BOOL lookup_name(TALLOC_CTX *mem_ctx,
const char *full_name, int flags,
const char **ret_domain, const char **ret_name,
- DOM_SID *ret_sid, enum SID_NAME_USE *ret_type)
+ DOM_SID *ret_sid, enum lsa_SidType *ret_type)
{
char *p;
const char *tmp;
const char *name = NULL;
uint32 rid;
DOM_SID sid;
- enum SID_NAME_USE type;
+ enum lsa_SidType type;
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
- struct group *grp;
if (tmp_ctx == NULL) {
DEBUG(0, ("talloc_new failed\n"));
name = talloc_strdup(tmp_ctx, full_name);
}
+ DEBUG(10,("lookup_name: %s => %s (domain), %s (name)\n",
+ full_name, domain, name));
+
if ((domain == NULL) || (name == NULL)) {
DEBUG(0, ("talloc failed\n"));
+ TALLOC_FREE(tmp_ctx);
return False;
}
sid_append_rid(&sid, rid);
goto ok;
}
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return False;
}
if (strequal(domain, builtin_domain_name())) {
type = SID_NAME_ALIAS;
goto ok;
}
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return False;
}
/* Try the explicit winbind lookup first, don't let it guess the
goto ok;
}
- if (strequal(domain, unix_users_domain_name())) {
+ if (!(flags & LOOKUP_NAME_EXPLICIT) && strequal(domain, unix_users_domain_name())) {
if (lookup_unix_user_name(name, &sid)) {
type = SID_NAME_USER;
goto ok;
}
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return False;
}
- if (strequal(domain, unix_groups_domain_name())) {
+ if (!(flags & LOOKUP_NAME_EXPLICIT) && strequal(domain, unix_groups_domain_name())) {
if (lookup_unix_group_name(name, &sid)) {
type = SID_NAME_DOM_GRP;
goto ok;
}
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return False;
}
if ((domain[0] == '\0') && (!(flags & LOOKUP_NAME_ISOLATED))) {
- goto failed;
- }
-
- /*
- * Nasty hack necessary for too common scenarios:
- *
- * For 'valid users = +users' we know "users" is most probably not
- * BUILTIN\users but the unix group users. This hack requires the
- * admin to explicitly qualify BUILTIN if BUILTIN\users is meant.
- *
- * Please note that LOOKUP_NAME_GROUP can not be requested via for
- * example lsa_lookupnames, it only comes into this routine via
- * the expansion of group names coming in from smb.conf
- */
-
- if ((flags & LOOKUP_NAME_GROUP) && ((grp = getgrnam(name)) != NULL)) {
-
- GROUP_MAP map;
-
- if (pdb_getgrgid(&map, grp->gr_gid)) {
- /* The hack gets worse. Handle the case where we have
- * 'force group = +unixgroup' but "unixgroup" has a
- * group mapping */
-
- if (sid_check_is_in_builtin(&map.sid)) {
- domain = talloc_strdup(
- tmp_ctx, builtin_domain_name());
- } else {
- domain = talloc_strdup(
- tmp_ctx, get_global_sam_name());
- }
-
- sid_copy(&sid, &map.sid);
- type = map.sid_name_use;
- goto ok;
- }
-
- /* If we are using the smbpasswd backend, we need to use the
- * algorithmic mapping for the unix group we find. This is
- * necessary because when creating the NT token from the unix
- * gid list we got from initgroups() we use gid_to_sid() that
- * uses algorithmic mapping if pdb_rid_algorithm() is true. */
-
- if (pdb_rid_algorithm() &&
- (grp->gr_gid < max_algorithmic_gid())) {
- domain = talloc_strdup(tmp_ctx, get_global_sam_name());
- sid_compose(&sid, get_global_sam_sid(),
- pdb_gid_to_group_rid(grp->gr_gid));
- type = SID_NAME_DOM_GRP;
- goto ok;
- }
-
- if (lookup_unix_group_name(name, &sid)) {
- domain = talloc_strdup(tmp_ctx,
- unix_groups_domain_name());
- type = SID_NAME_DOM_GRP;
- goto ok;
- }
+ TALLOC_FREE(tmp_ctx);
+ return False;
}
/* Now the guesswork begins, we haven't been given an explicit
if (strequal(name, get_global_sam_name())) {
if (!secrets_fetch_domain_sid(name, &sid)) {
DEBUG(3, ("Could not fetch my SID\n"));
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return False;
}
/* Swap domain and name */
tmp = name; name = domain; domain = tmp;
if (!IS_DC && strequal(name, lp_workgroup())) {
if (!secrets_fetch_domain_sid(name, &sid)) {
DEBUG(3, ("Could not fetch the domain SID\n"));
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return False;
}
/* Swap domain and name */
tmp = name; name = domain; domain = tmp;
/* 5. Trusted domains as such, to me it looks as if members don't do
this, tested an XP workstation in a NT domain -- vl */
- if (IS_DC && (secrets_fetch_trusted_domain_password(name, NULL,
- &sid, NULL))) {
+ if (IS_DC && (pdb_get_trusteddom_pw(name, NULL, &sid, NULL))) {
/* Swap domain and name */
tmp = name; name = domain; domain = tmp;
type = SID_NAME_DOMAIN;
/* Now our local possibilities are exhausted. */
if (!(flags & LOOKUP_NAME_REMOTE)) {
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return False;
}
/* If we are not a DC, we have to ask in our primary domain. Let
if (IS_DC && winbind_lookup_name("", name, &sid, &type)) {
DOM_SID dom_sid;
uint32 tmp_rid;
- enum SID_NAME_USE domain_type;
+ enum lsa_SidType domain_type;
if (type == SID_NAME_DOMAIN) {
/* Swap name and type */
(domain_type != SID_NAME_DOMAIN)) {
DEBUG(2, ("winbind could not find the domain's name "
"it just looked up for us\n"));
- goto failed;
+ TALLOC_FREE(tmp_ctx);
+ return False;
}
goto ok;
}
/* 11. Ok, windows would end here. Samba has two more options:
Unmapped users and unmapped groups */
- if (lookup_unix_user_name(name, &sid)) {
+ if (!(flags & LOOKUP_NAME_EXPLICIT) && lookup_unix_user_name(name, &sid)) {
domain = talloc_strdup(tmp_ctx, unix_users_domain_name());
type = SID_NAME_USER;
goto ok;
}
- if (lookup_unix_group_name(name, &sid)) {
+ if (!(flags & LOOKUP_NAME_EXPLICIT) && lookup_unix_group_name(name, &sid)) {
domain = talloc_strdup(tmp_ctx, unix_groups_domain_name());
type = SID_NAME_DOM_GRP;
goto ok;
}
- failed:
+ /*
+ * Ok, all possibilities tried. Fail.
+ */
+
TALLOC_FREE(tmp_ctx);
return False;
return False;
}
- if (ret_name != NULL) {
- *ret_name = talloc_steal(mem_ctx, name);
+ /*
+ * Hand over the results to the talloc context we've been given.
+ */
+
+ if ((ret_name != NULL) &&
+ !(*ret_name = talloc_strdup(mem_ctx, name))) {
+ DEBUG(0, ("talloc failed\n"));
+ TALLOC_FREE(tmp_ctx);
+ return False;
}
if (ret_domain != NULL) {
- char *tmp_dom = talloc_strdup(tmp_ctx, domain);
+ char *tmp_dom;
+ if (!(tmp_dom = talloc_strdup(mem_ctx, domain))) {
+ DEBUG(0, ("talloc failed\n"));
+ TALLOC_FREE(tmp_ctx);
+ return False;
+ }
strupper_m(tmp_dom);
- *ret_domain = talloc_steal(mem_ctx, tmp_dom);
+ *ret_domain = tmp_dom;
}
if (ret_sid != NULL) {
return True;
}
-static BOOL winbind_lookup_rids(TALLOC_CTX *mem_ctx,
- const DOM_SID *domain_sid,
- int num_rids, uint32 *rids,
- const char **domain_name,
- const char **names, enum SID_NAME_USE *types)
+/************************************************************************
+ Names from smb.conf can be unqualified. eg. valid users = foo
+ These names should never map to a remote name. Try global_sam_name()\foo,
+ and then "Unix Users"\foo (or "Unix Groups"\foo).
+************************************************************************/
+
+BOOL lookup_name_smbconf(TALLOC_CTX *mem_ctx,
+ const char *full_name, int flags,
+ const char **ret_domain, const char **ret_name,
+ DOM_SID *ret_sid, enum lsa_SidType *ret_type)
{
- /* Unless the winbind interface is upgraded, fall back to ask for
- * individual sids. I imagine introducing a lookuprids operation that
- * directly proxies to lsa_lookupsids to the correct DC. -- vl */
+ char *qualified_name;
+ const char *p;
- int i;
- for (i=0; i<num_rids; i++) {
- DOM_SID sid;
+ /* NB. No winbindd_separator here as lookup_name needs \\' */
+ if ((p = strchr_m(full_name, *lp_winbind_separator())) != NULL) {
+
+ /* The name is already qualified with a domain. */
+
+ if (*lp_winbind_separator() != '\\') {
+ char *tmp;
- sid_copy(&sid, domain_sid);
- sid_append_rid(&sid, rids[i]);
+ /* lookup_name() needs '\\' as a separator */
- if (winbind_lookup_sid(mem_ctx, &sid,
- *domain_name == NULL ?
- domain_name : NULL,
- &names[i], &types[i])) {
- if ((names[i] == NULL) || ((*domain_name) == NULL)) {
+ tmp = talloc_strdup(mem_ctx, full_name);
+ if (!tmp) {
return False;
}
- } else {
+ tmp[p - full_name] = '\\';
+ full_name = tmp;
+ }
+
+ return lookup_name(mem_ctx, full_name, flags,
+ ret_domain, ret_name,
+ ret_sid, ret_type);
+ }
+
+ /* Try with our own SAM name. */
+ qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
+ get_global_sam_name(),
+ full_name );
+ if (!qualified_name) {
+ return False;
+ }
+
+ if (lookup_name(mem_ctx, qualified_name, flags,
+ ret_domain, ret_name,
+ ret_sid, ret_type)) {
+ return True;
+ }
+
+ /* Finally try with "Unix Users" or "Unix Group" */
+ qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
+ flags & LOOKUP_NAME_GROUP ?
+ unix_groups_domain_name() :
+ unix_users_domain_name(),
+ full_name );
+ if (!qualified_name) {
+ return False;
+ }
+
+ return lookup_name(mem_ctx, qualified_name, flags,
+ ret_domain, ret_name,
+ ret_sid, ret_type);
+}
+
+static BOOL wb_lookup_rids(TALLOC_CTX *mem_ctx,
+ const DOM_SID *domain_sid,
+ int num_rids, uint32 *rids,
+ const char **domain_name,
+ const char **names, enum lsa_SidType *types)
+{
+ int i;
+ const char **my_names;
+ enum lsa_SidType *my_types;
+ TALLOC_CTX *tmp_ctx;
+
+ if (!(tmp_ctx = talloc_init("wb_lookup_rids"))) {
+ return False;
+ }
+
+ if (!winbind_lookup_rids(tmp_ctx, domain_sid, num_rids, rids,
+ domain_name, &my_names, &my_types)) {
+ *domain_name = "";
+ for (i=0; i<num_rids; i++) {
+ names[i] = "";
types[i] = SID_NAME_UNKNOWN;
}
+ TALLOC_FREE(tmp_ctx);
+ return True;
}
+
+ if (!(*domain_name = talloc_strdup(mem_ctx, *domain_name))) {
+ TALLOC_FREE(tmp_ctx);
+ return False;
+ }
+
+ /*
+ * winbind_lookup_rids allocates its own array. We've been given the
+ * array, so copy it over
+ */
+
+ for (i=0; i<num_rids; i++) {
+ if (my_names[i] == NULL) {
+ TALLOC_FREE(tmp_ctx);
+ return False;
+ }
+ if (!(names[i] = talloc_strdup(names, my_names[i]))) {
+ TALLOC_FREE(tmp_ctx);
+ return False;
+ }
+ types[i] = my_types[i];
+ }
+ TALLOC_FREE(tmp_ctx);
return True;
}
static BOOL lookup_rids(TALLOC_CTX *mem_ctx, const DOM_SID *domain_sid,
int num_rids, uint32_t *rids,
const char **domain_name,
- const char ***names, enum SID_NAME_USE **types)
+ const char ***names, enum lsa_SidType **types)
{
int i;
- *names = TALLOC_ARRAY(mem_ctx, const char *, num_rids);
- *types = TALLOC_ARRAY(mem_ctx, enum SID_NAME_USE, num_rids);
+ if (num_rids) {
+ *names = TALLOC_ARRAY(mem_ctx, const char *, num_rids);
+ *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
- if ((*names == NULL) || (*types == NULL)) {
- return False;
+ if ((*names == NULL) || (*types == NULL)) {
+ return False;
+ }
+ } else {
+ *names = NULL;
+ *types = NULL;
}
if (sid_check_is_domain(domain_sid)) {
return True;
}
- return winbind_lookup_rids(mem_ctx, domain_sid, num_rids, rids,
- domain_name, *names, *types);
+ return wb_lookup_rids(mem_ctx, domain_sid, num_rids, rids,
+ domain_name, *names, *types);
}
/*
const char **name)
{
const char *tmp;
- enum SID_NAME_USE type;
+ enum lsa_SidType type;
if (sid_check_is_domain(sid)) {
*name = talloc_strdup(mem_ctx, get_global_sam_name());
* and for SIDs that have 4 sub-authorities and thus look like
* domains */
- if (!NT_STATUS_IS_OK(secrets_trusted_domains(mem_ctx,
- &num_domains,
- &domains))) {
+ if (!NT_STATUS_IS_OK(pdb_enum_trusteddoms(mem_ctx,
+ &num_domains,
+ &domains))) {
return False;
}
* Level 2: Ask domain and trusted domains, no builtin and wkn
* Level 3: Only ask domain
* Level 4: W2k3ad: Only ask AD trusts
- * Level 5: Don't lookup anything
+ * Level 5: Only ask transitive forest trusts
* Level 6: Like 4
*/
TALLOC_CTX *tmp_ctx;
NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
struct lsa_name_info *name_infos;
- struct lsa_dom_info *dom_infos;
+ struct lsa_dom_info *dom_infos = NULL;
int i, j;
- tmp_ctx = talloc_new(mem_ctx);
- if (tmp_ctx == NULL) {
+ if (!(tmp_ctx = talloc_new(mem_ctx))) {
DEBUG(0, ("talloc_new failed\n"));
return NT_STATUS_NO_MEMORY;
}
- name_infos = TALLOC_ARRAY(tmp_ctx, struct lsa_name_info, num_sids);
- dom_infos = TALLOC_ZERO_ARRAY(tmp_ctx, struct lsa_dom_info,
+ if (num_sids) {
+ name_infos = TALLOC_ARRAY(mem_ctx, struct lsa_name_info, num_sids);
+ if (name_infos == NULL) {
+ result = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
+ } else {
+ name_infos = NULL;
+ }
+
+ dom_infos = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_dom_info,
MAX_REF_DOMAINS);
- if ((name_infos == NULL) || (dom_infos == NULL)) {
+ if (dom_infos == NULL) {
result = NT_STATUS_NO_MEMORY;
- goto done;
+ goto fail;
}
/* First build up the data structures:
*/
if (domain_name == NULL) {
result = NT_STATUS_NO_MEMORY;
- goto done;
+ goto fail;
}
name_infos[i].rid = 0;
name_infos, builtin_domain_name());
if (name_infos[i].name == NULL) {
result = NT_STATUS_NO_MEMORY;
- goto done;
+ goto fail;
}
}
} else {
/* This is a normal SID with rid component */
if (!sid_split_rid(&sid, &rid)) {
result = NT_STATUS_INVALID_PARAMETER;
- goto done;
+ goto fail;
}
}
if (j == MAX_REF_DOMAINS) {
/* TODO: What's the right error message here? */
result = NT_STATUS_NONE_MAPPED;
- goto done;
+ goto fail;
}
if (!dom_infos[j].valid) {
/* This name was being found above in the case
* when we found a domain SID */
dom_infos[j].name =
- talloc_steal(dom_infos, domain_name);
+ talloc_strdup(dom_infos, domain_name);
+ if (dom_infos[j].name == NULL) {
+ result = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
} else {
/* lookup_rids will take care of this */
dom_infos[j].name = NULL;
if (dom_infos[j].idxs == NULL) {
result = NT_STATUS_NO_MEMORY;
- goto done;
+ goto fail;
}
}
}
for (i=0; i<MAX_REF_DOMAINS; i++) {
uint32_t *rids;
+ const char *domain_name = NULL;
const char **names;
- enum SID_NAME_USE *types;
+ enum lsa_SidType *types;
struct lsa_dom_info *dom = &dom_infos[i];
if (!dom->valid) {
break;
}
- rids = TALLOC_ARRAY(tmp_ctx, uint32, dom->num_idxs);
-
- if (rids == NULL) {
- result = NT_STATUS_NO_MEMORY;
- goto done;
+ if (dom->num_idxs) {
+ if (!(rids = TALLOC_ARRAY(tmp_ctx, uint32, dom->num_idxs))) {
+ result = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
+ } else {
+ rids = NULL;
}
for (j=0; j<dom->num_idxs; j++) {
}
if (!lookup_rids(tmp_ctx, &dom->sid,
- dom->num_idxs, rids, &dom->name,
+ dom->num_idxs, rids, &domain_name,
&names, &types)) {
result = NT_STATUS_NO_MEMORY;
- goto done;
+ goto fail;
}
- talloc_steal(dom_infos, dom->name);
-
+ if (!(dom->name = talloc_strdup(dom_infos, domain_name))) {
+ result = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
+
for (j=0; j<dom->num_idxs; j++) {
int idx = dom->idxs[j];
name_infos[idx].type = types[j];
if (types[j] != SID_NAME_UNKNOWN) {
name_infos[idx].name =
- talloc_steal(name_infos, names[j]);
+ talloc_strdup(name_infos, names[j]);
+ if (name_infos[idx].name == NULL) {
+ result = NT_STATUS_NO_MEMORY;
+ goto fail;
+ }
} else {
name_infos[idx].name = NULL;
}
}
}
- *ret_domains = talloc_steal(mem_ctx, dom_infos);
- *ret_names = talloc_steal(mem_ctx, name_infos);
- result = NT_STATUS_OK;
+ *ret_domains = dom_infos;
+ *ret_names = name_infos;
+ return NT_STATUS_OK;
- done:
+ fail:
+ TALLOC_FREE(dom_infos);
+ TALLOC_FREE(name_infos);
TALLOC_FREE(tmp_ctx);
return result;
}
BOOL lookup_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
const char **ret_domain, const char **ret_name,
- enum SID_NAME_USE *ret_type)
+ enum lsa_SidType *ret_type)
{
struct lsa_dom_info *domain;
struct lsa_name_info *name;
TALLOC_CTX *tmp_ctx;
BOOL ret = False;
- tmp_ctx = talloc_new(mem_ctx);
-
- if (tmp_ctx == NULL) {
+ if (!(tmp_ctx = talloc_new(mem_ctx))) {
DEBUG(0, ("talloc_new failed\n"));
return False;
}
goto done;
}
- if (ret_domain != NULL) {
- *ret_domain = talloc_steal(mem_ctx, domain->name);
+ if ((ret_domain != NULL) &&
+ !(*ret_domain = talloc_strdup(mem_ctx, domain->name))) {
+ goto done;
}
- if (ret_name != NULL) {
- *ret_name = talloc_steal(mem_ctx, name->name);
+ if ((ret_name != NULL) &&
+ !(*ret_name = talloc_strdup(mem_ctx, name->name))) {
+ goto done;
}
if (ret_type != NULL) {
struct uid_sid_cache *next, *prev;
uid_t uid;
DOM_SID sid;
- enum SID_NAME_USE sidtype;
+ enum lsa_SidType sidtype;
} *uid_sid_cache_head;
static struct gid_sid_cache {
struct gid_sid_cache *next, *prev;
gid_t gid;
DOM_SID sid;
- enum SID_NAME_USE sidtype;
+ enum lsa_SidType sidtype;
} *gid_sid_cache_head;
/*****************************************************************
{
struct uid_sid_cache *pc;
+ /* do not store SIDs in the "Unix Group" domain */
+
+ if ( sid_check_is_in_unix_users( psid ) )
+ return;
+
if (n_uid_sid_cache >= MAX_UID_SID_CACHE_SIZE && n_uid_sid_cache > TURNOVER_UID_SID_CACHE_SIZE) {
/* Delete the last TURNOVER_UID_SID_CACHE_SIZE entries. */
struct uid_sid_cache *pc_next;
void store_gid_sid_cache(const DOM_SID *psid, gid_t gid)
{
struct gid_sid_cache *pc;
+
+ /* do not store SIDs in the "Unix Group" domain */
+
+ if ( sid_check_is_in_unix_groups( psid ) )
+ return;
if (n_gid_sid_cache >= MAX_GID_SID_CACHE_SIZE && n_gid_sid_cache > TURNOVER_GID_SID_CACHE_SIZE) {
/* Delete the last TURNOVER_GID_SID_CACHE_SIZE entries. */
}
/*****************************************************************
- *THE CANONICAL* convert uid_t to SID function.
+ *THE LEGACY* convert uid_t to SID function.
*****************************************************************/
-void uid_to_sid(DOM_SID *psid, uid_t uid)
+static void legacy_uid_to_sid(DOM_SID *psid, uid_t uid)
{
- uid_t low, high;
uint32 rid;
+ BOOL ret;
ZERO_STRUCTP(psid);
- if (fetch_sid_from_uid_cache(psid, uid))
- return;
-
- if (lp_idmap_uid(&low, &high) && (uid >= low) && (uid <= high) &&
- winbind_uid_to_sid(psid, uid)) {
+ become_root();
+ ret = pdb_uid_to_rid(uid, &rid);
+ unbecome_root();
- DEBUG(10,("uid_to_sid: winbindd %u -> %s\n",
- (unsigned int)uid, sid_string_static(psid)));
- goto done;
- }
-
- if (pdb_uid_to_rid(uid, &rid)) {
+ if (ret) {
/* This is a mapped user */
sid_copy(psid, get_global_sam_sid());
sid_append_rid(psid, rid);
goto done;
}
- if (pdb_rid_algorithm() && (uid < max_algorithmic_uid())) {
- sid_copy(psid, get_global_sam_sid());
- sid_append_rid(psid, algorithmic_pdb_uid_to_user_rid(uid));
- goto done;
- } else {
- uid_to_unix_users_sid(uid, psid);
- goto done;
- }
+ /* This is an unmapped user */
+
+ uid_to_unix_users_sid(uid, psid);
done:
- DEBUG(10,("uid_to_sid: local %u -> %s\n", (unsigned int)uid,
+ DEBUG(10,("LEGACY: uid %u -> sid %s\n", (unsigned int)uid,
sid_string_static(psid)));
store_uid_sid_cache(psid, uid);
}
/*****************************************************************
- *THE CANONICAL* convert gid_t to SID function.
+ *THE LEGACY* convert gid_t to SID function.
*****************************************************************/
-void gid_to_sid(DOM_SID *psid, gid_t gid)
+static void legacy_gid_to_sid(DOM_SID *psid, gid_t gid)
{
- gid_t low, high;
+ BOOL ret;
ZERO_STRUCTP(psid);
- if (fetch_sid_from_gid_cache(psid, gid))
- return;
+ become_root();
+ ret = pdb_gid_to_sid(gid, psid);
+ unbecome_root();
- if (lp_idmap_gid(&low, &high) && (gid >= low) && (gid <= high) &&
- winbind_gid_to_sid(psid, gid)) {
-
- DEBUG(10,("gid_to_sid: winbindd %u -> %s\n",
- (unsigned int)gid, sid_string_static(psid)));
- goto done;
- }
-
- if (pdb_gid_to_sid(gid, psid)) {
+ if (ret) {
/* This is a mapped group */
goto done;
}
+
+ /* This is an unmapped group */
- if (pdb_rid_algorithm() && (gid < max_algorithmic_gid())) {
- sid_copy(psid, get_global_sam_sid());
- sid_append_rid(psid, pdb_gid_to_group_rid(gid));
- goto done;
- } else {
- sid_copy(psid, &global_sid_Unix_Groups);
- sid_append_rid(psid, gid);
- goto done;
- }
+ gid_to_unix_groups_sid(gid, psid);
done:
- DEBUG(10,("gid_to_sid: local %u -> %s\n", (unsigned int)gid,
+ DEBUG(10,("LEGACY: gid %u -> sid %s\n", (unsigned int)gid,
sid_string_static(psid)));
store_gid_sid_cache(psid, gid);
}
/*****************************************************************
- *THE CANONICAL* convert SID to uid function.
+ *THE LEGACY* convert SID to uid function.
*****************************************************************/
-BOOL sid_to_uid(const DOM_SID *psid, uid_t *puid)
+static BOOL legacy_sid_to_uid(const DOM_SID *psid, uid_t *puid)
{
- enum SID_NAME_USE type;
+ enum lsa_SidType type;
uint32 rid;
- gid_t gid;
-
- if (fetch_uid_from_cache(puid, psid))
- return True;
-
- if (fetch_gid_from_cache(&gid, psid)) {
- return False;
- }
-
- if (sid_peek_check_rid(&global_sid_Unix_Users, psid, &rid)) {
- uid_t uid = rid;
- *puid = uid;
- goto done;
- }
if (sid_peek_check_rid(get_global_sam_sid(), psid, &rid)) {
union unid_t id;
+ BOOL ret;
- if (pdb_sid_to_id(psid, &id, &type)) {
+ become_root();
+ ret = pdb_sid_to_id(psid, &id, &type);
+ unbecome_root();
+
+ if (ret) {
if (type != SID_NAME_USER) {
DEBUG(5, ("sid %s is a %s, expected a user\n",
sid_string_static(psid),
*puid = id.uid;
goto done;
}
- if (pdb_rid_algorithm() &&
- algorithmic_pdb_rid_is_user(rid)) {
- *puid = algorithmic_pdb_user_rid_to_uid(rid);
- goto done;
- }
- /* This was ours, but it was neither mapped nor
- * algorithmic. Fail */
- return False;
+ /* This was ours, but it was not mapped. Fail */
}
- if (winbind_lookup_sid(NULL, psid, NULL, NULL, &type)) {
-
- if (type != SID_NAME_USER) {
- DEBUG(10, ("sid_to_uid: sid %s is a %s\n",
- sid_string_static(psid),
- sid_type_lookup(type)));
- return False;
- }
-
- if (!winbind_sid_to_uid(puid, psid)) {
- DEBUG(5, ("sid_to_uid: winbind failed to allocate a "
- "new uid for sid %s\n",
- sid_string_static(psid)));
- return False;
- }
- goto done;
- }
-
- /* TODO: Here would be the place to allocate both a gid and a uid for
- * the SID in question */
-
+ DEBUG(10,("LEGACY: mapping failed for sid %s\n", sid_string_static(psid)));
return False;
- done:
- DEBUG(10,("sid_to_uid: %s -> %u\n", sid_string_static(psid),
+done:
+ DEBUG(10,("LEGACY: sid %s -> uid %u\n", sid_string_static(psid),
(unsigned int)*puid ));
store_uid_sid_cache(psid, *puid);
}
/*****************************************************************
- *THE CANONICAL* convert SID to gid function.
+ *THE LEGACY* convert SID to gid function.
Group mapping is used for gids that maps to Wellknown SIDs
*****************************************************************/
-BOOL sid_to_gid(const DOM_SID *psid, gid_t *pgid)
+static BOOL legacy_sid_to_gid(const DOM_SID *psid, gid_t *pgid)
{
uint32 rid;
GROUP_MAP map;
union unid_t id;
- enum SID_NAME_USE type;
- uid_t uid;
-
- if (fetch_gid_from_cache(pgid, psid))
- return True;
-
- if (fetch_uid_from_cache(&uid, psid))
- return False;
-
- if (sid_peek_check_rid(&global_sid_Unix_Groups, psid, &rid)) {
- gid_t gid = rid;
- *pgid = gid;
- goto done;
- }
+ enum lsa_SidType type;
if ((sid_check_is_in_builtin(psid) ||
sid_check_is_in_wellknown_domain(psid))) {
- if (pdb_getgrsid(&map, *psid)) {
+ BOOL ret;
+
+ become_root();
+ ret = pdb_getgrsid(&map, *psid);
+ unbecome_root();
+
+ if (ret) {
*pgid = map.gid;
goto done;
}
+ DEBUG(10,("LEGACY: mapping failed for sid %s\n", sid_string_static(psid)));
return False;
}
if (sid_peek_check_rid(get_global_sam_sid(), psid, &rid)) {
- if (pdb_sid_to_id(psid, &id, &type)) {
+ BOOL ret;
+
+ become_root();
+ ret = pdb_sid_to_id(psid, &id, &type);
+ unbecome_root();
+
+ if (ret) {
if ((type != SID_NAME_DOM_GRP) &&
(type != SID_NAME_ALIAS)) {
- DEBUG(5, ("sid %s is a %s, expected a group\n",
+ DEBUG(5, ("LEGACY: sid %s is a %s, expected a group\n",
sid_string_static(psid),
sid_type_lookup(type)));
return False;
*pgid = id.gid;
goto done;
}
- if (pdb_rid_algorithm() &&
- !algorithmic_pdb_rid_is_user(rid)) {
- /* This must be a group, presented as alias */
- *pgid = pdb_group_rid_to_gid(rid);
- goto done;
+
+ /* This was ours, but it was not mapped. Fail */
+ }
+
+ DEBUG(10,("LEGACY: mapping failed for sid %s\n", sid_string_static(psid)));
+ return False;
+
+ done:
+ DEBUG(10,("LEGACY: sid %s -> gid %u\n", sid_string_static(psid),
+ (unsigned int)*pgid ));
+
+ store_gid_sid_cache(psid, *pgid);
+
+ return True;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert uid_t to SID function.
+*****************************************************************/
+
+void uid_to_sid(DOM_SID *psid, uid_t uid)
+{
+ ZERO_STRUCTP(psid);
+
+ if (fetch_sid_from_uid_cache(psid, uid))
+ return;
+
+ if (!winbind_uid_to_sid(psid, uid)) {
+ if (!winbind_ping()) {
+ legacy_uid_to_sid(psid, uid);
+ return;
}
- /* This was ours, but it was neither mapped nor
- * algorithmic. Fail. */
- return False;
+
+ DEBUG(5, ("uid_to_sid: winbind failed to find a sid for uid %u\n",
+ uid));
+ return;
}
+
+ DEBUG(10,("uid %u -> sid %s\n",
+ (unsigned int)uid, sid_string_static(psid)));
+
+ store_uid_sid_cache(psid, uid);
+ return;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert gid_t to SID function.
+*****************************************************************/
+
+void gid_to_sid(DOM_SID *psid, gid_t gid)
+{
+ ZERO_STRUCTP(psid);
+
+ if (fetch_sid_from_gid_cache(psid, gid))
+ return;
+
+ if (!winbind_gid_to_sid(psid, gid)) {
+ if (!winbind_ping()) {
+ legacy_gid_to_sid(psid, gid);
+ return;
+ }
+
+ DEBUG(5, ("gid_to_sid: winbind failed to find a sid for gid %u\n",
+ gid));
+ return;
+ }
+
+ DEBUG(10,("gid %u -> sid %s\n",
+ (unsigned int)gid, sid_string_static(psid)));
- if (!winbind_lookup_sid(NULL, psid, NULL, NULL, &type)) {
- DEBUG(11,("sid_to_gid: no one knows the SID %s (tried local, "
- "then winbind)\n", sid_string_static(psid)));
-
+ store_gid_sid_cache(psid, gid);
+ return;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert SID to uid function.
+*****************************************************************/
+
+BOOL sid_to_uid(const DOM_SID *psid, uid_t *puid)
+{
+ uint32 rid;
+ gid_t gid;
+
+ if (fetch_uid_from_cache(puid, psid))
+ return True;
+
+ if (fetch_gid_from_cache(&gid, psid)) {
return False;
}
- /* winbindd knows it; Ensure this is a group sid */
+ /* Optimize for the Unix Users Domain
+ * as the conversion is straightforward */
+ if (sid_peek_check_rid(&global_sid_Unix_Users, psid, &rid)) {
+ uid_t uid = rid;
+ *puid = uid;
- if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
- (type != SID_NAME_WKN_GRP)) {
- DEBUG(10,("sid_to_gid: winbind lookup succeeded but SID is "
- "a %s\n", sid_type_lookup(type)));
+ /* return here, don't cache */
+ DEBUG(10,("sid %s -> uid %u\n", sid_string_static(psid),
+ (unsigned int)*puid ));
+ return True;
+ }
+
+ if (!winbind_sid_to_uid(puid, psid)) {
+ if (!winbind_ping()) {
+ return legacy_sid_to_uid(psid, puid);
+ }
+
+ DEBUG(5, ("winbind failed to find a uid for sid %s\n",
+ sid_string_static(psid)));
return False;
}
-
- /* winbindd knows it and it is a type of group; sid_to_gid must succeed
- or we are dead in the water */
+
+ /* TODO: Here would be the place to allocate both a gid and a uid for
+ * the SID in question */
+
+ DEBUG(10,("sid %s -> uid %u\n", sid_string_static(psid),
+ (unsigned int)*puid ));
+
+ store_uid_sid_cache(psid, *puid);
+ return True;
+}
+
+/*****************************************************************
+ *THE CANONICAL* convert SID to gid function.
+ Group mapping is used for gids that maps to Wellknown SIDs
+*****************************************************************/
+
+BOOL sid_to_gid(const DOM_SID *psid, gid_t *pgid)
+{
+ uint32 rid;
+ uid_t uid;
+
+ if (fetch_gid_from_cache(pgid, psid))
+ return True;
+
+ if (fetch_uid_from_cache(&uid, psid))
+ return False;
+
+ /* Optimize for the Unix Groups Domain
+ * as the conversion is straightforward */
+ if (sid_peek_check_rid(&global_sid_Unix_Groups, psid, &rid)) {
+ gid_t gid = rid;
+ *pgid = gid;
+
+ /* return here, don't cache */
+ DEBUG(10,("sid %s -> gid %u\n", sid_string_static(psid),
+ (unsigned int)*pgid ));
+ return True;
+ }
+
+ /* Ask winbindd if it can map this sid to a gid.
+ * (Idmap will check it is a valid SID and of the right type) */
if ( !winbind_sid_to_gid(pgid, psid) ) {
- DEBUG(10,("sid_to_gid: winbind failed to allocate a new gid "
- "for sid %s\n", sid_string_static(psid)));
+ if (!winbind_ping()) {
+ return legacy_sid_to_gid(psid, pgid);
+ }
+
+ DEBUG(10,("winbind failed to find a gid for sid %s\n",
+ sid_string_static(psid)));
return False;
}
- done:
- DEBUG(10,("sid_to_gid: %s -> %u\n", sid_string_static(psid),
+ DEBUG(10,("sid %s -> gid %u\n", sid_string_static(psid),
(unsigned int)*pgid ));
store_gid_sid_cache(psid, *pgid);
git.samba.org / sfrench / samba-autobuild / .git / blobdiff