source3/winbindd/idmap_adex/idmap_adex.c

   1 /*
   2  * idmap_adex: Support for D Forests
   3  *
   4  * Copyright (C) Gerald (Jerry) Carter 2006-2008
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 #include "includes.h"
  22 #include "ads.h"
  23 #include "idmap.h"
  24 #include "idmap_adex.h"
  25 #include "nss_info.h"
  26 #include "secrets.h"
  27
  28 #undef DBGC_CLASS
  29 #define DBGC_CLASS DBGC_IDMAP
  30
  31 #define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
  32
  33 NTSTATUS init_module(void);
  34
  35 /*
  36  * IdMap backend
  37  */
  38
  39 /********************************************************************
  40  Basic init function responsible for determining our current mode
  41  (standalone or using Centeris Cells).  This must return success or
  42  it will be dropped from the idmap backend list.
  43  *******************************************************************/
  44
  45 static NTSTATUS _idmap_adex_init(struct idmap_domain *dom,
  46                                      const char *params)
  47 {
  48         ADS_STRUCT *ads = NULL;
  49         ADS_STATUS status;
  50         static NTSTATUS init_status = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
  51         struct dom_sid domain_sid;
  52         fstring dcname;
  53         struct sockaddr_storage ip;
  54         struct likewise_cell *lwcell;
  55
  56         if (NT_STATUS_IS_OK(init_status))
  57                 return NT_STATUS_OK;
  58
  59         /* Silently fail if we are not a member server in security = ads */
  60
  61         if ((lp_server_role() != ROLE_DOMAIN_MEMBER) ||
  62             (lp_security() != SEC_ADS)) {
  63                 init_status = NT_STATUS_INVALID_SERVER_STATE;
  64                 BAIL_ON_NTSTATUS_ERROR(init_status);
  65         }
  66
  67         /* fetch our domain SID first */
  68
  69         if (!secrets_fetch_domain_sid(lp_workgroup(), &domain_sid)) {
  70                 init_status = NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
  71                 BAIL_ON_NTSTATUS_ERROR(init_status);
  72         }
  73
  74         /* reuse the same ticket cache as winbindd */
  75
  76         setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
  77
  78         /* Establish a connection to a DC */
  79
  80         if ((ads = ads_init(lp_realm(), lp_workgroup(), NULL)) == NULL) {
  81                 init_status = NT_STATUS_NO_MEMORY;
  82                 BAIL_ON_NTSTATUS_ERROR(init_status);
  83         }
  84
  85         ads->auth.password =
  86             secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
  87         ads->auth.realm = SMB_STRDUP(lp_realm());
  88
  89         /* get the DC name here to setup the server affinity cache and
  90            local krb5.conf */
  91
  92         get_dc_name(lp_workgroup(), lp_realm(), dcname, &ip);
  93
  94         status = ads_connect(ads);
  95         if (!ADS_ERR_OK(status)) {
  96                 DEBUG(0, ("_idmap_adex_init: ads_connect() failed! (%s)\n",
  97                           ads_errstr(status)));
  98         }
  99         init_status = ads_ntstatus(status);
 100         BAIL_ON_NTSTATUS_ERROR(init_status);
 101
 102
 103         /* Find out cell membership */
 104
 105         init_status = cell_locate_membership(ads);
 106         if (!NT_STATUS_IS_OK(init_status)) {
 107                 DEBUG(0,("LWI: Fail to locate cell membership (%s).",
 108                          nt_errstr(init_status)));
 109                 goto done;
 110         }
 111
 112         /* Fill in the cell information */
 113
 114         lwcell = cell_list_head();
 115
 116         init_status = cell_lookup_settings(lwcell);
 117         BAIL_ON_NTSTATUS_ERROR(init_status);
 118
 119         /* Miscellaneous setup.  E.g. set up the list of GC
 120            servers and domain list for our forest (does not actually
 121            connect). */
 122
 123         init_status = gc_init_list();
 124         BAIL_ON_NTSTATUS_ERROR(init_status);
 125
 126         init_status = domain_init_list();
 127         BAIL_ON_NTSTATUS_ERROR(init_status);
 128
 129 done:
 130         if (!NT_STATUS_IS_OK(init_status)) {
 131                 DEBUG(1,("Likewise initialization failed (%s)\n",
 132                          nt_errstr(init_status)));
 133         }
 134
 135         /* cleanup */
 136
 137         if (!NT_STATUS_IS_OK(init_status)) {
 138                 cell_list_destroy();
 139
 140                 /* init_status stores the failure reason but we need to
 141                    return success or else idmap_init() will drop us from the
 142                    backend list */
 143                 return NT_STATUS_OK;
 144         }
 145
 146         init_status = NT_STATUS_OK;
 147
 148         return init_status;
 149 }
 150
 151 /**********************************************************************
 152  *********************************************************************/
 153
 154 static NTSTATUS _idmap_adex_get_sid_from_id(struct
 155                                                 idmap_domain
 156                                                 *dom, struct
 157                                                 id_map
 158                                                 **ids)
 159 {
 160         int i;
 161         bool one_mapped = false;
 162         bool all_mapped = true;
 163         NTSTATUS nt_status;
 164         struct likewise_cell *cell;
 165
 166         /* initialize the status to avoid suprise */
 167         for (i = 0; ids[i]; i++) {
 168                 ids[i]->status = ID_UNKNOWN;
 169         }
 170
 171         nt_status = _idmap_adex_init(dom, NULL);
 172         if (!NT_STATUS_IS_OK(nt_status))
 173                 return nt_status;
 174
 175         if ((cell = cell_list_head()) == NULL) {
 176                 return NT_STATUS_INVALID_SERVER_STATE;
 177         }
 178
 179         /* have to work through these one by one */
 180         for (i = 0; ids[i]; i++) {
 181                 NTSTATUS status;
 182                 status = cell->provider->get_sid_from_id(ids[i]->sid,
 183                                                          ids[i]->xid.id,
 184                                                          ids[i]->xid.type);
 185                 /* Fail if we cannot find any DC */
 186                 if (NT_STATUS_EQUAL
 187                     (status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
 188                         return status;
 189                 }
 190
 191                 if (!NT_STATUS_IS_OK(status)) {
 192                         ids[i]->status = ID_UNMAPPED;
 193                         all_mapped = false;
 194                         continue;
 195                 }
 196
 197                 ids[i]->status = ID_MAPPED;
 198                 one_mapped = true;
 199         }
 200
 201         return NT_STATUS_OK;
 202 }
 203
 204 /**********************************************************************
 205  *********************************************************************/
 206
 207 static NTSTATUS _idmap_adex_get_id_from_sid(struct
 208                                                 idmap_domain
 209                                                 *dom, struct
 210                                                 id_map
 211                                                 **ids)
 212 {
 213         int i;
 214         bool one_mapped = false;
 215         bool all_mapped = true;
 216         NTSTATUS nt_status;
 217         struct likewise_cell *cell;
 218
 219         /* initialize the status to avoid suprise */
 220         for (i = 0; ids[i]; i++) {
 221                 ids[i]->status = ID_UNKNOWN;
 222         }
 223
 224         nt_status = _idmap_adex_init(dom, NULL);
 225         if (!NT_STATUS_IS_OK(nt_status))
 226                 return nt_status;
 227
 228         if ((cell = cell_list_head()) == NULL) {
 229                 return NT_STATUS_INVALID_SERVER_STATE;
 230         }
 231
 232         /* have to work through these one by one */
 233         for (i = 0; ids[i]; i++) {
 234                 NTSTATUS status;
 235                 status = cell->provider->get_id_from_sid(&ids[i]->xid.id,
 236                                                          &ids[i]->xid.
 237                                                          type, ids[i]->sid);
 238                 /* Fail if we cannot find any DC */
 239                 if (NT_STATUS_EQUAL
 240                     (status, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
 241                         return status;
 242                 }
 243
 244                 if (!NT_STATUS_IS_OK(status)) {
 245                         ids[i]->status = ID_UNMAPPED;
 246                         all_mapped = false;
 247                         continue;
 248                 }
 249
 250                 ids[i]->status = ID_MAPPED;
 251                 one_mapped = true;
 252         }
 253
 254         return NT_STATUS_OK;
 255 }
 256
 257 /*
 258  * IdMap NSS plugin
 259  */
 260
 261 /**********************************************************************
 262  *********************************************************************/
 263
 264 static NTSTATUS _nss_adex_init(struct nss_domain_entry
 265                                   *e)
 266 {
 267         return _idmap_adex_init(NULL, NULL);
 268 }
 269
 270 /**********************************************************************
 271  *********************************************************************/
 272
 273 static NTSTATUS _nss_adex_get_info(struct
 274                                       nss_domain_entry *e,
 275                                       const struct dom_sid * sid,
 276                                       TALLOC_CTX * ctx,
 277                                       const char **homedir,
 278                                       const char **shell,
 279                                       const char **gecos, gid_t * p_gid)
 280 {
 281         NTSTATUS nt_status;
 282         struct likewise_cell *cell;
 283
 284         nt_status = _idmap_adex_init(NULL, NULL);
 285         if (!NT_STATUS_IS_OK(nt_status))
 286                 return nt_status;
 287
 288         if ((cell = cell_list_head()) == NULL) {
 289                 return NT_STATUS_INVALID_SERVER_STATE;
 290         }
 291
 292         return cell->provider->get_nss_info(sid, ctx, homedir,
 293                                             shell, gecos, p_gid);
 294 }
 295
 296 /**********************************************************************
 297  *********************************************************************/
 298
 299 static NTSTATUS _nss_adex_map_to_alias(TALLOC_CTX * mem_ctx,
 300                                        struct nss_domain_entry *e,
 301                                        const char *name, char **alias)
 302 {
 303         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 304         struct likewise_cell *cell = NULL;
 305
 306         nt_status = _idmap_adex_init(NULL, NULL);
 307         BAIL_ON_NTSTATUS_ERROR(nt_status);
 308
 309         if ((cell = cell_list_head()) == NULL) {
 310                 nt_status = NT_STATUS_INVALID_SERVER_STATE;
 311                 BAIL_ON_NTSTATUS_ERROR(nt_status);
 312         }
 313
 314         nt_status = cell->provider->map_to_alias(mem_ctx, e->domain,
 315                                                  name, alias);
 316
 317         /* go ahead and allow the cache mgr to mark this in
 318            negative cache */
 319
 320         if (!NT_STATUS_IS_OK(nt_status))
 321                 nt_status = NT_STATUS_NONE_MAPPED;
 322
 323 done:
 324         return nt_status;
 325 }
 326
 327 /**********************************************************************
 328  *********************************************************************/
 329
 330 static NTSTATUS _nss_adex_map_from_alias(TALLOC_CTX * mem_ctx,
 331                                          struct nss_domain_entry *e,
 332                                          const char *alias, char **name)
 333 {
 334         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 335         struct likewise_cell *cell = NULL;
 336
 337         nt_status = _idmap_adex_init(NULL, NULL);
 338         BAIL_ON_NTSTATUS_ERROR(nt_status);
 339
 340         if ((cell = cell_list_head()) == NULL) {
 341                 nt_status = NT_STATUS_INVALID_SERVER_STATE;
 342                 BAIL_ON_NTSTATUS_ERROR(nt_status);
 343         }
 344
 345
 346         nt_status = cell->provider->map_from_alias(mem_ctx, e->domain,
 347                                                    alias, name);
 348
 349         /* go ahead and allow the cache mgr to mark this in
 350            negative cache */
 351
 352         if (!NT_STATUS_IS_OK(nt_status))
 353                 nt_status = NT_STATUS_NONE_MAPPED;
 354
 355 done:
 356         return nt_status;
 357 }
 358
 359 /**********************************************************************
 360  *********************************************************************/
 361
 362 static NTSTATUS _nss_adex_close(void)
 363 {
 364         return NT_STATUS_NOT_IMPLEMENTED;
 365 }
 366
 367 /**********************************************************************
 368  *********************************************************************/
 369
 370 static struct idmap_methods adex_idmap_methods = {
 371
 372         .init             = _idmap_adex_init,
 373         .unixids_to_sids  = _idmap_adex_get_sid_from_id,
 374         .sids_to_unixids  = _idmap_adex_get_id_from_sid,
 375 };
 376 static struct nss_info_methods adex_nss_methods = {
 377         .init           = _nss_adex_init,
 378         .get_nss_info   = _nss_adex_get_info,
 379         .map_to_alias   = _nss_adex_map_to_alias,
 380         .map_from_alias = _nss_adex_map_from_alias,
 381         .close_fn       = _nss_adex_close
 382 };
 383
 384 /**********************************************************************
 385  Register with the idmap and idmap_nss subsystems. We have to protect
 386  against the idmap and nss_info interfaces being in a half-registered
 387  state.
 388  **********************************************************************/
 389 NTSTATUS idmap_adex_init(void)
 390 {
 391         static NTSTATUS idmap_status = NT_STATUS_UNSUCCESSFUL;
 392         static NTSTATUS nss_status = NT_STATUS_UNSUCCESSFUL;
 393         if (!NT_STATUS_IS_OK(idmap_status)) {
 394                 idmap_status =
 395                     smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
 396                                        "adex", &adex_idmap_methods);
 397                 if (!NT_STATUS_IS_OK(idmap_status)) {
 398                         DEBUG(0,
 399                               ("idmap_centeris_init: Failed to register the adex"
 400                                "idmap plugin.\n"));
 401                         return idmap_status;
 402                 }
 403         }
 404
 405         if (!NT_STATUS_IS_OK(nss_status)) {
 406                 nss_status =
 407                     smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
 408                                            "adex", &adex_nss_methods);
 409                 if (!NT_STATUS_IS_OK(nss_status)) {
 410                         DEBUG(0,
 411                               ("idmap_adex_init: Failed to register the adex"
 412                                "nss plugin.\n"));
 413                         return nss_status;
 414                 }
 415         }
 416
 417         return NT_STATUS_OK;
 418 }