2 Unix SMB/Netbios implementation.
4 Winbind ADS backend functions
6 Copyright (C) Andrew Tridgell 2001
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 /* Query display info for a realm. This is the basic user list fn */
28 static NTSTATUS query_user_list(struct winbindd_domain *domain,
30 uint32 *start_ndx, uint32 *num_entries,
31 WINBIND_USERINFO **info)
34 const char *attrs[] = {"sAMAccountName", "name", "objectSid", "primaryGroupID",
35 "userAccountControl", NULL};
40 DEBUG(3,("ads: query_user_list\n"));
42 if ((*start_ndx) != 0) {
43 DEBUG(1,("ads backend start_ndx not implemented\n"));
44 return NT_STATUS_NOT_IMPLEMENTED;
47 ads = ads_init(NULL, NULL, NULL);
49 DEBUG(1,("ads_init failed\n"));
50 return NT_STATUS_UNSUCCESSFUL;
53 rc = ads_connect(ads);
55 DEBUG(1,("query_user_list ads_connect: %s\n", ads_errstr(rc)));
56 return NT_STATUS_UNSUCCESSFUL;
59 rc = ads_search(ads, &res, "(objectclass=user)", attrs);
61 DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
62 return NT_STATUS_UNSUCCESSFUL;
65 count = ads_count_replies(ads, res);
67 DEBUG(1,("query_user_list: No users found\n"));
68 return NT_STATUS_UNSUCCESSFUL;
71 (*info) = talloc(mem_ctx, count * sizeof(**info));
72 if (!*info) return NT_STATUS_NO_MEMORY;
76 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
80 uint32 account_control;
82 if (!ads_pull_uint32(ads, msg, "userAccountControl",
84 !(account_control & UF_NORMAL_ACCOUNT)) continue;
86 name = ads_pull_string(ads, mem_ctx, msg, "sAMAccountName");
87 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
88 if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
89 DEBUG(1,("No sid for %s !?\n", name));
92 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
93 DEBUG(1,("No primary group for %s !?\n", name));
97 if (!sid_peek_rid(&sid, &rid)) {
98 DEBUG(1,("No rid for %s !?\n", name));
102 (*info)[i].acct_name = name;
103 (*info)[i].full_name = gecos;
104 (*info)[i].user_rid = rid;
105 (*info)[i].group_rid = group;
116 /* list all domain groups */
117 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
119 uint32 *start_ndx, uint32 *num_entries,
120 struct acct_info **info)
123 const char *attrs[] = {"sAMAccountName", "name", "objectSid",
124 "sAMAccountType", NULL};
129 DEBUG(3,("ads: enum_dom_groups\n"));
131 if ((*start_ndx) != 0) {
132 DEBUG(1,("ads backend start_ndx not implemented\n"));
133 return NT_STATUS_NOT_IMPLEMENTED;
136 ads = ads_init(NULL, NULL, NULL);
138 DEBUG(1,("ads_init failed\n"));
139 return NT_STATUS_UNSUCCESSFUL;
142 rc = ads_connect(ads);
144 DEBUG(1,("query_user_list ads_connect: %s\n", ads_errstr(rc)));
145 return NT_STATUS_UNSUCCESSFUL;
148 rc = ads_search(ads, &res, "(objectclass=group)", attrs);
150 DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
151 return NT_STATUS_UNSUCCESSFUL;
154 count = ads_count_replies(ads, res);
156 DEBUG(1,("query_user_list: No users found\n"));
157 return NT_STATUS_UNSUCCESSFUL;
160 (*info) = talloc(mem_ctx, count * sizeof(**info));
161 if (!*info) return NT_STATUS_NO_MEMORY;
165 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
171 if (!ads_pull_uint32(ads, msg, "sAMAccountType",
173 !(account_type & ATYPE_GROUP)) continue;
175 name = ads_pull_string(ads, mem_ctx, msg, "sAMAccountName");
176 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
177 if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
178 DEBUG(1,("No sid for %s !?\n", name));
182 if (!sid_peek_rid(&sid, &rid)) {
183 DEBUG(1,("No rid for %s !?\n", name));
187 fstrcpy((*info)[i].acct_name, name);
188 fstrcpy((*info)[i].acct_desc, gecos);
189 (*info)[i].rid = rid;
201 /* convert a single name to a sid in a domain */
202 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
205 enum SID_NAME_USE *type)
208 const char *attrs[] = {"objectSid", "sAMAccountType", NULL};
215 /* sigh. Need to fix interface to give us a raw name */
216 parse_domain_user(name, dom2, name2);
218 DEBUG(3,("ads: name_to_sid\n"));
220 ads = ads_init(NULL, NULL, NULL);
222 DEBUG(1,("ads_init failed\n"));
223 return NT_STATUS_UNSUCCESSFUL;
226 rc = ads_connect(ads);
228 DEBUG(1,("name_to_sid ads_connect: %s\n", ads_errstr(rc)));
229 return NT_STATUS_UNSUCCESSFUL;
232 asprintf(&exp, "(sAMAccountName=%s)", name2);
233 rc = ads_search(ads, &res, exp, attrs);
236 DEBUG(1,("name_to_sid ads_search: %s\n", ads_errstr(rc)));
237 return NT_STATUS_UNSUCCESSFUL;
240 count = ads_count_replies(ads, res);
242 DEBUG(1,("name_to_sid: %s not found\n", name));
243 return NT_STATUS_UNSUCCESSFUL;
246 if (!ads_pull_sid(ads, res, "objectSid", sid)) {
247 DEBUG(1,("No sid for %s !?\n", name));
248 return NT_STATUS_UNSUCCESSFUL;
251 if (!ads_pull_uint32(ads, res, "sAMAccountType", &t)) {
252 DEBUG(1,("No sAMAccountType for %s !?\n", name));
253 return NT_STATUS_UNSUCCESSFUL;
256 switch (t & 0xF0000000) {
258 *type = SID_NAME_DOM_GRP;
261 *type = SID_NAME_USER;
264 DEBUG(1,("hmm, need to map account type 0x%x\n", t));
265 *type = SID_NAME_UNKNOWN;
274 /* the ADS backend methods are exposed via this structure */
275 struct winbindd_methods ads_methods = {
279 /* I can't see a good way to do a sid to name mapping with ldap,
280 and MS servers always allow RPC for this (even in native mode) so
281 just use RPC. Maybe that's why they allow it? */
282 winbindd_rpc_sid_to_name