getsampwnam = pdb_default_getsampwnam;
2141         (*methods)->getsampwsid = pdb_default_getsampwsid;
2142         (*methods)->create_user = pdb_default_create_user;
2143         (*methods)->delete_user = pdb_default_delete_user;
2144         (*methods)->add_sam_account = pdb_default_add_sam_account;
2145         (*methods)->update_sam_account = pdb_default_update_sam_account;
2146         (*methods)->delete_sam_account = pdb_default_delete_sam_account;
2147         (*methods)->rename_sam_account = pdb_default_rename_sam_account;
2148         (*methods)->update_login_attempts = pdb_default_update_login_attempts;
2149
2150         (*methods)->getgrsid = pdb_default_getgrsid;
2151         (*methods)->getgrgid = pdb_default_getgrgid;
2152         (*methods)->getgrnam = pdb_default_getgrnam;
2153         (*methods)->create_dom_group = pdb_default_create_dom_group;
2154         (*methods)->delete_dom_group = pdb_default_delete_dom_group;
2155         (*methods)->add_group_mapping_entry = pdb_default_add_group_mapping_entry;
2156         (*methods)->update_group_mapping_entry = pdb_default_update_group_mapping_entry;
2157         (*methods)->delete_group_mapping_entry = pdb_default_delete_group_mapping_entry;
2158         (*methods)->enum_group_mapping = pdb_default_enum_group_mapping;
2159         (*methods)->enum_group_members = pdb_default_enum_group_members;
2160         (*methods)->enum_group_memberships = pdb_default_enum_group_memberships;
2161         (*methods)->set_unix_primary_group = pdb_default_set_unix_primary_group;
2162         (*methods)->add_groupmem = pdb_default_add_groupmem;
2163         (*methods)->del_groupmem = pdb_default_del_groupmem;
2164         (*methods)->create_alias = pdb_default_create_alias;
2165         (*methods)->delete_alias = pdb_default_delete_alias;
2166         (*methods)->get_aliasinfo = pdb_default_get_aliasinfo;
2167         (*methods)->set_aliasinfo = pdb_default_set_aliasinfo;
2168         (*methods)->add_aliasmem = pdb_default_add_aliasmem;
2169         (*methods)->del_aliasmem = pdb_default_del_aliasmem;
2170         (*methods)->enum_aliasmem = pdb_default_enum_aliasmem;
2171         (*methods)->enum_alias_memberships = pdb_default_alias_memberships;
2172         (*methods)->lookup_rids = pdb_default_lookup_rids;
2173         (*methods)->get_account_policy = pdb_default_get_account_policy;
2174         (*methods)->set_account_policy = pdb_default_set_account_policy;
2175         (*methods)->get_seq_num = pdb_default_get_seq_num;
2176         (*methods)->uid_to_rid = pdb_default_uid_to_rid;
2177         (*methods)->uid_to_sid = pdb_default_uid_to_sid;
2178         (*methods)->gid_to_sid = pdb_default_gid_to_sid;
2179         (*methods)->sid_to_id = pdb_default_sid_to_id;
2180
2181         (*methods)->search_users = pdb_default_search_users;
2182         (*methods)->search_groups = pdb_default_search_groups;
2183         (*methods)->search_aliases = pdb_default_search_aliases;
2184
2185         (*methods)->get_trusteddom_pw = pdb_default_get_trusteddom_pw;
2186         (*methods)->set_trusteddom_pw = pdb_default_set_trusteddom_pw;
2187         (*methods)->del_trusteddom_pw = pdb_default_del_trusteddom_pw;
2188         (*methods)->enum_trusteddoms  = pdb_default_enum_trusteddoms;
2189
2190         return NT_STATUS_OK;
2191 }