2 Unix SMB/CIFS implementation.
4 Winbind daemon - user related functions
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jeremy Allison 2001.
8 Copyright (C) Gerald (Jerry) Carter 2003.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 #define DBGC_CLASS DBGC_WINBIND
31 extern userdom_struct current_user_info;
33 static BOOL fillup_pw_field(const char *lp_template,
46 if (in && !strequal(in,"") && lp_security() == SEC_ADS && lp_winbind_sfu_support()) {
47 safe_strcpy(out, in, sizeof(fstring) - 1);
51 /* Home directory and shell - use template config parameters. The
52 defaults are /tmp for the home directory and /bin/false for
55 /* The substitution of %U and %D in the 'template homedir' is done
56 by alloc_sub_specified() below. */
58 templ = alloc_sub_specified(lp_template, username, domname, uid, gid);
63 safe_strcpy(out, templ, sizeof(fstring) - 1);
69 /* Fill a pwent structure with information we have obtained */
71 static BOOL winbindd_fill_pwent(char *dom_name, char *user_name,
72 DOM_SID *user_sid, DOM_SID *group_sid,
73 char *full_name, char *homedir, char *shell,
74 struct winbindd_pw *pw)
76 fstring output_username;
79 if (!pw || !dom_name || !user_name)
82 /* Resolve the uid number */
84 if (!NT_STATUS_IS_OK(idmap_sid_to_uid(user_sid, &pw->pw_uid, 0))) {
85 DEBUG(1, ("error getting user id for sid %s\n", sid_to_string(sid_string, user_sid)));
89 /* Resolve the gid number */
91 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(group_sid, &pw->pw_gid, 0))) {
92 DEBUG(1, ("error getting group id for sid %s\n", sid_to_string(sid_string, group_sid)));
96 strlower_m(user_name);
100 fill_domain_username(output_username, dom_name, user_name);
102 safe_strcpy(pw->pw_name, output_username, sizeof(pw->pw_name) - 1);
104 /* Full name (gecos) */
106 safe_strcpy(pw->pw_gecos, full_name, sizeof(pw->pw_gecos) - 1);
108 /* Home directory and shell - use template config parameters. The
109 defaults are /tmp for the home directory and /bin/false for
112 /* The substitution of %U and %D in the 'template homedir' is done
113 by alloc_sub_specified() below. */
115 fstrcpy(current_user_info.domain, dom_name);
117 if (!fillup_pw_field(lp_template_homedir(), user_name, dom_name,
118 pw->pw_uid, pw->pw_gid, homedir, pw->pw_dir))
121 if (!fillup_pw_field(lp_template_shell(), user_name, dom_name,
122 pw->pw_uid, pw->pw_gid, shell, pw->pw_shell))
125 /* Password - set to "x" as we can't generate anything useful here.
126 Authentication can be done using the pam_winbind module. */
128 safe_strcpy(pw->pw_passwd, "x", sizeof(pw->pw_passwd) - 1);
133 /* Wrapper for domain->methods->query_user, only on the parent->child pipe */
135 enum winbindd_result winbindd_dual_userinfo(struct winbindd_domain *domain,
136 struct winbindd_cli_state *state)
139 WINBIND_USERINFO user_info;
142 /* Ensure null termination */
143 state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
145 DEBUG(3, ("[%5lu]: lookupsid %s\n", (unsigned long)state->pid,
146 state->request.data.sid));
148 if (!string_to_sid(&sid, state->request.data.sid)) {
149 DEBUG(5, ("%s not a SID\n", state->request.data.sid));
150 return WINBINDD_ERROR;
153 status = domain->methods->query_user(domain, state->mem_ctx,
155 if (!NT_STATUS_IS_OK(status)) {
156 DEBUG(1, ("error getting user info for sid %s\n",
157 sid_string_static(&sid)));
158 return WINBINDD_ERROR;
161 fstrcpy(state->response.data.user_info.acct_name, user_info.acct_name);
162 fstrcpy(state->response.data.user_info.full_name, user_info.full_name);
163 fstrcpy(state->response.data.user_info.homedir, user_info.homedir);
164 fstrcpy(state->response.data.user_info.shell, user_info.shell);
165 if (!sid_peek_check_rid(&domain->sid, &user_info.group_sid,
166 &state->response.data.user_info.group_rid)) {
167 DEBUG(1, ("Could not extract group rid out of %s\n",
168 sid_string_static(&sid)));
169 return WINBINDD_ERROR;
175 struct getpwsid_state {
176 struct winbindd_cli_state *state;
177 struct winbindd_domain *domain;
188 static void getpwsid_queryuser_recv(void *private_data, BOOL success,
189 const char *acct_name,
190 const char *full_name,
194 static void getpwsid_sid2uid_recv(void *private_data, BOOL success, uid_t uid);
195 static void getpwsid_sid2gid_recv(void *private_data, BOOL success, gid_t gid);
197 static void winbindd_getpwsid(struct winbindd_cli_state *state,
200 struct getpwsid_state *s;
202 s = TALLOC_P(state->mem_ctx, struct getpwsid_state);
204 DEBUG(0, ("talloc failed\n"));
209 s->domain = find_domain_from_sid_noinit(sid);
210 if (s->domain == NULL) {
211 DEBUG(3, ("Could not find domain for sid %s\n",
212 sid_string_static(sid)));
216 sid_copy(&s->user_sid, sid);
218 query_user_async(s->state->mem_ctx, s->domain, sid,
219 getpwsid_queryuser_recv, s);
223 request_error(state);
226 static void getpwsid_queryuser_recv(void *private_data, BOOL success,
227 const char *acct_name,
228 const char *full_name,
233 struct getpwsid_state *s =
234 talloc_get_type_abort(private_data, struct getpwsid_state);
237 DEBUG(5, ("Could not query user %s\\%s\n", s->domain->name,
239 request_error(s->state);
243 s->username = talloc_strdup(s->state->mem_ctx, acct_name);
244 s->fullname = talloc_strdup(s->state->mem_ctx, full_name);
245 s->homedir = talloc_strdup(s->state->mem_ctx, homedir);
246 s->shell = talloc_strdup(s->state->mem_ctx, shell);
247 sid_copy(&s->group_sid, &s->domain->sid);
248 sid_append_rid(&s->group_sid, group_rid);
250 winbindd_sid2uid_async(s->state->mem_ctx, &s->user_sid,
251 getpwsid_sid2uid_recv, s);
254 static void getpwsid_sid2uid_recv(void *private_data, BOOL success, uid_t uid)
256 struct getpwsid_state *s =
257 talloc_get_type_abort(private_data, struct getpwsid_state);
260 DEBUG(5, ("Could not query user's %s\\%s uid\n",
261 s->domain->name, s->username));
262 request_error(s->state);
267 winbindd_sid2gid_async(s->state->mem_ctx, &s->group_sid,
268 getpwsid_sid2gid_recv, s);
271 static void getpwsid_sid2gid_recv(void *private_data, BOOL success, gid_t gid)
273 struct getpwsid_state *s =
274 talloc_get_type_abort(private_data, struct getpwsid_state);
275 struct winbindd_pw *pw;
276 fstring output_username;
279 DEBUG(5, ("Could not query user's %s\\%s\n gid",
280 s->domain->name, s->username));
286 pw = &s->state->response.data.pw;
289 fill_domain_username(output_username, s->domain->name, s->username);
290 safe_strcpy(pw->pw_name, output_username, sizeof(pw->pw_name) - 1);
291 safe_strcpy(pw->pw_gecos, s->fullname, sizeof(pw->pw_gecos) - 1);
293 fstrcpy(current_user_info.domain, s->domain->name);
295 if (!fillup_pw_field(lp_template_homedir(), s->username, s->domain->name,
296 pw->pw_uid, pw->pw_gid, s->homedir, pw->pw_dir)) {
297 DEBUG(5, ("Could not compose homedir\n"));
301 if (!fillup_pw_field(lp_template_shell(), s->username, s->domain->name,
302 pw->pw_uid, pw->pw_gid, s->shell, pw->pw_shell)) {
303 DEBUG(5, ("Could not compose shell\n"));
307 /* Password - set to "x" as we can't generate anything useful here.
308 Authentication can be done using the pam_winbind module. */
310 safe_strcpy(pw->pw_passwd, "x", sizeof(pw->pw_passwd) - 1);
312 request_ok(s->state);
316 request_error(s->state);
319 /* Return a password structure from a username. */
321 static void getpwnam_name2sid_recv(void *private_data, BOOL success,
322 const DOM_SID *sid, enum SID_NAME_USE type);
324 void winbindd_getpwnam(struct winbindd_cli_state *state)
326 struct winbindd_domain *domain;
327 fstring domname, username;
329 /* Ensure null termination */
330 state->request.data.username[sizeof(state->request.data.username)-1]='\0';
332 DEBUG(3, ("[%5lu]: getpwnam %s\n", (unsigned long)state->pid,
333 state->request.data.username));
335 if (!parse_domain_user(state->request.data.username, domname,
337 DEBUG(0, ("Could not parse domain user: %s\n",
338 state->request.data.username));
339 request_error(state);
343 /* Get info for the domain */
345 domain = find_domain_from_name(domname);
347 if (domain == NULL) {
348 DEBUG(7, ("could not find domain entry for domain %s\n",
350 request_error(state);
354 if ( strequal(domname, lp_workgroup()) && lp_winbind_trusted_domains_only() ) {
355 DEBUG(7,("winbindd_getpwnam: My domain -- rejecting getpwnam() for %s\\%s.\n",
357 request_error(state);
361 /* Get rid and name type from name. The following costs 1 packet */
363 winbindd_lookupname_async(state->mem_ctx, domname, username,
364 getpwnam_name2sid_recv, state);
367 static void getpwnam_name2sid_recv(void *private_data, BOOL success,
368 const DOM_SID *sid, enum SID_NAME_USE type)
370 struct winbindd_cli_state *state = private_data;
373 DEBUG(5, ("Could not lookup name for user %s\n",
374 state->request.data.username));
375 request_error(state);
379 if ((type != SID_NAME_USER) && (type != SID_NAME_COMPUTER)) {
380 DEBUG(5, ("%s is not a user\n", state->request.data.username));
381 request_error(state);
385 winbindd_getpwsid(state, sid);
388 /* Return a password structure given a uid number */
390 void winbindd_getpwuid(struct winbindd_cli_state *state)
395 /* Bug out if the uid isn't in the winbind range */
397 if ((state->request.data.uid < server_state.uid_low ) ||
398 (state->request.data.uid > server_state.uid_high)) {
399 request_error(state);
403 DEBUG(3, ("[%5lu]: getpwuid %lu\n", (unsigned long)state->pid,
404 (unsigned long)state->request.data.uid));
406 status = idmap_uid_to_sid(&user_sid, state->request.data.uid,
407 ID_QUERY_ONLY | ID_CACHE_ONLY);
409 if (!NT_STATUS_IS_OK(status)) {
410 DEBUG(5, ("Could not find SID for uid %lu\n",
411 (unsigned long)state->request.data.uid));
412 request_error(state);
416 winbindd_getpwsid(state, &user_sid);
420 * set/get/endpwent functions
423 /* Rewind file pointer for ntdom passwd database */
425 static BOOL winbindd_setpwent_internal(struct winbindd_cli_state *state)
427 struct winbindd_domain *domain;
429 DEBUG(3, ("[%5lu]: setpwent\n", (unsigned long)state->pid));
431 /* Check user has enabled this */
433 if (!lp_winbind_enum_users()) {
437 /* Free old static data if it exists */
439 if (state->getpwent_state != NULL) {
440 free_getent_state(state->getpwent_state);
441 state->getpwent_state = NULL;
445 /* add any local users we have */
447 if ( (domain_state = (struct getent_state *)malloc(sizeof(struct getent_state))) == NULL )
450 ZERO_STRUCTP(domain_state);
452 /* Add to list of open domains */
454 DLIST_ADD(state->getpwent_state, domain_state);
457 /* Create sam pipes for each domain we know about */
459 for(domain = domain_list(); domain != NULL; domain = domain->next) {
460 struct getent_state *domain_state;
463 /* don't add our domaina if we are a PDC or if we
464 are a member of a Samba domain */
466 if ( (IS_DC || lp_winbind_trusted_domains_only())
467 && strequal(domain->name, lp_workgroup()) )
472 /* Create a state record for this domain */
474 if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL) {
475 DEBUG(0, ("malloc failed\n"));
479 ZERO_STRUCTP(domain_state);
481 fstrcpy(domain_state->domain_name, domain->name);
483 /* Add to list of open domains */
485 DLIST_ADD(state->getpwent_state, domain_state);
488 state->getpwent_initialized = True;
492 void winbindd_setpwent(struct winbindd_cli_state *state)
494 if (winbindd_setpwent_internal(state)) {
497 request_error(state);
501 /* Close file pointer to ntdom passwd database */
503 void winbindd_endpwent(struct winbindd_cli_state *state)
505 DEBUG(3, ("[%5lu]: endpwent\n", (unsigned long)state->pid));
507 free_getent_state(state->getpwent_state);
508 state->getpwent_initialized = False;
509 state->getpwent_state = NULL;
513 /* Get partial list of domain users for a domain. We fill in the sam_entries,
514 and num_sam_entries fields with domain user information. The dispinfo_ndx
515 field is incremented to the index of the next user to fetch. Return True if
516 some users were returned, False otherwise. */
518 static BOOL get_sam_user_entries(struct getent_state *ent, TALLOC_CTX *mem_ctx)
522 WINBIND_USERINFO *info;
523 struct getpwent_user *name_list = NULL;
525 struct winbindd_domain *domain;
526 struct winbindd_methods *methods;
529 if (ent->num_sam_entries)
532 if (!(domain = find_domain_from_name(ent->domain_name))) {
533 DEBUG(3, ("no such domain %s in get_sam_user_entries\n",
538 methods = domain->methods;
540 /* Free any existing user info */
542 SAFE_FREE(ent->sam_entries);
543 ent->num_sam_entries = 0;
545 /* Call query_user_list to get a list of usernames and user rids */
549 status = methods->query_user_list(domain, mem_ctx, &num_entries,
553 struct getpwent_user *tnl;
555 tnl = SMB_REALLOC_ARRAY(name_list, struct getpwent_user, ent->num_sam_entries + num_entries);
558 DEBUG(0,("get_sam_user_entries realloc failed.\n"));
559 SAFE_FREE(name_list);
565 for (i = 0; i < num_entries; i++) {
566 /* Store account name and gecos */
567 if (!info[i].acct_name) {
568 fstrcpy(name_list[ent->num_sam_entries + i].name, "");
570 fstrcpy(name_list[ent->num_sam_entries + i].name,
573 if (!info[i].full_name) {
574 fstrcpy(name_list[ent->num_sam_entries + i].gecos, "");
576 fstrcpy(name_list[ent->num_sam_entries + i].gecos,
579 if (!info[i].homedir) {
580 fstrcpy(name_list[ent->num_sam_entries + i].homedir, "");
582 fstrcpy(name_list[ent->num_sam_entries + i].homedir,
585 if (!info[i].shell) {
586 fstrcpy(name_list[ent->num_sam_entries + i].shell, "");
588 fstrcpy(name_list[ent->num_sam_entries + i].shell,
593 /* User and group ids */
594 sid_copy(&name_list[ent->num_sam_entries+i].user_sid,
596 sid_copy(&name_list[ent->num_sam_entries+i].group_sid,
600 ent->num_sam_entries += num_entries;
602 /* Fill in remaining fields */
604 ent->sam_entries = name_list;
605 ent->sam_entry_index = 0;
606 result = ent->num_sam_entries > 0;
613 /* Fetch next passwd entry from ntdom database */
615 #define MAX_GETPWENT_USERS 500
617 void winbindd_getpwent(struct winbindd_cli_state *state)
619 struct getent_state *ent;
620 struct winbindd_pw *user_list;
621 int num_users, user_list_ndx = 0, i;
623 DEBUG(3, ("[%5lu]: getpwent\n", (unsigned long)state->pid));
625 /* Check user has enabled this */
627 if (!lp_winbind_enum_users()) {
628 request_error(state);
632 /* Allocate space for returning a chunk of users */
634 num_users = MIN(MAX_GETPWENT_USERS, state->request.data.num_entries);
636 if ((state->response.extra_data = SMB_MALLOC_ARRAY(struct winbindd_pw, num_users)) == NULL) {
637 request_error(state);
641 memset(state->response.extra_data, 0, num_users *
642 sizeof(struct winbindd_pw));
644 user_list = (struct winbindd_pw *)state->response.extra_data;
646 if (!state->getpwent_initialized)
647 winbindd_setpwent_internal(state);
649 if (!(ent = state->getpwent_state)) {
650 request_error(state);
654 /* Start sending back users */
656 for (i = 0; i < num_users; i++) {
657 struct getpwent_user *name_list = NULL;
660 /* Do we need to fetch another chunk of users? */
662 if (ent->num_sam_entries == ent->sam_entry_index) {
665 !get_sam_user_entries(ent, state->mem_ctx)) {
666 struct getent_state *next_ent;
668 /* Free state information for this domain */
670 SAFE_FREE(ent->sam_entries);
672 next_ent = ent->next;
673 DLIST_REMOVE(state->getpwent_state, ent);
679 /* No more domains */
685 name_list = ent->sam_entries;
687 /* Lookup user info */
689 result = winbindd_fill_pwent(
691 name_list[ent->sam_entry_index].name,
692 &name_list[ent->sam_entry_index].user_sid,
693 &name_list[ent->sam_entry_index].group_sid,
694 name_list[ent->sam_entry_index].gecos,
695 name_list[ent->sam_entry_index].homedir,
696 name_list[ent->sam_entry_index].shell,
697 &user_list[user_list_ndx]);
699 ent->sam_entry_index++;
701 /* Add user to return list */
706 state->response.data.num_entries++;
707 state->response.length +=
708 sizeof(struct winbindd_pw);
711 DEBUG(1, ("could not lookup domain user %s\n",
712 name_list[ent->sam_entry_index].name));
717 if (user_list_ndx > 0)
720 request_error(state);
723 /* List domain users without mapping to unix ids */
725 void winbindd_list_users(struct winbindd_cli_state *state)
727 struct winbindd_domain *domain;
728 WINBIND_USERINFO *info;
729 const char *which_domain;
730 uint32 num_entries = 0, total_entries = 0;
731 char *ted, *extra_data = NULL;
732 int extra_data_len = 0;
733 enum winbindd_result rv = WINBINDD_ERROR;
735 DEBUG(3, ("[%5lu]: list users\n", (unsigned long)state->pid));
737 /* Ensure null termination */
738 state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';
739 which_domain = state->request.domain_name;
741 /* Enumerate over trusted domains */
743 for (domain = domain_list(); domain; domain = domain->next) {
745 struct winbindd_methods *methods;
748 /* if we have a domain name restricting the request and this
749 one in the list doesn't match, then just bypass the remainder
752 if ( *which_domain && !strequal(which_domain, domain->name) )
755 methods = domain->methods;
757 /* Query display info */
758 status = methods->query_user_list(domain, state->mem_ctx,
759 &num_entries, &info);
761 if (num_entries == 0)
764 /* Allocate some memory for extra data */
765 total_entries += num_entries;
767 ted = SMB_REALLOC(extra_data, sizeof(fstring) * total_entries);
770 DEBUG(0,("failed to enlarge buffer!\n"));
771 SAFE_FREE(extra_data);
776 /* Pack user list into extra data fields */
778 for (i = 0; i < num_entries; i++) {
779 fstring acct_name, name;
781 if (!info[i].acct_name) {
782 fstrcpy(acct_name, "");
784 fstrcpy(acct_name, info[i].acct_name);
787 fill_domain_username(name, domain->name, acct_name);
789 /* Append to extra data */
790 memcpy(&extra_data[extra_data_len], name,
792 extra_data_len += strlen(name);
793 extra_data[extra_data_len++] = ',';
797 /* Assign extra_data fields in response structure */
800 extra_data[extra_data_len - 1] = '\0';
801 state->response.extra_data = extra_data;
802 state->response.length += extra_data_len;
805 /* No domains responded but that's still OK so don't return an
812 if (rv == WINBINDD_OK)
815 request_error(state);