fe9c8c135ededeccf414759238ab360944e4edc8
[kai/samba.git] / source3 / utils / net_groupmap.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  RPC Pipe client / server routines
4  *  Copyright (C) Andrew Tridgell              1992-2000,
5  *  Copyright (C) Jean Fran├žois Micouleau      1998-2001.
6  *  Copyright (C) Gerald Carter                2003,
7  *  Copyright (C) Volker Lendecke              2004
8  *
9  *  This program is free software; you can redistribute it and/or modify
10  *  it under the terms of the GNU General Public License as published by
11  *  the Free Software Foundation; either version 3 of the License, or
12  *  (at your option) any later version.
13  *
14  *  This program is distributed in the hope that it will be useful,
15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  *  GNU General Public License for more details.
18  *
19  *  You should have received a copy of the GNU General Public License
20  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
21  */
22
23
24 #include "includes.h"
25 #include "system/passwd.h"
26 #include "utils/net.h"
27 #include "../libcli/security/security.h"
28 #include "passdb.h"
29
30 /*********************************************************
31  Figure out if the input was an NT group or a SID string.
32  Return the SID.
33 **********************************************************/
34 static bool get_sid_from_input(struct dom_sid *sid, char *input)
35 {
36         GROUP_MAP *map;
37
38         map = talloc_zero(NULL, GROUP_MAP);
39         if (!map) {
40                 return false;
41         }
42
43         if (strncasecmp_m( input, "S-", 2)) {
44                 /* Perhaps its the NT group name? */
45                 if (!pdb_getgrnam(map, input)) {
46                         printf(_("NT Group %s doesn't exist in mapping DB\n"),
47                                input);
48                         TALLOC_FREE(map);
49                         return false;
50                 } else {
51                         *sid = map->sid;
52                 }
53         } else {
54                 if (!string_to_sid(sid, input)) {
55                         printf(_("converting sid %s from a string failed!\n"),
56                                input);
57                         TALLOC_FREE(map);
58                         return false;
59                 }
60         }
61         TALLOC_FREE(map);
62         return true;
63 }
64
65 /*********************************************************
66  Dump a GROUP_MAP entry to stdout (long or short listing)
67 **********************************************************/
68
69 static void print_map_entry (const GROUP_MAP *map, bool long_list)
70 {
71         if (!long_list)
72                 d_printf("%s (%s) -> %s\n", map->nt_name,
73                          sid_string_tos(&map->sid), gidtoname(map->gid));
74         else {
75                 d_printf("%s\n", map->nt_name);
76                 d_printf(_("\tSID       : %s\n"), sid_string_tos(&map->sid));
77                 d_printf(_("\tUnix gid  : %u\n"), (unsigned int)map->gid);
78                 d_printf(_("\tUnix group: %s\n"), gidtoname(map->gid));
79                 d_printf(_("\tGroup type: %s\n"),
80                          sid_type_lookup(map->sid_name_use));
81                 d_printf(_("\tComment   : %s\n"), map->comment);
82         }
83
84 }
85 /*********************************************************
86  List the groups.
87 **********************************************************/
88 static int net_groupmap_list(struct net_context *c, int argc, const char **argv)
89 {
90         size_t entries;
91         bool long_list = false;
92         size_t i;
93         fstring ntgroup = "";
94         fstring sid_string = "";
95         const char list_usage_str[] = N_("net groupmap list [verbose] "
96                                          "[ntgroup=NT group] [sid=SID]\n"
97                                          "    verbose\tPrint verbose list\n"
98                                          "    ntgroup\tNT group to list\n"
99                                          "    sid\tSID of group to list");
100
101         if (c->display_usage) {
102                 d_printf("%s\n%s\n", _("Usage: "), list_usage_str);
103                 return 0;
104         }
105
106         if (c->opt_verbose || c->opt_long_list_entries)
107                 long_list = true;
108
109         /* get the options */
110         for ( i=0; i<argc; i++ ) {
111                 if ( !strcasecmp_m(argv[i], "verbose")) {
112                         long_list = true;
113                 }
114                 else if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
115                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
116                         if ( !ntgroup[0] ) {
117                                 d_fprintf(stderr, _("must supply a name\n"));
118                                 return -1;
119                         }
120                 }
121                 else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
122                         fstrcpy( sid_string, get_string_param( argv[i] ) );
123                         if ( !sid_string[0] ) {
124                                 d_fprintf(stderr, _("must supply a SID\n"));
125                                 return -1;
126                         }
127                 }
128                 else {
129                         d_fprintf(stderr, _("Bad option: %s\n"), argv[i]);
130                         d_printf("%s\n%s\n", _("Usage:"), list_usage_str);
131                         return -1;
132                 }
133         }
134
135         /* list a single group is given a name */
136         if ( ntgroup[0] || sid_string[0] ) {
137                 struct dom_sid sid;
138                 GROUP_MAP *map;
139
140                 if ( sid_string[0] )
141                         strlcpy(ntgroup, sid_string, sizeof(ntgroup));
142
143                 if (!get_sid_from_input(&sid, ntgroup)) {
144                         return -1;
145                 }
146
147                 map = talloc_zero(NULL, GROUP_MAP);
148                 if (!map) {
149                         return -1;
150                 }
151
152                 /* Get the current mapping from the database */
153                 if(!pdb_getgrsid(map, sid)) {
154                         d_fprintf(stderr,
155                                   _("Failure to local group SID in the "
156                                     "database\n"));
157                         TALLOC_FREE(map);
158                         return -1;
159                 }
160
161                 print_map_entry(map, long_list );
162                 TALLOC_FREE(map);
163         }
164         else {
165                 GROUP_MAP **maps = NULL;
166                 bool ok = false;
167                 /* enumerate all group mappings */
168                 ok = pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN,
169                                             &maps, &entries,
170                                             ENUM_ALL_MAPPED);
171                 if (!ok) {
172                         return -1;
173                 }
174
175                 for (i=0; i<entries; i++) {
176                         print_map_entry(maps[i], long_list);
177                 }
178
179                 TALLOC_FREE(maps);
180         }
181
182         return 0;
183 }
184
185 /*********************************************************
186  Add a new group mapping entry
187 **********************************************************/
188
189 static int net_groupmap_add(struct net_context *c, int argc, const char **argv)
190 {
191         struct dom_sid sid;
192         fstring ntgroup = "";
193         fstring unixgrp = "";
194         fstring string_sid = "";
195         fstring type = "";
196         fstring ntcomment = "";
197         enum lsa_SidType sid_type = SID_NAME_DOM_GRP;
198         uint32 rid = 0;
199         gid_t gid;
200         int i;
201         GROUP_MAP *map;
202
203         const char *name_type;
204         const char add_usage_str[] = N_("net groupmap add "
205                                         "{rid=<int>|sid=<string>}"
206                                         " unixgroup=<string> "
207                                         "[type=<domain|local|builtin>] "
208                                         "[ntgroup=<string>] "
209                                         "[comment=<string>]");
210
211         name_type = "domain group";
212
213         if (c->display_usage) {
214                 d_printf("%s\n%s\n", _("Usage:\n"), add_usage_str);
215                 return 0;
216         }
217
218         /* get the options */
219         for ( i=0; i<argc; i++ ) {
220                 if ( !strncasecmp_m(argv[i], "rid", strlen("rid")) ) {
221                         rid = get_int_param(argv[i]);
222                         if ( rid < DOMAIN_RID_ADMINS ) {
223                                 d_fprintf(stderr,
224                                           _("RID must be greater than %d\n"),
225                                           (uint32)DOMAIN_RID_ADMINS-1);
226                                 return -1;
227                         }
228                 }
229                 else if ( !strncasecmp_m(argv[i], "unixgroup", strlen("unixgroup")) ) {
230                         fstrcpy( unixgrp, get_string_param( argv[i] ) );
231                         if ( !unixgrp[0] ) {
232                                 d_fprintf(stderr,_( "must supply a name\n"));
233                                 return -1;
234                         }
235                 }
236                 else if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
237                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
238                         if ( !ntgroup[0] ) {
239                                 d_fprintf(stderr, _("must supply a name\n"));
240                                 return -1;
241                         }
242                 }
243                 else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
244                         fstrcpy( string_sid, get_string_param( argv[i] ) );
245                         if ( !string_sid[0] ) {
246                                 d_fprintf(stderr, _("must supply a SID\n"));
247                                 return -1;
248                         }
249                 }
250                 else if ( !strncasecmp_m(argv[i], "comment", strlen("comment")) ) {
251                         fstrcpy( ntcomment, get_string_param( argv[i] ) );
252                         if ( !ntcomment[0] ) {
253                                 d_fprintf(stderr,
254                                           _("must supply a comment string\n"));
255                                 return -1;
256                         }
257                 }
258                 else if ( !strncasecmp_m(argv[i], "type", strlen("type")) )  {
259                         fstrcpy( type, get_string_param( argv[i] ) );
260                         switch ( type[0] ) {
261                                 case 'b':
262                                 case 'B':
263                                         sid_type = SID_NAME_WKN_GRP;
264                                         name_type = "wellknown group";
265                                         break;
266                                 case 'd':
267                                 case 'D':
268                                         sid_type = SID_NAME_DOM_GRP;
269                                         name_type = "domain group";
270                                         break;
271                                 case 'l':
272                                 case 'L':
273                                         sid_type = SID_NAME_ALIAS;
274                                         name_type = "alias (local) group";
275                                         break;
276                                 default:
277                                         d_fprintf(stderr,
278                                                   _("unknown group type %s\n"),
279                                                   type);
280                                         return -1;
281                         }
282                 }
283                 else {
284                         d_fprintf(stderr, _("Bad option: %s\n"), argv[i]);
285                         return -1;
286                 }
287         }
288
289         if ( !unixgrp[0] ) {
290                 d_printf("%s\n%s\n", _("Usage:\n"), add_usage_str);
291                 return -1;
292         }
293
294         if ( (gid = nametogid(unixgrp)) == (gid_t)-1 ) {
295                 d_fprintf(stderr, _("Can't lookup UNIX group %s\n"), unixgrp);
296                 return -1;
297         }
298
299         map = talloc_zero(NULL, GROUP_MAP);
300         if (!map) {
301                 return -1;
302         }
303         /* Default is domain group. */
304         map->sid_name_use = SID_NAME_DOM_GRP;
305         if (pdb_getgrgid(map, gid)) {
306                 d_printf(_("Unix group %s already mapped to SID %s\n"),
307                          unixgrp, sid_string_tos(&map->sid));
308                 TALLOC_FREE(map);
309                 return -1;
310         }
311         TALLOC_FREE(map);
312
313         if ( (rid == 0) && (string_sid[0] == '\0') ) {
314                 d_printf(_("No rid or sid specified, choosing a RID\n"));
315                 if (pdb_capabilities() & PDB_CAP_STORE_RIDS) {
316                         if (!pdb_new_rid(&rid)) {
317                                 d_printf(_("Could not get new RID\n"));
318                         }
319                 } else {
320                         rid = algorithmic_pdb_gid_to_group_rid(gid);
321                 }
322                 d_printf(_("Got RID %d\n"), rid);
323         }
324
325         /* append the rid to our own domain/machine SID if we don't have a full SID */
326         if ( !string_sid[0] ) {
327                 sid_compose(&sid, get_global_sam_sid(), rid);
328                 sid_to_fstring(string_sid, &sid);
329         }
330
331         if (!ntcomment[0]) {
332                 switch (sid_type) {
333                 case SID_NAME_WKN_GRP:
334                         fstrcpy(ntcomment, "Wellknown Unix group");
335                         break;
336                 case SID_NAME_DOM_GRP:
337                         fstrcpy(ntcomment, "Domain Unix group");
338                         break;
339                 case SID_NAME_ALIAS:
340                         fstrcpy(ntcomment, "Local Unix group");
341                         break;
342                 default:
343                         fstrcpy(ntcomment, "Unix group");
344                         break;
345                 }
346         }
347
348         if (!ntgroup[0] )
349                 strlcpy(ntgroup, unixgrp, sizeof(ntgroup));
350
351         if (!NT_STATUS_IS_OK(add_initial_entry(gid, string_sid, sid_type, ntgroup, ntcomment))) {
352                 d_fprintf(stderr, _("adding entry for group %s failed!\n"), ntgroup);
353                 return -1;
354         }
355
356         d_printf(_("Successfully added group %s to the mapping db as a %s\n"),
357                  ntgroup, name_type);
358         return 0;
359 }
360
361 static int net_groupmap_modify(struct net_context *c, int argc, const char **argv)
362 {
363         struct dom_sid sid;
364         GROUP_MAP *map = NULL;
365         fstring ntcomment = "";
366         fstring type = "";
367         fstring ntgroup = "";
368         fstring unixgrp = "";
369         fstring sid_string = "";
370         enum lsa_SidType sid_type = SID_NAME_UNKNOWN;
371         int i;
372         gid_t gid;
373         const char modify_usage_str[] = N_("net groupmap modify "
374                                            "{ntgroup=<string>|sid=<SID>} "
375                                            "[comment=<string>] "
376                                            "[unixgroup=<string>] "
377                                            "[type=<domain|local>]");
378
379         if (c->display_usage) {
380                 d_printf("%s\n%s\n", _("Usage:\n"), modify_usage_str);
381                 return 0;
382         }
383
384         /* get the options */
385         for ( i=0; i<argc; i++ ) {
386                 if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
387                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
388                         if ( !ntgroup[0] ) {
389                                 d_fprintf(stderr, _("must supply a name\n"));
390                                 return -1;
391                         }
392                 }
393                 else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
394                         fstrcpy( sid_string, get_string_param( argv[i] ) );
395                         if ( !sid_string[0] ) {
396                                 d_fprintf(stderr, _("must supply a name\n"));
397                                 return -1;
398                         }
399                 }
400                 else if ( !strncasecmp_m(argv[i], "comment", strlen("comment")) ) {
401                         fstrcpy( ntcomment, get_string_param( argv[i] ) );
402                         if ( !ntcomment[0] ) {
403                                 d_fprintf(stderr,
404                                           _("must supply a comment string\n"));
405                                 return -1;
406                         }
407                 }
408                 else if ( !strncasecmp_m(argv[i], "unixgroup", strlen("unixgroup")) ) {
409                         fstrcpy( unixgrp, get_string_param( argv[i] ) );
410                         if ( !unixgrp[0] ) {
411                                 d_fprintf(stderr,
412                                           _("must supply a group name\n"));
413                                 return -1;
414                         }
415                 }
416                 else if ( !strncasecmp_m(argv[i], "type", strlen("type")) )  {
417                         fstrcpy( type, get_string_param( argv[i] ) );
418                         switch ( type[0] ) {
419                                 case 'd':
420                                 case 'D':
421                                         sid_type = SID_NAME_DOM_GRP;
422                                         break;
423                                 case 'l':
424                                 case 'L':
425                                         sid_type = SID_NAME_ALIAS;
426                                         break;
427                         }
428                 }
429                 else {
430                         d_fprintf(stderr, _("Bad option: %s\n"), argv[i]);
431                         return -1;
432                 }
433         }
434
435         if ( !ntgroup[0] && !sid_string[0] ) {
436                 d_printf("%s\n%s\n", _("Usage:\n"), modify_usage_str);
437                 return -1;
438         }
439
440         /* give preference to the SID; if both the ntgroup name and SID
441            are defined, use the SID and assume that the group name could be a
442            new name */
443
444         if ( sid_string[0] ) {
445                 if (!get_sid_from_input(&sid, sid_string)) {
446                         return -1;
447                 }
448         }
449         else {
450                 if (!get_sid_from_input(&sid, ntgroup)) {
451                         return -1;
452                 }
453         }
454
455         map = talloc_zero(NULL, GROUP_MAP);
456         if (!map) {
457                 return -1;
458         }
459
460         /* Get the current mapping from the database */
461         if(!pdb_getgrsid(map, sid)) {
462                 d_fprintf(stderr,
463                          _("Failed to find local group SID in the database\n"));
464                 TALLOC_FREE(map);
465                 return -1;
466         }
467
468         /*
469          * Allow changing of group type only between domain and local
470          * We disallow changing Builtin groups !!! (SID problem)
471          */
472         if (sid_type == SID_NAME_UNKNOWN) {
473                 d_fprintf(stderr, _("Can't map to an unknown group type.\n"));
474                 TALLOC_FREE(map);
475                 return -1;
476         }
477
478         if (map->sid_name_use == SID_NAME_WKN_GRP) {
479                 d_fprintf(stderr,
480                           _("You can only change between domain and local "
481                             "groups.\n"));
482                 TALLOC_FREE(map);
483                 return -1;
484         }
485
486         map->sid_name_use = sid_type;
487
488         /* Change comment if new one */
489         if (ntcomment[0]) {
490                 map->comment = talloc_strdup(map, ntcomment);
491                 if (!map->comment) {
492                         d_fprintf(stderr, _("Out of memory!\n"));
493                         return -1;
494                 }
495         }
496
497         if (ntgroup[0]) {
498                 map->nt_name = talloc_strdup(map, ntgroup);
499                 if (!map->nt_name) {
500                         d_fprintf(stderr, _("Out of memory!\n"));
501                         return -1;
502                 }
503         }
504
505         if ( unixgrp[0] ) {
506                 gid = nametogid( unixgrp );
507                 if ( gid == -1 ) {
508                         d_fprintf(stderr, _("Unable to lookup UNIX group %s.  "
509                                             "Make sure the group exists.\n"),
510                                 unixgrp);
511                         TALLOC_FREE(map);
512                         return -1;
513                 }
514
515                 map->gid = gid;
516         }
517
518         if (!NT_STATUS_IS_OK(pdb_update_group_mapping_entry(map))) {
519                 d_fprintf(stderr, _("Could not update group database\n"));
520                 TALLOC_FREE(map);
521                 return -1;
522         }
523
524         d_printf(_("Updated mapping entry for %s\n"), map->nt_name);
525
526         TALLOC_FREE(map);
527         return 0;
528 }
529
530 static int net_groupmap_delete(struct net_context *c, int argc, const char **argv)
531 {
532         struct dom_sid sid;
533         fstring ntgroup = "";
534         fstring sid_string = "";
535         int i;
536         const char delete_usage_str[] = N_("net groupmap delete "
537                                            "{ntgroup=<string>|sid=<SID>}");
538
539         if (c->display_usage) {
540                 d_printf("%s\n%s\n", _("Usage:\n"), delete_usage_str);
541                 return 0;
542         }
543
544         /* get the options */
545         for ( i=0; i<argc; i++ ) {
546                 if ( !strncasecmp_m(argv[i], "ntgroup", strlen("ntgroup")) ) {
547                         fstrcpy( ntgroup, get_string_param( argv[i] ) );
548                         if ( !ntgroup[0] ) {
549                                 d_fprintf(stderr, _("must supply a name\n"));
550                                 return -1;
551                         }
552                 }
553                 else if ( !strncasecmp_m(argv[i], "sid", strlen("sid")) ) {
554                         fstrcpy( sid_string, get_string_param( argv[i] ) );
555                         if ( !sid_string[0] ) {
556                                 d_fprintf(stderr, _("must supply a SID\n"));
557                                 return -1;
558                         }
559                 }
560                 else {
561                         d_fprintf(stderr, _("Bad option: %s\n"), argv[i]);
562                         return -1;
563                 }
564         }
565
566         if ( !ntgroup[0] && !sid_string[0]) {
567                 d_printf("%s\n%s\n", _("Usage:\n"), delete_usage_str);
568                 return -1;
569         }
570
571         /* give preference to the SID if we have that */
572
573         if ( sid_string[0] )
574                 strlcpy(ntgroup, sid_string, sizeof(ntgroup));
575
576         if ( !get_sid_from_input(&sid, ntgroup) ) {
577                 d_fprintf(stderr, _("Unable to resolve group %s to a SID\n"),
578                           ntgroup);
579                 return -1;
580         }
581
582         if ( !NT_STATUS_IS_OK(pdb_delete_group_mapping_entry(sid)) ) {
583                 d_fprintf(stderr,
584                           _("Failed to remove group %s from the mapping db!\n"),
585                           ntgroup);
586                 return -1;
587         }
588
589         d_printf(_("Sucessfully removed %s from the mapping db\n"), ntgroup);
590
591         return 0;
592 }
593
594 static int net_groupmap_set(struct net_context *c, int argc, const char **argv)
595 {
596         const char *ntgroup = NULL;
597         struct group *grp = NULL;
598         GROUP_MAP *map;
599         bool have_map = false;
600
601         if ((argc < 1) || (argc > 2) || c->display_usage) {
602                 d_printf("%s\n%s",
603                          _("Usage:"),
604                          _(" net groupmap set \"NT Group\" "
605                            "[\"unix group\"] [-C \"comment\"] [-L] [-D]\n"));
606                 return -1;
607         }
608
609         if ( c->opt_localgroup && c->opt_domaingroup ) {
610                 d_printf(_("Can only specify -L or -D, not both\n"));
611                 return -1;
612         }
613
614         ntgroup = argv[0];
615
616         if (argc == 2) {
617                 grp = getgrnam(argv[1]);
618
619                 if (grp == NULL) {
620                         d_fprintf(stderr, _("Could not find unix group %s\n"),
621                                   argv[1]);
622                         return -1;
623                 }
624         }
625
626         map = talloc_zero(NULL, GROUP_MAP);
627         if (!map) {
628                 d_printf(_("Out of memory!\n"));
629                 return -1;
630         }
631
632         have_map = pdb_getgrnam(map, ntgroup);
633
634         if (!have_map) {
635                 struct dom_sid sid;
636                 have_map = ( (strncmp(ntgroup, "S-", 2) == 0) &&
637                              string_to_sid(&sid, ntgroup) &&
638                              pdb_getgrsid(map, sid) );
639         }
640
641         if (!have_map) {
642
643                 /* Ok, add it */
644
645                 if (grp == NULL) {
646                         d_fprintf(stderr,
647                                   _("Could not find group mapping for %s\n"),
648                                   ntgroup);
649                         TALLOC_FREE(map);
650                         return -1;
651                 }
652
653                 map->gid = grp->gr_gid;
654
655                 if (c->opt_rid == 0) {
656                         if ( pdb_capabilities() & PDB_CAP_STORE_RIDS ) {
657                                 if ( !pdb_new_rid((uint32*)&c->opt_rid) ) {
658                                         d_fprintf( stderr,
659                                             _("Could not allocate new RID\n"));
660                                         TALLOC_FREE(map);
661                                         return -1;
662                                 }
663                         } else {
664                                 c->opt_rid = algorithmic_pdb_gid_to_group_rid(map->gid);
665                         }
666                 }
667
668                 sid_compose(&map->sid, get_global_sam_sid(), c->opt_rid);
669
670                 map->sid_name_use = SID_NAME_DOM_GRP;
671                 map->nt_name = talloc_strdup(map, ntgroup);
672                 map->comment = talloc_strdup(map, "");
673                 if (!map->nt_name || !map->comment) {
674                         d_printf(_("Out of memory!\n"));
675                         TALLOC_FREE(map);
676                         return -1;
677                 }
678
679                 if (!NT_STATUS_IS_OK(pdb_add_group_mapping_entry(map))) {
680                         d_fprintf(stderr,
681                                   _("Could not add mapping entry for %s\n"),
682                                   ntgroup);
683                         TALLOC_FREE(map);
684                         return -1;
685                 }
686         }
687
688         /* Now we have a mapping entry, update that stuff */
689
690         if ( c->opt_localgroup || c->opt_domaingroup ) {
691                 if (map->sid_name_use == SID_NAME_WKN_GRP) {
692                         d_fprintf(stderr,
693                                   _("Can't change type of the BUILTIN "
694                                     "group %s\n"),
695                                   map->nt_name);
696                         TALLOC_FREE(map);
697                         return -1;
698                 }
699         }
700
701         if (c->opt_localgroup)
702                 map->sid_name_use = SID_NAME_ALIAS;
703
704         if (c->opt_domaingroup)
705                 map->sid_name_use = SID_NAME_DOM_GRP;
706
707         /* The case (opt_domaingroup && opt_localgroup) was tested for above */
708
709         if ((c->opt_comment != NULL) && (strlen(c->opt_comment) > 0)) {
710                 map->comment = talloc_strdup(map, c->opt_comment);
711                 if (!map->comment) {
712                         d_printf(_("Out of memory!\n"));
713                         TALLOC_FREE(map);
714                         return -1;
715                 }
716         }
717
718         if ((c->opt_newntname != NULL) && (strlen(c->opt_newntname) > 0)) {
719                 map->nt_name = talloc_strdup(map, c->opt_newntname);
720                 if (!map->nt_name) {
721                         d_printf(_("Out of memory!\n"));
722                         TALLOC_FREE(map);
723                         return -1;
724                 }
725         }
726
727         if (grp != NULL)
728                 map->gid = grp->gr_gid;
729
730         if (!NT_STATUS_IS_OK(pdb_update_group_mapping_entry(map))) {
731                 d_fprintf(stderr, _("Could not update group mapping for %s\n"),
732                           ntgroup);
733                 TALLOC_FREE(map);
734                 return -1;
735         }
736
737         TALLOC_FREE(map);
738         return 0;
739 }
740
741 static int net_groupmap_cleanup(struct net_context *c, int argc, const char **argv)
742 {
743         GROUP_MAP **maps = NULL;
744         size_t i, entries;
745
746         if (c->display_usage) {
747                 d_printf(  "%s\n"
748                            "net groupmap cleanup\n"
749                            "    %s\n",
750                          _("Usage:"),
751                          _("Delete all group mappings"));
752                 return 0;
753         }
754
755         if (!pdb_enum_group_mapping(NULL, SID_NAME_UNKNOWN, &maps, &entries,
756                                     ENUM_ALL_MAPPED)) {
757                 d_fprintf(stderr, _("Could not list group mappings\n"));
758                 return -1;
759         }
760
761         for (i=0; i<entries; i++) {
762
763                 if (maps[i]->gid == -1)
764                         printf(_("Group %s is not mapped\n"),
765                                 maps[i]->nt_name);
766
767                 if (!sid_check_is_in_our_domain(&maps[i]->sid)) {
768                         printf(_("Deleting mapping for NT Group %s, sid %s\n"),
769                                 maps[i]->nt_name,
770                                 sid_string_tos(&maps[i]->sid));
771                         pdb_delete_group_mapping_entry(maps[i]->sid);
772                 }
773         }
774
775         TALLOC_FREE(maps);
776         return 0;
777 }
778
779 static int net_groupmap_addmem(struct net_context *c, int argc, const char **argv)
780 {
781         struct dom_sid alias, member;
782
783         if ( (argc != 2) ||
784              c->display_usage ||
785              !string_to_sid(&alias, argv[0]) ||
786              !string_to_sid(&member, argv[1]) ) {
787                 d_printf("%s\n%s",
788                          _("Usage:"),
789                          _("net groupmap addmem alias-sid member-sid\n"));
790                 return -1;
791         }
792
793         if (!NT_STATUS_IS_OK(pdb_add_aliasmem(&alias, &member))) {
794                 d_fprintf(stderr, _("Could not add sid %s to alias %s\n"),
795                          argv[1], argv[0]);
796                 return -1;
797         }
798
799         return 0;
800 }
801
802 static int net_groupmap_delmem(struct net_context *c, int argc, const char **argv)
803 {
804         struct dom_sid alias, member;
805
806         if ( (argc != 2) ||
807              c->display_usage ||
808              !string_to_sid(&alias, argv[0]) ||
809              !string_to_sid(&member, argv[1]) ) {
810                 d_printf("%s\n%s",
811                          _("Usage:"),
812                          _("net groupmap delmem alias-sid member-sid\n"));
813                 return -1;
814         }
815
816         if (!NT_STATUS_IS_OK(pdb_del_aliasmem(&alias, &member))) {
817                 d_fprintf(stderr, _("Could not delete sid %s from alias %s\n"),
818                          argv[1], argv[0]);
819                 return -1;
820         }
821
822         return 0;
823 }
824
825 static int net_groupmap_listmem(struct net_context *c, int argc, const char **argv)
826 {
827         struct dom_sid alias;
828         struct dom_sid *members;
829         size_t i, num;
830
831         if ( (argc != 1) ||
832              c->display_usage ||
833              !string_to_sid(&alias, argv[0]) ) {
834                 d_printf("%s\n%s",
835                          _("Usage:"),
836                          _("net groupmap listmem alias-sid\n"));
837                 return -1;
838         }
839
840         members = NULL;
841         num = 0;
842
843         if (!NT_STATUS_IS_OK(pdb_enum_aliasmem(&alias, talloc_tos(),
844                                                &members, &num))) {
845                 d_fprintf(stderr, _("Could not list members for sid %s\n"),
846                           argv[0]);
847                 return -1;
848         }
849
850         for (i = 0; i < num; i++) {
851                 printf("%s\n", sid_string_tos(&(members[i])));
852         }
853
854         TALLOC_FREE(members);
855
856         return 0;
857 }
858
859 static bool print_alias_memberships(TALLOC_CTX *mem_ctx,
860                                     const struct dom_sid *domain_sid,
861                                     const struct dom_sid *member)
862 {
863         uint32 *alias_rids;
864         size_t i, num_alias_rids;
865
866         alias_rids = NULL;
867         num_alias_rids = 0;
868
869         if (!NT_STATUS_IS_OK(pdb_enum_alias_memberships(
870                                      mem_ctx, domain_sid, member, 1,
871                                      &alias_rids, &num_alias_rids))) {
872                 d_fprintf(stderr, _("Could not list memberships for sid %s\n"),
873                          sid_string_tos(member));
874                 return false;
875         }
876
877         for (i = 0; i < num_alias_rids; i++) {
878                 struct dom_sid alias;
879                 sid_compose(&alias, domain_sid, alias_rids[i]);
880                 printf("%s\n", sid_string_tos(&alias));
881         }
882
883         return true;
884 }
885
886 static int net_groupmap_memberships(struct net_context *c, int argc, const char **argv)
887 {
888         TALLOC_CTX *mem_ctx;
889         struct dom_sid *domain_sid, member;
890
891         if ( (argc != 1) ||
892              c->display_usage ||
893              !string_to_sid(&member, argv[0]) ) {
894                 d_printf("%s\n%s",
895                          _("Usage:"),
896                          _("net groupmap memberships sid\n"));
897                 return -1;
898         }
899
900         mem_ctx = talloc_init("net_groupmap_memberships");
901         if (mem_ctx == NULL) {
902                 d_fprintf(stderr, _("talloc_init failed\n"));
903                 return -1;
904         }
905
906         domain_sid = get_global_sam_sid();
907         if (domain_sid == NULL) {
908                 d_fprintf(stderr, _("Could not get domain sid\n"));
909                 return -1;
910         }
911
912         if (!print_alias_memberships(mem_ctx, domain_sid, &member) ||
913             !print_alias_memberships(mem_ctx, &global_sid_Builtin, &member))
914                 return -1;
915
916         talloc_destroy(mem_ctx);
917
918         return 0;
919 }
920
921 /***********************************************************
922  migrated functionality from smbgroupedit
923  **********************************************************/
924 int net_groupmap(struct net_context *c, int argc, const char **argv)
925 {
926         struct functable func[] = {
927                 {
928                         "add",
929                         net_groupmap_add,
930                         NET_TRANSPORT_LOCAL,
931                         N_("Create a new group mapping"),
932                         N_("net groupmap add\n"
933                            "    Create a new group mapping")
934                 },
935                 {
936                         "modify",
937                         net_groupmap_modify,
938                         NET_TRANSPORT_LOCAL,
939                         N_("Update a group mapping"),
940                         N_("net groupmap modify\n"
941                            "    Modify an existing group mapping")
942                 },
943                 {
944                         "delete",
945                         net_groupmap_delete,
946                         NET_TRANSPORT_LOCAL,
947                         N_("Remove a group mapping"),
948                         N_("net groupmap delete\n"
949                            "    Remove a group mapping")
950                 },
951                 {
952                         "set",
953                         net_groupmap_set,
954                         NET_TRANSPORT_LOCAL,
955                         N_("Set group mapping"),
956                         N_("net groupmap set\n"
957                            "    Set a group mapping")
958                 },
959                 {
960                         "cleanup",
961                         net_groupmap_cleanup,
962                         NET_TRANSPORT_LOCAL,
963                         N_("Remove foreign group mapping entries"),
964                         N_("net groupmap cleanup\n"
965                            "    Remove foreign group mapping entries")
966                 },
967                 {
968                         "addmem",
969                         net_groupmap_addmem,
970                         NET_TRANSPORT_LOCAL,
971                         N_("Add a foreign alias member"),
972                         N_("net groupmap addmem\n"
973                            "    Add a foreign alias member")
974                 },
975                 {
976                         "delmem",
977                         net_groupmap_delmem,
978                         NET_TRANSPORT_LOCAL,
979                         N_("Delete foreign alias member"),
980                         N_("net groupmap delmem\n"
981                            "    Delete foreign alias member")
982                 },
983                 {
984                         "listmem",
985                         net_groupmap_listmem,
986                         NET_TRANSPORT_LOCAL,
987                         N_("List foreign group members"),
988                         N_("net groupmap listmem\n"
989                            "    List foreign alias members")
990                 },
991                 {
992                         "memberships",
993                         net_groupmap_memberships,
994                         NET_TRANSPORT_LOCAL,
995                         N_("List foreign group memberships"),
996                         N_("net groupmap memberships\n"
997                            "    List foreign group memberships")
998                 },
999                 {
1000                         "list",
1001                         net_groupmap_list,
1002                         NET_TRANSPORT_LOCAL,
1003                         N_("List current group map"),
1004                         N_("net groupmap list\n"
1005                            "    List current group map")
1006                 },
1007                 {NULL, NULL, 0, NULL, NULL}
1008         };
1009
1010         return net_run_function(c,argc, argv, "net groupmap", func);
1011 }
1012