s3-libads: use ldap_init_fd() to initialize a ldap session if possible
[bbaumbach/samba-autobuild/.git] / source3 / passdb / pdb_util.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Authentication utility functions
4  *  Copyright (C) Andrew Tridgell 1992-1998
5  *  Copyright (C) Andrew Bartlett 2001
6  *  Copyright (C) Jeremy Allison 2000-2001
7  *  Copyright (C) Rafal Szczesniak 2002
8  *  Copyright (C) Volker Lendecke 2006
9  *  Copyright (C) Michael Adam 2007
10  *
11  *  This program is free software; you can redistribute it and/or modify
12  *  it under the terms of the GNU General Public License as published by
13  *  the Free Software Foundation; either version 3 of the License, or
14  *  (at your option) any later version.
15  *
16  *  This program is distributed in the hope that it will be useful,
17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19  *  GNU General Public License for more details.
20  *
21  *  You should have received a copy of the GNU General Public License
22  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
23  */
24
25 #include "includes.h"
26 #include "../libcli/security/security.h"
27 #include "passdb.h"
28 #include "lib/winbind_util.h"
29 #include "../librpc/gen_ndr/idmap.h"
30
31 /**
32  * Add sid as a member of builtin_sid.
33  *
34  * @param[in] builtin_sid       An existing builtin group.
35  * @param[in] dom_sid           sid to add as a member of builtin_sid.
36  * @return Normal NTSTATUS return
37  */
38 static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid,
39                                    const struct dom_sid *dom_sid)
40 {
41         NTSTATUS status;
42
43         if (!dom_sid || !builtin_sid) {
44                 return NT_STATUS_INVALID_PARAMETER;
45         }
46
47         status = pdb_add_aliasmem(builtin_sid, dom_sid);
48
49         if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) {
50                 struct dom_sid_buf buf1, buf2;
51                 DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
52                           dom_sid_str_buf(dom_sid, &buf1),
53                           dom_sid_str_buf(builtin_sid, &buf2)));
54                 return NT_STATUS_OK;
55         }
56
57         if (!NT_STATUS_IS_OK(status)) {
58                 struct dom_sid_buf buf1, buf2;
59                 DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
60                           "%s\n",
61                           dom_sid_str_buf(dom_sid, &buf1),
62                           dom_sid_str_buf(builtin_sid, &buf2),
63                           nt_errstr(status)));
64         }
65         return status;
66 }
67
68 /**
69  * Create the requested BUILTIN if it doesn't already exist.  This requires
70  * winbindd to be running.
71  *
72  * @param[in] rid BUILTIN rid to create
73  * @return Normal NTSTATUS return.
74  */
75 NTSTATUS pdb_create_builtin(uint32_t rid)
76 {
77         NTSTATUS status = NT_STATUS_OK;
78         struct dom_sid sid;
79         gid_t gid;
80         bool mapresult;
81
82         if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
83                 return NT_STATUS_NO_SUCH_ALIAS;
84         }
85
86         if (!pdb_is_responsible_for_builtin()) {
87                 /*
88                  * if this backend is not responsible for BUILTIN
89                  *
90                  * Use the gid from the mapping request for entry.
91                  * If the mapping fails, bail out
92                  */
93                 mapresult = sid_to_gid(&sid, &gid);
94                 if (!mapresult) {
95                         status = NT_STATUS_NO_SUCH_GROUP;
96                 } else {
97                         status = pdb_create_builtin_alias(rid, gid);
98                 }
99         } else {
100                 /*
101                  * this backend is responsible for BUILTIN
102                  *
103                  * a failed mapping result means that the entry
104                  * does not exist yet, so create it
105                  *
106                  * we use pdb_sid_to_id intentionally here to
107                  * directly query the passdb backend (sid_to_gid
108                  * would finally do the same)
109                  */
110                 struct unixid id;
111                 mapresult = pdb_sid_to_id(&sid, &id);
112                 if (!mapresult) {
113                         if (!lp_winbind_nested_groups() || !winbind_ping()) {
114                                 return NT_STATUS_PROTOCOL_UNREACHABLE;
115                         }
116                         status = pdb_create_builtin_alias(rid, 0);
117                 }
118         }
119         return status;
120 }
121
122 /*******************************************************************
123 *******************************************************************/
124
125 NTSTATUS create_builtin_users(const struct dom_sid *dom_sid)
126 {
127         NTSTATUS status;
128         struct dom_sid dom_users;
129
130         status = pdb_create_builtin(BUILTIN_RID_USERS);
131         if ( !NT_STATUS_IS_OK(status) ) {
132                 DEBUG(5,("create_builtin_users: Failed to create Users\n"));
133                 return status;
134         }
135
136         /* add domain users */
137         if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER)) &&
138             (dom_sid != NULL) &&
139             sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS))
140         {
141                 status = add_sid_to_builtin(&global_sid_Builtin_Users,
142                                             &dom_users);
143         }
144
145         return status;
146 }
147
148 /*******************************************************************
149 *******************************************************************/
150
151 NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid)
152 {
153         NTSTATUS status;
154         struct dom_sid dom_admins, root_sid;
155         fstring root_name;
156         enum lsa_SidType type;
157         TALLOC_CTX *ctx;
158         bool ret;
159
160         status = pdb_create_builtin(BUILTIN_RID_ADMINISTRATORS);
161         if ( !NT_STATUS_IS_OK(status) ) {
162                 DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
163                 return status;
164         }
165
166         /* add domain admins */
167         if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER)) &&
168             (dom_sid != NULL) &&
169             sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS))
170         {
171                 status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
172                                             &dom_admins);
173                 if (!NT_STATUS_IS_OK(status)) {
174                         return status;
175                 }
176         }
177
178         /* add root */
179         if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
180                 return NT_STATUS_NO_MEMORY;
181         }
182         fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
183         ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
184                           &root_sid, &type);
185         TALLOC_FREE( ctx );
186
187         if ( ret ) {
188                 status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
189                                             &root_sid);
190         }
191
192         return status;
193 }
194
195 /*******************************************************************
196 *******************************************************************/
197
198 NTSTATUS create_builtin_guests(const struct dom_sid *dom_sid)
199 {
200         NTSTATUS status;
201         struct dom_sid tmp_sid = { 0, };
202
203         status = pdb_create_builtin(BUILTIN_RID_GUESTS);
204         if (!NT_STATUS_IS_OK(status)) {
205                 DEBUG(5,("create_builtin_guests: Failed to create Guests\n"));
206                 return status;
207         }
208
209         /* add local guest */
210         if (sid_compose(&tmp_sid, get_global_sam_sid(), DOMAIN_RID_GUEST)) {
211                 status = add_sid_to_builtin(&global_sid_Builtin_Guests,
212                                             &tmp_sid);
213                 if (!NT_STATUS_IS_OK(status)) {
214                         return status;
215                 }
216         }
217
218         /* add local guests */
219         if (sid_compose(&tmp_sid, get_global_sam_sid(), DOMAIN_RID_GUESTS)) {
220                 status = add_sid_to_builtin(&global_sid_Builtin_Guests,
221                                             &tmp_sid);
222                 if (!NT_STATUS_IS_OK(status)) {
223                         return status;
224                 }
225         }
226
227         if (lp_server_role() != ROLE_DOMAIN_MEMBER) {
228                 return NT_STATUS_OK;
229         }
230
231         if (dom_sid == NULL) {
232                 return NT_STATUS_INTERNAL_ERROR;
233         }
234
235         /* add domain guests */
236         if (sid_compose(&tmp_sid, dom_sid, DOMAIN_RID_GUESTS)) {
237                 status = add_sid_to_builtin(&global_sid_Builtin_Guests,
238                                             &tmp_sid);
239                 if (!NT_STATUS_IS_OK(status)) {
240                         return status;
241                 }
242         }
243
244         return NT_STATUS_OK;
245 }