libads/authdata.o libads/cldap.o
LIBADS_SERVER_OBJ = libads/util.o libads/kerberos_verify.o \
- libads/ldap_schema.o sam/nss_info.o
+ libads/ldap_schema.o nsswitch/nss_info.o
SECRETS_OBJ = passdb/secrets.o passdb/machine_sid.o
NET_OBJ = $(NET_OBJ1) $(PARAM_OBJ) $(SECRETS_OBJ) $(LIBSMB_OBJ) \
$(RPC_PARSE_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \
$(KRBCLIENT_OBJ) $(LIB_NONSMBD_OBJ) $(LIBADDNS_OBJ0) \
- $(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) $(IDMAP_OBJ) \
+ $(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) \
$(LIBADS_OBJ) $(LIBADS_SERVER_OBJ) $(POPT_LIB_OBJ) \
$(SMBLDAP_OBJ) $(DCUTIL_OBJ) $(SERVER_MUTEX_OBJ) \
$(AFS_OBJ) $(AFS_SETTOKEN_OBJ) $(REGFIO_OBJ) $(READLINE_OBJ) \
$(SECRETS_OBJ) $(SMBLDAP_OBJ) $(LIBSAMBA_OBJ) \
$(RPC_PARSE_OBJ1) $(DOSERR_OBJ) $(LDB_OBJ)
-IDMAP_OBJ = sam/idmap.o sam/idmap_util.o @IDMAP_STATIC@
+IDMAP_OBJ = nsswitch/idmap.o nsswitch/idmap_cache.o nsswitch/idmap_util.o @IDMAP_STATIC@
WINBINDD_OBJ1 = \
nsswitch/winbindd.o \
LDB_CMDLINE_OBJ = $(PARAM_OBJ) $(SECRETS_OBJ) $(LIBSMB_OBJ) \
$(RPC_PARSE_OBJ) $(PASSDB_OBJ) $(GROUPDB_OBJ) \
$(KRBCLIENT_OBJ) $(LIB_NONSMBD_OBJ) $(LIBADDNS_OBJ0) \
- $(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) $(IDMAP_OBJ) \
+ $(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) \
$(LIBADS_OBJ) $(LIBADS_SERVER_OBJ) $(POPT_LIB_OBJ) \
$(SMBLDAP_OBJ) $(DCUTIL_OBJ) $(SERVER_MUTEX_OBJ) \
$(AFS_OBJ) $(AFS_SETTOKEN_OBJ) $(REGFIO_OBJ) $(READLINE_OBJ) \
@$(SHLD) $(LDSHFLAGS) -o $@ passdb/pdb_smbpasswd.o \
@SONAMEFLAG@`basename $@`
-bin/rid.@SHLIBEXT@: sam/idmap_rid.o
+bin/rid.@SHLIBEXT@: nsswitch/idmap_rid.o
@echo "Building plugin $@"
- @$(SHLD) $(LDSHFLAGS) -o $@ sam/idmap_rid.o \
+ @$(SHLD) $(LDSHFLAGS) -o $@ nsswitch/idmap_rid.o \
@SONAMEFLAG@`basename $@`
-bin/ad.@SHLIBEXT@: sam/idmap_ad.o
+bin/ad.@SHLIBEXT@: nsswitch/idmap_ad.o
@echo "Building plugin $@"
- @$(SHLD) $(LDSHFLAGS) -o $@ sam/idmap_ad.o \
+ @$(SHLD) $(LDSHFLAGS) -o $@ nsswitch/idmap_ad.o \
@SONAMEFLAG@`basename $@`
bin/weird.@SHLIBEXT@: $(DEVEL_HELP_WEIRD_OBJ)
NTSTATUS status;
gid_t gid;
+ DEBUG(10, ("Create local NT token for %s\n", sid_string_static(user_sid)));
+
if (!(result = TALLOC_ZERO_P(mem_ctx, NT_USER_TOKEN))) {
DEBUG(0, ("talloc failed\n"));
return NULL;
NTSTATUS create_local_token(auth_serversupplied_info *server_info)
{
TALLOC_CTX *mem_ctx;
+ struct id_map *ids;
NTSTATUS status;
size_t i;
server_info->groups = NULL;
/* Start at index 1, where the groups start. */
+ ids = talloc_zero_array(mem_ctx, struct id_map, server_info->ptok->num_sids);
+ for (i = 0; i < server_info->ptok->num_sids-1; i++) {
+ ids[i].sid = &server_info->ptok->user_sids[i + 1]; /* store the sids */
+ }
- for (i=1; i<server_info->ptok->num_sids; i++) {
- gid_t gid;
- DOM_SID *sid = &server_info->ptok->user_sids[i];
+ if (!winbind_sids_to_unixids(ids, server_info->ptok->num_sids-1)) {
+ DEBUG(2, ("Query to map secondary SIDs failed!\n"));
+ }
- if (!sid_to_gid(sid, &gid)) {
+ for (i = 0; i < server_info->ptok->num_sids-1; i++) {
+ if ( ! ids[i].mapped) {
DEBUG(10, ("Could not convert SID %s to gid, "
- "ignoring it\n", sid_string_static(sid)));
+ "ignoring it\n", sid_string_static(ids[i].sid)));
continue;
}
- if (!add_gid_to_array_unique(server_info, gid, &server_info->groups,
+ if ( ! ids[i].xid.type == ID_TYPE_UID) {
+ DEBUG(10, ("SID %s is a User ID (%u) not a Group ID, "
+ "ignoring it\n", sid_string_static(ids[i].sid), ids[i].xid.id));
+ continue;
+ }
+ if (!add_gid_to_array_unique(server_info, (gid_t)ids[i].xid.id, &server_info->groups,
&server_info->n_groups)) {
TALLOC_FREE(mem_ctx);
return NT_STATUS_NO_MEMORY;
}
}
-
+
debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
status = log_nt_token(mem_ctx, server_info->ptok);
MODULE_rpc_spoolss=STATIC
MODULE_rpc_srvsvc=STATIC
MODULE_idmap_tdb=STATIC
+MODULE_idmap_passdb=STATIC
+MODULE_idmap_nss=STATIC
AC_ARG_WITH(static-modules,
[ --with-static-modules=MODULES Comma-seperated list of names of modules to statically link in],
SMB_MODULE(rpc_unixinfo, \$(RPC_UNIXINFO_OBJ), "bin/librpc_unixinfo.$SHLIBEXT", RPC)
SMB_SUBSYSTEM(RPC,smbd/server.o)
-SMB_MODULE(idmap_ldap, sam/idmap_ldap.o, "bin/ldap.$SHLIBEXT", IDMAP)
-SMB_MODULE(idmap_tdb, sam/idmap_tdb.o, "bin/tdb.$SHLIBEXT", IDMAP)
-SMB_MODULE(idmap_rid, sam/idmap_rid.o, "bin/rid.$SHLIBEXT", IDMAP)
-SMB_MODULE(idmap_ad, sam/idmap_ad.o, "bin/ad.$SHLIBEXT", IDMAP)
-SMB_SUBSYSTEM(IDMAP,sam/idmap.o)
+SMB_MODULE(idmap_ldap, nsswitch/idmap_ldap.o, "bin/ldap.$SHLIBEXT", IDMAP)
+SMB_MODULE(idmap_tdb, nsswitch/idmap_tdb.o, "bin/tdb.$SHLIBEXT", IDMAP)
+SMB_MODULE(idmap_passdb, nsswitch/idmap_passdb.o, "bin/passdb.$SHLIBEXT", IDMAP)
+SMB_MODULE(idmap_nss, nsswitch/idmap_nss.o, "bin/nss.$SHLIBEXT", IDMAP)
+SMB_MODULE(idmap_rid, nsswitch/idmap_rid.o, "bin/rid.$SHLIBEXT", IDMAP)
+SMB_MODULE(idmap_ad, nsswitch/idmap_ad.o, "bin/ad.$SHLIBEXT", IDMAP)
+SMB_SUBSYSTEM(IDMAP, nsswitch/idmap.o)
SMB_MODULE(charset_weird, modules/weird.o, "bin/weird.$SHLIBEXT", CHARSET)
SMB_MODULE(charset_CP850, modules/CP850.o, "bin/CP850.$SHLIBEXT", CHARSET)
DLIST_ADD(list, p); \
} while (0)
-/* hook into the end of the list - needs a tmp pointer */
+/* hook into the end of the list - needs the entry type */
#define DLIST_ADD_END(list, p, type) \
do { \
if (!(list)) { \
/* The interface version specifier.
Updated to 3 for enum types by JRA. */
-#define SMB_IDMAP_INTERFACE_VERSION 3
+/* Updated to 4, completely new interface, SSS */
-enum idmap_type { ID_USERID, ID_GROUPID };
+#define SMB_IDMAP_INTERFACE_VERSION 4
-#define IDMAP_FLAG_NONE 0x0
-#define IDMAP_FLAG_QUERY_ONLY 0x1 /* Don't ever allocate, just query. */
-#define IDMAP_FLAG_CACHE_ONLY 0x2 /* Only look in our local cache, not remote. */
+struct idmap_domain {
+ DOM_SID *sid;
+ const char *name;
+ BOOL default_domain;
+ BOOL readonly;
+ void *private_data;
+ struct idmap_methods *methods;
+};
/* Filled out by IDMAP backends */
struct idmap_methods {
/* Called when backend is first loaded */
- NTSTATUS (*init)( const char *params );
+ NTSTATUS (*init)(struct idmap_domain *dom, const char *compat_params);
+
+ NTSTATUS (*unixids_to_sids)(struct idmap_domain *dom, struct id_map **ids);
+ NTSTATUS (*sids_to_unixids)(struct idmap_domain *dom, struct id_map **ids);
+ NTSTATUS (*set_mapping)(struct idmap_domain *dom, const struct id_map *map);
+ NTSTATUS (*remove_mapping)(struct idmap_domain *dom, const struct id_map *map);
- NTSTATUS (*allocate_id)(unid_t *id, enum idmap_type id_type);
- NTSTATUS (*get_sid_from_id)(DOM_SID *sid, unid_t id, enum idmap_type id_type, int flags);
- NTSTATUS (*get_id_from_sid)(unid_t *id, enum idmap_type *id_type, const DOM_SID *sid, int flags);
- NTSTATUS (*set_mapping)(const DOM_SID *sid, unid_t id, enum idmap_type id_type);
+ /* Called to dump backends data */
+ /* NOTE: caller must use talloc_free to free maps when done */
+ NTSTATUS (*dump_data)(struct idmap_domain *dom, struct id_map **maps, int *num_maps);
/* Called when backend is unloaded */
- NTSTATUS (*close_fn)(void);
+ NTSTATUS (*close_fn)(struct idmap_domain *dom);
+};
+
+struct idmap_alloc_methods {
- /* Called to dump backend status */
- void (*status)(void);
+ /* Called when backend is first loaded */
+ NTSTATUS (*init)(const char *compat_params);
+
+ NTSTATUS (*allocate_id)(struct unixid *id);
+ NTSTATUS (*get_id_hwm)(struct unixid *id);
+ NTSTATUS (*set_id_hwm)(struct unixid *id);
+
+ /* Called when backend is unloaded */
+ NTSTATUS (*close_fn)(void);
};
+
#endif /* _IDMAP_H_ */
BOOL (*uid_to_rid)(struct pdb_methods *methods, uid_t uid,
uint32 *rid);
+ BOOL (*uid_to_sid)(struct pdb_methods *methods, uid_t uid,
+ DOM_SID *sid);
BOOL (*gid_to_sid)(struct pdb_methods *methods, gid_t gid,
DOM_SID *sid);
BOOL (*sid_to_id)(struct pdb_methods *methods, const DOM_SID *sid,
#define dom_sid2 dom_sid
#define dom_sid28 dom_sid
+enum id_type {
+ ID_TYPE_UID,
+ ID_TYPE_GID
+};
+
+struct unixid {
+ uint32_t id;
+ enum id_type type;
+};
+
+struct id_map {
+ DOM_SID *sid;
+ struct unixid xid;
+ BOOL mapped;
+};
+
#include "librpc/ndr/misc.h"
#include "librpc/ndr/security.h"
#include "librpc/ndr/libndr.h"
time_t last_ping;
/* retrive-once info */
const char *uri;
+
+ /* credentials */
+ BOOL anonimous;
char *bind_dn;
char *bind_secret;
+
BOOL paged_results;
unsigned int num_failures;
if (freeit) {
SAFE_FREE(*whop);
- memset(*credp, '\0', strlen(*credp));
+ if (*credp) {
+ memset(*credp, '\0', strlen(*credp));
+ }
SAFE_FREE(*credp);
} else {
DEBUG(5,("rebind_proc_with_state: Rebinding as \"%s\"\n",
- ldap_state->bind_dn));
+ ldap_state->bind_dn?ldap_state->bind_dn:"[Anonymous bind]"));
- *whop = SMB_STRDUP(ldap_state->bind_dn);
- if (!*whop) {
- return LDAP_NO_MEMORY;
- }
- *credp = SMB_STRDUP(ldap_state->bind_secret);
- if (!*credp) {
- SAFE_FREE(*whop);
- return LDAP_NO_MEMORY;
+ if (ldap_state->anonymous) {
+ *whop = NULL;
+ *credp = NULL;
+ } else {
+ *whop = SMB_STRDUP(ldap_state->bind_dn);
+ if (!*whop) {
+ return LDAP_NO_MEMORY;
+ }
+ *credp = SMB_STRDUP(ldap_state->bind_secret);
+ if (!*credp) {
+ SAFE_FREE(*whop);
+ return LDAP_NO_MEMORY;
+ }
}
*methodp = LDAP_AUTH_SIMPLE;
}
int version;
DEBUG(5,("rebindproc_connect_with_state: Rebinding to %s as \"%s\"\n",
- url, ldap_state->bind_dn));
+ url, ldap_state->bind_dn?ldap_state->bind_dn:"[Anonymous bind]"));
/* call START_TLS again (ldaps:// is handled by the OpenLDAP library
* itself) before rebinding to another LDAP server to avoid to expose
static int smbldap_connect_system(struct smbldap_state *ldap_state, LDAP * ldap_struct)
{
int rc;
- char *ldap_dn;
- char *ldap_secret;
int version;
- /* get the password */
- if (!fetch_ldap_pw(&ldap_dn, &ldap_secret)) {
- DEBUG(0, ("ldap_connect_system: Failed to retrieve password from secrets.tdb\n"));
- return LDAP_INVALID_CREDENTIALS;
- }
+ if (!ldap_state->anonimous && !ldap_state->bind_dn) {
- ldap_state->bind_dn = ldap_dn;
- ldap_state->bind_secret = ldap_secret;
+ /* get the default dn and password only if they are not set already */
+ if (!fetch_ldap_pw(&ldap_state->bind_dn, &ldap_state->bind_secret)) {
+ DEBUG(0, ("ldap_connect_system: Failed to retrieve password from secrets.tdb\n"));
+ return LDAP_INVALID_CREDENTIALS;
+ }
+ }
/* removed the sasl_bind_s "EXTERNAL" stuff, as my testsuite
(OpenLDAP) doesnt' seem to support it */
DEBUG(10,("ldap_connect_system: Binding to ldap server %s as \"%s\"\n",
- ldap_state->uri, ldap_dn));
+ ldap_state->uri, ldap_state->bind_dn));
#ifdef HAVE_LDAP_SET_REBIND_PROC
#if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
#endif /*defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)*/
#endif
- rc = ldap_simple_bind_s(ldap_struct, ldap_dn, ldap_secret);
+ rc = ldap_simple_bind_s(ldap_struct, ldap_state->bind_dn, ldap_state->bind_secret);
if (rc != LDAP_SUCCESS) {
char *ld_error = NULL;
DEBUG(ldap_state->num_failures ? 2 : 0,
("failed to bind to server %s with dn=\"%s\" Error: %s\n\t%s\n",
ldap_state->uri,
- ldap_dn ? ldap_dn : "(unknown)", ldap_err2string(rc),
+ ldap_state->bind_dn ? ldap_state->bind_dn : "[Anonymous bind]",
+ ldap_err2string(rc),
ld_error ? ld_error : "(unknown)"));
SAFE_FREE(ld_error);
ldap_state->num_failures++;
DEBUG(5,("The connection to the LDAP server was closed\n"));
/* maybe free the results here --metze */
-
-
return NT_STATUS_OK;
}
const char *attrs[] = { "namingContexts", NULL };
return smbldap_check_root_dse(ld, attrs, naming_context);
}
+
+BOOL smbldap_set_creds(struct smbldap_state *ldap_state, BOOL anon, const char *dn, const char *secret)
+{
+ ldap_state->anonimous = anon;
+
+ /* free any previously set credential */
+
+ SAFE_FREE(ldap_state->bind_dn);
+ if (ldap_state->bind_secret) {
+ /* make sure secrets are zeroed out of memory */
+ memset(ldap_state->bind_secret, '\0', strlen(ldap_state->bind_secret));
+ SAFE_FREE(ldap_state->bind_secret);
+ }
+
+ if ( ! anon) {
+ ldap_state->bind_dn = SMB_STRDUP(dn);
+ ldap_state->bind_secret = SMB_STRDUP(secret);
+ }
+
+ return True;
+}
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+ ID Mapping
+ Copyright (C) Tim Potter 2000
+ Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
+ Copyright (C) Simo Sorce 2003
+ Copyright (C) Jeremy Allison 2006
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/
+
+#include "includes.h"
+#include "winbindd.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_IDMAP
+
+static_decl_idmap;
+
+struct idmap_backend {
+ const char *name;
+ struct idmap_methods *methods;
+ struct idmap_backend *prev, *next;
+};
+
+struct idmap_alloc_backend {
+ const char *name;
+ struct idmap_alloc_methods *methods;
+ struct idmap_alloc_backend *prev, *next;
+};
+
+struct idmap_cache_ctx;
+
+static TALLOC_CTX *idmap_ctx = NULL;
+static struct idmap_cache_ctx *idmap_cache;
+
+static struct idmap_backend *backends = NULL;
+static struct idmap_domain **idmap_domains = NULL;
+static int num_domains = 0;
+static int pdb_dom_num = -1;
+static int def_dom_num = -1;
+
+static struct idmap_alloc_backend *alloc_backends = NULL;
+static struct idmap_alloc_methods *alloc_methods = NULL;
+
+#define IDMAP_CHECK_RET(ret) do { if ( ! NT_STATUS_IS_OK(ret)) { DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); goto done; } } while(0)
+#define IDMAP_CHECK_ALLOC(mem) do { if (!mem) { DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; goto done; } } while(0)
+
+static struct idmap_methods *get_methods(struct idmap_backend *be, const char *name)
+{
+ struct idmap_backend *b;
+
+ for (b = be; b; b = b->next) {
+ if (strequal(b->name, name)) {
+ return b->methods;
+ }
+ }
+
+ return NULL;
+}
+
+static struct idmap_alloc_methods *get_alloc_methods(struct idmap_alloc_backend *be, const char *name)
+{
+ struct idmap_alloc_backend *b;
+
+ for (b = be; b; b = b->next) {
+ if (strequal(b->name, name)) {
+ return b->methods;
+ }
+ }
+
+ return NULL;
+}
+
+/**********************************************************************
+ Allow a module to register itself as a method.
+**********************************************************************/
+
+NTSTATUS smb_register_idmap(int version, const char *name, struct idmap_methods *methods)
+{
+ struct idmap_methods *test;
+ struct idmap_backend *entry;
+
+ if (!idmap_ctx) {
+ return NT_STATUS_INTERNAL_DB_ERROR;
+ }
+
+ if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
+ DEBUG(0, ("Failed to register idmap module.\n"
+ "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
+ "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
+ "Please recompile against the current version of samba!\n",
+ version, SMB_IDMAP_INTERFACE_VERSION));
+ return NT_STATUS_OBJECT_TYPE_MISMATCH;
+ }
+
+ if (!name || !name[0] || !methods) {
+ DEBUG(0,("Called with NULL pointer or empty name!\n"));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ test = get_methods(backends, name);
+ if (test) {
+ DEBUG(0,("Idmap module %s already registered!\n", name));
+ return NT_STATUS_OBJECT_NAME_COLLISION;
+ }
+
+ entry = talloc(idmap_ctx, struct idmap_backend);
+ if ( ! entry) {
+ DEBUG(0,("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+ entry->name = talloc_strdup(idmap_ctx, name);
+ if ( ! entry->name) {
+ DEBUG(0,("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+ entry->methods = methods;
+
+ DLIST_ADD(backends, entry);
+ DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
+ return NT_STATUS_OK;
+}
+
+/**********************************************************************
+ Allow a module to register itself as a method.
+**********************************************************************/
+
+NTSTATUS smb_register_idmap_alloc(int version, const char *name, struct idmap_alloc_methods *methods)
+{
+ struct idmap_alloc_methods *test;
+ struct idmap_alloc_backend *entry;
+
+ if (!idmap_ctx) {
+ return NT_STATUS_INTERNAL_DB_ERROR;
+ }
+
+ if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
+ DEBUG(0, ("Failed to register idmap alloc module.\n"
+ "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
+ "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
+ "Please recompile against the current version of samba!\n",
+ version, SMB_IDMAP_INTERFACE_VERSION));
+ return NT_STATUS_OBJECT_TYPE_MISMATCH;
+ }
+
+ if (!name || !name[0] || !methods) {
+ DEBUG(0,("Called with NULL pointer or empty name!\n"));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ test = get_alloc_methods(alloc_backends, name);
+ if (test) {
+ DEBUG(0,("idmap_alloc module %s already registered!\n", name));
+ return NT_STATUS_OBJECT_NAME_COLLISION;
+ }
+
+ entry = talloc(idmap_ctx, struct idmap_alloc_backend);
+ if ( ! entry) {
+ DEBUG(0,("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+ entry->name = talloc_strdup(idmap_ctx, name);
+ if ( ! entry->name) {
+ DEBUG(0,("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+ entry->methods = methods;
+
+ DLIST_ADD(alloc_backends, entry);
+ DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name));
+ return NT_STATUS_OK;
+}
+
+static int close_domain_destructor(struct idmap_domain *dom)
+{
+ NTSTATUS ret;
+
+ ret = dom->methods->close_fn(dom);
+ if (!NT_STATUS_IS_OK(ret)) {
+ DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom->name));
+ }
+
+ return 0;
+}
+
+/**************************************************************************
+ Shutdown.
+**************************************************************************/
+
+NTSTATUS idmap_close(void)
+{
+ /* close the alloc backend first before freeing idmap_ctx */
+ if (alloc_methods) {
+ alloc_methods->close_fn();
+ alloc_methods = NULL;
+ }
+ alloc_backends = NULL;
+
+ /* this talloc_free call will fire the talloc destructors
+ * that will free all active backends resources */
+ TALLOC_FREE(idmap_ctx);
+ idmap_cache = NULL;
+ idmap_domains = NULL;
+ backends = NULL;
+
+ return NT_STATUS_OK;
+}
+
+/**********************************************************************
+ Initialise idmap cache and a remote backend (if configured).
+**********************************************************************/
+
+static const char *idmap_default_domain[] = { "default domain", NULL };
+
+NTSTATUS idmap_init(void)
+{
+ NTSTATUS ret;
+ struct idmap_domain *dom;
+ const char *compat_backend = NULL;
+ const char *compat_params = NULL;
+ const char **dom_list = NULL;
+ char *alloc_backend;
+ BOOL default_already_defined = False;
+ BOOL pri_dom_is_in_list = False;
+ int compat = 0;
+ int i;
+
+ if (idmap_ctx) {
+ return NT_STATUS_OK;
+ }
+
+ idmap_ctx = talloc_named_const(NULL, 0, "IDMAP MEMORY CONTEXT");
+ if ( ! idmap_ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* init cache */
+ idmap_cache = idmap_cache_init(idmap_ctx);
+ if ( ! idmap_cache) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ /* register static backends */
+ static_init_idmap;
+
+ if ((dom_list = lp_idmap_domains()) != NULL) {
+ if (lp_idmap_backend()) {
+ DEBUG(0, ("WARNING: idmap backend and idmap domains are mutually excusive!\n"));
+ DEBUGADD(0, (" idmap backend option will be IGNORED!\n"));
+ }
+
+ } else if (lp_idmap_backend()) {
+ const char **compat_list = lp_idmap_backend();
+ const char *p;
+
+ DEBUG(0, ("WARNING: idmap backend is deprecated!\n"));
+ compat = 1;
+
+ /* strip any leading idmap_ prefix of */
+ if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
+ p = *compat_list += 6;
+ DEBUG(0, ("WARNING: idmap backend uses obsolete and deprecated 'idmap_' prefix.\n"));
+ DEBUGADD(0, (" Please replace 'idmap_%s' by '%s' in %s\n", p, p, dyn_CONFIGFILE));
+ compat_backend = p;
+ } else {
+ compat_backend = *compat_list;
+ }
+
+ if ((p = strchr(compat_backend, ':')) != NULL) {
+ compat_params = p + 1;
+ }
+ }
+
+ if ( ! dom_list) {
+ dom_list = idmap_default_domain;
+ }
+
+ /***************************
+ * initialize idmap domains
+ */
+ DEBUG(1, ("Initializing idmap domains\n"));
+
+ for (i = 0; dom_list[i]; i++) {
+ const char *parm_backend;
+ char *config_option;
+
+ if (strequal(dom_list[i], lp_workgroup())) {
+ pri_dom_is_in_list = True;
+ }
+ /* init domain */
+
+ dom = talloc_zero(idmap_ctx, struct idmap_domain);
+ IDMAP_CHECK_ALLOC(dom);
+
+ dom->name = talloc_strdup(dom, dom_list[i]);
+ IDMAP_CHECK_ALLOC(dom->name);
+
+ config_option = talloc_asprintf(dom, "idmap config %s", dom->name);
+ IDMAP_CHECK_ALLOC(config_option);
+
+ /* default or specific ? */
+
+ dom->default_domain = lp_parm_bool(-1, config_option, "default", False);
+ if (dom->default_domain ||
+ strequal(dom_list[i], idmap_default_domain[0])) {
+ /* the default domain is a cacth all domain
+ * so no specific domain sid is provided */
+ dom->sid = NULL;
+ /* make sure this is set even when we match idmap_default_domain[0] */
+ dom->default_domain = True;
+
+ if (lp_parm_const_string(-1, config_option, "domain sid", NULL)) {
+ DEBUG(1, ("WARNING: Can't force a /domain sid/ on the DEFAULT domain, Ignoring!"));
+ }
+
+ /* only one default domain is permitted */
+ if (default_already_defined) {
+ DEBUG(1, ("ERROR: Multiple domains defined as default!\n"));
+ ret = NT_STATUS_INVALID_PARAMETER;
+ goto done;
+ }
+
+ default_already_defined = True;
+
+ } else {
+ const char *sid;
+
+ sid = lp_parm_const_string(-1, config_option, "domain sid", NULL);
+ if (sid) {
+ dom->sid = string_sid_talloc(dom, sid);
+ } else {
+ struct winbindd_domain *wdom = find_domain_from_name(dom->name);
+ if (wdom) {
+ dom->sid = sid_dup_talloc(dom, &wdom->sid);
+ IDMAP_CHECK_ALLOC(dom->sid);
+ }
+ }
+
+ if ( ! dom->sid) {
+ DEBUG(1, ("ERROR: Could not find DOMAIN SID for domain %s\n", dom->name));
+ DEBUGADD(1, (" Consider to set explicitly the /domain sid/ option\n"));
+ ret = NT_STATUS_NO_SUCH_DOMAIN;
+ goto done;
+ }
+ }
+
+ /* is this a readonly domain ? */
+ dom->readonly = lp_parm_bool(-1, config_option, "readonly", False);
+
+ /* find associated backend (default: tdb) */
+ if (compat) {
+ parm_backend = talloc_strdup(idmap_ctx, compat_backend);
+ } else {
+ parm_backend =
+ talloc_strdup(idmap_ctx,
+ lp_parm_const_string(-1, config_option, "backend", "tdb"));
+ }
+ IDMAP_CHECK_ALLOC(parm_backend);
+
+ /* get the backend methods for this domain */
+ dom->methods = get_methods(backends, parm_backend);
+
+ if ( ! dom->methods) {
+ ret = smb_probe_module("idmap", parm_backend);
+ if (NT_STATUS_IS_OK(ret)) {
+ dom->methods = get_methods(backends, parm_backend);
+ }
+ }
+ if ( ! dom->methods) {
+ DEBUG(0, ("ERROR: Could not get methods for backend %s\n", parm_backend));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ /* check the set_mapping function exists otherwise mark the module as readonly */
+ if ( ! dom->methods->set_mapping) {
+ dom->readonly = True;
+ }
+
+ /* now that we have methods, set the destructor for this domain */
+ talloc_set_destructor(dom, close_domain_destructor);
+
+ /* Finally instance a backend copy for this domain */
+ ret = dom->methods->init(dom, compat_params);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(0, ("ERROR: Initialization failed for backend %s (domain %s)\n",
+ parm_backend, dom->name));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+ idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, i+1);
+ if ( ! idmap_domains) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ idmap_domains[i] = dom;
+
+ if (dom->default_domain) { /* save default domain position for future uses */
+ def_dom_num = i;
+ }
+
+ DEBUG(10, ("Domain %s - Sid %s - Backend %s - %sdefault - %sreadonly\n",
+ dom->name, sid_string_static(dom->sid), parm_backend,
+ dom->default_domain?"":"not ", dom->readonly?"":"not "));
+
+ talloc_free(config_option);
+ }
+
+ /* save the number of domains we have */
+ num_domains = i;
+
+ /* automatically add idmap_nss backend if needed */
+ if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
+ ( ! pri_dom_is_in_list) &&
+ lp_winbind_trusted_domains_only()) {
+ DOM_SID our_sid;
+
+ if (!secrets_fetch_domain_sid(lp_workgroup(), &our_sid)) {
+ DEBUG(0, ("Could not fetch our SID - did we join?\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ dom = talloc_zero(idmap_ctx, struct idmap_domain);
+ IDMAP_CHECK_ALLOC(dom);
+
+ dom->name = talloc_strdup(dom, lp_workgroup());
+ IDMAP_CHECK_ALLOC(dom->name);
+
+ dom->default_domain = False;
+ dom->readonly = True;
+
+ dom->sid = sid_dup_talloc(dom, &our_sid);
+ IDMAP_CHECK_ALLOC(dom->sid);
+
+ /* get the backend methods for passdb */
+ dom->methods = get_methods(backends, "nss");
+
+ /* (the nss module is always statically linked) */
+ if ( ! dom->methods) {
+ DEBUG(0, ("ERROR: Could not get methods for idmap_nss ?!\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ /* now that we have methods, set the destructor for this domain */
+ talloc_set_destructor(dom, close_domain_destructor);
+
+ /* Finally instance a backend copy for this domain */
+ ret = dom->methods->init(dom, compat_params);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(0, ("ERROR: Initialization failed for idmap_nss ?!\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, num_domains+1);
+ if ( ! idmap_domains) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ idmap_domains[num_domains] = dom;
+
+ DEBUG(10, ("Domain %s - Sid %s - Backend nss - not default - readonly\n",
+ dom->name, sid_string_static(dom->sid)));
+
+ num_domains++;
+ }
+
+ /**** automatically add idmap_passdb backend ****/
+ dom = talloc_zero(idmap_ctx, struct idmap_domain);
+ IDMAP_CHECK_ALLOC(dom);
+
+ dom->name = talloc_strdup(dom, get_global_sam_name());
+ IDMAP_CHECK_ALLOC(dom->name);
+
+ dom->default_domain = False;
+ dom->readonly = True;
+
+ dom->sid = sid_dup_talloc(dom, get_global_sam_sid());
+ IDMAP_CHECK_ALLOC(dom->sid);
+
+ /* get the backend methods for passdb */
+ dom->methods = get_methods(backends, "passdb");
+
+ /* (the passdb module is always statically linked) */
+ if ( ! dom->methods) {
+ DEBUG(0, ("ERROR: Could not get methods for idmap_passdb ?!\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ /* now that we have methods, set the destructor for this domain */
+ talloc_set_destructor(dom, close_domain_destructor);
+
+ /* Finally instance a backend copy for this domain */
+ ret = dom->methods->init(dom, compat_params);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(0, ("ERROR: Initialization failed for idmap_passdb ?!\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, num_domains+1);
+ if ( ! idmap_domains) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ idmap_domains[num_domains] = dom;
+
+ /* needed to handle special BUILTIN and wellknown SIDs cases */
+ pdb_dom_num = num_domains;
+
+ DEBUG(10, ("Domain %s - Sid %s - Backend passdb - not default - readonly\n",
+ dom->name, sid_string_static(dom->sid)));
+ DEBUGADD(10, (" (special: includes handling BUILTIN and Wellknown SIDs as well)\n"));
+
+ num_domains++;
+ /**** finished adding idmap_passdb backend ****/
+
+ /* sort domains so that the default is the last one */
+ if (def_dom_num != num_domains-1) { /* default is not last, move it */
+ struct idmap_domain *tmp;
+
+ if (pdb_dom_num > def_dom_num) {
+ pdb_dom_num --;
+
+ } else if (pdb_dom_num == def_dom_num) { /* ?? */
+ pdb_dom_num = num_domains - 1;
+ }
+
+ tmp = idmap_domains[def_dom_num];
+
+ for (i = def_dom_num; i < num_domains-1; i++) {
+ idmap_domains[i] = idmap_domains[i+1];
+ }
+ idmap_domains[i] = tmp;
+ def_dom_num = i;
+ }
+
+
+ /***************************
+ * initialize alloc module
+ */
+ DEBUG(1, ("Initializing idmap alloc module\n"));
+
+ if (compat) {
+ alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
+ } else {
+ char *ab = lp_idmap_alloc_backend();
+
+ if (ab && (ab[0] != '\0')) {
+ alloc_backend = talloc_strdup(idmap_ctx, lp_idmap_alloc_backend());
+ } else {
+ alloc_backend = talloc_strdup(idmap_ctx, "tdb");
+ }
+ }
+ IDMAP_CHECK_ALLOC(alloc_backend);
+
+ alloc_methods = get_alloc_methods(alloc_backends, alloc_backend);
+ if ( ! alloc_methods) {
+ ret = smb_probe_module("idmap", alloc_backend);
+ if (NT_STATUS_IS_OK(ret)) {
+ alloc_methods = get_alloc_methods(alloc_backends, alloc_backend);
+ }
+ }
+ if ( ! alloc_methods) {
+ DEBUG(0, ("ERROR: Could not get methods for alloc backend %s\n", alloc_backend));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ ret = alloc_methods->init(compat_params);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(0, ("ERROR: Initialization failed for alloc backend %s\n", alloc_backend));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ return NT_STATUS_OK;
+
+done:
+ DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
+ idmap_close();
+ return ret;
+}
+
+/**************************************************************************
+ idmap allocator interface functions
+**************************************************************************/
+
+NTSTATUS idmap_allocate_uid(struct unixid *id)
+{
+ NTSTATUS ret;
+
+ if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ return ret;
+ }
+
+ id->type = ID_TYPE_UID;
+ return alloc_methods->allocate_id(id);
+}
+
+NTSTATUS idmap_allocate_gid(struct unixid *id)
+{
+ NTSTATUS ret;
+
+ if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ return ret;
+ }
+
+ id->type = ID_TYPE_GID;
+ return alloc_methods->allocate_id(id);
+}
+
+NTSTATUS idmap_set_uid_hwm(struct unixid *id)
+{
+ NTSTATUS ret;
+
+ if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ return ret;
+ }
+
+ id->type = ID_TYPE_UID;
+ return alloc_methods->set_id_hwm(id);
+}
+
+NTSTATUS idmap_set_gid_hwm(struct unixid *id)
+{
+ NTSTATUS ret;
+
+ if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ return ret;
+ }
+
+ id->type = ID_TYPE_GID;
+ return alloc_methods->set_id_hwm(id);
+}
+
+/*********************************************************
+ Check if creating a mapping is permitted for the domain
+*********************************************************/
+
+static NTSTATUS idmap_can_map(const struct id_map *map, struct idmap_domain **ret_dom)
+{
+ struct idmap_domain *dom;
+ int i;
+
+ /* Check we do not create mappings for our own local domain, or BUILTIN or special SIDs */
+ if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
+ sid_check_is_in_builtin(map->sid) ||
+ sid_check_is_in_wellknown_domain(map->sid)) {
+ DEBUG(10, ("We are not supposed to create mappings for our own domains (local, builtin, specials)\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ /* Special check for trusted domain only = Yes */
+ if (lp_winbind_trusted_domains_only()) {
+ struct winbindd_domain *wdom = find_our_domain();
+ if (wdom && (sid_compare_domain(map->sid, &wdom->sid) == 0)) {
+ DEBUG(10, ("We are not supposed to create mappings for our primary domain when <trusted domain only> is True\n"));
+ DEBUGADD(10, ("Leave [%s] unmapped\n", sid_string_static(map->sid)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+ }
+
+ for (i = 0, dom = NULL; i < num_domains; i++) {
+ if ((idmap_domains[i]->default_domain) || /* ok set it into the default domain */
+ (sid_compare_domain(idmap_domains[i]->sid, map->sid) == 0)) { /* ok found a specific domain */
+ dom = idmap_domains[i];
+ break;
+ }
+ }
+
+ if (! dom) {
+ /* huh, couldn't find a suitable domain, let's just leave it unmapped */
+ DEBUG(10, ("Could not find imdap backend for SID %s", sid_string_static(map->sid)));
+ return NT_STATUS_NO_SUCH_DOMAIN;
+ }
+
+ if (dom->readonly) {
+ /* ouch the domain is read only, let's just leave it unmapped */
+ DEBUG(10, ("imdap backend for SID %s is READONLY!\n", sid_string_static(map->sid)));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ *ret_dom = dom;
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS idmap_new_mapping(TALLOC_CTX *ctx, struct id_map *map)
+{
+ NTSTATUS ret;
+ struct idmap_domain *dom;
+ char *domname, *name;
+ enum lsa_SidType sid_type;
+
+ ret = idmap_can_map(map, &dom);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ /* check if this is a valid SID and then map it */
+ if (winbindd_lookup_name_by_sid(ctx, map->sid, &domname, &name, &sid_type)) {
+ switch (sid_type) {
+ case SID_NAME_USER:
+ ret = idmap_allocate_uid(&map->xid);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* can't allocate id, let's just leave it unmapped */
+ DEBUG(2, ("uid allocation failed! Can't create mapping\n"));
+ return NT_STATUS_NONE_MAPPED;
+ }
+ break;
+ case SID_NAME_DOM_GRP:
+ case SID_NAME_ALIAS:
+ case SID_NAME_WKN_GRP:
+ ret = idmap_allocate_gid(&map->xid);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* can't allocate id, let's just leave it unmapped */
+ DEBUG(2, ("gid allocation failed! Can't create mapping\n"));
+ return NT_STATUS_NONE_MAPPED;
+ }
+ break;
+ default:
+ /* invalid sid, let's just leave it unmapped */
+ DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map->sid)));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ /* ok, got a new id, let's set a mapping */
+ map->mapped = True;
+
+ DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
+ sid_string_static(map->sid),
+ (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
+ (unsigned long)map->xid.id));
+ ret = dom->methods->set_mapping(dom, map);
+
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* something wrong here :-( */
+ DEBUG(2, ("Failed to commit mapping\n!"));
+
+ /* TODO: would it make sense to have an "unalloc_id function?" */
+
+ return NT_STATUS_NONE_MAPPED;
+ }
+ } else {
+ DEBUG(2,("Invalid SID, not mapping %s (type %d)\n",
+ sid_string_static(map->sid), sid_type));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS idmap_backends_set_mapping(const struct id_map *map)
+{
+ struct idmap_domain *dom;
+ NTSTATUS ret;
+
+ DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
+ sid_string_static(map->sid),
+ (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
+ (unsigned long)map->xid.id));
+
+ ret = idmap_can_map(map, &dom);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ return ret;
+ }
+
+ DEBUG(10, ("set_mapping for domain %s(%s)\n", dom->name, sid_string_static(dom->sid)));
+
+ return dom->methods->set_mapping(dom, map);
+}
+
+static NTSTATUS idmap_backends_unixids_to_sids(struct id_map **ids)
+{
+ struct idmap_domain *dom;
+ struct id_map **_ids;
+ TALLOC_CTX *ctx;
+ NTSTATUS ret;
+ int i, u, n;
+
+ if (!ids || !*ids) {
+ DEBUG(1, ("Invalid list of maps\n"));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ ctx = talloc_named_const(NULL, 0, "idmap_backends_unixids_to_sids ctx");
+ if ( ! ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ DEBUG(10, ("Query backends to map ids->sids\n"));
+
+ /* start from the default (the last one) and then if there are still
+ * unmapped entries cycle through the others */
+
+ _ids = ids;
+
+ /* make sure all maps are marked as false */
+ for (i = 0; _ids[i]; i++) {
+ _ids[i]->mapped = False;
+ }
+
+ for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
+ struct id_map **unmapped = NULL;
+
+ dom = idmap_domains[n];
+
+ DEBUG(10, ("Query sids from domain %s(%s)\n", dom->name, sid_string_static(dom->sid)));
+
+ ret = dom->methods->unixids_to_sids(dom, _ids);
+ IDMAP_CHECK_RET(ret);
+
+ TALLOC_FREE(unmapped);
+
+ for (i = 0, u = 0; _ids[i]; i++) {
+ if (_ids[i]->mapped == False) {
+ unmapped = talloc_realloc(ctx, unmapped, struct id_map *, u + 2);
+ IDMAP_CHECK_ALLOC(unmapped);
+ unmapped[u] = _ids[i];
+ u++;
+ }
+ }
+ if (unmapped) {
+ /* terminate the unmapped list */
+ unmapped[u] = NULL;
+ } else { /* no more unmapped entries, get out */
+ break;
+ }
+
+ _ids = unmapped;
+ }
+
+ if (!_ids) {
+ /* there are still unmapped ids, map them to the unix users/groups domains */
+ for (i = 0; _ids[i]; i++) {
+ switch (_ids[i]->xid.type) {
+ case ID_TYPE_UID:
+ uid_to_unix_users_sid((uid_t)_ids[i]->xid.id, _ids[i]->sid);
+ _ids[i]->mapped = True;
+ break;
+ case ID_TYPE_GID:
+ gid_to_unix_groups_sid((gid_t)_ids[i]->xid.id, _ids[i]->sid);
+ _ids[i]->mapped = True;
+ break;
+ default: /* what?! */
+ _ids[i]->mapped = False;
+ break;
+ }
+ }
+ }
+
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(ctx);
+ return ret;
+}
+
+static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
+{
+ struct id_map ***dom_ids;
+ struct idmap_domain *dom;
+ TALLOC_CTX *ctx;
+ NTSTATUS ret;
+ int i, *counters;
+
+ if (!ids || !*ids) {
+ DEBUG(1, ("Invalid list of maps\n"));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ ctx = talloc_named_const(NULL, 0, "idmap_backends_sids_to_unixids ctx");
+ if ( ! ctx) {
+ DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ DEBUG(10, ("Query backends to map sids->ids\n"));
+
+ /* split list per domain */
+ dom_ids = talloc_zero_array(ctx, struct id_map **, num_domains);
+ IDMAP_CHECK_ALLOC(dom_ids);
+ counters = talloc_zero_array(ctx, int, num_domains);
+
+ for (i = 0; ids[i]; i++) {
+ int dom_num;
+
+ /* make sure they are unmapped by default */
+ ids[i]->mapped = False;
+
+ for (dom_num = 0, dom = NULL; dom_num < num_domains; dom_num++) {
+ if (idmap_domains[dom_num]->default_domain) {
+ /* we got to the default domain */
+ dom = idmap_domains[dom_num];
+ break;
+ }
+ if (sid_compare_domain(idmap_domains[dom_num]->sid, ids[i]->sid) == 0) {
+ dom = idmap_domains[dom_num];
+ break;
+ }
+ }
+ if (( ! dom) || dom->default_domain) {
+ /* handle BUILTIN or Special SIDs
+ * and prevent them from falling into the default domain space */
+ if ((sid_check_is_in_builtin(ids[i]->sid) ||
+ sid_check_is_in_wellknown_domain(ids[i]->sid))) {
+
+ if (pdb_dom_num != -1) {
+ dom = idmap_domains[pdb_dom_num];
+ dom_num = pdb_dom_num;
+ } else {
+ dom = NULL;
+ }
+ }
+ }
+ if ( ! dom) {
+ /* no dom move on */
+ continue;
+ }
+
+ DEBUG(10, ("SID %s is being handled by %s(%d)\n",
+ sid_string_static(ids[i]->sid),
+ dom?dom->name:"none",
+ dom_num));
+
+ dom_ids[dom_num] = talloc_realloc(ctx, dom_ids[dom_num], struct id_map *, counters[dom_num] + 2);
+ IDMAP_CHECK_ALLOC(dom_ids[dom_num]);
+
+ dom_ids[dom_num][counters[dom_num]] = ids[i];
+ counters[dom_num]++;
+ dom_ids[dom_num][counters[dom_num]] = NULL;
+ }
+
+ /* ok all the ids have been dispatched in the right queues
+ * let's cycle through the filled ones */
+
+ for (i = 0; i < num_domains; i++) {
+ if (dom_ids[i]) { /* ok, we have ids in this one */
+ dom = idmap_domains[i];
+ DEBUG(10, ("Query ids from domain %s(%s)\n", dom->name, sid_string_static(dom->sid)));
+ ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
+ IDMAP_CHECK_RET(ret);
+ }
+ }
+
+ /* ok all the backends have been contacted at this point */
+ /* let's see if we have any unmapped SID left and act accordingly */
+
+ for (i = 0; ids[i]; i++) {
+ if ( ! ids[i]->mapped) { /* ok this is an unmapped one, see if we can map it */
+ ret = idmap_new_mapping(ctx, ids[i]);
+ if (NT_STATUS_IS_OK(ret)) {
+ /* successfully mapped */
+ ids[i]->mapped = True;
+ } else if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
+ /* could not map it */
+ ids[i]->mapped = False;
+ } else{
+ /* Something very bad happened down there */
+ goto done;
+ }
+ }
+ }
+
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(ctx);
+ return ret;
+}
+
+/**************************************************************************
+ idmap interface functions
+**************************************************************************/
+
+NTSTATUS idmap_unixids_to_sids(struct id_map **ids)
+{
+ TALLOC_CTX *ctx;
+ NTSTATUS ret;
+ struct id_map **bids;
+ int i, bi;
+ int bn = 0;
+
+ if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ return ret;
+ }
+
+ if (!ids || !*ids) {
+ DEBUG(1, ("Invalid list of maps\n"));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ ctx = talloc_named_const(NULL, 0, "idmap_unixids_to_sids ctx");
+ if ( ! ctx) {
+ DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* no ids to be asked to the backends by default */
+ bids = NULL;
+ bi = 0;
+
+ for (i = 0; ids[i]; i++) {
+
+ if ( ! ids[i]->sid) {
+ DEBUG(1, ("invalid null SID in id_map array"));
+ talloc_free(ctx);
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ ret = idmap_cache_map_id(idmap_cache, ids[i]);
+
+ /* TODO: handle NT_STATUS_SYNCHRONIZATION_REQUIRED for disconnected mode */
+
+ if ( ! NT_STATUS_IS_OK(ret)) {
+
+ if ( ! bids) {
+ /* alloc space for ids to be resolved by backends (realloc ten by ten) */
+ bids = talloc_array(ctx, struct id_map *, 10);
+ if ( ! bids) {
+ DEBUG(1, ("Out of memory!\n"));
+ talloc_free(ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+ bn = 10;
+ }
+
+ /* add this id to the ones to be retrieved from the backends */
+ bids[bi] = ids[i];
+ bi++;
+
+ /* check if we need to allocate new space on the rids array */
+ if (bi == bn) {
+ bn += 10;
+ bids = talloc_realloc(ctx, bids, struct id_map *, bn);
+ if ( ! bids) {
+ DEBUG(1, ("Out of memory!\n"));
+ talloc_free(ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+ }
+
+ /* make sure the last element is NULL */
+ bids[bi] = NULL;
+ }
+ }
+
+ /* let's see if there is any id mapping to be retieved from the backends */
+ if (bi) {
+ ret = idmap_backends_unixids_to_sids(bids);
+ IDMAP_CHECK_RET(ret);
+
+ /* update the cache */
+ for (i = 0; i < bi; i++) {
+ if (bids[i]->mapped) {
+ ret = idmap_cache_set(idmap_cache, bids[i]);
+ } else {
+ ret = idmap_cache_set_negative_id(idmap_cache, bids[i]);
+ }
+ IDMAP_CHECK_RET(ret);
+ }
+ }
+
+ ret = NT_STATUS_OK;
+done:
+ talloc_free(ctx);
+ return ret;
+}
+
+NTSTATUS idmap_sids_to_unixids(struct id_map **ids)
+{
+ TALLOC_CTX *ctx;
+ NTSTATUS ret;
+ struct id_map **bids;
+ int i, bi;
+ int bn = 0;
+
+ if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ return ret;
+ }
+
+ if (!ids || !*ids) {
+ DEBUG(1, ("Invalid list of maps\n"));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ ctx = talloc_named_const(NULL, 0, "idmap_sids_to_unixids ctx");
+ if ( ! ctx) {
+ DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* no ids to be asked to the backends by default */
+ bids = NULL;
+ bi = 0;
+
+ for (i = 0; ids[i]; i++) {
+
+ if ( ! ids[i]->sid) {
+ DEBUG(1, ("invalid null SID in id_map array\n"));
+ talloc_free(ctx);
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ ret = idmap_cache_map_sid(idmap_cache, ids[i]);
+
+ /* TODO: handle NT_STATUS_SYNCHRONIZATION_REQUIRED for disconnected mode */
+
+ if ( ! NT_STATUS_IS_OK(ret)) {
+
+ if ( ! bids) {
+ /* alloc space for ids to be resolved by backends (realloc ten by ten) */
+ bids = talloc_array(ctx, struct id_map *, 10);
+ if ( ! bids) {
+ DEBUG(1, ("Out of memory!\n"));
+ talloc_free(ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+ bn = 10;
+ }
+
+ /* add this id to the ones to be retrieved from the backends */
+ bids[bi] = ids[i];
+ bi++;
+
+ /* check if we need to allocate new space on the ids array */
+ if (bi == bn) {
+ bn += 10;
+ bids = talloc_realloc(ctx, bids, struct id_map *, bn);
+ if ( ! bids) {
+ DEBUG(1, ("Out of memory!\n"));
+ talloc_free(ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+ }
+
+ /* make sure the last element is NULL */
+ bids[bi] = NULL;
+ }
+ }
+
+ /* let's see if there is any id mapping to be retieved from the backends */
+ if (bids) {
+ ret = idmap_backends_sids_to_unixids(bids);
+ IDMAP_CHECK_RET(ret);
+
+ /* update the cache */
+ for (i = 0; bids[i]; i++) {
+ if (bids[i]->mapped) {
+ ret = idmap_cache_set(idmap_cache, bids[i]);
+ } else {
+ ret = idmap_cache_set_negative_sid(idmap_cache, bids[i]);
+ }
+ IDMAP_CHECK_RET(ret);
+ }
+ }
+
+ ret = NT_STATUS_OK;
+done:
+ talloc_free(ctx);
+ return ret;
+}
+
+NTSTATUS idmap_set_mapping(const struct id_map *id)
+{
+ TALLOC_CTX *ctx;
+ NTSTATUS ret;
+
+ if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ return ret;
+ }
+
+ /* sanity checks */
+ if ((id->sid == NULL) || (! id->mapped)) {
+ DEBUG(1, ("NULL SID or unmapped entry\n"));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ /* TODO: check uid/gid range ? */
+
+ ctx = talloc_named_const(NULL, 0, "idmap_set_mapping ctx");
+ if ( ! ctx) {
+ DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* set the new mapping */
+ ret = idmap_backends_set_mapping(id);
+ IDMAP_CHECK_RET(ret);
+
+ /* set the mapping in the cache */
+ ret = idmap_cache_set(idmap_cache, id);
+ IDMAP_CHECK_RET(ret);
+
+done:
+ talloc_free(ctx);
+ return ret;
+}
+
+/**************************************************************************
+ Dump backend status.
+**************************************************************************/
+
+void idmap_dump_maps(char *logfile)
+{
+ NTSTATUS ret;
+ struct unixid allid;
+ struct id_map *maps;
+ int num_maps;
+ FILE *dump;
+ int i;
+
+ if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ return;
+ }
+
+ dump = fopen(logfile, "w");
+ if ( ! dump) {
+ DEBUG(0, ("Unable to open open stream for file [%s], errno: %d\n", logfile, errno));
+ return;
+ }
+
+ allid.type = ID_TYPE_UID;
+ allid.id = 0;
+ alloc_methods->get_id_hwm(&allid);
+ fprintf(dump, "USER HWM %lu\n", (unsigned long)allid.id);
+
+ allid.type = ID_TYPE_GID;
+ allid.id = 0;
+ alloc_methods->get_id_hwm(&allid);
+ fprintf(dump, "GROUP HWM %lu\n", (unsigned long)allid.id);
+
+ maps = talloc(idmap_ctx, struct id_map);
+ num_maps = 0;
+
+ for (i = 0; i < num_domains; i++) {
+ if (idmap_domains[i]->methods->dump_data) {
+ idmap_domains[i]->methods->dump_data(idmap_domains[i], &maps, &num_maps);
+ }
+ }
+
+ for (i = 0; i < num_maps; i++) {
+ switch (maps[i].xid.type) {
+ case ID_TYPE_UID:
+ fprintf(dump, "UID %lu %s\n",
+ (unsigned long)maps[i].xid.id,
+ sid_string_static(maps[i].sid));
+ break;
+ case ID_TYPE_GID:
+ fprintf(dump, "GID %lu %s\n",
+ (unsigned long)maps[i].xid.id,
+ sid_string_static(maps[i].sid));
+ break;
+ }
+ }
+
+ fflush(dump);
+ fclose(dump);
+}
+
+const char *idmap_fecth_secret(const char *backend, bool alloc,
+ const char *domain, const char *identity)
+{
+ char *tmp, *ret;
+ int r;
+
+ if (alloc) {
+ r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
+ } else {
+ r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
+ }
+
+ if (r < 0) return NULL;
+
+ strupper_m(tmp); /* make sure the key is case insensitive */
+ ret = secrets_fetch_generic(tmp, identity);
+
+ free(tmp);
+ return ret;
+}
--- /dev/null
+/*
+ * idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
+ *
+ * Unix SMB/CIFS implementation.
+ *
+ * Winbind ADS backend functions
+ *
+ * Copyright (C) Andrew Tridgell 2001
+ * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
+ * Copyright (C) Gerald (Jerry) Carter 2004
+ * Copyright (C) Luke Howard 2001-2004
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include "includes.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_IDMAP
+
+#define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
+
+NTSTATUS init_module(void);
+
+static ADS_STRUCT *ad_idmap_ads = NULL;
+
+static char *attr_uidnumber = NULL;
+static char *attr_gidnumber = NULL;
+
+static ADS_STATUS ad_idmap_check_attr_mapping(ADS_STRUCT *ads)
+{
+ ADS_STATUS status;
+ enum wb_posix_mapping map_type;
+
+ if (attr_uidnumber != NULL && attr_gidnumber != NULL) {
+ return ADS_ERROR(LDAP_SUCCESS);
+ }
+
+ SMB_ASSERT(ads->server.workgroup);
+
+ map_type = get_nss_info(ads->server.workgroup);
+
+ if ((map_type == WB_POSIX_MAP_SFU) ||
+ (map_type == WB_POSIX_MAP_RFC2307)) {
+
+ status = ads_check_posix_schema_mapping(ads, map_type);
+ if (ADS_ERR_OK(status)) {
+ attr_uidnumber = SMB_STRDUP(ads->schema.posix_uidnumber_attr);
+ attr_gidnumber = SMB_STRDUP(ads->schema.posix_gidnumber_attr);
+ ADS_ERROR_HAVE_NO_MEMORY(attr_uidnumber);
+ ADS_ERROR_HAVE_NO_MEMORY(attr_gidnumber);
+ return ADS_ERROR(LDAP_SUCCESS);
+ } else {
+ DEBUG(0,("ads_check_posix_schema_mapping failed: %s\n", ads_errstr(status)));
+ /* return status; */
+ }
+ }
+
+ /* fallback to XAD defaults */
+ attr_uidnumber = SMB_STRDUP("uidNumber");
+ attr_gidnumber = SMB_STRDUP("gidNumber");
+ ADS_ERROR_HAVE_NO_MEMORY(attr_uidnumber);
+ ADS_ERROR_HAVE_NO_MEMORY(attr_gidnumber);
+
+ return ADS_ERROR(LDAP_SUCCESS);
+}
+
+static ADS_STRUCT *ad_idmap_cached_connection(void)
+{
+ ADS_STRUCT *ads;
+ ADS_STATUS status;
+ BOOL local = False;
+
+ if (ad_idmap_ads != NULL) {
+ ads = ad_idmap_ads;
+
+ /* check for a valid structure */
+
+ DEBUG(7, ("Current tickets expire at %d, time is now %d\n",
+ (uint32) ads->auth.expire, (uint32) time(NULL)));
+ if ( ads->config.realm && (ads->auth.expire > time(NULL))) {
+ return ads;
+ } else {
+ /* we own this ADS_STRUCT so make sure it goes away */
+ ads->is_mine = True;
+ ads_destroy( &ads );
+ ads_kdestroy(WINBIND_CCACHE_NAME);
+ ad_idmap_ads = NULL;
+ }
+ }
+
+ if (!local) {
+ /* we don't want this to affect the users ccache */
+ setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
+ }
+
+ ads = ads_init(lp_realm(), lp_workgroup(), NULL);
+ if (!ads) {
+ DEBUG(1,("ads_init failed\n"));
+ return NULL;
+ }
+
+ /* the machine acct password might have change - fetch it every time */
+ SAFE_FREE(ads->auth.password);
+ ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
+
+ SAFE_FREE(ads->auth.realm);
+ ads->auth.realm = SMB_STRDUP(lp_realm());
+
+ status = ads_connect(ads);
+ if (!ADS_ERR_OK(status)) {
+ DEBUG(1, ("ad_idmap_init: failed to connect to AD\n"));
+ ads_destroy(&ads);
+ return NULL;
+ }
+
+ ads->is_mine = False;
+
+ status = ad_idmap_check_attr_mapping(ads);
+ if (!ADS_ERR_OK(status)) {
+ DEBUG(1, ("ad_idmap_init: failed to check attribute mapping\n"));
+ return NULL;
+ }
+
+ ad_idmap_ads = ads;
+ return ads;
+}
+
+struct idmap_ad_context {
+ uint32_t filter_low_id, filter_high_id; /* Filter range */
+};
+
+/* Initialize and check conf is appropriate */
+static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom, const char *params)
+{
+ NTSTATUS ret;
+ struct idmap_ad_context *ctx;
+ char *config_option;
+ const char *range;
+ const char *tmp;
+ ADS_STRUCT *ads;
+
+ /* verify AD is reachable (not critical, we may just be offline at start) */
+ ads = ad_idmap_cached_connection();
+ if (ads == NULL) {
+ DEBUG(1, ("WARNING: Could not init an AD connection! Mapping might not work.\n"));
+ }
+
+ ctx = talloc_zero(dom, struct idmap_ad_context);
+ if ( ! ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
+ if ( ! config_option) {
+ DEBUG(0, ("Out of memory!\n"));
+ talloc_free(ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* load ranges */
+ range = lp_parm_const_string(-1, config_option, "range", NULL);
+ if (range && range[0]) {
+ if ((sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2) ||
+ (ctx->filter_low_id > ctx->filter_high_id)) {
+ DEBUG(1, ("ERROR: invalid filter range [%s]", range));
+ ctx->filter_low_id = 0;
+ ctx->filter_high_id = 0;
+ }
+ }
+
+ /* idmap AD can work well only if it is the default module (trusts)
+ * with additional BUILTIN and alloc using TDB */
+ if ( ! dom->default_domain) {
+ DEBUG(1, ("WARNING: idmap_ad is not configured as the default domain.\n"
+ "For best results we suggest you to configure this module as\n"
+ "default and configure BULTIN to use idmap_tdb\n"
+ "ex: idmap domains = BUILTIN %s\n"
+ " idmap alloc config: range = 5000 - 9999\n"
+ " idmap config %s: default = yes\n"
+ " idmap config %s: backend = ad\n"
+ " idmap config %s: range = 10000 - 10000000 #this is optional\n"
+ "NOTE: make sure the ranges do not overlap\n",
+ dom->name, dom->name, dom->name, dom->name));
+ }
+ if ( ! dom->readonly) {
+ DEBUG(1, ("WARNING: forcing to readonly, as idmap_ad can't write on AD.\n"));
+ dom->readonly = true; /* force readonly */
+ }
+
+ dom->private_data = ctx;
+
+ talloc_free(config_option);
+ return NT_STATUS_OK;
+}
+
+#define IDMAP_AD_MAX_IDS 30
+#define CHECK_ALLOC_DONE(mem) do { if (!mem) { DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; goto done; } } while (0)
+
+/* this function searches up to IDMAP_AD_MAX_IDS entries in maps for a match */
+static struct id_map *find_map_by_id(struct id_map **maps, enum id_type type, uint32_t id)
+{
+ int i;
+
+ for (i = 0; i < IDMAP_AD_MAX_IDS; i++) {
+ if (maps[i] == NULL) { /* end of the run */
+ return NULL;
+ }
+ if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
+ return maps[i];
+ }
+ }
+
+ return NULL;
+}
+
+static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
+{
+ NTSTATUS ret;
+ TALLOC_CTX *memctx;
+ struct idmap_ad_context *ctx;
+ ADS_STATUS rc;
+ ADS_STRUCT *ads;
+ const char *attrs[] = { "sAMAccountType",
+ "objectSid",
+ NULL, /* attr_uidnumber */
+ NULL, /* attr_gidnumber */
+ NULL };
+ LDAPMessage *res = NULL;
+ char *filter = NULL;
+ BOOL multi = False;
+ int idx = 0;
+ int bidx = 0;
+ int count;
+ int i;
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
+
+ memctx = talloc_new(ctx);
+ if ( ! memctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ ads = ad_idmap_cached_connection();
+ if (ads == NULL) {
+ DEBUG(1, ("ADS uninitialized\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ /* attr_uidnumber and attr_gidnumber are surely successfully initialized now */
+ attrs[2] = attr_uidnumber;
+ attrs[3] = attr_gidnumber;
+
+ if ( ! ids[1]) {
+ /* if we are requested just one mapping use the simple filter */
+ switch (ids[0]->xid.type) {
+ case ID_TYPE_UID:
+
+ filter = talloc_asprintf(memctx,
+ "(&(|(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d))(%s=%lu))",
+ ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
+ attr_uidnumber,
+ (unsigned long)ids[0]->xid.id);
+ break;
+ case ID_TYPE_GID:
+
+ filter = talloc_asprintf(memctx,
+ "(&(|(sAMAccountType=%d)(sAMAccountType=%d))(%s=%lu))",
+ ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP,
+ attr_gidnumber,
+ (unsigned long)ids[0]->xid.id);
+ break;
+ default:
+ DEBUG(3, ("Unknown ID type\n"));
+ ret = NT_STATUS_INVALID_PARAMETER;
+ goto done;
+ }
+ CHECK_ALLOC_DONE(filter);
+ DEBUG(10, ("Filter: [%s]\n", filter));
+ } else {
+ /* multiple mappings */
+ multi = True;
+ }
+
+again:
+ if (multi) {
+ char *u_filter = NULL;
+ char *g_filter = NULL;
+
+ bidx = idx;
+ for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
+ switch (ids[idx]->xid.type) {
+ case ID_TYPE_UID:
+
+ if ( ! u_filter) {
+ u_filter = talloc_asprintf(memctx, "(&(|"
+ "(sAMAccountType=%d)"
+ "(sAMAccountType=%d)"
+ "(sAMAccountType=%d))(|",
+ ATYPE_NORMAL_ACCOUNT,
+ ATYPE_WORKSTATION_TRUST,
+ ATYPE_INTERDOMAIN_TRUST);
+ }
+ u_filter = talloc_asprintf_append(u_filter, "(%s=%lu)",
+ attr_uidnumber,
+ (unsigned long)ids[idx]->xid.id);
+ CHECK_ALLOC_DONE(u_filter);
+ break;
+
+ case ID_TYPE_GID:
+ if ( ! g_filter) {
+ g_filter = talloc_asprintf(memctx, "(&(|"
+ "(sAMAccountType=%d)"
+ "(sAMAccountType=%d))(|",
+ ATYPE_SECURITY_GLOBAL_GROUP,
+ ATYPE_SECURITY_LOCAL_GROUP);
+ }
+ g_filter = talloc_asprintf_append(g_filter, "(%s=%lu)",
+ attr_gidnumber,
+ (unsigned long)ids[idx]->xid.id);
+ CHECK_ALLOC_DONE(g_filter);
+ break;
+
+ default:
+ DEBUG(3, ("Unknown ID type\n"));
+ ids[idx]->mapped = false;
+ continue;
+ }
+ }
+ filter = talloc_asprintf(memctx, "(|");
+ CHECK_ALLOC_DONE(filter);
+ if ( u_filter) {
+ filter = talloc_asprintf_append(filter, "%s))", u_filter);
+ CHECK_ALLOC_DONE(filter);
+ TALLOC_FREE(u_filter);
+ }
+ if ( g_filter) {
+ filter = talloc_asprintf_append(filter, "%s))", g_filter);
+ CHECK_ALLOC_DONE(filter);
+ TALLOC_FREE(g_filter);
+ }
+ filter = talloc_asprintf_append(filter, ")");
+ CHECK_ALLOC_DONE(filter);
+ DEBUG(10, ("Filter: [%s]\n", filter));
+ } else {
+ bidx = 0;
+ idx = 1;
+ }
+
+ rc = ads_search_retry(ads, &res, filter, attrs);
+ if (!ADS_ERR_OK(rc)) {
+ DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ count = ads_count_replies(ads, res);
+ if (count == 0) {
+ DEBUG(10, ("No IDs found\n"));
+ }
+
+ for (i = 0; i < count; i++) {
+ LDAPMessage *entry;
+ DOM_SID sid;
+ enum id_type type;
+ struct id_map *map;
+ uint32_t id;
+ uint32_t atype;
+ int n;
+
+ if (i == 0) { /* first entry */
+ entry = ads_first_entry(ads, res);
+ } else { /* following ones */
+ entry = ads_next_entry(ads, entry);
+ }
+ if ( ! entry) {
+ DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
+ continue;
+ }
+
+ /* first check if the SID is present */
+ if (!ads_pull_sid(ads, entry, "objectSid", &sid)) {
+ DEBUG(2, ("Could not retrieve SID from entry\n"));
+ continue;
+ }
+
+ /* get type */
+ if (!ads_pull_uint32(ads, entry, "sAMAccountType", &atype)) {
+ DEBUG(1, ("could not get SAM account type\n"));
+ continue;
+ }
+
+ switch (atype & 0xF0000000) {
+ case ATYPE_SECURITY_GLOBAL_GROUP:
+ case ATYPE_SECURITY_LOCAL_GROUP:
+ type = ID_TYPE_GID;
+ break;
+ case ATYPE_NORMAL_ACCOUNT:
+ case ATYPE_WORKSTATION_TRUST:
+ case ATYPE_INTERDOMAIN_TRUST:
+ type = ID_TYPE_UID;
+ break;
+ default:
+ DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
+ continue;
+ }
+
+ if (!ads_pull_uint32(ads, entry, (type==ID_TYPE_UID)?attr_uidnumber:attr_gidnumber, &id)) {
+ DEBUG(1, ("Could not get unix ID\n"));
+ continue;
+ }
+ if ((id == 0) ||
+ (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
+ (ctx->filter_high_id && (id > ctx->filter_high_id))) {
+ DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
+ id, ctx->filter_low_id, ctx->filter_high_id));
+ continue;
+ }
+
+ map = find_map_by_id(&ids[bidx], type, id);
+ if (!map) {
+ DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
+ continue;
+ }
+
+ sid_copy(map->sid, &sid);
+
+ /* mapped */
+ map->mapped = True;
+
+ DEBUG(10, ("Mapped %s -> %lu (%d)\n",
+ sid_string_static(map->sid),
+ (unsigned long)map->xid.id,
+ map->xid.type));
+ }
+
+ if (res) {
+ ads_msgfree(ads, res);
+ }
+
+ if (multi && ids[idx]) { /* still some values to map */
+ goto again;
+ }
+
+ ret = NT_STATUS_OK;
+done:
+ talloc_free(memctx);
+ return ret;
+}
+
+/* this function searches up to IDMAP_AD_MAX_IDS entries in maps for a match */
+static struct id_map *find_map_by_sid(struct id_map **maps, DOM_SID *sid)
+{
+ int i;
+
+ for (i = 0; i < IDMAP_AD_MAX_IDS; i++) {
+ if (maps[i] == NULL) { /* end of the run */
+ return NULL;
+ }
+ if (sid_equal(maps[i]->sid, sid)) {
+ return maps[i];
+ }
+ }
+
+ return NULL;
+}
+
+static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
+{
+ NTSTATUS ret;
+ TALLOC_CTX *memctx;
+ struct idmap_ad_context *ctx;
+ ADS_STATUS rc;
+ ADS_STRUCT *ads;
+ const char *attrs[] = { "sAMAccountType",
+ "objectSid",
+ NULL, /* attr_uidnumber */
+ NULL, /* attr_gidnumber */
+ NULL };
+ LDAPMessage *res = NULL;
+ char *filter = NULL;
+ BOOL multi = False;
+ int idx = 0;
+ int bidx = 0;
+ int count;
+ int i;
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
+
+ memctx = talloc_new(ctx);
+ if ( ! memctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ ads = ad_idmap_cached_connection();
+ if (ads == NULL) {
+ DEBUG(1, ("ADS uninitialized\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ /* attr_uidnumber and attr_gidnumber are surely successfully initialized now */
+ attrs[2] = attr_uidnumber;
+ attrs[3] = attr_gidnumber;
+
+
+ if ( ! ids[1]) {
+ /* if we are requested just one mapping use the simple filter */
+ char *sidstr;
+
+ sidstr = sid_binstring(ids[0]->sid);
+ filter = talloc_asprintf(memctx, "(&(objectSid=%s)(|" /* the requested Sid */
+ "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
+ "(sAMAccountType=%d)(sAMAccountType=%d)))", /* group account types */
+ sidstr,
+ ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
+ ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
+ if (! filter) {
+ free(sidstr);
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ CHECK_ALLOC_DONE(filter);
+ DEBUG(10, ("Filter: [%s]\n", filter));
+ } else {
+ /* multiple mappings */
+ multi = True;
+ }
+
+again:
+ if (multi) {
+ char *sidstr;
+
+ filter = talloc_asprintf(memctx,
+ "(&(|"
+ "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
+ "(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
+ ")(|",
+ ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
+ ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
+
+ CHECK_ALLOC_DONE(filter);
+
+ bidx = idx;
+ for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
+
+ sidstr = sid_binstring(ids[idx]->sid);
+ filter = talloc_asprintf_append(filter, "(objectSid=%s)", sidstr);
+
+ free(sidstr);
+ CHECK_ALLOC_DONE(filter);
+ }
+ filter = talloc_asprintf_append(filter, "))");
+ CHECK_ALLOC_DONE(filter);
+ DEBUG(10, ("Filter: [%s]\n", filter));
+ } else {
+ bidx = 0;
+ idx = 1;
+ }
+
+ rc = ads_search_retry(ads, &res, filter, attrs);
+ if (!ADS_ERR_OK(rc)) {
+ DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ count = ads_count_replies(ads, res);
+ if (count == 0) {
+ DEBUG(10, ("No IDs found\n"));
+ }
+
+ for (i = 0; i < count; i++) {
+ LDAPMessage *entry;
+ DOM_SID sid;
+ enum id_type type;
+ struct id_map *map;
+ uint32_t id;
+ uint32_t atype;
+ int n;
+
+ if (i == 0) { /* first entry */
+ entry = ads_first_entry(ads, res);
+ } else { /* following ones */
+ entry = ads_next_entry(ads, entry);
+ }
+ if ( ! entry) {
+ DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
+ continue;
+ }
+
+ /* first check if the SID is present */
+ if (!ads_pull_sid(ads, entry, "objectSid", &sid)) {
+ DEBUG(2, ("Could not retrieve SID from entry\n"));
+ continue;
+ }
+
+ map = find_map_by_sid(&ids[bidx], &sid);
+ if (!map) {
+ DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
+ continue;
+ }
+
+ /* get type */
+ if (!ads_pull_uint32(ads, entry, "sAMAccountType", &atype)) {
+ DEBUG(1, ("could not get SAM account type\n"));
+ continue;
+ }
+
+ switch (atype & 0xF0000000) {
+ case ATYPE_SECURITY_GLOBAL_GROUP:
+ case ATYPE_SECURITY_LOCAL_GROUP:
+ type = ID_TYPE_GID;
+ break;
+ case ATYPE_NORMAL_ACCOUNT:
+ case ATYPE_WORKSTATION_TRUST:
+ case ATYPE_INTERDOMAIN_TRUST:
+ type = ID_TYPE_UID;
+ break;
+ default:
+ DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
+ continue;
+ }
+
+ if (!ads_pull_uint32(ads, entry, (type==ID_TYPE_UID)?attr_uidnumber:attr_gidnumber, &id)) {
+ DEBUG(1, ("Could not get unix ID\n"));
+ continue;
+ }
+ if ((id == 0) ||
+ (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
+ (ctx->filter_high_id && (id > ctx->filter_high_id))) {
+ DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
+ id, ctx->filter_low_id, ctx->filter_high_id));
+ continue;
+ }
+
+ /* mapped */
+ map->xid.type = type;
+ map->xid.id = id;
+ map->mapped = True;
+
+ DEBUG(10, ("Mapped %s -> %lu (%d)\n",
+ sid_string_static(map->sid),
+ (unsigned long)map->xid.id,
+ map->xid.type));
+ }
+
+ if (res) {
+ ads_msgfree(ads, res);
+ }
+
+ if (multi && ids[idx]) { /* still some values to map */
+ goto again;
+ }
+
+ ret = NT_STATUS_OK;
+done:
+ talloc_free(memctx);
+ return ret;
+}
+
+static NTSTATUS idmap_ad_close(struct idmap_domain *dom)
+{
+ ADS_STRUCT *ads = ad_idmap_ads;
+
+ if (ads != NULL) {
+ /* we own this ADS_STRUCT so make sure it goes away */
+ ads->is_mine = True;
+ ads_destroy( &ads );
+ ad_idmap_ads = NULL;
+ }
+
+ SAFE_FREE(attr_uidnumber);
+ SAFE_FREE(attr_gidnumber);
+
+ return NT_STATUS_OK;
+}
+
+static struct idmap_methods ad_methods = {
+ .init = idmap_ad_initialize,
+ .unixids_to_sids = idmap_ad_unixids_to_sids,
+ .sids_to_unixids = idmap_ad_sids_to_unixids,
+ .close_fn = idmap_ad_close
+};
+
+/* support for new authentication subsystem */
+NTSTATUS idmap_ad_init(void)
+{
+ return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ad", &ad_methods);
+}
+
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+ ID Mapping Cache
+
+ based on gencache
+
+ Copyright (C) Simo Sorce 2006
+ Copyright (C) Rafal Szczesniak 2002
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/
+
+#include "includes.h"
+
+#define TIMEOUT_LEN 12
+#define IDMAP_CACHE_DATA_FMT "%12u/%s"
+#define IDMAP_READ_CACHE_DATA_FMT_TEMPLATE "%%12u/%%%us"
+
+struct idmap_cache_ctx {
+ TDB_CONTEXT *tdb;
+};
+
+static int idmap_cache_destructor(struct idmap_cache_ctx *cache)
+{
+ int ret = 0;
+
+ if (cache && cache->tdb) {
+ ret = tdb_close(cache->tdb);
+ cache->tdb = NULL;
+ }
+
+ return ret;
+}
+
+struct idmap_cache_ctx *idmap_cache_init(TALLOC_CTX *memctx)
+{
+ struct idmap_cache_ctx *cache;
+ char* cache_fname = NULL;
+
+ cache = talloc(memctx, struct idmap_cache_ctx);
+ if ( ! cache) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NULL;
+ }
+
+ cache_fname = lock_path("idmap_cache.tdb");
+
+ DEBUG(10, ("Opening cache file at %s\n", cache_fname));
+
+ cache->tdb = tdb_open_log(cache_fname, 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
+
+ if (!cache->tdb) {
+ DEBUG(5, ("Attempt to open %s has failed.\n", cache_fname));
+ return NULL;
+ }
+
+ talloc_set_destructor(cache, idmap_cache_destructor);
+
+ return cache;
+}
+
+void idmap_cache_shutdown(struct idmap_cache_ctx *cache)
+{
+ talloc_free(cache);
+}
+
+NTSTATUS idmap_cache_build_sidkey(TALLOC_CTX *ctx, char **sidkey, const struct id_map *id)
+{
+ *sidkey = talloc_asprintf(ctx, "IDMAP/SID/%s", sid_string_static(id->sid));
+ if ( ! *sidkey) {
+ DEBUG(1, ("failed to build sidkey, OOM?\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ return NT_STATUS_OK;
+}
+
+NTSTATUS idmap_cache_build_idkey(TALLOC_CTX *ctx, char **idkey, const struct id_map *id)
+{
+ *idkey = talloc_asprintf(ctx, "IDMAP/%s/%lu",
+ (id->xid.type==ID_TYPE_UID)?"UID":"GID",
+ (unsigned long)id->xid.id);
+ if ( ! *idkey) {
+ DEBUG(1, ("failed to build idkey, OOM?\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ return NT_STATUS_OK;
+}
+
+NTSTATUS idmap_cache_set(struct idmap_cache_ctx *cache, const struct id_map *id)
+{
+ NTSTATUS ret;
+ time_t timeout = time(NULL) + lp_idmap_expire_time();
+ TDB_DATA keybuf, databuf;
+ char *sidkey;
+ char *idkey;
+ char *valstr;
+
+ ret = idmap_cache_build_sidkey(cache, &sidkey, id);
+ if (!NT_STATUS_IS_OK(ret)) return ret;
+
+ /* use sidkey as the local memory ctx */
+ ret = idmap_cache_build_idkey(sidkey, &idkey, id);
+ if (!NT_STATUS_IS_OK(ret)) {
+ goto done;
+ }
+
+ /* save SID -> ID */
+
+ /* use sidkey as the local memory ctx */
+ valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, idkey);
+ if (!valstr) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ keybuf.dptr = sidkey;
+ keybuf.dsize = strlen(sidkey)+1;
+ databuf.dptr = valstr;
+ databuf.dsize = strlen(valstr)+1;
+ DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
+ " %s (%d seconds %s)\n", keybuf.dptr, valstr , ctime(&timeout),
+ (int)(timeout - time(NULL)),
+ timeout > time(NULL) ? "ahead" : "in the past"));
+
+ if (tdb_store(cache->tdb, keybuf, databuf, TDB_REPLACE) != 0) {
+ DEBUG(3, ("Failed to store cache entry!\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ /* save ID -> SID */
+
+ /* use sidkey as the local memory ctx */
+ valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, sidkey);
+ if (!valstr) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ keybuf.dptr = idkey;
+ keybuf.dsize = strlen(idkey)+1;
+ databuf.dptr = valstr;
+ databuf.dsize = strlen(valstr)+1;
+ DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
+ " %s (%d seconds %s)\n", keybuf.dptr, valstr, ctime(&timeout),
+ (int)(timeout - time(NULL)),
+ timeout > time(NULL) ? "ahead" : "in the past"));
+
+ if (tdb_store(cache->tdb, keybuf, databuf, TDB_REPLACE) != 0) {
+ DEBUG(3, ("Failed to store cache entry!\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(sidkey);
+ return ret;
+}
+
+NTSTATUS idmap_cache_del(struct idmap_cache_ctx *cache, const struct id_map *id)
+{
+ NTSTATUS ret;
+ TDB_DATA keybuf;
+ char *sidkey = NULL;
+ char *idkey = NULL;
+
+ ret = idmap_cache_build_sidkey(cache, &sidkey, id);
+ if (!NT_STATUS_IS_OK(ret)) return ret;
+
+ ret = idmap_cache_build_idkey(cache, &idkey, id);
+ if (!NT_STATUS_IS_OK(ret)) {
+ goto done;
+ }
+
+ /* delete SID */
+
+ keybuf.dptr = sidkey;
+ keybuf.dsize = strlen(sidkey)+1;
+ DEBUG(10, ("Deleting cache entry (key = %s)\n", keybuf.dptr));
+
+ if (tdb_delete(cache->tdb, keybuf) != 0) {
+ DEBUG(3, ("Failed to delete cache entry!\n"));
+ }
+
+ /* delete ID */
+
+ keybuf.dptr = idkey;
+ keybuf.dsize = strlen(idkey)+1;
+ DEBUG(10, ("Deleting cache entry (key = %s)\n", keybuf.dptr));
+
+ if (tdb_delete(cache->tdb, keybuf) != 0) {
+ DEBUG(3, ("Failed to delete cache entry!\n"));
+ }
+
+done:
+ talloc_free(sidkey);
+ talloc_free(idkey);
+ return ret;
+}
+
+NTSTATUS idmap_cache_set_negative_sid(struct idmap_cache_ctx *cache, const struct id_map *id)
+{
+ NTSTATUS ret;
+ time_t timeout = time(NULL) + lp_idmap_negative_time();
+ TDB_DATA keybuf, databuf;
+ char *sidkey;
+ char *valstr;
+
+ ret = idmap_cache_build_sidkey(cache, &sidkey, id);
+ if (!NT_STATUS_IS_OK(ret)) return ret;
+
+ /* use sidkey as the local memory ctx */
+ valstr = talloc_asprintf(sidkey, IDMAP_CACHE_DATA_FMT, (int)timeout, "IDMAP/NEGATIVE");
+ if (!valstr) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ keybuf.dptr = sidkey;
+ keybuf.dsize = strlen(sidkey)+1;
+ databuf.dptr = valstr;
+ databuf.dsize = strlen(valstr)+1;
+ DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
+ " %s (%d seconds %s)\n", keybuf.dptr, valstr, ctime(&timeout),
+ (int)(timeout - time(NULL)),
+ timeout > time(NULL) ? "ahead" : "in the past"));
+
+ if (tdb_store(cache->tdb, keybuf, databuf, TDB_REPLACE) != 0) {
+ DEBUG(3, ("Failed to store cache entry!\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+done:
+ talloc_free(sidkey);
+ return ret;
+}
+
+NTSTATUS idmap_cache_set_negative_id(struct idmap_cache_ctx *cache, const struct id_map *id)
+{
+ NTSTATUS ret;
+ time_t timeout = time(NULL) + lp_idmap_negative_time();
+ TDB_DATA keybuf, databuf;
+ char *idkey;
+ char *valstr;
+
+ ret = idmap_cache_build_idkey(cache, &idkey, id);
+ if (!NT_STATUS_IS_OK(ret)) return ret;
+
+ /* use idkey as the local memory ctx */
+ valstr = talloc_asprintf(idkey, IDMAP_CACHE_DATA_FMT, (int)timeout, "IDMAP/NEGATIVE");
+ if (!valstr) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ keybuf.dptr = idkey;
+ keybuf.dsize = strlen(idkey)+1;
+ databuf.dptr = valstr;
+ databuf.dsize = strlen(valstr)+1;
+ DEBUG(10, ("Adding cache entry with key = %s; value = %s and timeout ="
+ " %s (%d seconds %s)\n", keybuf.dptr, valstr, ctime(&timeout),
+ (int)(timeout - time(NULL)),
+ timeout > time(NULL) ? "ahead" : "in the past"));
+
+ if (tdb_store(cache->tdb, keybuf, databuf, TDB_REPLACE) != 0) {
+ DEBUG(3, ("Failed to store cache entry!\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+done:
+ talloc_free(idkey);
+ return ret;
+}
+
+NTSTATUS idmap_cache_fill_map(struct id_map *id, const char *value)
+{
+ char *rem;
+
+ /* see if it is a sid */
+ if ( ! strncmp("IDMAP/SID/", value, 10)) {
+
+ if ( ! string_to_sid(id->sid, &value[10])) {
+ goto failed;
+ }
+
+ id->mapped = True;
+
+ return NT_STATUS_OK;
+ }
+
+ /* not a SID see if it is an UID or a GID */
+ if ( ! strncmp("IDMAP/UID/", value, 10)) {
+
+ /* a uid */
+ id->xid.type = ID_TYPE_UID;
+
+ } else if ( ! strncmp("IDMAP/GID/", value, 10)) {
+
+ /* a gid */
+ id->xid.type = ID_TYPE_GID;
+
+ } else {
+
+ /* a completely bogus value bail out */
+ goto failed;
+ }
+
+ id->xid.id = strtol(&value[10], &rem, 0);
+ if (*rem != '\0') {
+ goto failed;
+ }
+
+ id->mapped = True;
+
+ return NT_STATUS_OK;
+
+failed:
+ DEBUG(1, ("invalid value: %s\n", value));
+ id->mapped = False;
+ return NT_STATUS_INTERNAL_DB_CORRUPTION;
+}
+
+BOOL idmap_cache_is_negative(const char *val)
+{
+ if ( ! strcmp("IDMAP/NEGATIVE", val)) {
+ return True;
+ }
+ return False;
+}
+
+/* search the cahce for the SID an return a mapping if found *
+ *
+ * 3 cases are possible
+ *
+ * 1 map found
+ * in this case id->mapped = True and NT_STATUS_OK is returned
+ * 2 map not found
+ * in this case id->mapped = False and NT_STATUS_NONE_MAPPED is returned
+ * 3 negative cache found
+ * in this case id->mapped = False and NT_STATUS_OK is returned
+ *
+ * As a special case if the cache is expired NT_STATUS_SYNCHRONIZATION_REQUIRED
+ * is returned instead of NT_STATUS_OK. In this case revalidation of the cache
+ * is needed.
+ */
+
+NTSTATUS idmap_cache_map_sid(struct idmap_cache_ctx *cache, struct id_map *id)
+{
+ NTSTATUS ret;
+ TDB_DATA keybuf, databuf;
+ time_t t;
+ char *sidkey;
+ char *endptr;
+
+ /* make sure it is marked as not mapped by default */
+ id->mapped = False;
+
+ ret = idmap_cache_build_sidkey(cache, &sidkey, id);
+ if (!NT_STATUS_IS_OK(ret)) return ret;
+
+ keybuf.dptr = sidkey;
+ keybuf.dsize = strlen(sidkey)+1;
+
+ databuf = tdb_fetch(cache->tdb, keybuf);
+
+ if (databuf.dptr == NULL) {
+ DEBUG(10, ("Cache entry with key = %s couldn't be found\n", sidkey));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ t = strtol(databuf.dptr, &endptr, 10);
+
+ if ((endptr == NULL) || (*endptr != '/')) {
+ DEBUG(2, ("Invalid gencache data format: %s\n", databuf.dptr));
+ /* remove the entry */
+ tdb_delete(cache->tdb, keybuf);
+ ret = NT_STATUS_NONE_MAPPED;
+ goto done;
+ }
+
+ /* check it is not negative */
+ if (strcmp("IDMAP/NEGATIVE", endptr+1) != 0) {
+
+ DEBUG(10, ("Returning %s cache entry: key = %s, value = %s, "
+ "timeout = %s", t > time(NULL) ? "valid" :
+ "expired", sidkey, endptr+1, ctime(&t)));
+
+ /* this call if successful will also mark the entry as mapped */
+ ret = idmap_cache_fill_map(id, endptr+1);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* if not valid form delete the entry */
+ tdb_delete(cache->tdb, keybuf);
+ ret = NT_STATUS_NONE_MAPPED;
+ goto done;
+ }
+
+ /* here ret == NT_STATUS_OK and id->mapped = True */
+
+ if (t <= time(NULL)) {
+ /* We're expired, set an error code for upper layer */
+ ret = NT_STATUS_SYNCHRONIZATION_REQUIRED;
+ }
+ } else {
+ /* this is not mapped (id->mapped = False),
+ * and that's right as it was a negative cache hit */
+ ret = NT_STATUS_OK;
+
+ if (t <= time(NULL)) {
+ /* We're expired, delete the entry and return not mapped */
+ tdb_delete(cache->tdb, keybuf);
+ ret = NT_STATUS_NONE_MAPPED;
+ }
+ }
+
+done:
+ SAFE_FREE(databuf.dptr);
+ talloc_free(sidkey);
+ return ret;
+}
+
+/* search the cahce for the ID an return a mapping if found *
+ *
+ * 3 cases are possible
+ *
+ * 1 map found
+ * in this case id->mapped = True and NT_STATUS_OK is returned
+ * 2 map not found
+ * in this case id->mapped = False and NT_STATUS_NONE_MAPPED is returned
+ * 3 negative cache found
+ * in this case id->mapped = False and NT_STATUS_OK is returned
+ *
+ * As a special case if the cache is expired NT_STATUS_SYNCHRONIZATION_REQUIRED
+ * is returned instead of NT_STATUS_OK. In this case revalidation of the cache
+ * is needed.
+ */
+
+NTSTATUS idmap_cache_map_id(struct idmap_cache_ctx *cache, struct id_map *id)
+{
+ NTSTATUS ret;
+ TDB_DATA keybuf, databuf;
+ time_t t;
+ char *idkey;
+ char *endptr;
+
+ /* make sure it is marked as not mapped by default */
+ id->mapped = False;
+
+ ret = idmap_cache_build_idkey(cache, &idkey, id);
+ if (!NT_STATUS_IS_OK(ret)) return ret;
+
+ keybuf.dptr = idkey;
+ keybuf.dsize = strlen(idkey)+1;
+
+ databuf = tdb_fetch(cache->tdb, keybuf);
+
+ if (databuf.dptr == NULL) {
+ DEBUG(10, ("Cache entry with key = %s couldn't be found\n", idkey));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ t = strtol(databuf.dptr, &endptr, 10);
+
+ if ((endptr == NULL) || (*endptr != '/')) {
+ DEBUG(2, ("Invalid gencache data format: %s\n", databuf.dptr));
+ /* remove the entry */
+ tdb_delete(cache->tdb, keybuf);
+ ret = NT_STATUS_NONE_MAPPED;
+ goto done;
+ }
+
+ /* check it is not negative */
+ if (strcmp("IDMAP/NEGATIVE", endptr+1) != 0) {
+
+ DEBUG(10, ("Returning %s cache entry: key = %s, value = %s, "
+ "timeout = %s", t > time(NULL) ? "valid" :
+ "expired", idkey, endptr+1, ctime(&t)));
+
+ /* this call if successful will also mark the entry as mapped */
+ ret = idmap_cache_fill_map(id, endptr+1);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* if not valid form delete the entry */
+ tdb_delete(cache->tdb, keybuf);
+ ret = NT_STATUS_NONE_MAPPED;
+ goto done;
+ }
+
+ /* here ret == NT_STATUS_OK and id->mapped = True */
+
+ if (t <= time(NULL)) {
+ /* We're expired, set an error code for upper layer */
+ ret = NT_STATUS_SYNCHRONIZATION_REQUIRED;
+ }
+ } else {
+ /* this is not mapped (id->mapped = False),
+ * and that's right as it was a negative cache hit */
+ ret = NT_STATUS_OK;
+
+ if (t <= time(NULL)) {
+ /* We're expired, delete the entry and return not mapped */
+ tdb_delete(cache->tdb, keybuf);
+ ret = NT_STATUS_NONE_MAPPED;
+ }
+ }
+done:
+ SAFE_FREE(databuf.dptr);
+ talloc_free(idkey);
+ return ret;
+}
+
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+
+ idmap LDAP backend
+
+ Copyright (C) Tim Potter 2000
+ Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
+ Copyright (C) Gerald Carter 2003
+ Copyright (C) Simo Sorce 2003-2006
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_IDMAP
+
+#include <lber.h>
+#include <ldap.h>
+
+#include "smbldap.h"
+
+struct idmap_ldap_alloc_context {
+ struct smbldap_state *smbldap_state;
+ char *url;
+ char *suffix;
+ char *user_dn;
+ uid_t low_uid, high_uid; /* Range of uids */
+ gid_t low_gid, high_gid; /* Range of gids */
+
+};
+
+#define CHECK_ALLOC_DONE(mem) do { if (!mem) { DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; goto done; } } while (0)
+
+/**********************************************************************
+ IDMAP ALLOC TDB BACKEND
+**********************************************************************/
+
+static struct idmap_ldap_alloc_context *idmap_alloc_ldap;
+
+/**********************************************************************
+ Verify the sambaUnixIdPool entry in the directory.
+**********************************************************************/
+
+static NTSTATUS verify_idpool(void)
+{
+ NTSTATUS ret;
+ TALLOC_CTX *ctx;
+ LDAPMessage *result = NULL;
+ LDAPMod **mods = NULL;
+ const char **attr_list;
+ char *filter;
+ int count;
+ int rc;
+
+ if ( ! idmap_alloc_ldap) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ ctx = talloc_new(idmap_alloc_ldap);
+ if ( ! ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ filter = talloc_asprintf(ctx, "(objectclass=%s)", LDAP_OBJ_IDPOOL);
+ CHECK_ALLOC_DONE(filter);
+
+ attr_list = get_attr_list(ctx, idpool_attr_list);
+ CHECK_ALLOC_DONE(attr_list);
+
+ rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
+ idmap_alloc_ldap->suffix,
+ LDAP_SCOPE_SUBTREE,
+ filter,
+ attr_list,
+ 0,
+ &result);
+
+ if (rc != LDAP_SUCCESS) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct, result);
+
+ ldap_msgfree(result);
+
+ if ( count > 1 ) {
+ DEBUG(0,("Multiple entries returned from %s (base == %s)\n",
+ filter, idmap_alloc_ldap->suffix));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+ else if (count == 0) {
+ char *uid_str, *gid_str;
+
+ uid_str = talloc_asprintf(ctx, "%lu", (unsigned long)idmap_alloc_ldap->low_uid);
+ gid_str = talloc_asprintf(ctx, "%lu", (unsigned long)idmap_alloc_ldap->low_gid);
+
+ smbldap_set_mod(&mods, LDAP_MOD_ADD,
+ "objectClass", LDAP_OBJ_IDPOOL);
+ smbldap_set_mod(&mods, LDAP_MOD_ADD,
+ get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER),
+ uid_str);
+ smbldap_set_mod(&mods, LDAP_MOD_ADD,
+ get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER),
+ gid_str);
+ if (mods) {
+ rc = smbldap_modify(idmap_alloc_ldap->smbldap_state,
+ idmap_alloc_ldap->suffix,
+ mods);
+ ldap_mods_free(mods, True);
+ } else {
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+ }
+
+ ret = (rc == LDAP_SUCCESS)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
+done:
+ talloc_free(ctx);
+ return ret;
+}
+
+/*****************************************************************************
+ Initialise idmap database.
+*****************************************************************************/
+
+static NTSTATUS idmap_ldap_alloc_init(const char *params)
+{
+ NTSTATUS nt_status;
+ const char *secret;
+ const char *range;
+ const char *tmp;
+ uint32_t low_id = 0;
+ uint32_t high_id = 0;
+
+ idmap_alloc_ldap = talloc_zero(NULL, struct idmap_ldap_alloc_context);
+ if (!idmap_alloc_ldap) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* load ranges */
+ idmap_alloc_ldap->low_uid = 0;
+ idmap_alloc_ldap->high_uid = 0;
+ idmap_alloc_ldap->low_gid = 0;
+ idmap_alloc_ldap->high_gid = 0;
+
+ range = lp_parm_const_string(-1, "idmap alloc config", "range", NULL);
+ if (range && range[0]) {
+ if (sscanf(range, "%u - %u", &low_id, &high_id) == 2) {
+ if (low_id < high_id) {
+ idmap_alloc_ldap->low_gid = idmap_alloc_ldap->low_uid = low_id;
+ idmap_alloc_ldap->high_gid = idmap_alloc_ldap->high_uid = high_id;
+ } else {
+ DEBUG(1, ("ERROR: invalid idmap alloc range [%s]", range));
+ }
+ } else {
+ DEBUG(1, ("ERROR: invalid syntax for idmap alloc config:range [%s]", range));
+ }
+ }
+
+ if (lp_idmap_uid(&low_id, &high_id)) {
+ idmap_alloc_ldap->low_uid = low_id;
+ idmap_alloc_ldap->high_uid = high_id;
+ }
+
+ if (lp_idmap_gid(&low_id, &high_id)) {
+ idmap_alloc_ldap->low_gid = low_id;
+ idmap_alloc_ldap->high_gid= high_id;
+ }
+
+ if (idmap_alloc_ldap->high_uid <= idmap_alloc_ldap->low_uid) {
+ DEBUG(1, ("idmap uid range missing or invalid\n"));
+ DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
+ talloc_free(idmap_alloc_ldap);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ if (idmap_alloc_ldap->high_gid <= idmap_alloc_ldap->low_gid) {
+ DEBUG(1, ("idmap gid range missing or invalid\n"));
+ DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
+ talloc_free(idmap_alloc_ldap);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ if (params && *params) {
+ /* assume location is the only parameter */
+ idmap_alloc_ldap->url = talloc_strdup(idmap_alloc_ldap, params);
+ } else {
+ tmp = lp_parm_const_string(-1, "idmap alloc config", "ldap_url", NULL);
+
+ if ( ! tmp) {
+ DEBUG(1, ("ERROR: missing idmap ldap url\n"));
+ talloc_free(idmap_alloc_ldap);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ idmap_alloc_ldap->url = talloc_strdup(idmap_alloc_ldap, tmp);
+ }
+ if ( ! idmap_alloc_ldap->url) {
+ talloc_free(idmap_alloc_ldap);
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ tmp = lp_ldap_idmap_suffix();
+ if ( ! tmp || ! *tmp) {
+ tmp = lp_parm_const_string(-1, "idmap alloc config", "ldap_base_dn", NULL);
+ }
+ if ( ! tmp) {
+ tmp = lp_ldap_suffix();
+ if (tmp) {
+ DEBUG(1, ("WARNING: Trying to use the global ldap suffix(%s)\n", tmp));
+ DEBUGADD(1, ("as suffix. This may not be what you want!\n"));
+ }
+ }
+ if ( ! tmp) {
+ DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
+ talloc_free(idmap_alloc_ldap);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+ idmap_alloc_ldap->suffix = talloc_strdup(idmap_alloc_ldap, tmp);
+ if ( ! idmap_alloc_ldap->suffix) {
+ talloc_free(idmap_alloc_ldap);
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ tmp = lp_parm_const_string(-1, "idmap alloc config", "ldap_user_dn", NULL);
+
+ if ( ! tmp) {
+ tmp = lp_ldap_admin_dn();
+ }
+ if (! tmp || ! *tmp) {
+ DEBUG(1, ("ERROR: missing idmap ldap user dn\n"));
+ talloc_free(idmap_alloc_ldap);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ idmap_alloc_ldap->user_dn = talloc_strdup(idmap_alloc_ldap, tmp);
+ if ( ! idmap_alloc_ldap->user_dn) {
+ talloc_free(idmap_alloc_ldap);
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!NT_STATUS_IS_OK(nt_status =
+ smbldap_init(idmap_alloc_ldap, idmap_alloc_ldap->url,
+ &idmap_alloc_ldap->smbldap_state))) {
+ DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n",
+ idmap_alloc_ldap->url));
+ talloc_free(idmap_alloc_ldap);
+ return nt_status;
+ }
+
+ /* fetch credentials from secrets.tdb */
+ secret = idmap_fecth_secret("ldap", true, NULL, idmap_alloc_ldap->user_dn);
+ if (!secret) {
+ DEBUG(1, ("ERROR: unable to fetch auth credentials\n"));
+ talloc_free(idmap_alloc_ldap);
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ /* now set credentials */
+ smbldap_set_creds(idmap_alloc_ldap->smbldap_state, false, idmap_alloc_ldap->user_dn, secret);
+
+ /* see if the idmap suffix and sub entries exists */
+ nt_status = verify_idpool();
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ talloc_free(idmap_alloc_ldap);
+ return nt_status;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/********************************
+ Allocate a new uid or gid
+********************************/
+
+static NTSTATUS idmap_ldap_allocate_id(struct unixid *xid)
+{
+ TALLOC_CTX *ctx;
+ NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
+ int rc = LDAP_SERVER_DOWN;
+ int count = 0;
+ LDAPMessage *result = NULL;
+ LDAPMessage *entry = NULL;
+ LDAPMod **mods = NULL;
+ char *id_str;
+ char *new_id_str;
+ char *filter = NULL;
+ const char *dn = NULL;
+ const char **attr_list;
+ const char *type;
+
+ if ( ! idmap_alloc_ldap) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ ctx = talloc_new(idmap_alloc_ldap);
+ if ( ! ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* get type */
+ switch (xid->type) {
+
+ case ID_TYPE_UID:
+ type = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
+ break;
+
+ case ID_TYPE_GID:
+ type = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
+ break;
+
+ default:
+ DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ filter = talloc_asprintf(ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
+ CHECK_ALLOC_DONE(filter);
+
+ attr_list = get_attr_list(ctx, idpool_attr_list);
+ CHECK_ALLOC_DONE(attr_list);
+
+ DEBUG(10, ("Search of the id pool (filter: %s)\n", filter));
+
+ rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
+ idmap_alloc_ldap->suffix,
+ LDAP_SCOPE_SUBTREE, filter,
+ attr_list, 0, &result);
+
+ if (rc != LDAP_SUCCESS) {
+ DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
+ goto done;
+ }
+
+ talloc_autofree_ldapmsg(ctx, result);
+
+ count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct, result);
+ if (count != 1) {
+ DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
+ goto done;
+ }
+
+ entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct, result);
+
+ dn = smbldap_talloc_dn(ctx, idmap_alloc_ldap->smbldap_state->ldap_struct, entry);
+ if ( ! dn) {
+ goto done;
+ }
+
+ if ( ! (id_str = smbldap_talloc_single_attribute(idmap_alloc_ldap->smbldap_state->ldap_struct,
+ entry, type, ctx))) {
+ DEBUG(0,("%s attribute not found\n", type));
+ goto done;
+ }
+ if ( ! id_str) {
+ DEBUG(0,("Out of memory\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ xid->id = strtoul(id_str, NULL, 10);
+
+ /* make sure we still have room to grow */
+
+ switch (xid->type) {
+ case ID_TYPE_UID:
+ if (xid->id > idmap_alloc_ldap->high_uid) {
+ DEBUG(0,("Cannot allocate uid above %lu!\n",
+ (unsigned long)idmap_alloc_ldap->high_uid));
+ goto done;
+ }
+ break;
+
+ case ID_TYPE_GID:
+ if (xid->id > idmap_alloc_ldap->high_gid) {
+ DEBUG(0,("Cannot allocate gid above %lu!\n",
+ (unsigned long)idmap_alloc_ldap->high_uid));
+ goto done;
+ }
+ break;
+
+ default:
+ /* impossible */
+ goto done;
+ }
+
+ new_id_str = talloc_asprintf(ctx, "%lu", (unsigned long)xid->id + 1);
+ if ( ! new_id_str) {
+ DEBUG(0,("Out of memory\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ smbldap_set_mod(&mods, LDAP_MOD_DELETE, type, id_str);
+ smbldap_set_mod(&mods, LDAP_MOD_ADD, type, new_id_str);
+
+ if (mods == NULL) {
+ DEBUG(0,("smbldap_set_mod() failed.\n"));
+ goto done;
+ }
+
+ DEBUG(10, ("Try to atomically increment the id (%s -> %s)\n", id_str, new_id_str));
+
+ rc = smbldap_modify(idmap_alloc_ldap->smbldap_state, dn, mods);
+
+ ldap_mods_free(mods, True);
+
+ if (rc != LDAP_SUCCESS) {
+ DEBUG(1,("Failed to allocate new %s. smbldap_modify() failed.\n", type));
+ goto done;
+ }
+
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(ctx);
+ return ret;
+}
+
+/**********************************
+ Get current highest id.
+**********************************/
+
+static NTSTATUS idmap_ldap_get_hwm(struct unixid *xid)
+{
+ TALLOC_CTX *memctx;
+ NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
+ int rc = LDAP_SERVER_DOWN;
+ int count = 0;
+ LDAPMessage *result = NULL;
+ LDAPMessage *entry = NULL;
+ char *id_str;
+ char *filter = NULL;
+ const char **attr_list;
+ const char *type;
+
+ if ( ! idmap_alloc_ldap) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ memctx = talloc_new(idmap_alloc_ldap);
+ if ( ! memctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* get type */
+ switch (xid->type) {
+
+ case ID_TYPE_UID:
+ type = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
+ break;
+
+ case ID_TYPE_GID:
+ type = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
+ break;
+
+ default:
+ DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ filter = talloc_asprintf(memctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
+ CHECK_ALLOC_DONE(filter);
+
+ attr_list = get_attr_list(memctx, idpool_attr_list);
+ CHECK_ALLOC_DONE(attr_list);
+
+ rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
+ idmap_alloc_ldap->suffix,
+ LDAP_SCOPE_SUBTREE, filter,
+ attr_list, 0, &result);
+
+ if (rc != LDAP_SUCCESS) {
+ DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
+ goto done;
+ }
+
+ talloc_autofree_ldapmsg(memctx, result);
+
+ count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct, result);
+ if (count != 1) {
+ DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
+ goto done;
+ }
+
+ entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct, result);
+
+ id_str = smbldap_talloc_single_attribute(idmap_alloc_ldap->smbldap_state->ldap_struct,
+ entry, type, memctx);
+ if ( ! id_str) {
+ DEBUG(0,("%s attribute not found\n", type));
+ goto done;
+ }
+ if ( ! id_str) {
+ DEBUG(0,("Out of memory\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ xid->id = strtoul(id_str, NULL, 10);
+
+ ret = NT_STATUS_OK;
+done:
+ talloc_free(memctx);
+ return ret;
+}
+/**********************************
+ Set highest id.
+**********************************/
+
+static NTSTATUS idmap_ldap_set_hwm(struct unixid *xid)
+{
+ TALLOC_CTX *ctx;
+ NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
+ int rc = LDAP_SERVER_DOWN;
+ int count = 0;
+ LDAPMessage *result = NULL;
+ LDAPMessage *entry = NULL;
+ LDAPMod **mods = NULL;
+ char *new_id_str;
+ char *filter = NULL;
+ const char *dn = NULL;
+ const char **attr_list;
+ const char *type;
+
+ if ( ! idmap_alloc_ldap) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ ctx = talloc_new(idmap_alloc_ldap);
+ if ( ! ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* get type */
+ switch (xid->type) {
+
+ case ID_TYPE_UID:
+ type = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
+ break;
+
+ case ID_TYPE_GID:
+ type = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
+ break;
+
+ default:
+ DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ filter = talloc_asprintf(ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
+ CHECK_ALLOC_DONE(filter);
+
+ attr_list = get_attr_list(ctx, idpool_attr_list);
+ CHECK_ALLOC_DONE(attr_list);
+
+ rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
+ idmap_alloc_ldap->suffix,
+ LDAP_SCOPE_SUBTREE, filter,
+ attr_list, 0, &result);
+
+ if (rc != LDAP_SUCCESS) {
+ DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
+ goto done;
+ }
+
+ talloc_autofree_ldapmsg(ctx, result);
+
+ count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct, result);
+ if (count != 1) {
+ DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
+ goto done;
+ }
+
+ entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct, result);
+
+ dn = smbldap_talloc_dn(ctx, idmap_alloc_ldap->smbldap_state->ldap_struct, entry);
+ if ( ! dn) {
+ goto done;
+ }
+
+ new_id_str = talloc_asprintf(ctx, "%lu", (unsigned long)xid->id);
+ if ( ! new_id_str) {
+ DEBUG(0,("Out of memory\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ smbldap_set_mod(&mods, LDAP_MOD_REPLACE, type, new_id_str);
+
+ if (mods == NULL) {
+ DEBUG(0,("smbldap_set_mod() failed.\n"));
+ goto done;
+ }
+
+ rc = smbldap_modify(idmap_alloc_ldap->smbldap_state, dn, mods);
+
+ ldap_mods_free(mods, True);
+
+ if (rc != LDAP_SUCCESS) {
+ DEBUG(1,("Failed to allocate new %s. smbldap_modify() failed.\n", type));
+ goto done;
+ }
+
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(ctx);
+ return ret;
+}
+
+/**********************************
+ Close idmap ldap alloc
+**********************************/
+
+static NTSTATUS idmap_ldap_alloc_close(void)
+{
+ if (idmap_alloc_ldap) {
+ smbldap_free_struct(&idmap_alloc_ldap->smbldap_state);
+ DEBUG(5,("The connection to the LDAP server was closed\n"));
+ /* maybe free the results here --metze */
+ TALLOC_FREE(idmap_alloc_ldap);
+ }
+ return NT_STATUS_OK;
+}
+
+
+/**********************************************************************
+ IDMAP MAPPING LDAP BACKEND
+**********************************************************************/
+
+struct idmap_ldap_context {
+ struct smbldap_state *smbldap_state;
+ char *url;
+ char *suffix;
+ char *user_dn;
+ uint32_t filter_low_id, filter_high_id; /* Filter range */
+ BOOL anon;
+};
+
+static int idmap_ldap_close_destructor(struct idmap_ldap_context *ctx)
+{
+ smbldap_free_struct(&ctx->smbldap_state);
+ DEBUG(5,("The connection to the LDAP server was closed\n"));
+ /* maybe free the results here --metze */
+
+ return 0;
+}
+
+/********************************
+ Initialise idmap database.
+********************************/
+
+static NTSTATUS idmap_ldap_db_init(struct idmap_domain *dom, const char *params)
+{
+ NTSTATUS ret;
+ struct idmap_ldap_context *ctx;
+ char *config_option;
+ const char *secret;
+ const char *range;
+ const char *tmp;
+
+ ctx = talloc_zero(dom, struct idmap_ldap_context);
+ if ( ! ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
+ if ( ! config_option) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ /* load ranges */
+ range = lp_parm_const_string(-1, config_option, "range", NULL);
+ if (range && range[0]) {
+ if ((sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2) ||
+ (ctx->filter_low_id > ctx->filter_high_id)) {
+ DEBUG(1, ("ERROR: invalid filter range [%s]", range));
+ ctx->filter_low_id = 0;
+ ctx->filter_high_id = 0;
+ }
+ }
+
+ if (params && *params) {
+ /* assume location is the only parameter */
+ ctx->url = talloc_strdup(ctx, params);
+ } else {
+ tmp = lp_parm_const_string(-1, config_option, "ldap_url", NULL);
+
+ if ( ! tmp) {
+ DEBUG(1, ("ERROR: missing idmap ldap url\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ ctx->url = talloc_strdup(ctx, tmp);
+ }
+ CHECK_ALLOC_DONE(ctx->url);
+
+ tmp = lp_ldap_idmap_suffix();
+ if ( ! tmp || ! *tmp) {
+ tmp = lp_parm_const_string(-1, config_option, "ldap_base_dn", NULL);
+ }
+ if ( ! tmp) {
+ tmp = lp_ldap_suffix();
+ if (tmp) {
+ DEBUG(1, ("WARNING: Trying to use the global ldap suffix(%s)\n", tmp));
+ DEBUGADD(1, ("as suffix. This may not be what you want!\n"));
+ }
+ }
+ if ( ! tmp) {
+ DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+ ctx->suffix = talloc_strdup(ctx, tmp);
+ CHECK_ALLOC_DONE(ctx->suffix);
+
+ ctx->anon = lp_parm_bool(-1, config_option, "ldap_anon", False);
+
+ ret = smbldap_init(ctx, ctx->url, &ctx->smbldap_state);
+ if (!NT_STATUS_IS_OK(ret)) {
+ DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n", ctx->url));
+ goto done;
+ }
+
+ if ( ! ctx->anon) {
+ tmp = lp_parm_const_string(-1, config_option, "ldap_user_dn", NULL);
+
+ if ( ! tmp) {
+ tmp = lp_ldap_admin_dn();
+ }
+ if (! tmp || ! *tmp) {
+ DEBUG(1, ("ERROR: missing idmap ldap user dn\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ ctx->user_dn = talloc_strdup(ctx, tmp);
+ CHECK_ALLOC_DONE(ctx->user_dn);
+
+ /* fetch credentials */
+ secret = idmap_fecth_secret("ldap", false, dom->name, ctx->user_dn);
+ if (!secret) {
+ DEBUG(1, ("ERROR: unable to fetch auth credentials\n"));
+ ret = NT_STATUS_ACCESS_DENIED;
+ goto done;
+ }
+ /* now set credentials */
+ smbldap_set_creds(ctx->smbldap_state, false, ctx->user_dn, secret);
+ } else {
+ smbldap_set_creds(ctx->smbldap_state, true, NULL, NULL);
+ }
+
+ /* set the destructor on the context, so that resource are properly
+ * freed if the contexts is released */
+ talloc_set_destructor(ctx, idmap_ldap_close_destructor);
+
+ dom->private_data = ctx;
+
+ talloc_free(config_option);
+ return NT_STATUS_OK;
+
+/*failed */
+done:
+ talloc_free(ctx);
+ return ret;
+}
+
+/* max number of ids requested per batch query */
+#define IDMAP_LDAP_MAX_IDS 30
+
+/**********************************
+ lookup a set of unix ids.
+**********************************/
+
+/* this function searches up to IDMAP_LDAP_MAX_IDS entries in maps for a match */
+static struct id_map *find_map_by_id(struct id_map **maps, enum id_type type, uint32_t id)
+{
+ int i;
+
+ for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
+ if (maps[i] == NULL) { /* end of the run */
+ return NULL;
+ }
+ if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
+ return maps[i];
+ }
+ }
+
+ return NULL;
+}
+
+static NTSTATUS idmap_ldap_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
+{
+ NTSTATUS ret;
+ TALLOC_CTX *memctx;
+ struct idmap_ldap_context *ctx;
+ LDAPMessage *result = NULL;
+ const char *uidNumber;
+ const char *gidNumber;
+ const char **attr_list;
+ char *filter = NULL;
+ BOOL multi = False;
+ int idx = 0;
+ int bidx = 0;
+ int count;
+ int rc;
+ int i;
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
+
+ memctx = talloc_new(ctx);
+ if ( ! memctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
+ gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
+
+ attr_list = get_attr_list(ctx, sidmap_attr_list);
+
+ if ( ! ids[1]) {
+ /* if we are requested just one mapping use the simple filter */
+
+ filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%lu))",
+ LDAP_OBJ_IDMAP_ENTRY,
+ (ids[0]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
+ (unsigned long)ids[0]->xid.id);
+ CHECK_ALLOC_DONE(filter);
+ DEBUG(10, ("Filter: [%s]\n", filter));
+ } else {
+ /* multiple mappings */
+ multi = True;
+ }
+
+again:
+ if (multi) {
+
+ talloc_free(filter);
+ filter = talloc_asprintf(memctx, "(&(objectClass=%s)(|", LDAP_OBJ_IDMAP_ENTRY);
+ CHECK_ALLOC_DONE(filter);
+
+ bidx = idx;
+ for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
+ filter = talloc_asprintf_append(filter, "(%s=%lu)",
+ (ids[idx]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
+ (unsigned long)ids[idx]->xid.id);
+ CHECK_ALLOC_DONE(filter);
+ }
+ filter = talloc_asprintf_append(filter, "))");
+ CHECK_ALLOC_DONE(filter);
+ DEBUG(10, ("Filter: [%s]\n", filter));
+ } else {
+ bidx = 0;
+ idx = 1;
+ }
+
+ rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
+ filter, attr_list, 0, &result);
+
+ if (rc != LDAP_SUCCESS) {
+ DEBUG(3,("Failure looking up ids (%s)\n", ldap_err2string(rc)));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
+
+ if (count == 0) {
+ DEBUG(10, ("NO SIDs found\n"));
+ }
+
+ for (i = 0; i < count; i++) {
+ LDAPMessage *entry = NULL;
+ char *sidstr = NULL;
+ char *tmp = NULL;
+ enum id_type type;
+ struct id_map *map;
+ uint32_t id;
+
+ if (i == 0) { /* first entry */
+ entry = ldap_first_entry(ctx->smbldap_state->ldap_struct, result);
+ } else { /* following ones */
+ entry = ldap_next_entry(ctx->smbldap_state->ldap_struct, entry);
+ }
+ if ( ! entry) {
+ DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
+ continue;
+ }
+
+ /* first check if the SID is present */
+ sidstr = smbldap_talloc_single_attribute(
+ ctx->smbldap_state->ldap_struct,
+ entry, LDAP_ATTRIBUTE_SID, memctx);
+ if ( ! sidstr) { /* no sid, skip entry */
+ DEBUG(2, ("WARNING SID not found on entry\n"));
+ continue;
+ }
+
+ /* now try to see if it is a uid, if not try with a gid
+ * (gid is more common, but in case both uidNumber and
+ * gidNumber are returned the SID is mapped to the uid not the gid) */
+ type = ID_TYPE_UID;
+ tmp = smbldap_talloc_single_attribute(
+ ctx->smbldap_state->ldap_struct,
+ entry, uidNumber, memctx);
+ if ( ! tmp) {
+ type = ID_TYPE_GID;
+ tmp = smbldap_talloc_single_attribute(
+ ctx->smbldap_state->ldap_struct,
+ entry, gidNumber, memctx);
+ }
+ if ( ! tmp) { /* wow very strange entry, how did it match ? */
+ DEBUG(5, ("Unprobable match on (%s), no uidNumber, nor gidNumber returned\n", sidstr));
+ TALLOC_FREE(sidstr);
+ continue;
+ }
+
+ id = strtoul(tmp, NULL, 10);
+ if ((id == 0) ||
+ (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
+ (ctx->filter_high_id && (id > ctx->filter_high_id))) {
+ DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
+ id, ctx->filter_low_id, ctx->filter_high_id));
+ TALLOC_FREE(sidstr);
+ TALLOC_FREE(tmp);
+ continue;
+ }
+ TALLOC_FREE(tmp);
+
+ map = find_map_by_id(&ids[bidx], type, id);
+ if (!map) {
+ DEBUG(2, ("WARNING: couldn't match sid (%s) with requested ids\n", sidstr));
+ TALLOC_FREE(sidstr);
+ continue;
+ }
+
+ if ( ! string_to_sid(map->sid, sidstr)) {
+ DEBUG(2, ("ERROR: Invalid SID on entry\n"));
+ TALLOC_FREE(sidstr);
+ continue;
+ }
+ TALLOC_FREE(sidstr);
+
+ /* mapped */
+ map->mapped = True;
+
+ DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_static(map->sid), (unsigned long)map->xid.id, map->xid.type));
+ }
+
+ /* free the ldap results */
+ if (result) {
+ ldap_msgfree(result);
+ result = NULL;
+ }
+
+ if (multi && ids[idx]) { /* still some values to map */
+ goto again;
+ }
+
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(memctx);
+ return ret;
+}
+
+/**********************************
+ lookup a set of sids.
+**********************************/
+
+/* this function searches up to IDMAP_LDAP_MAX_IDS entries in maps for a match */
+static struct id_map *find_map_by_sid(struct id_map **maps, DOM_SID *sid)
+{
+ int i;
+
+ for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
+ if (maps[i] == NULL) { /* end of the run */
+ return NULL;
+ }
+ if (sid_equal(maps[i]->sid, sid)) {
+ return maps[i];
+ }
+ }
+
+ return NULL;
+}
+
+static NTSTATUS idmap_ldap_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
+{
+ NTSTATUS ret;
+ TALLOC_CTX *memctx;
+ struct idmap_ldap_context *ctx;
+ LDAPMessage *result = NULL;
+ const char *uidNumber;
+ const char *gidNumber;
+ const char **attr_list;
+ char *filter = NULL;
+ BOOL multi = False;
+ int idx = 0;
+ int bidx = 0;
+ int count;
+ int rc;
+ int i;
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
+
+ memctx = talloc_new(ctx);
+ if ( ! memctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
+ gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
+
+ attr_list = get_attr_list(ctx, sidmap_attr_list);
+
+ if ( ! ids[1]) {
+ /* if we are requested just one mapping use the simple filter */
+
+ filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%s))",
+ LDAP_OBJ_IDMAP_ENTRY,
+ LDAP_ATTRIBUTE_SID,
+ sid_string_static(ids[0]->sid));
+ CHECK_ALLOC_DONE(filter);
+ DEBUG(10, ("Filter: [%s]\n", filter));
+ } else {
+ /* multiple mappings */
+ multi = True;
+ }
+
+again:
+ if (multi) {
+
+ TALLOC_FREE(filter);
+ filter = talloc_asprintf(memctx, "(&(objectClass=%s)(|", LDAP_OBJ_IDMAP_ENTRY);
+ CHECK_ALLOC_DONE(filter);
+
+ bidx = idx;
+ for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
+ filter = talloc_asprintf_append(filter, "(%s=%s)",
+ LDAP_ATTRIBUTE_SID,
+ sid_string_static(ids[idx]->sid));
+ CHECK_ALLOC_DONE(filter);
+ }
+ filter = talloc_asprintf_append(filter, "))");
+ CHECK_ALLOC_DONE(filter);
+ DEBUG(10, ("Filter: [%s]", filter));
+ } else {
+ bidx = 0;
+ idx = 1;
+ }
+
+ rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
+ filter, attr_list, 0, &result);
+
+ if (rc != LDAP_SUCCESS) {
+ DEBUG(3,("Failure looking up sids (%s)\n", ldap_err2string(rc)));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
+
+ if (count == 0) {
+ DEBUG(10, ("NO SIDs found\n"));
+ }
+
+ for (i = 0; i < count; i++) {
+ LDAPMessage *entry = NULL;
+ char *sidstr = NULL;
+ char *tmp = NULL;
+ enum id_type type;
+ struct id_map *map;
+ DOM_SID sid;
+ uint32_t id;
+
+ if (i == 0) { /* first entry */
+ entry = ldap_first_entry(ctx->smbldap_state->ldap_struct, result);
+ } else { /* following ones */
+ entry = ldap_next_entry(ctx->smbldap_state->ldap_struct, entry);
+ }
+
+ /* first check if the SID is present */
+ sidstr = smbldap_talloc_single_attribute(
+ ctx->smbldap_state->ldap_struct,
+ entry, LDAP_ATTRIBUTE_SID, memctx);
+ if ( ! sidstr) { /* no sid ??, skip entry */
+ DEBUG(2, ("WARNING SID not found on entry\n"));
+ continue;
+ }
+
+ if ( ! string_to_sid(&sid, sidstr)) {
+ DEBUG(2, ("ERROR: Invalid SID on entry\n"));
+ TALLOC_FREE(sidstr);
+ continue;
+ }
+
+ map = find_map_by_sid(&ids[bidx], &sid);
+ if (!map) {
+ DEBUG(2, ("WARNING: couldn't find entry sid (%s) in ids", sidstr));
+ TALLOC_FREE(sidstr);
+ continue;
+ }
+
+ TALLOC_FREE(sidstr);
+
+ /* now try to see if it is a uid, if not try with a gid
+ * (gid is more common, but in case both uidNumber and
+ * gidNumber are returned the SID is mapped to the uid not the gid) */
+ type = ID_TYPE_UID;
+ tmp = smbldap_talloc_single_attribute(
+ ctx->smbldap_state->ldap_struct,
+ entry, uidNumber, memctx);
+ if ( ! tmp) {
+ type = ID_TYPE_GID;
+ tmp = smbldap_talloc_single_attribute(
+ ctx->smbldap_state->ldap_struct,
+ entry, gidNumber, memctx);
+ }
+ if ( ! tmp) { /* no ids ?? */
+ DEBUG(5, ("no uidNumber, nor gidNumber attributes found\n"));
+ continue;
+ }
+
+ id = strtoul(tmp, NULL, 10);
+ if ((id == 0) ||
+ (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
+ (ctx->filter_high_id && (id > ctx->filter_high_id))) {
+ DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
+ id, ctx->filter_low_id, ctx->filter_high_id));
+ TALLOC_FREE(tmp);
+ continue;
+ }
+ TALLOC_FREE(tmp);
+
+ /* mapped */
+ map->xid.type = type;
+ map->xid.id = id;
+ map->mapped = True;
+
+ DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_static(map->sid), (unsigned long)map->xid.id, map->xid.type));
+ }
+
+ /* free the ldap results */
+ if (result) {
+ ldap_msgfree(result);
+ result = NULL;
+ }
+
+ if (multi && ids[idx]) { /* still some values to map */
+ goto again;
+ }
+
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(memctx);
+ return ret;
+}
+
+/**********************************
+ set a mapping.
+**********************************/
+
+/* TODO: change this: This function cannot be called to modify a mapping, only set a new one */
+
+static NTSTATUS idmap_ldap_set_mapping(struct idmap_domain *dom, const struct id_map *map)
+{
+ NTSTATUS ret;
+ TALLOC_CTX *memctx;
+ struct idmap_ldap_context *ctx;
+ LDAPMessage *entry = NULL;
+ LDAPMod **mods = NULL;
+ const char *type;
+ char *id_str;
+ char *sid;
+ char *dn;
+ int rc = -1;
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
+
+ switch(map->xid.type) {
+ case ID_TYPE_UID:
+ type = get_attr_key2string(sidmap_attr_list, LDAP_ATTR_UIDNUMBER);
+ break;
+
+ case ID_TYPE_GID:
+ type = get_attr_key2string(sidmap_attr_list, LDAP_ATTR_GIDNUMBER);
+ break;
+
+ default:
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ memctx = talloc_new(ctx);
+ if ( ! memctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ id_str = talloc_asprintf(memctx, "%lu", (unsigned long)map->xid.id);
+ CHECK_ALLOC_DONE(id_str);
+
+ sid = talloc_strdup(memctx, sid_string_static(map->sid));
+ CHECK_ALLOC_DONE(sid);
+
+ dn = talloc_asprintf(memctx, "%s=%s,%s",
+ get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
+ sid,
+ ctx->suffix);
+ CHECK_ALLOC_DONE(dn);
+
+ smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_IDMAP_ENTRY);
+
+ smbldap_make_mod(ctx->smbldap_state->ldap_struct, entry, &mods, type, id_str);
+
+ smbldap_make_mod(ctx->smbldap_state->ldap_struct, entry, &mods,
+ get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID), sid);
+
+ if ( ! mods) {
+ DEBUG(2, ("ERROR: No mods?\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ /* TODO: remove conflicting mappings! */
+
+ smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SID_ENTRY);
+
+ DEBUG(10, ("Set DN %s (%s -> %s)\n", dn, sid, id_str));
+
+ rc = smbldap_add(ctx->smbldap_state, dn, mods);
+ ldap_mods_free(mods, True);
+
+ if (rc != LDAP_SUCCESS) {
+ char *ld_error = NULL;
+ ldap_get_option(ctx->smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING, &ld_error);
+ DEBUG(0,("ldap_set_mapping_internals: Failed to add %s to %lu mapping [%s]\n",
+ sid, (unsigned long)map->xid.id, type));
+ DEBUG(0, ("ldap_set_mapping_internals: Error was: %s (%s)\n",
+ ld_error ? ld_error : "(NULL)", ldap_err2string (rc)));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to %lu [%s]\n",
+ sid, (unsigned long)map->xid.id, type));
+
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(memctx);
+ return ret;
+}
+
+/**********************************
+ remove a mapping.
+**********************************/
+
+static NTSTATUS idmap_ldap_remove_mapping(struct idmap_domain *dom, const struct id_map *map)
+{
+ return NT_STATUS_UNSUCCESSFUL;
+}
+
+/**********************************
+ Close the idmap ldap instance
+**********************************/
+
+static NTSTATUS idmap_ldap_close(struct idmap_domain *dom)
+{
+ struct idmap_ldap_context *ctx;
+
+ if (dom->private_data) {
+ ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
+
+ talloc_free(ctx);
+ dom->private_data = NULL;
+ }
+
+ return NT_STATUS_OK;
+}
+
+static struct idmap_methods idmap_ldap_methods = {
+
+ .init = idmap_ldap_db_init,
+ .unixids_to_sids = idmap_ldap_unixids_to_sids,
+ .sids_to_unixids = idmap_ldap_sids_to_unixids,
+ .set_mapping = idmap_ldap_set_mapping,
+ .remove_mapping = idmap_ldap_remove_mapping,
+ /* .dump_data = TODO */
+ .close_fn = idmap_ldap_close
+};
+
+static struct idmap_alloc_methods idmap_ldap_alloc_methods = {
+
+ .init = idmap_ldap_alloc_init,
+ .allocate_id = idmap_ldap_allocate_id,
+ .get_id_hwm = idmap_ldap_get_hwm,
+ .set_id_hwm = idmap_ldap_set_hwm,
+ .close_fn = idmap_ldap_alloc_close,
+ /* .dump_data = TODO */
+};
+
+NTSTATUS idmap_alloc_ldap_init(void)
+{
+ return smb_register_idmap_alloc(SMB_IDMAP_INTERFACE_VERSION, "ldap", &idmap_ldap_alloc_methods);
+}
+
+NTSTATUS idmap_ldap_init(void)
+{
+ NTSTATUS ret;
+
+ /* FIXME: bad hack to actually register also the alloc_ldap module without changining configure.in */
+ ret = idmap_alloc_ldap_init();
+ if (! NT_STATUS_IS_OK(ret)) {
+ return ret;
+ }
+ return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ldap", &idmap_ldap_methods);
+}
+
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+
+ idmap PASSDB backend
+
+ Copyright (C) Simo Sorce 2006
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "winbindd.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_IDMAP
+
+/*****************************
+ Initialise idmap database.
+*****************************/
+
+static NTSTATUS idmap_nss_int_init(struct idmap_domain *dom, const char *compat_params)
+{
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ lookup a set of unix ids.
+**********************************/
+
+static NTSTATUS idmap_nss_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
+{
+ TALLOC_CTX *ctx;
+ struct winbindd_domain *wdom;
+ BOOL winbind_env;
+ int i;
+
+ wdom = find_lookup_domain_from_name(dom->name);
+ if (!wdom) {
+ DEBUG(2, ("Can't lookup domain %s\n", dom->name));
+ return NT_STATUS_NO_SUCH_DOMAIN;
+ }
+
+ ctx = talloc_new(dom);
+ if ( ! ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* avoid any possible recursion in winbindd,
+ * these calls are aimed at getting info
+ * out of alternative nss dbs anyway */
+ winbind_env = winbind_env_set();
+ winbind_off();
+
+ for (i = 0; ids[i]; i++) {
+ struct passwd *pw;
+ struct group *gr;
+ const char *name;
+ enum lsa_SidType type;
+
+ switch (ids[i]->xid.type) {
+ case ID_TYPE_UID:
+ pw = getpwuid((uid_t)ids[i]->xid.id);
+ if (!pw) {
+ ids[i]->mapped = False;
+ continue;
+ }
+ name = pw->pw_name;
+ break;
+ case ID_TYPE_GID:
+ gr = getgrgid((gid_t)ids[i]->xid.id);
+ if (!gr) {
+ ids[i]->mapped = False;
+ continue;
+ }
+ name = gr->gr_name;
+ break;
+ default: /* ?? */
+ ids[i]->mapped = False;
+ continue;
+ }
+
+ /* Lookup name from PDC using lsa_lookup_names() */
+ if (!winbindd_lookup_sid_by_name(ctx, wdom, dom->name, name, ids[i]->sid, &type)) {
+ ids[i]->mapped = False;
+ continue;
+ }
+
+ /* make sure it is marked as unmapped if types do not match */
+ ids[i]->mapped = False;
+
+ switch (type) {
+ case SID_NAME_USER:
+ if (ids[i]->xid.type == ID_TYPE_UID) {
+ ids[i]->mapped = True;
+ }
+ break;
+
+ case SID_NAME_DOM_GRP:
+ case SID_NAME_ALIAS:
+ case SID_NAME_WKN_GRP:
+ if (ids[i]->xid.type == ID_TYPE_GID) {
+ ids[i]->mapped = True;
+ }
+ break;
+
+ default:
+ break;
+ }
+ }
+
+ /* allow winbindd calls again, if they were enabled */
+ if (!winbind_env) {
+ winbind_on();
+ }
+
+ talloc_free(ctx);
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ lookup a set of sids.
+**********************************/
+
+static NTSTATUS idmap_nss_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
+{
+ TALLOC_CTX *ctx;
+ BOOL winbind_env;
+ int i;
+
+ ctx = talloc_new(dom);
+ if ( ! ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* avoid any possible recursion in winbindd,
+ * these calls are aimed at getting info
+ * out of alternative nss dbs anyway */
+ winbind_env = winbind_env_set();
+ winbind_off();
+
+ for (i = 0; ids[i]; i++) {
+ struct passwd *pw;
+ struct group *gr;
+ enum lsa_SidType type;
+ char *dom_name = NULL;
+ char *name = NULL;
+
+ if (!winbindd_lookup_name_by_sid(ctx, ids[i]->sid, &dom_name, &name, &type)) {
+ ids[i]->mapped = False;
+ continue;
+ }
+
+ /* make sure it is marked as unmapped if types do not match */
+ ids[i]->mapped = False;
+
+ switch (type) {
+ case SID_NAME_USER:
+
+ /* this will find also all lower case name and use username level */
+ pw = Get_Pwnam(name);
+ if (pw) {
+ ids[i]->xid.id = pw->pw_uid;
+ ids[i]->xid.type = ID_TYPE_UID;
+ ids[i]->mapped = True;
+ }
+ break;
+
+ case SID_NAME_DOM_GRP:
+ case SID_NAME_ALIAS:
+ case SID_NAME_WKN_GRP:
+
+ gr = getgrnam(name);
+ if (gr) {
+ ids[i]->xid.id = gr->gr_gid;
+ ids[i]->xid.type = ID_TYPE_GID;
+ ids[i]->mapped = True;
+ }
+ break;
+
+ default:
+ break;
+ }
+
+ TALLOC_FREE(dom_name);
+ TALLOC_FREE(name);
+ }
+
+ /* allow winbindd calls again, if they were enabled */
+ if (!winbind_env) {
+ winbind_on();
+ }
+
+ talloc_free(ctx);
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ Close the idmap tdb instance
+**********************************/
+
+static NTSTATUS idmap_nss_close(struct idmap_domain *dom)
+{
+ return NT_STATUS_OK;
+}
+
+static struct idmap_methods nss_methods = {
+
+ .init = idmap_nss_int_init,
+ .unixids_to_sids = idmap_nss_unixids_to_sids,
+ .sids_to_unixids = idmap_nss_sids_to_unixids,
+ .close_fn = idmap_nss_close
+};
+
+NTSTATUS idmap_nss_init(void)
+{
+ return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "nss", &nss_methods);
+}
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+
+ idmap PASSDB backend
+
+ Copyright (C) Simo Sorce 2006
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_IDMAP
+
+/*****************************
+ Initialise idmap database.
+*****************************/
+
+static NTSTATUS idmap_pdb_init(struct idmap_domain *dom, const char *compat_params)
+{
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ lookup a set of unix ids.
+**********************************/
+
+static NTSTATUS idmap_pdb_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
+{
+ int i;
+
+ for (i = 0; ids[i]; i++) {
+ switch (ids[i]->xid.type) {
+ case ID_TYPE_UID:
+ ids[i]->mapped = pdb_uid_to_sid((uid_t)ids[i]->xid.id, ids[i]->sid);
+ break;
+ case ID_TYPE_GID:
+ ids[i]->mapped = pdb_gid_to_sid((gid_t)ids[i]->xid.id, ids[i]->sid);
+ break;
+ default: /* ?? */
+ ids[i]->mapped = False;
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ lookup a set of sids.
+**********************************/
+
+static NTSTATUS idmap_pdb_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
+{
+ int i;
+
+ for (i = 0; ids[i]; i++) {
+ enum lsa_SidType type;
+ union unid_t id;
+
+ if (pdb_sid_to_id(ids[i]->sid, &id, &type)) {
+ switch (type) {
+ case SID_NAME_USER:
+ ids[i]->xid.id = id.uid;
+ ids[i]->xid.type = ID_TYPE_UID;
+ ids[i]->mapped = True;
+ break;
+
+ case SID_NAME_DOM_GRP:
+ case SID_NAME_ALIAS:
+ case SID_NAME_WKN_GRP:
+ ids[i]->xid.id = id.gid;
+ ids[i]->xid.type = ID_TYPE_GID;
+ ids[i]->mapped = True;
+ break;
+
+ default: /* ?? */
+ /* make sure it is marked as unmapped */
+ ids[i]->mapped = False;
+ break;
+ }
+ } else {
+ /* Query Failed */
+ ids[i]->mapped = False;
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ Close the idmap tdb instance
+**********************************/
+
+static NTSTATUS idmap_pdb_close(struct idmap_domain *dom)
+{
+ return NT_STATUS_OK;
+}
+
+static struct idmap_methods passdb_methods = {
+
+ .init = idmap_pdb_init,
+ .unixids_to_sids = idmap_pdb_unixids_to_sids,
+ .sids_to_unixids = idmap_pdb_sids_to_unixids,
+ .close_fn =idmap_pdb_close
+};
+
+NTSTATUS idmap_passdb_init(void)
+{
+ return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "passdb", &passdb_methods);
+}
--- /dev/null
+/*
+ * idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts
+ * Copyright (C) Guenther Deschner, 2004
+ * Copyright (C) Sumit Bose, 2004
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+#include "includes.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_IDMAP
+
+struct idmap_rid_context {
+ DOM_SID dom_sid;
+ uint32_t low_id;
+ uint32_t high_id;
+ uint32_t base_rid;
+};
+
+/* compat params can't be used because of the completely different way we support multiple domains in the new idmap */
+static NTSTATUS idmap_rid_initialize(struct idmap_domain *dom, const char *compat_params)
+{
+ NTSTATUS ret;
+ struct idmap_rid_context *ctx;
+ char *config_option = NULL;
+ const char *range;
+
+ ctx = talloc_zero(dom, struct idmap_rid_context);
+ if ( ! ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
+ if ( ! config_option) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ range = lp_parm_const_string(-1, config_option, "range", NULL);
+ if (( ! range) ||
+ (sscanf(range, "%u - %u", &ctx->low_id, &ctx->high_id) != 2) ||
+ (ctx->low_id > ctx->high_id)) {
+ ctx->low_id = 0;
+ ctx->high_id = 0;
+ }
+
+ if (( ! ctx->low_id) || ( ! ctx->high_id)) {
+ DEBUG(1, ("ERROR: Invalid configuration, ID range missing\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto failed;
+ }
+
+ ctx->base_rid = lp_parm_int(-1, config_option, "base_rid", 0);
+
+ sid_copy(&ctx->dom_sid, dom->sid);
+
+ dom->private_data = ctx;
+
+ talloc_free(config_option);
+ return NT_STATUS_OK;
+
+failed:
+ talloc_free(ctx);
+ return ret;
+}
+
+static NTSTATUS idmap_rid_id_to_sid(struct idmap_rid_context *ctx, struct id_map *map)
+{
+ char *domname, *name;
+ enum lsa_SidType sid_type;
+
+ if (!ctx || !map) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ /* apply filters before checking */
+ if ((map->xid.id < ctx->low_id) || (map->xid.id > ctx->high_id)) {
+ DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
+ map->xid.id, ctx->low_id, ctx->high_id));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ sid_compose(map->sid, &ctx->dom_sid, map->xid.id - ctx->low_id + ctx->base_rid);
+
+ if (winbindd_lookup_name_by_sid(ctx, map->sid, &domname, &name, &sid_type)) {
+ switch (sid_type) {
+ case SID_NAME_USER:
+ if (map->xid.type != ID_TYPE_UID) {
+ /* wrong type */
+ DEBUG(5, ("Resulting SID is of wrong ID type\n"));
+ return NT_STATUS_NONE_MAPPED;
+ }
+ break;
+ case SID_NAME_DOM_GRP:
+ case SID_NAME_ALIAS:
+ case SID_NAME_WKN_GRP:
+ if (map->xid.type != ID_TYPE_GID) {
+ /* wrong type */
+ DEBUG(5, ("Resulting SID is of wrong ID type\n"));
+ return NT_STATUS_NONE_MAPPED;
+ }
+ break;
+ default:
+ /* invalid sid, let's just leave it unmapped */
+ DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map->sid)));
+ return NT_STATUS_NONE_MAPPED;
+ }
+ } else {
+ DEBUG(2, ("Failed: to resolve SID\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ map->mapped = True;
+
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ Single sid to id lookup function.
+**********************************/
+
+static NTSTATUS idmap_rid_sid_to_id(struct idmap_rid_context *ctx, struct id_map *map)
+{
+ char *domname, *name;
+ enum lsa_SidType sid_type;
+ uint32_t rid;
+
+ if (!ctx || !map) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ sid_peek_rid(map->sid, &rid);
+ map->xid.id = rid - ctx->base_rid + ctx->low_id;
+
+ /* check if this is a valid SID and set the type */
+ if (winbindd_lookup_name_by_sid(ctx, map->sid, &domname, &name, &sid_type)) {
+ switch (sid_type) {
+ case SID_NAME_USER:
+ map->xid.type = ID_TYPE_UID;
+ break;
+ case SID_NAME_DOM_GRP:
+ case SID_NAME_ALIAS:
+ case SID_NAME_WKN_GRP:
+ map->xid.type = ID_TYPE_GID;
+ break;
+ default:
+ /* invalid sid, let's just leave it unmapped */
+ DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map->sid)));
+ return NT_STATUS_NONE_MAPPED;
+ }
+ } else {
+ DEBUG(2, ("Failed: to resolve SID\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ /* apply filters before returning result */
+ if ((map->xid.id < ctx->low_id) || (map->xid.id > ctx->high_id)) {
+ DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
+ map->xid.id, ctx->low_id, ctx->high_id));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ map->mapped = True;
+
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ lookup a set of unix ids.
+**********************************/
+
+static NTSTATUS idmap_rid_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
+{
+ struct idmap_rid_context *ctx;
+ NTSTATUS ret;
+ int i;
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_rid_context);
+
+ for (i = 0; ids[i]; i++) {
+ /* make sure it is marked as unmapped before resolveing */
+ ids[i]->mapped = False;
+
+ ret = idmap_rid_id_to_sid(ctx, ids[i]);
+
+ if (( ! NT_STATUS_IS_OK(ret)) &&
+ ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
+ /* some fatal error occurred, log it */
+ DEBUG(3, ("Unexpected error resolving an ID (%d)\n", ids[i]->xid.id));
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ lookup a set of sids.
+**********************************/
+
+static NTSTATUS idmap_rid_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
+{
+ struct idmap_rid_context *ctx;
+ NTSTATUS ret;
+ int i;
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_rid_context);
+
+ for (i = 0; ids[i]; i++) {
+ /* make sure it is marked as unmapped before resolveing */
+ ids[i]->mapped = False;
+
+ ret = idmap_rid_sid_to_id(ctx, ids[i]);
+
+ if (( ! NT_STATUS_IS_OK(ret)) &&
+ ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
+ /* some fatal error occurred, log it */
+ DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
+ sid_string_static(ids[i]->sid)));
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
+static NTSTATUS idmap_rid_close(struct idmap_domain *dom)
+{
+ struct idmap_tdb_context *ctx;
+
+ if (dom->private_data) {
+ TALLOC_FREE(dom->private_data);
+ }
+ return NT_STATUS_OK;
+}
+
+static struct idmap_methods rid_methods = {
+ .init = idmap_rid_initialize,
+ .unixids_to_sids = idmap_rid_unixids_to_sids,
+ .sids_to_unixids = idmap_rid_sids_to_unixids,
+ .close_fn = idmap_rid_close
+};
+
+NTSTATUS idmap_rid_init(void)
+{
+ return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "rid", &rid_methods);
+}
+
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+
+ idmap TDB backend
+
+ Copyright (C) Tim Potter 2000
+ Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
+ Copyright (C) Jeremy Allison 2006
+ Copyright (C) Simo Sorce 2003-2006
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "winbindd.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_IDMAP
+
+/* High water mark keys */
+#define HWM_GROUP "GROUP HWM"
+#define HWM_USER "USER HWM"
+
+static struct idmap_tdb_state {
+
+ /* User and group id pool */
+ uid_t low_uid, high_uid; /* Range of uids to allocate */
+ gid_t low_gid, high_gid; /* Range of gids to allocate */
+
+} idmap_tdb_state;
+
+/*****************************************************************************
+ For idmap conversion: convert one record to new format
+ Ancient versions (eg 2.2.3a) of winbindd_idmap.tdb mapped DOMAINNAME/rid
+ instead of the SID.
+*****************************************************************************/
+static int convert_fn(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA data, void *state)
+{
+ struct winbindd_domain *domain;
+ char *p;
+ DOM_SID sid;
+ uint32 rid;
+ fstring keystr;
+ fstring dom_name;
+ TDB_DATA key2;
+ BOOL *failed = (BOOL *)state;
+
+ DEBUG(10,("Converting %s\n", key.dptr));
+
+ p = strchr(key.dptr, '/');
+ if (!p)
+ return 0;
+
+ *p = 0;
+ fstrcpy(dom_name, key.dptr);
+ *p++ = '/';
+
+ domain = find_domain_from_name(dom_name);
+ if (domain == NULL) {
+ /* We must delete the old record. */
+ DEBUG(0,("Unable to find domain %s\n", dom_name ));
+ DEBUG(0,("deleting record %s\n", key.dptr ));
+
+ if (tdb_delete(tdb, key) != 0) {
+ DEBUG(0, ("Unable to delete record %s\n", key.dptr));
+ *failed = True;
+ return -1;
+ }
+
+ return 0;
+ }
+
+ rid = atoi(p);
+
+ sid_copy(&sid, &domain->sid);
+ sid_append_rid(&sid, rid);
+
+ sid_to_string(keystr, &sid);
+ key2.dptr = keystr;
+ key2.dsize = strlen(keystr) + 1;
+
+ if (tdb_store(tdb, key2, data, TDB_INSERT) != 0) {
+ DEBUG(0,("Unable to add record %s\n", key2.dptr ));
+ *failed = True;
+ return -1;
+ }
+
+ if (tdb_store(tdb, data, key2, TDB_REPLACE) != 0) {
+ DEBUG(0,("Unable to update record %s\n", data.dptr ));
+ *failed = True;
+ return -1;
+ }
+
+ if (tdb_delete(tdb, key) != 0) {
+ DEBUG(0,("Unable to delete record %s\n", key.dptr ));
+ *failed = True;
+ return -1;
+ }
+
+ return 0;
+}
+
+/*****************************************************************************
+ Convert the idmap database from an older version.
+*****************************************************************************/
+
+static BOOL idmap_tdb_convert(const char *idmap_name)
+{
+ int32 vers;
+ BOOL bigendianheader;
+ BOOL failed = False;
+ TDB_CONTEXT *idmap_tdb;
+
+ if (!(idmap_tdb = tdb_open_log(idmap_name, 0,
+ TDB_DEFAULT, O_RDWR,
+ 0600))) {
+ DEBUG(0, ("Unable to open idmap database\n"));
+ return False;
+ }
+
+ bigendianheader = (tdb_get_flags(idmap_tdb) & TDB_BIGENDIAN) ? True : False;
+
+ vers = tdb_fetch_int32(idmap_tdb, "IDMAP_VERSION");
+
+ if (((vers == -1) && bigendianheader) || (IREV(vers) == IDMAP_VERSION)) {
+ /* Arrggghh ! Bytereversed or old big-endian - make order independent ! */
+ /*
+ * high and low records were created on a
+ * big endian machine and will need byte-reversing.
+ */
+
+ int32 wm;
+
+ wm = tdb_fetch_int32(idmap_tdb, HWM_USER);
+
+ if (wm != -1) {
+ wm = IREV(wm);
+ } else {
+ wm = idmap_tdb_state.low_uid;
+ }
+
+ if (tdb_store_int32(idmap_tdb, HWM_USER, wm) == -1) {
+ DEBUG(0, ("Unable to byteswap user hwm in idmap database\n"));
+ tdb_close(idmap_tdb);
+ return False;
+ }
+
+ wm = tdb_fetch_int32(idmap_tdb, HWM_GROUP);
+ if (wm != -1) {
+ wm = IREV(wm);
+ } else {
+ wm = idmap_tdb_state.low_gid;
+ }
+
+ if (tdb_store_int32(idmap_tdb, HWM_GROUP, wm) == -1) {
+ DEBUG(0, ("Unable to byteswap group hwm in idmap database\n"));
+ tdb_close(idmap_tdb);
+ return False;
+ }
+ }
+
+ /* the old format stored as DOMAIN/rid - now we store the SID direct */
+ tdb_traverse(idmap_tdb, convert_fn, &failed);
+
+ if (failed) {
+ DEBUG(0, ("Problem during conversion\n"));
+ tdb_close(idmap_tdb);
+ return False;
+ }
+
+ if (tdb_store_int32(idmap_tdb, "IDMAP_VERSION", IDMAP_VERSION) == -1) {
+ DEBUG(0, ("Unable to dtore idmap version in databse\n"));
+ tdb_close(idmap_tdb);
+ return False;
+ }
+
+ tdb_close(idmap_tdb);
+ return True;
+}
+
+/*****************************************************************************
+ Convert the idmap database from an older version if necessary
+*****************************************************************************/
+
+BOOL idmap_tdb_upgrade(TALLOC_CTX *ctx, const char *tdbfile)
+{
+ char *backup_name;
+
+ DEBUG(0, ("Upgrading winbindd_idmap.tdb from an old version\n"));
+
+ backup_name = talloc_asprintf(ctx, "%s.bak", tdbfile);
+ if ( ! backup_name) {
+ DEBUG(0, ("Out of memory!\n"));
+ return False;
+ }
+
+ if (backup_tdb(tdbfile, backup_name, 0) != 0) {
+ DEBUG(0, ("Could not backup idmap database\n"));
+ talloc_free(backup_name);
+ return False;
+ }
+
+ talloc_free(backup_name);
+ return idmap_tdb_convert(tdbfile);
+}
+
+/* WARNING: We can't open a tdb twice inthe same process, for that reason
+ * I'm going to use a hack with open ref counts to open the winbindd_idmap.tdb
+ * only once. We will later decide whether to split the db in multiple files
+ * or come up with a better solution to share them. */
+
+static TDB_CONTEXT *idmap_tdb_common_ctx;
+static int idmap_tdb_open_ref_count = 0;
+
+static NTSTATUS idmap_tdb_open_db(TALLOC_CTX *memctx, TDB_CONTEXT **tdbctx)
+{
+ NTSTATUS ret;
+ TALLOC_CTX *ctx;
+ SMB_STRUCT_STAT stbuf;
+ char *tdbfile = NULL;
+ int32 version;
+ BOOL tdb_is_new = False;
+
+ if (idmap_tdb_open_ref_count) { /* the tdb has already been opened */
+ idmap_tdb_open_ref_count++;
+ *tdbctx = idmap_tdb_common_ctx;
+ return NT_STATUS_OK;
+ }
+
+ /* use our own context here */
+ ctx = talloc_new(memctx);
+ if (!ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* use the old database if present */
+ tdbfile = talloc_strdup(ctx, lock_path("winbindd_idmap.tdb"));
+ if (!tdbfile) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ if (!file_exist(tdbfile, &stbuf)) {
+ tdb_is_new = True;
+ }
+
+ DEBUG(10,("Opening tdbfile %s\n", tdbfile ));
+
+ /* Open idmap repository */
+ if (!(idmap_tdb_common_ctx = tdb_open_log(tdbfile, 0, TDB_DEFAULT, O_RDWR | O_CREAT, 0644))) {
+ DEBUG(0, ("Unable to open idmap database\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ if (tdb_is_new) {
+ /* the file didn't existed before opening it, let's
+ * store idmap version as nobody else yet opened and
+ * stored it. I do not like this method but didn't
+ * found a way to understand if an opened tdb have
+ * been just created or not --- SSS */
+ tdb_store_int32(idmap_tdb_common_ctx, "IDMAP_VERSION", IDMAP_VERSION);
+ }
+
+ /* check against earlier versions */
+ version = tdb_fetch_int32(idmap_tdb_common_ctx, "IDMAP_VERSION");
+ if (version != IDMAP_VERSION) {
+
+ /* backup_tdb expects the tdb not to be open */
+ tdb_close(idmap_tdb_common_ctx);
+
+ if ( ! idmap_tdb_upgrade(ctx, tdbfile)) {
+
+ DEBUG(0, ("Unable to open idmap database, it's in an old formati, and upgrade failed!\n"));
+ ret = NT_STATUS_INTERNAL_DB_ERROR;
+ goto done;
+ }
+
+ /* Re-Open idmap repository */
+ if (!(idmap_tdb_common_ctx = tdb_open_log(tdbfile, 0, TDB_DEFAULT, O_RDWR | O_CREAT, 0644))) {
+ DEBUG(0, ("Unable to open idmap database\n"));
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+ }
+
+ *tdbctx = idmap_tdb_common_ctx;
+ idmap_tdb_open_ref_count++;
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(ctx);
+ return ret;
+}
+
+ /* NEVER use tdb_close() except for the conversion routines that are guaranteed
+ * to run only when the database is opened the first time, always use this function. */
+
+BOOL idmap_tdb_tdb_close(TDB_CONTEXT *tdbctx)
+{
+ if (tdbctx != idmap_tdb_common_ctx) {
+ DEBUG(0, ("ERROR: Invalid tdb context!"));
+ return False;
+ }
+
+ idmap_tdb_open_ref_count--;
+ if (idmap_tdb_open_ref_count) {
+ return True;
+ }
+
+ return tdb_close(idmap_tdb_common_ctx);
+}
+
+/**********************************************************************
+ IDMAP ALLOC TDB BACKEND
+**********************************************************************/
+
+static TDB_CONTEXT *idmap_alloc_tdb;
+
+/**********************************
+ Initialise idmap alloc database.
+**********************************/
+
+static NTSTATUS idmap_tdb_alloc_init( const char *params )
+{
+ NTSTATUS ret;
+ TALLOC_CTX *ctx;
+ const char *range;
+ uint32_t low_id = 0;
+ uint32_t high_id = 0;
+
+ /* use our own context here */
+ ctx = talloc_new(NULL);
+ if (!ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ ret = idmap_tdb_open_db(ctx, &idmap_alloc_tdb);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ talloc_free(ctx);
+ return ret;
+ }
+
+ talloc_free(ctx);
+
+ /* load ranges */
+ idmap_tdb_state.low_uid = 0;
+ idmap_tdb_state.high_uid = 0;
+ idmap_tdb_state.low_gid = 0;
+ idmap_tdb_state.high_gid = 0;
+
+ range = lp_parm_const_string(-1, "idmap alloc config", "range", NULL);
+ if (range && range[0]) {
+ if (sscanf(range, "%u - %u", &low_id, &high_id) == 2) {
+ if (low_id < high_id) {
+ idmap_tdb_state.low_gid = idmap_tdb_state.low_uid = low_id;
+ idmap_tdb_state.high_gid = idmap_tdb_state.high_uid = high_id;
+ } else {
+ DEBUG(1, ("ERROR: invalid idmap alloc range [%s]", range));
+ }
+ } else {
+ DEBUG(1, ("ERROR: invalid syntax for idmap alloc config:range [%s]", range));
+ }
+ }
+
+ /* Create high water marks for group and user id */
+ if (lp_idmap_uid(&low_id, &high_id)) {
+ idmap_tdb_state.low_uid = low_id;
+ idmap_tdb_state.high_uid = high_id;
+ }
+
+ if (lp_idmap_gid(&low_id, &high_id)) {
+ idmap_tdb_state.low_gid = low_id;
+ idmap_tdb_state.high_gid = high_id;
+ }
+
+ if (idmap_tdb_state.high_uid <= idmap_tdb_state.low_uid) {
+ DEBUG(1, ("idmap uid range missing or invalid\n"));
+ DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ } else {
+ if (((low_id = tdb_fetch_int32(idmap_alloc_tdb, HWM_USER)) == -1) ||
+ (low_id < idmap_tdb_state.low_uid)) {
+ if (tdb_store_int32(idmap_alloc_tdb, HWM_USER, idmap_tdb_state.low_uid) == -1) {
+ DEBUG(0, ("Unable to initialise user hwm in idmap database\n"));
+ return NT_STATUS_INTERNAL_DB_ERROR;
+ }
+ }
+ }
+
+ if (idmap_tdb_state.high_gid <= idmap_tdb_state.low_gid) {
+ DEBUG(1, ("idmap gid range missing or invalid\n"));
+ DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ } else {
+ if (((low_id = tdb_fetch_int32(idmap_alloc_tdb, HWM_GROUP)) == -1) ||
+ (low_id < idmap_tdb_state.low_gid)) {
+ if (tdb_store_int32(idmap_alloc_tdb, HWM_GROUP, idmap_tdb_state.low_gid) == -1) {
+ DEBUG(0, ("Unable to initialise group hwm in idmap database\n"));
+ return NT_STATUS_INTERNAL_DB_ERROR;
+ }
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ Allocate a new id.
+**********************************/
+
+static NTSTATUS idmap_tdb_allocate_id(struct unixid *xid)
+{
+ BOOL ret;
+ const char *hwmkey;
+ const char *hwmtype;
+ uint32_t high_hwm;
+ uint32_t hwm;
+
+ /* Get current high water mark */
+ switch (xid->type) {
+
+ case ID_TYPE_UID:
+ hwmkey = HWM_USER;
+ hwmtype = "UID";
+ high_hwm = idmap_tdb_state.high_uid;
+ break;
+
+ case ID_TYPE_GID:
+ hwmkey = HWM_GROUP;
+ hwmtype = "GID";
+ high_hwm = idmap_tdb_state.high_gid;
+ break;
+
+ default:
+ DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if ((hwm = tdb_fetch_int32(idmap_alloc_tdb, hwmkey)) == -1) {
+ return NT_STATUS_INTERNAL_DB_ERROR;
+ }
+
+ /* check it is in the range */
+ if (hwm > high_hwm) {
+ DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
+ hwmtype, (unsigned long)high_hwm));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ /* fetch a new id and increment it */
+ ret = tdb_change_uint32_atomic(idmap_alloc_tdb, hwmkey, &hwm, 1);
+ if (!ret) {
+ DEBUG(1, ("Fatal error while fetching a new %s value\n!", hwmtype));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ /* recheck it is in the range */
+ if (hwm > high_hwm) {
+ DEBUG(1, ("Fatal Error: %s range full!! (max: %lu)\n",
+ hwmtype, (unsigned long)high_hwm));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ xid->id = hwm;
+ DEBUG(10,("New %s = %d\n", hwmtype, hwm));
+
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ Get current highest id.
+**********************************/
+
+static NTSTATUS idmap_tdb_get_hwm(struct unixid *xid)
+{
+ const char *hwmkey;
+ const char *hwmtype;
+ uint32_t hwm;
+ uint32_t high_hwm;
+
+ /* Get current high water mark */
+ switch (xid->type) {
+
+ case ID_TYPE_UID:
+ hwmkey = HWM_USER;
+ hwmtype = "UID";
+ high_hwm = idmap_tdb_state.high_uid;
+ break;
+
+ case ID_TYPE_GID:
+ hwmkey = HWM_GROUP;
+ hwmtype = "GID";
+ high_hwm = idmap_tdb_state.high_gid;
+ break;
+
+ default:
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if ((hwm = tdb_fetch_int32(idmap_alloc_tdb, hwmkey)) == -1) {
+ return NT_STATUS_INTERNAL_DB_ERROR;
+ }
+
+ xid->id = hwm;
+
+ /* Warn if it is out of range */
+ if (hwm >= high_hwm) {
+ DEBUG(0, ("Warning: %s range full!! (max: %lu)\n",
+ hwmtype, (unsigned long)high_hwm));
+ }
+
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ Set high id.
+**********************************/
+
+static NTSTATUS idmap_tdb_set_hwm(struct unixid *xid)
+{
+ const char *hwmkey;
+ const char *hwmtype;
+ uint32_t hwm;
+ uint32_t high_hwm;
+
+ /* Get current high water mark */
+ switch (xid->type) {
+
+ case ID_TYPE_UID:
+ hwmkey = HWM_USER;
+ hwmtype = "UID";
+ high_hwm = idmap_tdb_state.high_uid;
+ break;
+
+ case ID_TYPE_GID:
+ hwmkey = HWM_GROUP;
+ hwmtype = "GID";
+ high_hwm = idmap_tdb_state.high_gid;
+ break;
+
+ default:
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ hwm = xid->id;
+
+ if ((hwm = tdb_store_int32(idmap_alloc_tdb, hwmkey, hwm)) == -1) {
+ return NT_STATUS_INTERNAL_DB_ERROR;
+ }
+
+ /* Warn if it is out of range */
+ if (hwm >= high_hwm) {
+ DEBUG(0, ("Warning: %s range full!! (max: %lu)\n",
+ hwmtype, (unsigned long)high_hwm));
+ }
+
+ return NT_STATUS_OK;
+}
+
+/**********************************
+ Close the alloc tdb
+**********************************/
+
+static NTSTATUS idmap_tdb_alloc_close(void)
+{
+ if (idmap_alloc_tdb) {
+ if (idmap_tdb_tdb_close(idmap_alloc_tdb) == 0) {
+ return NT_STATUS_OK;
+ } else {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+ }
+ return NT_STATUS_OK;
+}
+
+/**********************************************************************
+ IDMAP MAPPING TDB BACKEND
+**********************************************************************/
+
+struct idmap_tdb_context {
+ TDB_CONTEXT *tdb;
+ uint32_t filter_low_id;
+ uint32_t filter_high_id;
+};
+
+/*****************************
+ Initialise idmap database.
+*****************************/
+
+static NTSTATUS idmap_tdb_db_init(struct idmap_domain *dom, const char *compat_params)
+{
+ NTSTATUS ret;
+ struct idmap_tdb_context *ctx;
+ char *config_option = NULL;
+ const char *range;
+
+ ctx = talloc(dom, struct idmap_tdb_context);
+ if ( ! ctx) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
+ if ( ! config_option) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ ret = idmap_tdb_open_db(ctx, &ctx->tdb);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ goto failed;
+ }
+
+ range = lp_parm_const_string(-1, config_option, "range", NULL);
+ if (( ! range) ||
+ (sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2) ||
+ (ctx->filter_low_id > ctx->filter_high_id)) {
+ ctx->filter_low_id = 0;
+ ctx->filter_high_id = 0;
+ }
+
+ dom->private_data = ctx;
+
+ talloc_free(config_option);
+ return NT_STATUS_OK;
+
+failed:
+ talloc_free(ctx);
+ return ret;
+}
+
+/**********************************
+ Single id to sid lookup function.
+**********************************/
+
+static NTSTATUS idmap_tdb_id_to_sid(struct idmap_tdb_context *ctx, struct id_map *map)
+{
+ NTSTATUS ret;
+ TDB_DATA key, data;
+
+ if (!ctx || !map) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ /* apply filters before checking */
+ if ((ctx->filter_low_id && (map->xid.id < ctx->filter_low_id)) ||
+ (ctx->filter_high_id && (map->xid.id > ctx->filter_high_id))) {
+ DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
+ map->xid.id, ctx->filter_low_id, ctx->filter_high_id));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ switch (map->xid.type) {
+
+ case ID_TYPE_UID:
+ key.dptr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
+ break;
+
+ case ID_TYPE_GID:
+ key.dptr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
+ break;
+
+ default:
+ DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ /* final SAFE_FREE safe */
+ data.dptr = NULL;
+
+ if (key.dptr == NULL) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ key.dsize = strlen(key.dptr) + 1;
+
+ DEBUG(10,("Fetching record %s\n", key.dptr));
+
+ /* Check if the mapping exists */
+ data = tdb_fetch(ctx->tdb, key);
+
+ if (!data.dptr) {
+ DEBUG(10,("Record %s not found\n", key.dptr));
+ ret = NT_STATUS_NONE_MAPPED;
+ goto done;
+ }
+
+ if (!string_to_sid(map->sid, data.dptr)) {
+ DEBUG(10,("INVALID SID (%s) in record %s\n",
+ data.dptr, key.dptr));
+ ret = NT_STATUS_INTERNAL_DB_ERROR;
+ goto done;
+ }
+
+ DEBUG(10,("Found record %s -> %s\n", key.dptr, data.dptr));
+ ret = NT_STATUS_OK;
+
+done:
+ SAFE_FREE(data.dptr);
+ talloc_free(key.dptr);
+ return ret;
+}
+
+/**********************************
+ Single sid to id lookup function.
+**********************************/
+
+static NTSTATUS idmap_tdb_sid_to_id(struct idmap_tdb_context *ctx, struct id_map *map)
+{
+ NTSTATUS ret;
+ TDB_DATA key, data;
+ unsigned long rec_id = 0;
+
+ if ((key.dptr = talloc_asprintf(ctx, "%s", sid_string_static(map->sid))) == NULL) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ key.dsize = strlen(key.dptr) + 1;
+
+ DEBUG(10,("Fetching record %s\n", key.dptr));
+
+ /* Check if sid is present in database */
+ data = tdb_fetch(ctx->tdb, key);
+ if (!data.dptr) {
+ DEBUG(10,("Record %s not found\n", key.dptr));
+ ret = NT_STATUS_NONE_MAPPED;
+ goto done;
+ }
+
+ /* What type of record is this ? */
+ if (sscanf(data.dptr, "UID %lu", &rec_id) == 1) { /* Try a UID record. */
+ map->xid.id = rec_id;
+ map->xid.type = ID_TYPE_UID;
+ DEBUG(10,("Found uid record %s -> %s \n", key.dptr, data.dptr ));
+ ret = NT_STATUS_OK;
+
+ } else if (sscanf(data.dptr, "GID %lu", &rec_id) == 1) { /* Try a GID record. */
+ map->xid.id = rec_id;
+ map->xid.type = ID_TYPE_GID;
+ DEBUG(10,("Found gid record %s -> %s \n", key.dptr, data.dptr ));
+ ret = NT_STATUS_OK;
+
+ } else { /* Unknown record type ! */
+ DEBUG(2, ("Found INVALID record %s -> %s\n", key.dptr, data.dptr));
+ ret = NT_STATUS_INTERNAL_DB_ERROR;
+ }
+
+ SAFE_FREE(data.dptr);
+
+ /* apply filters before returning result */
+ if ((ctx->filter_low_id && (map->xid.id < ctx->filter_low_id)) ||
+ (ctx->filter_high_id && (map->xid.id > ctx->filter_high_id))) {
+ DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
+ map->xid.id, ctx->filter_low_id, ctx->filter_high_id));
+ ret = NT_STATUS_NONE_MAPPED;
+ }
+
+done:
+ talloc_free(key.dptr);
+ return ret;
+}
+
+/**********************************
+ lookup a set of unix ids.
+**********************************/
+
+static NTSTATUS idmap_tdb_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
+{
+ struct idmap_tdb_context *ctx;
+ NTSTATUS ret;
+ int i;
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
+
+ for (i = 0; ids[i]; i++) {
+ ret = idmap_tdb_id_to_sid(ctx, ids[i]);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+
+ /* if it is just a failed mapping continue */
+ if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
+
+ /* make sure it is marked as unmapped */
+ ids[i]->mapped = False;
+ continue;
+ }
+
+ /* some fatal error occurred, return immediately */
+ goto done;
+ }
+
+ /* all ok, id is mapped */
+ ids[i]->mapped = True;
+ }
+
+ ret = NT_STATUS_OK;
+
+done:
+ return ret;
+}
+
+/**********************************
+ lookup a set of sids.
+**********************************/
+
+static NTSTATUS idmap_tdb_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
+{
+ struct idmap_tdb_context *ctx;
+ NTSTATUS ret;
+ int i;
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
+
+ for (i = 0; ids[i]; i++) {
+ ret = idmap_tdb_sid_to_id(ctx, ids[i]);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+
+ /* if it is just a failed mapping continue */
+ if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
+
+ /* make sure it is marked as unmapped */
+ ids[i]->mapped = False;
+ continue;
+ }
+
+ /* some fatal error occurred, return immediately */
+ goto done;
+ }
+
+ /* all ok, id is mapped */
+ ids[i]->mapped = True;
+ }
+
+ ret = NT_STATUS_OK;
+
+done:
+ return ret;
+}
+
+/**********************************
+ set a mapping.
+**********************************/
+
+static NTSTATUS idmap_tdb_set_mapping(struct idmap_domain *dom, const struct id_map *map)
+{
+ struct idmap_tdb_context *ctx;
+ NTSTATUS ret;
+ TDB_DATA ksid, kid, data;
+
+ if (!map || !map->sid) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ ksid.dptr = kid.dptr = data.dptr = NULL;
+
+ /* TODO: should we filter a set_mapping using low/high filters ? */
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
+
+ switch (map->xid.type) {
+
+ case ID_TYPE_UID:
+ kid.dptr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
+ break;
+
+ case ID_TYPE_GID:
+ kid.dptr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
+ break;
+
+ default:
+ DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (kid.dptr == NULL) {
+ DEBUG(0, ("ERROR: Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ kid.dsize = strlen(kid.dptr) + 1;
+
+ if ((ksid.dptr = talloc_asprintf(ctx, "%s", sid_string_static(map->sid))) == NULL) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ ksid.dsize = strlen(ksid.dptr) + 1;
+
+ DEBUG(10, ("Storing %s <-> %s map\n", ksid.dptr, kid.dptr));
+
+ /* *DELETE* previous mappings if any.
+ * This is done both SID and [U|G]ID passed in */
+
+ /* Lock the record for this SID. */
+ if (tdb_chainlock(ctx->tdb, ksid) != 0) {
+ DEBUG(10,("Failed to lock record %s. Error %s\n",
+ ksid.dptr, tdb_errorstr(ctx->tdb) ));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ data = tdb_fetch(ctx->tdb, ksid);
+ if (data.dptr) {
+ DEBUG(10, ("Deleting existing mapping %s <-> %s\n", data.dptr, ksid.dptr ));
+ tdb_delete(ctx->tdb, data);
+ tdb_delete(ctx->tdb, ksid);
+ SAFE_FREE(data.dptr);
+ }
+
+ data = tdb_fetch(ctx->tdb, kid);
+ if (data.dptr) {
+ DEBUG(10,("Deleting existing mapping %s <-> %s\n", data.dptr, kid.dptr ));
+ tdb_delete(ctx->tdb, data);
+ tdb_delete(ctx->tdb, kid);
+ SAFE_FREE(data.dptr);
+ }
+
+ if (tdb_store(ctx->tdb, ksid, kid, TDB_INSERT) == -1) {
+ DEBUG(0, ("Error storing SID -> ID: %s\n", tdb_errorstr(ctx->tdb)));
+ tdb_chainunlock(ctx->tdb, ksid);
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+ if (tdb_store(ctx->tdb, kid, ksid, TDB_INSERT) == -1) {
+ DEBUG(0, ("Error stroing ID -> SID: %s\n", tdb_errorstr(ctx->tdb)));
+ /* try to remove the previous stored SID -> ID map */
+ tdb_delete(ctx->tdb, ksid);
+ tdb_chainunlock(ctx->tdb, ksid);
+ ret = NT_STATUS_UNSUCCESSFUL;
+ goto done;
+ }
+
+ tdb_chainunlock(ctx->tdb, ksid);
+ DEBUG(10,("Stored %s <-> %s\n", ksid.dptr, kid.dptr));
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(ksid.dptr);
+ talloc_free(kid.dptr);
+ SAFE_FREE(data.dptr);
+ return ret;
+}
+
+/**********************************
+ remove a mapping.
+**********************************/
+
+static NTSTATUS idmap_tdb_remove_mapping(struct idmap_domain *dom, const struct id_map *map)
+{
+ struct idmap_tdb_context *ctx;
+ NTSTATUS ret;
+ TDB_DATA ksid, kid, data;
+
+ if (!map || !map->sid) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ ksid.dptr = kid.dptr = data.dptr = NULL;
+
+ /* TODO: should we filter a remove_mapping using low/high filters ? */
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
+
+ switch (map->xid.type) {
+
+ case ID_TYPE_UID:
+ kid.dptr = talloc_asprintf(ctx, "UID %lu", (unsigned long)map->xid.id);
+ break;
+
+ case ID_TYPE_GID:
+ kid.dptr = talloc_asprintf(ctx, "GID %lu", (unsigned long)map->xid.id);
+ break;
+
+ default:
+ DEBUG(2, ("INVALID unix ID type: 0x02%x\n", map->xid.type));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (kid.dptr == NULL) {
+ DEBUG(0, ("ERROR: Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ kid.dsize = strlen(kid.dptr) + 1;
+
+ if ((ksid.dptr = talloc_asprintf(ctx, "%s", sid_string_static(map->sid))) == NULL) {
+ DEBUG(0, ("Out of memory!\n"));
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ ksid.dsize = strlen(ksid.dptr) + 1;
+
+ DEBUG(10, ("Checking %s <-> %s map\n", ksid.dptr, kid.dptr));
+
+ /* Lock the record for this SID. */
+ if (tdb_chainlock(ctx->tdb, ksid) != 0) {
+ DEBUG(10,("Failed to lock record %s. Error %s\n",
+ ksid.dptr, tdb_errorstr(ctx->tdb) ));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ /* Check if sid is present in database */
+ data = tdb_fetch(ctx->tdb, ksid);
+ if (!data.dptr) {
+ DEBUG(10,("Record %s not found\n", ksid.dptr));
+ tdb_chainunlock(ctx->tdb, ksid);
+ ret = NT_STATUS_NONE_MAPPED;
+ goto done;
+ }
+
+ /* Check if sid is mapped to the specified ID */
+ if ((data.dsize != kid.dsize) ||
+ (memcmp(data.dptr, kid.dptr, data.dsize) != 0)) {
+ DEBUG(10,("Specified SID does not map to specified ID\n"));
+ DEBUGADD(10,("Actual mapping is %s -> %s\n", ksid.dptr, data.dptr));
+ tdb_chainunlock(ctx->tdb, ksid);
+ ret = NT_STATUS_NONE_MAPPED;
+ goto done;
+ }
+
+ DEBUG(10, ("Removing %s <-> %s map\n", ksid.dptr, kid.dptr));
+
+ /* Delete previous mappings. */
+
+ data = tdb_fetch(ctx->tdb, ksid);
+ if (data.dptr) {
+ DEBUG(10, ("Deleting existing mapping %s -> %s\n", ksid.dptr, kid.dptr ));
+ tdb_delete(ctx->tdb, ksid);
+ SAFE_FREE(data.dptr);
+ }
+
+ data = tdb_fetch(ctx->tdb, kid);
+ if (data.dptr) {
+ DEBUG(10,("Deleting existing mapping %s -> %s\n", kid.dptr, ksid.dptr ));
+ tdb_delete(ctx->tdb, kid);
+ SAFE_FREE(data.dptr);
+ }
+
+ tdb_chainunlock(ctx->tdb, ksid);
+ ret = NT_STATUS_OK;
+
+done:
+ talloc_free(ksid.dptr);
+ talloc_free(kid.dptr);
+ SAFE_FREE(data.dptr);
+ return ret;
+}
+
+/**********************************
+ Close the idmap tdb instance
+**********************************/
+
+static NTSTATUS idmap_tdb_close(struct idmap_domain *dom)
+{
+ struct idmap_tdb_context *ctx;
+
+ if (dom->private_data) {
+ ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
+
+ if (idmap_tdb_tdb_close(ctx->tdb) == 0) {
+ return NT_STATUS_OK;
+ } else {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+ }
+ return NT_STATUS_OK;
+}
+
+struct dump_data {
+ TALLOC_CTX *memctx;
+ struct id_map **maps;
+ int *num_maps;
+ NTSTATUS ret;
+};
+
+static int idmap_tdb_dump_one_entry(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA value, void *pdata)
+{
+ struct dump_data *data = talloc_get_type(pdata, struct dump_data);
+ struct id_map *maps;
+ int num_maps = *data->num_maps;
+
+ /* ignore any record but the ones with a SID as key */
+ if (strncmp(key.dptr, "S-", 2) == 0) {
+
+ maps = talloc_realloc(NULL, *data->maps, struct id_map, num_maps+1);
+ if ( ! maps) {
+ DEBUG(0, ("Out of memory!\n"));
+ data->ret = NT_STATUS_NO_MEMORY;
+ return -1;
+ }
+ *data->maps = maps;
+ maps[num_maps].sid = talloc(maps, DOM_SID);
+ if ( ! maps[num_maps].sid) {
+ DEBUG(0, ("Out of memory!\n"));
+ data->ret = NT_STATUS_NO_MEMORY;
+ return -1;
+ }
+
+ if (!string_to_sid(maps[num_maps].sid, key.dptr)) {
+ DEBUG(10,("INVALID record %s\n", key.dptr));
+ /* continue even with errors */
+ return 0;
+ }
+
+ /* Try a UID record. */
+ if (sscanf(value.dptr, "UID %u", &(maps[num_maps].xid.id)) == 1) {
+ maps[num_maps].xid.type = ID_TYPE_UID;
+ maps[num_maps].mapped = True;
+ *data->num_maps = num_maps + 1;
+
+ /* Try a GID record. */
+ } else
+ if (sscanf(value.dptr, "GID %u", &(maps[num_maps].xid.id)) == 1) {
+ maps[num_maps].xid.type = ID_TYPE_GID;
+ maps[num_maps].mapped = True;
+ *data->num_maps = num_maps + 1;
+
+ /* Unknown record type ! */
+ } else {
+ DEBUG(2, ("Found INVALID record %s -> %s\n", key.dptr, value.dptr));
+ /* do not increment num_maps */
+ }
+ }
+
+ return 0;
+}
+
+/**********************************
+ Dump all mappings out
+**********************************/
+
+static NTSTATUS idmap_tdb_dump_data(struct idmap_domain *dom, struct id_map **maps, int *num_maps)
+{
+ struct idmap_tdb_context *ctx;
+ struct dump_data *data;
+ NTSTATUS ret = NT_STATUS_OK;
+
+ ctx = talloc_get_type(dom->private_data, struct idmap_tdb_context);
+
+ data = talloc_zero(ctx, struct dump_data);
+ if ( ! data) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+ data->maps = maps;
+ data->num_maps = num_maps;
+ data->ret = NT_STATUS_OK;
+
+ tdb_traverse(ctx->tdb, idmap_tdb_dump_one_entry, data);
+
+ if ( ! NT_STATUS_IS_OK(data->ret)) {
+ ret = data->ret;
+ }
+
+ talloc_free(data);
+ return ret;
+}
+
+static struct idmap_methods db_methods = {
+
+ .init = idmap_tdb_db_init,
+ .unixids_to_sids = idmap_tdb_unixids_to_sids,
+ .sids_to_unixids = idmap_tdb_sids_to_unixids,
+ .set_mapping = idmap_tdb_set_mapping,
+ .remove_mapping = idmap_tdb_remove_mapping,
+ .dump_data = idmap_tdb_dump_data,
+ .close_fn = idmap_tdb_close
+};
+
+static struct idmap_alloc_methods db_alloc_methods = {
+
+ .init = idmap_tdb_alloc_init,
+ .allocate_id = idmap_tdb_allocate_id,
+ .get_id_hwm = idmap_tdb_get_hwm,
+ .set_id_hwm = idmap_tdb_set_hwm,
+ .close_fn = idmap_tdb_alloc_close
+};
+
+NTSTATUS idmap_alloc_tdb_init(void)
+{
+ return smb_register_idmap_alloc(SMB_IDMAP_INTERFACE_VERSION, "tdb", &db_alloc_methods);
+}
+
+NTSTATUS idmap_tdb_init(void)
+{
+ NTSTATUS ret;
+
+ /* FIXME: bad hack to actually register also the alloc_tdb module without changining configure.in */
+ ret = idmap_alloc_tdb_init();
+ if (! NT_STATUS_IS_OK(ret)) {
+ return ret;
+ }
+ return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "tdb", &db_methods);
+}
--- /dev/null
+/*
+ Unix SMB/CIFS implementation.
+ ID Mapping
+ Copyright (C) Simo Sorce 2003
+ Copyright (C) Jeremy Allison 2006
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/
+
+#include "includes.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_IDMAP
+
+/*****************************************************************
+ Returns the SID mapped to the given UID.
+ If mapping is not possible returns an error.
+*****************************************************************/
+
+NTSTATUS idmap_uid_to_sid(DOM_SID *sid, uid_t uid)
+{
+ NTSTATUS ret;
+ struct id_map map;
+ struct id_map *maps[2];
+
+ DEBUG(10,("uid = [%lu]\n", (unsigned long)uid));
+
+ map.sid = sid;
+ map.xid.type = ID_TYPE_UID;
+ map.xid.id = uid;
+
+ maps[0] = ↦
+ maps[1] = NULL;
+
+ ret = idmap_unixids_to_sids(maps);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(10, ("error mapping uid [%lu]\n", (unsigned long)uid));
+ return ret;
+ }
+
+ if ( ! map.mapped) {
+ DEBUG(10, ("uid [%lu] not mapped\n", (unsigned long)uid));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/*****************************************************************
+ Returns SID mapped to the given GID.
+ If mapping is not possible returns an error.
+*****************************************************************/
+
+NTSTATUS idmap_gid_to_sid(DOM_SID *sid, gid_t gid)
+{
+ NTSTATUS ret;
+ struct id_map map;
+ struct id_map *maps[2];
+
+ DEBUG(10,("gid = [%lu]\n", (unsigned long)gid));
+
+ map.sid = sid;
+ map.xid.type = ID_TYPE_GID;
+ map.xid.id = gid;
+
+ maps[0] = ↦
+ maps[1] = NULL;
+
+ ret = idmap_unixids_to_sids(maps);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(10, ("error mapping gid [%lu]\n", (unsigned long)gid));
+ return ret;
+ }
+
+ if ( ! map.mapped) {
+ DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/*****************************************************************
+ Returns the UID mapped to the given SID.
+ If mapping is not possible or SID maps to a GID returns an error.
+*****************************************************************/
+
+NTSTATUS idmap_sid_to_uid(DOM_SID *sid, uid_t *uid)
+{
+ NTSTATUS ret;
+ struct id_map map;
+ struct id_map *maps[2];
+
+ DEBUG(10,("idmap_sid_to_uid: sid = [%s]\n", sid_string_static(sid)));
+
+ map.sid = sid;
+
+ maps[0] = ↦
+ maps[1] = NULL;
+
+ ret = idmap_sids_to_unixids(maps);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(10, ("error mapping sid [%s] to uid\n", sid_string_static(sid)));
+ return ret;
+ }
+
+ if (( ! map.mapped) || (map.xid.type != ID_TYPE_UID)) {
+ DEBUG(10, ("sid [%s] not mapped to an uid [%u,%u,%u]\n", sid_string_static(sid), map.mapped, map.xid.type, map.xid.id));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ *uid = map.xid.id;
+
+ return NT_STATUS_OK;
+}
+
+/*****************************************************************
+ Returns the GID mapped to the given SID.
+ If mapping is not possible or SID maps to a UID returns an error.
+*****************************************************************/
+
+NTSTATUS idmap_sid_to_gid(DOM_SID *sid, gid_t *gid)
+{
+ NTSTATUS ret;
+ struct id_map map;
+ struct id_map *maps[2];
+
+ DEBUG(10,("idmap_sid_to_gid: sid = [%s]\n", sid_string_static(sid)));
+
+ map.sid = sid;
+
+ maps[0] = ↦
+ maps[1] = NULL;
+
+ ret = idmap_sids_to_unixids(maps);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(10, ("error mapping sid [%s] to gid\n", sid_string_static(sid)));
+ return ret;
+ }
+
+ if (( ! map.mapped) || (map.xid.type != ID_TYPE_GID)) {
+ DEBUG(10, ("sid [%s] not mapped to an gid [%u,%u,%u]\n", sid_string_static(sid), map.mapped, map.xid.type, map.xid.id));
+ return NT_STATUS_NONE_MAPPED;
+ }
+
+ *gid = map.xid.id;
+
+ return NT_STATUS_OK;
+}
return (result == NSS_STATUS_SUCCESS);
}
+/* Call winbindd to convert SID to uid */
+
+BOOL winbind_sids_to_unixids(struct id_map *ids, int num_ids)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ int result;
+ DOM_SID *sids;
+ int i;
+
+ /* Initialise request */
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ request.extra_len = num_ids * sizeof(DOM_SID);
+
+ sids = SMB_MALLOC(request.extra_len);
+ for (i = 0; i < num_ids; i++) {
+ sid_copy(&sids[i], ids[i].sid);
+ }
+
+ request.extra_data.data = (char *)sids;
+
+ /* Make request */
+
+ result = winbindd_request_response(WINBINDD_SIDS_TO_XIDS, &request, &response);
+
+ /* Copy out result */
+
+ if (result == NSS_STATUS_SUCCESS) {
+ struct unixid *wid = (struct unixid *)response.extra_data.data;
+
+ for (i = 0; i < num_ids; i++) {
+ if (wid[i].type == -1) {
+ ids[i].mapped = False;
+ } else {
+ ids[i].mapped = True;
+ ids[i].xid.type = wid[i].type;
+ ids[i].xid.id = wid[i].id;
+ }
+ }
+ }
+
+ SAFE_FREE(request.extra_data.data);
+ SAFE_FREE(response.extra_data.data);
+
+ return (result == NSS_STATUS_SUCCESS);
+}
+
+BOOL winbind_idmap_dump_maps(TALLOC_CTX *memctx, const char *file)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ int result;
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ request.extra_data.data = SMB_STRDUP(file);
+ request.extra_len = strlen(request.extra_data.data) + 1;
+
+ result = winbindd_request_response(WINBINDD_DUMP_MAPS, &request, &response);
+
+ SAFE_FREE(request.extra_data.data);
+ return (result == NSS_STATUS_SUCCESS);
+}
+
BOOL winbind_allocate_uid(uid_t *uid)
{
struct winbindd_request request;
return True;
}
+BOOL winbind_set_mapping(const struct id_map *map)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ int result;
+
+ /* Initialise request */
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ /* Make request */
+
+ request.data.dual_idmapset.id = map->xid.id;
+ request.data.dual_idmapset.type = map->xid.type;
+ sid_to_string(request.data.dual_idmapset.sid, map->sid);
+
+ result = winbindd_request_response(WINBINDD_SET_MAPPING, &request, &response);
+
+ return (result == NSS_STATUS_SUCCESS);
+}
+
+BOOL winbind_set_uid_hwm(unsigned long id)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ int result;
+
+ /* Initialise request */
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ /* Make request */
+
+ request.data.dual_idmapset.id = id;
+ request.data.dual_idmapset.type = ID_TYPE_UID;
+
+ result = winbindd_request_response(WINBINDD_SET_HWM, &request, &response);
+
+ return (result == NSS_STATUS_SUCCESS);
+}
+
+BOOL winbind_set_gid_hwm(unsigned long id)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ int result;
+
+ /* Initialise request */
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ /* Make request */
+
+ request.data.dual_idmapset.id = id;
+ request.data.dual_idmapset.type = ID_TYPE_GID;
+
+ result = winbindd_request_response(WINBINDD_SET_HWM, &request, &response);
+
+ return (result == NSS_STATUS_SUCCESS);
+}
+
/* Fetch the list of groups a user is a member of from winbindd. This is
used by winbind_getgroups. */
{ WINBINDD_SID_TO_GID, winbindd_sid_to_gid, "SID_TO_GID" },
{ WINBINDD_UID_TO_SID, winbindd_uid_to_sid, "UID_TO_SID" },
{ WINBINDD_GID_TO_SID, winbindd_gid_to_sid, "GID_TO_SID" },
+ { WINBINDD_SIDS_TO_XIDS, winbindd_sids_to_unixids, "SIDS_TO_XIDS" },
{ WINBINDD_ALLOCATE_UID, winbindd_allocate_uid, "ALLOCATE_UID" },
{ WINBINDD_ALLOCATE_GID, winbindd_allocate_gid, "ALLOCATE_GID" },
+ { WINBINDD_SET_MAPPING, winbindd_set_mapping, "SET_MAPPING" },
+ { WINBINDD_SET_HWM, winbindd_set_hwm, "SET_HWMS" },
/* Miscellaneous */
+ { WINBINDD_DUMP_MAPS, winbindd_dump_maps, "DUMP_MAPS" },
+
{ WINBINDD_CHECK_MACHACC, winbindd_check_machine_acct, "CHECK_MACHACC" },
{ WINBINDD_PING, winbindd_ping, "PING" },
{ WINBINDD_INFO, winbindd_info, "INFO" },
/* Main function */
-struct winbindd_state server_state; /* Server state information */
-
int main(int argc, char **argv, char **envp)
{
pstring logfile;
namecache_enable();
- /* Check winbindd parameters are valid */
-
- ZERO_STRUCT(server_state);
-
/* Winbind daemon initialisation */
- if ( (!winbindd_param_init()) || (!winbindd_upgrade_idmap()) ||
- (!idmap_init(lp_idmap_backend())) ) {
- DEBUG(1, ("Could not init idmap -- netlogon proxy only\n"));
- idmap_set_proxyonly();
+ if ( ! NT_STATUS_IS_OK(idmap_init()) ) {
+ DEBUG(1, ("Could not init idmap! - Sid/[UG]id mapping will not be available\n"));
}
/* Unblock all signals we are interested in as they may have been
/* Server state structure */
-struct winbindd_state {
-
- /* User and group id pool */
-
- uid_t uid_low, uid_high; /* Range of uids to allocate */
- gid_t gid_low, gid_high; /* Range of gids to allocate */
-};
-
-extern struct winbindd_state server_state; /* Server information */
-
typedef struct {
char *acct_name;
char *full_name;
&state->response, do_async_recv, state);
}
-static void idmap_set_mapping_recv(TALLOC_CTX *mem_ctx, BOOL success,
+static void winbindd_set_mapping_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
void *c, void *private_data)
{
cont(private_data, True);
}
-void idmap_set_mapping_async(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
- unid_t id, int id_type,
+void winbindd_set_mapping_async(TALLOC_CTX *mem_ctx, const struct id_map *map,
void (*cont)(void *private_data, BOOL success),
void *private_data)
{
struct winbindd_request request;
ZERO_STRUCT(request);
- request.cmd = WINBINDD_DUAL_IDMAPSET;
- if (id_type == ID_USERID)
- request.data.dual_idmapset.uid = id.uid;
- else
- request.data.dual_idmapset.gid = id.gid;
- request.data.dual_idmapset.type = id_type;
- sid_to_string(request.data.dual_idmapset.sid, sid);
-
- do_async(mem_ctx, idmap_child(), &request, idmap_set_mapping_recv,
+ request.cmd = WINBINDD_DUAL_SET_MAPPING;
+ request.data.dual_idmapset.id = map->xid.id;
+ request.data.dual_idmapset.type = map->xid.type;
+ sid_to_string(request.data.dual_idmapset.sid, map->sid);
+
+ do_async(mem_ctx, idmap_child(), &request, winbindd_set_mapping_recv,
(void *)cont, private_data);
}
-enum winbindd_result winbindd_dual_idmapset(struct winbindd_domain *domain,
+enum winbindd_result winbindd_dual_set_mapping(struct winbindd_domain *domain,
struct winbindd_cli_state *state)
{
+ struct id_map map;
DOM_SID sid;
- unid_t id;
NTSTATUS result;
DEBUG(3, ("[%5lu]: dual_idmapset\n", (unsigned long)state->pid));
if (!string_to_sid(&sid, state->request.data.dual_idmapset.sid))
return WINBINDD_ERROR;
- if (state->request.data.dual_idmapset.type == ID_USERID)
- id.uid = state->request.data.dual_idmapset.uid;
- else
- id.gid = state->request.data.dual_idmapset.gid;
+ map.sid = &sid;
+ map.xid.id = state->request.data.dual_idmapset.id;
+ map.xid.type = state->request.data.dual_idmapset.type;
- result = idmap_set_mapping(
- &sid, id,
- (enum idmap_type)state->request.data.dual_idmapset.type);
+ result = idmap_set_mapping(&map);
return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
}
-static void idmap_sid2uid_recv(TALLOC_CTX *mem_ctx, BOOL success,
+static void winbindd_set_hwm_recv(TALLOC_CTX *mem_ctx, BOOL success,
+ struct winbindd_response *response,
+ void *c, void *private_data)
+{
+ void (*cont)(void *priv, BOOL succ) = (void (*)(void *, BOOL))c;
+
+ if (!success) {
+ DEBUG(5, ("Could not trigger idmap_set_hwm\n"));
+ cont(private_data, False);
+ return;
+ }
+
+ if (response->result != WINBINDD_OK) {
+ DEBUG(5, ("idmap_set_hwm returned an error\n"));
+ cont(private_data, False);
+ return;
+ }
+
+ cont(private_data, True);
+}
+
+void winbindd_set_hwm_async(TALLOC_CTX *mem_ctx, const struct unixid *xid,
+ void (*cont)(void *private_data, BOOL success),
+ void *private_data)
+{
+ struct winbindd_request request;
+ ZERO_STRUCT(request);
+ request.cmd = WINBINDD_DUAL_SET_HWM;
+ request.data.dual_idmapset.id = xid->id;
+ request.data.dual_idmapset.type = xid->type;
+
+ do_async(mem_ctx, idmap_child(), &request, winbindd_set_hwm_recv,
+ (void *)cont, private_data);
+}
+
+enum winbindd_result winbindd_dual_set_hwm(struct winbindd_domain *domain,
+ struct winbindd_cli_state *state)
+{
+ struct unixid xid;
+ NTSTATUS result;
+
+ DEBUG(3, ("[%5lu]: dual_set_hwm\n", (unsigned long)state->pid));
+
+ xid.id = state->request.data.dual_idmapset.id;
+ xid.type = state->request.data.dual_idmapset.type;
+
+ switch (xid.type) {
+ case ID_TYPE_UID:
+ result = idmap_set_uid_hwm(&xid);
+ break;
+ case ID_TYPE_GID:
+ result = idmap_set_gid_hwm(&xid);
+ break;
+ default:
+ return WINBINDD_ERROR;
+ }
+ return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
+}
+
+static void winbindd_sids2xids_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
- void *c, void *private_data);
+ void *c, void *private_data)
+{
+ void (*cont)(void *priv, BOOL succ, void *, int) =
+ (void (*)(void *, BOOL, void *, int))c;
-void idmap_sid2uid_async(TALLOC_CTX *mem_ctx, const DOM_SID *sid, BOOL alloc,
- void (*cont)(void *private_data, BOOL success, uid_t uid),
+ if (!success) {
+ DEBUG(5, ("Could not trigger sids2xids\n"));
+ cont(private_data, False, NULL, 0);
+ return;
+ }
+
+ if (response->result != WINBINDD_OK) {
+ DEBUG(5, ("sids2xids returned an error\n"));
+ cont(private_data, False, NULL, 0);
+ return;
+ }
+
+ cont(private_data, True, response->extra_data.data, response->length - sizeof(response));
+}
+
+void winbindd_sids2xids_async(TALLOC_CTX *mem_ctx, void *sids, int size,
+ void (*cont)(void *private_data, BOOL success, void *data, int len),
void *private_data)
{
struct winbindd_request request;
ZERO_STRUCT(request);
- request.cmd = WINBINDD_DUAL_SID2UID;
- sid_to_string(request.data.dual_sid2id.sid, sid);
- request.data.dual_sid2id.alloc = alloc;
- do_async(mem_ctx, idmap_child(), &request, idmap_sid2uid_recv,
+ request.cmd = WINBINDD_DUAL_SIDS2XIDS;
+ request.extra_data.data = sids;
+ request.extra_len = size;
+ do_async(mem_ctx, idmap_child(), &request, winbindd_sids2xids_recv,
(void *)cont, private_data);
}
-enum winbindd_result winbindd_dual_sid2uid(struct winbindd_domain *domain,
+enum winbindd_result winbindd_dual_sids2xids(struct winbindd_domain *domain,
struct winbindd_cli_state *state)
{
- DOM_SID sid;
+ DOM_SID *sids;
+ struct unixid *xids;
+ struct id_map **ids;
NTSTATUS result;
+ int num, i;
- DEBUG(3, ("[%5lu]: sid to uid %s\n", (unsigned long)state->pid,
- state->request.data.dual_sid2id.sid));
+ DEBUG(3, ("[%5lu]: sids to unix ids\n", (unsigned long)state->pid));
- if (!string_to_sid(&sid, state->request.data.dual_sid2id.sid)) {
- DEBUG(1, ("Could not get convert sid %s from string\n",
- state->request.data.dual_sid2id.sid));
+ sids = (DOM_SID *)state->request.extra_data.data;
+ num = state->request.extra_len / sizeof(DOM_SID);
+
+ ids = talloc_zero_array(state->mem_ctx, struct id_map *, num + 1);
+ if ( ! ids) {
+ DEBUG(0, ("Out of memory!\n"));
return WINBINDD_ERROR;
}
+ for (i = 0; i < num; i++) {
+ ids[i] = talloc(ids, struct id_map);
+ if ( ! ids[i]) {
+ DEBUG(0, ("Out of memory!\n"));
+ talloc_free(ids);
+ return WINBINDD_ERROR;
+ }
+ ids[i]->sid = &sids[i];
+ }
- /* Find uid for this sid and return it, possibly ask the slow remote
- * idmap */
+ result = idmap_sids_to_unixids(ids);
- result = idmap_sid_to_uid(&sid, &(state->response.data.uid),
- state->request.data.dual_sid2id.alloc ?
- 0 : IDMAP_FLAG_QUERY_ONLY);
+ if (NT_STATUS_IS_OK(result)) {
- return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
+ xids = SMB_MALLOC_ARRAY(struct unixid, num);
+ if ( ! xids) {
+ DEBUG(0, ("Out of memory!\n"));
+ talloc_free(ids);
+ return WINBINDD_ERROR;
+ }
+
+ for (i = 0; i < num; i++) {
+ if (ids[i]->mapped) {
+ xids[i].type = ids[i]->xid.type;
+ xids[i].id = ids[i]->xid.id;
+ } else {
+ xids[i].type = -1;
+ }
+ }
+
+ state->response.length = sizeof(state->response) + (sizeof(struct unixid) * num);
+ state->response.extra_data.data = xids;
+
+ } else {
+ DEBUG (2, ("idmap_sids_to_unixids returned an error: 0x%08x\n", NT_STATUS_V(result)));
+ talloc_free(ids);
+ return WINBINDD_ERROR;
+ }
+
+ talloc_free(ids);
+ return WINBINDD_OK;
}
-static void idmap_sid2uid_recv(TALLOC_CTX *mem_ctx, BOOL success,
+static void winbindd_sid2uid_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
void *c, void *private_data)
{
cont(private_data, True, response->data.uid);
}
+void winbindd_sid2uid_async(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
+ void (*cont)(void *private_data, BOOL success, uid_t uid),
+ void *private_data)
+{
+ struct winbindd_request request;
+ ZERO_STRUCT(request);
+ request.cmd = WINBINDD_DUAL_SID2UID;
+ sid_to_string(request.data.dual_sid2id.sid, sid);
+ do_async(mem_ctx, idmap_child(), &request, winbindd_sid2uid_recv,
+ (void *)cont, private_data);
+}
+
+enum winbindd_result winbindd_dual_sid2uid(struct winbindd_domain *domain,
+ struct winbindd_cli_state *state)
+{
+ DOM_SID sid;
+ NTSTATUS result;
+
+ DEBUG(3, ("[%5lu]: sid to uid %s\n", (unsigned long)state->pid,
+ state->request.data.dual_sid2id.sid));
+
+ if (!string_to_sid(&sid, state->request.data.dual_sid2id.sid)) {
+ DEBUG(1, ("Could not get convert sid %s from string\n",
+ state->request.data.dual_sid2id.sid));
+ return WINBINDD_ERROR;
+ }
+
+ /* Find uid for this sid and return it, possibly ask the slow remote idmap */
+
+ result = idmap_sid_to_uid(&sid, &(state->response.data.uid));
+
+ return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
+}
+
+#if 0 /* not used */
static void uid2name_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
void *c, void *private_data);
do_async(mem_ctx, idmap_child(), &request, uid2name_recv,
(void *)cont, private_data);
}
+#endif /* not used */
enum winbindd_result winbindd_dual_uid2name(struct winbindd_domain *domain,
struct winbindd_cli_state *state)
return WINBINDD_OK;
}
+#if 0 /* not used */
static void uid2name_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
void *c, void *private_data)
do_async(mem_ctx, idmap_child(), &request, name2uid_recv,
(void *)cont, private_data);
}
+#endif /* not used */
enum winbindd_result winbindd_dual_name2uid(struct winbindd_domain *domain,
struct winbindd_cli_state *state)
return WINBINDD_OK;
}
+#if 0 /* not used */
static void name2uid_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
void *c, void *private_data)
cont(private_data, True, response->data.uid);
}
+#endif /* not used */
-static void idmap_sid2gid_recv(TALLOC_CTX *mem_ctx, BOOL success,
+static void winbindd_sid2gid_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
- void *c, void *private_data);
+ void *c, void *private_data)
+{
+ void (*cont)(void *priv, BOOL succ, gid_t gid) =
+ (void (*)(void *, BOOL, gid_t))c;
+
+ if (!success) {
+ DEBUG(5, ("Could not trigger sid2gid\n"));
+ cont(private_data, False, 0);
+ return;
+ }
+
+ if (response->result != WINBINDD_OK) {
+ DEBUG(5, ("sid2gid returned an error\n"));
+ cont(private_data, False, 0);
+ return;
+ }
-void idmap_sid2gid_async(TALLOC_CTX *mem_ctx, const DOM_SID *sid, BOOL alloc,
+ cont(private_data, True, response->data.gid);
+}
+
+void winbindd_sid2gid_async(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
void (*cont)(void *private_data, BOOL success, gid_t gid),
void *private_data)
{
DEBUG(7,("idmap_sid2gid_async: Resolving %s to a gid\n",
request.data.dual_sid2id.sid));
- request.data.dual_sid2id.alloc = alloc;
- do_async(mem_ctx, idmap_child(), &request, idmap_sid2gid_recv,
+ do_async(mem_ctx, idmap_child(), &request, winbindd_sid2gid_recv,
(void *)cont, private_data);
}
return WINBINDD_ERROR;
}
- /* Find gid for this sid and return it, possibly ask the slow remote
- * idmap */
-
- result = idmap_sid_to_gid(&sid, &state->response.data.gid,
- state->request.data.dual_sid2id.alloc ?
- 0 : IDMAP_FLAG_QUERY_ONLY);
-
- /* If the lookup failed, the perhaps we need to look
- at the passdb for local groups */
+ /* Find gid for this sid and return it, possibly ask the slow remote idmap */
- if ( !NT_STATUS_IS_OK(result) ) {
- if ( sid_to_gid( &sid, &(state->response.data.gid) ) ) {
- result = NT_STATUS_OK;
- }
- }
+ result = idmap_sid_to_gid(&sid, &state->response.data.gid);
+
+ DEBUG(10, ("winbindd_dual_sid2gid: 0x%08x - %s - %u\n", NT_STATUS_V(result), sid_string_static(&sid), state->response.data.gid));
return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR;
}
-static void idmap_sid2gid_recv(TALLOC_CTX *mem_ctx, BOOL success,
- struct winbindd_response *response,
- void *c, void *private_data)
-{
- void (*cont)(void *priv, BOOL succ, gid_t gid) =
- (void (*)(void *, BOOL, gid_t))c;
-
- if (!success) {
- DEBUG(5, ("Could not trigger sid2gid\n"));
- cont(private_data, False, 0);
- return;
- }
-
- if (response->result != WINBINDD_OK) {
- DEBUG(5, ("sid2gid returned an error\n"));
- cont(private_data, False, 0);
- return;
- }
-
- cont(private_data, True, response->data.gid);
-}
-
static void gid2name_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
void *c, void *private_data)
return WINBINDD_OK;
}
+#if 0 /* not used */
static void name2gid_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
void *c, void *private_data);
do_async(mem_ctx, idmap_child(), &request, name2gid_recv,
(void *)cont, private_data);
}
+#endif /* not used */
enum winbindd_result winbindd_dual_name2gid(struct winbindd_domain *domain,
struct winbindd_cli_state *state)
return WINBINDD_OK;
}
+#if 0 /* not used */
static void name2gid_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
void *c, void *private_data)
cont(private_data, True, response->data.gid);
}
-
+#endif /* not used */
static void lookupsid_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
{
enum lsa_SidType type;
DOM_SID sid;
- fstring name;
- fstring dom_name;
+ char *name = NULL;
+ char *dom_name = NULL;
/* Ensure null termination */
state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
if (!winbindd_lookup_name_by_sid(state->mem_ctx, &sid, dom_name, name,
&type)) {
+ TALLOC_FREE(dom_name);
+ TALLOC_FREE(name);
return WINBINDD_ERROR;
}
fstrcpy(state->response.data.name.name, name);
state->response.data.name.type = type;
+ TALLOC_FREE(dom_name);
+ TALLOC_FREE(name);
return WINBINDD_OK;
}
state->cont(state->private_data, True, state->sids, state->num_sids);
}
-struct sid2uid_state {
- TALLOC_CTX *mem_ctx;
- DOM_SID sid;
- char *username;
- uid_t uid;
- void (*cont)(void *private_data, BOOL success, uid_t uid);
- void *private_data;
-};
-
-static void sid2uid_lookup_sid_recv(void *private_data, BOOL success,
- const char *dom_name, const char *name,
- enum lsa_SidType type);
-static void sid2uid_noalloc_recv(void *private_data, BOOL success, uid_t uid);
-static void sid2uid_alloc_recv(void *private_data, BOOL success, uid_t uid);
-static void sid2uid_name2uid_recv(void *private_data, BOOL success, uid_t uid);
-static void sid2uid_set_mapping_recv(void *private_data, BOOL success);
-
-void winbindd_sid2uid_async(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
- void (*cont)(void *private_data, BOOL success,
- uid_t uid),
- void *private_data)
-{
- struct sid2uid_state *state;
- NTSTATUS result;
- uid_t uid;
-
- if (idmap_proxyonly()) {
- DEBUG(10, ("idmap proxy only\n"));
- cont(private_data, False, 0);
- return;
- }
-
- /* Query only the local tdb, everything else might possibly block */
-
- result = idmap_sid_to_uid(sid, &uid, IDMAP_FLAG_QUERY_ONLY|IDMAP_FLAG_CACHE_ONLY);
-
- if (NT_STATUS_IS_OK(result)) {
- cont(private_data, True, uid);
- return;
- }
-
- state = TALLOC_ZERO_P(mem_ctx, struct sid2uid_state);
- if (state == NULL) {
- DEBUG(0, ("talloc failed\n"));
- cont(private_data, False, 0);
- return;
- }
-
- state->mem_ctx = mem_ctx;
- state->sid = *sid;
- state->cont = cont;
- state->private_data = private_data;
-
- /* Let's see if it's really a user before allocating a uid */
-
- winbindd_lookupsid_async(mem_ctx, sid, sid2uid_lookup_sid_recv, state);
-}
-
-static void sid2uid_lookup_sid_recv(void *private_data, BOOL success,
- const char *dom_name, const char *name,
- enum lsa_SidType type)
-{
- struct sid2uid_state *state =
- talloc_get_type_abort(private_data, struct sid2uid_state);
-
- if (!success) {
- DEBUG(5, ("Could not trigger lookup_sid\n"));
- state->cont(state->private_data, False, 0);
- return;
- }
-
- if ((type != SID_NAME_USER) && (type != SID_NAME_COMPUTER)) {
- DEBUG(5, ("SID is not a user\n"));
- state->cont(state->private_data, False, 0);
- return;
- }
-
- state->username = talloc_strdup(state->mem_ctx, name);
-
- /* Ask the possibly blocking remote IDMAP */
-
- idmap_sid2uid_async(state->mem_ctx, &state->sid, False,
- sid2uid_noalloc_recv, state);
-}
-
-static void sid2uid_noalloc_recv(void *private_data, BOOL success, uid_t uid)
-{
- struct sid2uid_state *state =
- talloc_get_type_abort(private_data, struct sid2uid_state);
-
- if (success) {
- DEBUG(10, ("found uid for sid %s in remote backend\n",
- sid_string_static(&state->sid)));
- state->cont(state->private_data, True, uid);
- return;
- }
-
- if (lp_winbind_trusted_domains_only() &&
- (sid_compare_domain(&state->sid, &find_our_domain()->sid) == 0)) {
- DEBUG(10, ("Trying to go via nss\n"));
- winbindd_name2uid_async(state->mem_ctx, state->username,
- sid2uid_name2uid_recv, state);
- return;
- }
-
- /* To be done: Here we're going to try the unixinfo pipe */
-
- /* Now allocate a uid */
-
- idmap_sid2uid_async(state->mem_ctx, &state->sid, True,
- sid2uid_alloc_recv, state);
-}
-
-static void sid2uid_alloc_recv(void *private_data, BOOL success, uid_t uid)
-{
- struct sid2uid_state *state =
- talloc_get_type_abort(private_data, struct sid2uid_state);
-
- if (!success) {
- DEBUG(5, ("Could not allocate uid\n"));
- state->cont(state->private_data, False, 0);
- return;
- }
-
- state->cont(state->private_data, True, uid);
-}
-
-static void sid2uid_name2uid_recv(void *private_data, BOOL success, uid_t uid)
-{
- struct sid2uid_state *state =
- talloc_get_type_abort(private_data, struct sid2uid_state);
- unid_t id;
-
- if (!success) {
- DEBUG(5, ("Could not find uid for name %s\n",
- state->username));
- state->cont(state->private_data, False, 0);
- return;
- }
-
- state->uid = uid;
-
- id.uid = uid;
- idmap_set_mapping_async(state->mem_ctx, &state->sid, id, ID_USERID,
- sid2uid_set_mapping_recv, state);
-}
-
-static void sid2uid_set_mapping_recv(void *private_data, BOOL success)
-{
- struct sid2uid_state *state =
- talloc_get_type_abort(private_data, struct sid2uid_state);
-
- if (!success) {
- DEBUG(5, ("Could not set ID mapping for sid %s\n",
- sid_string_static(&state->sid)));
- state->cont(state->private_data, False, 0);
- return;
- }
-
- state->cont(state->private_data, True, state->uid);
-}
-
-struct sid2gid_state {
- TALLOC_CTX *mem_ctx;
- DOM_SID sid;
- char *groupname;
- gid_t gid;
- void (*cont)(void *private_data, BOOL success, gid_t gid);
- void *private_data;
-};
-
-static void sid2gid_lookup_sid_recv(void *private_data, BOOL success,
- const char *dom_name, const char *name,
- enum lsa_SidType type);
-static void sid2gid_noalloc_recv(void *private_data, BOOL success, gid_t gid);
-static void sid2gid_alloc_recv(void *private_data, BOOL success, gid_t gid);
-static void sid2gid_name2gid_recv(void *private_data, BOOL success, gid_t gid);
-static void sid2gid_set_mapping_recv(void *private_data, BOOL success);
-
-void winbindd_sid2gid_async(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
- void (*cont)(void *private_data, BOOL success,
- gid_t gid),
- void *private_data)
-{
- struct sid2gid_state *state;
- NTSTATUS result;
- gid_t gid;
-
- if (idmap_proxyonly()) {
- DEBUG(10, ("idmap proxy only\n"));
- cont(private_data, False, 0);
- return;
- }
-
- /* Query only the local tdb, everything else might possibly block */
-
- result = idmap_sid_to_gid(sid, &gid, IDMAP_FLAG_QUERY_ONLY|IDMAP_FLAG_CACHE_ONLY);
-
- if (NT_STATUS_IS_OK(result)) {
- cont(private_data, True, gid);
- return;
- }
-
- state = TALLOC_ZERO_P(mem_ctx, struct sid2gid_state);
- if (state == NULL) {
- DEBUG(0, ("talloc failed\n"));
- cont(private_data, False, 0);
- return;
- }
-
- state->mem_ctx = mem_ctx;
- state->sid = *sid;
- state->cont = cont;
- state->private_data = private_data;
-
- /* Let's see if it's really a user before allocating a gid */
-
- winbindd_lookupsid_async(mem_ctx, sid, sid2gid_lookup_sid_recv, state);
-}
-
-static void sid2gid_lookup_sid_recv(void *private_data, BOOL success,
- const char *dom_name, const char *name,
- enum lsa_SidType type)
-{
- struct sid2gid_state *state =
- talloc_get_type_abort(private_data, struct sid2gid_state);
-
- if (!success) {
- DEBUG(5, ("Could not trigger lookup_sid\n"));
- state->cont(state->private_data, False, 0);
- return;
- }
-
- if (((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
- (type != SID_NAME_WKN_GRP))) {
- DEBUG(5, ("SID is not a group\n"));
- state->cont(state->private_data, False, 0);
- return;
- }
-
- state->groupname = talloc_strdup(state->mem_ctx, name);
-
- /* Ask the possibly blocking remote IDMAP and allocate */
-
- idmap_sid2gid_async(state->mem_ctx, &state->sid, False,
- sid2gid_noalloc_recv, state);
-}
-
-static void sid2gid_noalloc_recv(void *private_data, BOOL success, gid_t gid)
-{
- struct sid2gid_state *state =
- talloc_get_type_abort(private_data, struct sid2gid_state);
-
- if (success) {
- DEBUG(10, ("found gid for sid %s in remote backend\n",
- sid_string_static(&state->sid)));
- state->cont(state->private_data, True, gid);
- return;
- }
-
- if (lp_winbind_trusted_domains_only() &&
- (sid_compare_domain(&state->sid, &find_our_domain()->sid) == 0)) {
- DEBUG(10, ("Trying to go via nss\n"));
- winbindd_name2gid_async(state->mem_ctx, state->groupname,
- sid2gid_name2gid_recv, state);
- return;
- }
-
- /* To be done: Here we're going to try the unixinfo pipe */
-
- /* Now allocate a gid */
-
- idmap_sid2gid_async(state->mem_ctx, &state->sid, True,
- sid2gid_alloc_recv, state);
-}
-
-static void sid2gid_alloc_recv(void *private_data, BOOL success, gid_t gid)
-{
- struct sid2gid_state *state =
- talloc_get_type_abort(private_data, struct sid2gid_state);
-
- if (!success) {
- DEBUG(5, ("Could not allocate gid\n"));
- state->cont(state->private_data, False, 0);
- return;
- }
-
- state->cont(state->private_data, True, gid);
-}
-
-static void sid2gid_name2gid_recv(void *private_data, BOOL success, gid_t gid)
-{
- struct sid2gid_state *state =
- talloc_get_type_abort(private_data, struct sid2gid_state);
- unid_t id;
-
- if (!success) {
- DEBUG(5, ("Could not find gid for name %s\n",
- state->groupname));
- state->cont(state->private_data, False, 0);
- return;
- }
-
- state->gid = gid;
-
- id.gid = gid;
- idmap_set_mapping_async(state->mem_ctx, &state->sid, id, ID_GROUPID,
- sid2gid_set_mapping_recv, state);
-}
-
-static void sid2gid_set_mapping_recv(void *private_data, BOOL success)
-{
- struct sid2gid_state *state =
- talloc_get_type_abort(private_data, struct sid2gid_state);
-
- if (!success) {
- DEBUG(5, ("Could not set ID mapping for sid %s\n",
- sid_string_static(&state->sid)));
- state->cont(state->private_data, False, 0);
- return;
- }
-
- state->cont(state->private_data, True, state->gid);
-}
-
static void query_user_recv(TALLOC_CTX *mem_ctx, BOOL success,
struct winbindd_response *response,
void *c, void *private_data)
(unsigned long) state->request.data.uid));
/* Find sid for this uid and return it, possibly ask the slow remote idmap */
- result = idmap_uid_to_sid(&sid, state->request.data.uid, IDMAP_FLAG_NONE);
+ result = idmap_uid_to_sid(&sid, state->request.data.uid);
if (NT_STATUS_IS_OK(result)) {
sid_to_string(state->response.data.sid.sid, &sid);
(unsigned long) state->request.data.gid));
/* Find sid for this gid and return it, possibly ask the slow remote idmap */
- result = idmap_gid_to_sid(&sid, state->request.data.gid, IDMAP_FLAG_NONE);
+ result = idmap_gid_to_sid(&sid, state->request.data.gid);
if (NT_STATUS_IS_OK(result)) {
sid_to_string(state->response.data.sid.sid, &sid);
return WINBINDD_ERROR;
}
+
+static void winbindd_dump_id_maps_recv(TALLOC_CTX *mem_ctx, BOOL success,
+ struct winbindd_response *response,
+ void *c, void *private_data)
+{
+ void (*cont)(void *priv, BOOL succ) =
+ (void (*)(void *, BOOL))c;
+
+ if (!success) {
+ DEBUG(5, ("Could not trigger a map dump\n"));
+ cont(private_data, False);
+ return;
+ }
+
+ if (response->result != WINBINDD_OK) {
+ DEBUG(5, ("idmap dump maps returned an error\n"));
+ cont(private_data, False);
+ return;
+ }
+
+ cont(private_data, True);
+}
+
+void winbindd_dump_maps_async(TALLOC_CTX *mem_ctx, void *data, int size,
+ void (*cont)(void *private_data, BOOL success),
+ void *private_data)
+{
+ struct winbindd_request request;
+ ZERO_STRUCT(request);
+ request.cmd = WINBINDD_DUAL_DUMP_MAPS;
+ request.extra_data.data = data;
+ request.extra_len = size;
+ do_async(mem_ctx, idmap_child(), &request, winbindd_dump_id_maps_recv,
+ (void *)cont, private_data);
+}
+
+enum winbindd_result winbindd_dual_dump_maps(struct winbindd_domain *domain,
+ struct winbindd_cli_state *state)
+{
+ DEBUG(3, ("[%5lu]: dual dump maps\n", (unsigned long)state->pid));
+
+ idmap_dump_maps((char *)state->request.extra_data.data);
+
+ return WINBINDD_OK;
+}
+
{ WINBINDD_CHECK_MACHACC, winbindd_dual_check_machine_acct, "CHECK_MACHACC" },
{ WINBINDD_DUAL_SID2UID, winbindd_dual_sid2uid, "DUAL_SID2UID" },
{ WINBINDD_DUAL_SID2GID, winbindd_dual_sid2gid, "DUAL_SID2GID" },
+ { WINBINDD_DUAL_SIDS2XIDS, winbindd_dual_sids2xids, "DUAL_SIDS2XIDS" },
{ WINBINDD_DUAL_UID2SID, winbindd_dual_uid2sid, "DUAL_UID2SID" },
{ WINBINDD_DUAL_GID2SID, winbindd_dual_gid2sid, "DUAL_GID2SID" },
{ WINBINDD_DUAL_UID2NAME, winbindd_dual_uid2name, "DUAL_UID2NAME" },
{ WINBINDD_DUAL_NAME2UID, winbindd_dual_name2uid, "DUAL_NAME2UID" },
{ WINBINDD_DUAL_GID2NAME, winbindd_dual_gid2name, "DUAL_GID2NAME" },
{ WINBINDD_DUAL_NAME2GID, winbindd_dual_name2gid, "DUAL_NAME2GID" },
- { WINBINDD_DUAL_IDMAPSET, winbindd_dual_idmapset, "DUAL_IDMAPSET" },
+ { WINBINDD_DUAL_SET_MAPPING, winbindd_dual_set_mapping, "DUAL_SET_MAPPING" },
+ { WINBINDD_DUAL_SET_HWM, winbindd_dual_set_hwm, "DUAL_SET_HWMS" },
+ { WINBINDD_DUAL_DUMP_MAPS, winbindd_dual_dump_maps, "DUAL_DUMP_MAPS" },
{ WINBINDD_DUAL_USERINFO, winbindd_dual_userinfo, "DUAL_USERINFO" },
{ WINBINDD_ALLOCATE_UID, winbindd_dual_allocate_uid, "ALLOCATE_UID" },
{ WINBINDD_ALLOCATE_GID, winbindd_dual_allocate_gid, "ALLOCATE_GID" },
if (sys_getpeereid(state->sock, &ret_uid)==0) {
/* We know who's asking - look up their SID if
it's one we've mapped before. */
- status = idmap_uid_to_sid(&querying_user_sid,
- ret_uid,
- IDMAP_FLAG_QUERY_ONLY|IDMAP_FLAG_CACHE_ONLY);
+ status = idmap_uid_to_sid(&querying_user_sid, ret_uid);
if (NT_STATUS_IS_OK(status)) {
pquerying_user_sid = &querying_user_sid;
DEBUG(10,("fill_grent_mem: querying uid %u -> %s\n",
/* Try to get the GID */
- status = idmap_sid_to_gid(&group_sid, &gid, 0);
+ status = idmap_sid_to_gid(&group_sid, &gid);
if (NT_STATUS_IS_OK(status)) {
goto got_gid;
{
struct winbindd_domain *domain;
enum lsa_SidType name_type;
- fstring dom_name;
- fstring group_name;
+ char *dom_name = NULL;
+ char *group_name = NULL;
size_t gr_mem_len;
size_t num_gr_mem;
char *gr_mem;
/* Get name from sid */
- if (!winbindd_lookup_name_by_sid(state->mem_ctx, &group_sid, dom_name,
- group_name, &name_type)) {
+ if (!winbindd_lookup_name_by_sid(state->mem_ctx, &group_sid, &dom_name,
+ &group_name, &name_type)) {
DEBUG(1, ("could not lookup sid\n"));
request_error(state);
+ TALLOC_FREE(group_name);
+ TALLOC_FREE(dom_name);
return;
}
if (!domain) {
DEBUG(1,("Can't find domain from sid\n"));
request_error(state);
+ TALLOC_FREE(group_name);
+ TALLOC_FREE(dom_name);
return;
}
DEBUG(1, ("name '%s' is not a local or domain group: %d\n",
group_name, name_type));
request_error(state);
+ TALLOC_FREE(group_name);
+ TALLOC_FREE(dom_name);
return;
}
&num_gr_mem,
&gr_mem, &gr_mem_len)) {
request_error(state);
+ TALLOC_FREE(group_name);
+ TALLOC_FREE(dom_name);
return;
}
state->response.length += gr_mem_len;
state->response.extra_data.data = gr_mem;
+ TALLOC_FREE(group_name);
+ TALLOC_FREE(dom_name);
+
request_ok(state);
}
/* Return a group structure from a gid number */
void winbindd_getgrgid(struct winbindd_cli_state *state)
{
- DOM_SID group_sid;
- NTSTATUS status;
-
DEBUG(3, ("[%5lu]: getgrgid %lu\n", (unsigned long)state->pid,
(unsigned long)state->request.data.gid));
- /* Bug out if the gid isn't in the winbind range */
-
- if ((state->request.data.gid < server_state.gid_low) ||
- (state->request.data.gid > server_state.gid_high)) {
- request_error(state);
- return;
- }
-
- /* Get sid from gid */
-
- status = idmap_gid_to_sid(&group_sid, state->request.data.gid, IDMAP_FLAG_NONE);
- if (NT_STATUS_IS_OK(status)) {
- /* This is a remote one */
- getgrgid_got_sid(state, group_sid);
- return;
- }
-
- DEBUG(10,("winbindd_getgrgid: gid %lu not found in cache, try with the async interface\n",
- (unsigned long)state->request.data.gid));
-
+ /* always use the async interface */
winbindd_gid2sid_async(state->mem_ctx, state->request.data.gid, getgrgid_recv, state);
}
sid_copy(&group_sid, &domain->sid);
sid_append_rid(&group_sid, name_list[ent->sam_entry_index].rid);
- if (!NT_STATUS_IS_OK(idmap_sid_to_gid(&group_sid,
- &group_gid, 0))) {
+ if (!NT_STATUS_IS_OK(idmap_sid_to_gid(&group_sid, &group_gid))) {
union unid_t id;
enum lsa_SidType type;
/* Update this when you change the interface. */
-#define WINBIND_INTERFACE_VERSION 17
+#define WINBIND_INTERFACE_VERSION 18
/* Have to deal with time_t being 4 or 8 bytes due to structure alignment.
On a 64bit Linux box, we have to support a constant structure size
WINBINDD_SID_TO_UID,
WINBINDD_SID_TO_GID,
+ WINBINDD_SIDS_TO_XIDS,
WINBINDD_UID_TO_SID,
WINBINDD_GID_TO_SID,
WINBINDD_ALLOCATE_UID,
WINBINDD_ALLOCATE_GID,
+ WINBINDD_SET_MAPPING,
+ WINBINDD_SET_HWM,
/* Miscellaneous other stuff */
+ WINBINDD_DUMP_MAPS,
+
WINBINDD_CHECK_MACHACC, /* Check machine account pw works */
WINBINDD_PING, /* Just tell me winbind is running */
WINBINDD_INFO, /* Various bit of info. Currently just tidbits */
* between parent and children */
WINBINDD_DUAL_SID2UID,
WINBINDD_DUAL_SID2GID,
+ WINBINDD_DUAL_SIDS2XIDS,
WINBINDD_DUAL_UID2SID,
WINBINDD_DUAL_GID2SID,
- WINBINDD_DUAL_IDMAPSET,
+ WINBINDD_DUAL_SET_MAPPING,
+ WINBINDD_DUAL_SET_HWM,
+ WINBINDD_DUAL_DUMP_MAPS,
/* Wrapper around possibly blocking unix nss calls */
WINBINDD_DUAL_UID2NAME,
struct {
fstring sid;
fstring name;
- BOOL alloc;
} dual_sid2id;
struct {
- int type;
- uid_t uid;
- gid_t gid;
fstring sid;
+ uint32 type;
+ uint32 id;
} dual_idmapset;
BOOL list_all_domains;
/* Convert a sid to a uid. We assume we only have one rid attached to the
sid. */
-static void sid2uid_recv(void *private_data, BOOL success, uid_t uid);
+static void sid2uid_recv(void *private_data, BOOL success, uid_t uid)
+{
+ struct winbindd_cli_state *state =
+ talloc_get_type_abort(private_data, struct winbindd_cli_state);
+
+ if (!success) {
+ DEBUG(5, ("Could not convert sid %s\n",
+ state->request.data.sid));
+ request_error(state);
+ return;
+ }
+
+ state->response.data.uid = uid;
+ request_ok(state);
+}
void winbindd_sid_to_uid(struct winbindd_cli_state *state)
{
DOM_SID sid;
- NTSTATUS result;
/* Ensure null termination */
state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
DEBUG(3, ("[%5lu]: sid to uid %s\n", (unsigned long)state->pid,
state->request.data.sid));
- if (idmap_proxyonly()) {
- DEBUG(8, ("IDMAP proxy only\n"));
- request_error(state);
- return;
- }
-
if (!string_to_sid(&sid, state->request.data.sid)) {
DEBUG(1, ("Could not get convert sid %s from string\n",
state->request.data.sid));
return;
}
- /* Query only the local tdb, everything else might possibly block */
-
- result = idmap_sid_to_uid(&sid, &state->response.data.uid,
- IDMAP_FLAG_QUERY_ONLY|IDMAP_FLAG_CACHE_ONLY);
-
- if (NT_STATUS_IS_OK(result)) {
- request_ok(state);
- return;
- }
-
+ /* always use the async interface (may block) */
winbindd_sid2uid_async(state->mem_ctx, &sid, sid2uid_recv, state);
}
-static void sid2uid_recv(void *private_data, BOOL success, uid_t uid)
+/* Convert a sid to a gid. We assume we only have one rid attached to the
+ sid.*/
+
+static void sid2gid_recv(void *private_data, BOOL success, gid_t gid)
{
struct winbindd_cli_state *state =
talloc_get_type_abort(private_data, struct winbindd_cli_state);
return;
}
- state->response.data.uid = uid;
+ state->response.data.gid = gid;
request_ok(state);
}
-/* Convert a sid to a gid. We assume we only have one rid attached to the
- sid.*/
-
-static void sid2gid_recv(void *private_data, BOOL success, gid_t gid);
-
void winbindd_sid_to_gid(struct winbindd_cli_state *state)
{
DOM_SID sid;
- NTSTATUS result;
/* Ensure null termination */
state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
DEBUG(3, ("[%5lu]: sid to gid %s\n", (unsigned long)state->pid,
state->request.data.sid));
- if (idmap_proxyonly()) {
- DEBUG(8, ("IDMAP proxy only\n"));
- request_error(state);
- return;
- }
-
if (!string_to_sid(&sid, state->request.data.sid)) {
DEBUG(1, ("Could not get convert sid %s from string\n",
state->request.data.sid));
return;
}
- /* Query only the local tdb, everything else might possibly block */
-
- result = idmap_sid_to_gid(&sid, &state->response.data.gid,
- IDMAP_FLAG_QUERY_ONLY|IDMAP_FLAG_CACHE_ONLY);
-
- if (NT_STATUS_IS_OK(result)) {
- request_ok(state);
- return;
- }
-
+ /* always use the async interface (may block) */
winbindd_sid2gid_async(state->mem_ctx, &sid, sid2gid_recv, state);
}
-static void sid2gid_recv(void *private_data, BOOL success, gid_t gid)
+static void sids2xids_recv(void *private_data, BOOL success, void *data, int len)
{
struct winbindd_cli_state *state =
talloc_get_type_abort(private_data, struct winbindd_cli_state);
if (!success) {
- DEBUG(5, ("Could not convert sid %s\n",
- state->request.data.sid));
+ DEBUG(5, ("Could not convert sids to xids\n"));
request_error(state);
return;
}
- state->response.data.gid = gid;
+ state->response.extra_data.data = data;
+ state->response.length = sizeof(state->response) + len;
request_ok(state);
}
-/* Convert a uid to a sid */
-
-struct uid2sid_state {
- struct winbindd_cli_state *cli_state;
- uid_t uid;
- fstring name;
- DOM_SID sid;
- enum lsa_SidType type;
-};
-
-static void uid2sid_uid2name_recv(void *private_data, BOOL success,
- const char *username);
-static void uid2sid_lookupname_recv(void *private_data, BOOL success,
- const DOM_SID *sid,
- enum lsa_SidType type);
-static void uid2sid_idmap_set_mapping_recv(void *private_data, BOOL success);
-
-static void uid2sid_recv(void *private_data, BOOL success, const char *sid);
-
-void winbindd_uid_to_sid(struct winbindd_cli_state *state)
+void winbindd_sids_to_unixids(struct winbindd_cli_state *state)
{
- DOM_SID sid;
- NTSTATUS status;
-
- DEBUG(3, ("[%5lu]: uid to sid %lu\n", (unsigned long)state->pid,
- (unsigned long)state->request.data.uid));
+ DEBUG(3, ("[%5lu]: sids to xids\n", (unsigned long)state->pid));
- if (idmap_proxyonly()) {
- DEBUG(8, ("IDMAP proxy only\n"));
- request_error(state);
- return;
- }
-
- status = idmap_uid_to_sid(&sid, state->request.data.uid,
- IDMAP_FLAG_QUERY_ONLY|IDMAP_FLAG_CACHE_ONLY);
-
- if (NT_STATUS_IS_OK(status)) {
- sid_to_string(state->response.data.sid.sid, &sid);
- state->response.data.sid.type = SID_NAME_USER;
- request_ok(state);
- return;
- }
-
- winbindd_uid2sid_async(state->mem_ctx, state->request.data.uid, uid2sid_recv, state);
+ winbindd_sids2xids_async(state->mem_ctx,
+ state->request.extra_data.data,
+ state->request.extra_len,
+ sids2xids_recv, state);
}
-static void uid2sid_recv(void *private_data, BOOL success, const char *sid)
+static void set_mapping_recv(void *private_data, BOOL success)
{
struct winbindd_cli_state *state =
- (struct winbindd_cli_state *)private_data;
- struct uid2sid_state *uid2sid_state;
+ talloc_get_type_abort(private_data, struct winbindd_cli_state);
- if (success) {
- DEBUG(10,("uid2sid: uid %lu has sid %s\n",
- (unsigned long)(state->request.data.uid), sid));
- fstrcpy(state->response.data.sid.sid, sid);
- state->response.data.sid.type = SID_NAME_USER;
- request_ok(state);
+ if (!success) {
+ DEBUG(5, ("Could not set sid mapping\n"));
+ request_error(state);
return;
}
- /* preexisitng mapping not found go on */
+ request_ok(state);
+}
- if (is_in_uid_range(state->request.data.uid)) {
- /* This is winbind's, so we should better have succeeded
- * above. */
- request_error(state);
- return;
- }
+void winbindd_set_mapping(struct winbindd_cli_state *state)
+{
+ struct id_map map;
+ DOM_SID sid;
- /* The only chance that this is correct is that winbind trusted
- * domains only = yes, and the user exists in nss and the domain. */
+ DEBUG(3, ("[%5lu]: set id map\n", (unsigned long)state->pid));
- if (!lp_winbind_trusted_domains_only()) {
+ if ( ! state->privileged) {
+ DEBUG(0, ("Only root is allowed to set mappings!\n"));
request_error(state);
return;
}
- uid2sid_state = TALLOC_ZERO_P(state->mem_ctx, struct uid2sid_state);
- if (uid2sid_state == NULL) {
- DEBUG(0, ("talloc failed\n"));
+ if (!string_to_sid(&sid, state->request.data.dual_idmapset.sid)) {
+ DEBUG(1, ("Could not get convert sid %s from string\n",
+ state->request.data.sid));
request_error(state);
return;
}
- uid2sid_state->cli_state = state;
- uid2sid_state->uid = state->request.data.uid;
+ map.sid = &sid;
+ map.xid.id = state->request.data.dual_idmapset.id;
+ map.xid.type = state->request.data.dual_idmapset.type;
- winbindd_uid2name_async(state->mem_ctx, state->request.data.uid,
- uid2sid_uid2name_recv, uid2sid_state);
+ winbindd_set_mapping_async(state->mem_ctx, &map,
+ set_mapping_recv, state);
}
-static void uid2sid_uid2name_recv(void *private_data, BOOL success,
- const char *username)
+static void set_hwm_recv(void *private_data, BOOL success)
{
- struct uid2sid_state *state =
- talloc_get_type_abort(private_data, struct uid2sid_state);
-
- DEBUG(10, ("uid2sid: uid %lu has name %s\n",
- (unsigned long)state->uid, username));
-
- fstrcpy(state->name, username);
+ struct winbindd_cli_state *state =
+ talloc_get_type_abort(private_data, struct winbindd_cli_state);
if (!success) {
- request_error(state->cli_state);
+ DEBUG(5, ("Could not set sid mapping\n"));
+ request_error(state);
return;
}
- winbindd_lookupname_async(state->cli_state->mem_ctx,
- find_our_domain()->name, username,
- uid2sid_lookupname_recv, state);
+ request_ok(state);
}
-static void uid2sid_lookupname_recv(void *private_data, BOOL success,
- const DOM_SID *sid, enum lsa_SidType type)
+void winbindd_set_hwm(struct winbindd_cli_state *state)
{
- struct uid2sid_state *state =
- talloc_get_type_abort(private_data, struct uid2sid_state);
- unid_t id;
+ struct unixid xid;
+
+ DEBUG(3, ("[%5lu]: set hwm\n", (unsigned long)state->pid));
- if ((!success) || (type != SID_NAME_USER)) {
- request_error(state->cli_state);
+ if ( ! state->privileged) {
+ DEBUG(0, ("Only root is allowed to set mappings!\n"));
+ request_error(state);
return;
}
- state->sid = *sid;
- state->type = type;
+ xid.id = state->request.data.dual_idmapset.id;
+ xid.type = state->request.data.dual_idmapset.type;
- id.uid = state->uid;
- idmap_set_mapping_async(state->cli_state->mem_ctx, sid, id, ID_USERID,
- uid2sid_idmap_set_mapping_recv, state );
+ winbindd_set_hwm_async(state->mem_ctx, &xid, set_hwm_recv, state);
}
-static void uid2sid_idmap_set_mapping_recv(void *private_data, BOOL success)
-{
- struct uid2sid_state *state =
- talloc_get_type_abort(private_data, struct uid2sid_state);
-
- /* don't fail if we can't store it */
-
- sid_to_string(state->cli_state->response.data.sid.sid, &state->sid);
- state->cli_state->response.data.sid.type = state->type;
- request_ok(state->cli_state);
-}
-
-/* Convert a gid to a sid */
-
-struct gid2sid_state {
- struct winbindd_cli_state *cli_state;
- gid_t gid;
- fstring name;
- DOM_SID sid;
- enum lsa_SidType type;
-};
-
-static void gid2sid_gid2name_recv(void *private_data, BOOL success,
- const char *groupname);
-static void gid2sid_lookupname_recv(void *private_data, BOOL success,
- const DOM_SID *sid,
- enum lsa_SidType type);
-static void gid2sid_idmap_set_mapping_recv(void *private_data, BOOL success);
-
-static void gid2sid_recv(void *private_data, BOOL success, const char *sid);
+/* Convert a uid to a sid */
-void winbindd_gid_to_sid(struct winbindd_cli_state *state)
+static void uid2sid_recv(void *private_data, BOOL success, const char *sid)
{
- DOM_SID sid;
- NTSTATUS status;
-
- DEBUG(3, ("[%5lu]: gid to sid %lu\n", (unsigned long)state->pid,
- (unsigned long)state->request.data.gid));
+ struct winbindd_cli_state *state =
+ (struct winbindd_cli_state *)private_data;
- if (idmap_proxyonly()) {
- DEBUG(8, ("IDMAP proxy only\n"));
- request_error(state);
+ if (success) {
+ DEBUG(10,("uid2sid: uid %lu has sid %s\n",
+ (unsigned long)(state->request.data.uid), sid));
+ fstrcpy(state->response.data.sid.sid, sid);
+ state->response.data.sid.type = SID_NAME_USER;
+ request_ok(state);
return;
}
- status = idmap_gid_to_sid(&sid, state->request.data.gid,
- IDMAP_FLAG_QUERY_ONLY|IDMAP_FLAG_CACHE_ONLY);
+ request_error(state);
+ return;
+}
- if (NT_STATUS_IS_OK(status)) {
- sid_to_string(state->response.data.sid.sid, &sid);
- state->response.data.sid.type = SID_NAME_DOM_GRP;
- request_ok(state);
- return;
- }
+void winbindd_uid_to_sid(struct winbindd_cli_state *state)
+{
+ DEBUG(3, ("[%5lu]: uid to sid %lu\n", (unsigned long)state->pid,
+ (unsigned long)state->request.data.uid));
- winbindd_gid2sid_async(state->mem_ctx, state->request.data.gid, gid2sid_recv, state);
+ /* always go via the async interface (may block) */
+ winbindd_uid2sid_async(state->mem_ctx, state->request.data.uid, uid2sid_recv, state);
}
+/* Convert a gid to a sid */
+
static void gid2sid_recv(void *private_data, BOOL success, const char *sid)
{
struct winbindd_cli_state *state =
(struct winbindd_cli_state *)private_data;
- struct gid2sid_state *gid2sid_state;
if (success) {
DEBUG(10,("gid2sid: gid %lu has sid %s\n",
return;
}
- /* preexisitng mapping not found go on */
-
- if (is_in_gid_range(state->request.data.gid)) {
- /* This is winbind's, so we should better have succeeded
- * above. */
- request_error(state);
- return;
- }
-
- /* The only chance that this is correct is that winbind trusted
- * domains only = yes, and the user exists in nss and the domain. */
-
- if (!lp_winbind_trusted_domains_only()) {
- request_error(state);
- return;
- }
-
- /* The only chance that this is correct is that winbind trusted
- * domains only = yes, and the user exists in nss and the domain. */
-
- gid2sid_state = TALLOC_ZERO_P(state->mem_ctx, struct gid2sid_state);
- if (gid2sid_state == NULL) {
- DEBUG(0, ("talloc failed\n"));
- request_error(state);
- return;
- }
-
- gid2sid_state->cli_state = state;
- gid2sid_state->gid = state->request.data.gid;
-
- winbindd_gid2name_async(state->mem_ctx, state->request.data.gid,
- gid2sid_gid2name_recv, gid2sid_state);
-}
-
-static void gid2sid_gid2name_recv(void *private_data, BOOL success,
- const char *username)
-{
- struct gid2sid_state *state =
- talloc_get_type_abort(private_data, struct gid2sid_state);
-
- DEBUG(10, ("gid2sid: gid %lu has name %s\n",
- (unsigned long)state->gid, username));
-
- fstrcpy(state->name, username);
-
- if (!success) {
- request_error(state->cli_state);
- return;
- }
-
- winbindd_lookupname_async(state->cli_state->mem_ctx,
- find_our_domain()->name, username,
- gid2sid_lookupname_recv, state);
+ request_error(state);
+ return;
}
-static void gid2sid_lookupname_recv(void *private_data, BOOL success,
- const DOM_SID *sid, enum lsa_SidType type)
-{
- struct gid2sid_state *state =
- talloc_get_type_abort(private_data, struct gid2sid_state);
- unid_t id;
-
- if ((!success) ||
- ((type != SID_NAME_DOM_GRP) && (type!=SID_NAME_ALIAS))) {
- request_error(state->cli_state);
- return;
- }
-
- state->sid = *sid;
- state->type = type;
- id.gid = state->gid;
- idmap_set_mapping_async(state->cli_state->mem_ctx, sid, id, ID_GROUPID,
- gid2sid_idmap_set_mapping_recv, state );
-}
-
-static void gid2sid_idmap_set_mapping_recv(void *private_data, BOOL success)
+void winbindd_gid_to_sid(struct winbindd_cli_state *state)
{
- struct gid2sid_state *state =
- (struct gid2sid_state *)private_data;
-
- /* don't fail if we can't store it */
+ DEBUG(3, ("[%5lu]: gid to sid %lu\n", (unsigned long)state->pid,
+ (unsigned long)state->request.data.gid));
- sid_to_string(state->cli_state->response.data.sid.sid, &state->sid);
- state->cli_state->response.data.sid.type = state->type;
- request_ok(state->cli_state);
+ /* always use async calls (may block) */
+ winbindd_gid2sid_async(state->mem_ctx, state->request.data.gid, gid2sid_recv, state);
}
void winbindd_allocate_uid(struct winbindd_cli_state *state)
enum winbindd_result winbindd_dual_allocate_uid(struct winbindd_domain *domain,
struct winbindd_cli_state *state)
{
- union unid_t id;
+ struct unixid xid;
- if (!NT_STATUS_IS_OK(idmap_allocate_id(&id, ID_USERID))) {
+ if (!NT_STATUS_IS_OK(idmap_allocate_uid(&xid))) {
return WINBINDD_ERROR;
}
- state->response.data.uid = id.uid;
+ state->response.data.uid = xid.id;
return WINBINDD_OK;
}
enum winbindd_result winbindd_dual_allocate_gid(struct winbindd_domain *domain,
struct winbindd_cli_state *state)
{
- union unid_t id;
+ struct unixid xid;
- if (!NT_STATUS_IS_OK(idmap_allocate_id(&id, ID_GROUPID))) {
+ if (!NT_STATUS_IS_OK(idmap_allocate_gid(&xid))) {
return WINBINDD_ERROR;
}
- state->response.data.gid = id.gid;
+ state->response.data.gid = xid.id;
return WINBINDD_OK;
}
+static void dump_maps_recv(void *private_data, BOOL success)
+{
+ struct winbindd_cli_state *state =
+ talloc_get_type_abort(private_data, struct winbindd_cli_state);
+
+ if (!success) {
+ DEBUG(5, ("Could not dump maps\n"));
+ request_error(state);
+ return;
+ }
+
+ request_ok(state);
+}
+
+void winbindd_dump_maps(struct winbindd_cli_state *state)
+{
+ if ( ! state->privileged) {
+ DEBUG(0, ("Only root is allowed to ask for an idmap dump!\n"));
+ request_error(state);
+ return;
+ }
+
+ DEBUG(3, ("[%5lu]: dump maps\n", (unsigned long)state->pid));
+
+ winbindd_dump_maps_async(state->mem_ctx,
+ state->request.extra_data.data,
+ state->request.extra_len,
+ dump_maps_recv, state);
+}
+
/* Resolve the uid number */
- if (!NT_STATUS_IS_OK(idmap_sid_to_uid(user_sid, &pw->pw_uid, 0))) {
+ if (!NT_STATUS_IS_OK(idmap_sid_to_uid(user_sid, &pw->pw_uid))) {
DEBUG(1, ("error getting user id for sid %s\n", sid_to_string(sid_string, user_sid)));
return False;
}
/* Resolve the gid number */
- if (!NT_STATUS_IS_OK(idmap_sid_to_gid(group_sid, &pw->pw_gid, 0))) {
+ if (!NT_STATUS_IS_OK(idmap_sid_to_gid(group_sid, &pw->pw_gid))) {
DEBUG(1, ("error getting group id for sid %s\n", sid_to_string(sid_string, group_sid)));
return False;
}
/* Return a password structure given a uid number */
void winbindd_getpwuid(struct winbindd_cli_state *state)
{
- DOM_SID user_sid;
- NTSTATUS status;
-
- /* Bug out if the uid isn't in the winbind range */
- if ((state->request.data.uid < server_state.uid_low ) ||
- (state->request.data.uid > server_state.uid_high)) {
- request_error(state);
- return;
- }
-
DEBUG(3, ("[%5lu]: getpwuid %lu\n", (unsigned long)state->pid,
(unsigned long)state->request.data.uid));
- status = idmap_uid_to_sid(&user_sid, state->request.data.uid,
- IDMAP_FLAG_QUERY_ONLY | IDMAP_FLAG_CACHE_ONLY);
-
- if (NT_STATUS_IS_OK(status)) {
- winbindd_getpwsid(state, &user_sid);
- return;
- }
-
- DEBUG(10,("Could not find SID for uid %lu in the cache. Querying idmap backend\n",
- (unsigned long)state->request.data.uid));
-
+ /* always query idmap via the async interface */
+ /* if this turns to be too slow we will add here a direct query to the cache */
winbindd_uid2sid_async(state->mem_ctx, state->request.data.uid, getpwuid_recv, state);
}
**/
BOOL winbindd_lookup_name_by_sid(TALLOC_CTX *mem_ctx,
DOM_SID *sid,
- fstring dom_name,
- fstring name,
+ char **dom_name,
+ char **name,
enum lsa_SidType *type)
{
- char *names;
- char *dom_names;
NTSTATUS result;
- BOOL rv = False;
struct winbindd_domain *domain;
domain = find_lookup_domain_from_sid(sid);
/* Lookup name */
- result = domain->methods->sid_to_name(domain, mem_ctx, sid, &dom_names, &names, type);
+ result = domain->methods->sid_to_name(domain, mem_ctx, sid, dom_name, name, type);
/* Return name and type if successful */
- if ((rv = NT_STATUS_IS_OK(result))) {
- fstrcpy(dom_name, dom_names);
- fstrcpy(name, names);
- } else {
- *type = SID_NAME_UNKNOWN;
- fstrcpy(name, name_deadbeef);
+ if (NT_STATUS_IS_OK(result)) {
+ return True;
}
+
+ *type = SID_NAME_UNKNOWN;
+ *name = talloc_strdup(mem_ctx, name_deadbeef);
- return rv;
+ return False;
}
/* Free state information held for {set,get,end}{pw,gr}ent() functions */
}
}
-/* Parse winbindd related parameters */
-
-BOOL winbindd_param_init(void)
-{
- /* Parse winbind uid and winbind_gid parameters */
-
- if (!lp_idmap_uid(&server_state.uid_low, &server_state.uid_high)) {
- DEBUG(0, ("winbindd: idmap uid range missing or invalid\n"));
- DEBUG(0, ("winbindd: cannot continue, exiting.\n"));
- return False;
- }
-
- if (!lp_idmap_gid(&server_state.gid_low, &server_state.gid_high)) {
- DEBUG(0, ("winbindd: idmap gid range missing or invalid\n"));
- DEBUG(0, ("winbindd: cannot continue, exiting.\n"));
- return False;
- }
-
- return True;
-}
-
-BOOL is_in_uid_range(uid_t uid)
-{
- return ((uid >= server_state.uid_low) &&
- (uid <= server_state.uid_high));
-}
-
-BOOL is_in_gid_range(gid_t gid)
-{
- return ((gid >= server_state.gid_low) &&
- (gid <= server_state.gid_high));
-}
-
/* Is this a domain which we may assume no DOMAIN\ prefix? */
static BOOL assume_domain(const char *domain)
return _num_clients;
}
-/*****************************************************************************
- For idmap conversion: convert one record to new format
- Ancient versions (eg 2.2.3a) of winbindd_idmap.tdb mapped DOMAINNAME/rid
- instead of the SID.
-*****************************************************************************/
-static int convert_fn(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA data, void *state)
-{
- struct winbindd_domain *domain;
- char *p;
- DOM_SID sid;
- uint32 rid;
- fstring keystr;
- fstring dom_name;
- TDB_DATA key2;
- BOOL *failed = (BOOL *)state;
-
- DEBUG(10,("Converting %s\n", key.dptr));
-
- p = strchr(key.dptr, '/');
- if (!p)
- return 0;
-
- *p = 0;
- fstrcpy(dom_name, key.dptr);
- *p++ = '/';
-
- domain = find_domain_from_name(dom_name);
- if (domain == NULL) {
- /* We must delete the old record. */
- DEBUG(0,("Unable to find domain %s\n", dom_name ));
- DEBUG(0,("deleting record %s\n", key.dptr ));
-
- if (tdb_delete(tdb, key) != 0) {
- DEBUG(0, ("Unable to delete record %s\n", key.dptr));
- *failed = True;
- return -1;
- }
-
- return 0;
- }
-
- rid = atoi(p);
-
- sid_copy(&sid, &domain->sid);
- sid_append_rid(&sid, rid);
-
- sid_to_string(keystr, &sid);
- key2.dptr = keystr;
- key2.dsize = strlen(keystr) + 1;
-
- if (tdb_store(tdb, key2, data, TDB_INSERT) != 0) {
- DEBUG(0,("Unable to add record %s\n", key2.dptr ));
- *failed = True;
- return -1;
- }
-
- if (tdb_store(tdb, data, key2, TDB_REPLACE) != 0) {
- DEBUG(0,("Unable to update record %s\n", data.dptr ));
- *failed = True;
- return -1;
- }
-
- if (tdb_delete(tdb, key) != 0) {
- DEBUG(0,("Unable to delete record %s\n", key.dptr ));
- *failed = True;
- return -1;
- }
-
- return 0;
-}
-
-/* These definitions are from sam/idmap_tdb.c. Replicated here just
- out of laziness.... :-( */
-
-/* High water mark keys */
-#define HWM_GROUP "GROUP HWM"
-#define HWM_USER "USER HWM"
-
-/*****************************************************************************
- Convert the idmap database from an older version.
-*****************************************************************************/
-
-static BOOL idmap_convert(const char *idmap_name)
-{
- int32 vers;
- BOOL bigendianheader;
- BOOL failed = False;
- TDB_CONTEXT *idmap_tdb;
-
- if (!(idmap_tdb = tdb_open_log(idmap_name, 0,
- TDB_DEFAULT, O_RDWR,
- 0600))) {
- DEBUG(0, ("idmap_convert: Unable to open idmap database\n"));
- return False;
- }
-
- bigendianheader = (tdb_get_flags(idmap_tdb) & TDB_BIGENDIAN) ? True : False;
-
- vers = tdb_fetch_int32(idmap_tdb, "IDMAP_VERSION");
-
- if (((vers == -1) && bigendianheader) || (IREV(vers) == IDMAP_VERSION)) {
- /* Arrggghh ! Bytereversed or old big-endian - make order independent ! */
- /*
- * high and low records were created on a
- * big endian machine and will need byte-reversing.
- */
-
- int32 wm;
-
- wm = tdb_fetch_int32(idmap_tdb, HWM_USER);
-
- if (wm != -1) {
- wm = IREV(wm);
- } else {
- wm = server_state.uid_low;
- }
-
- if (tdb_store_int32(idmap_tdb, HWM_USER, wm) == -1) {
- DEBUG(0, ("idmap_convert: Unable to byteswap user hwm in idmap database\n"));
- tdb_close(idmap_tdb);
- return False;
- }
-
- wm = tdb_fetch_int32(idmap_tdb, HWM_GROUP);
- if (wm != -1) {
- wm = IREV(wm);
- } else {
- wm = server_state.gid_low;
- }
-
- if (tdb_store_int32(idmap_tdb, HWM_GROUP, wm) == -1) {
- DEBUG(0, ("idmap_convert: Unable to byteswap group hwm in idmap database\n"));
- tdb_close(idmap_tdb);
- return False;
- }
- }
-
- /* the old format stored as DOMAIN/rid - now we store the SID direct */
- tdb_traverse(idmap_tdb, convert_fn, &failed);
-
- if (failed) {
- DEBUG(0, ("Problem during conversion\n"));
- tdb_close(idmap_tdb);
- return False;
- }
-
- if (tdb_store_int32(idmap_tdb, "IDMAP_VERSION", IDMAP_VERSION) == -1) {
- DEBUG(0, ("idmap_convert: Unable to dtore idmap version in databse\n"));
- tdb_close(idmap_tdb);
- return False;
- }
-
- tdb_close(idmap_tdb);
- return True;
-}
-
-/*****************************************************************************
- Convert the idmap database from an older version if necessary
-*****************************************************************************/
-
-BOOL winbindd_upgrade_idmap(void)
-{
- pstring idmap_name;
- pstring backup_name;
- SMB_STRUCT_STAT stbuf;
- TDB_CONTEXT *idmap_tdb;
-
- pstrcpy(idmap_name, lock_path("winbindd_idmap.tdb"));
-
- if (!file_exist(idmap_name, &stbuf)) {
- /* nothing to convert return */
- return True;
- }
-
- if (!(idmap_tdb = tdb_open_log(idmap_name, 0,
- TDB_DEFAULT, O_RDWR,
- 0600))) {
- DEBUG(0, ("idmap_convert: Unable to open idmap database\n"));
- return False;
- }
-
- if (tdb_fetch_int32(idmap_tdb, "IDMAP_VERSION") == IDMAP_VERSION) {
- /* nothing to convert return */
- tdb_close(idmap_tdb);
- return True;
- }
-
- /* backup_tdb expects the tdb not to be open */
- tdb_close(idmap_tdb);
-
- DEBUG(0, ("Upgrading winbindd_idmap.tdb from an old version\n"));
-
- pstrcpy(backup_name, idmap_name);
- pstrcat(backup_name, ".bak");
-
- if (backup_tdb(idmap_name, backup_name, 0) != 0) {
- DEBUG(0, ("Could not backup idmap database\n"));
- return False;
- }
-
- return idmap_convert(idmap_name);
-}
-
NTSTATUS lookup_usergroups_cached(struct winbindd_domain *domain,
TALLOC_CTX *mem_ctx,
const DOM_SID *user_sid,
BOOL bWinbindNestedGroups;
BOOL bWinbindRefreshTickets;
BOOL bWinbindOfflineLogon;
- char **szIdmapBackend;
+ char **szIdmapDomains;
+ char **szIdmapBackend; /* deprecated */
+ char **szIdmapAllocBackend;
char *szAddShareCommand;
char *szChangeShareCommand;
char *szDeleteShareCommand;
int client_signing;
int server_signing;
int iUsershareMaxShares;
+ int iIdmapExpireTime;
+ int iIdmapNegativeTime;
BOOL bResetOnZeroVC;
param_opt_struct *param_opt;
{N_("Winbind options"), P_SEP, P_SEPARATOR},
{"passdb expand explicit", P_BOOL, P_GLOBAL, &Globals.bPassdbExpandExplicit, NULL, NULL, FLAG_ADVANCED},
- {"idmap backend", P_LIST, P_GLOBAL, &Globals.szIdmapBackend, NULL, NULL, FLAG_ADVANCED},
- {"idmap uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED},
- {"winbind uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_HIDE},
- {"idmap gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED},
- {"winbind gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_HIDE},
+ {"idmap domains", P_LIST, P_GLOBAL, &Globals.szIdmapDomains, NULL, NULL, FLAG_ADVANCED},
+ {"idmap backend", P_LIST, P_GLOBAL, &Globals.szIdmapBackend, NULL, NULL, FLAG_ADVANCED | FLAG_DEPRECATED },
+ {"idmap alloc backend", P_STRING, P_GLOBAL, &Globals.szIdmapAllocBackend, NULL, NULL, FLAG_ADVANCED},
+ {"idmap expire time", P_INTEGER, P_GLOBAL, &Globals.iIdmapExpireTime, NULL, NULL, FLAG_ADVANCED},
+ {"idmap negative time", P_INTEGER, P_GLOBAL, &Globals.iIdmapNegativeTime, NULL, NULL, FLAG_ADVANCED},
+ {"idmap uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_ADVANCED | FLAG_DEPRECATED },
+ {"winbind uid", P_STRING, P_GLOBAL, &Globals.szIdmapUID, handle_idmap_uid, NULL, FLAG_HIDE | FLAG_DEPRECATED },
+ {"idmap gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_ADVANCED | FLAG_DEPRECATED },
+ {"winbind gid", P_STRING, P_GLOBAL, &Globals.szIdmapGID, handle_idmap_gid, NULL, FLAG_HIDE | FLAG_DEPRECATED },
{"template homedir", P_STRING, P_GLOBAL, &Globals.szTemplateHomedir, NULL, NULL, FLAG_ADVANCED},
{"template shell", P_STRING, P_GLOBAL, &Globals.szTemplateShell, NULL, NULL, FLAG_ADVANCED},
{"winbind separator", P_STRING, P_GLOBAL, &Globals.szWinbindSeparator, NULL, NULL, FLAG_ADVANCED},
Globals.bWinbindRefreshTickets = False;
Globals.bWinbindOfflineLogon = False;
+ Globals.iIdmapExpireTime = 900; /* 15 minutes by default */
+ Globals.iIdmapNegativeTime = 120; /* 2 minutes by default */
+
Globals.bPassdbExpandExplicit = False;
Globals.name_cache_timeout = 660; /* In seconds */
FN_GLOBAL_BOOL(lp_winbind_refresh_tickets, &Globals.bWinbindRefreshTickets)
FN_GLOBAL_BOOL(lp_winbind_offline_logon, &Globals.bWinbindOfflineLogon)
-FN_GLOBAL_LIST(lp_idmap_backend, &Globals.szIdmapBackend)
+FN_GLOBAL_LIST(lp_idmap_domains, &Globals.szIdmapDomains)
+FN_GLOBAL_LIST(lp_idmap_backend, &Globals.szIdmapBackend) /* deprecated */
+FN_GLOBAL_STRING(lp_idmap_alloc_backend, &Globals.szIdmapAllocBackend)
+FN_GLOBAL_INTEGER(lp_idmap_expire_time, &Globals.iIdmapExpireTime)
+FN_GLOBAL_INTEGER(lp_idmap_negative_time, &Globals.iIdmapNegativeTime)
FN_GLOBAL_BOOL(lp_passdb_expand_explicit, &Globals.bPassdbExpandExplicit)
FN_GLOBAL_STRING(lp_ldap_suffix, &Globals.szLdapSuffix)
}
/*****************************************************************
- *THE CANONICAL* convert uid_t to SID function.
+ *THE LEGACY* convert uid_t to SID function.
*****************************************************************/
-void uid_to_sid(DOM_SID *psid, uid_t uid)
+void legacy_uid_to_sid(DOM_SID *psid, uid_t uid)
{
- uid_t low, high;
uint32 rid;
BOOL ret;
ZERO_STRUCTP(psid);
- if (fetch_sid_from_uid_cache(psid, uid))
- return;
-
- if ((lp_winbind_trusted_domains_only() ||
- (lp_idmap_uid(&low, &high) && (uid >= low) && (uid <= high))) &&
- winbind_uid_to_sid(psid, uid)) {
-
- DEBUG(10,("uid_to_sid: winbindd %u -> %s\n",
- (unsigned int)uid, sid_string_static(psid)));
- goto done;
- }
-
become_root_uid_only();
ret = pdb_uid_to_rid(uid, &rid);
unbecome_root_uid_only();
uid_to_unix_users_sid(uid, psid);
done:
- DEBUG(10,("uid_to_sid: local %u -> %s\n", (unsigned int)uid,
+ DEBUG(10,("LEGACY: uid %u -> sid %s\n", (unsigned int)uid,
sid_string_static(psid)));
- store_uid_sid_cache(psid, uid);
return;
}
/*****************************************************************
- *THE CANONICAL* convert gid_t to SID function.
+ *THE LEGACY* convert gid_t to SID function.
*****************************************************************/
-void gid_to_sid(DOM_SID *psid, gid_t gid)
+void legacy_gid_to_sid(DOM_SID *psid, gid_t gid)
{
BOOL ret;
- gid_t low, high;
ZERO_STRUCTP(psid);
- if (fetch_sid_from_gid_cache(psid, gid))
- return;
-
- if ((lp_winbind_trusted_domains_only() ||
- (lp_idmap_gid(&low, &high) && (gid >= low) && (gid <= high))) &&
- winbind_gid_to_sid(psid, gid)) {
-
- DEBUG(10,("gid_to_sid: winbindd %u -> %s\n",
- (unsigned int)gid, sid_string_static(psid)));
- goto done;
- }
-
become_root_uid_only();
ret = pdb_gid_to_sid(gid, psid);
unbecome_root_uid_only();
gid_to_unix_groups_sid(gid, psid);
done:
- DEBUG(10,("gid_to_sid: local %u -> %s\n", (unsigned int)gid,
+ DEBUG(10,("LEGACY: gid %u -> sid %s\n", (unsigned int)gid,
sid_string_static(psid)));
- store_gid_sid_cache(psid, gid);
return;
}
/*****************************************************************
- *THE CANONICAL* convert SID to uid function.
+ *THE LEGACY* convert SID to uid function.
*****************************************************************/
-BOOL sid_to_uid(const DOM_SID *psid, uid_t *puid)
+BOOL legacy_sid_to_uid(const DOM_SID *psid, uid_t *puid)
{
enum lsa_SidType type;
uint32 rid;
- gid_t gid;
-
- if (fetch_uid_from_cache(puid, psid))
- return True;
-
- if (fetch_gid_from_cache(&gid, psid)) {
- return False;
- }
if (sid_peek_check_rid(&global_sid_Unix_Users, psid, &rid)) {
uid_t uid = rid;
return False;
}
- if (winbind_lookup_sid(NULL, psid, NULL, NULL, &type)) {
-
- if (type != SID_NAME_USER) {
- DEBUG(10, ("sid_to_uid: sid %s is a %s\n",
- sid_string_static(psid),
- sid_type_lookup(type)));
- return False;
- }
-
- if (!winbind_sid_to_uid(puid, psid)) {
- DEBUG(5, ("sid_to_uid: winbind failed to allocate a "
- "new uid for sid %s\n",
- sid_string_static(psid)));
- return False;
- }
- goto done;
- }
-
- /* TODO: Here would be the place to allocate both a gid and a uid for
- * the SID in question */
-
return False;
done:
- DEBUG(10,("sid_to_uid: %s -> %u\n", sid_string_static(psid),
+ DEBUG(10,("LEGACY: sid %s -> uid %u\n", sid_string_static(psid),
(unsigned int)*puid ));
- store_uid_sid_cache(psid, *puid);
return True;
}
/*****************************************************************
- *THE CANONICAL* convert SID to gid function.
+ *THE LEGACY* convert SID to gid function.
Group mapping is used for gids that maps to Wellknown SIDs
*****************************************************************/
-BOOL sid_to_gid(const DOM_SID *psid, gid_t *pgid)
+BOOL legacy_sid_to_gid(const DOM_SID *psid, gid_t *pgid)
{
uint32 rid;
GROUP_MAP map;
union unid_t id;
enum lsa_SidType type;
- uid_t uid;
-
- if (fetch_gid_from_cache(pgid, psid))
- return True;
-
- if (fetch_uid_from_cache(&uid, psid))
- return False;
if (sid_peek_check_rid(&global_sid_Unix_Groups, psid, &rid)) {
gid_t gid = rid;
return False;
}
- if (!winbind_lookup_sid(NULL, psid, NULL, NULL, &type)) {
- DEBUG(11,("sid_to_gid: no one knows the SID %s (tried local, "
- "then winbind)\n", sid_string_static(psid)));
-
+ done:
+ DEBUG(10,("LEGACY: sid %s -> gid %u\n", sid_string_static(psid),
+ (unsigned int)*pgid ));
+
+ return True;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert uid_t to SID function.
+*****************************************************************/
+
+void uid_to_sid(DOM_SID *psid, uid_t uid)
+{
+ ZERO_STRUCTP(psid);
+
+ if (fetch_sid_from_uid_cache(psid, uid))
+ return;
+
+ if (!winbind_uid_to_sid(psid, uid)) {
+ if (!winbind_ping()) {
+ DEBUG(2, ("WARNING: Winbindd not running, mapping ids with legacy code"));
+ return legacy_uid_to_sid(psid, uid);
+ }
+
+ DEBUG(5, ("uid_to_sid: winbind failed to find a sid for uid %u\n",
+ uid));
+ return;
+ }
+
+ DEBUG(10,("uid %u -> sid %s\n",
+ (unsigned int)uid, sid_string_static(psid)));
+
+ store_uid_sid_cache(psid, uid);
+ return;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert gid_t to SID function.
+*****************************************************************/
+
+void gid_to_sid(DOM_SID *psid, gid_t gid)
+{
+ ZERO_STRUCTP(psid);
+
+ if (fetch_sid_from_gid_cache(psid, gid))
+ return;
+
+ if (!winbind_gid_to_sid(psid, gid)) {
+ if (!winbind_ping()) {
+ DEBUG(2, ("WARNING: Winbindd not running, mapping ids with legacy code"));
+ return legacy_gid_to_sid(psid, gid);
+ }
+
+ DEBUG(5, ("gid_to_sid: winbind failed to find a sid for gid %u\n",
+ gid));
+ return;
+ }
+
+ DEBUG(10,("gid %u -> sid %s\n",
+ (unsigned int)gid, sid_string_static(psid)));
+
+ store_gid_sid_cache(psid, gid);
+ return;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert SID to uid function.
+*****************************************************************/
+
+BOOL sid_to_uid(const DOM_SID *psid, uid_t *puid)
+{
+ gid_t gid;
+
+ if (fetch_uid_from_cache(puid, psid))
+ return True;
+
+ if (fetch_gid_from_cache(&gid, psid)) {
return False;
}
- /* winbindd knows it; Ensure this is a group sid */
+ if (!winbind_sid_to_uid(puid, psid)) {
+ if (!winbind_ping()) {
+ DEBUG(2, ("WARNING: Winbindd not running, mapping ids with legacy code"));
+ return legacy_sid_to_uid(psid, puid);
+ }
- if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
- (type != SID_NAME_WKN_GRP)) {
- DEBUG(10,("sid_to_gid: winbind lookup succeeded but SID is "
- "a %s\n", sid_type_lookup(type)));
+ DEBUG(5, ("winbind failed to find a uid for sid %s\n",
+ sid_string_static(psid)));
return False;
}
-
- /* winbindd knows it and it is a type of group; sid_to_gid must succeed
- or we are dead in the water */
+
+ /* TODO: Here would be the place to allocate both a gid and a uid for
+ * the SID in question */
+
+ DEBUG(10,("sid %s -> uid %u\n", sid_string_static(psid),
+ (unsigned int)*puid ));
+
+ store_uid_sid_cache(psid, *puid);
+ return True;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert SID to gid function.
+ Group mapping is used for gids that maps to Wellknown SIDs
+*****************************************************************/
+
+BOOL sid_to_gid(const DOM_SID *psid, gid_t *pgid)
+{
+ uid_t uid;
+
+ if (fetch_gid_from_cache(pgid, psid))
+ return True;
+
+ if (fetch_uid_from_cache(&uid, psid))
+ return False;
+
+ /* Ask winbindd if it can map this sid to a gid.
+ * (Idmap will check it is a valid SID and of the right type) */
if ( !winbind_sid_to_gid(pgid, psid) ) {
- DEBUG(10,("sid_to_gid: winbind failed to allocate a new gid "
- "for sid %s\n", sid_string_static(psid)));
+ if (!winbind_ping()) {
+ DEBUG(2, ("WARNING: Winbindd not running, mapping ids with legacy code"));
+ return legacy_sid_to_uid(psid, pgid);
+ }
+
+ DEBUG(10,("winbind failed to find a gid for sid %s\n",
+ sid_string_static(psid)));
return False;
}
- done:
- DEBUG(10,("sid_to_gid: %s -> %u\n", sid_string_static(psid),
+ DEBUG(10,("sid %s -> gid %u\n", sid_string_static(psid),
(unsigned int)*pgid ));
store_gid_sid_cache(psid, *pgid);
return pdb->uid_to_rid(pdb, uid, rid);
}
+BOOL pdb_uid_to_sid(uid_t uid, DOM_SID *sid)
+{
+ struct pdb_methods *pdb = pdb_get_methods();
+ return pdb->uid_to_sid(pdb, uid, sid);
+}
+
BOOL pdb_gid_to_sid(gid_t gid, DOM_SID *sid)
{
struct pdb_methods *pdb = pdb_get_methods();
return NT_STATUS_OK;
}
-static BOOL pdb_default_uid_to_rid(struct pdb_methods *methods, uid_t uid,
- uint32 *rid)
+static BOOL pdb_default_uid_to_sid(struct pdb_methods *methods, uid_t uid,
+ DOM_SID *sid)
{
struct samu *sampw = NULL;
struct passwd *unix_pw;
return False;
}
- ret = sid_peek_check_rid(get_global_sam_sid(),
- pdb_get_user_sid(sampw), rid);
+ sid_copy(sid, pdb_get_user_sid(sampw));
+
+ TALLOC_FREE(sampw);
+
+ return True;
+}
+
+static BOOL pdb_default_uid_to_rid(struct pdb_methods *methods, uid_t uid,
+ uint32 *rid)
+{
+ DOM_SID sid;
+ BOOL ret;
+
+ ret = pdb_default_uid_to_sid(methods, uid, &sid);
+ if (!ret) {
+ return ret;
+ }
+
+ ret = sid_peek_check_rid(get_global_sam_sid(), &sid, rid);
if (!ret) {
DEBUG(1, ("Could not peek rid out of sid %s\n",
- sid_string_static(pdb_get_user_sid(sampw))));
+ sid_string_static(&sid)));
}
- TALLOC_FREE(sampw);
return ret;
}
(*methods)->set_account_policy = pdb_default_set_account_policy;
(*methods)->get_seq_num = pdb_default_get_seq_num;
(*methods)->uid_to_rid = pdb_default_uid_to_rid;
+ (*methods)->uid_to_sid = pdb_default_uid_to_sid;
(*methods)->gid_to_sid = pdb_default_gid_to_sid;
(*methods)->sid_to_id = pdb_default_sid_to_id;
return True;
}
+
+BOOL secrets_store_generic(const char *owner, const char *key, const char *secret)
+{
+ char *tdbkey = NULL;
+ BOOL ret;
+
+ if (asprintf(&tdbkey, "SECRETS/GENERIC/%s/%s", owner, key) < 0) {
+ DEBUG(0, ("asprintf failed!\n"));
+ return False;
+ }
+
+ ret = secrets_store(tdbkey, secret, strlen(secret)+1);
+
+ SAFE_FREE(tdbkey);
+ return ret;
+}
+
+/*******************************************************************
+ Find the ldap password.
+******************************************************************/
+
+char *secrets_fetch_generic(const char *owner, const char *key)
+{
+ char *secret = NULL;
+ char *tdbkey = NULL;
+
+ if (( ! owner) || ( ! key)) {
+ DEBUG(1, ("Invalid Paramters"));
+ return NULL;
+ }
+
+ if (asprintf(&tdbkey, "SECRETS/GENERIC/%s/%s", owner, key) < 0) {
+ DEBUG(0, ("Out of memory!\n"));
+ return NULL;
+ }
+
+ secret = (char *)secrets_fetch(tdbkey, NULL);
+ SAFE_FREE(tdbkey);
+
+ return secret;
+}
+
+++ /dev/null
-/*
- Unix SMB/CIFS implementation.
- ID Mapping
- Copyright (C) Tim Potter 2000
- Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
- Copyright (C) Simo Sorce 2003
- Copyright (C) Jeremy Allison 2006
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/
-
-#include "includes.h"
-
-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_IDMAP
-
-static_decl_idmap;
-
-struct idmap_function_entry {
- const char *name;
- struct idmap_methods *methods;
- struct idmap_function_entry *prev,*next;
-};
-
-static struct idmap_function_entry *backends = NULL;
-
-static struct idmap_methods *cache_map;
-static struct idmap_methods *remote_map;
-
-static BOOL proxyonly = False;
-
-/**********************************************************************
- Get idmap methods. Don't allow tdb to be a remote method.
-**********************************************************************/
-
-static struct idmap_methods *get_methods(const char *name, BOOL cache_method)
-{
- struct idmap_function_entry *entry = backends;
-
- for(entry = backends; entry; entry = entry->next) {
- if (!cache_method && strequal(entry->name, "tdb"))
- continue; /* tdb is only cache method. */
- if (strequal(entry->name, name))
- return entry->methods;
- }
-
- return NULL;
-}
-
-/**********************************************************************
- Allow a module to register itself as a method.
-**********************************************************************/
-
-NTSTATUS smb_register_idmap(int version, const char *name, struct idmap_methods *methods)
-{
- struct idmap_function_entry *entry;
-
- if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
- DEBUG(0, ("smb_register_idmap: Failed to register idmap module.\n"
- "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
- "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
- "Please recompile against the current version of samba!\n",
- version, SMB_IDMAP_INTERFACE_VERSION));
- return NT_STATUS_OBJECT_TYPE_MISMATCH;
- }
-
- if (!name || !name[0] || !methods) {
- DEBUG(0,("smb_register_idmap: called with NULL pointer or empty name!\n"));
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- if (get_methods(name, False)) {
- DEBUG(0,("smb_register_idmap: idmap module %s already registered!\n", name));
- return NT_STATUS_OBJECT_NAME_COLLISION;
- }
-
- entry = SMB_XMALLOC_P(struct idmap_function_entry);
- entry->name = smb_xstrdup(name);
- entry->methods = methods;
-
- DLIST_ADD(backends, entry);
- DEBUG(5, ("smb_register_idmap: Successfully added idmap backend '%s'\n", name));
- return NT_STATUS_OK;
-}
-
-/**********************************************************************
- Initialise idmap cache and a remote backend (if configured).
-**********************************************************************/
-
-BOOL idmap_init(const char **remote_backend)
-{
- if (!backends)
- static_init_idmap;
-
- if (!cache_map) {
- cache_map = get_methods("tdb", True);
-
- if (!cache_map) {
- DEBUG(0, ("idmap_init: could not find tdb cache backend!\n"));
- return False;
- }
-
- if (!NT_STATUS_IS_OK(cache_map->init( NULL ))) {
- DEBUG(0, ("idmap_init: could not initialise tdb cache backend!\n"));
- return False;
- }
- }
-
- if ((remote_map == NULL) && (remote_backend != NULL) &&
- (*remote_backend != NULL) && (**remote_backend != '\0')) {
- char *rem_backend = smb_xstrdup(*remote_backend);
- fstring params = "";
- char *pparams;
- BOOL idmap_prefix_workaround = False;
-
- /* get any mode parameters passed in */
-
- if ( (pparams = strchr( rem_backend, ':' )) != NULL ) {
- *pparams = '\0';
- pparams++;
- fstrcpy( params, pparams );
- }
-
- /* strip any leading idmap_ prefix of */
- if ( strncmp( rem_backend, "idmap_", 6) == 0 ) {
- rem_backend += 6;
- idmap_prefix_workaround = True;
- DEBUG(0, ("idmap_init: idmap backend uses deprecated 'idmap_' prefix. Please replace 'idmap_%s' by '%s' in %s\n", rem_backend, rem_backend, dyn_CONFIGFILE));
- }
-
- DEBUG(3, ("idmap_init: using '%s' as remote backend\n", rem_backend));
-
- if((remote_map = get_methods(rem_backend, False)) ||
- (NT_STATUS_IS_OK(smb_probe_module("idmap", rem_backend)) &&
- (remote_map = get_methods(rem_backend, False)))) {
- if (!NT_STATUS_IS_OK(remote_map->init(params))) {
- DEBUG(0, ("idmap_init: failed to initialize remote backend!\n"));
- return False;
- }
- } else {
- DEBUG(0, ("idmap_init: could not load remote backend '%s'\n", rem_backend));
- if (idmap_prefix_workaround)
- rem_backend -= 6;
- SAFE_FREE(rem_backend);
- return False;
- }
- if (idmap_prefix_workaround)
- rem_backend -= 6;
- SAFE_FREE(rem_backend);
- }
-
- return True;
-}
-
-/**************************************************************************
- Don't do id mapping. This is used to make winbind a netlogon proxy only.
-**************************************************************************/
-
-void idmap_set_proxyonly(void)
-{
- proxyonly = True;
-}
-
-BOOL idmap_proxyonly(void)
-{
- return proxyonly;
-}
-
-/**************************************************************************
- This is a rare operation, designed to allow an explicit mapping to be
- set up for a sid to a POSIX id.
-**************************************************************************/
-
-NTSTATUS idmap_set_mapping(const DOM_SID *sid, unid_t id, enum idmap_type id_type)
-{
- struct idmap_methods *map = remote_map;
- DOM_SID tmp_sid;
-
- if (proxyonly) {
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if (sid_check_is_in_our_domain(sid)) {
- DEBUG(3, ("Refusing to add SID %s to idmap, it's our own "
- "domain\n", sid_string_static(sid)));
- return NT_STATUS_ACCESS_DENIED;
- }
-
- if (sid_check_is_in_builtin(sid)) {
- DEBUG(3, ("Refusing to add SID %s to idmap, it's our builtin "
- "domain\n", sid_string_static(sid)));
- return NT_STATUS_ACCESS_DENIED;
- }
-
- DEBUG(10, ("idmap_set_mapping: Set %s to %s %lu\n",
- sid_string_static(sid),
- (id_type == ID_USERID) ? "UID" : "GID",
- (id_type == ID_USERID) ? (unsigned long)id.uid :
- (unsigned long)id.gid));
-
- if ( (NT_STATUS_IS_OK(cache_map->get_sid_from_id(&tmp_sid, id, id_type, IDMAP_FLAG_QUERY_ONLY))) &&
- sid_equal(sid, &tmp_sid) ) {
- /* Nothing to do, we already have that mapping */
- DEBUG(10, ("idmap_set_mapping: Mapping already there\n"));
- return NT_STATUS_OK;
- }
-
- if (map == NULL) {
- /* Ok, we don't have a authoritative remote
- mapping. So update our local cache only. */
- map = cache_map;
- }
-
- return map->set_mapping(sid, id, id_type);
-}
-
-/**************************************************************************
- Get ID from SID. This can create a mapping for a SID to a POSIX id.
-**************************************************************************/
-
-NTSTATUS idmap_get_id_from_sid(unid_t *id, enum idmap_type *id_type, const DOM_SID *sid, int flags)
-{
- NTSTATUS ret;
- int cache_flags = flags;
-
- if (proxyonly) {
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if (sid_check_is_in_our_domain(sid)) {
- DEBUG(9, ("sid %s is in our domain -- go look in passdb\n",
- sid_string_static(sid)));
- return NT_STATUS_NONE_MAPPED;
- }
-
- if (sid_check_is_in_builtin(sid)) {
- DEBUG(9, ("sid %s is in builtin domain -- go look in passdb\n",
- sid_string_static(sid)));
- return NT_STATUS_NONE_MAPPED;
- }
-
- if (remote_map) {
- /* We have a central remote idmap so only look in
- cache, ensure we don't allocate */
- cache_flags |= IDMAP_FLAG_QUERY_ONLY;
- }
-
- ret = cache_map->get_id_from_sid(id, id_type, sid, cache_flags);
- if (NT_STATUS_IS_OK(ret)) {
- return NT_STATUS_OK;
- }
-
- if ((remote_map == NULL) || (flags & IDMAP_FLAG_CACHE_ONLY)) {
- return ret;
- }
-
- /* Ok, the mapping was not in the cache, give the remote map a try. */
-
- ret = remote_map->get_id_from_sid(id, id_type, sid, flags);
-
- if (NT_STATUS_IS_OK(ret)) {
- /* The remote backend gave us a valid mapping, cache it. */
- ret = cache_map->set_mapping(sid, *id, *id_type);
- }
-
- return ret;
-}
-
-/**************************************************************************
- Get SID from ID. This must have been created before.
-**************************************************************************/
-
-NTSTATUS idmap_get_sid_from_id(DOM_SID *sid, unid_t id, enum idmap_type id_type, int flags)
-{
- NTSTATUS ret;
- int cache_flags = flags;
-
- if (proxyonly) {
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if (remote_map) {
- /* We have a central remote idmap so only look in
- cache, ensure we don't allocate */
- cache_flags |= IDMAP_FLAG_QUERY_ONLY;
- }
-
- ret = cache_map->get_sid_from_id(sid, id, id_type, cache_flags);
-
- if (NT_STATUS_IS_OK(ret)) {
- return ret;
- }
-
- if ((remote_map == NULL) || (flags & IDMAP_FLAG_CACHE_ONLY)) {
- return ret;
- }
-
- /* Not in cache, ask our authoritative backend */
-
- ret = remote_map->get_sid_from_id(sid, id, id_type, flags);
-
- if (NT_STATUS_IS_OK(ret)) {
- /* The remote backend gave us a valid mapping, cache it. */
- ret = cache_map->set_mapping(sid, id, id_type);
- }
-
- return ret;
-}
-
-/**************************************************************************
- Alloocate a new UNIX uid/gid
-**************************************************************************/
-
-NTSTATUS idmap_allocate_id(unid_t *id, enum idmap_type id_type)
-{
- /* we have to allocate from the authoritative backend */
-
- if (proxyonly) {
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if ( remote_map ) {
- return remote_map->allocate_id( id, id_type );
- }
-
- return cache_map->allocate_id( id, id_type );
-}
-
-/**************************************************************************
- Shutdown maps.
-**************************************************************************/
-
-NTSTATUS idmap_close(void)
-{
- NTSTATUS ret;
-
- if (proxyonly) {
- return NT_STATUS_OK;
- }
-
- ret = cache_map->close_fn();
- if (!NT_STATUS_IS_OK(ret)) {
- DEBUG(3, ("idmap_close: failed to close local tdb cache!\n"));
- }
- cache_map = NULL;
-
- if (remote_map) {
- ret = remote_map->close_fn();
- if (!NT_STATUS_IS_OK(ret)) {
- DEBUG(3, ("idmap_close: failed to close remote idmap repository!\n"));
- }
- remote_map = NULL;
- }
-
- return ret;
-}
-
-/**************************************************************************
- Dump backend status.
-**************************************************************************/
-
-void idmap_status(void)
-{
- cache_map->status();
- if (remote_map) {
- remote_map->status();
- }
-}
+++ /dev/null
-/*
- * idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
- *
- * Unix SMB/CIFS implementation.
- *
- * Winbind ADS backend functions
- *
- * Copyright (C) Andrew Tridgell 2001
- * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
- * Copyright (C) Gerald (Jerry) Carter 2004
- * Copyright (C) Luke Howard 2001-2004
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#include "includes.h"
-
-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_IDMAP
-
-#define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
-
-NTSTATUS init_module(void);
-
-static ADS_STRUCT *ad_idmap_ads = NULL;
-
-static char *attr_uidnumber = NULL;
-static char *attr_gidnumber = NULL;
-
-static ADS_STATUS ad_idmap_check_attr_mapping(ADS_STRUCT *ads)
-{
- ADS_STATUS status;
- enum wb_posix_mapping map_type;
-
- if (attr_uidnumber != NULL && attr_gidnumber != NULL) {
- return ADS_ERROR(LDAP_SUCCESS);
- }
-
- SMB_ASSERT(ads->server.workgroup);
-
- map_type = get_nss_info(ads->server.workgroup);
-
- if ((map_type == WB_POSIX_MAP_SFU) ||
- (map_type == WB_POSIX_MAP_RFC2307)) {
-
- status = ads_check_posix_schema_mapping(ads, map_type);
- if (ADS_ERR_OK(status)) {
- attr_uidnumber = SMB_STRDUP(ads->schema.posix_uidnumber_attr);
- attr_gidnumber = SMB_STRDUP(ads->schema.posix_gidnumber_attr);
- ADS_ERROR_HAVE_NO_MEMORY(attr_uidnumber);
- ADS_ERROR_HAVE_NO_MEMORY(attr_gidnumber);
- return ADS_ERROR(LDAP_SUCCESS);
- } else {
- DEBUG(0,("ads_check_posix_schema_mapping failed: %s\n", ads_errstr(status)));
- /* return status; */
- }
- }
-
- /* fallback to XAD defaults */
- attr_uidnumber = SMB_STRDUP("uidNumber");
- attr_gidnumber = SMB_STRDUP("gidNumber");
- ADS_ERROR_HAVE_NO_MEMORY(attr_uidnumber);
- ADS_ERROR_HAVE_NO_MEMORY(attr_gidnumber);
-
- return ADS_ERROR(LDAP_SUCCESS);
-}
-
-static ADS_STRUCT *ad_idmap_cached_connection(void)
-{
- ADS_STRUCT *ads;
- ADS_STATUS status;
- BOOL local = False;
-
- if (ad_idmap_ads != NULL) {
- ads = ad_idmap_ads;
-
- /* check for a valid structure */
-
- DEBUG(7, ("Current tickets expire at %d, time is now %d\n",
- (uint32) ads->auth.expire, (uint32) time(NULL)));
- if ( ads->config.realm && (ads->auth.expire > time(NULL))) {
- return ads;
- } else {
- /* we own this ADS_STRUCT so make sure it goes away */
- ads->is_mine = True;
- ads_destroy( &ads );
- ads_kdestroy(WINBIND_CCACHE_NAME);
- ad_idmap_ads = NULL;
- }
- }
-
- if (!local) {
- /* we don't want this to affect the users ccache */
- setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
- }
-
- ads = ads_init(lp_realm(), lp_workgroup(), NULL);
- if (!ads) {
- DEBUG(1,("ads_init failed\n"));
- return NULL;
- }
-
- /* the machine acct password might have change - fetch it every time */
- SAFE_FREE(ads->auth.password);
- ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
-
- SAFE_FREE(ads->auth.realm);
- ads->auth.realm = SMB_STRDUP(lp_realm());
-
- status = ads_connect(ads);
- if (!ADS_ERR_OK(status)) {
- DEBUG(1, ("ad_idmap_init: failed to connect to AD\n"));
- ads_destroy(&ads);
- return NULL;
- }
-
- ads->is_mine = False;
-
- status = ad_idmap_check_attr_mapping(ads);
- if (!ADS_ERR_OK(status)) {
- DEBUG(1, ("ad_idmap_init: failed to check attribute mapping\n"));
- return NULL;
- }
-
- ad_idmap_ads = ads;
- return ads;
-}
-
-/* no op */
-static NTSTATUS ad_idmap_init(const char *uri)
-{
- return NT_STATUS_OK;
-}
-
-static NTSTATUS ad_idmap_get_sid_from_id(DOM_SID *sid, unid_t unid, enum idmap_type id_type, int flags)
-{
- ADS_STATUS rc;
- NTSTATUS status = NT_STATUS_NONE_MAPPED;
- const char *attrs[] = { "objectSid", NULL };
- LDAPMessage *res = NULL;
- LDAPMessage *msg = NULL;
- char *expr = NULL;
- fstring sid_string;
- int count;
- ADS_STRUCT *ads;
-
- if (sid == NULL) {
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- ads = ad_idmap_cached_connection();
- if (ads == NULL) {
- DEBUG(1, ("ad_idmap_get_id_from_sid ADS uninitialized\n"));
- return NT_STATUS_NOT_SUPPORTED;
- }
-
- switch (id_type) {
- case ID_USERID:
- if (asprintf(&expr, "(&(|(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d))(%s=%d))",
- ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
- ads->schema.posix_uidnumber_attr, (int)unid.uid) == -1) {
- return NT_STATUS_NO_MEMORY;
- }
- break;
- case ID_GROUPID:
- if (asprintf(&expr, "(&(|(sAMAccountType=%d)(sAMAccountType=%d))(%s=%d))",
- ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP,
- ads->schema.posix_gidnumber_attr, (int)unid.gid) == -1) {
- return NT_STATUS_NO_MEMORY;
- }
- break;
- default:
- return NT_STATUS_INVALID_PARAMETER;
- break;
- }
-
- rc = ads_search_retry(ads, &res, expr, attrs);
- free(expr);
- if (!ADS_ERR_OK(rc)) {
- DEBUG(1, ("ad_idmap_get_sid_from_id: ads_search: %s\n", ads_errstr(rc)));
- goto done;
- }
-
- count = ads_count_replies(ads, res);
- if (count == 0) {
- DEBUG(1, ("ad_idmap_get_sid_from_id: ads_count_replies: no results\n"));
- goto done;
- } else if (count != 1) {
- DEBUG(1, ("ad_idmap_get_sid_from_id: ads_count_replies: incorrect cardinality\n"));
- goto done;
- }
-
- msg = ads_first_entry(ads, res);
- if (msg == NULL) {
- DEBUG(1, ("ad_idmap_get_sid_from_id: ads_first_entry: could not retrieve search result\n"));
- goto done;
- }
-
- if (!ads_pull_sid(ads, msg, "objectSid", sid)) {
- DEBUG(1, ("ad_idmap_get_sid_from_id: ads_pull_sid: could not retrieve SID from entry\n"));
- goto done;
- }
-
- status = NT_STATUS_OK;
- DEBUG(1, ("ad_idmap_get_sid_from_id mapped POSIX %s %d to SID [%s]\n",
- (id_type == ID_GROUPID) ? "GID" : "UID", (int)unid.uid,
- sid_to_string(sid_string, sid)));
-
-done:
- if (res != NULL) {
- ads_msgfree(ads, res);
- }
-
- return status;
-}
-
-static NTSTATUS ad_idmap_get_id_from_sid(unid_t *unid, enum idmap_type *id_type, const DOM_SID *sid, int flags)
-{
- ADS_STATUS rc;
- NTSTATUS status = NT_STATUS_NONE_MAPPED;
- const char *attrs[] = { "sAMAccountType", ADS_ATTR_SFU_UIDNUMBER_OID,
- ADS_ATTR_SFU_GIDNUMBER_OID,
- ADS_ATTR_RFC2307_UIDNUMBER_OID,
- ADS_ATTR_RFC2307_GIDNUMBER_OID,
- NULL };
- LDAPMessage *res = NULL;
- LDAPMessage *msg = NULL;
- char *expr = NULL;
- uint32 atype, uid;
- char *sidstr;
- fstring sid_string;
- int count;
- ADS_STRUCT *ads;
-
- if (unid == NULL) {
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- ads = ad_idmap_cached_connection();
- if (ads == NULL) {
- DEBUG(1, ("ad_idmap_get_id_from_sid ADS uninitialized\n"));
- return NT_STATUS_NOT_SUPPORTED;
- }
-
- sidstr = sid_binstring(sid);
- if (asprintf(&expr, "(objectSid=%s)", sidstr) == -1) {
- free(sidstr);
- return NT_STATUS_NO_MEMORY;
- }
-
- rc = ads_search_retry(ads, &res, expr, attrs);
- free(sidstr);
- free(expr);
- if (!ADS_ERR_OK(rc)) {
- DEBUG(1, ("ad_idmap_get_id_from_sid: ads_search: %s\n", ads_errstr(rc)));
- goto done;
- }
-
- count = ads_count_replies(ads, res);
- if (count == 0) {
- DEBUG(1, ("ad_idmap_get_id_from_sid: ads_count_replies: no results\n"));
- goto done;
- } else if (count != 1) {
- DEBUG(1, ("ad_idmap_get_id_from_sid: ads_count_replies: incorrect cardinality\n"));
- goto done;
- }
-
- msg = ads_first_entry(ads, res);
- if (msg == NULL) {
- DEBUG(1, ("ad_idmap_get_id_from_sid: ads_first_entry: could not retrieve search result\n"));
- goto done;
- }
-
- if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype)) {
- DEBUG(1, ("ad_idmap_get_id_from_sid: ads_pull_uint32: could not read SAM account type\n"));
- goto done;
- }
-
- switch (atype & 0xF0000000) {
- case ATYPE_SECURITY_GLOBAL_GROUP:
- case ATYPE_SECURITY_LOCAL_GROUP:
- *id_type = ID_GROUPID;
- break;
- case ATYPE_NORMAL_ACCOUNT:
- case ATYPE_WORKSTATION_TRUST:
- case ATYPE_INTERDOMAIN_TRUST:
- *id_type = ID_USERID;
- break;
- default:
- DEBUG(1, ("ad_idmap_get_id_from_sid: unrecognized SAM account type %08x\n", atype));
- goto done;
- break;
- }
-
- if (!ads_pull_uint32(ads, msg, (*id_type == ID_GROUPID) ? attr_gidnumber : attr_uidnumber, &uid)) {
- DEBUG(1, ("ad_idmap_get_id_from_sid: ads_pull_uint32: could not read attribute '%s'\n",
- (*id_type == ID_GROUPID) ? attr_gidnumber : attr_uidnumber));
- goto done;
- }
-
- unid->uid = (uid_t)uid;
-
- status = NT_STATUS_OK;
- DEBUG(1, ("ad_idmap_get_id_from_sid mapped SID [%s] to POSIX %s %d\n",
- sid_to_string(sid_string, sid),
- (*id_type == ID_GROUPID) ? "GID" : "UID", uid));
-
-done:
- if (res != NULL) {
- ads_msgfree(ads, res);
- }
-
- return status;
-
-}
-
-static NTSTATUS ad_idmap_set_mapping(const DOM_SID *sid, unid_t id, enum idmap_type id_type)
-{
- /* Not supported, and probably won't be... */
- /* (It's not particularly feasible with a single-master model.) */
-
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-static NTSTATUS ad_idmap_close(void)
-{
- ADS_STRUCT *ads = ad_idmap_ads;
-
- if (ads != NULL) {
- /* we own this ADS_STRUCT so make sure it goes away */
- ads->is_mine = True;
- ads_destroy( &ads );
- ad_idmap_ads = NULL;
- }
-
- SAFE_FREE(attr_uidnumber);
- SAFE_FREE(attr_gidnumber);
-
- return NT_STATUS_OK;
-}
-
-static NTSTATUS ad_idmap_allocate_id(unid_t *id, enum idmap_type id_type)
-{
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-static void ad_idmap_status(void)
-{
- DEBUG(0, ("AD IDMAP Status not available\n"));
-}
-
-static struct idmap_methods ad_methods = {
- ad_idmap_init,
- ad_idmap_allocate_id,
- ad_idmap_get_sid_from_id,
- ad_idmap_get_id_from_sid,
- ad_idmap_set_mapping,
- ad_idmap_close,
- ad_idmap_status
-};
-
-
-/* support for new authentication subsystem */
-NTSTATUS idmap_ad_init(void)
-{
- return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ad", &ad_methods);
-}
-
+++ /dev/null
-/*
- Unix SMB/CIFS implementation.
-
- idmap LDAP backend
-
- Copyright (C) Tim Potter 2000
- Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
- Copyright (C) Simo Sorce 2003
- Copyright (C) Gerald Carter 2003
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "includes.h"
-
-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_IDMAP
-
-
-#include <lber.h>
-#include <ldap.h>
-
-#include "smbldap.h"
-
-struct ldap_idmap_state {
- struct smbldap_state *smbldap_state;
- TALLOC_CTX *mem_ctx;
-};
-
-static struct ldap_idmap_state ldap_state;
-
-/* number tries while allocating new id */
-#define LDAP_MAX_ALLOC_ID 128
-
-
-/***********************************************************************
- This function cannot be called to modify a mapping, only set a new one
-***********************************************************************/
-
-static NTSTATUS ldap_set_mapping(const DOM_SID *sid, unid_t id, enum idmap_type id_type)
-{
- pstring dn;
- pstring id_str;
- fstring type;
- LDAPMod **mods = NULL;
- int rc = -1;
- int ldap_op;
- fstring sid_string;
- LDAPMessage *entry = NULL;
-
- sid_to_string( sid_string, sid );
-
- ldap_op = LDAP_MOD_ADD;
- pstr_sprintf(dn, "%s=%s,%s", get_attr_key2string( sidmap_attr_list, LDAP_ATTR_SID),
- sid_string, lp_ldap_idmap_suffix());
-
- if ( id_type == ID_USERID ) {
- fstrcpy( type, get_attr_key2string( sidmap_attr_list, LDAP_ATTR_UIDNUMBER ) );
- } else {
- fstrcpy( type, get_attr_key2string( sidmap_attr_list, LDAP_ATTR_GIDNUMBER ) );
- }
-
- pstr_sprintf(id_str, "%lu", ((id_type == ID_USERID) ? (unsigned long)id.uid :
- (unsigned long)id.gid));
-
- smbldap_set_mod( &mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_IDMAP_ENTRY );
-
- smbldap_make_mod( ldap_state.smbldap_state->ldap_struct,
- entry, &mods, type, id_str );
-
- smbldap_make_mod( ldap_state.smbldap_state->ldap_struct,
- entry, &mods,
- get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
- sid_string );
-
- /* There may well be nothing at all to do */
-
- if (mods) {
- smbldap_set_mod( &mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SID_ENTRY );
- rc = smbldap_add(ldap_state.smbldap_state, dn, mods);
- ldap_mods_free( mods, True );
- } else {
- rc = LDAP_SUCCESS;
- }
-
- if (rc != LDAP_SUCCESS) {
- char *ld_error = NULL;
- ldap_get_option(ldap_state.smbldap_state->ldap_struct, LDAP_OPT_ERROR_STRING,
- &ld_error);
- DEBUG(0,("ldap_set_mapping_internals: Failed to %s mapping from %s to %lu [%s]\n",
- (ldap_op == LDAP_MOD_ADD) ? "add" : "replace",
- sid_string, (unsigned long)((id_type & ID_USERID) ? id.uid : id.gid), type));
- DEBUG(0, ("ldap_set_mapping_internals: Error was: %s (%s)\n",
- ld_error ? ld_error : "(NULL)", ldap_err2string (rc)));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to %lu [%s]\n",
- sid_string, ((id_type & ID_USERID) ? (unsigned long)id.uid :
- (unsigned long)id.gid), type));
-
- return NT_STATUS_OK;
-}
-
-/*****************************************************************************
- Allocate a new uid or gid
-*****************************************************************************/
-
-static NTSTATUS ldap_allocate_id(unid_t *id, enum idmap_type id_type)
-{
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
- int rc = LDAP_SERVER_DOWN;
- int count = 0;
- LDAPMessage *result = NULL;
- LDAPMessage *entry = NULL;
- pstring id_str, new_id_str;
- LDAPMod **mods = NULL;
- const char *type;
- char *dn = NULL;
- const char **attr_list;
- pstring filter;
- uid_t luid, huid;
- gid_t lgid, hgid;
-
- if (id_type != ID_USERID && id_type != ID_GROUPID) {
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- type = (id_type == ID_USERID) ?
- get_attr_key2string( idpool_attr_list, LDAP_ATTR_UIDNUMBER ) :
- get_attr_key2string( idpool_attr_list, LDAP_ATTR_GIDNUMBER );
-
- pstr_sprintf(filter, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
-
- attr_list = get_attr_list( NULL, idpool_attr_list );
-
- rc = smbldap_search(ldap_state.smbldap_state, lp_ldap_idmap_suffix(),
- LDAP_SCOPE_SUBTREE, filter,
- attr_list, 0, &result);
- TALLOC_FREE( attr_list );
-
- if (rc != LDAP_SUCCESS) {
- DEBUG(0,("ldap_allocate_id: %s object not found\n", LDAP_OBJ_IDPOOL));
- goto out;
- }
-
- count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result);
- if (count != 1) {
- DEBUG(0,("ldap_allocate_id: single %s object not found\n", LDAP_OBJ_IDPOOL));
- goto out;
- }
-
- dn = smbldap_get_dn(ldap_state.smbldap_state->ldap_struct, result);
- if (!dn) {
- goto out;
- }
- entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result);
-
- if (!smbldap_get_single_pstring(ldap_state.smbldap_state->ldap_struct, entry, type, id_str)) {
- DEBUG(0,("ldap_allocate_id: %s attribute not found\n",
- type));
- goto out;
- }
-
- /* this must succeed or else we wouldn't have initialized */
-
- lp_idmap_uid( &luid, &huid);
- lp_idmap_gid( &lgid, &hgid);
-
- /* make sure we still have room to grow */
-
- if (id_type == ID_USERID) {
- id->uid = strtoul(id_str, NULL, 10);
- if (id->uid > huid ) {
- DEBUG(0,("ldap_allocate_id: Cannot allocate uid above %lu!\n",
- (unsigned long)huid));
- goto out;
- }
- } else {
- id->gid = strtoul(id_str, NULL, 10);
- if (id->gid > hgid ) {
- DEBUG(0,("ldap_allocate_id: Cannot allocate gid above %lu!\n",
- (unsigned long)hgid));
- goto out;
- }
- }
-
- pstr_sprintf(new_id_str, "%lu",
- ((id_type == ID_USERID) ? (unsigned long)id->uid :
- (unsigned long)id->gid) + 1);
-
- smbldap_set_mod( &mods, LDAP_MOD_DELETE, type, id_str );
- smbldap_set_mod( &mods, LDAP_MOD_ADD, type, new_id_str );
-
- if (mods == NULL) {
- DEBUG(0,("ldap_allocate_id: smbldap_set_mod() failed.\n"));
- goto out;
- }
-
- rc = smbldap_modify(ldap_state.smbldap_state, dn, mods);
-
- ldap_mods_free( mods, True );
- if (rc != LDAP_SUCCESS) {
- DEBUG(1,("ldap_allocate_id: Failed to allocate new %s. ldap_modify() failed.\n",
- type));
- goto out;
- }
-
- ret = NT_STATUS_OK;
-out:
- SAFE_FREE(dn);
- if (result != NULL)
- ldap_msgfree(result);
-
- return ret;
-}
-
-/*****************************************************************************
- get a sid from an id
-*****************************************************************************/
-
-static NTSTATUS ldap_get_sid_from_id(DOM_SID *sid, unid_t id, enum idmap_type id_type, int flags)
-{
- LDAPMessage *result = NULL;
- LDAPMessage *entry = NULL;
- pstring sid_str;
- pstring filter;
- pstring suffix;
- const char *type;
- int rc;
- int count;
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
- const char **attr_list;
-
- if ( id_type == ID_USERID )
- type = get_attr_key2string( idpool_attr_list, LDAP_ATTR_UIDNUMBER );
- else
- type = get_attr_key2string( idpool_attr_list, LDAP_ATTR_GIDNUMBER );
-
- pstrcpy( suffix, lp_ldap_idmap_suffix() );
- pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))",
- LDAP_OBJ_IDMAP_ENTRY, type,
- ((id_type & ID_USERID) ? (unsigned long)id.uid : (unsigned long)id.gid));
-
- attr_list = get_attr_list( NULL, sidmap_attr_list );
- rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE,
- filter, attr_list, 0, &result);
-
- if (rc != LDAP_SUCCESS) {
- DEBUG(3,("ldap_get_isd_from_id: Failure looking up entry (%s)\n",
- ldap_err2string(rc) ));
- goto out;
- }
-
- count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result);
-
- if (count != 1) {
- DEBUG(0,("ldap_get_sid_from_id: mapping not found for %s: %lu\n",
- type, ((id_type & ID_USERID) ? (unsigned long)id.uid :
- (unsigned long)id.gid)));
- goto out;
- }
-
- entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result);
-
- if ( !smbldap_get_single_pstring(ldap_state.smbldap_state->ldap_struct, entry, LDAP_ATTRIBUTE_SID, sid_str) )
- goto out;
-
- if (!string_to_sid(sid, sid_str))
- goto out;
-
- ret = NT_STATUS_OK;
-out:
- TALLOC_FREE( attr_list );
-
- if (result)
- ldap_msgfree(result);
-
- return ret;
-}
-
-/***********************************************************************
- Get an id from a sid - urg. This is assuming the *output* parameter id_type
- has been initialized with the correct needed type - ID_USERID or ID_GROUPID.
- This *sucks* and is bad design and needs fixing. JRA.
-***********************************************************************/
-
-static NTSTATUS ldap_get_id_from_sid(unid_t *id, enum idmap_type *id_type, const DOM_SID *sid, int flags)
-{
- LDAPMessage *result = NULL;
- LDAPMessage *entry = NULL;
- pstring sid_str;
- pstring filter;
- pstring id_str;
- const char *suffix;
- const char *type;
- int rc;
- int count;
- const char **attr_list;
- char *dn = NULL;
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
-
- sid_to_string(sid_str, sid);
-
- DEBUG(8,("ldap_get_id_from_sid: %s (%s)\n", sid_str,
- (*id_type & ID_GROUPID ? "group" : "user") ));
-
- suffix = lp_ldap_idmap_suffix();
- pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
- LDAP_OBJ_IDMAP_ENTRY, LDAP_ATTRIBUTE_SID, sid_str);
-
- if ( *id_type == ID_GROUPID )
- type = get_attr_key2string( sidmap_attr_list, LDAP_ATTR_GIDNUMBER );
- else
- type = get_attr_key2string( sidmap_attr_list, LDAP_ATTR_UIDNUMBER );
-
- /* do the search and check for errors */
-
- attr_list = get_attr_list( NULL, sidmap_attr_list );
- rc = smbldap_search(ldap_state.smbldap_state, suffix, LDAP_SCOPE_SUBTREE,
- filter, attr_list, 0, &result);
-
- if (rc != LDAP_SUCCESS) {
- DEBUG(3,("ldap_get_id_from_sid: Failure looking up idmap entry (%s)\n",
- ldap_err2string(rc) ));
- goto out;
- }
-
- /* check for the number of entries returned */
-
- count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result);
-
- if ( count > 1 ) {
- DEBUG(0, ("ldap_get_id_from_sid: (2nd) search %s returned [%d] entries!\n",
- filter, count));
- goto out;
- }
-
- /* try to allocate a new id if we still haven't found one */
-
- if ( !count ) {
- int i;
-
- if (flags & IDMAP_FLAG_QUERY_ONLY) {
- DEBUG(5,("ldap_get_id_from_sid: No matching entry found and QUERY_ONLY flag set\n"));
- goto out;
- }
-
- DEBUG(8,("ldap_get_id_from_sid: Allocating new id\n"));
-
- for (i = 0; i < LDAP_MAX_ALLOC_ID; i++) {
- ret = ldap_allocate_id(id, *id_type);
- if ( NT_STATUS_IS_OK(ret) )
- break;
- }
-
- if ( !NT_STATUS_IS_OK(ret) ) {
- DEBUG(0,("ldap_allocate_id: cannot acquire id lock!\n"));
- goto out;
- }
-
- DEBUG(10,("ldap_get_id_from_sid: Allocated new %cid [%ul]\n",
- (*id_type & ID_GROUPID ? 'g' : 'u'), (uint32)id->uid ));
-
- ret = ldap_set_mapping(sid, *id, *id_type);
-
- /* all done */
-
- goto out;
- }
-
- DEBUG(10,("ldap_get_id_from_sid: success\n"));
-
- entry = ldap_first_entry(ldap_state.smbldap_state->ldap_struct, result);
-
- dn = smbldap_get_dn(ldap_state.smbldap_state->ldap_struct, result);
- if (!dn)
- goto out;
-
- DEBUG(10, ("Found mapping entry at dn=%s, looking for %s\n", dn, type));
-
- if ( smbldap_get_single_pstring(ldap_state.smbldap_state->ldap_struct, entry, type, id_str) ) {
- if ( (*id_type == ID_USERID) )
- id->uid = strtoul(id_str, NULL, 10);
- else
- id->gid = strtoul(id_str, NULL, 10);
-
- ret = NT_STATUS_OK;
- goto out;
- }
-
-out:
- TALLOC_FREE( attr_list );
- if (result)
- ldap_msgfree(result);
- SAFE_FREE(dn);
-
- return ret;
-}
-
-/**********************************************************************
- Verify the sambaUnixIdPool entry in the directiry.
-**********************************************************************/
-
-static NTSTATUS verify_idpool( void )
-{
- fstring filter;
- int rc;
- const char **attr_list;
- LDAPMessage *result = NULL;
- LDAPMod **mods = NULL;
- int count;
-
- fstr_sprintf( filter, "(objectclass=%s)", LDAP_OBJ_IDPOOL );
-
- attr_list = get_attr_list( NULL, idpool_attr_list );
- rc = smbldap_search(ldap_state.smbldap_state, lp_ldap_idmap_suffix(),
- LDAP_SCOPE_SUBTREE, filter, attr_list, 0, &result);
- TALLOC_FREE( attr_list );
-
- if (rc != LDAP_SUCCESS)
- return NT_STATUS_UNSUCCESSFUL;
-
- count = ldap_count_entries(ldap_state.smbldap_state->ldap_struct, result);
-
- ldap_msgfree(result);
-
- if ( count > 1 ) {
- DEBUG(0,("ldap_idmap_init: multiple entries returned from %s (base == %s)\n",
- filter, lp_ldap_idmap_suffix() ));
- return NT_STATUS_UNSUCCESSFUL;
- }
- else if (count == 0) {
- uid_t luid, huid;
- gid_t lgid, hgid;
- fstring uid_str, gid_str;
-
- if ( !lp_idmap_uid(&luid, &huid) || !lp_idmap_gid( &lgid, &hgid ) ) {
- DEBUG(0,("ldap_idmap_init: idmap uid/gid parameters not specified\n"));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- fstr_sprintf( uid_str, "%lu", (unsigned long)luid );
- fstr_sprintf( gid_str, "%lu", (unsigned long)lgid );
-
- smbldap_set_mod( &mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_IDPOOL );
- smbldap_set_mod( &mods, LDAP_MOD_ADD,
- get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER), uid_str );
- smbldap_set_mod( &mods, LDAP_MOD_ADD,
- get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER), gid_str );
- if (mods) {
- rc = smbldap_modify(ldap_state.smbldap_state, lp_ldap_idmap_suffix(), mods);
- ldap_mods_free( mods, True );
- } else {
- return NT_STATUS_UNSUCCESSFUL;
- }
- }
-
- return ( rc==LDAP_SUCCESS ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL );
-}
-
-/*****************************************************************************
- Initialise idmap database.
-*****************************************************************************/
-
-static NTSTATUS ldap_idmap_init( const char *params )
-{
- NTSTATUS nt_status;
-
- ldap_state.mem_ctx = talloc_init("idmap_ldap");
- if (!ldap_state.mem_ctx) {
- return NT_STATUS_NO_MEMORY;
- }
-
- /* assume location is the only parameter */
- if (!NT_STATUS_IS_OK(nt_status =
- smbldap_init(ldap_state.mem_ctx, params,
- &ldap_state.smbldap_state))) {
- talloc_destroy(ldap_state.mem_ctx);
- return nt_status;
- }
-
- /* see if the idmap suffix and sub entries exists */
-
- nt_status = verify_idpool();
- if ( !NT_STATUS_IS_OK(nt_status) )
- return nt_status;
-
- return NT_STATUS_OK;
-}
-
-/*****************************************************************************
- End the LDAP session
-*****************************************************************************/
-
-static NTSTATUS ldap_idmap_close(void)
-{
-
- smbldap_free_struct(&(ldap_state).smbldap_state);
- talloc_destroy(ldap_state.mem_ctx);
-
- DEBUG(5,("The connection to the LDAP server was closed\n"));
- /* maybe free the results here --metze */
-
- return NT_STATUS_OK;
-}
-
-
-/* This function doesn't make as much sense in an LDAP world since the calling
- node doesn't really control the ID ranges */
-static void ldap_idmap_status(void)
-{
- DEBUG(0, ("LDAP IDMAP Status not available\n"));
-}
-
-static struct idmap_methods ldap_methods = {
- ldap_idmap_init,
- ldap_allocate_id,
- ldap_get_sid_from_id,
- ldap_get_id_from_sid,
- ldap_set_mapping,
- ldap_idmap_close,
- ldap_idmap_status
-
-};
-
-NTSTATUS idmap_ldap_init(void)
-{
- return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ldap", &ldap_methods);
-}
+++ /dev/null
-/*
- * idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts
- * Copyright (C) Guenther Deschner, 2004
- * Copyright (C) Sumit Bose, 2004
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- */
-
-#include "includes.h"
-
-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_IDMAP
-
-NTSTATUS init_module(void);
-
-struct dom_entry {
- fstring name;
- fstring sid;
- uint32 min_id;
- uint32 max_id;
-};
-
-typedef struct trust_dom_array {
- int number;
- struct dom_entry *dom;
-} trust_dom_array;
-
-static trust_dom_array trust;
-
-static NTSTATUS rid_idmap_parse(const char *init_param,
- uint32 num_domains,
- fstring *domain_names,
- DOM_SID *domain_sids,
- uid_t u_low,
- uid_t u_high)
-{
- const char *p;
- int i;
- fstring sid_str;
- BOOL known_domain = False;
- fstring tok;
-
- p = init_param;
- trust.number = 0;
-
- /* falling back to automatic mapping when there were no options given */
- if (!*init_param) {
-
- DEBUG(3,("rid_idmap_parse: no domain list given or trusted domain-support deactivated, falling back to automatic mapping for own domain:\n"));
-
- sid_to_string(sid_str, &domain_sids[0]);
-
- fstrcpy(trust.dom[0].name, domain_names[0]);
- fstrcpy(trust.dom[0].sid, sid_str);
- trust.dom[0].min_id = u_low;
- trust.dom[0].max_id = u_high;
- trust.number = 1;
-
- DEBUGADD(3,("rid_idmap_parse:\tdomain: [%s], sid: [%s], range=[%d-%d]\n",
- trust.dom[0].name, trust.dom[0].sid, trust.dom[0].min_id, trust.dom[0].max_id));
- return NT_STATUS_OK;
- }
-
- /* scan through the init_param-list */
- while (next_token(&init_param, tok, LIST_SEP, sizeof(tok))) {
-
- p = tok;
- DEBUG(3,("rid_idmap_parse: parsing entry: %d\n", trust.number));
-
- /* reinit sizes */
- trust.dom = SMB_REALLOC_ARRAY(trust.dom, struct dom_entry,
- trust.number+1);
-
- if ( trust.dom == NULL ) {
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!next_token(&p, tok, "=", sizeof(tok))) {
- DEBUG(0, ("rid_idmap_parse: no '=' sign found in domain list [%s]\n", init_param));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- /* add the name */
- fstrcpy(trust.dom[trust.number].name, tok);
- DEBUGADD(3,("rid_idmap_parse:\tentry %d has name: [%s]\n", trust.number, trust.dom[trust.number].name));
-
- /* add the domain-sid */
- for (i=0; i<num_domains; i++) {
-
- known_domain = False;
-
- if (strequal(domain_names[i], trust.dom[trust.number].name)) {
-
- sid_to_string(sid_str, &domain_sids[i]);
- fstrcpy(trust.dom[trust.number].sid, sid_str);
-
- DEBUGADD(3,("rid_idmap_parse:\tentry %d has sid: [%s]\n", trust.number, trust.dom[trust.number].sid));
- known_domain = True;
- break;
- }
- }
-
- if (!known_domain) {
- DEBUG(0,("rid_idmap_parse: your DC does not know anything about domain: [%s]\n", trust.dom[trust.number].name));
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- if (!next_token(&p, tok, "-", sizeof(tok))) {
- DEBUG(0,("rid_idmap_parse: no mapping-range defined\n"));
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- /* add min_id */
- trust.dom[trust.number].min_id = atoi(tok);
- DEBUGADD(3,("rid_idmap_parse:\tentry %d has min_id: [%d]\n", trust.number, trust.dom[trust.number].min_id));
-
- /* add max_id */
- trust.dom[trust.number].max_id = atoi(p);
- DEBUGADD(3,("rid_idmap_parse:\tentry %d has max_id: [%d]\n", trust.number, trust.dom[trust.number].max_id));
-
- trust.number++;
- }
-
- return NT_STATUS_OK;
-
-}
-
-static NTSTATUS rid_idmap_get_domains(uint32 *num_domains, fstring **domain_names, DOM_SID **domain_sids)
-{
- NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
- struct cli_state *cli;
- struct rpc_pipe_client *pipe_hnd;
- TALLOC_CTX *mem_ctx;
- POLICY_HND pol;
- uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED;
- fstring dc_name;
- struct in_addr dc_ip;
- const char *password = NULL;
- const char *username = NULL;
- const char *domain = NULL;
- uint32 info_class = 5;
- char *domain_name = NULL;
- DOM_SID *domain_sid, sid;
- fstring sid_str;
- int i;
- uint32 trusted_num_domains = 0;
- char **trusted_domain_names;
- DOM_SID *trusted_domain_sids;
- uint32 enum_ctx = 0;
- int own_domains = 2;
-
- /* put the results together */
- *num_domains = 2;
- *domain_names = SMB_MALLOC_ARRAY(fstring, *num_domains);
- *domain_sids = SMB_MALLOC_ARRAY(DOM_SID, *num_domains);
-
- /* avoid calling a DC when trusted domains are not allowed anyway */
- if (!lp_allow_trusted_domains()) {
-
- fstrcpy((*domain_names)[0], lp_workgroup());
- if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
- DEBUG(0,("rid_idmap_get_domains: failed to retrieve domain sid\n"));
- return status;
- }
- sid_copy(&(*domain_sids)[0], &sid);
-
- /* add BUILTIN */
- fstrcpy((*domain_names)[1], "BUILTIN");
- sid_copy(&(*domain_sids)[1], &global_sid_Builtin);
-
- return NT_STATUS_OK;
- }
-
- /* create mem_ctx */
- if (!(mem_ctx = talloc_init("rid_idmap_get_trusted_domains"))) {
- DEBUG(0, ("rid_idmap_get_domains: talloc_init() failed\n"));
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!get_dc_name(lp_workgroup(), 0, dc_name, &dc_ip)) {
- DEBUG(1, ("rid_idmap_get_domains: could not get dc-name\n"));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- /* open a connection to the dc */
- username = (char *)secrets_fetch(SECRETS_AUTH_USER, NULL);
- password = (char *)secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
- domain = (char *)secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
-
- if (username) {
-
- if (!domain)
- domain = smb_xstrdup(lp_workgroup());
-
- if (!password)
- password = smb_xstrdup("");
-
- DEBUG(3, ("rid_idmap_get_domains: IPC$ connections done by user %s\\%s\n", domain, username));
-
- } else {
-
- DEBUG(3, ("rid_idmap_get_domains: IPC$ connections done anonymously\n"));
- username = "";
- domain = "";
- password = "";
- }
-
- DEBUG(10, ("rid_idmap_get_domains: opening connection to [%s]\n", dc_name));
-
- status = cli_full_connection(&cli, global_myname(), dc_name,
- NULL, 0,
- "IPC$", "IPC",
- username,
- lp_workgroup(),
- password,
- CLI_FULL_CONNECTION_ANONYMOUS_FALLBACK, True, NULL);
-
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("rid_idmap_get_domains: could not setup connection to dc\n"));
- return status;
- }
-
- /* query the lsa-pipe */
- pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_LSARPC, &status);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("rid_idmap_get_domains: could not setup connection to dc\n"));
- goto out;
- }
-
- /* query policies */
- status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, False, des_access,
- &pol);
- if (!NT_STATUS_IS_OK(status)) {
- goto out;
- }
-
- status = rpccli_lsa_query_info_policy(pipe_hnd, mem_ctx, &pol,
- info_class, &domain_name,
- &domain_sid);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("rid_idmap_get_domains: cannot retrieve domain-info\n"));
- goto out;
- }
-
- sid_to_string(sid_str, domain_sid);
- DEBUG(10,("rid_idmap_get_domains: my domain: [%s], sid: [%s]\n", domain_name, sid_str));
-
- /* scan trusted domains */
- DEBUG(10, ("rid_idmap_get_domains: enumerating trusted domains\n"));
- status = rpccli_lsa_enum_trust_dom(pipe_hnd, mem_ctx, &pol, &enum_ctx,
- &trusted_num_domains,
- &trusted_domain_names,
- &trusted_domain_sids);
-
- if (!NT_STATUS_IS_OK(status) &&
- !NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES) &&
- !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
- DEBUG(1, ("rid_idmap_get_domains: could not enumerate trusted domains\n"));
- goto out;
- }
-
- /* show trusted domains */
- DEBUG(10,("rid_idmap_get_domains: scan for trusted domains gave %d results:\n", trusted_num_domains));
- for (i=0; i<trusted_num_domains; i++) {
- sid_to_string(sid_str, &trusted_domain_sids[i]);
- DEBUGADD(10,("rid_idmap_get_domains:\t#%d\tDOMAIN: [%s], SID: [%s]\n",
- i, trusted_domain_names[i], sid_str));
- }
-
- if (!sid_equal(domain_sid, get_global_sam_sid()))
- ++own_domains;
-
- /* put the results together */
- *num_domains = trusted_num_domains + own_domains;
- *domain_names = SMB_REALLOC_ARRAY(*domain_names, fstring,
- *num_domains);
- if (!*domain_names) {
- goto out;
- }
- *domain_sids = SMB_REALLOC_ARRAY(*domain_sids, DOM_SID, *num_domains);
- if (!*domain_sids) {
- goto out;
- }
-
- /* first add mydomain */
- fstrcpy((*domain_names)[0], domain_name);
- sid_copy(&(*domain_sids)[0], domain_sid);
-
- /* then add BUILTIN */
- fstrcpy((*domain_names)[1], "BUILTIN");
- sid_copy(&(*domain_sids)[1], &global_sid_Builtin);
-
- /* then add my local sid */
- if (!sid_equal(domain_sid, get_global_sam_sid())) {
- fstrcpy((*domain_names)[2], global_myname());
- sid_copy(&(*domain_sids)[2], get_global_sam_sid());
- }
-
- /* add trusted domains */
- for (i=0; i<trusted_num_domains; i++) {
- fstrcpy((*domain_names)[i+own_domains], trusted_domain_names[i]);
- sid_copy(&((*domain_sids)[i+own_domains]), &(trusted_domain_sids[i]));
- }
-
- /* show complete domain list */
- DEBUG(5,("rid_idmap_get_domains: complete domain-list has %d entries:\n", *num_domains));
- for (i=0; i<*num_domains; i++) {
- sid_to_string(sid_str, &((*domain_sids)[i]));
- DEBUGADD(5,("rid_idmap_get_domains:\t#%d\tdomain: [%s], sid: [%s]\n",
- i, (*domain_names)[i], sid_str ));
- }
-
- status = NT_STATUS_OK;
-
-out:
- rpccli_lsa_Close(pipe_hnd, mem_ctx, &pol);
- cli_rpc_pipe_close(pipe_hnd);
- talloc_destroy(mem_ctx);
- cli_shutdown(cli);
-
- return status;
-}
-
-static NTSTATUS rid_idmap_init(const char *init_param)
-{
- int i, j;
- uid_t u_low, u_high;
- gid_t g_low, g_high;
- uint32 num_domains = 0;
- fstring *domain_names;
- DOM_SID *domain_sids;
- NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
- trust.dom = NULL;
-
- /* basic sanity checks */
- if (!lp_idmap_uid(&u_low, &u_high) || !lp_idmap_gid(&g_low, &g_high)) {
- DEBUG(0, ("rid_idmap_init: cannot get required global idmap-ranges.\n"));
- return nt_status;
- }
-
- if (u_low != g_low || u_high != g_high) {
- DEBUG(0, ("rid_idmap_init: range defined in \"idmap uid\" must match range of \"idmap gid\".\n"));
- return nt_status;
- }
-
- if (lp_allow_trusted_domains()) {
-#if IDMAP_RID_SUPPORT_TRUSTED_DOMAINS
- DEBUG(3,("rid_idmap_init: enabling trusted-domain-mapping\n"));
-#else
- DEBUG(0,("rid_idmap_init: idmap_rid does not work with trusted domains\n"));
- DEBUGADD(0,("rid_idmap_init: please set \"allow trusted domains\" to \"no\" when using idmap_rid\n"));
- return nt_status;
-#endif
- }
-
- /* init sizes */
- trust.dom = SMB_MALLOC_P(struct dom_entry);
- if (trust.dom == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
-
- /* retrieve full domain list */
- nt_status = rid_idmap_get_domains(&num_domains, &domain_names, &domain_sids);
- if (!NT_STATUS_IS_OK(nt_status) &&
- !NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MORE_ENTRIES) &&
- !NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES)) {
- DEBUG(0, ("rid_idmap_init: cannot fetch sids for domain and/or trusted-domains from domain-controller.\n"));
- return nt_status;
- }
-
- /* parse the init string */
- nt_status = rid_idmap_parse(init_param, num_domains, domain_names, domain_sids, u_low, u_high);
- if (!NT_STATUS_IS_OK(nt_status)) {
- DEBUG(0, ("rid_idmap_init: cannot parse module-configuration\n"));
- goto out;
- }
-
- nt_status = NT_STATUS_INVALID_PARAMETER;
-
- /* some basic sanity checks */
- for (i=0; i<trust.number; i++) {
-
- if (trust.dom[i].min_id > trust.dom[i].max_id) {
- DEBUG(0, ("rid_idmap_init: min_id (%d) has to be smaller than max_id (%d) for domain [%s]\n",
- trust.dom[i].min_id, trust.dom[i].max_id, trust.dom[i].name));
- goto out;
- }
-
- if (trust.dom[i].min_id < u_low || trust.dom[i].max_id > u_high) {
- DEBUG(0, ("rid_idmap_init: mapping of domain [%s] (%d-%d) has to fit into global idmap range (%d-%d).\n",
- trust.dom[i].name, trust.dom[i].min_id, trust.dom[i].max_id, u_low, u_high));
- goto out;
- }
- }
-
- /* check for overlaps */
- for (i=0; i<trust.number-1; i++) {
- for (j=i+1; j<trust.number; j++) {
- if (trust.dom[i].min_id <= trust.dom[j].max_id && trust.dom[j].min_id <= trust.dom[i].max_id) {
- DEBUG(0, ("rid_idmap_init: the ranges of domain [%s] and [%s] overlap\n",
- trust.dom[i+1].name, trust.dom[i].name));
- goto out;
- }
- }
- }
-
- DEBUG(3, ("rid_idmap_init: using %d mappings:\n", trust.number));
- for (i=0; i<trust.number; i++) {
- DEBUGADD(3, ("rid_idmap_init:\tdomain: [%s], sid: [%s], min_id: [%d], max_id: [%d]\n",
- trust.dom[i].name, trust.dom[i].sid, trust.dom[i].min_id, trust.dom[i].max_id));
- }
-
- nt_status = NT_STATUS_OK;
-
-out:
- SAFE_FREE(domain_names);
- SAFE_FREE(domain_sids);
-
- return nt_status;
-}
-
-static NTSTATUS rid_idmap_get_sid_from_id(DOM_SID *sid, unid_t unid, enum idmap_type id_type, int flags)
-
-{
- fstring sid_string;
- int i;
- DOM_SID sidstr;
-
- /* find range */
- for (i=0; i<trust.number; i++) {
- if (trust.dom[i].min_id <= unid.uid && trust.dom[i].max_id >= unid.uid )
- break;
- }
-
- if (i == trust.number) {
- DEBUG(0,("rid_idmap_get_sid_from_id: no suitable range available for id: %d\n", unid.uid));
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- /* use lower-end of idmap-range as offset for users and groups*/
- unid.uid -= trust.dom[i].min_id;
-
- if (!trust.dom[i].sid)
- return NT_STATUS_INVALID_PARAMETER;
-
- string_to_sid(&sidstr, trust.dom[i].sid);
- sid_copy(sid, &sidstr);
- if (!sid_append_rid( sid, (unsigned long)unid.uid )) {
- DEBUG(0,("rid_idmap_get_sid_from_id: could not append rid to domain sid\n"));
- return NT_STATUS_NO_MEMORY;
- }
-
- DEBUG(3, ("rid_idmap_get_sid_from_id: mapped POSIX %s %d to SID [%s]\n",
- (id_type == ID_GROUPID) ? "GID" : "UID", unid.uid,
- sid_to_string(sid_string, sid)));
-
- return NT_STATUS_OK;
-}
-
-static NTSTATUS rid_idmap_get_id_from_sid(unid_t *unid, enum idmap_type *id_type, const DOM_SID *sid, int flags)
-{
- fstring sid_string;
- int i;
- uint32 rid;
- DOM_SID sidstr;
-
- /* check if we have a mapping for the sid */
- for (i=0; i<trust.number; i++) {
- if (!trust.dom[i].sid) {
- return NT_STATUS_INVALID_PARAMETER;
- }
- string_to_sid(&sidstr, trust.dom[i].sid);
- if ( sid_compare_domain(sid, &sidstr) == 0 )
- break;
- }
-
- if (i == trust.number) {
- DEBUG(0,("rid_idmap_get_id_from_sid: no suitable range available for sid: %s\n",
- sid_string_static(sid)));
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- if (!sid_peek_rid(sid, &rid)) {
- DEBUG(0,("rid_idmap_get_id_from_sid: could not peek rid\n"));
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- /* use lower-end of idmap-range as offset for users and groups */
- unid->uid = rid + trust.dom[i].min_id;
-
- if (unid->uid > trust.dom[i].max_id) {
- DEBUG(0,("rid_idmap_get_id_from_sid: rid: %d (%s: %d) too high for mapping of domain: %s (%d-%d)\n",
- rid, (*id_type == ID_GROUPID) ? "GID" : "UID", unid->uid, trust.dom[i].name,
- trust.dom[i].min_id, trust.dom[i].max_id));
- return NT_STATUS_INVALID_PARAMETER;
- }
- if (unid->uid < trust.dom[i].min_id) {
- DEBUG(0,("rid_idmap_get_id_from_sid: rid: %d (%s: %d) too low for mapping of domain: %s (%d-%d)\n",
- rid, (*id_type == ID_GROUPID) ? "GID" : "UID", unid->uid,
- trust.dom[i].name, trust.dom[i].min_id, trust.dom[i].max_id));
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- DEBUG(3,("rid_idmap_get_id_from_sid: mapped SID [%s] to POSIX %s %d\n",
- sid_to_string(sid_string, sid),
- (*id_type == ID_GROUPID) ? "GID" : "UID", unid->uid));
-
- return NT_STATUS_OK;
-
-}
-
-static NTSTATUS rid_idmap_set_mapping(const DOM_SID *sid, unid_t id, enum idmap_type id_type)
-{
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-static NTSTATUS rid_idmap_close(void)
-{
- SAFE_FREE(trust.dom);
-
- return NT_STATUS_OK;
-}
-
-static NTSTATUS rid_idmap_allocate_id(unid_t *id, enum idmap_type id_type)
-{
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-static void rid_idmap_status(void)
-{
- DEBUG(0, ("RID IDMAP Status not available\n"));
-}
-
-static struct idmap_methods rid_methods = {
- rid_idmap_init,
- rid_idmap_allocate_id,
- rid_idmap_get_sid_from_id,
- rid_idmap_get_id_from_sid,
- rid_idmap_set_mapping,
- rid_idmap_close,
- rid_idmap_status
-};
-
-NTSTATUS idmap_rid_init(void)
-{
- return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "rid", &rid_methods);
-}
-
+++ /dev/null
-/*
- Unix SMB/CIFS implementation.
-
- idmap LDAP backend
-
- Copyright (C) Tim Potter 2000
- Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
- Copyright (C) Simo Sorce 2003
- Copyright (C) Gerald Carter 2003
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "includes.h"
-
-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_IDMAP
-
-struct ldap_connection *ldap_conn = NULL;
-
-/* number tries while allocating new id */
-#define LDAP_MAX_ALLOC_ID 128
-
-
-/***********************************************************************
- This function cannot be called to modify a mapping, only set a new one
-***********************************************************************/
-
-static NTSTATUS ldap_set_mapping(const DOM_SID *sid, unid_t id, int id_type)
-{
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
- pstring id_str;
- const char *type;
- fstring sid_string;
- struct ldap_message *msg;
- struct ldap_message *mod_res = NULL;
- char *mod;
-
- type = (id_type & ID_USERID) ? "uidNumber" : "gidNumber";
-
- sid_to_string( sid_string, sid );
-
- pstr_sprintf(id_str, "%lu",
- ((id_type & ID_USERID) ?
- (unsigned long)id.uid : (unsigned long)id.gid));
-
- asprintf(&mod,
- "dn: sambaSID=%s,%s\n"
- "changetype: add\n"
- "objectClass: sambaIdmapEntry\n"
- "objectClass: sambaSidEntry\n"
- "sambaSID: %s\n"
- "%s: %lu\n",
- sid_string, lp_ldap_idmap_suffix(), sid_string, type,
- ((id_type & ID_USERID) ?
- (unsigned long)id.uid : (unsigned long)id.gid));
-
- msg = ldap_ldif2msg(mod);
-
- SAFE_FREE(mod);
-
- if (msg == NULL)
- return NT_STATUS_NO_MEMORY;
-
- mod_res = ldap_transaction(ldap_conn, msg);
-
- if ((mod_res == NULL) || (mod_res->r.ModifyResponse.resultcode != 0))
- goto out;
-
- ret = NT_STATUS_OK;
- out:
- destroy_ldap_message(msg);
- destroy_ldap_message(mod_res);
- return ret;
-}
-
-/*****************************************************************************
- Allocate a new uid or gid
-*****************************************************************************/
-
-static NTSTATUS ldap_allocate_id(unid_t *id, enum idmap_type id_type)
-{
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
- uid_t luid, huid;
- gid_t lgid, hgid;
- const char *attrs[] = { "uidNumber", "gidNumber" };
- struct ldap_message *idpool_s = NULL;
- struct ldap_message *idpool = NULL;
- struct ldap_message *mod_msg = NULL;
- struct ldap_message *mod_res = NULL;
- int value;
- const char *id_attrib;
- char *mod;
-
- if (id_type != ID_USERID && id_type != ID_GROUPID) {
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- id_attrib = (id_type == ID_USERID) ? "uidNumber" : "gidNumber";
-
- idpool_s = new_ldap_search_message(lp_ldap_suffix(),
- LDAP_SEARCH_SCOPE_SUB,
- "(objectclass=sambaUnixIdPool)",
- 2, attrs);
-
- if (idpool_s == NULL)
- return NT_STATUS_NO_MEMORY;
-
- idpool = ldap_searchone(ldap_conn, idpool_s, NULL);
-
- if (idpool == NULL)
- goto out;
-
- if (!ldap_find_single_int(idpool, id_attrib, &value))
- goto out;
-
- /* this must succeed or else we wouldn't have initialized */
-
- lp_idmap_uid( &luid, &huid);
- lp_idmap_gid( &lgid, &hgid);
-
- /* make sure we still have room to grow */
-
- if (id_type == ID_USERID) {
- id->uid = value;
- if (id->uid > huid ) {
- DEBUG(0,("ldap_allocate_id: Cannot allocate uid "
- "above %lu!\n", (unsigned long)huid));
- goto out;
- }
- }
- else {
- id->gid = value;
- if (id->gid > hgid ) {
- DEBUG(0,("ldap_allocate_id: Cannot allocate gid "
- "above %lu!\n", (unsigned long)hgid));
- goto out;
- }
- }
-
- asprintf(&mod,
- "dn: %s\n"
- "changetype: modify\n"
- "delete: %s\n"
- "%s: %d\n"
- "-\n"
- "add: %s\n"
- "%s: %d\n",
- idpool->r.SearchResultEntry.dn, id_attrib, id_attrib, value,
- id_attrib, id_attrib, value+1);
-
- mod_msg = ldap_ldif2msg(mod);
-
- SAFE_FREE(mod);
-
- if (mod_msg == NULL)
- goto out;
-
- mod_res = ldap_transaction(ldap_conn, mod_msg);
-
- if ((mod_res == NULL) || (mod_res->r.ModifyResponse.resultcode != 0))
- goto out;
-
- ret = NT_STATUS_OK;
-out:
- destroy_ldap_message(idpool_s);
- destroy_ldap_message(idpool);
- destroy_ldap_message(mod_msg);
- destroy_ldap_message(mod_res);
-
- return ret;
-}
-
-/*****************************************************************************
- get a sid from an id
-*****************************************************************************/
-
-static NTSTATUS ldap_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type)
-{
- pstring filter;
- const char *type;
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
- const char *attr_list[] = { "sambaSID" };
- struct ldap_message *msg;
- struct ldap_message *entry = NULL;
- char *sid_str;
-
- type = (id_type & ID_USERID) ? "uidNumber" : "gidNumber";
-
- pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))", "sambaIdmapEntry",
- type,
- ((id_type & ID_USERID) ?
- (unsigned long)id.uid : (unsigned long)id.gid));
-
- msg = new_ldap_search_message(lp_ldap_idmap_suffix(),
- LDAP_SEARCH_SCOPE_SUB,
- filter, 1, attr_list);
-
- if (msg == NULL)
- return NT_STATUS_NO_MEMORY;
-
- entry = ldap_searchone(ldap_conn, msg, NULL);
-
- if (entry == NULL)
- goto out;
-
- if (!ldap_find_single_string(entry, "sambaSID", entry->mem_ctx,
- &sid_str))
- goto out;
-
- if (!string_to_sid(sid, sid_str))
- goto out;
-
- ret = NT_STATUS_OK;
-out:
- destroy_ldap_message(msg);
- destroy_ldap_message(entry);
-
- return ret;
-}
-
-/***********************************************************************
- Get an id from a sid
-***********************************************************************/
-
-static NTSTATUS ldap_get_id_from_sid(unid_t *id, int *id_type,
- const DOM_SID *sid)
-{
- pstring filter;
- const char *type;
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
- struct ldap_message *msg;
- struct ldap_message *entry = NULL;
- int i;
-
- DEBUG(8,("ldap_get_id_from_sid: %s (%s)\n", sid_string_static(sid),
- (*id_type & ID_GROUPID ? "group" : "user") ));
-
- type = ((*id_type) & ID_USERID) ? "uidNumber" : "gidNumber";
-
- pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
- "sambaIdmapEntry", "sambaSID", sid_string_static(sid));
-
- msg = new_ldap_search_message(lp_ldap_idmap_suffix(),
- LDAP_SEARCH_SCOPE_SUB,
- filter, 1, &type);
-
- if (msg == NULL)
- return NT_STATUS_NO_MEMORY;
-
- entry = ldap_searchone(ldap_conn, msg, NULL);
-
- if (entry != NULL) {
- int value;
-
- if (!ldap_find_single_int(entry, type, &value))
- goto out;
-
- if ((*id_type) & ID_USERID)
- id->uid = value;
- else
- id->gid = value;
-
- ret = NT_STATUS_OK;
- goto out;
- }
-
- if ((*id_type) & ID_QUERY_ONLY)
- goto out;
-
- /* Allocate a new RID */
-
- for (i = 0; i < LDAP_MAX_ALLOC_ID; i++) {
- ret = ldap_allocate_id(id, *id_type);
- if ( NT_STATUS_IS_OK(ret) )
- break;
- }
-
- if ( !NT_STATUS_IS_OK(ret) ) {
- DEBUG(0,("Could not allocate id\n"));
- goto out;
- }
-
- DEBUG(10,("ldap_get_id_from_sid: Allocated new %cid [%ul]\n",
- (*id_type & ID_GROUPID ? 'g' : 'u'), (uint32)id->uid ));
-
- ret = ldap_set_mapping(sid, *id, *id_type);
-
-out:
- destroy_ldap_message(msg);
- destroy_ldap_message(entry);
-
- return ret;
-}
-
-/**********************************************************************
- Verify the sambaUnixIdPool entry in the directory.
-**********************************************************************/
-static NTSTATUS verify_idpool(void)
-{
- const char *attr_list[3] = { "uidnumber", "gidnumber", "objectclass" };
- BOOL result;
- char *mod;
- struct ldap_message *msg, *entry, *res;
-
- uid_t luid, huid;
- gid_t lgid, hgid;
-
- msg = new_ldap_search_message(lp_ldap_suffix(),
- LDAP_SEARCH_SCOPE_SUB,
- "(objectClass=sambaUnixIdPool)",
- 3, attr_list);
-
- if (msg == NULL)
- return NT_STATUS_NO_MEMORY;
-
- entry = ldap_searchone(ldap_conn, msg, NULL);
-
- result = (entry != NULL);
-
- destroy_ldap_message(msg);
- destroy_ldap_message(entry);
-
- if (result)
- return NT_STATUS_OK;
-
- if ( !lp_idmap_uid(&luid, &huid) || !lp_idmap_gid( &lgid, &hgid ) ) {
- DEBUG(3,("ldap_idmap_init: idmap uid/gid parameters not "
- "specified\n"));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- asprintf(&mod,
- "dn: %s\n"
- "changetype: modify\n"
- "add: objectClass\n"
- "objectClass: sambaUnixIdPool\n"
- "-\n"
- "add: uidNumber\n"
- "uidNumber: %lu\n"
- "-\n"
- "add: gidNumber\n"
- "gidNumber: %lu\n",
- lp_ldap_idmap_suffix(),
- (unsigned long)luid, (unsigned long)lgid);
-
- msg = ldap_ldif2msg(mod);
-
- SAFE_FREE(mod);
-
- if (msg == NULL)
- return NT_STATUS_NO_MEMORY;
-
- res = ldap_transaction(ldap_conn, msg);
-
- if ((res == NULL) || (res->r.ModifyResponse.resultcode != 0)) {
- destroy_ldap_message(msg);
- destroy_ldap_message(res);
- DEBUG(5, ("Could not add sambaUnixIdPool\n"));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- destroy_ldap_message(msg);
- destroy_ldap_message(res);
- return NT_STATUS_OK;
-}
-
-/*****************************************************************************
- Initialise idmap database.
-*****************************************************************************/
-
-static NTSTATUS ldap_idmap_init( char *params )
-{
- NTSTATUS nt_status;
- char *dn, *pw;
-
- ldap_conn = new_ldap_connection();
-
- if (!fetch_ldap_pw(&dn, &pw))
- return NT_STATUS_UNSUCCESSFUL;
-
- ldap_conn->auth_dn = talloc_strdup(ldap_conn->mem_ctx, dn);
- ldap_conn->simple_pw = talloc_strdup(ldap_conn->mem_ctx, pw);
-
- SAFE_FREE(dn);
- SAFE_FREE(pw);
-
- if (!ldap_setup_connection(ldap_conn, params, NULL, NULL))
- return NT_STATUS_UNSUCCESSFUL;
-
- /* see if the idmap suffix and sub entries exists */
-
- nt_status = verify_idpool();
- if ( !NT_STATUS_IS_OK(nt_status) )
- return nt_status;
-
- return NT_STATUS_OK;
-}
-
-/*****************************************************************************
- End the LDAP session
-*****************************************************************************/
-
-static NTSTATUS ldap_idmap_close(void)
-{
-
- DEBUG(5,("The connection to the LDAP server was closed\n"));
- /* maybe free the results here --metze */
-
- return NT_STATUS_OK;
-}
-
-
-/* This function doesn't make as much sense in an LDAP world since the calling
- node doesn't really control the ID ranges */
-static void ldap_idmap_status(void)
-{
- DEBUG(0, ("LDAP IDMAP Status not available\n"));
-}
-
-static struct idmap_methods ldap_methods = {
- ldap_idmap_init,
- ldap_allocate_id,
- ldap_get_sid_from_id,
- ldap_get_id_from_sid,
- ldap_set_mapping,
- ldap_idmap_close,
- ldap_idmap_status
-
-};
-
-NTSTATUS idmap_smbldap_init(void)
-{
- return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "smbldap", &ldap_methods);
-}
+++ /dev/null
-/*
- Unix SMB/CIFS implementation.
-
- idmap TDB backend
-
- Copyright (C) Tim Potter 2000
- Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
- Copyright (C) Simo Sorce 2003
- Copyright (C) Jeremy Allison 2006
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "includes.h"
-
-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_IDMAP
-
-/* High water mark keys */
-#define HWM_GROUP "GROUP HWM"
-#define HWM_USER "USER HWM"
-
-/* Globals */
-static TDB_CONTEXT *idmap_tdb;
-
-static struct idmap_state {
-
- /* User and group id pool */
-
- uid_t uid_low, uid_high; /* Range of uids to allocate */
- gid_t gid_low, gid_high; /* Range of gids to allocate */
-} idmap_state;
-
-/**********************************************************************
- Allocate either a user or group id from the pool
-**********************************************************************/
-
-static NTSTATUS db_allocate_id(unid_t *id, enum idmap_type id_type)
-{
- BOOL ret;
- int hwm;
-
- /* Get current high water mark */
- switch (id_type) {
- case ID_USERID:
-
- if ((hwm = tdb_fetch_int32(idmap_tdb, HWM_USER)) == -1) {
- return NT_STATUS_INTERNAL_DB_ERROR;
- }
-
- /* check it is in the range */
- if (hwm > idmap_state.uid_high) {
- DEBUG(0, ("idmap Fatal Error: UID range full!! (max: %lu)\n",
- (unsigned long)idmap_state.uid_high));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- /* fetch a new id and increment it */
- ret = tdb_change_uint32_atomic(idmap_tdb, HWM_USER, (unsigned int *)&hwm, 1);
- if (!ret) {
- DEBUG(0, ("idmap_tdb: Fatal error while fetching a new id\n!"));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- /* recheck it is in the range */
- if (hwm > idmap_state.uid_high) {
- DEBUG(0, ("idmap Fatal Error: UID range full!! (max: %lu)\n",
- (unsigned long)idmap_state.uid_high));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- (*id).uid = hwm;
- DEBUG(10,("db_allocate_id: ID_USERID (*id).uid = %d\n", (unsigned int)hwm));
-
- break;
- case ID_GROUPID:
- if ((hwm = tdb_fetch_int32(idmap_tdb, HWM_GROUP)) == -1) {
- return NT_STATUS_INTERNAL_DB_ERROR;
- }
-
- /* check it is in the range */
- if (hwm > idmap_state.gid_high) {
- DEBUG(0, ("idmap Fatal Error: GID range full!! (max: %lu)\n",
- (unsigned long)idmap_state.gid_high));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- /* fetch a new id and increment it */
- ret = tdb_change_uint32_atomic(idmap_tdb, HWM_GROUP, (unsigned int *)&hwm, 1);
-
- if (!ret) {
- DEBUG(0, ("idmap_tdb: Fatal error while fetching a new id\n!"));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- /* recheck it is in the range */
- if (hwm > idmap_state.gid_high) {
- DEBUG(0, ("idmap Fatal Error: GID range full!! (max: %lu)\n",
- (unsigned long)idmap_state.gid_high));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- (*id).gid = hwm;
- DEBUG(10,("db_allocate_id: ID_GROUPID (*id).gid = %d\n", (unsigned int)hwm));
-
- break;
- default:
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- return NT_STATUS_OK;
-}
-
-/* Get a sid from an id - internal non-reverse map checking function. */
-
-static NTSTATUS db_internal_get_sid_from_id(DOM_SID *sid, unid_t id, enum idmap_type id_type)
-{
- TDB_DATA key, data;
- TALLOC_CTX *memctx;
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
-
- if ((memctx = talloc_new(NULL)) == NULL) {
- DEBUG(0, ("ERROR: Out of memory!\n"));
- return NT_STATUS_NO_MEMORY;
- }
-
- switch (id_type) {
- case ID_USERID:
- key.dptr = talloc_asprintf(memctx, "UID %lu", (unsigned long)id.uid);
- break;
- case ID_GROUPID:
- key.dptr = talloc_asprintf(memctx, "GID %lu", (unsigned long)id.gid);
- break;
- default:
- ret = NT_STATUS_INVALID_PARAMETER;
- goto done;
- }
-
- if (key.dptr == NULL) {
- DEBUG(0, ("ERROR: Out of memory!\n"));
- ret = NT_STATUS_NO_MEMORY;
- goto done;
- }
-
- key.dsize = strlen(key.dptr) + 1;
-
- DEBUG(10,("db_internal_get_sid_from_id: fetching record %s\n", key.dptr));
-
- data = tdb_fetch(idmap_tdb, key);
-
- if (data.dptr) {
- if (string_to_sid(sid, data.dptr)) {
- DEBUG(10,("db_internal_get_sid_from_id: fetching record %s -> %s\n", key.dptr, data.dptr ));
- ret = NT_STATUS_OK;
- }
- SAFE_FREE(data.dptr);
- }
-
-done:
- talloc_free(memctx);
- return ret;
-}
-
-/* Get an id from a sid - internal non-reverse map checking function. */
-
-static NTSTATUS db_internal_get_id_from_sid(unid_t *id, enum idmap_type *id_type, const DOM_SID *sid)
-{
- NTSTATUS ret;
- TDB_DATA key, data;
- TALLOC_CTX *memctx;
- unsigned long rec_id;
-
- if ((memctx = talloc_new(NULL)) == NULL) {
- DEBUG(0, ("ERROR: Out of memory!\n"));
- return NT_STATUS_NO_MEMORY;
- }
-
- /* Check if sid is present in database */
- if ((key.dptr = talloc_asprintf(memctx, "%s", sid_string_static(sid))) == NULL) {
- DEBUG(0, ("ERROR: Out of memory!\n"));
- ret = NT_STATUS_NO_MEMORY;
- goto done;
- }
-
- key.dsize = strlen(key.dptr) + 1;
-
- DEBUG(10,("db_internal_get_id_from_sid: fetching record %s\n", key.dptr));
-
- data = tdb_fetch(idmap_tdb, key);
- if (!data.dptr) {
- DEBUG(10,("db_internal_get_id_from_sid: record %s not found\n", key.dptr));
- ret = NT_STATUS_NO_SUCH_USER;
- goto done;
- } else {
- DEBUG(10,("db_internal_get_id_from_sid: record %s -> %s\n", key.dptr, data.dptr));
- }
-
- /* What type of record is this ? */
-
- /* Try and parse and return a uid */
- if (sscanf(data.dptr, "UID %lu", &rec_id) == 1) {
- id->uid = (uid_t)rec_id;
- *id_type = ID_USERID;
- DEBUG(10,("db_internal_get_id_from_sid: fetching uid record %s -> %s \n",
- key.dptr, data.dptr ));
- ret = NT_STATUS_OK;
- } else if (sscanf(data.dptr, "GID %lu", &rec_id) == 1) { /* Try a GID record. */
- id->gid = (uid_t)rec_id;
- *id_type = ID_GROUPID;
- DEBUG(10,("db_internal_get_id_from_sid: fetching gid record %s -> %s \n",
- key.dptr, data.dptr ));
- ret = NT_STATUS_OK;
- } else {
- /* Unknown record type ! */
- ret = NT_STATUS_INTERNAL_DB_ERROR;
- }
-
- SAFE_FREE(data.dptr);
-
-done:
- talloc_free(memctx);
- return ret;
-}
-
-/* Get a sid from an id - internal non-reverse map checking function. */
-
-static NTSTATUS db_get_sid_from_id(DOM_SID *sid, unid_t id, enum idmap_type id_type, int flags)
-{
- NTSTATUS ret;
- unid_t tmp_id;
- enum idmap_type tmp_id_type;
-
- ret = db_internal_get_sid_from_id(sid, id, id_type);
-
- if (!NT_STATUS_IS_OK(ret)) {
- return ret;
- }
-
- /* Ensure the reverse mapping exists. */
-
- ret = db_internal_get_id_from_sid(&tmp_id, &tmp_id_type, sid);
- if (NT_STATUS_IS_OK(ret)) {
- /* Check the reverse mapping is the same. */
- if (tmp_id.uid != id.uid || tmp_id_type != id_type) {
- DEBUG(10,("db_get_sid_from_id: reverse mapping mismatch "
- "tmp_id = %u, id = %u, tmp_id_type = %u, id_type = %u\n",
- (unsigned int)tmp_id.uid, (unsigned int)id.uid,
- (unsigned int)tmp_id_type, (unsigned int)id_type ));
- return NT_STATUS_NO_SUCH_USER;
- }
- }
-
- return ret;
-}
-
-/***********************************************************************
- Why is this function internal and not part of the interface ?????
- This *sucks* and is bad design and needs fixing. JRA.
-***********************************************************************/
-
-static NTSTATUS db_internal_allocate_new_id_for_sid(unid_t *id, enum idmap_type *id_type, const DOM_SID *sid)
-{
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
- TDB_DATA sid_data;
- TDB_DATA ugid_data;
- TALLOC_CTX *memctx;
-
- if ((memctx = talloc_new(NULL)) == NULL) {
- DEBUG(0, ("ERROR: Out of memory!\n"));
- return NT_STATUS_NO_MEMORY;
- }
-
- if ((sid_data.dptr = talloc_asprintf(memctx, "%s", sid_string_static(sid))) == NULL) {
- DEBUG(0, ("ERROR: Out of memory!\n"));
- talloc_free(memctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- sid_data.dsize = strlen(sid_data.dptr) + 1;
-
- /* Lock the record for this SID. */
- if (tdb_chainlock(idmap_tdb, sid_data) != 0) {
- DEBUG(10,("db_internal_allocate_new_id_for_sid: failed to lock record %s. Error %s\n",
- sid_data.dptr, tdb_errorstr(idmap_tdb) ));
- talloc_free(memctx);
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- do {
- /* Allocate a new id for this sid */
- ret = db_allocate_id(id, *id_type);
- if (!NT_STATUS_IS_OK(ret)) {
- goto done;
- }
-
- /* Store the UID side */
- /* Store new id */
- if (*id_type == ID_USERID) {
- ugid_data.dptr = talloc_asprintf(memctx, "UID %lu",
- (unsigned long)((*id).uid));
- } else {
- ugid_data.dptr = talloc_asprintf(memctx, "GID %lu",
- (unsigned long)((*id).gid));
- }
-
- if (ugid_data.dptr == NULL) {
- DEBUG(0, ("ERROR: Out of memory!\n"));
- ret = NT_STATUS_NO_MEMORY;
- goto done;
- }
-
- ugid_data.dsize = strlen(ugid_data.dptr) + 1;
-
- DEBUG(10,("db_internal_allocate_new_id_for_sid: storing %s -> %s\n",
- ugid_data.dptr, sid_data.dptr ));
-
- if (tdb_store(idmap_tdb, ugid_data, sid_data, TDB_INSERT) != -1) {
- ret = NT_STATUS_OK;
- break;
- }
- if (tdb_error(idmap_tdb) != TDB_ERR_EXISTS) {
- DEBUG(10,("db_internal_allocate_new_id_for_sid: error %s\n", tdb_errorstr(idmap_tdb)));
- }
-
- ret = NT_STATUS_INTERNAL_DB_ERROR;
-
- } while (tdb_error(idmap_tdb) == TDB_ERR_EXISTS);
-
- if (NT_STATUS_IS_OK(ret)) {
- DEBUG(10,("db_internal_allocate_new_id_for_sid: storing %s -> %s\n",
- sid_data.dptr, ugid_data.dptr ));
-
- if (tdb_store(idmap_tdb, sid_data, ugid_data, TDB_REPLACE) == -1) {
- DEBUG(10,("db_internal_allocate_new_id_for_sid: error %s\n", tdb_errorstr(idmap_tdb) ));
- ret = NT_STATUS_INTERNAL_DB_ERROR;
- }
- }
-
- done:
-
- tdb_chainunlock(idmap_tdb, sid_data);
- talloc_free(memctx);
-
- return ret;
-}
-
-/***********************************************************************
- Get an id from a sid - urg. This is assuming the *output* parameter id_type
- has been initialized with the correct needed type - ID_USERID or ID_GROUPID.
- This function also allocates new mappings ! WTF ??????
- This *sucks* and is bad design and needs fixing. JRA.
-***********************************************************************/
-
-static NTSTATUS db_get_id_from_sid(unid_t *id, enum idmap_type *id_type, const DOM_SID *sid, int flags)
-{
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
- enum idmap_type tmp_id_type = *id_type;
-
- DEBUG(10,("db_get_id_from_sid %s\n", sid_string_static(sid)));
-
- ret = db_internal_get_id_from_sid(id, &tmp_id_type, sid);
-
- if (NT_STATUS_IS_OK(ret)) {
- DOM_SID sid_tmp;
-
- /* Check the reverse mapping is the same. Remember *id_type was set as a parameter
- to this call... */
- if (tmp_id_type != *id_type) {
- DEBUG(10,("db_get_sid_from_id: sid %s reverse mapping mismatch "
- "tmp_id_type = %u, id_type = %u\n",
- sid_string_static(sid),
- (unsigned int)tmp_id_type, (unsigned int)(*id_type) ));
- return NT_STATUS_NO_SUCH_USER;
- }
-
- ret = db_internal_get_sid_from_id(&sid_tmp, *id, *id_type);
- if (NT_STATUS_IS_OK(ret)) {
- if (!sid_equal(&sid_tmp, sid)) {
- DEBUG(10,("db_get_sid_from_id: sid %s reverse mapping SID mismatch"
- "id = %u, id_type = %u\n",
- sid_string_static(sid),
- (unsigned int)id->uid, (unsigned int)(*id_type) ));
- return NT_STATUS_NO_SUCH_USER;
- }
- }
- return ret;
- }
-
- if (flags & IDMAP_FLAG_QUERY_ONLY) {
- return ret;
- }
-
- /* We're in to bad design territory.... This call is now
- *allocating* and storing a new mapping for sid -> id. This SHOULD
- NOT BE DONE HERE ! There needs to be a separate upper
- level call for this... I think the reason this was badly
- designed this way was the desire to reuse cache code with
- a tdb idmap implementation. They MUST be separated ! JRA */
-
- return db_internal_allocate_new_id_for_sid(id, id_type, sid);
-}
-
-static NTSTATUS db_set_mapping(const DOM_SID *sid, unid_t id, enum idmap_type id_type)
-{
- NTSTATUS ret;
- TDB_DATA ksid, kid, data;
- TALLOC_CTX *memctx;
-
- DEBUG(10,("db_set_mapping: id_type = 0x%x\n", (unsigned int)id_type));
-
- if ((memctx = talloc_new(NULL)) == NULL) {
- DEBUG(0, ("ERROR: Out of memory!\n"));
- return NT_STATUS_NO_MEMORY;
- }
-
- if ((ksid.dptr = talloc_asprintf(memctx, "%s", sid_string_static(sid))) == NULL) {
- DEBUG(0, ("ERROR: Out of memory!\n"));
- ret = NT_STATUS_NO_MEMORY;
- goto done;
- }
- ksid.dsize = strlen(ksid.dptr) + 1;
-
- if (id_type == ID_USERID) {
- kid.dptr = talloc_asprintf(memctx, "UID %lu", (unsigned long)id.uid);
- } else {
- kid.dptr = talloc_asprintf(memctx, "GID %lu", (unsigned long)id.gid);
- }
-
- if (kid.dptr == NULL) {
- DEBUG(0, ("ERROR: Out of memory!\n"));
- ret = NT_STATUS_NO_MEMORY;
- goto done;
- }
- kid.dsize = strlen(kid.dptr) + 1;
-
- /* *DELETE* prevoius mappings if any.
- * This is done both SID and [U|G]ID passed in */
-
- /* Lock the record for this SID. */
- if (tdb_chainlock(idmap_tdb, ksid) != 0) {
- DEBUG(10,("db_set_mapping: failed to lock record %s. Error %s\n",
- ksid.dptr, tdb_errorstr(idmap_tdb) ));
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- DEBUG(10,("db_set_mapping: fetching %s\n", ksid.dptr));
-
- data = tdb_fetch(idmap_tdb, ksid);
- if (data.dptr) {
- DEBUG(10,("db_set_mapping: deleting %s and %s\n", data.dptr, ksid.dptr ));
- tdb_delete(idmap_tdb, data);
- tdb_delete(idmap_tdb, ksid);
- SAFE_FREE(data.dptr);
- }
- data = tdb_fetch(idmap_tdb, kid);
- if (data.dptr) {
- DEBUG(10,("db_set_mapping: deleting %s and %s\n", data.dptr, kid.dptr ));
- tdb_delete(idmap_tdb, data);
- tdb_delete(idmap_tdb, kid);
- SAFE_FREE(data.dptr);
- }
-
- if (tdb_store(idmap_tdb, ksid, kid, TDB_INSERT) == -1) {
- DEBUG(0, ("idb_set_mapping: tdb_store 1 error: %s\n", tdb_errorstr(idmap_tdb)));
- tdb_chainunlock(idmap_tdb, ksid);
- ret = NT_STATUS_UNSUCCESSFUL;
- goto done;
- }
- if (tdb_store(idmap_tdb, kid, ksid, TDB_INSERT) == -1) {
- DEBUG(0, ("idb_set_mapping: tdb_store 2 error: %s\n", tdb_errorstr(idmap_tdb)));
- tdb_chainunlock(idmap_tdb, ksid);
- ret = NT_STATUS_UNSUCCESSFUL;
- goto done;
- }
-
- tdb_chainunlock(idmap_tdb, ksid);
- DEBUG(10,("db_set_mapping: stored %s -> %s and %s -> %s\n", ksid.dptr, kid.dptr, kid.dptr, ksid.dptr ));
- ret = NT_STATUS_OK;
-done:
- talloc_free(memctx);
- return ret;
-}
-
-/*****************************************************************************
- Initialise idmap database.
-*****************************************************************************/
-
-static NTSTATUS db_idmap_init( const char *params )
-{
- SMB_STRUCT_STAT stbuf;
- char *tdbfile = NULL;
- int32 version;
- BOOL tdb_is_new = False;
-
- /* use the old database if present */
- tdbfile = SMB_STRDUP(lock_path("winbindd_idmap.tdb"));
- if (!tdbfile) {
- DEBUG(0, ("idmap_init: out of memory!\n"));
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!file_exist(tdbfile, &stbuf)) {
- tdb_is_new = True;
- }
-
- DEBUG(10,("db_idmap_init: Opening tdbfile %s\n", tdbfile ));
-
- /* Open idmap repository */
- if (!(idmap_tdb = tdb_open_log(tdbfile, 0,
- TDB_DEFAULT, O_RDWR | O_CREAT,
- 0644))) {
- DEBUG(0, ("idmap_init: Unable to open idmap database\n"));
- SAFE_FREE(tdbfile);
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- SAFE_FREE(tdbfile);
-
- if (tdb_is_new) {
- /* the file didn't existed before opening it, let's
- * store idmap version as nobody else yet opened and
- * stored it. I do not like this method but didn't
- * found a way to understand if an opened tdb have
- * been just created or not --- SSS */
- tdb_store_int32(idmap_tdb, "IDMAP_VERSION", IDMAP_VERSION);
- }
-
- /* check against earlier versions */
- version = tdb_fetch_int32(idmap_tdb, "IDMAP_VERSION");
- if (version != IDMAP_VERSION) {
- DEBUG(0, ("idmap_init: Unable to open idmap database, it's in an old format!\n"));
- return NT_STATUS_INTERNAL_DB_ERROR;
- }
-
- /* Create high water marks for group and user id */
- if (!lp_idmap_uid(&idmap_state.uid_low, &idmap_state.uid_high)) {
- DEBUG(1, ("idmap uid range missing or invalid\n"));
- DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
- } else {
- if (tdb_fetch_int32(idmap_tdb, HWM_USER) == -1) {
- if (tdb_store_int32(idmap_tdb, HWM_USER, idmap_state.uid_low) == -1) {
- DEBUG(0, ("idmap_init: Unable to initialise user hwm in idmap database\n"));
- return NT_STATUS_INTERNAL_DB_ERROR;
- }
- }
- }
-
- if (!lp_idmap_gid(&idmap_state.gid_low, &idmap_state.gid_high)) {
- DEBUG(1, ("idmap gid range missing or invalid\n"));
- DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
- } else {
- if (tdb_fetch_int32(idmap_tdb, HWM_GROUP) == -1) {
- if (tdb_store_int32(idmap_tdb, HWM_GROUP, idmap_state.gid_low) == -1) {
- DEBUG(0, ("idmap_init: Unable to initialise group hwm in idmap database\n"));
- return NT_STATUS_INTERNAL_DB_ERROR;
- }
- }
- }
-
- return NT_STATUS_OK;
-}
-
-/* Close the tdb */
-static NTSTATUS db_idmap_close(void)
-{
- if (idmap_tdb) {
- if (tdb_close(idmap_tdb) == 0) {
- return NT_STATUS_OK;
- } else {
- return NT_STATUS_UNSUCCESSFUL;
- }
- }
- return NT_STATUS_OK;
-}
-
-
-/* Dump status information to log file. Display different stuff based on
- the debug level:
-
- Debug Level Information Displayed
- =================================================================
- 0 Percentage of [ug]id range allocated
- 0 High water marks (next allocated ids)
-*/
-
-#define DUMP_INFO 0
-
-static void db_idmap_status(void)
-{
- int user_hwm, group_hwm;
-
- DEBUG(0, ("winbindd idmap status:\n"));
-
- /* Get current high water marks */
-
- if ((user_hwm = tdb_fetch_int32(idmap_tdb, HWM_USER)) == -1) {
- DEBUG(DUMP_INFO,
- ("\tCould not get userid high water mark!\n"));
- }
-
- if ((group_hwm = tdb_fetch_int32(idmap_tdb, HWM_GROUP)) == -1) {
- DEBUG(DUMP_INFO,
- ("\tCould not get groupid high water mark!\n"));
- }
-
- /* Display next ids to allocate */
-
- if (user_hwm != -1) {
- DEBUG(DUMP_INFO,
- ("\tNext userid to allocate is %d\n", user_hwm));
- }
-
- if (group_hwm != -1) {
- DEBUG(DUMP_INFO,
- ("\tNext groupid to allocate is %d\n", group_hwm));
- }
-
- /* Display percentage of id range already allocated. */
-
- if (user_hwm != -1) {
- int num_users = user_hwm - idmap_state.uid_low;
- int total_users =
- idmap_state.uid_high - idmap_state.uid_low;
-
- DEBUG(DUMP_INFO,
- ("\tUser id range is %d%% full (%d of %d)\n",
- num_users * 100 / total_users, num_users,
- total_users));
- }
-
- if (group_hwm != -1) {
- int num_groups = group_hwm - idmap_state.gid_low;
- int total_groups =
- idmap_state.gid_high - idmap_state.gid_low;
-
- DEBUG(DUMP_INFO,
- ("\tGroup id range is %d%% full (%d of %d)\n",
- num_groups * 100 / total_groups, num_groups,
- total_groups));
- }
-
- /* Display complete mapping of users and groups to rids */
-}
-
-/**********************************************************************
- Return the TDB_CONTEXT* for winbindd_idmap. I **really** feel
- dirty doing this, but not so dirty that I want to create another
- tdb
-***********************************************************************/
-
-TDB_CONTEXT *idmap_tdb_handle( void )
-{
- if ( idmap_tdb )
- return idmap_tdb;
-
- /* go ahead an open it; db_idmap_init() doesn't use any params
- right now */
-
- db_idmap_init( NULL );
- if ( idmap_tdb )
- return idmap_tdb;
-
- return NULL;
-}
-
-static struct idmap_methods db_methods = {
-
- db_idmap_init,
- db_allocate_id,
- db_get_sid_from_id,
- db_get_id_from_sid,
- db_set_mapping,
- db_idmap_close,
- db_idmap_status
-
-};
-
-NTSTATUS idmap_tdb_init(void)
-{
- return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "tdb", &db_methods);
-}
+++ /dev/null
-/*
- Unix SMB/CIFS implementation.
- ID Mapping
- Copyright (C) Simo Sorce 2003
- Copyright (C) Jeremy Allison 2006
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/
-
-#include "includes.h"
-
-#undef DBGC_CLASS
-#define DBGC_CLASS DBGC_IDMAP
-
-/*****************************************************************
- Returns SID pointer.
-*****************************************************************/
-
-NTSTATUS idmap_uid_to_sid(DOM_SID *sid, uid_t uid, int flags)
-{
- unid_t id;
-
- DEBUG(10,("idmap_uid_to_sid: uid = [%lu]\n", (unsigned long)uid));
-
- id.uid = uid;
-
- return idmap_get_sid_from_id(sid, id, ID_USERID, flags);
-}
-
-/*****************************************************************
- Group mapping is used for gids that maps to Wellknown SIDs
- Returns SID pointer.
-*****************************************************************/
-
-NTSTATUS idmap_gid_to_sid(DOM_SID *sid, gid_t gid, int flags)
-{
- unid_t id;
-
- DEBUG(10,("idmap_gid_to_sid: gid = [%lu]\n", (unsigned long)gid));
-
- id.gid = gid;
-
- return idmap_get_sid_from_id(sid, id, ID_GROUPID, flags);
-}
-
-/*****************************************************************
- if it is a foreign sid or it is in idmap rid range check idmap,
- otherwise falls back to the legacy algorithmic mapping.
- Returns True if this name is a user sid and the conversion
- was done correctly, False if not.
-*****************************************************************/
-
-NTSTATUS idmap_sid_to_uid(const DOM_SID *sid, uid_t *uid, int flags)
-{
- NTSTATUS ret;
- enum idmap_type id_type;
- unid_t id;
-
- DEBUG(10,("idmap_sid_to_uid: sid = [%s]\n", sid_string_static(sid)));
-
- /* For the LDAP and tdb backends we must *KNOW* what we're looking for.
- This interface design *SUCKS* ! JRA. */
-
- id_type = ID_USERID;
- ret = idmap_get_id_from_sid(&id, &id_type, sid, flags);
-
- if (!NT_STATUS_IS_OK(ret)) {
- return ret;
- }
-
- if (id_type != ID_USERID) {
- return NT_STATUS_NONE_MAPPED;
- }
-
- DEBUG(10,("idmap_sid_to_uid: uid = [%lu]\n", (unsigned long)id.uid));
- *uid = id.uid;
-
- return NT_STATUS_OK;
-}
-
-/*****************************************************************
- *THE CANONICAL* convert SID to gid function.
- if it is a foreign sid or it is in idmap rid range check idmap,
- otherwise falls back to the legacy algorithmic mapping.
- Group mapping is used for gids that maps to Wellknown SIDs
- Returns True if this name is a user sid and the conversion
- was done correctly, False if not.
-*****************************************************************/
-
-NTSTATUS idmap_sid_to_gid(const DOM_SID *sid, gid_t *gid, int flags)
-{
- NTSTATUS ret;
- enum idmap_type id_type;
- unid_t id;
-
- DEBUG(10,("sid_to_gid: sid = [%s]\n", sid_string_static(sid)));
-
- /* For the LDAP and tdb backends we must *KNOW* what we're looking for.
- This interface design *SUCKS* ! JRA. */
-
- id_type = ID_GROUPID;
- ret = idmap_get_id_from_sid(&id, &id_type, sid, flags);
-
- if (!NT_STATUS_IS_OK(ret)) {
- return ret;
- }
-
- if (id_type != ID_GROUPID) {
- return NT_STATUS_NONE_MAPPED;
- }
-
- DEBUG(10,("idmap_sid_to_gid: gid = [%lu]\n", (unsigned long)id.gid));
- *gid = id.gid;
-
- return NT_STATUS_OK;
-}
{"SETDOMAINSID", net_setdomainsid},
{"GETDOMAINSID", net_getdomainsid},
{"MAXRID", net_maxrid},
- {"IDMAP", net_idmap},
+ {"IDMAP", net_idmap},
{"STATUS", net_status},
{"USERSHARE", net_usershare},
{"USERSIDLIST", net_usersidlist},
#include "includes.h"
#include "utils/net.h"
-
-/***********************************************************
- Helper function for net_idmap_dump. Dump one entry.
- **********************************************************/
-static int net_idmap_dump_one_entry(TDB_CONTEXT *tdb,
- TDB_DATA key,
- TDB_DATA data,
- void *unused)
-{
- if (strcmp(key.dptr, "USER HWM") == 0) {
- printf("USER HWM %d\n", IVAL(data.dptr,0));
- return 0;
- }
-
- if (strcmp(key.dptr, "GROUP HWM") == 0) {
- printf("GROUP HWM %d\n", IVAL(data.dptr,0));
- return 0;
- }
-
- if (strncmp(key.dptr, "S-", 2) != 0)
- return 0;
-
- printf("%s %s\n", data.dptr, key.dptr);
- return 0;
-}
+#define ALLOC_CHECK(mem) do { \
+ if (!mem) { \
+ d_fprintf(stderr, "Out of memory!\n"); \
+ talloc_free(ctx); \
+ return -1; \
+ } } while(0)
/***********************************************************
Dump the current idmap
**********************************************************/
static int net_idmap_dump(int argc, const char **argv)
{
- TDB_CONTEXT *idmap_tdb;
-
- if ( argc != 1 )
- return net_help_idmap( argc, argv );
-
- idmap_tdb = tdb_open_log(argv[0], 0, TDB_DEFAULT, O_RDONLY, 0);
-
- if (idmap_tdb == NULL) {
- d_fprintf(stderr, "Could not open idmap: %s\n", argv[0]);
- return -1;
- }
-
- tdb_traverse(idmap_tdb, net_idmap_dump_one_entry, NULL);
-
- tdb_close(idmap_tdb);
-
- return 0;
-}
-
-/***********************************************************
- Fix up the HWMs after a idmap restore.
- **********************************************************/
-
-struct hwms {
- BOOL ok;
- uid_t user_hwm;
- gid_t group_hwm;
-};
-
-static int net_idmap_find_max_id(TDB_CONTEXT *tdb, TDB_DATA key, TDB_DATA data,
- void *handle)
-{
- struct hwms *hwms = (struct hwms *)handle;
- void *idptr = NULL;
- BOOL isgid = False;
- int id;
+ TALLOC_CTX *ctx;
+ char *filename;
- if (strncmp(key.dptr, "S-", 2) != 0)
- return 0;
-
- if (sscanf(data.dptr, "GID %d", &id) == 1) {
- idptr = (void *)&hwms->group_hwm;
- isgid = True;
- }
-
- if (sscanf(data.dptr, "UID %d", &id) == 1) {
- idptr = (void *)&hwms->user_hwm;
- isgid = False;
+ if (argc != 1) {
+ return net_help_idmap(argc, argv);
}
- if (idptr == NULL) {
- d_fprintf(stderr, "Illegal idmap entry: [%s]->[%s]\n",
- key.dptr, data.dptr);
- hwms->ok = False;
+ if (! winbind_ping()) {
+ d_fprintf(stderr, "To use net idmap Winbindd must be running.\n");
return -1;
}
- if (isgid) {
- if (hwms->group_hwm <= (gid_t)id) {
- hwms->group_hwm = (gid_t)(id+1);
+ ctx = talloc_new(NULL);
+ ALLOC_CHECK(ctx);
+
+ filename = talloc_strdup(ctx, argv[0]);
+ ALLOC_CHECK(filename);
+
+ /* filename must be absolute */
+ if (*filename != '/') {
+ char path[4096];
+
+ filename = getcwd(path, 4095);
+ if ( ! filename) {
+ d_fprintf(stderr, "Failed to obtain full output file path");
+ talloc_free(ctx);
+ return -1;
}
- } else {
- if (hwms->user_hwm <= (uid_t)id) {
- hwms->user_hwm = (uid_t)(id+1);
- }
- }
-
- return 0;
-}
-static NTSTATUS net_idmap_fixup_hwm(void)
-{
- NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
- TDB_CONTEXT *idmap_tdb;
- char *tdbfile = NULL;
-
- struct hwms hwms;
- struct hwms highest;
-
- if (!lp_idmap_uid(&hwms.user_hwm, &highest.user_hwm) ||
- !lp_idmap_gid(&hwms.group_hwm, &highest.group_hwm)) {
- d_fprintf(stderr, "idmap range missing\n");
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- tdbfile = SMB_STRDUP(lock_path("winbindd_idmap.tdb"));
- if (!tdbfile) {
- DEBUG(0, ("idmap_init: out of memory!\n"));
- return NT_STATUS_NO_MEMORY;
- }
-
- idmap_tdb = tdb_open_log(tdbfile, 0, TDB_DEFAULT, O_RDWR, 0);
-
- if (idmap_tdb == NULL) {
- d_fprintf(stderr, "Could not open idmap: %s\n", tdbfile);
- return NT_STATUS_NO_SUCH_FILE;
- }
-
- hwms.ok = True;
-
- tdb_traverse(idmap_tdb, net_idmap_find_max_id, &hwms);
-
- if (!hwms.ok) {
- goto done;
+ filename = talloc_asprintf(ctx, "%s/%s", path, argv[0]);
+ ALLOC_CHECK(filename);
}
- d_printf("USER HWM: %d GROUP HWM: %d\n",
- hwms.user_hwm, hwms.group_hwm);
-
- if (hwms.user_hwm >= highest.user_hwm) {
- d_fprintf(stderr, "Highest UID out of uid range\n");
- goto done;
- }
-
- if (hwms.group_hwm >= highest.group_hwm) {
- d_fprintf(stderr, "Highest GID out of gid range\n");
- goto done;
- }
-
- if ((tdb_store_int32(idmap_tdb, "USER HWM", (int32)hwms.user_hwm) != 0) ||
- (tdb_store_int32(idmap_tdb, "GROUP HWM", (int32)hwms.group_hwm) != 0)) {
- d_fprintf(stderr, "Could not store HWMs\n");
- goto done;
+ if ( ! winbind_idmap_dump_maps(ctx, filename)) {
+ d_fprintf(stderr, "Failed to obtain idmap data from winbindd\n");
+ talloc_free(ctx);
+ return -1;
}
- result = NT_STATUS_OK;
- done:
- tdb_close(idmap_tdb);
- return result;
+ talloc_free(ctx);
+ return 0;
}
/***********************************************************
static int net_idmap_restore(int argc, const char **argv)
{
- if (!idmap_init(lp_idmap_backend())) {
- d_fprintf(stderr, "Could not init idmap\n");
+ TALLOC_CTX *ctx;
+ FILE *input;
+
+ if (! winbind_ping()) {
+ d_fprintf(stderr, "To use net idmap Winbindd must be running.\n");
return -1;
}
- while (!feof(stdin)) {
- fstring line, sid_string, fmt_string1, fmt_string2;
+ ctx = talloc_new(NULL);
+ ALLOC_CHECK(ctx);
+
+ if (argc == 1) {
+ input = fopen(argv[0], "r");
+ } else {
+ input = stdin;
+ }
+
+ while (!feof(input)) {
+ char line[128], sid_string[128];
int len;
- unid_t id;
- enum idmap_type type;
- unsigned long idval;
DOM_SID sid;
+ struct id_map map;
+ unsigned long idval;
- if (fgets(line, sizeof(line)-1, stdin) == NULL)
+ if (fgets(line, 127, input) == NULL)
break;
len = strlen(line);
if ( (len > 0) && (line[len-1] == '\n') )
line[len-1] = '\0';
- snprintf(fmt_string1, sizeof(fmt_string1), "GID %%ul %%%us", FSTRING_LEN);
- snprintf(fmt_string2, sizeof(fmt_string2), "UID %%ul %%%us", FSTRING_LEN);
-
- if (sscanf(line, fmt_string1, &idval, sid_string) == 2) {
- type = ID_GROUPID;
- id.gid = (gid_t)idval;
- } else if (sscanf(line, fmt_string2, &idval, sid_string) == 2) {
- type = ID_USERID;
- id.uid = (uid_t)idval;
+ if (sscanf(line, "GID %lu %128s", &idval, sid_string) == 2) {
+ map.xid.type = ID_TYPE_GID;
+ map.xid.id = idval;
+ } else if (sscanf(line, "UID %lu %128s", &idval, sid_string) == 2) {
+ map.xid.type = ID_TYPE_UID;
+ map.xid.id = idval;
+ } else if (sscanf(line, "USER HWM %lu", &idval) == 1) {
+ /* set uid hwm */
+ if (! winbind_set_uid_hwm(idval)) {
+ d_fprintf(stderr, "Could not set USER HWM\n");
+ }
+ continue;
+ } else if (sscanf(line, "GROUP HWM %lu", &idval) == 1) {
+ /* set gid hwm */
+ if (! winbind_set_gid_hwm(idval)) {
+ d_fprintf(stderr, "Could not set GROUP HWM\n");
+ }
+ continue;
} else {
- d_printf("ignoring invalid line [%s]\n", line);
+ d_fprintf(stderr, "ignoring invalid line [%s]\n", line);
continue;
}
if (!string_to_sid(&sid, sid_string)) {
- d_printf("ignoring invalid sid [%s]\n", sid_string);
+ d_fprintf(stderr, "ignoring invalid sid [%s]\n", sid_string);
continue;
}
+ map.sid = &sid;
- if (!NT_STATUS_IS_OK(idmap_set_mapping(&sid, id, type))) {
+ if (!winbind_set_mapping(&map)) {
d_fprintf(stderr, "Could not set mapping of %s %lu to sid %s\n",
- (type == ID_GROUPID) ? "GID" : "UID",
- (type == ID_GROUPID) ? (unsigned long)id.gid:
- (unsigned long)id.uid,
- sid_string_static(&sid));
+ (map.xid.type == ID_TYPE_GID) ? "GID" : "UID",
+ (unsigned long)map.xid.id, sid_string_static(map.sid));
continue;
}
-
+
}
- idmap_close();
+ if (input != stdin) {
+ fclose(input);
+ }
- return NT_STATUS_IS_OK(net_idmap_fixup_hwm()) ? 0 : -1;
+ talloc_free(ctx);
+ return 0;
}
/***********************************************************
**********************************************************/
static int net_idmap_delete(int argc, const char **argv)
{
- TDB_CONTEXT *idmap_tdb;
- TDB_DATA key, data;
- fstring sid;
-
- if (argc != 2)
- return net_help_idmap(argc, argv);
+ d_printf("Not Implemented yet\n");
+ return -1;
+}
- idmap_tdb = tdb_open_log(argv[0], 0, TDB_DEFAULT, O_RDWR, 0);
+static int net_idmap_set(int argc, const char **argv)
+{
+ d_printf("Not Implemented yet\n");
+ return -1;
+}
+BOOL idmap_store_secret(const char *backend, bool alloc,
+ const char *domain, const char *identity,
+ const char *secret)
+{
+ char *tmp;
+ int r;
+ BOOL ret;
- if (idmap_tdb == NULL) {
- d_fprintf(stderr, "Could not open idmap: %s\n", argv[0]);
- return -1;
+ if (alloc) {
+ r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
+ } else {
+ r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
}
- fstrcpy(sid, argv[1]);
+ if (r < 0) return false;
- if (strncmp(sid, "S-1-5-", strlen("S-1-5-")) != 0) {
- d_fprintf(stderr, "Can only delete SIDs, %s is does not start with "
- "S-1-5-\n", sid);
- return -1;
+ strupper_m(tmp); /* make sure the key is case insensitive */
+ ret = secrets_store_generic(tmp, identity, secret);
+
+ free(tmp);
+ return ret;
+}
+
+
+static int net_idmap_secret(int argc, const char **argv)
+{
+ TALLOC_CTX *ctx;
+ const char *secret;
+ const char *dn;
+ char *domain;
+ char *backend;
+ char *opt = NULL;
+ BOOL ret;
+
+ if (argc != 2) {
+ return net_help_idmap(argc, argv);
}
- key.dptr = sid;
- key.dsize = strlen(key.dptr)+1;
+ secret = argv[1];
- data = tdb_fetch(idmap_tdb, key);
+ ctx = talloc_new(NULL);
+ ALLOC_CHECK(ctx);
- if (data.dptr == NULL) {
- d_fprintf(stderr, "Could not find sid %s\n", argv[1]);
- return -1;
+ if (strcmp(argv[0], "alloc") == 0) {
+ domain = NULL;
+ backend = lp_idmap_alloc_backend();
+ } else {
+ domain = talloc_strdup(ctx, argv[0]);
+ ALLOC_CHECK(domain);
+
+ opt = talloc_asprintf(ctx, "idmap config %s", domain);
+ ALLOC_CHECK(opt);
+
+ backend = talloc_strdup(ctx, lp_parm_const_string(-1, opt, "backend", "tdb"));
+ ALLOC_CHECK(backend);
}
- if (tdb_delete(idmap_tdb, key) != 0) {
- d_fprintf(stderr, "Could not delete key %s\n", argv[1]);
+ if ( ( ! backend) || ( ! strequal(backend, "ldap"))) {
+ d_fprintf(stderr, "The only currently supported backend is LDAP\n");
+ talloc_free(ctx);
return -1;
}
- if (tdb_delete(idmap_tdb, data) != 0) {
- d_fprintf(stderr, "Could not delete key %s\n", data.dptr);
+ if (domain) {
+
+ dn = lp_parm_const_string(-1, opt, "ldap_user_dn", NULL);
+ if ( ! dn) {
+ d_fprintf(stderr, "Missing ldap_user_dn option for domain %s\n", domain);
+ talloc_free(ctx);
+ return -1;
+ }
+
+ ret = idmap_store_secret("ldap", false, domain, dn, secret);
+ } else {
+ dn = lp_parm_const_string(-1, "idmap alloc config", "ldap_user_dn", NULL);
+ if ( ! dn) {
+ d_fprintf(stderr, "Missing ldap_user_dn option for alloc backend\n");
+ talloc_free(ctx);
+ return -1;
+ }
+
+ ret = idmap_store_secret("ldap", true, NULL, dn, secret);
+ }
+
+ if ( ! ret) {
+ d_fprintf(stderr, "Failed to store secret\n");
+ talloc_free(ctx);
return -1;
}
+ d_printf("Secret stored\n");
return 0;
}
-
int net_help_idmap(int argc, const char **argv)
{
- d_printf("net idmap dump <tdbfile>"\
- "\n Dump current id mapping\n");
+ d_printf("net idmap dump <outputfile>\n"\
+ " Dump current id mapping\n");
- d_printf("net idmap restore"\
- "\n Restore entries from stdin to current local idmap\n");
+ d_printf("net idmap restore\n"\
+ " Restore entries from stdin\n");
/* Deliberately *not* document net idmap delete */
+ d_printf("net idmap secret <DOMAIN>|alloc <secret>\n"\
+ " Set the secret for the specified DOMAIN (or the alloc module)\n");
+
return -1;
}
struct functable func[] = {
{"dump", net_idmap_dump},
{"restore", net_idmap_restore},
+ {"setmap", net_idmap_set },
{"delete", net_idmap_delete},
+ {"secret", net_idmap_secret},
{"help", net_help_idmap},
{NULL, NULL}
};
git.samba.org / kamenim / samba-autobuild / .git / commitdiff