/*
- Unix SMB/Netbios implementation.
- Version 2.0
+ Unix SMB/CIFS implementation.
Winbind daemon - sid related functions
*/
#include "winbindd.h"
-#include "sids.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_WINBIND
/* Convert a string */
DOM_SID sid, tmp_sid;
uint32 rid;
fstring name;
+ fstring dom_name;
+
+ /* Ensure null termination */
+ state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
- DEBUG(3, ("[%5d]: lookupsid %s\n", state->pid,
+ DEBUG(3, ("[%5lu]: lookupsid %s\n", (unsigned long)state->pid,
state->request.data.sid));
/* Lookup sid from PDC using lsa_lookup_sids() */
- string_to_sid(&sid, state->request.data.sid);
+ if (!string_to_sid(&sid, state->request.data.sid)) {
+ DEBUG(5, ("%s not a SID\n", state->request.data.sid));
+ return WINBINDD_ERROR;
+ }
/* Don't look up BUILTIN sids */
/* Lookup the sid */
- if (!winbindd_lookup_name_by_sid(&sid, name, &type)) {
+ if (!winbindd_lookup_name_by_sid(&sid, dom_name, name, &type)) {
return WINBINDD_ERROR;
}
- string_sub(name, "\\", lp_winbind_separator(), sizeof(fstring));
+ fstrcpy(state->response.data.name.dom_name, dom_name);
fstrcpy(state->response.data.name.name, name);
+
state->response.data.name.type = type;
return WINBINDD_OK;
}
-/* Convert a sid to a string */
+/**
+ * Look up the SID for a qualified name.
+ **/
enum winbindd_result winbindd_lookupname(struct winbindd_cli_state *state)
{
enum SID_NAME_USE type;
- fstring sid_str, name_domain, name_user, name;
+ fstring sid_str;
+ char *name_domain, *name_user;
DOM_SID sid;
-
- DEBUG(3, ("[%5d]: lookupname %s\n", state->pid,
- state->request.data.name));
+ struct winbindd_domain *domain;
- parse_domain_user(state->request.data.name, name_domain, name_user);
+ /* Ensure null termination */
+ state->request.data.sid[sizeof(state->request.data.name.dom_name)-1]='\0';
- snprintf(name, sizeof(name), "%s\\%s", name_domain, name_user);
+ /* Ensure null termination */
+ state->request.data.sid[sizeof(state->request.data.name.name)-1]='\0';
- /* Lookup name from PDC using lsa_lookup_names() */
+ DEBUG(3, ("[%5lu]: lookupname %s%s%s\n", (unsigned long)state->pid,
+ state->request.data.name.dom_name,
+ lp_winbind_separator(),
+ state->request.data.name.name));
+
+ name_domain = state->request.data.name.dom_name;
+ name_user = state->request.data.name.name;
- if (!winbindd_lookup_sid_by_name(name, &sid, &type)) {
+ if ((domain = find_domain_from_name(name_domain)) == NULL) {
+ DEBUG(0, ("could not find domain entry for domain %s\n",
+ name_domain));
+ return WINBINDD_ERROR;
+ }
+
+ /* Lookup name from PDC using lsa_lookup_names() */
+ if (!winbindd_lookup_sid_by_name(domain, name_user, &sid, &type)) {
return WINBINDD_ERROR;
}
enum winbindd_result winbindd_sid_to_uid(struct winbindd_cli_state *state)
{
DOM_SID sid;
- uint32 user_rid;
- struct winbindd_domain *domain;
+ uint32 flags = 0x0;
- DEBUG(3, ("[%5d]: sid to uid %s\n", state->pid,
+ /* Ensure null termination */
+ state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
+
+ DEBUG(3, ("[%5lu]: sid to uid %s\n", (unsigned long)state->pid,
state->request.data.sid));
/* Split sid into domain sid and user rid */
-
- string_to_sid(&sid, state->request.data.sid);
- sid_split_rid(&sid, &user_rid);
-
- /* Find domain this sid belongs to */
-
- if ((domain = find_domain_from_sid(&sid)) == NULL) {
- fstring sid_str;
-
- sid_to_string(sid_str, &sid);
- DEBUG(1, ("Could not find domain for sid %s\n", sid_str));
+ if (!string_to_sid(&sid, state->request.data.sid)) {
+ DEBUG(1, ("Could not get convert sid %s from string\n", state->request.data.sid));
return WINBINDD_ERROR;
}
-
+
+ if ( state->request.flags & WBFLAG_QUERY_ONLY )
+ flags = ID_QUERY_ONLY;
+
/* Find uid for this sid and return it */
-
- if (!winbindd_idmap_get_uid_from_rid(domain->name, user_rid,
- &state->response.data.uid)) {
- DEBUG(1, ("Could not get uid for sid %s\n",
- state->request.data.sid));
+ if ( !NT_STATUS_IS_OK(idmap_sid_to_uid(&sid, &(state->response.data.uid), flags)) ) {
+ DEBUG(1, ("Could not get uid for sid %s\n", state->request.data.sid));
return WINBINDD_ERROR;
}
enum winbindd_result winbindd_sid_to_gid(struct winbindd_cli_state *state)
{
DOM_SID sid;
- uint32 group_rid;
- struct winbindd_domain *domain;
+ uint32 flags = 0x0;
- DEBUG(3, ("[%5d]: sid to gid %s\n", state->pid,
- state->request.data.sid));
-
- /* Split sid into domain sid and user rid */
+ /* Ensure null termination */
+ state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
- string_to_sid(&sid, state->request.data.sid);
- sid_split_rid(&sid, &group_rid);
-
- /* Find domain this sid belongs to */
-
- if ((domain = find_domain_from_sid(&sid)) == NULL) {
- fstring sid_str;
+ DEBUG(3, ("[%5lu]: sid to gid %s\n", (unsigned long)state->pid,
+ state->request.data.sid));
- sid_to_string(sid_str, &sid);
- DEBUG(1, ("Could not find domain for sid %s\n", sid_str));
+ if (!string_to_sid(&sid, state->request.data.sid)) {
+ DEBUG(1, ("Could not cvt string to sid %s\n", state->request.data.sid));
return WINBINDD_ERROR;
}
- /* Find uid for this sid and return it */
-
- if (!winbindd_idmap_get_gid_from_rid(domain->name, group_rid,
- &state->response.data.gid)) {
- DEBUG(1, ("Could not get gid for sid %s\n",
- state->request.data.sid));
+ if ( state->request.flags & WBFLAG_QUERY_ONLY )
+ flags = ID_QUERY_ONLY;
+
+ /* Find gid for this sid and return it */
+ if ( !NT_STATUS_IS_OK(idmap_sid_to_gid(&sid, &(state->response.data.gid), flags)) ) {
+ DEBUG(1, ("Could not get gid for sid %s\n", state->request.data.sid));
return WINBINDD_ERROR;
}
enum winbindd_result winbindd_uid_to_sid(struct winbindd_cli_state *state)
{
- struct winbindd_domain *domain;
- uint32 user_rid;
DOM_SID sid;
- /* Bug out if the uid isn't in the winbind range */
-
+#if 0 /* JERRY */
+ /* we cannot do this check this anymore since a domain member of
+ a Samba domain may share unix accounts via NIS or LDAP. In this
+ case the uid/gid will be out of winbindd's range but still might
+ be resolved to a SID via an ldap idmap backend */
+
if ((state->request.data.uid < server_state.uid_low ) ||
(state->request.data.uid > server_state.uid_high)) {
return WINBINDD_ERROR;
}
+#endif
- DEBUG(3, ("[%5d]: uid to sid %d\n", state->pid,
- state->request.data.uid));
+ DEBUG(3, ("[%5lu]: uid to sid %lu\n", (unsigned long)state->pid,
+ (unsigned long)state->request.data.uid));
/* Lookup rid for this uid */
-
- if (!winbindd_idmap_get_rid_from_uid(state->request.data.uid,
- &user_rid, &domain)) {
- DEBUG(1, ("Could not convert uid %d to rid\n",
- state->request.data.uid));
+ if (!NT_STATUS_IS_OK(idmap_uid_to_sid(&sid, state->request.data.uid))) {
+ DEBUG(1, ("Could not convert uid %lu to rid\n",
+ (unsigned long)state->request.data.uid));
return WINBINDD_ERROR;
}
- /* Construct sid and return it */
-
- sid_copy(&sid, &domain->sid);
- sid_append_rid(&sid, user_rid);
sid_to_string(state->response.data.sid.sid, &sid);
state->response.data.sid.type = SID_NAME_USER;
enum winbindd_result winbindd_gid_to_sid(struct winbindd_cli_state *state)
{
- struct winbindd_domain *domain;
- uint32 group_rid;
DOM_SID sid;
- /* Bug out if the gid isn't in the winbind range */
-
+#if 0 /* JERRY */
+ /* we cannot do this check this anymore since a domain member of
+ a Samba domain may share unix accounts via NIS or LDAP. In this
+ case the uid/gid will be out of winbindd's range but still might
+ be resolved to a SID via an ldap idmap backend */
+
if ((state->request.data.gid < server_state.gid_low) ||
(state->request.data.gid > server_state.gid_high)) {
return WINBINDD_ERROR;
}
+#endif
- DEBUG(3, ("[%5d]: gid to sid %d\n", state->pid,
- state->request.data.gid));
+ DEBUG(3, ("[%5lu]: gid to sid %lu\n", (unsigned long)state->pid,
+ (unsigned long)state->request.data.gid));
- /* Lookup rid for this uid */
-
- if (!winbindd_idmap_get_rid_from_gid(state->request.data.gid,
- &group_rid, &domain)) {
- DEBUG(1, ("Could not convert gid %d to rid\n",
- state->request.data.gid));
+ /* Lookup sid for this uid */
+ if (!NT_STATUS_IS_OK(idmap_gid_to_sid(&sid, state->request.data.gid))) {
+ DEBUG(1, ("Could not convert gid %lu to sid\n",
+ (unsigned long)state->request.data.gid));
return WINBINDD_ERROR;
}
/* Construct sid and return it */
-
- sid_copy(&sid, &domain->sid);
- sid_append_rid(&sid, group_rid);
sid_to_string(state->response.data.sid.sid, &sid);
state->response.data.sid.type = SID_NAME_DOM_GRP;
git.samba.org / tprouty / samba.git / blobdiff