pdb_samba_dsdb: implement pdb_samba_dsdb_enum_trusteddoms()
[bbaumbach/samba-autobuild/.git] / source3 / passdb / pdb_util.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  Authentication utility functions
4  *  Copyright (C) Andrew Tridgell 1992-1998
5  *  Copyright (C) Andrew Bartlett 2001
6  *  Copyright (C) Jeremy Allison 2000-2001
7  *  Copyright (C) Rafal Szczesniak 2002
8  *  Copyright (C) Volker Lendecke 2006
9  *  Copyright (C) Michael Adam 2007
10  *
11  *  This program is free software; you can redistribute it and/or modify
12  *  it under the terms of the GNU General Public License as published by
13  *  the Free Software Foundation; either version 3 of the License, or
14  *  (at your option) any later version.
15  *
16  *  This program is distributed in the hope that it will be useful,
17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19  *  GNU General Public License for more details.
20  *
21  *  You should have received a copy of the GNU General Public License
22  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
23  */
24
25 #include "includes.h"
26 #include "../libcli/security/security.h"
27 #include "passdb.h"
28 #include "lib/winbind_util.h"
29 #include "../librpc/gen_ndr/idmap.h"
30
31 /**
32  * Add sid as a member of builtin_sid.
33  *
34  * @param[in] builtin_sid       An existing builtin group.
35  * @param[in] dom_sid           sid to add as a member of builtin_sid.
36  * @return Normal NTSTATUS return
37  */
38 static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid,
39                                    const struct dom_sid *dom_sid)
40 {
41         NTSTATUS status = NT_STATUS_OK;
42
43         if (!dom_sid || !builtin_sid) {
44                 return NT_STATUS_INVALID_PARAMETER;
45         }
46
47         status = pdb_add_aliasmem(builtin_sid, dom_sid);
48
49         if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) {
50                 DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
51                           sid_string_dbg(dom_sid),
52                           sid_string_dbg(builtin_sid)));
53                 return NT_STATUS_OK;
54         }
55
56         if (!NT_STATUS_IS_OK(status)) {
57                 DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
58                           "%s\n", sid_string_dbg(dom_sid),
59                           sid_string_dbg(builtin_sid), nt_errstr(status)));
60         }
61         return status;
62 }
63
64 /**
65  * Create the requested BUILTIN if it doesn't already exist.  This requires
66  * winbindd to be running.
67  *
68  * @param[in] rid BUILTIN rid to create
69  * @return Normal NTSTATUS return.
70  */
71 NTSTATUS pdb_create_builtin(uint32_t rid)
72 {
73         NTSTATUS status = NT_STATUS_OK;
74         struct dom_sid sid;
75         gid_t gid;
76         bool mapresult;
77
78         if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
79                 return NT_STATUS_NO_SUCH_ALIAS;
80         }
81
82         if (!pdb_is_responsible_for_builtin()) {
83                 /*
84                  * if this backend is not responsible for BUILTIN
85                  *
86                  * Use the gid from the mapping request for entry.
87                  * If the mapping fails, bail out
88                  */
89                 mapresult = sid_to_gid(&sid, &gid);
90                 if (!mapresult) {
91                         status = NT_STATUS_NO_SUCH_GROUP;
92                 } else {
93                         status = pdb_create_builtin_alias(rid, gid);
94                 }
95         } else {
96                 /*
97                  * this backend is responsible for BUILTIN
98                  *
99                  * a failed mapping result means that the entry
100                  * does not exist yet, so create it
101                  *
102                  * we use pdb_sid_to_id intentionally here to
103                  * directly query the passdb backend (sid_to_gid
104                  * would finally do the same)
105                  */
106                 struct unixid id;
107                 mapresult = pdb_sid_to_id(&sid, &id);
108                 if (!mapresult) {
109                         if (!lp_winbind_nested_groups() || !winbind_ping()) {
110                                 return NT_STATUS_PROTOCOL_UNREACHABLE;
111                         }
112                         status = pdb_create_builtin_alias(rid, 0);
113                 }
114         }
115         return status;
116 }
117
118 /*******************************************************************
119 *******************************************************************/
120
121 NTSTATUS create_builtin_users(const struct dom_sid *dom_sid)
122 {
123         NTSTATUS status;
124         struct dom_sid dom_users;
125
126         status = pdb_create_builtin(BUILTIN_RID_USERS);
127         if ( !NT_STATUS_IS_OK(status) ) {
128                 DEBUG(5,("create_builtin_users: Failed to create Users\n"));
129                 return status;
130         }
131
132         /* add domain users */
133         if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
134                 && sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS))
135         {
136                 status = add_sid_to_builtin(&global_sid_Builtin_Users,
137                                             &dom_users);
138         }
139
140         return status;
141 }
142
143 /*******************************************************************
144 *******************************************************************/
145
146 NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid)
147 {
148         NTSTATUS status;
149         struct dom_sid dom_admins, root_sid;
150         fstring root_name;
151         enum lsa_SidType type;
152         TALLOC_CTX *ctx;
153         bool ret;
154
155         status = pdb_create_builtin(BUILTIN_RID_ADMINISTRATORS);
156         if ( !NT_STATUS_IS_OK(status) ) {
157                 DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
158                 return status;
159         }
160
161         /* add domain admins */
162         if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
163                 && sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS))
164         {
165                 status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
166                                             &dom_admins);
167                 if (!NT_STATUS_IS_OK(status)) {
168                         return status;
169                 }
170         }
171
172         /* add root */
173         if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
174                 return NT_STATUS_NO_MEMORY;
175         }
176         fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
177         ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
178                           &root_sid, &type);
179         TALLOC_FREE( ctx );
180
181         if ( ret ) {
182                 status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
183                                             &root_sid);
184         }
185
186         return status;
187 }