source3/winbindd/idmap_autorid.c

   1 /*
   2  *  idmap_autorid: static map between Active Directory/NT RIDs
   3  *  and RFC 2307 accounts
   4  *
   5  *  based on the idmap_rid module, but this module defines the ranges
   6  *  for the domains by automatically allocating a range for each domain
   7  *
   8  *  Copyright (C) Christian Ambach, 2010-2012
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 3 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  22  *
  23  */
  24
  25 /*
  26  * This module allocates ranges for domains to be used in a
  27  * algorithmic mode like idmap_rid. Multiple ranges are supported
  28  * for a single domain: If a rid exceeds the range size, a matching
  29  * range is allocated to hold the rid's id.
  30  *
  31  * Here are the formulas applied:
  32  *
  33  *
  34  * For a sid of the form domain_sid-rid, we have
  35  *
  36  *   rid = reduced_rid + domain_range_index * range_size
  37  *
  38  * with
  39  *   reduced_rid := rid % range_size
  40  *   domain_range_index := rid / range_size
  41  *
  42  * And reduced_rid fits into a range.
  43  *
  44  * In the database, we associate a range_number to
  45  * the pair domain_sid,domain_range_index.
  46  *
  47  * Now the unix id for the given sid calculates as:
  48  *
  49  *   id = reduced_rid + range_low_id
  50  *
  51  * with
  52  *
  53  *   range_low_id = low_id + range_number * range_size
  54  *
  55  *
  56  * The inverse calculation goes like this:
  57  *
  58  * Given a unix id, let
  59  *
  60  *   normalized_id := id - low_id
  61  *   reduced_rid := normalized_id % range_size
  62  *   range_number = normalized_id / range_size
  63  *
  64  * Then we have
  65  *
  66  *   id = reduced_rid + low_id + range_number * range_size
  67  *
  68  * From the database, get the domain_sid,domain_range_index pair
  69  * belonging to the range_number (if there is already one).
  70  *
  71  * Then the rid for the unix id calculates as:
  72  *
  73  *   rid = reduced_rid + domain_range_index * range_size
  74  */
  75
  76 #include "idmap_autorid_tdb.h"
  77 #include "winbindd.h"
  78 #include "idmap.h"
  79 #include "idmap_rw.h"
  80 #include "../libcli/security/dom_sid.h"
  81
  82 #undef DBGC_CLASS
  83 #define DBGC_CLASS DBGC_IDMAP
  84
  85 /* handle to the tdb storing domain <-> range assignments */
  86 static struct db_context *autorid_db;
  87
  88 static bool ignore_builtin = false;
  89
  90 static NTSTATUS idmap_autorid_get_alloc_range(struct idmap_domain *dom,
  91                                         struct autorid_range_config *range)
  92 {
  93         NTSTATUS status;
  94
  95         ZERO_STRUCT(*range);
  96
  97         fstrcpy(range->domsid, ALLOC_RANGE);
  98
  99         status = idmap_autorid_get_domainrange(autorid_db,
 100                                                range,
 101                                                dom->read_only);
 102
 103         return status;
 104 }
 105
 106 static NTSTATUS idmap_autorid_allocate_id(struct idmap_domain *dom,
 107                                           struct unixid *xid) {
 108
 109         NTSTATUS ret;
 110         struct autorid_range_config range;
 111
 112         if (dom->read_only) {
 113                 DEBUG(3, ("Backend is read-only, refusing "
 114                           "new allocation request\n"));
 115                 return NT_STATUS_UNSUCCESSFUL;
 116         }
 117
 118         /* fetch the range for the allocation pool */
 119
 120         ret = idmap_autorid_get_alloc_range(dom, &range);
 121         if (!NT_STATUS_IS_OK(ret)) {
 122                 DEBUG(3, ("Could not determine range for allocation pool, "
 123                           "check previous messages for reason\n"));
 124                 return ret;
 125         }
 126
 127         ret = idmap_tdb_common_get_new_id(dom, xid);
 128
 129         if (!NT_STATUS_IS_OK(ret)) {
 130                 DEBUG(1, ("Fatal error while allocating new ID!\n"));
 131                 return ret;
 132         }
 133
 134         xid->id = xid->id + range.low_id;
 135
 136         DEBUG(10, ("Returned new %s %d from allocation range\n",
 137                    (xid->type==ID_TYPE_UID)?"uid":"gid", xid->id));
 138
 139         return ret;
 140 }
 141
 142 /*
 143  * map a SID to xid using the idmap_tdb like pool
 144  */
 145 static NTSTATUS idmap_autorid_id_to_sid_alloc(struct idmap_domain *dom,
 146                                               struct id_map *map)
 147 {
 148         NTSTATUS ret;
 149
 150         /* look out for the mapping */
 151         ret = idmap_tdb_common_unixid_to_sid(dom, map);
 152
 153         if (NT_STATUS_IS_OK(ret)) {
 154                 map->status = ID_MAPPED;
 155                 return ret;
 156         }
 157
 158         map->status = ID_UNKNOWN;
 159
 160         DEBUG(10, ("no ID->SID mapping for %d could be found\n", map->xid.id));
 161
 162         return ret;
 163 }
 164
 165 static NTSTATUS idmap_autorid_id_to_sid(struct autorid_global_config *cfg,
 166                                         struct idmap_domain *dom,
 167                                         struct id_map *map)
 168 {
 169         uint32_t range_number;
 170         uint32_t domain_range_index = 0;
 171         uint32_t normalized_id;
 172         uint32_t reduced_rid;
 173         uint32_t rid;
 174         TDB_DATA data = tdb_null;
 175         char *keystr;
 176         struct dom_sid domsid;
 177         NTSTATUS status;
 178         bool ok;
 179         const char *q = NULL;
 180
 181         /* can this be one of our ids? */
 182         if (map->xid.id < cfg->minvalue) {
 183                 DEBUG(10, ("id %d is lower than minimum value, "
 184                            "ignoring mapping request\n", map->xid.id));
 185                 map->status = ID_UNKNOWN;
 186                 return NT_STATUS_OK;
 187         }
 188
 189         if (map->xid.id > (cfg->minvalue + cfg->rangesize * cfg->maxranges)) {
 190                 DEBUG(10, ("id %d is outside of maximum id value, "
 191                            "ignoring mapping request\n", map->xid.id));
 192                 map->status = ID_UNKNOWN;
 193                 return NT_STATUS_OK;
 194         }
 195
 196         /* determine the range of this uid */
 197
 198         normalized_id = map->xid.id - cfg->minvalue;
 199         range_number = normalized_id / cfg->rangesize;
 200
 201         keystr = talloc_asprintf(talloc_tos(), "%u", range_number);
 202         if (!keystr) {
 203                 return NT_STATUS_NO_MEMORY;
 204         }
 205
 206         status = dbwrap_fetch_bystring(autorid_db, talloc_tos(), keystr, &data);
 207         TALLOC_FREE(keystr);
 208
 209         if (!NT_STATUS_IS_OK(status)) {
 210                 DEBUG(4, ("id %d belongs to range %d which does not have "
 211                           "domain mapping, ignoring mapping request\n",
 212                           map->xid.id, range_number));
 213                 TALLOC_FREE(data.dptr);
 214                 map->status = ID_UNKNOWN;
 215                 return NT_STATUS_OK;
 216         }
 217
 218         if (strncmp((const char *)data.dptr,
 219                     ALLOC_RANGE,
 220                     strlen(ALLOC_RANGE)) == 0) {
 221                 /*
 222                  * this is from the alloc range, check if there is a mapping
 223                  */
 224                 DEBUG(5, ("id %d belongs to allocation range, "
 225                           "checking for mapping\n",
 226                           map->xid.id));
 227                 TALLOC_FREE(data.dptr);
 228                 return idmap_autorid_id_to_sid_alloc(dom, map);
 229         }
 230
 231         ok = dom_sid_parse_endp((const char *)data.dptr, &domsid, &q);
 232         TALLOC_FREE(data.dptr);
 233         if (!ok) {
 234                 map->status = ID_UNKNOWN;
 235                 return NT_STATUS_OK;
 236         }
 237         if ((q != NULL) && (*q != '\0'))
 238                 if (sscanf(q+1, "%"SCNu32, &domain_range_index) != 1) {
 239                         DEBUG(10, ("Domain range index not found, "
 240                                    "ignoring mapping request\n"));
 241                         map->status = ID_UNKNOWN;
 242                         return NT_STATUS_OK;
 243                 }
 244
 245         reduced_rid = normalized_id % cfg->rangesize;
 246         rid = reduced_rid + domain_range_index * cfg->rangesize;
 247
 248         sid_compose(map->sid, &domsid, rid);
 249
 250         /* We **really** should have some way of validating
 251            the SID exists and is the correct type here.  But
 252            that is a deficiency in the idmap_rid design. */
 253
 254         map->status = ID_MAPPED;
 255         map->xid.type = ID_TYPE_BOTH;
 256
 257         return NT_STATUS_OK;
 258 }
 259
 260 /**********************************
 261  Single sid to id lookup function.
 262 **********************************/
 263
 264 static NTSTATUS idmap_autorid_sid_to_id_rid(
 265                                         struct autorid_global_config *global,
 266                                         struct autorid_range_config *range,
 267                                         struct id_map *map)
 268 {
 269         uint32_t rid;
 270         uint32_t reduced_rid;
 271
 272         sid_peek_rid(map->sid, &rid);
 273
 274         reduced_rid = rid % global->rangesize;
 275
 276         map->xid.id = reduced_rid + range->low_id;
 277         map->xid.type = ID_TYPE_BOTH;
 278         map->status = ID_MAPPED;
 279
 280         return NT_STATUS_OK;
 281 }
 282
 283 /**********************************
 284  lookup a set of unix ids.
 285 **********************************/
 286
 287 static NTSTATUS idmap_autorid_unixids_to_sids(struct idmap_domain *dom,
 288                                               struct id_map **ids)
 289 {
 290         struct idmap_tdb_common_context *commoncfg;
 291         struct autorid_global_config *globalcfg;
 292         NTSTATUS ret;
 293         int i;
 294         int num_tomap = 0;
 295         int num_mapped = 0;
 296
 297         /* initialize the status to avoid surprise */
 298         for (i = 0; ids[i]; i++) {
 299                 ids[i]->status = ID_UNKNOWN;
 300                 num_tomap++;
 301         }
 302
 303         commoncfg =
 304             talloc_get_type_abort(dom->private_data,
 305                                   struct idmap_tdb_common_context);
 306
 307         globalcfg = talloc_get_type(commoncfg->private_data,
 308                                     struct autorid_global_config);
 309
 310         for (i = 0; ids[i]; i++) {
 311
 312                 ret = idmap_autorid_id_to_sid(globalcfg, dom, ids[i]);
 313
 314                 if ((!NT_STATUS_IS_OK(ret)) &&
 315                     (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 316                         /* some fatal error occurred, log it */
 317                         DEBUG(3, ("Unexpected error resolving an ID "
 318                                   " (%d)\n", ids[i]->xid.id));
 319                         goto failure;
 320                 }
 321
 322                 if (NT_STATUS_IS_OK(ret) && ids[i]->status == ID_MAPPED) {
 323                         num_mapped++;
 324                 }
 325
 326         }
 327
 328         if (num_tomap == num_mapped) {
 329                 return NT_STATUS_OK;
 330         } else if (num_mapped == 0) {
 331                 return NT_STATUS_NONE_MAPPED;
 332         }
 333
 334         return STATUS_SOME_UNMAPPED;
 335
 336
 337       failure:
 338         return ret;
 339 }
 340
 341 /*
 342  * map a SID to xid using the idmap_tdb like pool
 343  */
 344 static NTSTATUS idmap_autorid_sid_to_id_alloc(struct idmap_domain *dom,
 345                                         struct id_map *map,
 346                                         struct idmap_tdb_common_context *ctx)
 347 {
 348         NTSTATUS ret;
 349         int res;
 350
 351         map->status = ID_UNKNOWN;
 352
 353         /* see if we already have a mapping */
 354         ret = idmap_tdb_common_sid_to_unixid(dom, map);
 355
 356         if (NT_STATUS_IS_OK(ret)) {
 357                 map->status = ID_MAPPED;
 358                 return ret;
 359         }
 360
 361         /* bad things happened */
 362         if (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
 363                 DEBUG(1, ("Looking up SID->ID mapping for %s failed: %s\n",
 364                           sid_string_dbg(map->sid), nt_errstr(ret)));
 365                 return ret;
 366         }
 367
 368         if (dom->read_only) {
 369                 DEBUG(3, ("Not allocating new mapping for %s, because backend "
 370                           "is read-only\n", sid_string_dbg(map->sid)));
 371                 map->status = ID_UNMAPPED;
 372                 return NT_STATUS_NONE_MAPPED;
 373         }
 374
 375         DEBUG(10, ("Creating new mapping in pool for %s\n",
 376                    sid_string_dbg(map->sid)));
 377
 378         /* create new mapping */
 379         res = dbwrap_transaction_start(ctx->db);
 380         if (res != 0) {
 381                 DEBUG(2, ("transaction_start failed\n"));
 382                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 383         }
 384
 385         ret = idmap_tdb_common_new_mapping(dom, map);
 386         if (!NT_STATUS_IS_OK(ret)) {
 387                 if (dbwrap_transaction_cancel(ctx->db) != 0) {
 388                         smb_panic("Cancelling transaction failed");
 389                 }
 390                 map->status = ID_UNMAPPED;
 391                 return ret;
 392         }
 393
 394         res = dbwrap_transaction_commit(ctx->db);
 395         if (res == 0) {
 396                 map->status = ID_MAPPED;
 397                 return NT_STATUS_OK;
 398         }
 399
 400         DEBUG(2, ("transaction_commit failed\n"));
 401         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 402
 403 }
 404
 405 /**********************************
 406  lookup a set of sids.
 407 **********************************/
 408
 409 static NTSTATUS idmap_autorid_sids_to_unixids(struct idmap_domain *dom,
 410                                               struct id_map **ids)
 411 {
 412         struct idmap_tdb_common_context *commoncfg;
 413         struct autorid_global_config *global;
 414         NTSTATUS ret;
 415         int i;
 416         int num_tomap = 0;
 417         int num_mapped = 0;
 418
 419         /* initialize the status to avoid surprise */
 420         for (i = 0; ids[i]; i++) {
 421                 ids[i]->status = ID_UNKNOWN;
 422                 num_tomap++;
 423         }
 424
 425         commoncfg =
 426             talloc_get_type_abort(dom->private_data,
 427                                   struct idmap_tdb_common_context);
 428
 429         global = talloc_get_type(commoncfg->private_data,
 430                                  struct autorid_global_config);
 431
 432         for (i = 0; ids[i]; i++) {
 433                 struct winbindd_tdc_domain *domain;
 434                 struct autorid_range_config range;
 435                 uint32_t rid;
 436                 struct dom_sid domainsid;
 437
 438                 ZERO_STRUCT(range);
 439
 440                 DEBUG(10, ("Trying to map %s\n", sid_string_dbg(ids[i]->sid)));
 441
 442                 sid_copy(&domainsid, ids[i]->sid);
 443                 if (!sid_split_rid(&domainsid, &rid)) {
 444                         DEBUG(4, ("Could not determine domain SID from %s, "
 445                                   "ignoring mapping request\n",
 446                                   sid_string_dbg(ids[i]->sid)));
 447                         continue;
 448                 }
 449
 450                 /* is this a well-known SID? */
 451
 452                 if (sid_check_is_wellknown_domain(&domainsid, NULL)) {
 453
 454                         DEBUG(10, ("SID %s is well-known, using pool\n",
 455                                    sid_string_dbg(ids[i]->sid)));
 456
 457                         ret = idmap_autorid_sid_to_id_alloc(dom, ids[i],
 458                                                             commoncfg);
 459
 460                         if (!NT_STATUS_IS_OK(ret) &&
 461                             !NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
 462                                 DEBUG(3, ("Unexpected error resolving "
 463                                           "SID (%s)\n",
 464                                           sid_string_dbg(ids[i]->sid)));
 465                                 goto failure;
 466                         }
 467
 468                         if (NT_STATUS_IS_OK(ret) && ids[i]->status == ID_MAPPED) {
 469                                 num_mapped++;
 470                         }
 471
 472                         continue;
 473                 }
 474
 475                 /* BUILTIN is passdb's job */
 476                 if (dom_sid_equal(&domainsid, &global_sid_Builtin) &&
 477                     ignore_builtin) {
 478                         DEBUG(10, ("Ignoring request for BUILTIN domain\n"));
 479                         continue;
 480                 }
 481
 482                 /*
 483                  * Check if the domain is around
 484                  */
 485                 domain = wcache_tdc_fetch_domainbysid(talloc_tos(),
 486                                                       &domainsid);
 487                 if (domain == NULL) {
 488                         DEBUG(10, ("Ignoring unknown domain sid %s\n",
 489                                    sid_string_dbg(&domainsid)));
 490                         continue;
 491                 }
 492                 TALLOC_FREE(domain);
 493
 494                 sid_to_fstring(range.domsid, &domainsid);
 495
 496                 /* Calculate domain_range_index for multi-range support */
 497                 range.domain_range_index = rid / (global->rangesize);
 498
 499                 ret = idmap_autorid_get_domainrange(autorid_db, &range,
 500                                                     dom->read_only);
 501
 502                 /* read-only mode and a new domain range would be required? */
 503                 if (NT_STATUS_EQUAL(ret, NT_STATUS_NOT_FOUND) &&
 504                     dom->read_only) {
 505                         DEBUG(10, ("read-only is enabled, did not allocate "
 506                                    "new range for domain %s\n",
 507                                    sid_string_dbg(&domainsid)));
 508                         continue;
 509                 }
 510
 511                 if (!NT_STATUS_IS_OK(ret)) {
 512                         DEBUG(3, ("Could not determine range for domain, "
 513                                   "check previous messages for reason\n"));
 514                         goto failure;
 515                 }
 516
 517                 ret = idmap_autorid_sid_to_id_rid(global, &range, ids[i]);
 518
 519                 if ((!NT_STATUS_IS_OK(ret)) &&
 520                     (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 521                         /* some fatal error occurred, log it */
 522                         DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
 523                                   sid_string_dbg(ids[i]->sid)));
 524                         goto failure;
 525                 }
 526
 527                 if (NT_STATUS_IS_OK(ret) && ids[i]->status == ID_MAPPED) {
 528                         num_mapped++;
 529                 }
 530         }
 531
 532         if (num_tomap == num_mapped) {
 533                 return NT_STATUS_OK;
 534         } else if (num_mapped == 0) {
 535                 return NT_STATUS_NONE_MAPPED;
 536         }
 537
 538         return STATUS_SOME_UNMAPPED;
 539
 540       failure:
 541         return ret;
 542
 543 }
 544
 545 static NTSTATUS idmap_autorid_preallocate_wellknown(struct idmap_domain *dom)
 546 {
 547         const char *groups[] = { "S-1-1-0", "S-1-2-0", "S-1-2-1",
 548                 "S-1-3-0", "S-1-3-1", "S-1-3-2", "S-1-3-3", "S-1-3-4",
 549                 "S-1-5-1", "S-1-5-2", "S-1-5-3", "S-1-5-4", "S-1-5-6",
 550                 "S-1-5-7", "S-1-5-8", "S-1-5-9", "S-1-5-10", "S-1-5-11",
 551                 "S-1-5-12", "S-1-5-13", "S-1-5-14", "S-1-5-15",
 552                 "S-1-5-17", "S-1-5-18", "S-1-5-19", "S-1-5-20"
 553         };
 554
 555         struct id_map **maps;
 556         int i, num;
 557         NTSTATUS status;
 558
 559         if (dom->read_only) {
 560                 return NT_STATUS_OK;
 561         }
 562
 563         num = ARRAY_SIZE(groups);
 564
 565         maps = talloc_array(talloc_tos(), struct id_map*, num+1);
 566         if (!maps) {
 567                 return NT_STATUS_NO_MEMORY;
 568         }
 569
 570         for (i = 0; i < num; i++) {
 571                 maps[i] = talloc(maps, struct id_map);
 572                 if (maps[i] == NULL) {
 573                         talloc_free(maps);
 574                         return NT_STATUS_NO_MEMORY;
 575                 }
 576                 maps[i]->xid.type = ID_TYPE_GID;
 577                 maps[i]->sid = dom_sid_parse_talloc(maps, groups[i]);
 578         }
 579
 580         maps[num] = NULL;
 581
 582         status = idmap_autorid_sids_to_unixids(dom, maps);
 583
 584         DEBUG(10,("Preallocation run finished with status %s\n",
 585                   nt_errstr(status)));
 586
 587         talloc_free(maps);
 588
 589         return NT_STATUS_IS_OK(status)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
 590 }
 591
 592 static NTSTATUS idmap_autorid_initialize_action(struct db_context *db,
 593                                                 void *private_data)
 594 {
 595         struct idmap_domain *dom;
 596         struct idmap_tdb_common_context *common;
 597         struct autorid_global_config *config;
 598         NTSTATUS status;
 599
 600         dom = (struct idmap_domain *)private_data;
 601         common = (struct idmap_tdb_common_context *)dom->private_data;
 602         config = (struct autorid_global_config *)common->private_data;
 603
 604         status = idmap_autorid_init_hwms(db);
 605         if (!NT_STATUS_IS_OK(status)) {
 606                 return status;
 607         }
 608
 609         status = idmap_autorid_saveconfig(db, config);
 610         if (!NT_STATUS_IS_OK(status)) {
 611                 DEBUG(1, ("Failed to store configuration data!\n"));
 612                 return status;
 613         }
 614
 615         status = idmap_autorid_preallocate_wellknown(dom);
 616         if (!NT_STATUS_IS_OK(status)) {
 617                 DEBUG(1, ("Failed to preallocate wellknown sids: %s\n",
 618                           nt_errstr(status)));
 619                 return status;
 620         }
 621
 622         return NT_STATUS_OK;
 623 }
 624
 625 static NTSTATUS idmap_autorid_initialize(struct idmap_domain *dom)
 626 {
 627         struct idmap_tdb_common_context *commonconfig;
 628         struct autorid_global_config *config;
 629         NTSTATUS status;
 630
 631         if (!strequal(dom->name, "*")) {
 632                 DEBUG(0, ("idmap_autorid_initialize: Error: autorid configured "
 633                           "for domain '%s'. But autorid can only be used for "
 634                           "the default idmap configuration.\n", dom->name));
 635                 return NT_STATUS_INVALID_PARAMETER;
 636         }
 637
 638         commonconfig = talloc_zero(dom, struct idmap_tdb_common_context);
 639         if (!commonconfig) {
 640                 DEBUG(0, ("Out of memory!\n"));
 641                 return NT_STATUS_NO_MEMORY;
 642         }
 643         dom->private_data = commonconfig;
 644
 645         commonconfig->rw_ops = talloc_zero(commonconfig, struct idmap_rw_ops);
 646         if (commonconfig->rw_ops == NULL) {
 647                 DEBUG(0, ("Out of memory!\n"));
 648                 return NT_STATUS_NO_MEMORY;
 649         }
 650
 651         config = talloc_zero(commonconfig, struct autorid_global_config);
 652         if (!config) {
 653                 DEBUG(0, ("Out of memory!\n"));
 654                 return NT_STATUS_NO_MEMORY;
 655         }
 656         commonconfig->private_data = config;
 657
 658         config->minvalue = dom->low_id;
 659         config->rangesize = lp_parm_int(-1, "idmap config *",
 660                                         "rangesize", 100000);
 661
 662         config->maxranges = (dom->high_id - dom->low_id + 1) /
 663             config->rangesize;
 664
 665         if (config->maxranges == 0) {
 666                 DEBUG(1, ("Allowed uid range is smaller than rangesize. "
 667                           "Increase uid range or decrease rangesize.\n"));
 668                 status = NT_STATUS_INVALID_PARAMETER;
 669                 goto error;
 670         }
 671
 672         /* check if the high-low limit is a multiple of the rangesize */
 673         if ((dom->high_id - dom->low_id + 1) % config->rangesize != 0) {
 674                 DEBUG(5, ("High uid-low uid difference of %d "
 675                           "is not a multiple of the rangesize %d, "
 676                           "limiting ranges to lower boundary number of %d\n",
 677                           (dom->high_id - dom->low_id + 1), config->rangesize,
 678                           config->maxranges));
 679         }
 680
 681         DEBUG(5, ("%d domain ranges with a size of %d are available\n",
 682                   config->maxranges, config->rangesize));
 683
 684         ignore_builtin = lp_parm_bool(-1, "idmap config *",
 685                                       "ignore builtin", false);
 686
 687         /* fill the TDB common configuration */
 688
 689         commonconfig->max_id = config->rangesize -1;
 690         commonconfig->hwmkey_uid = ALLOC_HWM_UID;
 691         commonconfig->hwmkey_gid = ALLOC_HWM_GID;
 692         commonconfig->rw_ops->get_new_id = idmap_autorid_allocate_id;
 693         commonconfig->rw_ops->set_mapping = idmap_tdb_common_set_mapping;
 694
 695         status = idmap_autorid_db_open(state_path("autorid.tdb"),
 696                                        NULL, /* TALLOC_CTX */
 697                                        &autorid_db);
 698         if (!NT_STATUS_IS_OK(status)) {
 699                 goto error;
 700         }
 701
 702         commonconfig->db = autorid_db;
 703
 704         status = dbwrap_trans_do(autorid_db,
 705                                  idmap_autorid_initialize_action,
 706                                  dom);
 707         if (!NT_STATUS_IS_OK(status)) {
 708                 DEBUG(1, ("Failed to init the idmap database: %s\n",
 709                           nt_errstr(status)));
 710                 goto error;
 711         }
 712
 713         goto done;
 714
 715 error:
 716         talloc_free(config);
 717
 718 done:
 719         return status;
 720 }
 721
 722 /*
 723   Close the idmap tdb instance
 724 */
 725 static struct idmap_methods autorid_methods = {
 726         .init = idmap_autorid_initialize,
 727         .unixids_to_sids = idmap_autorid_unixids_to_sids,
 728         .sids_to_unixids = idmap_autorid_sids_to_unixids,
 729         .allocate_id     = idmap_autorid_allocate_id
 730 };
 731
 732 NTSTATUS idmap_autorid_init(void)
 733 {
 734         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
 735                                   "autorid", &autorid_methods);
 736 }