This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
#include "includes.h"
#include "winbindd.h"
struct idmap_cache_ctx;
+struct idmap_alloc_context {
+ const char *params;
+ struct idmap_alloc_methods *methods;
+ BOOL initialized;
+};
+
static TALLOC_CTX *idmap_ctx = NULL;
static struct idmap_cache_ctx *idmap_cache;
static int def_dom_num = -1;
static struct idmap_alloc_backend *alloc_backends = NULL;
-static struct idmap_alloc_methods *alloc_methods = NULL;
+static struct idmap_alloc_context *idmap_alloc_ctx = NULL;
#define IDMAP_CHECK_RET(ret) do { if ( ! NT_STATUS_IS_OK(ret)) { DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); goto done; } } while(0)
+#define IDMAP_REPORT_RET(ret) do { if ( ! NT_STATUS_IS_OK(ret)) { DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); } } while(0)
#define IDMAP_CHECK_ALLOC(mem) do { if (!mem) { DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; goto done; } } while(0)
static struct idmap_methods *get_methods(struct idmap_backend *be, const char *name)
return NULL;
}
+BOOL idmap_is_offline(void)
+{
+ return ( lp_winbind_offline_logon() &&
+ get_global_winbindd_state_offline() );
+}
+
/**********************************************************************
Allow a module to register itself as a method.
**********************************************************************/
NTSTATUS idmap_close(void)
{
/* close the alloc backend first before freeing idmap_ctx */
- if (alloc_methods) {
- alloc_methods->close_fn();
- alloc_methods = NULL;
+ if (idmap_alloc_ctx) {
+ idmap_alloc_ctx->methods->close_fn();
+ idmap_alloc_ctx->methods = NULL;
}
alloc_backends = NULL;
static const char *idmap_default_domain[] = { "default domain", NULL };
+/****************************************************************************
+ ****************************************************************************/
+
+NTSTATUS idmap_init_cache(void)
+{
+ /* Always initialize the cache. We'll have to delay initialization
+ of backends if we are offline */
+
+ if ( idmap_ctx ) {
+ return NT_STATUS_OK;
+ }
+
+ if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ return NT_STATUS_OK;
+}
+
+/****************************************************************************
+ ****************************************************************************/
+
NTSTATUS idmap_init(void)
-{
+{
NTSTATUS ret;
+ static NTSTATUS idmap_init_status = NT_STATUS_UNSUCCESSFUL;
struct idmap_domain *dom;
- const char *compat_backend = NULL;
- const char *compat_params = NULL;
+ char *compat_backend = NULL;
+ char *compat_params = NULL;
const char **dom_list = NULL;
- char *alloc_backend;
+ char *alloc_backend = NULL;
BOOL default_already_defined = False;
BOOL pri_dom_is_in_list = False;
int compat = 0;
int i;
- if (idmap_ctx) {
- return NT_STATUS_OK;
- }
+ ret = idmap_init_cache();
+ if ( !NT_STATUS_IS_OK(ret) )
+ return ret;
- idmap_ctx = talloc_named_const(NULL, 0, "IDMAP MEMORY CONTEXT");
- if ( ! idmap_ctx) {
- return NT_STATUS_NO_MEMORY;
+ if (NT_STATUS_IS_OK(idmap_init_status)) {
+ return NT_STATUS_OK;
}
+
+ /* We can't reliably call intialization code here unless
+ we are online. But return NT_STATUS_OK so the upper
+ level code doesn't abort idmap lookups. */
- /* init cache */
- idmap_cache = idmap_cache_init(idmap_ctx);
- if ( ! idmap_cache) {
- return NT_STATUS_UNSUCCESSFUL;
+ if ( get_global_winbindd_state_offline() ) {
+ idmap_init_status = NT_STATUS_FILE_IS_OFFLINE;
+ return NT_STATUS_OK;
}
- /* register static backends */
static_init_idmap;
- if ((dom_list = lp_idmap_domains()) != NULL) {
- if (lp_idmap_backend()) {
- DEBUG(0, ("WARNING: idmap backend and idmap domains are mutually excusive!\n"));
- DEBUGADD(0, (" idmap backend option will be IGNORED!\n"));
- }
-
- } else if (lp_idmap_backend()) {
- const char **compat_list = lp_idmap_backend();
- const char *p;
-
- DEBUG(0, ("WARNING: idmap backend is deprecated!\n"));
- compat = 1;
-
- /* strip any leading idmap_ prefix of */
- if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
- p = *compat_list += 6;
- DEBUG(0, ("WARNING: idmap backend uses obsolete and deprecated 'idmap_' prefix.\n"));
- DEBUGADD(0, (" Please replace 'idmap_%s' by '%s' in %s\n", p, p, dyn_CONFIGFILE));
- compat_backend = p;
+ dom_list = lp_idmap_domains();
+
+ if ( lp_idmap_backend() ) {
+ const char **compat_list = lp_idmap_backend();
+ char *p = NULL;
+ const char *q = NULL;
+
+ if ( dom_list ) {
+ DEBUG(0, ("WARNING: idmap backend and idmap domains are "
+ "mutually exclusive!\n"));
+ DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
} else {
- compat_backend = *compat_list;
- }
+ compat = 1;
+
+ if ( (compat_backend = talloc_strdup( idmap_ctx, *compat_list )) == NULL ) {
+ ret = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ /* strip any leading idmap_ prefix of */
+ if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
+ q = *compat_list += 6;
+ DEBUG(0, ("WARNING: idmap backend uses obsolete and "
+ "deprecated 'idmap_' prefix.\n"
+ "Please replace 'idmap_%s' by '%s' in %s\n",
+ q, q, dyn_CONFIGFILE));
+ compat_backend = talloc_strdup( idmap_ctx, q);
+ } else {
+ compat_backend = talloc_strdup( idmap_ctx, *compat_list);
+ }
- if ((p = strchr(compat_backend, ':')) != NULL) {
- compat_params = p + 1;
- }
+ /* separate the backend and module arguements */
+ if ((p = strchr(compat_backend, ':')) != NULL) {
+ *p = '\0';
+ compat_params = p + 1;
+ }
+ }
+ } else if ( !dom_list ) {
+ /* Back compatible: without idmap domains and explicit
+ idmap backend. Taking default idmap backend: tdb */
+
+ compat = 1;
+ compat_backend = talloc_strdup( idmap_ctx, "tdb");
+ compat_params = compat_backend;
}
if ( ! dom_list) {
const char *parm_backend;
char *config_option;
+ /* ignore BUILTIN and local MACHINE domains */
+ if ( strequal(dom_list[i], "BUILTIN")
+ || strequal(dom_list[i], get_global_sam_name() ) )
+ {
+ DEBUG(0,("idmap_init: Ignoring invalid domain %s\n",
+ dom_list[i]));
+ continue;
+ }
+
if (strequal(dom_list[i], lp_workgroup())) {
pri_dom_is_in_list = True;
}
/* init domain */
- dom = talloc_zero(idmap_ctx, struct idmap_domain);
+ dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
IDMAP_CHECK_ALLOC(dom);
dom->name = talloc_strdup(dom, dom_list[i]);
/* default or specific ? */
dom->default_domain = lp_parm_bool(-1, config_option, "default", False);
+
if (dom->default_domain ||
strequal(dom_list[i], idmap_default_domain[0])) {
- /* the default domain is a cacth all domain
- * so no specific domain sid is provided */
- dom->sid = NULL;
+
/* make sure this is set even when we match idmap_default_domain[0] */
dom->default_domain = True;
- if (lp_parm_const_string(-1, config_option, "domain sid", NULL)) {
- DEBUG(1, ("WARNING: Can't force a /domain sid/ on the DEFAULT domain, Ignoring!"));
- }
-
- /* only one default domain is permitted */
if (default_already_defined) {
DEBUG(1, ("ERROR: Multiple domains defined as default!\n"));
ret = NT_STATUS_INVALID_PARAMETER;
default_already_defined = True;
- } else {
- const char *sid;
-
- sid = lp_parm_const_string(-1, config_option, "domain sid", NULL);
- if (sid) {
- dom->sid = string_sid_talloc(dom, sid);
- } else {
- struct winbindd_domain *wdom = find_domain_from_name(dom->name);
- if (wdom) {
- dom->sid = sid_dup_talloc(dom, &wdom->sid);
- IDMAP_CHECK_ALLOC(dom->sid);
- }
- }
-
- if ( ! dom->sid) {
- DEBUG(1, ("ERROR: Could not find DOMAIN SID for domain %s\n", dom->name));
- DEBUGADD(1, (" Consider to set explicitly the /domain sid/ option\n"));
- ret = NT_STATUS_NO_SUCH_DOMAIN;
- goto done;
- }
- }
+ }
- /* is this a readonly domain ? */
dom->readonly = lp_parm_bool(-1, config_option, "readonly", False);
/* find associated backend (default: tdb) */
if (compat) {
parm_backend = talloc_strdup(idmap_ctx, compat_backend);
} else {
- parm_backend =
- talloc_strdup(idmap_ctx,
- lp_parm_const_string(-1, config_option, "backend", "tdb"));
+ parm_backend = talloc_strdup(idmap_ctx,
+ lp_parm_const_string(-1, config_option, "backend", "tdb"));
}
IDMAP_CHECK_ALLOC(parm_backend);
/* check the set_mapping function exists otherwise mark the module as readonly */
if ( ! dom->methods->set_mapping) {
+ DEBUG(5, ("Forcing to readonly, as this module can't store arbitrary mappings.\n"));
dom->readonly = True;
}
/* now that we have methods, set the destructor for this domain */
talloc_set_destructor(dom, close_domain_destructor);
+ if (compat_params) {
+ dom->params = talloc_strdup(dom, compat_params);
+ IDMAP_CHECK_ALLOC(dom->params);
+ } else {
+ dom->params = NULL;
+ }
+
/* Finally instance a backend copy for this domain */
- ret = dom->methods->init(dom, compat_params);
+ ret = dom->methods->init(dom);
if ( ! NT_STATUS_IS_OK(ret)) {
- DEBUG(0, ("ERROR: Initialization failed for backend %s (domain %s)\n",
+ DEBUG(0, ("ERROR: Initialization failed for backend %s (domain %s), deferred!\n",
parm_backend, dom->name));
- ret = NT_STATUS_UNSUCCESSFUL;
- goto done;
}
idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, i+1);
if ( ! idmap_domains) {
def_dom_num = i;
}
- DEBUG(10, ("Domain %s - Sid %s - Backend %s - %sdefault - %sreadonly\n",
- dom->name, sid_string_static(dom->sid), parm_backend,
+ DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
+ dom->name, parm_backend,
dom->default_domain?"":"not ", dom->readonly?"":"not "));
talloc_free(config_option);
if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
( ! pri_dom_is_in_list) &&
lp_winbind_trusted_domains_only()) {
- DOM_SID our_sid;
- if (!secrets_fetch_domain_sid(lp_workgroup(), &our_sid)) {
- DEBUG(0, ("Could not fetch our SID - did we join?\n"));
- ret = NT_STATUS_UNSUCCESSFUL;
- goto done;
- }
-
- dom = talloc_zero(idmap_ctx, struct idmap_domain);
+ dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
IDMAP_CHECK_ALLOC(dom);
dom->name = talloc_strdup(dom, lp_workgroup());
dom->default_domain = False;
dom->readonly = True;
- dom->sid = sid_dup_talloc(dom, &our_sid);
- IDMAP_CHECK_ALLOC(dom->sid);
-
/* get the backend methods for passdb */
dom->methods = get_methods(backends, "nss");
/* now that we have methods, set the destructor for this domain */
talloc_set_destructor(dom, close_domain_destructor);
+ if (compat_params) {
+ dom->params = talloc_strdup(dom, compat_params);
+ IDMAP_CHECK_ALLOC(dom->params);
+ } else {
+ dom->params = NULL;
+ }
+
/* Finally instance a backend copy for this domain */
- ret = dom->methods->init(dom, compat_params);
+ ret = dom->methods->init(dom);
if ( ! NT_STATUS_IS_OK(ret)) {
DEBUG(0, ("ERROR: Initialization failed for idmap_nss ?!\n"));
ret = NT_STATUS_UNSUCCESSFUL;
}
idmap_domains[num_domains] = dom;
- DEBUG(10, ("Domain %s - Sid %s - Backend nss - not default - readonly\n",
- dom->name, sid_string_static(dom->sid)));
+ DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n", dom->name ));
num_domains++;
}
/**** automatically add idmap_passdb backend ****/
- dom = talloc_zero(idmap_ctx, struct idmap_domain);
+ dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
IDMAP_CHECK_ALLOC(dom);
dom->name = talloc_strdup(dom, get_global_sam_name());
dom->default_domain = False;
dom->readonly = True;
- dom->sid = sid_dup_talloc(dom, get_global_sam_sid());
- IDMAP_CHECK_ALLOC(dom->sid);
-
/* get the backend methods for passdb */
dom->methods = get_methods(backends, "passdb");
/* now that we have methods, set the destructor for this domain */
talloc_set_destructor(dom, close_domain_destructor);
+ if (compat_params) {
+ dom->params = talloc_strdup(dom, compat_params);
+ IDMAP_CHECK_ALLOC(dom->params);
+ } else {
+ dom->params = NULL;
+ }
+
/* Finally instance a backend copy for this domain */
- ret = dom->methods->init(dom, compat_params);
+ ret = dom->methods->init(dom);
if ( ! NT_STATUS_IS_OK(ret)) {
DEBUG(0, ("ERROR: Initialization failed for idmap_passdb ?!\n"));
ret = NT_STATUS_UNSUCCESSFUL;
/* needed to handle special BUILTIN and wellknown SIDs cases */
pdb_dom_num = num_domains;
- DEBUG(10, ("Domain %s - Sid %s - Backend passdb - not default - readonly\n",
- dom->name, sid_string_static(dom->sid)));
- DEBUGADD(10, (" (special: includes handling BUILTIN and Wellknown SIDs as well)\n"));
+ DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n", dom->name));
num_domains++;
/**** finished adding idmap_passdb backend ****/
/* sort domains so that the default is the last one */
- if (def_dom_num != num_domains-1) { /* default is not last, move it */
+ /* don't sort if no default domain defined */
+ if (def_dom_num != -1 && def_dom_num != num_domains-1) { /* default is not last, move it */
struct idmap_domain *tmp;
if (pdb_dom_num > def_dom_num) {
}
- /***************************
- * initialize alloc module
- */
- DEBUG(1, ("Initializing idmap alloc module\n"));
+ /* Initialize alloc module */
+ DEBUG(3, ("Initializing idmap alloc module\n"));
+
+ alloc_backend = NULL;
if (compat) {
alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
} else {
if (ab && (ab[0] != '\0')) {
alloc_backend = talloc_strdup(idmap_ctx, lp_idmap_alloc_backend());
- } else {
- alloc_backend = talloc_strdup(idmap_ctx, "tdb");
}
}
- IDMAP_CHECK_ALLOC(alloc_backend);
- alloc_methods = get_alloc_methods(alloc_backends, alloc_backend);
- if ( ! alloc_methods) {
- ret = smb_probe_module("idmap", alloc_backend);
- if (NT_STATUS_IS_OK(ret)) {
- alloc_methods = get_alloc_methods(alloc_backends, alloc_backend);
+ if ( alloc_backend ) {
+
+ idmap_alloc_ctx = TALLOC_ZERO_P(idmap_ctx, struct idmap_alloc_context);
+ IDMAP_CHECK_ALLOC(idmap_alloc_ctx);
+
+ idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends, alloc_backend);
+ if ( ! idmap_alloc_ctx->methods) {
+ ret = smb_probe_module("idmap", alloc_backend);
+ if (NT_STATUS_IS_OK(ret)) {
+ idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends, alloc_backend);
+ }
}
- }
- if ( ! alloc_methods) {
- DEBUG(0, ("ERROR: Could not get methods for alloc backend %s\n", alloc_backend));
- ret = NT_STATUS_UNSUCCESSFUL;
- goto done;
- }
+ if (idmap_alloc_ctx->methods) {
- ret = alloc_methods->init(compat_params);
- if ( ! NT_STATUS_IS_OK(ret)) {
- DEBUG(0, ("ERROR: Initialization failed for alloc backend %s\n", alloc_backend));
- ret = NT_STATUS_UNSUCCESSFUL;
- goto done;
+ if (compat_params) {
+ idmap_alloc_ctx->params = talloc_strdup(idmap_alloc_ctx, compat_params);
+ IDMAP_CHECK_ALLOC(idmap_alloc_ctx->params);
+ } else {
+ idmap_alloc_ctx->params = NULL;
+ }
+
+ ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(0, ("ERROR: Initialization failed for alloc "
+ "backend %s, deferred!\n", alloc_backend));
+ } else {
+ idmap_alloc_ctx->initialized = True;
+ }
+ } else {
+ DEBUG(2, ("idmap_init: Unable to get methods for alloc backend %s\n",
+ alloc_backend));
+ /* certain compat backends are just readonly */
+ if ( compat ) {
+ TALLOC_FREE(idmap_alloc_ctx);
+ ret = NT_STATUS_OK;
+ } else {
+ ret = NT_STATUS_UNSUCCESSFUL;
+ }
+ }
}
+
+ /* cleanpu temporary strings */
+ TALLOC_FREE( compat_backend );
- return NT_STATUS_OK;
+ idmap_init_status = NT_STATUS_OK;
+
+ return ret;
done:
DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
idmap_close();
+
return ret;
}
+static NTSTATUS idmap_alloc_init(void)
+{
+ NTSTATUS ret;
+
+ if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ return ret;
+ }
+
+ if ( ! idmap_alloc_ctx) {
+ return NT_STATUS_NOT_SUPPORTED;
+ }
+
+ if ( ! idmap_alloc_ctx->initialized) {
+ ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ DEBUG(0, ("ERROR: Initialization failed for alloc "
+ "backend, deferred!\n"));
+ return ret;
+ } else {
+ idmap_alloc_ctx->initialized = True;
+ }
+ }
+
+ return NT_STATUS_OK;
+}
+
/**************************************************************************
idmap allocator interface functions
**************************************************************************/
{
NTSTATUS ret;
- if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
return ret;
}
id->type = ID_TYPE_UID;
- return alloc_methods->allocate_id(id);
+ return idmap_alloc_ctx->methods->allocate_id(id);
}
NTSTATUS idmap_allocate_gid(struct unixid *id)
{
NTSTATUS ret;
- if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
return ret;
}
id->type = ID_TYPE_GID;
- return alloc_methods->allocate_id(id);
+ return idmap_alloc_ctx->methods->allocate_id(id);
}
NTSTATUS idmap_set_uid_hwm(struct unixid *id)
{
NTSTATUS ret;
- if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
return ret;
}
id->type = ID_TYPE_UID;
- return alloc_methods->set_id_hwm(id);
+ return idmap_alloc_ctx->methods->set_id_hwm(id);
}
NTSTATUS idmap_set_gid_hwm(struct unixid *id)
{
NTSTATUS ret;
- if (! NT_STATUS_IS_OK(ret = idmap_init())) {
+ if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
return ret;
}
id->type = ID_TYPE_GID;
- return alloc_methods->set_id_hwm(id);
+ return idmap_alloc_ctx->methods->set_id_hwm(id);
}
+/******************************************************************************
+ Lookup an idmap_domain give a full user or group SID
+ ******************************************************************************/
+
+static struct idmap_domain* find_idmap_domain_from_sid( DOM_SID *account_sid )
+{
+ DOM_SID domain_sid;
+ uint32 rid;
+ struct winbindd_domain *domain = NULL;
+ int i;
+
+ /* 1. Handle BUILTIN or Special SIDs and prevent them from
+ falling into the default domain space (if we have a
+ configured passdb backend. */
+
+ if ( (pdb_dom_num != -1) &&
+ (sid_check_is_in_builtin(account_sid) ||
+ sid_check_is_in_wellknown_domain(account_sid) ||
+ sid_check_is_in_unix_groups(account_sid) ||
+ sid_check_is_in_unix_users(account_sid)) )
+ {
+ return idmap_domains[pdb_dom_num];
+ }
+
+ /* 2. Lookup the winbindd_domain from the account_sid */
+
+ sid_copy( &domain_sid, account_sid );
+ sid_split_rid( &domain_sid, &rid );
+ domain = find_domain_from_sid_noinit( &domain_sid );
+
+ for (i = 0; domain && i < num_domains; i++) {
+ if ( strequal( idmap_domains[i]->name, domain->name ) ) {
+ return idmap_domains[i];
+ }
+ }
+
+ /* 3. Fall back to the default domain */
+
+ if ( def_dom_num != -1 ) {
+ return idmap_domains[def_dom_num];
+ }
+
+ return NULL;
+}
+
+/******************************************************************************
+ Lookup an index given an idmap_domain pointer
+ ******************************************************************************/
+
+static uint32 find_idmap_domain_index( struct idmap_domain *id_domain)
+{
+ int i;
+
+ for (i = 0; i < num_domains; i++) {
+ if ( idmap_domains[i] == id_domain )
+ return i;
+ }
+
+ return -1;
+}
+
+
/*********************************************************
Check if creating a mapping is permitted for the domain
*********************************************************/
static NTSTATUS idmap_can_map(const struct id_map *map, struct idmap_domain **ret_dom)
{
struct idmap_domain *dom;
- int i;
/* Check we do not create mappings for our own local domain, or BUILTIN or special SIDs */
if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
sid_check_is_in_builtin(map->sid) ||
- sid_check_is_in_wellknown_domain(map->sid)) {
+ sid_check_is_in_wellknown_domain(map->sid) ||
+ sid_check_is_in_unix_users(map->sid) ||
+ sid_check_is_in_unix_groups(map->sid) )
+ {
DEBUG(10, ("We are not supposed to create mappings for our own domains (local, builtin, specials)\n"));
return NT_STATUS_UNSUCCESSFUL;
}
}
}
- for (i = 0, dom = NULL; i < num_domains; i++) {
- if ((idmap_domains[i]->default_domain) || /* ok set it into the default domain */
- (sid_compare_domain(idmap_domains[i]->sid, map->sid) == 0)) { /* ok found a specific domain */
- dom = idmap_domains[i];
- break;
- }
- }
-
- if (! dom) {
+ if ( (dom = find_idmap_domain_from_sid( map->sid )) == NULL ) {
/* huh, couldn't find a suitable domain, let's just leave it unmapped */
- DEBUG(10, ("Could not find imdap backend for SID %s", sid_string_static(map->sid)));
+ DEBUG(10, ("Could not find idmap backend for SID %s", sid_string_static(map->sid)));
return NT_STATUS_NO_SUCH_DOMAIN;
}
if (dom->readonly) {
/* ouch the domain is read only, let's just leave it unmapped */
- DEBUG(10, ("imdap backend for SID %s is READONLY!\n", sid_string_static(map->sid)));
+ DEBUG(10, ("idmap backend for SID %s is READONLY!\n", sid_string_static(map->sid)));
return NT_STATUS_UNSUCCESSFUL;
}
{
NTSTATUS ret;
struct idmap_domain *dom;
- const char *domname, *name;
- enum lsa_SidType sid_type;
- BOOL wbret;
+
+ /* If we are offline we cannot lookup SIDs, deny mapping */
+ if (idmap_is_offline()) {
+ return NT_STATUS_FILE_IS_OFFLINE;
+ }
ret = idmap_can_map(map, &dom);
if ( ! NT_STATUS_IS_OK(ret)) {
return NT_STATUS_NONE_MAPPED;
}
-
- /* by default calls to winbindd are disabled
- the following call will not recurse so this is safe */
- winbind_on();
- wbret = winbind_lookup_sid(ctx, map->sid, &domname, &name, &sid_type);
- winbind_off();
/* check if this is a valid SID and then map it */
- if (wbret) {
- switch (sid_type) {
- case SID_NAME_USER:
- ret = idmap_allocate_uid(&map->xid);
- if ( ! NT_STATUS_IS_OK(ret)) {
- /* can't allocate id, let's just leave it unmapped */
- DEBUG(2, ("uid allocation failed! Can't create mapping\n"));
- return NT_STATUS_NONE_MAPPED;
- }
- break;
- case SID_NAME_DOM_GRP:
- case SID_NAME_ALIAS:
- case SID_NAME_WKN_GRP:
- ret = idmap_allocate_gid(&map->xid);
- if ( ! NT_STATUS_IS_OK(ret)) {
- /* can't allocate id, let's just leave it unmapped */
- DEBUG(2, ("gid allocation failed! Can't create mapping\n"));
- return NT_STATUS_NONE_MAPPED;
- }
- break;
- default:
- /* invalid sid, let's just leave it unmapped */
- DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map->sid)));
+ switch (map->xid.type) {
+ case ID_TYPE_UID:
+ ret = idmap_allocate_uid(&map->xid);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* can't allocate id, let's just leave it unmapped */
+ DEBUG(2, ("uid allocation failed! Can't create mapping\n"));
+ return NT_STATUS_NONE_MAPPED;
+ }
+ break;
+ case ID_TYPE_GID:
+ ret = idmap_allocate_gid(&map->xid);
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* can't allocate id, let's just leave it unmapped */
+ DEBUG(2, ("gid allocation failed! Can't create mapping\n"));
return NT_STATUS_NONE_MAPPED;
}
+ break;
+ default:
+ /* invalid sid, let's just leave it unmapped */
+ DEBUG(3,("idmap_new_mapping: Refusing to create a "
+ "mapping for an unspecified ID type.\n"));
+ return NT_STATUS_NONE_MAPPED;
+ }
- /* ok, got a new id, let's set a mapping */
- map->status = ID_MAPPED;
+ /* ok, got a new id, let's set a mapping */
+ map->status = ID_MAPPED;
- DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
- sid_string_static(map->sid),
- (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
- (unsigned long)map->xid.id));
- ret = dom->methods->set_mapping(dom, map);
+ DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
+ sid_string_static(map->sid),
+ (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
+ (unsigned long)map->xid.id));
+ ret = dom->methods->set_mapping(dom, map);
- if ( ! NT_STATUS_IS_OK(ret)) {
- /* something wrong here :-( */
- DEBUG(2, ("Failed to commit mapping\n!"));
+ if ( ! NT_STATUS_IS_OK(ret)) {
+ /* something wrong here :-( */
+ DEBUG(2, ("Failed to commit mapping\n!"));
- /* TODO: would it make sense to have an "unalloc_id function?" */
+ /* TODO: would it make sense to have an "unalloc_id function?" */
- return NT_STATUS_NONE_MAPPED;
- }
- } else {
- DEBUG(2,("Invalid SID, not mapping %s (type %d)\n",
- sid_string_static(map->sid), sid_type));
return NT_STATUS_NONE_MAPPED;
}
return ret;
}
- DEBUG(10, ("set_mapping for domain %s(%s)\n", dom->name, sid_string_static(dom->sid)));
+ DEBUG(10,("set_mapping for domain %s\n", dom->name ));
return dom->methods->set_mapping(dom, map);
}
_ids = ids;
- /* make sure all maps are marked as in UNKNOWN status */
- for (i = 0; _ids[i]; i++) {
- _ids[i]->status = ID_UNKNOWN;
- }
-
unmapped = NULL;
for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
dom = idmap_domains[n];
- DEBUG(10, ("Query sids from domain %s(%s)\n", dom->name, sid_string_static(dom->sid)));
+ DEBUG(10, ("Query sids from domain %s\n", dom->name));
ret = dom->methods->unixids_to_sids(dom, _ids);
- IDMAP_CHECK_RET(ret);
+ IDMAP_REPORT_RET(ret);
unmapped = NULL;
for (i = 0, u = 0; _ids[i]; i++) {
- if (_ids[i]->status == ID_UNKNOWN || _ids[i]->status == ID_UNMAPPED) {
+ if (_ids[i]->status != ID_MAPPED) {
unmapped = talloc_realloc(ctx, unmapped, struct id_map *, u + 2);
IDMAP_CHECK_ALLOC(unmapped);
unmapped[u] = _ids[i];
if (unmapped) {
/* there are still unmapped ids, map them to the unix users/groups domains */
+ /* except for expired entries, these will be returned as valid (offline mode) */
for (i = 0; unmapped[i]; i++) {
+ if (unmapped[i]->status == ID_EXPIRED) continue;
switch (unmapped[i]->xid.type) {
case ID_TYPE_UID:
uid_to_unix_users_sid((uid_t)unmapped[i]->xid.id, unmapped[i]->sid);
NTSTATUS ret;
int i, *counters;
- if (!ids || !*ids) {
- DEBUG(1, ("Invalid list of maps\n"));
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- ctx = talloc_named_const(NULL, 0, "idmap_backends_sids_to_unixids ctx");
- if ( ! ctx) {
+ if ( (ctx = talloc_named_const(NULL, 0, "be_sids_to_ids")) == NULL ) {
DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
return NT_STATUS_NO_MEMORY;
}
DEBUG(10, ("Query backends to map sids->ids\n"));
/* split list per domain */
- dom_ids = talloc_zero_array(ctx, struct id_map **, num_domains);
+ if (num_domains == 0) {
+ DEBUG(1, ("No domains available?\n"));
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ dom_ids = TALLOC_ZERO_ARRAY(ctx, struct id_map **, num_domains);
IDMAP_CHECK_ALLOC(dom_ids);
- counters = talloc_zero_array(ctx, int, num_domains);
+ counters = TALLOC_ZERO_ARRAY(ctx, int, num_domains);
+ IDMAP_CHECK_ALLOC(counters);
- for (i = 0; ids[i]; i++) {
- int dom_num;
+ /* partition the requests by domain */
- /* make sure they are unknown to start off */
- ids[i]->status = ID_UNKNOWN;
+ for (i = 0; ids[i]; i++) {
+ uint32 idx;
- for (dom_num = 0, dom = NULL; dom_num < num_domains; dom_num++) {
- if (idmap_domains[dom_num]->default_domain) {
- /* we got to the default domain */
- dom = idmap_domains[dom_num];
- break;
- }
- if (sid_compare_domain(idmap_domains[dom_num]->sid, ids[i]->sid) == 0) {
- dom = idmap_domains[dom_num];
- break;
- }
- }
- if (( ! dom) || dom->default_domain) {
- /* handle BUILTIN or Special SIDs
- * and prevent them from falling into the default domain space */
- if ((sid_check_is_in_builtin(ids[i]->sid) ||
- sid_check_is_in_wellknown_domain(ids[i]->sid))) {
-
- if (pdb_dom_num != -1) {
- dom = idmap_domains[pdb_dom_num];
- dom_num = pdb_dom_num;
- } else {
- dom = NULL;
- }
- }
- }
- if ( ! dom) {
- /* no dom move on */
+ if ( (dom = find_idmap_domain_from_sid( ids[i]->sid )) == NULL ) {
+ /* no available idmap_domain. Move on */
continue;
}
- DEBUG(10, ("SID %s is being handled by %s(%d)\n",
- sid_string_static(ids[i]->sid),
- dom?dom->name:"none",
- dom_num));
+ DEBUG(10,("SID %s is being handled by %s\n",
+ sid_string_static(ids[i]->sid),
+ dom ? dom->name : "none" ));
- dom_ids[dom_num] = talloc_realloc(ctx, dom_ids[dom_num], struct id_map *, counters[dom_num] + 2);
- IDMAP_CHECK_ALLOC(dom_ids[dom_num]);
+ idx = find_idmap_domain_index( dom );
+ SMB_ASSERT( idx != -1 );
+
+ dom_ids[idx] = talloc_realloc(ctx, dom_ids[idx],
+ struct id_map *, counters[idx] + 2);
+ IDMAP_CHECK_ALLOC(dom_ids[idx]);
- dom_ids[dom_num][counters[dom_num]] = ids[i];
- counters[dom_num]++;
- dom_ids[dom_num][counters[dom_num]] = NULL;
+ dom_ids[idx][counters[idx]] = ids[i];
+ counters[idx]++;
+ dom_ids[idx][counters[idx]] = NULL;
}
- /* ok all the ids have been dispatched in the right queues
- * let's cycle through the filled ones */
+ /* All the ids have been dispatched in the right queues.
+ Let's cycle through the filled ones */
for (i = 0; i < num_domains; i++) {
- if (dom_ids[i]) { /* ok, we have ids in this one */
+ if (dom_ids[i]) {
dom = idmap_domains[i];
- DEBUG(10, ("Query ids from domain %s(%s)\n", dom->name, sid_string_static(dom->sid)));
+ DEBUG(10, ("Query ids from domain %s\n", dom->name));
ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
- IDMAP_CHECK_RET(ret);
+ IDMAP_REPORT_RET(ret);
}
}
/* let's see if we have any unmapped SID left and act accordingly */
for (i = 0; ids[i]; i++) {
+ /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
+ * was not able to confirm/deny (offline mode) */
if (ids[i]->status == ID_UNKNOWN || ids[i]->status == ID_UNMAPPED) {
/* ok this is an unmapped one, see if we can map it */
ret = idmap_new_mapping(ctx, ids[i]);
/* could not map it */
ids[i]->status = ID_UNMAPPED;
} else {
- /* Something very bad happened down there */
+ /* Something very bad happened down there
+ * OR we are offline */
ids[i]->status = ID_UNKNOWN;
}
}
struct id_map **bids;
int i, bi;
int bn = 0;
+ struct winbindd_domain *our_domain = find_our_domain();
if (! NT_STATUS_IS_OK(ret = idmap_init())) {
return ret;
if ( ! bids) {
/* alloc space for ids to be resolved by backends (realloc ten by ten) */
- bids = talloc_array(ctx, struct id_map *, 10);
+ bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
if ( ! bids) {
DEBUG(1, ("Out of memory!\n"));
talloc_free(ctx);
/* let's see if there is any id mapping to be retieved from the backends */
if (bi) {
+ /* Only do query if we are online */
+ if ( IS_DOMAIN_OFFLINE(our_domain) ) {
+ ret = NT_STATUS_FILE_IS_OFFLINE;
+ goto done;
+ }
+
ret = idmap_backends_unixids_to_sids(bids);
IDMAP_CHECK_RET(ret);
for (i = 0; i < bi; i++) {
if (bids[i]->status == ID_MAPPED) {
ret = idmap_cache_set(idmap_cache, bids[i]);
+ } else if (bids[i]->status == ID_EXPIRED) {
+ /* the cache returned an expired entry and the backend was
+ * was not able to clear the situation (offline).
+ * This handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
+ * for disconnected mode, */
+ bids[i]->status = ID_MAPPED;
} else if (bids[i]->status == ID_UNKNOWN) {
- /* return an expired entry in the cache or an unknown */
- /* this handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
- * for disconnected mode */
- idmap_cache_map_id(idmap_cache, ids[i]);
+ /* something bad here. We were not able to handle this for some
+ * reason, mark it as unmapped and hope next time things will
+ * settle down. */
+ bids[i]->status = ID_UNMAPPED;
} else { /* unmapped */
ret = idmap_cache_set_negative_id(idmap_cache, bids[i]);
}
struct id_map **bids;
int i, bi;
int bn = 0;
+ struct winbindd_domain *our_domain = find_our_domain();
if (! NT_STATUS_IS_OK(ret = idmap_init())) {
return ret;
if ( ! NT_STATUS_IS_OK(ret)) {
if ( ! bids) {
- /* alloc space for ids to be resolved by backends (realloc ten by ten) */
- bids = talloc_array(ctx, struct id_map *, 10);
+ /* alloc space for ids to be resolved
+ by backends (realloc ten by ten) */
+ bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
if ( ! bids) {
DEBUG(1, ("Out of memory!\n"));
talloc_free(ctx);
/* let's see if there is any id mapping to be retieved from the backends */
if (bids) {
+ /* Only do query if we are online */
+ if ( IS_DOMAIN_OFFLINE(our_domain) ) {
+ ret = NT_STATUS_FILE_IS_OFFLINE;
+ goto done;
+ }
+
ret = idmap_backends_sids_to_unixids(bids);
IDMAP_CHECK_RET(ret);
for (i = 0; bids[i]; i++) {
if (bids[i]->status == ID_MAPPED) {
ret = idmap_cache_set(idmap_cache, bids[i]);
+ } else if (bids[i]->status == ID_EXPIRED) {
+ /* the cache returned an expired entry and the backend was
+ * was not able to clear the situation (offline).
+ * This handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
+ * for disconnected mode, */
+ bids[i]->status = ID_MAPPED;
} else if (bids[i]->status == ID_UNKNOWN) {
- /* return an expired entry in the cache or an unknown */
- /* this handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
- * for disconnected mode */
- idmap_cache_map_id(idmap_cache, ids[i]);
- } else {
+ /* something bad here. We were not able to handle this for some
+ * reason, mark it as unmapped and hope next time things will
+ * settle down. */
+ bids[i]->status = ID_UNMAPPED;
+ } else { /* unmapped */
ret = idmap_cache_set_negative_sid(idmap_cache, bids[i]);
}
IDMAP_CHECK_RET(ret);
return;
}
- allid.type = ID_TYPE_UID;
- allid.id = 0;
- alloc_methods->get_id_hwm(&allid);
- fprintf(dump, "USER HWM %lu\n", (unsigned long)allid.id);
-
- allid.type = ID_TYPE_GID;
- allid.id = 0;
- alloc_methods->get_id_hwm(&allid);
- fprintf(dump, "GROUP HWM %lu\n", (unsigned long)allid.id);
-
+ if (NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
+ allid.type = ID_TYPE_UID;
+ allid.id = 0;
+ idmap_alloc_ctx->methods->get_id_hwm(&allid);
+ fprintf(dump, "USER HWM %lu\n", (unsigned long)allid.id);
+
+ allid.type = ID_TYPE_GID;
+ allid.id = 0;
+ idmap_alloc_ctx->methods->get_id_hwm(&allid);
+ fprintf(dump, "GROUP HWM %lu\n", (unsigned long)allid.id);
+ }
+
maps = talloc(idmap_ctx, struct id_map);
num_maps = 0;
(unsigned long)maps[i].xid.id,
sid_string_static(maps[i].sid));
break;
+ case ID_TYPE_NOT_SPECIFIED:
+ break;
}
}
fclose(dump);
}
-const char *idmap_fecth_secret(const char *backend, bool alloc,
- const char *domain, const char *identity)
+char *idmap_fetch_secret(const char *backend, bool alloc,
+ const char *domain, const char *identity)
{
char *tmp, *ret;
int r;
r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
}
- if (r < 0) return NULL;
+ if (r < 0)
+ return NULL;
strupper_m(tmp); /* make sure the key is case insensitive */
ret = secrets_fetch_generic(tmp, identity);
- free(tmp);
+ SAFE_FREE( tmp );
+
return ret;
}
+
git.samba.org / tprouty / samba.git / blobdiff