2 Unix SMB/CIFS implementation.
4 Winbind daemon - user related functions
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jeremy Allison 2001.
8 Copyright (C) Gerald (Jerry) Carter 2003.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 #define DBGC_CLASS DBGC_WINBIND
31 extern userdom_struct current_user_info;
33 /* Fill a pwent structure with information we have obtained */
35 static BOOL winbindd_fill_pwent(char *dom_name, char *user_name,
36 DOM_SID *user_sid, DOM_SID *group_sid,
37 char *full_name, struct winbindd_pw *pw)
39 fstring output_username;
44 if (!pw || !dom_name || !user_name)
47 /* Resolve the uid number */
49 if (!NT_STATUS_IS_OK(idmap_sid_to_uid(user_sid, &pw->pw_uid, 0))) {
50 DEBUG(1, ("error getting user id for sid %s\n", sid_to_string(sid_string, user_sid)));
54 /* Resolve the gid number */
56 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(group_sid, &pw->pw_gid, 0))) {
57 DEBUG(1, ("error getting group id for sid %s\n", sid_to_string(sid_string, group_sid)));
61 strlower_m(user_name);
65 fill_domain_username(output_username, dom_name, user_name);
67 safe_strcpy(pw->pw_name, output_username, sizeof(pw->pw_name) - 1);
69 /* Full name (gecos) */
71 safe_strcpy(pw->pw_gecos, full_name, sizeof(pw->pw_gecos) - 1);
73 /* Home directory and shell - use template config parameters. The
74 defaults are /tmp for the home directory and /bin/false for
77 /* The substitution of %U and %D in the 'template homedir' is done
78 by alloc_sub_specified() below. */
80 fstrcpy(current_user_info.domain, dom_name);
82 homedir = alloc_sub_specified(lp_template_homedir(), user_name, dom_name, pw->pw_uid, pw->pw_gid);
87 safe_strcpy(pw->pw_dir, homedir, sizeof(pw->pw_dir) - 1);
91 shell = alloc_sub_specified(lp_template_shell(), user_name, dom_name, pw->pw_uid, pw->pw_gid);
96 safe_strcpy(pw->pw_shell, shell,
97 sizeof(pw->pw_shell) - 1);
101 /* Password - set to "x" as we can't generate anything useful here.
102 Authentication can be done using the pam_winbind module. */
104 safe_strcpy(pw->pw_passwd, "x", sizeof(pw->pw_passwd) - 1);
109 /* Wrapper for domain->methods->query_user, only on the parent->child pipe */
111 enum winbindd_result winbindd_dual_userinfo(struct winbindd_domain *domain,
112 struct winbindd_cli_state *state)
115 WINBIND_USERINFO user_info;
118 /* Ensure null termination */
119 state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
121 DEBUG(3, ("[%5lu]: lookupsid %s\n", (unsigned long)state->pid,
122 state->request.data.sid));
124 if (!string_to_sid(&sid, state->request.data.sid)) {
125 DEBUG(5, ("%s not a SID\n", state->request.data.sid));
126 return WINBINDD_ERROR;
129 status = domain->methods->query_user(domain, state->mem_ctx,
131 if (!NT_STATUS_IS_OK(status)) {
132 DEBUG(1, ("error getting user info for sid %s\n",
133 sid_string_static(&sid)));
134 return WINBINDD_ERROR;
137 fstrcpy(state->response.data.user_info.acct_name, user_info.acct_name);
138 fstrcpy(state->response.data.user_info.full_name, user_info.full_name);
139 if (!sid_peek_check_rid(&domain->sid, &user_info.group_sid,
140 &state->response.data.user_info.group_rid)) {
141 DEBUG(1, ("Could not extract group rid out of %s\n",
142 sid_string_static(&sid)));
143 return WINBINDD_ERROR;
149 struct getpwsid_state {
150 struct winbindd_cli_state *state;
151 struct winbindd_domain *domain;
160 static void getpwsid_queryuser_recv(void *private, BOOL success,
161 const char *acct_name,
162 const char *full_name, uint32 group_rid);
163 static void getpwsid_sid2uid_recv(void *private, BOOL success, uid_t uid);
164 static void getpwsid_sid2gid_recv(void *private, BOOL success, gid_t gid);
166 static void winbindd_getpwsid(struct winbindd_cli_state *state,
169 struct getpwsid_state *s;
171 s = TALLOC_P(state->mem_ctx, struct getpwsid_state);
173 DEBUG(0, ("talloc failed\n"));
178 s->domain = find_domain_from_sid_noinit(sid);
179 if (s->domain == NULL) {
180 DEBUG(3, ("Could not find domain for sid %s\n",
181 sid_string_static(sid)));
185 sid_copy(&s->user_sid, sid);
187 query_user_async(s->state->mem_ctx, s->domain, sid,
188 getpwsid_queryuser_recv, s);
192 s->state->response.result = WINBINDD_ERROR;
193 request_finished(state);
196 static void getpwsid_queryuser_recv(void *private, BOOL success,
197 const char *acct_name,
198 const char *full_name, uint32 group_rid)
200 struct getpwsid_state *s =
201 talloc_get_type_abort(private, struct getpwsid_state);
204 DEBUG(5, ("Could not query user %s\\%s\n", s->domain->name,
206 s->state->response.result = WINBINDD_ERROR;
207 request_finished(s->state);
211 s->username = talloc_strdup(s->state->mem_ctx, acct_name);
212 s->fullname = talloc_strdup(s->state->mem_ctx, full_name);
213 sid_copy(&s->group_sid, &s->domain->sid);
214 sid_append_rid(&s->group_sid, group_rid);
216 winbindd_sid2uid_async(s->state->mem_ctx, &s->user_sid,
217 getpwsid_sid2uid_recv, s);
220 static void getpwsid_sid2uid_recv(void *private, BOOL success, uid_t uid)
222 struct getpwsid_state *s =
223 talloc_get_type_abort(private, struct getpwsid_state);
226 DEBUG(5, ("Could not query user's %s\\%s uid\n",
227 s->domain->name, s->username));
228 s->state->response.result = WINBINDD_ERROR;
229 request_finished(s->state);
234 winbindd_sid2gid_async(s->state->mem_ctx, &s->group_sid,
235 getpwsid_sid2gid_recv, s);
238 static void getpwsid_sid2gid_recv(void *private, BOOL success, gid_t gid)
240 struct getpwsid_state *s =
241 talloc_get_type_abort(private, struct getpwsid_state);
242 struct winbindd_pw *pw;
243 fstring output_username;
247 s->state->response.result = WINBINDD_ERROR;
250 DEBUG(5, ("Could not query user's %s\\%s\n gid",
251 s->domain->name, s->username));
257 pw = &s->state->response.data.pw;
260 fill_domain_username(output_username, s->domain->name, s->username);
261 safe_strcpy(pw->pw_name, output_username, sizeof(pw->pw_name) - 1);
262 safe_strcpy(pw->pw_gecos, s->fullname, sizeof(pw->pw_gecos) - 1);
264 /* Home directory and shell - use template config parameters. The
265 defaults are /tmp for the home directory and /bin/false for
268 /* The substitution of %U and %D in the 'template homedir' is done
269 by alloc_sub_specified() below. */
271 fstrcpy(current_user_info.domain, s->domain->name);
273 homedir = alloc_sub_specified(lp_template_homedir(), s->username,
274 s->domain->name, pw->pw_uid, pw->pw_gid);
275 if (homedir == NULL) {
276 DEBUG(5, ("Could not compose homedir\n"));
279 safe_strcpy(pw->pw_dir, homedir, sizeof(pw->pw_dir) - 1);
282 shell = alloc_sub_specified(lp_template_shell(), s->username,
283 s->domain->name, pw->pw_uid, pw->pw_gid);
285 DEBUG(5, ("Could not compose shell\n"));
288 safe_strcpy(pw->pw_shell, shell, sizeof(pw->pw_shell) - 1);
291 /* Password - set to "x" as we can't generate anything useful here.
292 Authentication can be done using the pam_winbind module. */
294 safe_strcpy(pw->pw_passwd, "x", sizeof(pw->pw_passwd) - 1);
296 s->state->response.result = WINBINDD_OK;
299 request_finished(s->state);
302 /* Return a password structure from a username. */
304 static void getpwnam_name2sid_recv(void *private, BOOL success,
305 const DOM_SID *sid, enum SID_NAME_USE type);
307 enum winbindd_result winbindd_getpwnam(struct winbindd_cli_state *state)
309 struct winbindd_domain *domain;
310 fstring domname, username;
312 /* Ensure null termination */
313 state->request.data.username[sizeof(state->request.data.username)-1]='\0';
315 DEBUG(3, ("[%5lu]: getpwnam %s\n", (unsigned long)state->pid,
316 state->request.data.username));
318 if (!parse_domain_user(state->request.data.username, domname,
320 DEBUG(0, ("Could not parse domain user: %s\n",
321 state->request.data.username));
322 return WINBINDD_ERROR;
325 /* Get info for the domain */
327 domain = find_domain_from_name(domname);
329 if (domain == NULL) {
330 DEBUG(7, ("could not find domain entry for domain %s\n",
332 return WINBINDD_ERROR;
335 if ( strequal(domname, lp_workgroup()) && lp_winbind_trusted_domains_only() ) {
336 DEBUG(7,("winbindd_getpwnam: My domain -- rejecting getpwnam() for %s\\%s.\n",
338 return WINBINDD_ERROR;
341 /* Get rid and name type from name. The following costs 1 packet */
343 winbindd_lookupname_async(state->mem_ctx, domname, username,
344 getpwnam_name2sid_recv, state);
345 return WINBINDD_PENDING;
348 static void getpwnam_name2sid_recv(void *private, BOOL success,
349 const DOM_SID *sid, enum SID_NAME_USE type)
351 struct winbindd_cli_state *state = private;
354 DEBUG(5, ("Could not lookup name for user %s\n",
355 state->request.data.username));
356 state->response.result = WINBINDD_ERROR;
357 request_finished(state);
361 if ((type != SID_NAME_USER) && (type != SID_NAME_COMPUTER)) {
362 DEBUG(5, ("%s is not a user\n", state->request.data.username));
363 state->response.result = WINBINDD_ERROR;
364 request_finished(state);
368 winbindd_getpwsid(state, sid);
371 /* Return a password structure given a uid number */
373 enum winbindd_result winbindd_getpwuid(struct winbindd_cli_state *state)
378 /* Bug out if the uid isn't in the winbind range */
380 if ((state->request.data.uid < server_state.uid_low ) ||
381 (state->request.data.uid > server_state.uid_high))
382 return WINBINDD_ERROR;
384 DEBUG(3, ("[%5lu]: getpwuid %lu\n", (unsigned long)state->pid,
385 (unsigned long)state->request.data.uid));
387 status = idmap_uid_to_sid(&user_sid, state->request.data.uid,
388 ID_QUERY_ONLY | ID_CACHE_ONLY);
390 if (!NT_STATUS_IS_OK(status)) {
391 DEBUG(5, ("Could not find SID for uid %lu\n",
392 (unsigned long)state->request.data.uid));
393 return WINBINDD_ERROR;
396 winbindd_getpwsid(state, &user_sid);
397 return WINBINDD_PENDING;
401 * set/get/endpwent functions
404 /* Rewind file pointer for ntdom passwd database */
406 enum winbindd_result winbindd_setpwent(struct winbindd_cli_state *state)
408 struct winbindd_domain *domain;
410 DEBUG(3, ("[%5lu]: setpwent\n", (unsigned long)state->pid));
412 /* Check user has enabled this */
414 if (!lp_winbind_enum_users())
415 return WINBINDD_ERROR;
417 /* Free old static data if it exists */
419 if (state->getpwent_state != NULL) {
420 free_getent_state(state->getpwent_state);
421 state->getpwent_state = NULL;
425 /* add any local users we have */
427 if ( (domain_state = (struct getent_state *)malloc(sizeof(struct getent_state))) == NULL )
428 return WINBINDD_ERROR;
430 ZERO_STRUCTP(domain_state);
432 /* Add to list of open domains */
434 DLIST_ADD(state->getpwent_state, domain_state);
437 /* Create sam pipes for each domain we know about */
439 for(domain = domain_list(); domain != NULL; domain = domain->next) {
440 struct getent_state *domain_state;
443 /* don't add our domaina if we are a PDC or if we
444 are a member of a Samba domain */
446 if ( (IS_DC || lp_winbind_trusted_domains_only())
447 && strequal(domain->name, lp_workgroup()) )
452 /* Create a state record for this domain */
454 if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL)
455 return WINBINDD_ERROR;
457 ZERO_STRUCTP(domain_state);
459 fstrcpy(domain_state->domain_name, domain->name);
461 /* Add to list of open domains */
463 DLIST_ADD(state->getpwent_state, domain_state);
466 state->getpwent_initialized = True;
471 /* Close file pointer to ntdom passwd database */
473 enum winbindd_result winbindd_endpwent(struct winbindd_cli_state *state)
475 DEBUG(3, ("[%5lu]: endpwent\n", (unsigned long)state->pid));
477 free_getent_state(state->getpwent_state);
478 state->getpwent_initialized = False;
479 state->getpwent_state = NULL;
484 /* Get partial list of domain users for a domain. We fill in the sam_entries,
485 and num_sam_entries fields with domain user information. The dispinfo_ndx
486 field is incremented to the index of the next user to fetch. Return True if
487 some users were returned, False otherwise. */
489 static BOOL get_sam_user_entries(struct getent_state *ent, TALLOC_CTX *mem_ctx)
493 WINBIND_USERINFO *info;
494 struct getpwent_user *name_list = NULL;
496 struct winbindd_domain *domain;
497 struct winbindd_methods *methods;
500 if (ent->num_sam_entries)
503 if (!(domain = find_domain_from_name(ent->domain_name))) {
504 DEBUG(3, ("no such domain %s in get_sam_user_entries\n",
509 methods = domain->methods;
511 /* Free any existing user info */
513 SAFE_FREE(ent->sam_entries);
514 ent->num_sam_entries = 0;
516 /* Call query_user_list to get a list of usernames and user rids */
520 status = methods->query_user_list(domain, mem_ctx, &num_entries,
524 struct getpwent_user *tnl;
526 tnl = SMB_REALLOC_ARRAY(name_list, struct getpwent_user, ent->num_sam_entries + num_entries);
529 DEBUG(0,("get_sam_user_entries realloc failed.\n"));
530 SAFE_FREE(name_list);
536 for (i = 0; i < num_entries; i++) {
537 /* Store account name and gecos */
538 if (!info[i].acct_name) {
539 fstrcpy(name_list[ent->num_sam_entries + i].name, "");
541 fstrcpy(name_list[ent->num_sam_entries + i].name,
544 if (!info[i].full_name) {
545 fstrcpy(name_list[ent->num_sam_entries + i].gecos, "");
547 fstrcpy(name_list[ent->num_sam_entries + i].gecos,
551 /* User and group ids */
552 sid_copy(&name_list[ent->num_sam_entries+i].user_sid,
554 sid_copy(&name_list[ent->num_sam_entries+i].group_sid,
558 ent->num_sam_entries += num_entries;
560 /* Fill in remaining fields */
562 ent->sam_entries = name_list;
563 ent->sam_entry_index = 0;
564 result = ent->num_sam_entries > 0;
571 /* Fetch next passwd entry from ntdom database */
573 #define MAX_GETPWENT_USERS 500
575 enum winbindd_result winbindd_getpwent(struct winbindd_cli_state *state)
577 struct getent_state *ent;
578 struct winbindd_pw *user_list;
579 int num_users, user_list_ndx = 0, i;
581 DEBUG(3, ("[%5lu]: getpwent\n", (unsigned long)state->pid));
583 /* Check user has enabled this */
585 if (!lp_winbind_enum_users())
586 return WINBINDD_ERROR;
588 /* Allocate space for returning a chunk of users */
590 num_users = MIN(MAX_GETPWENT_USERS, state->request.data.num_entries);
592 if ((state->response.extra_data = SMB_MALLOC_ARRAY(struct winbindd_pw, num_users)) == NULL)
593 return WINBINDD_ERROR;
595 memset(state->response.extra_data, 0, num_users *
596 sizeof(struct winbindd_pw));
598 user_list = (struct winbindd_pw *)state->response.extra_data;
600 if (!state->getpwent_initialized)
601 winbindd_setpwent(state);
603 if (!(ent = state->getpwent_state))
604 return WINBINDD_ERROR;
606 /* Start sending back users */
608 for (i = 0; i < num_users; i++) {
609 struct getpwent_user *name_list = NULL;
612 /* Do we need to fetch another chunk of users? */
614 if (ent->num_sam_entries == ent->sam_entry_index) {
617 !get_sam_user_entries(ent, state->mem_ctx)) {
618 struct getent_state *next_ent;
620 /* Free state information for this domain */
622 SAFE_FREE(ent->sam_entries);
624 next_ent = ent->next;
625 DLIST_REMOVE(state->getpwent_state, ent);
631 /* No more domains */
637 name_list = ent->sam_entries;
639 /* Lookup user info */
641 result = winbindd_fill_pwent(
643 name_list[ent->sam_entry_index].name,
644 &name_list[ent->sam_entry_index].user_sid,
645 &name_list[ent->sam_entry_index].group_sid,
646 name_list[ent->sam_entry_index].gecos,
647 &user_list[user_list_ndx]);
649 ent->sam_entry_index++;
651 /* Add user to return list */
656 state->response.data.num_entries++;
657 state->response.length +=
658 sizeof(struct winbindd_pw);
661 DEBUG(1, ("could not lookup domain user %s\n",
662 name_list[ent->sam_entry_index].name));
667 return (user_list_ndx > 0) ? WINBINDD_OK : WINBINDD_ERROR;
670 /* List domain users without mapping to unix ids */
672 enum winbindd_result winbindd_list_users(struct winbindd_cli_state *state)
674 struct winbindd_domain *domain;
675 WINBIND_USERINFO *info;
676 const char *which_domain;
677 uint32 num_entries = 0, total_entries = 0;
678 char *ted, *extra_data = NULL;
679 int extra_data_len = 0;
680 enum winbindd_result rv = WINBINDD_ERROR;
682 DEBUG(3, ("[%5lu]: list users\n", (unsigned long)state->pid));
684 /* Ensure null termination */
685 state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';
686 which_domain = state->request.domain_name;
688 /* Enumerate over trusted domains */
690 for (domain = domain_list(); domain; domain = domain->next) {
692 struct winbindd_methods *methods;
695 /* if we have a domain name restricting the request and this
696 one in the list doesn't match, then just bypass the remainder
699 if ( *which_domain && !strequal(which_domain, domain->name) )
702 methods = domain->methods;
704 /* Query display info */
705 status = methods->query_user_list(domain, state->mem_ctx,
706 &num_entries, &info);
708 if (num_entries == 0)
711 /* Allocate some memory for extra data */
712 total_entries += num_entries;
714 ted = SMB_REALLOC(extra_data, sizeof(fstring) * total_entries);
717 DEBUG(0,("failed to enlarge buffer!\n"));
718 SAFE_FREE(extra_data);
723 /* Pack user list into extra data fields */
725 for (i = 0; i < num_entries; i++) {
726 fstring acct_name, name;
728 if (!info[i].acct_name) {
729 fstrcpy(acct_name, "");
731 fstrcpy(acct_name, info[i].acct_name);
734 fill_domain_username(name, domain->name, acct_name);
736 /* Append to extra data */
737 memcpy(&extra_data[extra_data_len], name,
739 extra_data_len += strlen(name);
740 extra_data[extra_data_len++] = ',';
744 /* Assign extra_data fields in response structure */
747 extra_data[extra_data_len - 1] = '\0';
748 state->response.extra_data = extra_data;
749 state->response.length += extra_data_len;
752 /* No domains responded but that's still OK so don't return an